ci: prune workflow runs on a schedule instead of by hand - #62
Merged
Conversation
Keep warm pings four times an hour through waking hours: about 64 runs a day, 450 a week. Left alone it buries everything else. The run list reached 881 entries, 426 of them pings, and a real Deploy failure sat in it unnoticed from 17 to 24 August — the noise was not cosmetic, it hid an outage. Not fixed by slowing the ping. keep-warm.yml already explains that fifteen minutes is the loose end of what beats a twenty-minute idle unload, so widening it trades away the thing it exists for. Keep the cadence; stop keeping the runs. Retention follows what a run is evidence of. A ping proves nothing after the next ping, so Keep warm is kept one day. CI, CodeQL, Gitleaks, Deploy and Dependency Review are the audit trail and are kept thirty days — the window where "when did this start failing?" is still answerable, which is exactly the question that went unanswered for a week. Runs still in progress are never deleted. workflow_dispatch takes a dry_run input that lists what would go without deleting anything. Uses only the gh CLI and github.token, so no third-party action and no allowlist entry. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The repository's own rules rejected the first version of prune-runs.yml: GHA002 against permissions: actions: write at workflow scope. The rule was right — a write granted there applies to every job the file ever grows. Moved to the one job that needs it, which is how deploy.yml is already written. That still reports, and correctly: actions: write is a real write, and unlike id-token it reaches the repository. There is no narrower grant for deleting a run, so it goes in the Accepted list with the cost written down rather than implied — the job can delete any run in the repository, including the audit trail it exists to keep readable. It checks out nothing and reads no secret. Accepted is exact: a second finding in the same file still fails, and an entry whose finding stops appearing fails too, so this cannot outlive its reason. 193 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The run list had reached 881 entries, 426 of them Keep warm pings — and a genuine Deploy failure sat in that list unnoticed from 17 to 24 August. The noise was not cosmetic; it hid an outage for a week.
Why not just slow the ping down
keep-warm.ymlalready answers that: fifteen minutes is the loose end of what reliably beats a twenty-minute idle unload, and GitHub delays scheduled runs under load. Widening the interval trades away the thing the workflow exists to do.So the cadence stays and the runs go.
Retention by what a run is evidence of
Thirty days covers the window where "when did this start failing?" is still answerable — precisely the question that went unanswered here.
Safety
workflow_dispatchaccepts adry_runinput that lists what would be deleted without deleting itghCLI andgithub.token— no third-party action, so no allowlist entry neededpermissions: actions: writeand nothing else; no checkout, no contents accessactionlintclean; the allowlist guard from #60 passes.