Yes, it can. GitHub's documentation says that from 1 October 2026 the organization retention setting applies to checks, workflow runs and commit statuses, not only artifacts and logs. The default is 90 days. If your audit window is longer, export the records you rely on, or raise the setting where your plan allows.
What the documentation says
According to GitHub's page on configuring retention, checks, workflow runs, commit statuses, artifacts and log files are retained for 90 days by default. Until 1 October 2026, checks, workflow runs and commit statuses were kept for 400 plus days regardless of the setting. After that date, the configured period governs them too.
The limits differ by repository type:
| Repository type | Allowed retention |
|---|---|
| Public | 1 to 90 days |
| Private | 1 to 400 days |
A new value applies only to new objects. It does not stretch records that already exist. Repositories under a managing organization or enterprise cannot exceed the limit set above them.
Why this matters for evidence
Auditors sample across a period. A Type 2 style window of six or twelve months means a sample from month two may be requested in month eight. If the underlying pull request checks have aged out, the merge is still visible, but the proof that tests and scans passed on that commit may not be.
Think about which of these you cite:
- Required status checks on a merge
- Scanner runs tied to a commit
- Deployment workflow logs
- Uploaded scan reports
Each lives on the retention clock.
What to do this week
- Open the organization setting under Actions, General, and read the current number.
- Decide whether it covers your longest audit window. For private repositories you can go up to 400 days.
- For anything that must outlive that, copy it out on a schedule: a scan report, a run summary, a list of checks per merged commit.
- Record the retention value and the date you checked it, so you can show the auditor it was a conscious setting.
- Remember that a change is not retroactive. Do it before the old records age out.
Deleting a workflow run also deletes its artifacts, so restrict who can delete runs.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what a merge gate records for each pull request, which is the kind of record worth preserving.
Where Safeguard fits
Safeguard provides policies and gates on pull requests along with compliance and evidence automation, which keeps a dated copy of scan results outside any single CI retention setting. A free scan shows the dependency side.
Quick check
Does the change affect public repositories differently?
Yes. Public repositories can set 1 to 90 days, so the ceiling is 90. Private repositories can go to 400.
If I raise retention now, do I recover old runs?
No. The documentation says a changed period applies only to new objects.
Sources
- GitHub Docs: configuring the retention period for checks, workflow runs, commit statuses, artifacts, and logs
- GitHub Docs: removing workflow artifacts
Last reviewed: 19 October 2026.
