feat(repo-health): add workflow-optimization skill

.agents/skills/magpie-workflow-optimization

@@ -0,0 +1 @@
+../../plugins/magpie-repo-health/skills/workflow-optimization

.claude-plugin/marketplace.json

@@ -64,7 +64,7 @@
       "name": "magpie-repo-health",
       "source": "./plugins/magpie-repo-health",
       "version": "0.9.0.dev202610192305",
-      "description": "Apache Magpie repo-health family (7 skills)."
+      "description": "Apache Magpie repo-health family (8 skills)."
     },
     {
       "name": "magpie-security",

.claude/skills/magpie-workflow-optimization

@@ -0,0 +1 @@
+../../.agents/skills/magpie-workflow-optimization

.github/labeler.yml

@@ -221,6 +221,7 @@ capability:triage:
           - 'plugins/magpie-repo-health/skills/dependency-license-audit/**'
           - 'plugins/magpie-repo-health/skills/flaky-test-triage/**'
           - 'plugins/magpie-repo-health/skills/license-compliance-audit/**'
+          - 'plugins/magpie-repo-health/skills/workflow-optimization/**'
           - 'plugins/magpie-repo-health/skills/workflow-security-audit/**'
           - 'plugins/magpie-security/skills/issue-triage/**'
           - 'tools/skill-evals/evals/ci-runner-audit/**'
@@ -240,6 +241,7 @@ capability:triage:
           - 'tools/skill-evals/evals/release-vote-tally/**'
           - 'tools/skill-evals/evals/reviewer-routing/**'
           - 'tools/skill-evals/evals/security-issue-triage/**'
+          - 'tools/skill-evals/evals/workflow-optimization/**'
           - 'tools/skill-evals/evals/workflow-security-audit/**'
 
 family:ci:
@@ -352,6 +354,7 @@ family:repo-health:
           - 'tools/skill-evals/evals/dependency-license-audit/**'
           - 'tools/skill-evals/evals/flaky-test-triage/**'
           - 'tools/skill-evals/evals/license-compliance-audit/**'
+          - 'tools/skill-evals/evals/workflow-optimization/**'
           - 'tools/skill-evals/evals/workflow-security-audit/**'
 
 family:security:

