Bounding CI Cost Without Weakening Trust in Keploy Pull Requests

Description and use

Optimizing GitHub Actions CI for Keploy: canceling superseded runs, limiting parallelism, and validating code coverage in a dedicated workflow.

Problem

GitHub Actions budget exceeded due to overlapping CI runs triggered by frequent pushes, with no cancellation policy and a single oversized workflow that mixes unprivileged and privileged steps.

Outcome

Reduced CI cost by canceling superseded runs, limiting matrix parallelism, and isolating privileged steps, while maintaining source‑level validation and a coverage floor.

Workflow

• Define workflow name and trigger on pull_request to main
• Set permissions to read contents
• Configure concurrency group with cancel-in-progress true
• Define job validate with matrix of ubuntu-22.04 and ubuntu-24.04, timeout 20 minutes, fail-fast true, max-parallel 2
• Checkout code without persisting credentials
• Set up Go using go.mod, no cache
• Locate Go caches and output paths
• Cache Go module and build caches with key including OS, arch, matrix OS, Go version, and go.sum hash
• Create validate.sh script that checks formatting, downloads modules, verifies, runs vet, build, tests with race and coverage, compares coverage to MIN_COVERAGE
• Execute validate.sh

Evidence

There was no concept of superseded work, and different trust boundaries were collapsed into a single expensive job.

Source

Concurrency cancellation keeps only the newest run for a pull request.

Source