检测GitHub组织休眠用户的Python脚本获取成员活动失败

我开发了一款用于检测GitHub组织中休眠用户的Python脚本，可获取指定GitHub组织的所有用户并打印其最后活动日期。脚本代码如下：

import requests

def get_github_organization_members(token, organization):
    url = f"https://api.github.com/orgs/{organization}/members"
    headers = {
        "Authorization": f"token {token}",
        "Accept": "application/vnd.github.v3+json"
    }
    
    members = []
    while url:
        response = requests.get(url, headers=headers)
        if response.status_code == 200:
            members_page = response.json()
            members.extend(members_page)
            url = response.links.get('next', {}).get('url')
        else:
            print(f"Failed to retrieve members: {response.status_code}")
            break

    for member in members:
        member_login = member['login']
        events_url = f"https://api.github.com/users/{member_login}/events/orgs/{organization}"
        events_response = requests.get(events_url, headers=headers)
        if events_response.status_code == 200:
            events = events_response.json()
            if events:
                last_event = events[0]
                last_activity = last_event['created_at']
                print(f"{member_login}: Last activity on {last_activity}")
            else:
                print(f"{member_login}: No recent activity")
        else:
            print(f"Failed to retrieve events for {member_login}: {events_response.status_code}")

if __name__ == "__main__":
    token = "<a given PAT token>"
    organization = "<a given GitHub organization>"
    get_github_organization_members(token, organization)

脚本执行逻辑 #

• 调用GitHub API的https://api.github.com/orgs/{organization}/members接口获取组织成员列表；
• 为每个成员调用https://api.github.com/users/{member_login}/events/orgs/{organization}接口获取活动信息；
• 使用的PAT（Personal Access Token）属于组织内拥有Owner角色的user42，已配置Events（读）和Members（读）权限。

遇到的问题 #

运行脚本时可正常获取组织的80名成员列表，但仅能获取到user42的活动信息，其余成员均返回404错误。请问是否缺少PAT权限？或是用户需配置活动共享？亦或有其他原因？同时欢迎提供检测GitHub组织休眠用户的替代方案。

原因分析 #

1. API接口访问限制：/users/{member_login}/events/orgs/{organization}接口的设计逻辑是，仅允许授权用户查看自己的组织活动，或者目标用户的活动为公开可见时才能获取。对于私有组织的成员，即使用户是组织Owner，也无法通过该接口获取其他成员的活动记录——这就是只有user42自己的活动能被正常返回，其他成员触发404的核心原因。
2. PAT权限无问题：当前配置的Events（读）和Members（读）权限已经满足获取成员列表的需求，权限不足并非问题根源。

替代方案 #

方案1：通过组织公开事件接口统计 #

调用/orgs/{organization}/events接口获取组织内的所有公开事件，再从中提取每个成员的最后活动时间。注意该接口仅返回公开仓库的活动，私有仓库操作不会被包含。

核心代码示例：

# 复用原获取组织成员的逻辑
def get_organization_members(token, organization):
    url = f"https://api.github.com/orgs/{organization}/members"
    headers = {"Authorization": f"token {token}", "Accept": "application/vnd.github.v3+json"}
    members = []
    while url:
        response = requests.get(url, headers=headers)
        if response.status_code == 200:
            members.extend(response.json())
            url = response.links.get('next', {}).get('url')
        else:
            print(f"Failed to retrieve members: {response.status_code}")
            break
    return members

def get_member_last_activity(token, organization):
    # 获取组织公开事件
    events_url = f"https://api.github.com/orgs/{organization}/events"
    headers = {"Authorization": f"token {token}", "Accept": "application/vnd.github.v3+json"}
    events = []
    while events_url:
        response = requests.get(events_url, headers=headers)
        if response.status_code == 200:
            events.extend(response.json())
            events_url = response.links.get('next', {}).get('url')
        else:
            print(f"Failed to retrieve org events: {response.status_code}")
            break
    
    # 整理成员最后活动时间
    member_activity = {}
    for event in events:
        actor = event['actor']['login']
        event_time = event['created_at']
        if actor not in member_activity or event_time > member_activity[actor]:
            member_activity[actor] = event_time
    
    # 输出结果
    members = get_organization_members(token, organization)
    for member in members:
        login = member['login']
        if login in member_activity:
            print(f"{login}: Last public activity on {member_activity[login]}")
        else:
            print(f"{login}: No public activity found in the organization")

if __name__ == "__main__":
    token = "<your PAT>"
    organization = "<your org>"
    get_member_last_activity(token, organization)

方案2：使用GitHub Audit Log（企业/团队版专属） #

若组织使用GitHub Enterprise或Team计划，可通过Audit Log API（/orgs/{organization}/audit-log）获取全面的成员活动记录，包括私有仓库的操作。该接口需要组织Owner或拥有Audit Log权限的用户PAT，能精准追踪所有成员的组织内活动，适合检测休眠用户。

方案3：检查成员仓库贡献记录 #

遍历组织内的所有仓库，通过/repos/{organization}/{repo}/contributors接口查看成员的贡献情况，或直接获取成员最近的提交时间。这种方式能获取私有仓库的活动信息，但API调用量较大，需注意GitHub的API速率限制。

内容的提问来源于stack exchange，提问作者fgalan