.github/skills/magpie-workflow-optimization

@@ -0,0 +1 @@
+../../.agents/skills/magpie-workflow-optimization

.grok/skills/magpie-workflow-optimization

@@ -0,0 +1 @@
+../../.agents/skills/magpie-workflow-optimization

.kiro/skills/magpie-workflow-optimization

@@ -0,0 +1 @@
+../../.agents/skills/magpie-workflow-optimization

README.md

@@ -181,7 +181,7 @@ means and which modes are still proposed vs. shipping today.
 | [**pr-management**](docs/pr-management/README.md) | opt-in | Triage | Maintainer-facing PR-queue management — triage, stats, deep code review, stack review, express-lane merge, stale-sweep, reviewer routing, and pre-first-PR checks. | 9 skills, [`docs/pr-management/`](docs/pr-management/README.md) |
 | [**issue**](docs/issue-management/README.md) | opt-in | Triage, Drafting | General-issue lifecycle: triage, reproduction, fix drafting, reassess, stale-sweep, deduplication, and backlog reporting. | 8 skills, [`docs/issue-management/`](docs/issue-management/README.md) |
 | [**release-management**](docs/release-management/README.md) | opt-in | Triage, Drafting | 14-step ASF release lifecycle, planning issue, RC cut + sign, `[VOTE]` thread, tally, promote, `[ANNOUNCE]`, archive, audit log. Agent never holds the RM's signing key and never publishes the release. **Experimental**, all 10 skills shipped. | 10 skills, [`docs/release-management/`](docs/release-management/) |
-| [**repo-health**](docs/repo-health/README.md) | opt-in | Triage | Read-only repository-health audits: obsolete runner labels, Actions workflow security, dependency vulnerabilities, dependency licence review, license/NOTICE compliance, flaky-test patterns, plus audit-finding fixes. | 7 skills, [`docs/repo-health/`](docs/repo-health/) |
+| [**repo-health**](docs/repo-health/README.md) | opt-in | Triage | Read-only repository-health audits: obsolete runner labels, Actions workflow security, dependency vulnerabilities, dependency licence review, license/NOTICE compliance, flaky-test patterns, workflow runner-usage optimization, plus audit-finding fixes. | 8 skills, [`docs/repo-health/`](docs/repo-health/) |
 | [**pairing**](docs/pairing/README.md) | opt-in | Pairing | Pair a change with a structured self-review or a multi-agent adversarial review before it lands. | 2 skills, [`docs/pairing/`](docs/pairing/README.md) |
 | [**mentoring**](docs/mentoring/README.md) | opt-in | Mentoring | Newcomer-facing mentoring — first-contact welcome, newcomer-issue explanations, and good-first-issue authoring + backlog curation. **Experimental**. | 4 skills, [`docs/mentoring/`](docs/mentoring/README.md) |
 | [**contributor-growth**](docs/contributor-growth/README.md) | opt-in | Triage, Mentoring | The path-to-committer track: activity sweeps, nomination briefs, contributor-sentiment signals, readiness tracking, threshold calibration, candidate screening, committer / post-vote onboarding, and contributor identity mapping across Slack, Discord, and social media. | 9 skills, [`docs/contributor-growth/`](docs/contributor-growth/README.md) |

docs/labels-and-capabilities.md

@@ -77,7 +77,7 @@ every install; the other eight are opt-in (see
 | `family:issue` | opt-in | `issue-*` skills (`issue-triage`, `issue-reproducer`, `issue-fix-workflow`, `issue-reassess`, `issue-reassess-stats`, `issue-stale-sweep`, `issue-deduplicate`, `issue-backlog-stats`) ([`docs/issue-management/`](issue-management/README.md)) |
 | `family:pr-management` | opt-in | `pr-management-*` skills plus `pr-stale-sweep`, `pre-first-pr-check`, `reviewer-routing` ([`docs/pr-management/`](pr-management/README.md)) |
 | `family:release-management` | opt-in | `release-*` skills — planning, RC cut, `[VOTE]` draft + tally, promote, `[ANNOUNCE]`, archive sweep, audit report, keys sync ([`docs/release-management/`](release-management/README.md)) |
-| `family:repo-health` | opt-in | Read-only repository audits and their follow-up fixes: `ci-runner-audit`, `workflow-security-audit`, `dependency-audit`, `dependency-license-audit`, `license-compliance-audit`, `flaky-test-triage`, `audit-finding-fix` ([`docs/repo-health/`](repo-health/README.md)) |
+| `family:repo-health` | opt-in | Read-only repository audits and their follow-up fixes: `ci-runner-audit`, `workflow-security-audit`, `workflow-optimization`, `dependency-audit`, `dependency-license-audit`, `license-compliance-audit`, `flaky-test-triage`, `audit-finding-fix` ([`docs/repo-health/`](repo-health/README.md)) |
 | `family:pairing` | opt-in | `pairing-self-review`, `pairing-multi-agent-review` ([`docs/pairing/`](pairing/README.md)) |
 | `family:mentoring` | opt-in | `mentoring-welcome`, `newcomer-issue-explainer`, `good-first-issue-author`, `good-first-issue-sweep` ([`docs/mentoring/`](mentoring/README.md)) |
 | `family:contributor-growth` | opt-in | The path-to-committer track: `contributor-activity-sweep`, `contributor-sentiment`, `contributor-to-committer`, `contributor-nomination`, `contributor-calibrate`, `contributor-candidate-screen`, `committer-onboarding`, `contributor-identity-map`, `onboarding-concierge` ([`docs/contributor-growth/`](contributor-growth/README.md)) |
@@ -235,6 +235,7 @@ Capabilities for every skill currently in
 | `dependency-audit` | `capability:triage` |
 | `dependency-license-audit` | `capability:triage` |
 | `workflow-security-audit` | `capability:triage` |
+| `workflow-optimization` | `capability:triage` |
 | `license-compliance-audit` | `capability:triage` |
 | `flaky-test-triage` | `capability:triage` |
 | `reviewer-routing` | `capability:triage` *(scores the configured reviewer roster on area match, git-history familiarity, and open-review load; proposes a primary reviewer plus optional backup — read-only, propose-then-confirm)* |

docs/modes.md

@@ -59,7 +59,7 @@ Autonomous* (the renamed former *Auto-merge*).
 
