In September a customer's security team sent us a scan of the container image for our command line tool, the one we publish openly so partners can automate their bookings with us. It listed a critical OpenSSL advisory that had been fixed upstream three weeks earlier. Our image was supposed to be rebuilt every night for exactly that reason. The newest tag in the registry was eleven weeks old.

The tool lives in a public GitHub repository. Next to the release workflow sits a nightly one, on a schedule trigger, that rebuilds the image on the same base, lets the package manager pick up security updates, runs the smoke tests and pushes the result. It had worked for two years, and nobody looked at it, because it was meant to need nobody.

When I opened the Actions tab, the workflow carried a banner saying it had been disabled because the repository had seen no activity. GitHub documents the rule: in a public repository, scheduled workflows are switched off automatically after sixty days without activity.…