GitHub engineers build Evergreen to automate repository hygiene

GitHub engineers have introduced Evergreen, a GitHub App designed to manage organization hygiene in shared environments. The tool automates quarterly access reviews for outside collaborators and identifies stale repositories for archival. Built using Go and native GitHub features like Actions and webhooks, it follows a 'fail secure' philosophy to maintain security without manual intervention.

How Evergreen operates

• Built as a Go webhook server running in a container.
• Uses a controller repository to act as the system's clock and memory.
• Leverages GitHub Actions scheduled workflows to trigger repository_dispatch events.
• Tracks repository state via JSON files committed to a Git repository, providing a built-in audit trail via git log.
• Implements a quarterly cycle: flagging stale repos, reviewing collaborator access, archiving inactive repos, and auto-revoking unconfirmed access.

Why it matters

The project demonstrates how organizations can use native platform features and 'GitOps' principles to automate complex security and maintenance tasks without external databases.