Staying Evergreen: How we automated secure access and repo hygiene in a shared org

Managing a shared GitHub organization is like maintaining a house—without regular upkeep, things get messy fast. Forgotten repositories accumulate, outside collaborator permissions drift from their original intent, and security gaps widen silently. GitHub’s recent engineering post tackles this exact problem by showing how to use native GitHub features to automatically review outside collaborator access and archive stale repositories. The result is a cleaner, more secure organization without manual overhead.

The technical approach here is straightforward but powerful. Instead of relying on manual quarterly audits (which inevitably slip), GitHub’s solution uses GitHub Actions workflows to programmatically check repository age, activity status, and collaborator permissions. The workflows query repository metadata through the GitHub API, identify repositories with no commits in a set timeframe, and flag collaborators who no longer need access. When conditions match—say, a repo hasn’t been touched in 12 months—the system can either trigger an archive workflow or open an issue for review. For access control, the automation checks collaborator relationships against teams and removes permissions that fall outside documented access policies. This runs on a schedule, meaning security decisions aren’t forgotten between audits.

Why does this matter? Consider a real scenario: a contractor wraps up a three-month project and gets repository access removed from active repos, but their access lingers on an archived prototype nobody remembers. Six months later, that prototype contains legacy API credentials or data that shouldn’t be exposed. Or picture a startup growing from 10 to 50 engineers—suddenly you have 200 repositories and no clear picture of which are production-critical versus experiments. Manual access reviews become a bottleneck, and stale repos become technical debt. Automation solves both problems simultaneously: security reviews happen consistently, and old projects get properly archived rather than rotting in the organization.

For teams running AWS, using CI/CD pipelines, or managing any multi-tenant platform, this approach extends beyond GitHub. The core pattern—automated compliance checks on a schedule, using native APIs and infrastructure as code—applies to any shared resource. You can apply similar thinking to AWS IAM access reviews, container registry cleanup, or API key rotation. Start small: pick one pain point (maybe “we have no idea who has access to what”), automate the detection, and build review workflows around the findings. GitHub’s example shows that staying on top of security and hygiene doesn’t require expensive tools—just a reliable automation process that runs when humans might forget.