agent-scan workflow (storybookjs/storybook)
The agent-scan workflow from storybookjs/storybook, explained and optimized by Latchkey.
- A
- CI health grade
- 85/100
- Health score
- 1
- Job per trigger
- 2
- Fixes in the optimized version
In short
- CI health: A (excellent)
- The optimized version below points runs-on at Latchkey managed runners and adds job timeouts.
What it does
This is the agent-scan workflow from the storybookjs/storybook repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.
Below, Latchkey shows a faster, safer version produced by its optimization engine.
The workflow
workflow (.yml)
###################################################################################################
# #
# ██ #
# ██░░██ #
# ░░ ░░ ██░░░░░░██ ░░░░ #
# ██░░░░░░░░░░██ #
# ██░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░██ #
# ██░░░░░░██████░░░░░░██ #
# ██░░░░░░██████░░░░░░██ #
# ██░░░░░░░░██████░░░░░░░░██ #
# ██░░░░░░░░██████░░░░░░░░██ #
# ██░░░░░░░░░░██████░░░░░░░░░░██ #
# ██░░░░░░░░░░░░██████░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░██████░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░██████░░░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░░░██████░░░░░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░░░██████░░░░░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░░░░░██████░░░░░░░░░░░░░░░░░░██ #
# ░░ ██░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░██ #
# ██████████████████████████████████████████ #
# #
# #
# SECURITY WARNING: Ensure your `pull_request_target` job respects the following rules: #
# #
# - Never write to GitHub Actions cache, as it would allow cache poisoning attacks #
# - Only call third-party systems that are aware the code passed to them could be untrustworthy #
# - Always set explicit permissions on your PR to limit the capabilities of secrets.GITHUB_TOKEN #
# #
###################################################################################################
name: agent-scan
# Start with empty permissions on `pull_request_target`, then set permissions per job as needed.
permissions: {}
on:
# Use `pull_request_target` so we can run this workflow on PRs from forks, as its goal is to assess
# if PR authors are trustworthy. Only reasons on the PR author and does not check out the fork code.
# zizmor: ignore[dangerous-triggers] # required for fork PRs; no fork code is checked out
pull_request_target:
types:
- opened
- reopened
branches:
- next
- main
concurrency:
group: agent-scan-${{ github.event.pull_request.number }}
cancel-in-progress: true
jobs:
agentscan:
if: |
github.repository_owner == 'storybookjs' &&
github.event.pull_request.head.repo.full_name != github.repository &&
!contains(
fromJSON('["dependabot[bot]", "github-actions[bot]","storybook-bot"]'),
github.event.pull_request.user.login
)
runs-on: ubuntu-latest
permissions:
pull-requests: write
contents: read
steps:
- name: Checkout code from `next`/`main` branch (trusted code, not PR author code)
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.event.pull_request.base.sha }}
persist-credentials: false
- name: Install script dependencies
run: npm install --prefix .github/scripts
- name: Check author org membership
id: membership
env:
INPUT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
INPUT_ORG: ${{ github.repository_owner }}
INPUT_USERNAME: ${{ github.event.pull_request.user.login }}
run: node .github/scripts/agent-scan-check-org-membership.mjs
- name: Cache AgentScan analysis
if: steps.membership.outputs.should-scan == 'true'
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: .agentscan-cache
# Safe because the cache is prefixed and only used here, and does not include
# user-controlled content (can't spoof another actor's identity).
key: agentscan-cache-${{ github.actor }}
- name: AgentScan
if: steps.membership.outputs.should-scan == 'true'
id: agentscan
uses: MatteoGabriele/agentscan-action@f41545309db947a68e22ed2643f182e754f4d41a # v1.8.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
agent-scan-comment: false
cache-path: .agentscan-cache
label-community-flagged: 'agent-scan:community-flagged'
label-mixed: 'agent-scan:mixed'
label-automation: 'agent-scan:automated'
- name: Label PR with classification
if: steps.membership.outputs.should-scan == 'true' && steps.agentscan.outputs.classification
env:
INPUT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
INPUT_CLASSIFICATION: ${{ steps.agentscan.outputs.classification }}
run: node .github/scripts/agent-scan-label-pr.mjsThe same workflow, on Latchkey
Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.
