sindresorhus/ky CI report

The wait

The slow part of macOS CI

macOS jobs on GitHub-hosted started in a median of 7s over 19 jobs: a short queue for this repository.

At a glance

Prices from GitHub's published rates, checked 6 October 2026

At GitHub's rates$75a month, 100% of it macOS. Free here: the repository is public.

If it were private14 monthsfor a $899 Mac mini plus Personal at $10 a month to pay for itself

Fixes found94 save minutes, 3 close security gaps, 2 add safeguards

What to fix

Sorted by risk and saving

Finding	Severity	Saving
macOS runner with no Apple toolchain stepsR04, main.yml, 2 places	High	1,093 min a month
Dependency install with no cacheR05, main.yml, 2 places	Medium	135 min a month
GITHUB_TOKEN wider than the job needsR16, main.yml	Medium risk	Security
Job without timeout-minutesR06, main.yml, 2 places	Medium	Safeguard
Action referenced by tag or branch, not a commit SHAR17, main.yml, 2 places	Low risk	Security

R04 in main.yml, test Job "test" runs on macOS but no step needs an Apple toolchain. Confidence 90%.

Confirm before merging: no step in job "test" needs macOS; every step was classified as portable.

 jobs:
   test:
     name: Node.js ${{ matrix.node-version }}
-    runs-on: macos-latest
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:

R04 in main.yml, browser Job "browser" runs on macOS but no step needs an Apple toolchain. Confidence 90%.

Confirm before merging: no step in job "browser" needs macOS; every step was classified as portable.

   # The browser tests, linting, build, and type checks do not depend on the Node.js version, so they run only once.
   browser:
     name: Browsers and static checks
-    runs-on: macos-latest
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v6

Every fix is free. Open them as pull requests with npx buildhound scan --fix.

Put your Mac mini to work.

One prompt into Claude Code, Codex or Cursor. Linux jobs run on your Mac within minutes; macOS jobs follow once the Mac has built its image.

Set up by hand

No GitHub credential on the machine
A fresh VM per job, off your network
Your agent prepares, you approve
How security works