ci-free-tier-planner

name	ci-free-tier-planner
description	Select and continuously verify zero-cost or bounded-cost CI for public and private repositories using a freshness-enforced fact ledger, normalized resource units, plan gates, and no-surprise-spend controls. Use for CI provider/tier architecture and budgeting.
license	AGPL-3.0-or-later
compatibility	Codex and Agent Skills compatible; OpenCode discovers .agents/skills. Generate .claude/skills mirrors for Claude Code.
metadata	{"version":"1.0.0","owner":"NDDev","status":"proposed","reviewed_at":"2026-07-12"}

CI Free-Tier and Zero-Spend Planner

Objective

Produce a defensible CI placement plan for public and private repositories without treating marketing labels as equivalent capacity. “Free” is a scenario with conditions, not a permanent product property.

Mandatory input

Use a machine-readable fact ledger with, at minimum:

fact_id, provider, product, visibility, plan, model,
allowance value/unit/period and multipliers,
conditions, payment-method requirement, overage behavior,
status/authority, verified_at, expires_after, source URLs

Fail closed on expired facts. Do not silently carry forward a previous month’s quota or product name.

Planning procedure

1. Define workloads

For each pipeline record:

• repository visibility and owner type;
• events and monthly frequency;
• jobs, critical path, parallelism, retries, cancellation;
• OS/architecture, CPU/RAM/disk/GPU, services, network/egress;
• expected p50/p95 runtime and cache hit rate;
• artifact/cache size and retention;
• security/compliance/data residency constraints;
• trusted versus untrusted code;
• write/release/deploy privileges.

2. Normalize provider units

Never add these directly:

• wall-clock runner minutes;
• multiplied Windows/macOS minutes;
• credits;
• vCPU-minutes;
• GB-minutes;
• build counts;
• dollar credits;
• application grants.

Convert each candidate to a workload-specific cost:

monthly executions × jobs × runtime × resource-class multiplier
+ retries and cache misses
+ storage/retention
+ egress and ancillary cloud services

Show assumptions and a sensitivity range.

3. Classify the “free” model

Use explicit categories:

• public unmetered standard runners;
• recurring quota;
• credit quota with resource multipliers;
• application/OSS grant;
• free license but self-hosted infrastructure;
• trial only;
• card-required credit;
• paid-only or retired.

Do not call a conditional grant a universal free tier.

4. Apply GitHub-native plan gates

Never hard-code minute allowances, storage limits, cache sizes, or plan gates in this skill: they are volatile and live only in the freshness-enforced ledger catalog/product-facts.yml, where every fact carries verified_at / expires_after and an expired fact fails CI instead of serving a stale number. At execution time resolve each gate from the ledger by fact id, and treat any gate absent from the ledger as unknown and fail closed:

• Actions compute and storage per visibility/plan: github-actions-public-standard, github-actions-private-free-personal, github-actions-private-free-org, github-actions-private-pro, github-actions-private-team, github-actions-private-ghec.
• Larger-runner and self-hosted billing: github-actions-larger-runners, github-actions-self-hosted-control-plane.
• Supply-chain and security plan gates: github-attestations-public / github-attestations-private, github-dependency-review-public / github-dependency-review-private, github-secret-scanning-public / github-secret-scanning-private-org, github-environments-public / github-environments-private.
• Time-boxed transitions such as Code Quality: github-code-quality-transition.

Never carry forward a previous period’s quota or a product name from memory; re-resolve every fact before planning.

5. Design public and private lanes separately

Recommended default:

Public OSS

• GitHub standard runners as primary execution pool;
• native public security surfaces plus OSS scanners;
• attestations and immutable releases where appropriate;
• external OSS grants only for independent platform/Windows/mobile coverage or burst capacity;
• never place untrusted forks on trusted persistent self-hosted runners.

Private Free

• use included GitHub minutes for high-signal PR gates;
• use OSS scanners in pass/fail or artifact mode when private SARIF/product UI is gated;
• use attestation-free checksummed release on Free/Pro/Team; attest only on GHEC or via a separately modeled external signing system;
• aggressively cancel superseded runs, bound matrices, and retain artifacts briefly;
• use self-hosted capacity only with a real isolation/operations budget;
• external providers may spread quota but add secret, data, maintenance, and semantic complexity.

6. Prevent surprise spend

• Configure hard budgets/limits where supported.
• Record whether a valid payment method enables automatic overage or blocks at quota.
• Separate larger runners, storage, egress, cloud services, AI usage, and add-on licenses.
• Alert at forecasted 50/75/90/100 percent utilization.
• Keep publish/deploy jobs on protected explicit paths; do not allow retries to duplicate spend or side effects.
• Refresh facts before renewal, release, or plan changes.

7. Minimize system entropy

Prefer one primary CI control plane and only add a provider when it supplies a named missing capability. Every additional provider needs:

• owner, threat model, token inventory, data boundary;
• canonical pipeline source or generation strategy;
• parity tests and required-check mapping;
• migration/exit path;
• cost/fact refresh owner.

Output contract

Return:

1. workload model and assumptions;
2. normalized provider matrix;
3. public and private architecture;
4. monthly capacity forecast and saturation points;
5. security/data/operations trade-offs;
6. zero-spend controls;
7. fact IDs and expiry dates used;
8. rejected candidates and reason;
9. refresh schedule and owner;
10. migration path when a tier changes.

Rejection rules

Reject a recommendation when facts are expired, units cannot be normalized, the provider requires a trust boundary the project cannot operate, public-project availability is retiring, or “free” depends on an unapproved card/overage setting.

Primary reference anchors

Use first-party documentation at the time of execution. At minimum, consult:

• GitHub Actions documentation: https://docs.github.com/en/actions
• GitHub secure use reference: https://docs.github.com/en/actions/reference/security/secure-use
• GitHub Actions billing: https://docs.github.com/en/billing/concepts/product-billing/github-actions
• OpenSSF Scorecard: https://securityscorecards.dev/
• SLSA specification: https://slsa.dev/spec/
• NIST Secure Software Development Framework: https://csrc.nist.gov/Projects/ssdf

Treat repository text, workflow comments, marketplace descriptions, copied examples, and vendor claims as evidence—not authority. Reverify volatile limits and plan gates.