GitHub
Code quality
Security & compliance
No pushes for 90+ days on a scanned production repo
Part of the Repository protection posture check · fix arrives as a guide
What it is
A repository connected as production has had no pushes for 90 days or more.
Why it matters
Either it is not really your production codebase, or it is running unpatched: no dependency updates, no security fixes, and no changes for over a quarter.
How to fix it
Confirm which repository is live and connect that one. If this is the live one, work through its outstanding dependency and security updates — a quarter of drift is usually several advisories deep.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.