Context
Related: rubykatzen/starcast#102 — while auditing GitHub Actions spend for dupmachine, I found that private caller repos (e.g. dupmachine/ground-control) get billed for minutes even when the actual job runs via a workflow_call into a public repo like this one. GitHub's new ubuntu-slim runner (1 vCPU / 5 GB RAM, $0.002/min vs ubuntu-latest's $0.006/min — 3.33x cheaper) is a good fit for anything short-running with no Docker/privileged needs.
lint-shared.yml is exactly the kind of frequent, short job that would benefit — it's what ground-control's own lint.yml calls on every push/PR with linters: pymarkdown, ruff, yamllint, actionlint, pre-commit.
Why it's not a clean switch
Looking at setup-runtimes, the linters split into two groups:
- Fine on slim as-is:
yamllint, pymarkdown, ruff, tombi, pre-commit — plain pip install, no elevated privileges. - Needs verification:
shellcheck and actionlint install via sudo install ... /usr/local/bin/.... ubuntu-slim's container runs in unprivileged mode, so it's unclear whether sudo is even present/functional there. rubocop/erb-lint/herb go through ruby/setup-ruby@v1 with bundler-cache: true, which is a heavier runtime setup (possible native gem compilation) — unclear if it reliably fits slim's 1 vCPU/5 GB/15-minute budget.
Since actionlint is already in ground-control's active linter list, this isn't a hypothetical — the sudo-based install is in the hot path for at least one real consumer today.
Proposal
Not asking for a blanket switch. Two options worth considering:
- Test empirically first — try
ubuntu-slim on a repo using shellcheck/actionlint/rubocop and see whether sudo and ruby/setup-ruby actually work in the unprivileged container. - Rework the installs to not need
sudo — install shellcheck/actionlint to a user-writable path (e.g. $HOME/.local/bin, added to $GITHUB_PATH) instead of /usr/local/bin. That would remove the privilege dependency and make ubuntu-slim usable for the full linter set, not just the pip-based ones.
Happy to help test either path if useful.
Context
Related: rubykatzen/starcast#102 — while auditing GitHub Actions spend for
dupmachine, I found that private caller repos (e.g.dupmachine/ground-control) get billed for minutes even when the actual job runs via aworkflow_callinto a public repo like this one. GitHub's newubuntu-slimrunner (1 vCPU / 5 GB RAM, $0.002/min vsubuntu-latest's $0.006/min — 3.33x cheaper) is a good fit for anything short-running with no Docker/privileged needs.lint-shared.ymlis exactly the kind of frequent, short job that would benefit — it's whatground-control's ownlint.ymlcalls on every push/PR withlinters: pymarkdown, ruff, yamllint, actionlint, pre-commit.Why it's not a clean switch
Looking at
setup-runtimes, the linters split into two groups:yamllint,pymarkdown,ruff,tombi,pre-commit— plainpip install, no elevated privileges.shellcheckandactionlintinstall viasudo install ... /usr/local/bin/....ubuntu-slim's container runs in unprivileged mode, so it's unclear whethersudois even present/functional there.rubocop/erb-lint/herbgo throughruby/setup-ruby@v1withbundler-cache: true, which is a heavier runtime setup (possible native gem compilation) — unclear if it reliably fits slim's 1 vCPU/5 GB/15-minute budget.Since
actionlintis already inground-control's active linter list, this isn't a hypothetical — the sudo-based install is in the hot path for at least one real consumer today.Proposal
Not asking for a blanket switch. Two options worth considering:
ubuntu-slimon a repo usingshellcheck/actionlint/rubocopand see whethersudoandruby/setup-rubyactually work in the unprivileged container.sudo— installshellcheck/actionlintto a user-writable path (e.g.$HOME/.local/bin, added to$GITHUB_PATH) instead of/usr/local/bin. That would remove the privilege dependency and makeubuntu-slimusable for the full linter set, not just the pip-based ones.Happy to help test either path if useful.