GitHub Organization Owner Checklist
This checklist is designed to be operational, not aspirational. If all items are complete, your organization is well-governed and low-risk.
Organization-Level Configuration
- Organization visibility and profile completed
- Default repository visibility defined (private by default)
- Default branch name standardized (e.g., main)
- Organization base permissions set to None
- Outside collaborators reviewed and minimized
- Member privileges restricted (repo creation, forking, pages)
Identity & Access Management
- Teams defined by function (Engineering, Infra, Data, External)
- No direct user permissions on repos (team-only access)
- Owners limited to minimum viable set
- Two-factor authentication enforced org-wide
- External collaborators expire automatically
- Service accounts documented and scoped
Repository Governance
- Branch protection rules enabled on all default branches
- Required pull request reviews enforced
- CODEOWNERS files present in all critical repos
- Required status checks configured
- Force pushes disabled
- Linear history enforced where appropriate
CI/CD & Automation
- GitHub Actions enabled org-wide
- Reusable workflows created for common pipelines
- Secrets centralized using Environments
- Self-hosted runners deployed for heavy workloads
- Third-party actions reviewed and pinned to SHAs
- Actions usage monitored monthly
Security & Supply Chain
- Dependabot alerts enabled everywhere
- Dependabot updates configured
- Secret scanning enabled for public repos
- Security policy (SECURITY.md) published
- Vulnerability disclosure workflow defined
- Code scanning enabled where applicable
Lifecycle & Cost Control
- Repo archival policy defined
- Inactive repos reviewed quarterly
- Actions minutes audited
- Package storage reviewed
- Enterprise upgrade triggers documented