 | Mode | Purpose | Status | Skill count |
 |---|---|---|---|
-| **Triage** | *(Agentic Triage)* Issues, security reports, PRs: spot, classify, route, surface duplicates. Every output is a suggestion the human signs off on. | stable (security) / experimental (pr-management, issue-management, contributor-nomination, repo-health, release-management) | 39 |
+| **Triage** | *(Agentic Triage)* Issues, security reports, PRs: spot, classify, route, surface duplicates. Every output is a suggestion the human signs off on. | stable (security) / experimental (pr-management, issue-management, contributor-nomination, repo-health, release-management) | 40 |
 | **Mentoring** | *(Agentic Mentoring)* Joins issue and PR threads in a teaching register: clarifying questions, pointers to project conventions, paired examples from prior PRs, hand-off to a human when scope exceeds the agent. Also authors net-new good first issues, curates the existing backlog, and explains filed issues to newcomers to lower onboarding latency. | experimental | 7 |
 | **Drafting** | *(Agentic Drafting)* Agent drafts a fix for a well-scoped problem and opens a PR; every PR is reviewed and merged by a human committer. | stable (security-only); experimental (issue-management, audit-findings, release-management family) | 11 |
 | **Pairing** | *(Agentic Pairing)* Developer-side dev-cycle skills with mentorship intrinsic — multi-agent review pipelines, self-review and pre-flight patterns, scoped fix drafting under the developer's driver's seat. | experimental | 3 |
@@ -112,6 +112,7 @@ do not act without human review.
 | [`dependency-audit`](../skills/dependency-audit/SKILL.md) | Read-only dependency vulnerability audit: detects the project's dependency manager(s), runs the appropriate audit tool, surfaces patchable findings grouped by severity, and proposes upgrades for maintainer review. | experimental |
 | [`dependency-license-audit`](../skills/dependency-license-audit/SKILL.md) | Read-only license audit of the dependency tree: resolves each dependency's declared license, classifies against the ASF three-category model (A/B/X) or a custom allowlist, and reports forbidden, binary-only (category B), and unknown-license dependencies. | experimental |
 | [`workflow-security-audit`](../skills/workflow-security-audit/SKILL.md) | Read-only GitHub Actions workflow security audit powered by `zizmor`: surfaces injection vulnerabilities, excessive permissions, unpinned external actions, and self-hosted-runner fork-secret leaks. | experimental |
+| [`workflow-optimization`](../skills/workflow-optimization/SKILL.md) | Read-only review of one repository's GitHub Actions workflows and run history against the ASF Infra workflow-optimization practices; produces a prioritised plan to cut runner use. | experimental |
 | [`license-compliance-audit`](../skills/license-compliance-audit/SKILL.md) | Read-only license-compliance audit: LICENSE presence, NOTICE completeness when required, and SPDX-header consistency across source files; proposes remedies for maintainer review. | experimental |
 | [`flaky-test-triage`](../skills/flaky-test-triage/SKILL.md) | Read-only flaky-test detection from CI run history: per-job failure-rate analysis over a configurable window, separating intermittent (flaky) from deterministic failures. | experimental |
 | [`release-verify-rc`](../skills/release-verify-rc/SKILL.md) | Read-only pre-flight on a staged RC: signatures against project KEYS, checksums, license headers (Apache RAT), NOTICE/LICENSE diff, no prohibited binaries, version-string consistency. Doubles as an Agentic Pairing-mode skill voters run in their own dev loop. | experimental |

docs/quick-start.md

@@ -36,7 +36,7 @@ project and no opt-in from your teammates. Committing anything for other
 people is a separate act called **adoption** —
 [Installation or Adoption?](quick-start/two-ways.md) draws the line.
 
