TMA-GITHUB-1.2.7
Ensure inactive repositories are reviewed and archived periodically
Description
Track inactive repositories and remove them periodically. Inactive repositories (i.e., no new changes introduced for a long period of time) can enlarge the surface of a potential attack or data leak. Reported as a manual review item: no reliable read-only gh api check exists for this control.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Perform the following to ensure that all the repositories in the organization are active, and those that are not reviewed or archived: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Click on your organization name and then on repositories. 3. Ensure every repository listed has been active in the last 3 to 6 months. If it's not, then ensure it is archived or reviewed regularly.
How it is fixed
Fix method: Guidance or infrastructure patch
Perform the following to review all inactive repositories and archive them periodically: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Click on your organization name and then on repositories. 3. Ensure every repository listed has been active in the last 3 to 6 months. Every repository that isn't active you should either review or archive by performing the next steps: 1. On GitHub.com, navigate to the main page of the repository. 2. Under your repository name, click Settings. 3. Under "Danger Zone", click Archive this repository. 4. Read the warnings. 5. Type the name of the repository you want to archive. 6.
Properties
- Operating systems
- Any
- Tags
- githubsource-code
- Reference
- CIS GitHub Benchmark v1.2.0 - 1.2.7 Ensure inactive repositories are reviewed and archived periodically