Monitor and optimize GitHub usage

An enterprise administrator reviews the monthly Actions metered usage report and notices a sharp cost increase driven by one organization's CI workflows. Investigation shows these workflows run on GitHub-hosted 16-core larger runners, but the jobs are lightweight lint and unit-test steps that complete in under three minutes and never approach CPU or memory limits. The team originally chose larger runners hoping to speed up builds. What is the most appropriate optimization the administrator should recommend to reduce cost without harming these workflows?

You are the enterprise administrator for a GitHub Enterprise Cloud account with 12 organizations. Finance has asked you to produce an internal chargeback showing how many GitHub Actions minutes each individual organization consumed last month, broken down by the runner operating system (Linux, Windows, macOS) so they can apply the correct per-minute multipliers. Which approach gives you the most accurate, granular data to satisfy this request?

An enterprise admin is investigating why a scheduled internal reporting tool that pulls repository metadata via the GitHub REST API intermittently fails with HTTP 403 responses during peak hours. The tool authenticates as a GitHub App installation. Support asks the admin to first determine whether the failures are caused by exhausting the app's hourly request budget before escalating. Which response header should the admin instruct the team to inspect to confirm this is a primary rate limit exhaustion?

An enterprise owner is reviewing suspicious activity where several repositories had their visibility changed to public overnight. Using the audit log, they need to determine whether these changes were performed by a human clicking in the web UI or by an automated integration acting on a user's behalf. Which audit log field or approach best allows them to distinguish programmatic (token-based) actions from interactive web sessions?

A security incident report indicates that a repository's default branch protection was disabled sometime between 14:00 and 15:00 UTC on a specific day. As the enterprise owner, you need to programmatically retrieve only the audit log events that occurred within that one-hour window to identify who made the change, without pulling the entire log history. Which approach lets you scope the query most precisely?

As an enterprise owner for a GitHub Enterprise Cloud organization with 30 orgs, leadership asks you to evaluate whether teams are actually adopting the security features you've paid to enable across the enterprise. You specifically want to see, at the enterprise level, how many repositories currently have code scanning, Dependabot, and secret scanning enabled versus disabled, so you can target the orgs that are lagging. Which built-in capability should you use to get this cross-org adoption view most efficiently?

An enterprise administrator reviews the monthly GitHub Enterprise Cloud billing report and notices that Git LFS charges have grown to become the second-largest line item after GitHub Actions. Several teams store large binary build artifacts and machine-learning model files directly in Git LFS, and CI pipelines clone these repositories on every workflow run. The administrator wants to reduce the recurring Git LFS cost while keeping the artifacts available to the teams that need them. Which action most directly addresses the primary Git LFS cost driver shown in the report?

As the enterprise administrator for a GitHub Enterprise Cloud account, you are asked by finance to explain a sharp month-over-month increase in the GitHub Actions bill. You need to identify which repositories and workflows are driving the additional minute consumption, broken down by runner operating system, before recommending optimizations. Which approach gives you the most granular, per-line data to attribute cost to specific repositories and runner types?

An enterprise owner on GitHub Enterprise Cloud notices the monthly bill for GitHub Packages storage has grown significantly over the past quarter. Before opening a support ticket, they want to identify which specific repositories are driving the increased Packages storage consumption so they can target cleanup efforts. Which action should the enterprise owner take first?

Your enterprise purchased 500 GitHub Copilot Business seats six months ago. Leadership asks you to justify the spend and identify optimization opportunities. You need to determine which assigned seats are effectively idle so they can be reclaimed. Which approach gives you the most accurate data to make this decision?