Proposal: Retention support

[jamesgeddes]

I propose the reopening of #2150, Support for setting the retention period for Github Actions artifacts and logs. The issue was marked as stale by stalebot and closed, but I believe there is strong justification to revisit it.

Why this matters

• Compliance: many organisations need to retain workflow logs and artifacts for audit or evidential purposes.
• Everything as Code: setting this manually in the UI breaks EaC principles, particularly when many other org settings are configurable as code.
• Documentation as Code: expressing retention policy in Terraform allows organisations to document policy in code, ensuring clear communication, version control, and peer review of compliance requirements.

Business Risk of not having retention in code

Today, many org-wide Actions settings are only configurable in the org UI, so lots of people end up as org admins. A bad actor could,

1. run something shady on Friday
2. drop log retention to 1 day
3. restore it to the policy value on Monday.

With no audit trail for that setting, evidence is gone - if anyone notices in the first place.

What Terraform would let teams enforce (once supported)

• Least privilege: remove broad org-admin for most humans; let a CI identity apply Terraform.
• Immutable audit trail: the Git history is the record.
• Change control: retention changes could require
  • a PR,
  • N reviewers (up to 6 on GitHub),
  • CODEOWNERS approval from appropriate stakeholders

Thanks for coming to my TED talk

Ideally, anything that one can configure in the organisation settings UI (https://github.com/organizations/[org]/settings/) should also be possible to set in the github_organization_settings resource. That broader alignment is outside the scope of this specific request, but it highlights why this capability matters.

To gauge community support, I am opening this as a poll.

---

Thanks to @mmf55 for originally logging #2150.