A practical automation pattern built from stock GitHub features
GitHub’s internal Evergreen app addresses two kinds of repository housekeeping: reviewing outside-collaborator access every quarter and flagging repositories that have gone stale. If an access review receives no response by its deadline, Evergreen revokes access. Repositories that stay inactive after warnings are archived, not deleted.
The implementation is intentionally ordinary: a GitHub App, scheduled Actions, webhooks, issues, custom properties and plain files in a controller repository. Four scheduled workflows initiate the cycle across the month. The system opens checklist issues, records decisions and keeps state in JSON files that can be reviewed through Git history.
The guardrails are the useful part
Evergreen’s design takes two positions. First, unreviewed access is removed rather than silently left in place. Second, it never destroys repository contents: an archived repository can be recovered, and every access change is recorded in the tracking issue. These choices make the automation easier to inspect and reverse than a hidden cleanup job.
GitHub says the app was built for its own shared organization, but the pattern can be adapted elsewhere. Teams still need to set a sensible inactivity threshold, provide a real review window and ensure that automation has only the permissions it requires. The lesson is not that every organization needs Evergreen; it is that repetitive access reviews can become an auditable workflow instead of a calendar reminder someone eventually misses.
Source published 2026-10-15. Coverage is based on the maker’s announcement and demonstration.