Cron in YAML
on: schedule with a cron expression runs the workflow on a recurring schedule. UTC, 5-field cron, repo must have activity (no commits in 60 days = scheduled workflows pause).
Common patterns
- Nightly full test suite — runs the long, expensive matrix every night so PRs only see the smoke subset.
- Dependency updates — Dependabot does this for you, but you can also run
npm outdated,pip-audit, etc., on a schedule. - Security scans — weekly CodeQL, monthly trivy.
- Stale issue / PR reaper —
actions/stale. - Health checks — periodic curls against your prod URL with Slack alerts on failure.
Caveats
- UTC always.
- GitHub may delay scheduled runs at peak load — don't depend on millisecond accuracy.
- Pair with
workflow_dispatchon the same workflow so you can also run it manually for debugging.