-**What you get.** 80 skills your agent can run, grouped into 10 **families** —
+**What you get.** 81 skills your agent can run, grouped into 10 **families** —
 PR triage and review, issue triage, security-report handling, release
 management, contributor mentoring. Install only the families you need; each one
 you add costs context in every session —
@@ -178,7 +178,7 @@ draws the line.
 
 **Every skill configures itself on first use.** You do not have to remember
 which projects are set up, or run anything to prepare a family before you use
-it: 69 of the 80 skills open with a silent pre-flight — the eleven exceptions are
+it: 70 of the 81 skills open with a silent pre-flight — the eleven exceptions are
 the setup skills themselves, which are what you run to fix whatever it finds.
 
 The first time you call a skill in a project, that pre-flight works out how

docs/quick-start/families.md

@@ -44,7 +44,7 @@ today — you are not meant to take all of them.
 | `magpie-release-management` | 10 | An ASF release is a long checklist where one missed step invalidates the vote. | RC cut, RC verification (signatures, hashes, LICENSE/NOTICE, no stray binaries), the `[VOTE]` thread, the tally, promotion, `[ANNOUNCE]`, archive sweep, audit log. The agent never holds your signing key and never publishes. |
 | `magpie-pr-management` | 9 | The PR queue grows faster than you can read it, and the oldest ones quietly rot. | Queue triage into ready / needs-review / waiting-on-author, deep code review with blocking vs non-blocking findings, whole-stack review of stacked PRs, reviewer routing, express-lane merge, stale sweep, and queue statistics. |
 | `magpie-issue` | 8 | A backlog full of duplicates, unreproducible reports, and issues nobody has read in a year. | Triage with proposed labels, duplicate clustering, reproduction attempts across versions, fix drafting, reassessment of old issues, stale sweep, and backlog stats. |
-| `magpie-repo-health` | 7 | Slow rot you only notice when it breaks: vulnerable deps, unpinned actions, licence drift, flaky tests. | Read-only audits for dependency CVEs, dependency licences, LICENSE/NOTICE compliance, Actions workflow security, obsolete runner labels, and flaky-test patterns — plus a skill that fixes what they find. |
+| `magpie-repo-health` | 8 | Slow rot you only notice when it breaks: vulnerable deps, unpinned actions, licence drift, flaky tests, wasted CI runners. | Read-only audits for dependency CVEs, dependency licences, LICENSE/NOTICE compliance, Actions workflow security, obsolete runner labels, flaky-test patterns, and CI runner usage — plus a skill that fixes what they find. |
 | `magpie-contributor-growth` | 9 | Contributors who have earned committership go unnoticed because nobody is tracking the signal. | Activity sweeps against a review threshold, readiness tracking, threshold calibration from past nominations, candidate screening, sentiment signals, nomination briefs for the PMC, committer / post-vote onboarding checklists, and a contributor identity map across chat and social channels. |
 | `magpie-utilities` | 5 | You want to write your own skills, or find out what is actually installed. | Skill authoring and restructuring, a state reconciler, a live index of installed skills, and a path to report framework bugs upstream. **In the baseline.** |
 | `magpie-mentoring` | 4 | Newcomers open one PR, hit a wall of unwritten conventions, and never come back. | First-contact welcome comments, plain-language explanations of an issue for someone new, good-first-issue authoring, and a sweep that keeps that backlog honest. |

