High billing consumption generated by installing DDEV with github-action-setup-ddev

[mxr576]

As it was reported on Drupal Slack, installing DDEV with this GitHub Action could lead to unexpectedly high (1-7 minutes) GitHub Action minutes consumption in random cases.

I think this problem is also visible on this project.

Proof:

• Run 1: Takes 47s
• Run 2: Takes 1m 25s
• Run 3: Takes 2m
• Billing Overview

The actual command execution completes in ~3 seconds, but GitHub Actions bills for 1-2 minutes due to infrastructure overhead from multiple shell process spawns.

RCA:
TL;DR sudo apt install command MUST BE avoid on GHA because that is a real time-consumer that randomly increases your billed hours.

Expected Impact:

• Billing reduction: 2 minutes → 1 minute (~50% cost reduction)
• Execution time: Reduced process overhead from 60-90s to 5-10s
• Reliability: Maintained backward compatibility and error handling
• Developer experience: No workflow changes required

Outdated RCA & Proposed solution

Root Cause Analysis:

The current main.js implementation creates significant overhead through:

1. 8 separate execShellCommand() calls - each spawning individual shell processes
2. Sequential execution pattern - preventing command optimization
3. Process initialization overhead - 60-90 seconds of cumulative overhead across spawns
4. Ubuntu runner variability - apt operations timing inconsistencies between 20s-2min

Proposed Solution: Optimize main.js execution pattern

Technique 1: Command Batching
Combine related shell operations to reduce process spawning from 8 to 3-5 executions:

// Batch repository setup and installation (5 commands → 1 execution)
const setupCommands = [
  'sudo install -m 0755 -d /etc/apt/keyrings',
  'curl -fsSL https://pkg.ddev.com/apt/gpg.key | gpg --dearmor | sudo tee /etc/apt/keyrings/ddev.gpg > /dev/null',
  'sudo chmod a+r /etc/apt/keyrings/ddev.gpg',
  'echo "deb [signed-by=/etc/apt/keyrings/ddev.gpg] https://pkg.ddev.com/apt/ * *" | sudo tee /etc/apt/sources.list.d/ddev.list >/dev/null',
  `(sudo apt-get update || true) && sudo apt-get install -y ${ddevPackage} && mkcert -install`
];

yield execBatchCommands(setupCommands, "DDEV repository setup and installation");

Technique 2: Optimized Process Spawning
Replace individual shell spawns with batch execution using bash -c:

function execBatchCommands(commands, description) {
  return new Promise((resolve, reject) => {
    const batchCmd = commands.join(' && ');
    const process = child_process_1.spawn('bash', ['-c', batchCmd]);
    // ... error handling
  });
}

Technique 3: Strategic Error Isolation
Maintain separate executions only for operations requiring error isolation:

• Version hold operations (if version ≠ latest)
• Autostart with directory context
• Critical configuration steps

[mxr576]

#43 contains my first attempt to optimize the package install process, but the billed time is still random fluctuating between ~30s (acceptable) and 1+ minutes (unacceptable).

In our private repo I have also tried two different approaches:

1. Generated a local action with the same feature set as this addon has to ensure running package install via NodeJs is not the issue. The result was quite similar, sometimes maybe worst.

action.yml

name: 'Setup DDEV'
description: 'Install and configure DDEV'

inputs:
  version:
    description: 'DDEV version to install (e.g., "1.24.8" or "latest")'
    required: false
    default: 'latest'
  ddevDir:
    description: 'Directory containing .ddev configuration'
    required: false
    default: '.'
  autostart:
    description: 'Automatically start DDEV after installation'
    required: false
    default: 'false'

outputs:
  version:
    description: 'The installed DDEV version'
    value: ${{ steps.install.outputs.version }}
  is-ddev-installed:
    description: 'Whether DDEV was already installed'
    value: ${{ steps.check.outputs.is-ddev-installed }}

runs:
  using: 'composite'
  steps:
    - name: Check if DDEV already installed
      id: check
      shell: bash
      run: |
        if command -v ddev &> /dev/null; then
          CURRENT_VERSION=$(ddev version --json-output 2>/dev/null | jq -r '.raw' 2>/dev/null || ddev version 2>/dev/null | head -1 | awk '{print $3}' || echo "unknown")
          echo "DDEV already installed: $CURRENT_VERSION"
          echo "is-ddev-installed=true" >> $GITHUB_OUTPUT
          echo "current-version=$CURRENT_VERSION" >> $GITHUB_OUTPUT

          # Check if we need specific version
          if [[ "${{ inputs.version }}" != "latest" && "$CURRENT_VERSION" != "${{ inputs.version }}" ]]; then
            echo "Version mismatch. Current: $CURRENT_VERSION, Required: ${{ inputs.version }}"
            echo "is-ddev-installed=false" >> $GITHUB_OUTPUT
          fi
        else
          echo "DDEV not found, will install"
          echo "is-ddev-installed=false" >> $GITHUB_OUTPUT
        fi

    - name: Install DDEV
      id: install
      if: steps.check.outputs.is-ddev-installed != 'true'
      shell: bash
      run: |
        set -euo pipefail

        echo "🚀 Starting DDEV installation..."

