{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/gitlab-job-artifact-expiry-keep-latest-exceptions/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions/",
        "slug": "gitlab-job-artifact-expiry-keep-latest-exceptions",
        "url": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/gitlab-job-artifact-expiry-keep-latest-exceptions/"
        },
        "title": "Check GitLab’s keep-latest behavior before relying on artifact expiry",
        "summary": "An expire_in value alone does not describe the retention of every pipeline artifact.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:33:44+00:00",
        "modified_at": "2026-10-15T13:36:17+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 269,
        "potentially_affected": "This applies to GitLab job-artifact retention and download behavior as documented on review. Check the installed version and project or instance settings before forecasting storage reclamation.",
        "dse_recommendation": "DSE recommends separating temporary pipeline handoffs from distributable releases.",
        "primary_source": {
            "name": "GitLab — Job artifacts",
            "url": "https://docs.gitlab.com/ci/jobs/job_artifacts/",
            "published_on": null,
            "authority": "docs.gitlab.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>An expire_in value alone does not describe the retention of every pipeline artifact.</p>\n<h2>Source facts</h2>\n<p>GitLab job artifacts can have an expire_in setting; otherwise the instance default applies. The current documentation states that artifacts from the latest pipeline on each reference and the most recent successful pipeline can be preserved regardless of that expiry. Disabling the keep-latest behavior makes new artifacts follow their configured expiry, while older preserved artifacts may remain until another pipeline runs for the same reference. A latest-artifact URL also changes its target as new pipelines run, so it is not a fixed release identifier.</p>\n<p>Source: <a href=\"https://docs.gitlab.com/ci/jobs/job_artifacts/\">GitLab — Job artifacts</a>.</p>\n<h2>Applicability</h2>\n<p>This applies to GitLab job-artifact retention and download behavior as documented on review. Check the installed version and project or instance settings before forecasting storage reclamation.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends separating temporary pipeline handoffs from distributable releases. Record the desired retention, the keep-latest setting, and whether a branch is likely to run another pipeline. Review artifact contents for accidental credential or customer-data inclusion before retention changes. Use an appropriate versioned release store for outputs that must have a stable identity, rather than relying on a moving latest-job link. Obtain the required retention decision before deleting artifacts, and account for job logs or report data that may also be affected.</p>\n<h2>Verification</h2>\n<p>Create harmless artifacts on a test reference, observe the relevant keep-latest behavior, then run a newer pipeline and review which artifacts become eligible to expire. Check the resolved target of a latest URL. Record settings and timing without interpreting “eligible for expiry” as immediate guaranteed disk reclamation.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.gitlab.com/ci/jobs/job_artifacts/\">GitLab — Job artifacts</a>. Reviewed October 15, 2026.</p>",
        "content_text": "An expire_in value alone does not describe the retention of every pipeline artifact.\nSource facts\nGitLab job artifacts can have an expire_in setting; otherwise the instance default applies. The current documentation states that artifacts from the latest pipeline on each reference and the most recent successful pipeline can be preserved regardless of that expiry. Disabling the keep-latest behavior makes new artifacts follow their configured expiry, while older preserved artifacts may remain until another pipeline runs for the same reference. A latest-artifact URL also changes its target as new pipelines run, so it is not a fixed release identifier.\nSource: GitLab — Job artifacts.\nApplicability\nThis applies to GitLab job-artifact retention and download behavior as documented on review. Check the installed version and project or instance settings before forecasting storage reclamation.\nDSE recommendation\nDSE recommends separating temporary pipeline handoffs from distributable releases. Record the desired retention, the keep-latest setting, and whether a branch is likely to run another pipeline. Review artifact contents for accidental credential or customer-data inclusion before retention changes. Use an appropriate versioned release store for outputs that must have a stable identity, rather than relying on a moving latest-job link. Obtain the required retention decision before deleting artifacts, and account for job logs or report data that may also be affected.\nVerification\nCreate harmless artifacts on a test reference, observe the relevant keep-latest behavior, then run a newer pipeline and review which artifacts become eligible to expire. Check the resolved target of a latest URL. Record settings and timing without interpreting “eligible for expiry” as immediate guaranteed disk reclamation.\nOfficial reference\nGitLab — Job artifacts. Reviewed October 15, 2026.",
