GitHub introduces Evergreen, an app for automating repository hygiene and access reviews

Addressing Collaboration Challenges

Managing external collaborators and repository permissions in shared organizations can be complex and time-consuming. Repository owners must track access needs, update permissions, and archive inactive repositories. This manual process becomes difficult to maintain as projects scale, leading to potential security and organizational issues.

Introducing Evergreen

GitHub developed Evergreen, a GitHub App, to automate these organizational hygiene tasks. Evergreen operates through two primary workflows: quarterly reviews of outside collaborator access, where unconfirmed access is revoked, and the detection and archival of repositories that show no human activity past a defined threshold. This system ensures that access is secure and repositories remain organized without manual oversight.

Design Principles and Functionality

Evergreen's design adheres to two principles: "fail secure" and "never destroy anything." If an access review is not completed, access is automatically revoked. The system archives, rather than deletes, repositories and their contents, ensuring recoverability. All access changes are logged in a tracking issue for auditing and easy reversal.

Under the hood, Evergreen is a Go webhook server utilizing native GitHub features such as GitHub Apps, scheduled actions, webhooks, issues, and custom properties. A dedicated controller repository orchestrates Evergreen's operations, with scheduled GitHub Actions workflows triggering quarterly reviews and cleanup processes.

Impact on Organizations

By automating these critical tasks, Evergreen reduces the administrative burden on repository owners and enhances security posture. The system ensures that only necessary collaborators retain access and that inactive repositories do not clutter the organization. This approach provides a scalable solution for maintaining a clean and secure GitHub environment for collaborative projects.