GitHub follow automation that runs on GitHub's own servers on a schedule — no machine of yours stays on, nothing to start. A rework of the manual scripts in pwnedroot/GithubFollowz.
Pages is static hosting — it serves HTML/CSS/JS and nothing else. It can't run Python, can't run on a timer, and can't keep a secret: any token you put in page JavaScript is downloadable by anyone, so GitHub auto-revokes it in minutes.
The right tool is GitHub Actions: scheduled jobs on GitHub's runners, with your token in encrypted secrets. That's what this repo uses.
| Workflow | Trigger | Job |
|---|---|---|
Follow back (follow-back.yml) |
cron, twice a day + manual | Follows everyone who follows you but that you don't follow back |
Mass follow (mass-follow.yml) |
manual only | Follows users pulled from another account's follower/following list |
Both paginate past the 100-user limit, respect primary and secondary rate limits with exponential backoff, cap how many follows happen per run, and write a summary to the run's page. "Follow back" is idempotent — a run with nothing to do makes zero writes, so it's safe on a schedule.
-
Create the repo. Push this folder to a new GitHub repo (public or private both work). The scheduled workflow must be on the default branch (
main) — that's a GitHub rule. -
Make a token. Go to Settings → Developer settings → Personal access tokens. Either kind works:
- Classic: tick the
userscope (includesuser:follow). - Fine-grained: Account permissions → Followers → Read and write.
- Classic: tick the
-
Store it as a secret. In the repo: Settings → Secrets and variables → Actions → New repository secret. Name it exactly
FOLLOW_TOKENand paste the token. This is the one manual step that can't be automated — GitHub never lets code read a secret back out, which is the point. -
Done. "Follow back" now runs at 07:23 and 19:23 UTC. To change the cadence, edit the
cron:line in.github/workflows/follow-back.yml.
Do not use the automatic
GITHUB_TOKEN— it's scoped to the repository, not to you as a user, so it can't follow anyone. You need your own PAT.
- Follow back, now: repo Actions tab → Follow back → Run workflow. Tick dry run first to see who it would follow without touching anything.
- Mass follow: Actions → Mass follow → Run workflow, enter a target username. Defaults to dry run on — untick it to actually follow. It does 25 per run and filters out anyone you already follow, so re-running continues where it left off.
- Locally (optional):
FOLLOW_TOKEN=ghp_... ./scripts/run_local.sh follow-back
Edit the env: block in each workflow:
MAX_PER_RUN— follows per run (default 50 / 25).FOLLOW_DELAY— seconds between follows (default 3 / 5).DRY_RUN—trueto list without changing anything.
Auto-follow-back is friendly and low-risk. Mass-following strangers to farm follow-backs is what GitHub's Acceptable Use Policies can treat as spam/inauthentic activity, and it's enforced against real accounts — that's exactly why mass-follow is manual-only here and starts in dry-run. Keep delays sane, keep volumes low, and don't point it at your main account if that account matters to you. You own what you send.