Free CI minutes: what they cover and what they do not

What free minutes cover

GitHub includes a monthly quota of Actions minutes with every account, for use in private repositories. As of September 2026, GitHub's billing docs list:

• GitHub Free: 2,000 minutes a month
• GitHub Pro and GitHub Team: 3,000 minutes a month
• GitHub Enterprise Cloud: 50,000 minutes a month

Standard GitHub-hosted runners are free to use in public repositories. Included minutes reset at the start of each billing cycle. A few details affect how far they stretch:

• GitHub rounds the minutes each job uses up to the nearest whole minute.
• Included minutes cannot be used for GitHub's larger runners.
• Above the quota, a standard 2-core Linux runner costs $0.006 per minute (Windows and macOS cost more per minute).

That is a generous offer for compute. For many teams it is also the right one, and we say so below.

How far 2,000 minutes go

1. GitHub rounds each 2 minute 20 second job up to 3 minutes, so one run is billed as 4 × 3 = 12 minutes.
2. 2,000 ÷ 12 = 166.7, so the Free quota covers 166 full runs a month.
3. 166 ÷ 21 is about 7.9 runs per working day, for the whole team.
4. Each run past the quota costs 12 × $0.006 = $0.072.

For comparison, the same run on CRACI is metered per second: 4 × 140 seconds = 560 seconds, or about 9.33 minutes. The CRACI Pro plan includes 10,000 build minutes, so 10,000 ÷ 9.33 covers about 1,071 runs a month. CRACI has no free tier. Pro is €30 per month until the end of 2026 (the plan card shows a list price of €330), with €0.004 per minute above the included minutes on a 2 vCPU runner. See the pricing page for current numbers.

Free minutes can cost nothing and CRACI cannot. The better question is what each one gives you besides compute.

What free minutes do not cover

Minutes buy time on a machine. They were never meant to answer the questions that come up when you ship software to customers:

• Which packages did this build actually download, and from where?
• Could a compromised dependency have reached an unexpected host during the build?
• Is the artifact we shipped the one this build produced?
• When a new vulnerability is published, which of our released builds include it?
• What evidence can we hand to a customer or an auditor?

Security

GitHub offers free supply chain features that work alongside Actions, and they are worth turning on. Dependabot alerts scan your repository's default branch and alert you when a new vulnerability is added to the GitHub Advisory Database. You can also export the current state of a repository's dependency graph as an SBOM in SPDX format.

Those features describe the repository. CRACI records the build. Its runners observe traffic to package sources while the job runs, so the SBOM lists what the job actually pulled, including packages restored from CI caches, and states whether the record for each job and cache is complete. Network egress policies can deny everything except the software sources you allow. Details are on the SBOM generation page.

Resilience

When a new CVE lands, the useful answer is not whether your repository declares the package today, but which builds you shipped contain it. CRACI aggregates vulnerabilities across builds and repositories and re-evaluates monitored SBOMs continuously, so you can find the builds that share a vulnerable dependency. See vulnerability tracking.

Compliance evidence

Customers and regulators increasingly ask for SBOMs and proof of how software was built. CRACI signs provenance that links each artifact to its build and exports reports in PDF, HTML, CSV, Excel and JSON. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process. It does not make a company compliant on its own.

When free minutes are genuinely enough

Stay on free minutes, and turn on GitHub's free security features, if most of these are true:

• Your code is open source in public repositories, where standard hosted runners are free.
• You are prototyping, and nothing you build has reached customers yet.
• Your builds fit comfortably inside the monthly quota.
• No customer, auditor or regulator is asking you for SBOMs or build evidence.
• You do not sell products with digital elements in the EU market.

In that situation, paying for CRACI buys evidence nobody needs yet. Come back when that changes.

Signs it is time to look past free minutes

• A customer security questionnaire asks for an SBOM of the release you shipped.
• You sell in the EU. The Cyber Resilience Act's vulnerability reporting obligations apply from September 2026, with full application in December 2027. Our CRA overview covers the basics.
• An incident leaves you asking which builds pulled a package, and nobody can answer quickly.
• You pass the free quota every month and are already paying for minutes.

A middle path for startups

Eligible startups get a minimum of 100k free build minutes and hands-on onboarding from our team through the startup program. It is a way to see what build-time evidence looks like on your own pipeline before you pay for it.