GitHub Actions Bolsters Supply Chain Security with Enhanced Retention Policies

Effective October 1, 2026, GitHub Actions has expanded the scope of its retention settings to include checks, workflow runs, and commit statuses, in addition to the previously covered artifacts and logs. This means that these critical records will now be removed after the configured retention period, which defaults to 90 days if not otherwise specified. Previously, checks, workflow runs, and commit statuses were retained for over 400 days, regardless of the artifact and log retention policy. This update significantly impacts how organizations manage their CI/CD pipelines and their associated data. For practitioners, this is no longer just about managing storage costs; it's a fundamental shift that requires a re-evaluation of operational procedures and compliance strategies. The change directly addresses the need for more stringent control over the entire software supply chain, making the retention setting a critical component of an organization's security and audit posture. Losing historical workflow data could impede incident investigations, compliance audits, and the ability to demonstrate the provenance of releases. This move aligns with a broader industry trend towards hardening the software supply chain and increasing the determinism and observability of CI/CD processes. Recent incidents, such as the GhostAction campaign, have highlighted the vulnerabilities inherent in CI/CD automation, where compromised workflows can lead to widespread credential exfiltration and supply chain attacks. GitHub's 2026 roadmap for Actions has consistently emphasized secure defaults, policy controls, and enhanced observability to counter these threats. By making retention policies more comprehensive, GitHub is providing a crucial mechanism for organizations to manage the lifecycle of their CI/CD data more effectively, thereby reducing the attack surface and improving their ability to respond to security incidents. In practice, this means that DevOps teams and security auditors must immediately audit their GitHub Actions retention settings across all repositories, organizations, and enterprises. It's imperative to identify repositories that handle production releases or fall under regulatory compliance, and to set retention periods that meet those specific requirements. For data that needs to be retained beyond GitHub's maximum retention limits (e.g., 90 days for public repositories or enterprise caps), organizations must implement external archiving solutions. This includes exporting evidence such as green checks on old commits or workflow run details that explain release provenance. Furthermore, it's crucial to understand that changing the retention setting after October 1st will not restore already deleted records, emphasizing the urgency of proactive planning. Practitioners should also be aware that this policy extends to checks and statuses created by third-party integrations, not just those generated directly by GitHub Actions.