GitHub Actions keeps workflow artifacts and build logs for 90 days by default. Public repositories can set 1 to 90 days, private repositories 1 to 400 days. From 1 October 2026 the same retention setting also applies to checks, workflow runs and commit statuses, so review your value now.
The numbers at a glance
| Item | Default | Public repo range | Private repo range |
|---|---|---|---|
| Artifacts and logs | 90 days | 1 to 90 days | 1 to 400 days |
| Checks, runs, statuses | 400+ days until 1 Oct 2026, then your setting | 1 to 90 days | 1 to 400 days |
A custom value only applies to new objects. It does not change the expiry of artifacts and logs that already exist. If an organization or enterprise manages your repository, their cap wins over the repository setting.
Where you can set it
Retention can be set at repository, organization and enterprise level. You can also give a single artifact its own retention period when you upload it with the upload artifact action, which is useful when one file must live longer than the rest of the run.
In the organization UI the path is Settings, then Actions, then General, then the retention field for checks, workflow runs, statuses, artifacts and logs.
Finding out when something expires
The REST API for artifacts returns an expires_at value, so you can list what is about to disappear. If you are preparing an audit or a customer request, check that date before you promise to produce a build log from six months ago.
What deletion does
Deleting an artifact before it expires is permanent: GitHub's documentation warns that it cannot be restored. Deleting a workflow run also deletes every artifact attached to that run.
A practical retention plan
- Decide what each item is for. Debug logs rarely need more than a few weeks. Evidence for a release may need years.
- Keep short retention for bulky, low value artifacts such as intermediate build output, and save storage.
- Copy anything you must keep to a store you control: a release asset, an artifact repository, or an evidence bucket with its own retention rule.
- Record the commit, workflow run and digest next to the copy so it can be traced back.
- Re-check the setting after policy changes such as the October 2026 one.
For what to archive per release, see what to archive for each software release and what evidence to keep for each release vulnerability scan.
Safeguard's compliance and evidence automation collects scan results and release evidence into one place, so audit proof does not depend on a CI system's expiry clock.
Quick check
Can a public repository keep artifacts for a year?
No. GitHub documents 1 to 90 days for public repositories. Private repositories can go up to 400 days.
Does changing retention fix old artifacts?
No. The new period applies only to artifacts, logs and other objects created after the change.
Sources
- Removing workflow artifacts, GitHub Docs
- Configuring the retention period for checks, workflow runs, commit statuses, artifacts, and logs in your organization, GitHub Docs
Last reviewed: 19 October 2026.
