Monitor GitHub Actions scheduled (cron) workflows with a heartbeat: detect skipped, delayed, or failed runs that stay hidden inside CI. Setup, secrets, and buffers.
By H. Marcell, Freelance Software Developer
Updated July 17, 2026
H. Marcell is a freelance software developer who builds and runs web services and APIs, and writes about uptime monitoring, incident response, and status-page communication.
GitHub Actions scheduled workflows are convenient but easy to lose track of — a `schedule` trigger can be skipped, delayed, or silently disabled, and you will not know unless you happen to check the Actions tab. This guide shows how to monitor them externally with a heartbeat so a missed run pages you, including the quirks specific to GitHub's scheduler.
Add a final step to your scheduled workflow that runs only after the meaningful work succeeds. Storing the URL as a secret keeps it out of your workflow file and logs.
Two behaviors trip teams up. First, scheduled workflows can be delayed — sometimes by many minutes — when GitHub's runners are under load, so a heartbeat interval with no buffer will false-alarm regularly. Second, GitHub disables scheduled workflows in repositories with no commits for 60 days; the workflow simply stops running with no notice. An external heartbeat is what turns both of these silent behaviors into an alert you actually see.
Create a heartbeat check in Sandglass, store its URL as a repository or organization secret, and add a final step to the scheduled workflow that calls the URL after the real work succeeds. Set the heartbeat interval to your schedule plus a generous buffer for GitHub's known scheduling delays. A skipped or failed run means no heartbeat, which means an alert.
GitHub Actions scheduled workflows are not guaranteed to run exactly on time — runs can be delayed during high load, and scheduled workflows are automatically disabled on repositories with no activity for 60 days. Size your heartbeat buffer for the delay, and be aware that an inactive repo can have its schedule turned off entirely — which the heartbeat will catch.
Decide which failures in this topic actually reach customers before adding any monitoring.
Match each risk to a single HTTP, content, TCP, SSL certificate, or heartbeat check instead of stacking duplicates.
Give each alert one owner and one destination — email, a Slack webhook, or a generic webhook.
Revisit intervals, thresholds, and ownership once a real incident shows what was missing.
Free plan, no credit card required.