Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Evergreen is a GitHub App that automates two recurring governance tasks in a shared organization: quarterly reviews of outside collaborators and detection, warning, and archival of repositories that have gone stale. Its design keeps the process inside GitHub—using Issues, Actions, webhooks, repository dispatch, custom properties, and files committed to a controller repository—so decisions are visible to the people who must make them and recoverable when automation acts.
The key policy is fail secure: an unanswered access review revokes the access snapshot under review, while a stale repository is archived rather than deleted. That combination reduces standing access and clutter without making an irreversible change.
What Evergreen automates
In a shared organization, employees may collaborate with customers and partners across many repositories. Two jobs are easy to postpone but risky to leave unmanaged:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Outside-collaborator access: periodically confirm which external accounts still need access.
- Repository hygiene: identify inactive repositories, warn their owners, and archive them when the warning period expires.
Evergreen handles the scheduling, reminders, state tracking, API operations, and receipts. People still make the authorization decision: an authorized reviewer checks the accounts to retain and closes an Issue.
The controller repository is the clock and memory
A central controller repository stores Evergreen’s workflows and one JSON state file for each repository at state/repos/<repo_id>.json. Each file records the repository identity, last activity, collaborator snapshots, deadlines, decisions, tracking Issues, and staleness state. Because every change is committed, normal Git history becomes an inspectable audit trail without a separate database.
Four scheduled workflows divide the quarterly cycle. The same jobs can be started manually with workflow_dispatch when an organization needs an unscheduled run.
| Day of the cycle | Workflow | Purpose |
|---|---|---|
| 1st | Stale-repository review | Find inactive repositories and open warnings. |
| 8th | Access review | Open outside-collaborator checklist Issues. |
| 16th | Stale cleanup | Archive repositories whose warning and grace periods ended. |
| 23rd | Access cleanup | Apply the decisions or the fail-secure default. |
Reviews open two weeks before cleanup and include a hard grace period. The state file is the coordination point between the opening and cleanup jobs, so a restart does not require reconstructing decisions from transient API responses.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHow the outside-collaborator review works
1. Capture a review snapshot
Evergreen records the collaborators in scope and creates a checklist Issue. The snapshot matters: the cleanup decision applies to the accounts seen when the review opened, rather than silently changing the question as membership changes.
2. Put the decision in an Issue
Authorized “Hubbers” select the collaborators who should retain access and close the Issue. Issues are the user interface, so reviewers do not need a separate dashboard or a new approval system.
3. Apply the closed Issue
The App listens for the issues.closed webhook. Checked accounts are retained; unchecked accounts are revoked. Evergreen then posts a receipt listing retained and revoked accounts, giving the reviewer a human-readable result tied to the Issue and the corresponding state-file commit.
4. Handle silence and API failures safely
If nobody responds by the deadline, Evergreen revokes every account in the snapshot. This is the system’s fail-secure behavior: an expired approval does not become indefinite access. If an individual removal fails, the review remains pending and is retried later instead of being marked complete with an unknown outcome.
How stale repositories are handled
The stale-repository workflow evaluates recorded activity, warns the relevant people, and tracks the warning and grace deadlines in the repository’s JSON state. When cleanup arrives without a qualifying response, Evergreen archives the repository. Archiving is deliberately reversible; the repository and its history remain available for recovery. The policy can be summarized as “never destroy anything,” not “delete anything that looks old.”
Organization owners can exempt a repository from this path with the evergreen_exempt_from_archive custom property. A separate evergreen_exempt_from_access_review property opts a repository out of collaborator reviews.
Finding the right person to notify
Notification ownership follows a deterministic fallback chain:
- Use the
evergreen_repo_ownercustom property when it names an@useror@org/team. - If it is absent or unusable, consider recent Issue authors and commit authors who are members of the access-review team.
This gives owners an explicit control while retaining a practical fallback for repositories whose metadata is incomplete.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteNative GitHub building blocks are enough
Evergreen does not require a separate service for its core workflow. The implementation combines:
Rank #4
- A GitHub App for authenticated operations and webhook handling.
- Scheduled GitHub Actions for the quarterly clock.
workflow_dispatchand repository dispatch for on-demand runs and coordination.- Issues for checklists, reminders, reviewer interaction, and receipts.
- Custom properties for owners and opt-out controls.
- Plain JSON files committed to Git for durable state and an auditable history.
Authorization still needs to be designed carefully: only the intended reviewer group should be able to close a review Issue, and the App must have the minimum permissions needed to inspect collaborators, manage Issues, and archive repositories.
Designing for organization-scale rate limits
Content creation, rather than simple reads, determines the practical throughput. GitHub reported limits of 80 content-creating requests per minute and 500 per hour in 2026. Opening Issues, adding comments, and similar writes can therefore overwhelm a naïve loop over every repository.
Evergreen addresses this by batching repositories, spacing content calls by seconds, sleeping between batches, and counting only repositories that actually create content. A repository that needs no Issue or comment does not consume a content-creation slot. This pacing is part of correctness: it prevents a large organization-wide run from failing halfway through and leaving reviewers with an incomplete picture.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rollout and operational safeguards
Start with a dry run
The rollout began with DRY_RUN. In that mode, Evergreen logged intended writes without changing collaborators or repositories. Teams could inspect which accounts would be revoked, which Issues would be opened, and which repositories would be archived before activation.
Best Value
Communicate before enforcement
The change was announced before live reviews began. Reviewers therefore knew why new Issues appeared, what closing one meant, and what would happen if the deadline passed.
Make logs useful during the first cycles
Structured logfmt logs were sent to a dedicated Splunk index. Early runs exposed edge cases that a happy-path test would miss, including empty collaborator lists, unusual permission levels, and repositories with Issues disabled. Those cases can then receive an explicit branch or an operational exception instead of silently producing a misleading receipt.
An implementation checklist
- Create a controller repository and define the JSON schema for repository identity, activity, snapshots, deadlines, decisions, Issue numbers, and staleness.
- Build the GitHub App and restrict its installation and permissions to the organization and operations it must perform.
- Implement the four scheduled workflows and an on-demand
workflow_dispatchentry point. - Open access-review Issues with a clear checklist, deadline, and authorized-reviewer rule.
- Handle
issues.closed, retain checked accounts, revoke unchecked accounts, and publish a receipt. - Keep unanswered reviews pending until the hard deadline, then revoke the snapshot; retry individual failures.
- Implement stale warnings followed by reversible archival, with the two custom-property exemptions.
- Resolve notification owners through
evergreen_repo_owner, then the recent-author fallback. - Run with
DRY_RUN, inspect structured logs, and test empty lists, unusual permissions, disabled Issues, and partial API failures. - Batch and pace content-creating operations, counting only repositories that actually write content.
What this pattern gets right
Evergreen meets people where they work: reviewers act in Issues, while Git records the durable evidence. It separates reversible cleanup from destructive deletion, makes inaction produce a bounded security outcome, and treats retries, authorization, observability, and rate limits as part of the feature rather than afterthoughts. For organizations with many shared repositories, that combination turns periodic manual reminders into a repeatable control that can be inspected and recovered when needed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
