{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/github-actions-artifact-retention-evidence-window/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/",
        "slug": "github-actions-artifact-retention-evidence-window",
        "url": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/github-actions-artifact-retention-evidence-window/"
        },
        "title": "Set GitHub workflow artifact retention before release evidence expires",
        "summary": "Uploaded build evidence needs an explicit retention decision within the account’s configured limits.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:25+00:00",
        "modified_at": "2026-10-20T18:34:31+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 279,
        "potentially_affected": "This concerns GitHub Actions workflow artifacts. It does not establish a legal records-retention obligation, an independent backup, or a complete software provenance assessment.",
        "dse_recommendation": "DSE recommends identifying which outputs are release binaries, diagnostic material and approval evidence before choosing retention.",
        "primary_source": {
            "name": "GitHub — Store and share data with workflow artifacts",
            "url": "https://docs.github.com/en/actions/tutorials/store-and-share-data",
            "published_on": null,
            "authority": "docs.github.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Uploaded build evidence needs an explicit retention decision within the account’s configured limits.</p>\n<h2>Source facts</h2>\n<p>GitHub supports an artifact-specific retention-days value when upload-artifact creates a workflow artifact. That value cannot exceed the retention limit set by the repository, organization or enterprise. GitHub also describes upload and download digest comparison; a mismatch is reported as a warning. Artifact persistence and artifact validation therefore require separate attention in the release workflow.</p>\n<p>Source: <a href=\"https://docs.github.com/en/actions/tutorials/store-and-share-data\">GitHub — Store and share data with workflow artifacts</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns GitHub Actions workflow artifacts. It does not establish a legal records-retention obligation, an independent backup, or a complete software provenance assessment.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends identifying which outputs are release binaries, diagnostic material and approval evidence before choosing retention. Align required availability with the repository’s actual maximum and an approved long-term storage design where necessary. Exclude credentials and unnecessary sensitive data from uploads. Assign an owner to review failed or missing downloads and digest warnings rather than treating the existence of an artifact link as sufficient evidence. Give required release evidence a named retention owner and an expiry review date. Ask that owner to retrieve a sample through the intended audit path before accepting the design, with a separate response for integrity warnings and for evidence that has aged out.</p>\n<h2>Verification</h2>\n<p>Proposed verification: create a harmless artifact in a test workflow and inspect its configured retention and metadata. Download it through the intended review path and inspect digest-validation output. Confirm the release record can still locate required evidence and that any separately retained copy is accounted for under its own access and cleanup process.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.github.com/en/actions/tutorials/store-and-share-data\">GitHub — Store and share data with workflow artifacts</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Uploaded build evidence needs an explicit retention decision within the account’s configured limits.\nSource facts\nGitHub supports an artifact-specific retention-days value when upload-artifact creates a workflow artifact. That value cannot exceed the retention limit set by the repository, organization or enterprise. GitHub also describes upload and download digest comparison; a mismatch is reported as a warning. Artifact persistence and artifact validation therefore require separate attention in the release workflow.\nSource: GitHub — Store and share data with workflow artifacts.\nApplicability\nThis concerns GitHub Actions workflow artifacts. It does not establish a legal records-retention obligation, an independent backup, or a complete software provenance assessment.\nDSE recommendation\nDSE recommends identifying which outputs are release binaries, diagnostic material and approval evidence before choosing retention. Align required availability with the repository’s actual maximum and an approved long-term storage design where necessary. Exclude credentials and unnecessary sensitive data from uploads. Assign an owner to review failed or missing downloads and digest warnings rather than treating the existence of an artifact link as sufficient evidence. Give required release evidence a named retention owner and an expiry review date. Ask that owner to retrieve a sample through the intended audit path before accepting the design, with a separate response for integrity warnings and for evidence that has aged out.\nVerification\nProposed verification: create a harmless artifact in a test workflow and inspect its configured retention and metadata. Download it through the intended review path and inspect digest-validation output. Confirm the release record can still locate required evidence and that any separately retained copy is accounted for under its own access and cleanup process.\nOfficial reference\nGitHub — Store and share data with workflow artifacts. Reviewed October 20, 2026.",
