GitHub adds scheduled code scanning for inactive repos
GitHub code scanning now offers scheduled security scans for repositories that have been inactive for six months. This feature helps organizations maintain continuous security posture by ensuring even dormant codebases are regularly checked for vulnerabilities. It is available for organizations seeking to enhance their security practices on the platform.
- →Scheduled code scanning for inactive repositories
- →Purpose of scanning inactive repositories
Features (1) ›
- Scheduled code scanning for inactive repositories
GitHub code scanning now supports periodic security scans for repositories that have seen no activity (pushes or pull requests) for at least six months. This enhancement helps maintain a continuous security posture across all organizational codebases, including those that are infrequently updated.
Notes (1) ›
- Purpose of scanning inactive repositories
This new capability allows organizations to ensure consistent security coverage for all their code, regardless of recent commit activity. It addresses the challenge of maintaining security hygiene for long-lived but less frequently modified projects.
https://github.blog/changelog/2026-06-09-periodic-code-scanning-of-inactive-repositories
Related releases
- GitHub Copilot adds tiers for cost and quality in auto model selection GitHub Changelog ·
- GitHub Copilot usage metrics now include VS Code Agents activity GitHub Changelog ·
- GitHub Copilot Code Review Gains Auto-Resolution, Smart Commits, and Deeper Analysis GitHub Changelog ·
- GitHub Copilot Weekly Releases: Jira Integration, HydraFusion, and Enterprise Controls GitHub Changelog ·
- GitHub Launches Refreshed Repository Pull Requests Page in Public Preview GitHub Changelog ·
- GitHub AI Scan for PRs: API Management Now in Public Preview GitHub Changelog ·