List every repository, then flag the ones with no CODEOWNERS file, no team with write access, or no recent commits. Each flagged repo gets one of three outcomes: an owner is named, it is archived, or it is deleted. Ownerless repos are where unreviewed dependencies and forgotten services accumulate.
Why ownership is a discovery problem
A repository with no owner still builds, still deploys, and still pulls dependencies. When an advisory lands, nobody is paged. When a token expires, nobody notices. It is shadow IT created by inattention, not by intent.
You cannot approve what you cannot attribute, so ownership is the first column of any inventory.
What CODEOWNERS tells you, and what it does not
GitHub documents that a CODEOWNERS file can live in the .github directory, the repository root, or the docs directory, and GitHub uses the first one it finds in that order. It names the people or teams responsible for code, and they are requested for review when a pull request changes their files. Owners need write access to the repository, and teams must be visible.
Two details matter for your search. Lines with invalid syntax are skipped, and a file larger than 3 MB is not loaded at all, so owners are not shown or requested. A file that exists can still assign nobody. Check that the owners named in it still exist and can write to the repo.
A four signal test
Score each repository on four signals:
| Signal | Question | Where to look |
|---|---|---|
| Declared owner | Is there a valid CODEOWNERS entry for the whole repo? | The file and its error report |
| Access | Does a current team have write access? | Repository access settings |
| Activity | Any commit or merged pull request in the last 180 days? | Commit history |
| Deployment | Is it still built or deployed? | CI and deploy logs |
A repo that fails the first two signals is ownerless. A repo that fails activity but passes deployment is the dangerous one: running but untended.
Steps
- Export the repository list with last push date and visibility.
- Check for a CODEOWNERS file at each of the three locations.
- For repos with one, confirm the named owners are current members with write access.
- Cross check deployed services against the list. A service with no matching owned repo is a finding on its own.
- Send each suspected orphan to the engineering manager closest to its last committer, with a two week deadline.
- Archive or delete what nobody claims. Record the decision.
Archiving keeps history and stops new changes. Before you archive a repo that other projects depend on, see archived GitHub repo dependency: what to do.
Keep it from drifting
Add a rule that new repositories must include a CODEOWNERS file, and run the four signal test monthly. For monorepos, see CODEOWNERS for a monorepo directory ownership guide.
Quick check
Is a repo with no commits in a year abandoned?
Not necessarily. Stable libraries can be quiet. Combine activity with deployment and ownership before you decide.
Can a team own a repo without write access?
For review requests, no. GitHub requires owners to have write access, so an owner without it cannot be requested.
Safeguard offers asset discovery, SBOM and dependency scanning, and a free scan at gold.safeguard.sh/scan to help see what an unowned repo pulls in.
Sources
Last reviewed: 19 October 2026.