        # Determine package name based on version
        DDEV_PACKAGE="ddev"
        if [[ "${{ inputs.version }}" != "latest" ]]; then
          DDEV_PACKAGE="ddev=${{ inputs.version }}"
          echo "Installing specific version: ${{ inputs.version }}"
        else
          echo "Installing latest version"
        fi

        echo "📦 Setting up DDEV repository and installing package..."
        sudo install -m 0755 -d /etc/apt/keyrings && \
        curl -fsSL https://pkg.ddev.com/apt/gpg.key | gpg --dearmor | sudo tee /etc/apt/keyrings/ddev.gpg > /dev/null && \
        sudo chmod a+r /etc/apt/keyrings/ddev.gpg && \
        echo "deb [signed-by=/etc/apt/keyrings/ddev.gpg] https://pkg.ddev.com/apt/ * *" | sudo tee /etc/apt/sources.list.d/ddev.list >/dev/null && \
        (sudo apt-get update || true) && \
        sudo apt-get install -y $DDEV_PACKAGE && \
        mkcert -install

        # Handle version hold if specific version requested
        if [[ "${{ inputs.version }}" != "latest" ]]; then
          echo "🔒 Holding DDEV at version ${{ inputs.version }}"
          sudo apt-mark hold ddev
        fi

        # Get installed version and set output
        INSTALLED_VERSION=$(ddev --version | head -1 | awk '{print $3}' || echo "unknown")
        echo "version=$INSTALLED_VERSION" >> $GITHUB_OUTPUT
        echo "📋 DDEV version: $INSTALLED_VERSION"

        echo "✅ DDEV installation completed"

    - name: Configure DDEV
      shell: bash
      run: |
        set -euo pipefail

        echo "⚙️ Configuring DDEV..."

        # Configure DDEV globally with optimal settings
        ddev config global --instrumentation-opt-in=false --omit-containers=ddev-ssh-agent --router-bind-all-interfaces=false --use-hardened-images=false

        echo "✅ DDEV configuration completed"

    - name: Start DDEV
      if: inputs.autostart == 'true'
      shell: bash
      run: |
        set -euo pipefail

        echo "🎯 Starting DDEV in directory: ${{ inputs.ddevDir }}"

        cd "${{ inputs.ddevDir }}"

        # Check if .ddev directory exists
        if [[ ! -d ".ddev" ]]; then
          echo "⚠️ No .ddev directory found in ${{ inputs.ddevDir }}"
          echo "Creating basic DDEV configuration..."
          ddev config --project-type=php --docroot=. --create-docroot
        fi

        # Start DDEV with error handling
        ddev start

        echo "✅ DDEV started successfully"
        ddev describe

2. Tried to replice Gitlab's Docker in Docker approach on Github by leveraging https://github.com/ddev/ddev-gitlab-ci - which was mention in another Drupal Slack thread but I ran into a bunch of file permissions issues even after a permission workaround so I gave up on that.

workflow.yml

  tests:
    needs: provide_packages
    runs-on: ubuntu-24.04
    services:
      docker:
        image: docker:dind
        options: --privileged
    container:
      image: ghcr.io/ddev/ddev-gitlab-ci:stable
      options: --user root
    steps:
      - name: Fix permissions
        run: |
          # Ensure the workspace directory has correct permissions
          chown -R root:root /__w
          chmod -R 755 /__w

So the only option would be maintaining a runner with DDEV pre-installed? 🤔 :-/

[rfay]

Tried to replice Gitlab's Docker in Docker approach on Github by leveraging ddev/ddev-gitlab-ci - which was mention in another Drupal Slack thread but I ran into a bunch of file permissions issues even after a permission workaround so I gave up on that.

If you want guidance to try DinD some more, I can probably help. You have to use the global config no_bind_mounts, which then uses mutagen.

So the only option would be maintaining a runner with DDEV pre-installed? 🤔 :-/

This whole thing is easy if you maintain a runner. It's not about having DDEV pre-installed, it's about having the images pre-downloaded.

[rfay]

I'd be interested to know what the actual monetary impact is. Since all the things we do are open-source we haven't ever needed to pay GitHub for our workflow runs, so we get kind of naive about that.

[mxr576]

Without talking about actual numbers, what I can say that we have double the spending limits on GHA since we migrated our pipeline around September 10th. Before that the original spending limit was enough. So it is quite serious for us.

If you want guidance to try DinD some more, I can probably help. You have to use the global config no_bind_mounts, which then uses mutagen.

Thanks for the help, for now I considered that solution a dead end and do not want to invest more time on that. I have shared what I tried, maybe somebody continues exploring that path.

Since my previous comment I have also explored and alternative path which seems to be working, I did this discovery because I wanted to avoid the maintenance cost of DDEV pre-installed runner.

TL;DR sudo apt install command MUST BE avoid on GHA because that is a real time-consumer that randomly increases your billed hours.

So I created an alternative workflow that relies on the official DDEV manual bash script and the install takes <=5s every time! 🎉

But there is no free lunch as always...

1. Network errors are regular on GHA... leveraging curl -fsSL --retry 3 --retry-max-time 60 --retry-connrefused for download the script has not been enough, an exponential backoff retry strategy has to be implemented in a dedicated script and curl calls has to be wrapped with that.
2. ... moreover the install_ddev.sh also has to be wrapped since it also has curl calls in it.
3. and since package installs via apt install MUST BE avoid therefore libnss3-tools cannot be installed on the runner, so even if mkcert binary could be installed the same way as DDEV, HTTPS may not work in the browsers like Firefox and Chrome.

[rfay]

I doubt that libnss3-tools is important at all, or mkcert, if you can have your tests use http URLs.