Evergreen is a GitHub App that automates two recurring governance jobs in a shared organization: quarterly reviews of outside collaborators and detection, warning, and archival of repositories that have gone stale. Its safety rules are deliberately conservative: unanswered access reviews revoke the captured access snapshot, while stale repositories are archived so they can be recovered instead of deleted.
What Evergreen automates
GitHub employees working with customers and partners need access to many repositories, but that access and the repositories themselves change over time. Evergreen turns the periodic cleanup into an issue-driven workflow rather than relying on someone to remember a spreadsheet or run a one-off script.
As an Amazon Associate I earn from qualifying purchases.
- Outside-collaborator reviews: on a quarterly cycle, repository owners review a snapshot of external accounts and confirm who should retain access.
- Stale-repository handling: Evergreen identifies repositories that meet the organization’s staleness policy, warns the people associated with them, and archives them during a later cleanup run.
The implementation uses ordinary GitHub primitives: a GitHub App, scheduled Actions workflows, repository dispatch events, webhooks, issues, custom properties, and files committed to git. No separate governance database is required.
The controller repository and quarterly cadence
A controller repository serves as both the clock and the memory for the system. Four scheduled workflows divide discovery, notification, and enforcement across the month. The same jobs can be started manually with workflow_dispatch, which is useful during rollout or when an organization needs an immediate review.
| Workflow | Runs | Purpose |
|---|---|---|
| Stale-repository review | Quarterly, on the 1st | Find repositories that meet the staleness policy and begin the warning process |
| Outside-collaborator access review | Quarterly, on the 8th | Open review issues containing the current outside-collaborator snapshot |
| Stale cleanup | Quarterly, on the 16th | Archive repositories whose warning and grace period have expired |
| Access cleanup | Quarterly, on the 23rd | Apply the decisions recorded in access-review issues |
Reviews open two weeks before their cleanup run and include a hard grace period. That separation gives people time to respond while preserving a predictable enforcement date.
How an access review works
1. Evergreen opens a checklist issue
For each repository requiring review, the app creates an issue listing the outside collaborators in the captured snapshot. Issues are the user interface: reviewers do not need a separate dashboard or a new approval system.
2. An authorized reviewer marks the accounts to keep
Authorized Hubbers select the collaborators who should retain access and close the issue. The organization’s authorization rules determine who may perform this action; closing an issue is treated as a privileged decision, not merely a comment.
Recommended Free Tools
3. The app applies the decision and posts a receipt
Evergreen listens for the issues.closed webhook. Checked accounts are retained, unchecked accounts are revoked, and the issue receives a receipt listing which accounts were retained and which were revoked. That receipt gives the reviewer an immediate, human-readable result.
4. Silence fails secure
If nobody responds before the deadline, Evergreen revokes every collaborator in the snapshot. The behavior is intentional: an expired review does not silently preserve access that nobody has re-approved.
5. Failed removals remain pending
If an individual removal fails, Evergreen does not mark the review complete. It leaves the review pending and retries later, preventing a partial API failure from being mistaken for a successful cleanup.
How stale repositories are handled safely
The stale-repository workflow records last activity and starts a warning phase before enforcement. When the grace period expires, the cleanup job archives the repository rather than deleting it. Archiving makes the repository read-only while preserving its contents and allowing recovery if the project becomes active again.
Free tools Windows power users keep installed
One-click scans. No signup required.
Organization owners can exempt a repository from this process with the evergreen_exempt_from_archive custom property. The policy therefore has an explicit escape hatch instead of relying on an operator to race the cleanup job.
Git files provide the audit trail
Evergreen writes one JSON state file per repository at state/repos/<repo_id>.json. Each file records the repository identity, last-activity data, collaborator snapshots, deadlines, review decisions, tracking issues, and staleness state. Every change is committed to git, so the commit history shows what the system knew and when it changed it.
This design makes the audit trail inspectable with the same tools used for ordinary source code. Reviewers can examine a diff, identify the commit that advanced a deadline or recorded a decision, and retain the history without operating a second database.
Notification ownership and exemptions
Evergreen resolves whom to notify through a fallback chain:
- It first checks the repository’s
evergreen_repo_ownercustom property, which may name an@useror an@org/team. - If that property is absent, it looks at recent issue and commit authors who are members of the access-review team.
Owners can opt out of access reviews with evergreen_exempt_from_access_review. The separate archive exemption, evergreen_exempt_from_archive, controls stale-repository handling. Keeping the two properties separate lets an organization require access certification while allowing a repository to remain active outside the archival policy, or vice versa.
Rank #4
Why the default is deliberately fail secure
“Fail secure.” — Greg Mohler, Senior Service Delivery Engineer at GitHub
Evergreen treats uncertainty as a reason to remove temporary privilege, not preserve it. An unanswered review revokes the snapshot, and an incomplete removal stays pending for another attempt. The corresponding repository rule is, in Mohler’s words, “Never destroy anything”: archive stale content so a mistaken classification can be reversed.
Designing around GitHub’s content limits
Issue creation and comments are content-creating operations, so organization-wide automation must pace them. GitHub reported limits of 80 content-creating requests per minute and 500 per hour in 2026.
| Constraint | Evergreen response |
|---|---|
| 80 content-creating requests per minute | Space content calls by seconds instead of sending a burst |
| 500 content-creating requests per hour | Process repositories in batches and sleep between batches |
| Repositories that need no new issue or comment | Exclude them from the content-operation count |
The important accounting detail is that Evergreen counts repositories that actually create content, rather than treating every repository in the organization as an equivalent write. That keeps throughput predictable as the organization grows.
Best Value
Rollout and operational safeguards
Start with a dry run
The rollout began with DRY_RUN. In that mode, Evergreen logged intended writes without changing collaborators or repositories. Operators could inspect the proposed actions before enabling enforcement.
Communicate before activation
The team announced the change before turning on live cleanup, giving repository owners time to understand the issue workflow, assign an owner property, or set an exemption where appropriate.
Send structured logs to a dedicated index
Evergreen emitted structured logfmt logs to a dedicated Splunk index. During rollout, that observability exposed edge cases such as empty collaborator lists, unusual permission combinations, and repositories with issues disabled.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A practical Evergreen-style implementation blueprint
- Create a controller repository and a GitHub App with only the access needed for the intended governance actions.
- Store one JSON state file per repository under
state/repos/, and commit every state transition so git history remains the audit record. - Schedule separate review and cleanup workflows on the quarterly dates, while exposing
workflow_dispatchfor controlled manual runs. - Open checklist issues for access reviews and use the
issues.closedwebhook as the decision event. - Define explicit custom properties for notification ownership and independent access or archive exemptions.
- Make deadlines enforceable: revoke an unanswered access snapshot, archive rather than delete stale repositories, and retain pending status after a failed removal.
- Add dry-run logging, structured operational logs, batching, pacing, and retry handling before expanding to the full organization.
Evergreen’s central lesson is to meet people where they work: issues are the review surface, Actions provide the clock, webhooks connect decisions to enforcement, and git history preserves the evidence. The result is recurring governance that is reversible, inspectable, and safe to operate at shared-organization scale.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