workflow (.yml), optimized
###################################################################################################
# #
# ██ #
# ██░░██ #
# ░░ ░░ ██░░░░░░██ ░░░░ #
# ██░░░░░░░░░░██ #
# ██░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░██ #
# ██░░░░░░██████░░░░░░██ #
# ██░░░░░░██████░░░░░░██ #
# ██░░░░░░░░██████░░░░░░░░██ #
# ██░░░░░░░░██████░░░░░░░░██ #
# ██░░░░░░░░░░██████░░░░░░░░░░██ #
# ██░░░░░░░░░░░░██████░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░██████░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░██████░░░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░░░██████░░░░░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░░░██████░░░░░░░░░░░░░░░░██ #
# ██░░░░░░░░░░░░░░░░░░██████░░░░░░░░░░░░░░░░░░██ #
# ░░ ██░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░██ #
# ██████████████████████████████████████████ #
# #
# #
# SECURITY WARNING: Ensure your `pull_request_target` job respects the following rules: #
# #
# - Never write to GitHub Actions cache, as it would allow cache poisoning attacks #
# - Only call third-party systems that are aware the code passed to them could be untrustworthy #
# - Always set explicit permissions on your PR to limit the capabilities of secrets.GITHUB_TOKEN #
# #
###################################################################################################
name: agent-scan
# Start with empty permissions on `pull_request_target`, then set permissions per job as needed.
permissions: {}
on:
# Use `pull_request_target` so we can run this workflow on PRs from forks, as its goal is to assess
# if PR authors are trustworthy. Only reasons on the PR author and does not check out the fork code.
# zizmor: ignore[dangerous-triggers] # required for fork PRs; no fork code is checked out
pull_request_target:
types:
- opened
- reopened
branches:
- next
- main
concurrency:
group: agent-scan-${{ github.event.pull_request.number }}
cancel-in-progress: true
jobs:
agentscan:
timeout-minutes: 30
if: |
github.repository_owner == 'storybookjs' &&
github.event.pull_request.head.repo.full_name != github.repository &&
!contains(
fromJSON('["dependabot[bot]", "github-actions[bot]","storybook-bot"]'),
github.event.pull_request.user.login
)
runs-on: ubuntu-latest
runs-on: latchkey-small
permissions:
pull-requests: write
contents: read
steps:
- name: Checkout code from `next`/`main` branch (trusted code, not PR author code)
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.event.pull_request.base.sha }}
persist-credentials: false
- name: Install script dependencies
run: npm install --prefix .github/scripts
- name: Check author org membership
id: membership
env:
INPUT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
INPUT_ORG: ${{ github.repository_owner }}
INPUT_USERNAME: ${{ github.event.pull_request.user.login }}
run: node .github/scripts/agent-scan-check-org-membership.mjs
- name: Cache AgentScan analysis
if: steps.membership.outputs.should-scan == 'true'
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: .agentscan-cache
# Safe because the cache is prefixed and only used here, and does not include
# user-controlled content (can't spoof another actor's identity).
key: agentscan-cache-${{ github.actor }}
- name: AgentScan
if: steps.membership.outputs.should-scan == 'true'
id: agentscan
uses: MatteoGabriele/agentscan-action@f41545309db947a68e22ed2643f182e754f4d41a # v1.8.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
agent-scan-comment: false
cache-path: .agentscan-cache
label-community-flagged: 'agent-scan:community-flagged'
label-mixed: 'agent-scan:mixed'
label-automation: 'agent-scan:automated'
- name: Label PR with classification
if: steps.membership.outputs.should-scan == 'true' && steps.agentscan.outputs.classification
env:
INPUT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
INPUT_CLASSIFICATION: ${{ steps.agentscan.outputs.classification }}
run: node .github/scripts/agent-scan-label-pr.mjs
What changed
- Run on Latchkey managed runners with one line (
runs-on), which apply the fixes below automatically and self-heal transient failures. Each Linux x64 job moves to the Latchkey size matching its vCPU count,latchkey-smallfor a standard 2 vCPU runner; macOS, Windows and arm64 jobs stay as written. - Add a job timeout so a hung step cannot burn hours of runner time.
What Latchkey heals here
This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:
- Dependency installs
This workflow runs 1 job per trigger. It runs on a standard GitHub-hosted Linux x64 runner, which in a private repository bills $0.006 a minute against $0.0025 on latchkey-small, 58% lower; in a public repository like this one it is free. Estimate the monthly difference with your own run counts.
Actions used in this workflow
- actions/checkout
- actions/cache
- MatteoGabriele/agentscan-action
Frequently asked questions
What does the agent-scan workflow (storybookjs/storybook) workflow do?
This is the agent-scan workflow from the storybookjs/storybook repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.
What CI health grade does this workflow get?
This Automation and other workflow grades A. Paste your own workflow into the Latchkey grader to see its grade and the exact fixes.
How can I improve this Automation and other workflow?
Add job timeouts. Latchkey applies these automatically on managed runners when you point runs-on at Latchkey.