Does a scheduled workflow remain active if the last committer is a bot and the previous human user is removed from the organization?

[frozenbonito]

Select Topic Area

Question

Body

Hello,

I have a question about the behavior of scheduled workflows in GitHub Actions. I understand that a scheduled workflow becomes disabled if the last user who committed to the repository is removed from the organization.

When the last user to commit to the cron schedule of a workflow is removed from the organization, the scheduled workflow will be disabled.

https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule

However, if the most recent commit is made by a bot (e.g., Dependabot), and the last human user who committed before the bot is removed from the organization, will the workflow still be disabled?

I would appreciate clarification on how GitHub Actions handles this specific situation.

Thank you!

[rajtilak-2020]

Does a Scheduled Workflow Remain Active if the Last Committer is a Bot and the Previous Human User is Removed from the Organization?

In GitHub, a scheduled workflow (e.g., one defined in a repository's .github/workflows file) is tied to the repository itself, not directly to the committer or organization members. Here’s what happens in this scenario:

---

Key Points:

1. Scheduled Workflow Activation:

   • Scheduled workflows are triggered based on the schedule event in the workflow YAML (using cron syntax).
   • They will continue to run as long as:
     • The workflow is enabled in the repository settings.
     • The repository is active.
     • The GitHub Actions feature is not disabled for the repository.

2. Bot Commits:

   • The fact that the last commit was made by a bot does not affect the scheduled workflow. The workflow triggers are independent of who made the last commit.

3. Removal of a Human User:

   • If a human contributor is removed from the organization, it will not impact the workflow unless the workflow is explicitly tied to actions that require that user's credentials or access (e.g., secrets or protected branches managed by that user).

---

Considerations:

• Repository Ownership: If the repository becomes unmaintained (e.g., all admins are removed), it might affect settings indirectly.
• Secrets/Permissions: If the workflow relies on secrets or tokens tied to the removed user, it may fail at runtime due to lack of valid credentials.
• Access Tokens: Ensure the workflow uses repository-level or organization-level tokens rather than user tokens to avoid disruptions.

---

Conclusion:

The scheduled workflow will remain active and continue to run as long as the repository and workflow configuration remain intact. The committer being a bot or the removal of a user does not directly impact the functionality of scheduled workflows.

[frozenbonito]

The documentation clearly states that a scheduled workflow will be disabled if the user who last committed to the workflow is removed from the Organization.

When the last user to commit to the cron schedule of a workflow is removed from the organization, the scheduled workflow will be disabled.

https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule

This is also mentioned in the following discussion:
https://github.com/orgs/community/discussions/109354

[JoseSantos5455]

If a bot made the most recent commit and the last human user who committed before that bot was removed from the organization, the scheduled workflow will not be disabled. The bot's commit allows the workflow to remain active.

[frozenbonito]

Thank you for your answer!