Check ID:
Provider: GitHub
Service:
Severity: MEDIUM
Categories:
Resource type:
repository_inactive_not_archivedProvider: GitHub
Service:
repositorySeverity: MEDIUM
Categories:
software-supply-chainResource type:
NotDefinedWhat this check verifies
GitHub repository that remains unarchived and show no activity beyond a configured inactivity window (e.g.,180 days) are identified. The evaluation considers the most recent repository activity to surface long-idle codebases that are still unarchived.
Risk
Unarchived, long-inactive repos expand attack surface. Stale code and dependencies can hide unpatched flaws; writable state enables integrity compromise via malicious commits or workflow abuse; exposed secrets threaten confidentiality. Attackers can leverage them for lateral movement and supply-chain tampering.Recommendation
Adopt lifecycle management:- Archive or delete repos no longer needed
- If retained, update dependencies, rotate secrets, disable unused workflows, and restrict writes under least privilege
- Define an inactivity policy (e.g.,
180days) with periodic reviews to prevent dormant, writable codebases
Remediation
- CLI
- Terraform
- Dashboard steps
gh repo archive <OWNER>/<REPO> —yes
References
Where this check fires
This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable byCheck ID = repository_inactive_not_archived. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks