Periodic code scanning of inactive repositories

GitHub code scanning now supports scheduled security scans of repositories that have had no pushes or pull requests for six months or more. Organizations can use this to maintain continuous security coverage across all their repositories, including codebases that are no longer under active development. This setting only applies to repositories that use code scanning default setup.

When enabled, inactive repositories are automatically scanned every 30 days. This setting applies to all repositories in the organization. You can turn this on from Settings > Advanced Security > Global Settings by enabling Keep scheduled scans running every 30 days for inactive repositories.

To learn more, see configuring global security settings for your organization.