Since a lot of this depends on whether someone had ever had a private repo public in the past, I was hoping it could be resolved using the GitHub security audit log.

You can access that for your repos here: https://github.com/settings/security-log

Then search for repo:simonw/datasette or similar.

But... it looks like the audit log only goes back 6 months, so sadly it's not useful for reviewing this particular situation which involves repos that could have been 5 or more years old.

The ClickHouse copy of the GitHub Archive is useful for reviewing things and goes back a lot further. Try it here:

https://play.clickhouse.com/play?user=play

You can run this query to see relevant events for a specific username:

    with public_events as (
      select
        created_at as timestamp,
        'Private repo made public' as action,
        repo_name
      from github_events 
      where actor_login = 'simonw'
      and event_type in ('PublicEvent')
    ),
    most_recent_public_push as (
      select
        max(created_at) as timestamp,
        'Most recent public push' as action,
        repo_name
      from github_events
      where event_type = 'PushEvent'
      and actor_login = 'simonw'
      group by repo_name
    ),
    combined as (
      select * from public_events
      union all select * from most_recent_public_push
    )
    select * from combined order by timestamp

The PublicEvent one is "When a private repository is made public" according to https://docs.github.com/en/rest/using-the-rest-api/github-ev...

I just built a tool for running this query without having to type in the SQL: https://observablehq.com/@simonw/github-public-repo-history

Explained in this TIL: https://til.simonwillison.net/clickhouse/github-public-histo...