Automating permissions in code repositories: GitHub replaces external panels with Git logs and revokes neglected access by default

External accounts accumulate in shared code repositories as silent security gaps within tech organizations, as partners and consultants finish their work while access permissions remain active awaiting a manual review that is rarely performed on time. To address this growing burden in shared work environments, GitHub revealed details of its internal application "Evergreen", which transformed the review of external collaborators' permissions and archiving of inactive repositories into a fully automated cycle that relies entirely on the platform's native tools without adding complex external code layers.

The application, developed as a webhooks server in Go within a digital container, is based on two critical engineering principles: default safety on failure, and prohibition of permanent destruction.Default safety automatically revokes permissions when the review deadline passes without human response, instead of leaving doors ajar hoping for a reply.Conversely, the system does not delete any repository or file permanently, but merely archives them for retrieval, recording every permission change in a programmatic follow-up ticket for each repository, which allows restoring the prior state by copying identifiers into the smart-assistant interface "Copilot".

A regular quarterly cycle governs the system’s operation through a central repository that serves as a clock and memory for automation tasks, where scheduled GitHub Actions launch four defined stages: on day one inactivity is assessed and warning tickets are opened for repositories where human activity has ceased; on day eight the external collaborators’ log is captured and review tickets containing checklists are created; on day sixteen repositories untouched by activity are archived; and on day twenty-three permissions are automatically revoked for every lingering review ticket. The status of each repository is recorded in a JSON-format text file stored in the central repository, turning Git’s usual change log into a comprehensive forensic audit trail that spares cybersecurity teams from building bespoke monitoring databases.

Platform engineers adopted a ticket-driven workflow as the review interface, where repository owners receive a checklist of collaborator names and simply mark a check beside those whose access should continue before closing the ticket; the system then reads the selections, revokes the rest, and publishes an official change receipt. To safeguard the decision, the application verifies the identity of the ticket closer; if the user is external or unauthorized, the ticket is automatically reopened with an alert explaining why. Even during temporary API failures, the system employs a precautionary closure mechanism, recording review completion only after all deletions have succeeded to avoid any permission drift.

The system’s application was deployed at scale, involving more than 1,400 platform staff as well as thousands of customers and partners, and encountered technical limits tied to GitHub’s content-creation rates, capped at eighty requests per minute and five hundred per hour. The team addressed this by processing repositories in scheduled batches, spacing each call by two seconds, and allowing pause windows that reset the rate-limit counters. The system also ran in a silent pilot phase that read data without making real changes, while structured logs were sent to the Splunk platform to monitor exceptions and tune program behavior before full rollout.

This model offers a highly practical lesson for software-team leaders and security-operations engineers across the Gulf, Egypt, and the Levant, where enterprises, banks, and digital-government initiatives rely on extensive networks of external consultants and tech firms to deliver projects. Many regional IT departments resort to purchasing costly governance tools that sit outside the developers’ environment, or they allow neglected accounts to accumulate in experimental repositories for fear of disrupting operations, a practice at odds with the stringent compliance and data-protection standards in markets such as Saudi Arabia and the United Arab Emirates. Our recommendation to local engineering teams is to review shared-repository settings regularly and recognize that protecting code assets does not necessarily require expensive additional platforms; governance can be embedded in developers’ daily workflow, making permission revocation the safe default, while retaining a free historical audit trail via Git logs.

Safeguarding a shared development environment is not achieved through arduous seasonal clean-ups, but by establishing a calm automation cycle that makes the safest option the automatic path each quarter, with a clear rollback button that prevents any workflow confusion.