        "content_markdown": "An expire_in value alone does not describe the retention of every pipeline artifact.\n\n## Source facts\n\nGitLab job artifacts can have an expire_in setting; otherwise the instance default applies. The current documentation states that artifacts from the latest pipeline on each reference and the most recent successful pipeline can be preserved regardless of that expiry. Disabling the keep-latest behavior makes new artifacts follow their configured expiry, while older preserved artifacts may remain until another pipeline runs for the same reference. A latest-artifact URL also changes its target as new pipelines run, so it is not a fixed release identifier.\n\nSource: [GitLab — Job artifacts](https://docs.gitlab.com/ci/jobs/job_artifacts/).\n\n## Applicability\n\nThis applies to GitLab job-artifact retention and download behavior as documented on review. Check the installed version and project or instance settings before forecasting storage reclamation.\n\n## DSE recommendation\n\nDSE recommends separating temporary pipeline handoffs from distributable releases. Record the desired retention, the keep-latest setting, and whether a branch is likely to run another pipeline. Review artifact contents for accidental credential or customer-data inclusion before retention changes. Use an appropriate versioned release store for outputs that must have a stable identity, rather than relying on a moving latest-job link. Obtain the required retention decision before deleting artifacts, and account for job logs or report data that may also be affected.\n\n## Verification\n\nCreate harmless artifacts on a test reference, observe the relevant keep-latest behavior, then run a newer pipeline and review which artifacts become eligible to expire. Check the resolved target of a latest URL. Record settings and timing without interpreting “eligible for expiry” as immediate guaranteed disk reclamation.\n\n## Official reference\n\n[GitLab — Job artifacts](https://docs.gitlab.com/ci/jobs/job_artifacts/). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions/",
                "url": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Check GitLab’s keep-latest behavior before relying on artifact expiry",
                        "item": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions/#article",
                "identifier": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions/",
                "url": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions/",
                "headline": "Check GitLab’s keep-latest behavior before relying on artifact expiry",
                "description": "An expire_in value alone does not describe the retention of every pipeline artifact.",
                "abstract": "An expire_in value alone does not describe the retention of every pipeline artifact.",
                "articleBody": "An expire_in value alone does not describe the retention of every pipeline artifact.\nSource facts\nGitLab job artifacts can have an expire_in setting; otherwise the instance default applies. The current documentation states that artifacts from the latest pipeline on each reference and the most recent successful pipeline can be preserved regardless of that expiry. Disabling the keep-latest behavior makes new artifacts follow their configured expiry, while older preserved artifacts may remain until another pipeline runs for the same reference. A latest-artifact URL also changes its target as new pipelines run, so it is not a fixed release identifier.\nSource: GitLab — Job artifacts.\nApplicability\nThis applies to GitLab job-artifact retention and download behavior as documented on review. Check the installed version and project or instance settings before forecasting storage reclamation.\nDSE recommendation\nDSE recommends separating temporary pipeline handoffs from distributable releases. Record the desired retention, the keep-latest setting, and whether a branch is likely to run another pipeline. Review artifact contents for accidental credential or customer-data inclusion before retention changes. Use an appropriate versioned release store for outputs that must have a stable identity, rather than relying on a moving latest-job link. Obtain the required retention decision before deleting artifacts, and account for job logs or report data that may also be affected.\nVerification\nCreate harmless artifacts on a test reference, observe the relevant keep-latest behavior, then run a newer pipeline and review which artifacts become eligible to expire. Check the resolved target of a latest URL. Record settings and timing without interpreting “eligible for expiry” as immediate guaranteed disk reclamation.\nOfficial reference\nGitLab — Job artifacts. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:33:44+00:00",
                "dateModified": "2026-10-15T13:36:17+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/gitlab-job-artifact-expiry-keep-latest-exceptions/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Check GitLab’s keep-latest behavior before relying on artifact expiry"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 269,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "GitLab — Job artifacts",
                    "url": "https://docs.gitlab.com/ci/jobs/job_artifacts/"
                }
            }
        ]
    }
}