GitHub Introduces Evergreen for Secure Access and Repository Hygiene

What happened

GitHub has introduced Evergreen, a new workflow that automates organization hygiene and secure access reviews. According to GitHub Blog, Evergreen achieves this through two workflows: Outside collaborator access reviews and Stale repository detection and archival.

Why it matters

The Evergreen workflow ensures that organizations maintain a clean and secure environment by removing unnecessary collaborators and archiving stale repositories. This approach prioritizes security and hygiene, reducing the risk of vulnerabilities and data breaches.

Key details

Evergreen reviews outside collaborators every quarter, removing anyone not needed and archiving stale repositories. If nobody responds to an access review, Evergreen revokes access and never destroys a repository or its contents. Additionally, Evergreen tracks every repository's status as a JSON file committed to the controller repository, which acts as the clock and memory for the app's workflows. The workflows also support manual triggers using workflow_dispatch.