        "content_markdown": "Uploaded build evidence needs an explicit retention decision within the account’s configured limits.\n\n## Source facts\n\nGitHub supports an artifact-specific retention-days value when upload-artifact creates a workflow artifact. That value cannot exceed the retention limit set by the repository, organization or enterprise. GitHub also describes upload and download digest comparison; a mismatch is reported as a warning. Artifact persistence and artifact validation therefore require separate attention in the release workflow.\n\nSource: [GitHub — Store and share data with workflow artifacts](https://docs.github.com/en/actions/tutorials/store-and-share-data).\n\n## Applicability\n\nThis concerns GitHub Actions workflow artifacts. It does not establish a legal records-retention obligation, an independent backup, or a complete software provenance assessment.\n\n## DSE recommendation\n\nDSE recommends identifying which outputs are release binaries, diagnostic material and approval evidence before choosing retention. Align required availability with the repository’s actual maximum and an approved long-term storage design where necessary. Exclude credentials and unnecessary sensitive data from uploads. Assign an owner to review failed or missing downloads and digest warnings rather than treating the existence of an artifact link as sufficient evidence. Give required release evidence a named retention owner and an expiry review date. Ask that owner to retrieve a sample through the intended audit path before accepting the design, with a separate response for integrity warnings and for evidence that has aged out.\n\n## Verification\n\nProposed verification: create a harmless artifact in a test workflow and inspect its configured retention and metadata. Download it through the intended review path and inspect digest-validation output. Confirm the release record can still locate required evidence and that any separately retained copy is accounted for under its own access and cleanup process.\n\n## Official reference\n\n[GitHub — Store and share data with workflow artifacts](https://docs.github.com/en/actions/tutorials/store-and-share-data). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/",
                "url": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Set GitHub workflow artifact retention before release evidence expires",
                        "item": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/#article",
                "identifier": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/",
                "url": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/",
                "headline": "Set GitHub workflow artifact retention before release evidence expires",
                "description": "Uploaded build evidence needs an explicit retention decision within the account’s configured limits.",
                "abstract": "Uploaded build evidence needs an explicit retention decision within the account’s configured limits.",
                "articleBody": "Uploaded build evidence needs an explicit retention decision within the account’s configured limits.\nSource facts\nGitHub supports an artifact-specific retention-days value when upload-artifact creates a workflow artifact. That value cannot exceed the retention limit set by the repository, organization or enterprise. GitHub also describes upload and download digest comparison; a mismatch is reported as a warning. Artifact persistence and artifact validation therefore require separate attention in the release workflow.\nSource: GitHub — Store and share data with workflow artifacts.\nApplicability\nThis concerns GitHub Actions workflow artifacts. It does not establish a legal records-retention obligation, an independent backup, or a complete software provenance assessment.\nDSE recommendation\nDSE recommends identifying which outputs are release binaries, diagnostic material and approval evidence before choosing retention. Align required availability with the repository’s actual maximum and an approved long-term storage design where necessary. Exclude credentials and unnecessary sensitive data from uploads. Assign an owner to review failed or missing downloads and digest warnings rather than treating the existence of an artifact link as sufficient evidence. Give required release evidence a named retention owner and an expiry review date. Ask that owner to retrieve a sample through the intended audit path before accepting the design, with a separate response for integrity warnings and for evidence that has aged out.\nVerification\nProposed verification: create a harmless artifact in a test workflow and inspect its configured retention and metadata. Download it through the intended review path and inspect digest-validation output. Confirm the release record can still locate required evidence and that any separately retained copy is accounted for under its own access and cleanup process.\nOfficial reference\nGitHub — Store and share data with workflow artifacts. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:25+00:00",
                "dateModified": "2026-10-20T18:34:31+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Set GitHub workflow artifact retention before release evidence expires"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 279,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "GitHub — Store and share data with workflow artifacts",
                    "url": "https://docs.github.com/en/actions/tutorials/store-and-share-data"
                }
            }
        ]
    }
}