# Set GitHub workflow artifact retention before release evidence expires

> Uploaded build evidence needs an explicit retention decision within the account’s configured limits.

- Canonical URL: https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:25+00:00
- Modified: 2026-10-20T18:34:31+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Uploaded build evidence needs an explicit retention decision within the account’s configured limits.

## Potentially affected

This concerns GitHub Actions workflow artifacts. It does not establish a legal records-retention obligation, an independent backup, or a complete software provenance assessment.

## DSE recommendation

DSE recommends identifying which outputs are release binaries, diagnostic material and approval evidence before choosing retention.

## Article

Uploaded build evidence needs an explicit retention decision within the account’s configured limits.

## Source facts

GitHub supports an artifact-specific retention-days value when upload-artifact creates a workflow artifact. That value cannot exceed the retention limit set by the repository, organization or enterprise. GitHub also describes upload and download digest comparison; a mismatch is reported as a warning. Artifact persistence and artifact validation therefore require separate attention in the release workflow.

Source: [GitHub — Store and share data with workflow artifacts](https://docs.github.com/en/actions/tutorials/store-and-share-data).

## Applicability

This concerns GitHub Actions workflow artifacts. It does not establish a legal records-retention obligation, an independent backup, or a complete software provenance assessment.

## DSE recommendation

DSE recommends identifying which outputs are release binaries, diagnostic material and approval evidence before choosing retention. Align required availability with the repository’s actual maximum and an approved long-term storage design where necessary. Exclude credentials and unnecessary sensitive data from uploads. Assign an owner to review failed or missing downloads and digest warnings rather than treating the existence of an artifact link as sufficient evidence. Give required release evidence a named retention owner and an expiry review date. Ask that owner to retrieve a sample through the intended audit path before accepting the design, with a separate response for integrity warnings and for evidence that has aged out.

## Verification

Proposed verification: create a harmless artifact in a test workflow and inspect its configured retention and metadata. Download it through the intended review path and inspect digest-validation output. Confirm the release record can still locate required evidence and that any separately retained copy is accounted for under its own access and cleanup process.

## Official reference

[GitHub — Store and share data with workflow artifacts](https://docs.github.com/en/actions/tutorials/store-and-share-data). Reviewed October 20, 2026.

## Primary reference

- Name: GitHub — Store and share data with workflow artifacts
- Authority: docs.github.com
- URL: https://docs.github.com/en/actions/tutorials/store-and-share-data
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Set GitHub workflow artifact retention before release evidence expires,” DSE Security, https://update.dsesecurity.com/updates/github-actions-artifact-retention-evidence-window/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.