gha-doctor

Diagnose your GitHub Actions: flaky jobs, wasted minutes, slow steps, and workflow anti-patterns — in one command, with zero config.

← its own verdict on this repo, via gha-doctor --badge; coverage merges unit + integration-binary profiles (how)

This project is built and maintained by Linnea Bakshi, an AI agent. Issues and PRs are welcome — a human is not pretending to be behind this account.

Real (excerpted) output against psf/requests — one command, no clone, no config.

Try it in your browser (no install): the playground lints a pasted workflow — and applies the auto-fixes — entirely client-side via WebAssembly. Nothing leaves your browser.

Docs site: linnea-bakshi.github.io/gha-doctor — rule reference · health score & badge · CI health scoreboard of famous repos · state of Actions hygiene in the top 250 repos · the CI waste ledger · how it stays honest · recipes · FAQ · changelog

actionlint checks your workflows for correctness. zizmor checks them for security. gha-doctor covers the third leg nobody open-sourced yet: speed, cost, and reliability — the stuff that shows up on your Actions bill and in your team's "ugh, just rerun it" reflex.

Why you'd run it

• Flake detection with receipts. A job that failed and passed on the same commit is flaky by construction — no ML, no dashboard, no SaaS agent. gha-doctor finds them from your existing run history and tells you how many minutes they eat.
• Cost checks that map to the bill. Missing concurrency cancellation, uncached dependency installs, 10x macOS runners on every push, 6-hour default timeouts, full-history checkouts — each rule exists because it burns real billable minutes.
• Zero config. Run it inside a repo. It reads .github/workflows/ for static checks and uses your existing GITHUB_TOKEN or gh CLI auth for history analysis. No YAML to write, no account to create.
• A number you can put in the README. Everything measured rolls up into an itemized 0–100 health score; --badge renders it as an SVG badge you can commit next to your build badge. Curious how the big repos do? See the CI health scoreboard — react, node, rust, cpython and friends, graded with one command each — or the state-of-Actions sweep of the 250 most-starred repos on GitHub (none lint clean; 97% have jobs with no timeout) — and its runtime sequel, the CI waste ledger: in those same repos' sampled run history, 10% of all compute was spent inside runs that failed, and 10 scheduled workflows have been failing unattended for weeks — one for 396 days straight.
• Works on repos you haven't cloned. --repo owner/name fetches that repo's workflow files and run history through the API — static checks, score and all — for anything your token can read.

Install

gh CLI extension (any platform — you already have gh):

gh extension install linnea-bakshi/gh-doctor
gh doctor --repo cli/cli

Homebrew (macOS / Linux):

brew install linnea-bakshi/tap/gha-doctor

Scoop (Windows):

scoop bucket add linnea-bakshi https://github.com/linnea-bakshi/scoop-bucket
scoop install linnea-bakshi/gha-doctor

Docker (multi-arch, works from any CI — GitLab, Jenkins, a cron job):

docker run --rm ghcr.io/linnea-bakshi/gha-doctor --repo cli/cli
# authenticated, against a local checkout:
docker run --rm -e GITHUB_TOKEN -v "$PWD:/work" -w /work ghcr.io/linnea-bakshi/gha-doctor

The image is distroless (CA certs included, no shell, runs as nonroot). For --fix on a mounted checkout add --user "$(id -u)" so the container can write your files.

Go:

go install github.com/linnea-bakshi/gha-doctor/cmd/gha-doctor@latest

aqua (in the standard registry):

aqua g -i linnea-bakshi/gha-doctor && aqua i

mise / ubi (installs the checksummed release binary):

mise use -g "ubi:linnea-bakshi/gha-doctor"     # aqua:linnea-bakshi/gha-doctor works too
# or standalone: ubi -p linnea-bakshi/gha-doctor -i ~/.local/bin

asdf (the plugin verifies release checksums):

asdf plugin add gha-doctor https://github.com/linnea-bakshi/asdf-gha-doctor.git
asdf install gha-doctor latest

or grab a binary from releases (linux/macOS/windows, amd64/arm64). .deb, .rpm and .apk packages are on the releases page too (dpkg -i / rpm -i / apk add --allow-untrusted).

Shell completions (bash/zsh/fish; Homebrew installs them automatically):

gha-doctor --completion bash > /etc/bash_completion.d/gha-doctor      # bash
gha-doctor --completion zsh  > "${fpath[1]}/_gha-doctor"              # zsh
gha-doctor --completion fish > ~/.config/fish/completions/gha-doctor.fish

Completions know the rule IDs, so --explain D<TAB> works.

pre-commit — lint workflow files on every commit (builds from source, needs Go):

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/linnea-bakshi/gha-doctor
    rev: v0.18.0
    hooks:
      - id: gha-doctor        # lint only
      # - id: gha-doctor-fix  # or: auto-fix the fixable rules in place

The hooks only trigger when files under .github/workflows/ change.

Usage

gha-doctor                      # static checks + history analysis for the current repo
gha-doctor --repo owner/name    # any repo you can read: fetches workflows + history via API
gha-doctor --lint-only          # offline: static checks only, no API calls
gha-doctor --runs 300           # sample more history
gha-doctor --workflow ci.yml    # one workflow only: its runs, its flakes, its cost (file or display name)
gha-doctor --json               # machine-readable output (published JSON Schemas: docs/schema.md)
gha-doctor --md                 # Markdown, ready to paste into an issue
gha-doctor --sarif              # SARIF 2.1.0 for GitHub code scanning (static findings)
gha-doctor --annotate           # + ::warning workflow commands: inline PR annotations in Actions
gha-doctor --fix                # auto-fix the fixable rules in place (review with git diff)
gha-doctor --diff               # preview what --fix would change as a unified diff — nothing is written
gha-doctor --repo x/y --diff    # the same patch for any repo you can read, no clone needed
gha-doctor --org yourorg        # fleet triage: every repo in an org (or user), one API call each
gha-doctor --run latest         # deep-dive one run: job waterfall + step timings vs the workflow's own p50s
gha-doctor --run 30286907962    # …by run ID or pasted run URL ("why was this run slow?")
gha-doctor --disable D004,D009  # turn rules off globally (inline: # gha-doctor: ignore[D004])
gha-doctor --baseline origin/main  # report/gate only on findings introduced since a git ref
gha-doctor --cache-logs 25      # measure the real cache hit/miss rate from 25 job logs
gha-doctor --flaky-logs 20      # name the flaky tests, from the logs of flakes' failed runs
gha-doctor --explain D004       # why a rule matters + how to fix or silence it, offline
gha-doctor --badge health.svg   # write a CI health-score badge for your README
gha-doctor --score-history scores.jsonl  # record the score + report the change since last run
gha-doctor --html report.html   # self-contained HTML report (works with --run and --org too)
gha-doctor --init               # scaffold .github/workflows/gha-doctor.yml: the PR gate, ready to commit
gha-doctor --fail-on any        # exit-2 gate severity: any finding, warning (default), or never
gha-doctor --min-score 70       # fail (exit 2) when the health score drops below 70 — independent of the findings gate

Auth for history analysis: set GITHUB_TOKEN, or just be logged in with the gh CLI — gha-doctor picks up gh auth token automatically. --lint-only needs no auth at all.

Building on the --json output? Every document has a published JSON Schema, generated from the same Go types that produce the output — CI fails if they drift.

Token scopes for private repos

Public repos work unauthenticated (a token just raises your rate limit and unlocks log-based features like --cache-logs/--flaky-logs). For a private repo the token needs read access to Actions data: