GitHub Actions Retention Policy Expands: Checks, Runs, and Statuses Now Subject to Configured Lifespans

Effective October 1, 2026, GitHub Actions has significantly expanded the scope of its data retention policy. Previously, the retention setting primarily controlled the lifespan of workflow artifacts and logs. Now, this policy extends to include checks, workflow runs, and commit statuses. This means that these critical components of CI/CD history will also be subject to automatic deletion based on the configured retention period, which defaults to 90 days if not otherwise specified. This change is particularly significant for practitioners because it transforms the retention setting from a mere storage cost optimization into a critical operational and compliance decision. Historically, checks, workflow runs, and commit statuses were retained for over 400 days, regardless of shorter artifact and log retention settings. This provided a de facto long-term record of CI/CD activity. With the new policy, teams relying on these records for post-mortems, audit trails, or regulatory compliance will find that data disappearing if their retention periods are too short. The impact is immediate and could lead to gaps in release evidence or debugging capabilities for older deployments. This development aligns with a broader industry trend towards more granular control over data lifecycle management in CI/CD platforms, driven by both cost optimization and compliance requirements. As CI/CD pipelines become central to software delivery, the data they generate—from build logs to deployment statuses—is increasingly seen as a valuable asset that also carries governance responsibilities. Cloud providers and DevOps tool vendors are continuously refining their data retention capabilities, offering more flexibility but also demanding more proactive management from users. This move by GitHub reflects the growing maturity of CI/CD as a critical enterprise function, where data governance can no longer be an afterthought. Practically, DevOps teams must immediately audit their GitHub Actions retention settings at the enterprise, organization, and repository levels. It's crucial to identify repositories that produce production releases or handle regulated workloads and ensure their retention periods meet audit and compliance requirements. Teams should consider exporting long-lived release evidence to external archives if GitHub's maximum retention periods (e.g., 90 days for public repositories) are insufficient. Furthermore, it's important to remember that changing the setting *after* data has been deleted will not restore it, emphasizing the urgency of this review. Ignoring this change could lead to unexpected data loss and compliance issues down the line.