How GitHub gave every repository a durable owner
3 hours ago
- #GitHub repositories
- #security automation
- #ownership management
- GitHub had over 14,000 repositories, with fewer than half having clear ownership initially.
- To address this, a new ownership model was implemented using GitHub custom properties (ownership-type and ownership-name), validated against real data like Service Catalog entries, team existence, and employee handles.
- An automated enforcement system using a GitHub App and CronJob rolled out, with a 30-day grace period for existing repositories, after which unclaimed ones were archived (resulting in ~3,000 active and ~11,000 archived repositories).
- Issues during rollout included unexpected notifications on a weekend and edge cases like archived repositories breaking monitoring workflows, leading to fixes like @-mentioning administrators and adding a low water mark guardrail.
- Ownership is now mandatory at repository creation, with enforcement tightened to a one-hour loop for any repository losing ownership, ensuring ongoing 100% coverage.
- The entire effort took under 45 days, reducing risk by ensuring every active repository has a validated owner and archiving unused ones.