--- title: How GitHub gave every repository a durable owner | daily.dev description: GitHub had over 14,000 internal repositories with fewer than half having clear ownership. A Staff Security Engineer describes how the team solved this in under... canonical: https://daily.dev/posts/how-github-gave-every-repository-a-durable-owner-a4g8vfcrg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How GitHub gave every repository a durable owner | daily.dev og:description: GitHub had over 14,000 internal repositories with fewer than half having clear ownership. A Staff Security Engineer describes how the team solved this in under... og:url: https://daily.dev/posts/how-github-gave-every-repository-a-durable-owner-a4g8vfcrg og:image: https://api.daily.dev/og/posts/a4G8vfcRg.png og:image:alt: How GitHub gave every repository a durable owner og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How GitHub gave every repository a durable owner **[GitHub Blog](https://daily.dev/sources/ghblog)** · 10 min read · 0 upvotes · 0 comments ## Summary GitHub had over 14,000 internal repositories with fewer than half having clear ownership. A Staff Security Engineer describes how the team solved this in under 45 days using GitHub custom properties to assign validated owners to every active repository. The approach involved auto-populating ownership from an existing Service Catalog for ~1,500 service-backed repos, then rolling out a Kubernetes CronJob-backed GitHub App that opened issues in unowned repos with a 30-day grace period before archiving. About 8,000 repositories were archived, reducing the active inventory to ~3,000. Key lessons include adding a low-water-mark safety check to prevent mass-archiving from bad data, notifying repo admins directly via @-mentions, and enforcing ownership at repository creation time. The post also provides a reusable framework for other organizations to implement a similar model. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I enforce repository ownership across a large GitHub organization? Create two organization-level GitHub custom properties, ownership-type (single-select: Service Catalog, Team, or Hubber Handle) and ownership-name (text). Sync ownership automatically from any existing service catalog first, then enforce the properties as required at repository creation, and run a grace-period workflow (30 days) that opens issues and archives repositories that remain unclaimed. _Teams designing repository governance policies can track approaches like this one on daily.dev._ ### Why did GitHub choose to archive unowned repositories instead of deleting them? Archiving was chosen because it is reversible and non-destructive: the repository becomes read-only and GitHub Actions stops running, but nothing is deleted, and it can be unarchived later once ownership is set. This let GitHub apply archival broadly across roughly 8,000 stale repositories without needing to debate every edge case individually. _Engineers weighing archive-versus-delete tradeoffs for stale repos can follow related practices on daily.dev._ ### What problems came up when GitHub automated mass repository archiving? Two incidents surfaced: archiving a repository that Datadog used for automated issue creation triggered an unexpected page when Datadog could not open its issue, and a Service Catalog outage risked returning stale or corrupted data that could cause valid repositories to be mass-archived. Fixes included mentioning repo admins directly on ownership issues and adding a low water mark that halts runs exceeding a conservative archive/issue threshold. _Anyone building automation that archives resources at scale can find similar reliability lessons on daily.dev._ ## Similar posts on daily.dev - [How GitHub used secret scanning to reach inbox zero](https://daily.dev/posts/how-github-used-secret-scanning-to-reach-inbox-zero-26vbmbpb8) · GitHub Blog · 0 upvotes · 0 comments - [GitHub ships break glass credential revocation](https://daily.dev/posts/github-ships-break-glass-credential-revocation-cii7k9djr) · Aikido Security · 0 upvotes · 0 comments - [How to reassign resource ownership before someone’s last day](https://daily.dev/posts/how-to-reassign-resource-ownership-before-someone-s-last-day-umubjjbi6) · The New Stack · 0 upvotes · 0 comments - [Organization-level targeting for GitHub Code Quality](https://daily.dev/posts/organization-level-targeting-for-github-code-quality-eivvvumus) · GitHub Changelog · 0 upvotes · 0 comments - [I Had 80 Public GitHub Repos and Only Wanted 15 Visible — So I Automated It](https://daily.dev/posts/i-had-80-public-github-repos-and-only-wanted-15-visible-so-i-automated-it-bwbbcwqm9) · Medium · 0 upvotes · 0 comments --- Tags: [#github](https://daily.dev/tags/github), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/how-github-gave-every-repository-a-durable-owner-a4g8vfcrg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How GitHub gave every repository a durable owner","url":"https://daily.dev/posts/how-github-gave-every-repository-a-durable-owner-a4g8vfcrg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-github-gave-every-repository-a-durable-owner-a4g8vfcrg"},"datePublished":"2026-07-09T16:33:52.707Z","dateModified":"2026-09-14T07:37:02.351Z","description":"GitHub had over 14,000 internal repositories with fewer than half having clear ownership. A Staff Security Engineer describes how the team solved this in under...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1b4a249dc8f072838b26dc10f43f3a3e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1b4a249dc8f072838b26dc10f43f3a3e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/106cf162b88840808484d4b5429b59b1","url":"https://daily.dev/sources/ghblog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-github-gave-every-repository-a-durable-owner-a4g8vfcrg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"github,appsec","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Blog","item":"https://daily.dev/sources/ghblog"},{"@type":"ListItem","position":3,"name":"How GitHub gave every repository a durable owner"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-github-gave-every-repository-a-durable-owner-a4g8vfcrg#faq","mainEntity":[{"@type":"Question","name":"How can I enforce repository ownership across a large GitHub organization?","acceptedAnswer":{"@type":"Answer","text":"Create two organization-level GitHub custom properties, ownership-type (single-select: Service Catalog, Team, or Hubber Handle) and ownership-name (text). Sync ownership automatically from any existing service catalog first, then enforce the properties as required at repository creation, and run a grace-period workflow (30 days) that opens issues and archives repositories that remain unclaimed. Teams designing repository governance policies can track approaches like this one on daily.dev."}},{"@type":"Question","name":"Why did GitHub choose to archive unowned repositories instead of deleting them?","acceptedAnswer":{"@type":"Answer","text":"Archiving was chosen because it is reversible and non-destructive: the repository becomes read-only and GitHub Actions stops running, but nothing is deleted, and it can be unarchived later once ownership is set. This let GitHub apply archival broadly across roughly 8,000 stale repositories without needing to debate every edge case individually. Engineers weighing archive-versus-delete tradeoffs for stale repos can follow related practices on daily.dev."}},{"@type":"Question","name":"What problems came up when GitHub automated mass repository archiving?","acceptedAnswer":{"@type":"Answer","text":"Two incidents surfaced: archiving a repository that Datadog used for automated issue creation triggered an unexpected page when Datadog could not open its issue, and a Service Catalog outage risked returning stale or corrupted data that could cause valid repositories to be mass-archived. Fixes included mentioning repo admins directly on ownership issues and adding a low water mark that halts runs exceeding a conservative archive/issue threshold. Anyone building automation that archives resources at scale can find similar reliability lessons on daily.dev."}}]} ```