docs/repo-health/README.md

@@ -14,6 +14,7 @@
     - [`audit-finding-fix` (experimental)](#audit-finding-fix-experimental)
     - [`ci-runner-audit` (experimental)](#ci-runner-audit-experimental)
     - [`workflow-security-audit` (experimental)](#workflow-security-audit-experimental)
+    - [`workflow-optimization` (experimental)](#workflow-optimization-experimental)
     - [`dependency-audit` (experimental)](#dependency-audit-experimental)
     - [`license-compliance-audit` (experimental)](#license-compliance-audit-experimental)
     - [`flaky-test-triage` (experimental)](#flaky-test-triage-experimental)
@@ -35,7 +36,7 @@
 Read-only agent-assisted audits that surface repository maintenance signals
 a human would otherwise have to detect by hand: runner label obsolescence,
 Actions workflow security issues, stale or vulnerable dependencies,
-license/NOTICE drift, and flaky-test patterns. Every skill in this family
+license/NOTICE drift, flaky-test patterns, and wasted CI runner capacity. Every skill in this family
 produces a human-readable report and proposes remedies; applying any change
 is the maintainer's action.
 
@@ -53,7 +54,7 @@ follow. See [`docs/modes.md` § Triage](../modes.md#triage).
 
 ## Install & first runs
 
-Install just this family — one plugin, 7 skills. Read-only repository-health audits, plus fixes for what they find.
+Install just this family — one plugin, 8 skills. Read-only repository-health audits, plus fixes for what they find.
 
 Once you have [added the marketplace](../setup/marketplace-install.md):
 
@@ -231,6 +232,31 @@ enable. All classes are enabled by default.
 
 ---
 
+### `workflow-optimization` (experimental)
+
+Reviews one repository's GitHub Actions workflows and seven days of run
+history against the practices on the ASF Infra page
+[Optimizing GitHub Actions workflows](https://infra.apache.org/github-actions-optimization.html),
+which is the skill's source of truth.
+
+It looks for what costs runner capacity without adding coverage: setup
+failures that burn retries, duplicate post-merge and merge-queue runs, many
+one-minute jobs each waiting for its own runner, toolchain matrices run on
+every PR instead of a scheduled canary, missing timeouts and cancellation,
+jobs that fit `ubuntu-slim`, and Dependabot noise. Every finding carries a
+`file:line` and the run numbers behind it.
+
+Output is a prioritised plan (P0 broken, P1 fewer jobs per PR, P2 hygiene,
+P3 needs community agreement) with an estimated saving and a suggested split
+into pull requests. Read-only; the skill never edits workflow files, opens
+PRs, or posts comments.
+
+**Adopter contract**: none — no `<project-config>` file is read. ASF-only
+checks (`.asf.yaml`, the GitHub Actions Policy, `creation_cap`) are skipped
+for repositories outside the ASF.
+
+---
+
 ### `dependency-audit` (experimental)
 
 Detects the project's dependency manager(s), runs the appropriate audit
@@ -331,7 +357,7 @@ policy: <https://www.apache.org/legal/resolved.html>.
 
 ## Status
 
-**Experimental.** All seven skills shipped. No adopter-pilot evaluation
+**Experimental.** All eight skills shipped. No adopter-pilot evaluation
 has run end-to-end yet; shape may change between framework versions.
 
 To provide pilot feedback, copy

docs/setup/marketplace.md

@@ -53,7 +53,7 @@ Magpie**. The [pinned snapshot install](../quick-start/other-install-methods.md)
 for the cases it does not cover.
 
 > [!IMPORTANT]
-> A marketplace install drops the 80 skills into your agent and is complete
+> A marketplace install drops the 81 skills into your agent and is complete
 > for day-to-day use. What it does **not** set up on its own is the
 > repo-side machinery — the committed pin, the gitignored snapshot, drift
 > detection, agentic overrides — or the secure-agent setup, which you run
@@ -162,7 +162,7 @@ can say so, because it is the floor everything else is managed from.
 | `magpie-release-management` | 10 | ~0.8k |
 | `magpie-pr-management` | 9 | ~1.0k |
 | `magpie-issue` | 8 | ~0.7k |
-| `magpie-repo-health` | 7 | ~0.6k |
+| `magpie-repo-health` | 8 | ~0.7k |
 | `magpie-utilities` | 5 | ~0.4k |
 | `magpie-contributor-growth` | 9 | ~0.6k |
 | `magpie-mentoring` | 4 | ~0.4k |