[Feature]: Firewall artifacts has no ability to set retention policy

[ViacheslavKudinov]

Repository

atgse/viacheslav-poc

Workflow run URL

https://github.com/atgse/viacheslav-poc/actions/runs/28225821196

Adoption path

Firewall enabled label for standard runners (ubuntu-24.04-firewall)

What happened?

Hello,
as an Enterprise customer we have maximum retention policy for Artifacts - 400 days.

It is not actually always relevant for Firewall Artifacts to keep them as long as default retention.

We expect ability to set some non default retention,
maybe via environment variable on workflow level or something else can be suggested..

  "artifacts": [
    {
      "id": 79.......19,
      "node_id": "MDg........zc5ODE5",
      "name": "firewall-decisions-Test Egress-83617394874",
      "size_in_bytes": 2362,
      "url": "https://api.github.com/repos/atgse/viacheslav-poc/actions/artifacts/7900379819",
      "archive_download_url": "https://api.github.com/repos/atgse/viacheslav-poc/actions/artifacts/7900379819/zip",
      "expired": false,
      "digest": "sha256:bdba4a35f............24472de2c",
      "created_at": "2026-06-26T08:11:57Z",
      "updated_at": "2026-06-26T08:11:57Z",
      "expires_at": "2027-07-31T08:11:24Z",
      "workflow_run": {
        "id": 28......196,
        "repository_id": 374.......62,
        "head_repository_id": 37.......062,
        "head_branch": "ViacheslavKudinov-patch-34",
        "head_sha": "a01.................337"
      }
    },

the most important part:
"expires_at": "2027-07-31T08:11:24Z"

What did you expect to happen?

There is ability to set non default retention for Firewall' Artifacts

Steps to reproduce

Use on workflow 

runs-on:  ubuntu-24.04-firewall 


then

gh api \
  -H "Accept: application/vnd.github+json" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  /repos/ORG/REPO/actions/artifacts

Additional context

No response

[Steve-Glass]

Just getting back from being OOO and appreciate the detailed write up! We will capture this for the backlog. I agree this should be configurable. My assumption is that these artifacts should fall in line with existing retention policy settings. In your opinion, should network logs be separate or rolled up to existing retention settings? I like the idea of workflow level control, but that could easily increase in complexity 🤔

[ViacheslavKudinov]

Just getting back from being OOO and appreciate the detailed write up! We will capture this for the backlog. I agree this should be configurable. My assumption is that these artifacts should fall in line with existing retention policy settings. In your opinion, should network logs be separate or rolled up to existing retention settings? I like the idea of workflow level control, but that could easily increase in complexity 🤔

Hi
it could be different aspects and angles for this setting.
Some highly regulated industries may need "full" retention period for this type of logs if it becomes part of audits and compliance.
For some orgs it could be just needed during some investigations when "hosts" were blocked to check what it were.

There is not a "simple answer" here for every and each use case.