chore(ci): cap Actions artifact retention at 10 days

[sravinet]

What

Sets retention-days: 10 on every actions/upload-artifact step in this repo (8 step(s) across 7 workflow file(s)).

• code-quality.yml
• kani-verification.yml
• miri-memory-safety.yml
• pre-release.yml
• release.yml
• semgrep-sast.yml
• weekly-security-scan.yml

Why

Part of an org-wide pass. A survey of all 194 CaptainEmpower repos found 4,240 live artifacts holding 1.88 GiB, nearly all of it long past any useful review window. Capping retention at 10 days keeps artifacts around for the period people actually pull them and stops storage growing without bound.

Artifacts older than 10 days were deleted in the same pass.

How it was made

Applied by a transformer run against all 110 upload-artifact workflows in the org and validated there: every upload step parses back to retention-days: 10, no other key changes value, and re-running is a no-op. It handles the three shapes — an existing retention-days (value rewritten), a with: block without one (key added), and a step with no with: block (both added) — and stays clear of path: | block scalars.

Only the retention value changes; no workflow logic is touched.

[qodo-code-review]

PR Summary by Qodo

Cap GitHub Actions artifact retention at 10 days

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Standardizes all uploaded CI artifacts to a ten-day retention window.
• Reduces Actions storage growth without changing workflow execution or artifact contents.
• Keeps release SBOMs available through durable GitHub release attachments.

Diagram

graph TD
  W["CI Workflows"] -->|upload results| U["Upload Artifact"] -->|retain 10 days| S[("Actions Storage")] -->|expires| D["Automatic Deletion"]
  R["Release Workflow"] -->|publishes SBOMs| A[("Release Assets")]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Central organization retention cap

• ➕ Enforces the policy for current and future workflows
• ➕ Prevents omitted step-level settings from causing retention drift
• ➖ May affect repositories needing longer-lived temporary artifacts
• ➖ Provides less repository-level visibility and version-controlled intent

Recommendation: Keep the explicit per-step settings because they are auditable, preserve workflow-specific intent, and safely account for release SBOMs being published elsewhere. Consider an organization-level maximum as a complementary guardrail against future uploads omitting retention configuration.

Files changed (7) +8 / -8

Other (7) +8 / -8

code-quality.ymlShorten Rudra and Prusti artifact retention +2/-2

Shorten Rudra and Prusti artifact retention

• Changes both code-quality artifact uploads from 30-day to 10-day retention. Analysis and verification behavior remains unchanged.

.github/workflows/code-quality.yml

kani-verification.ymlShorten Kani result retention +1/-1

Shorten Kani result retention

• Reduces Kani verification artifact retention from 30 days to 10 days.

.github/workflows/kani-verification.yml

miri-memory-safety.ymlShorten Miri result retention +1/-1

Shorten Miri result retention

• Reduces Miri memory-safety artifact retention from 30 days to 10 days.

.github/workflows/miri-memory-safety.yml

pre-release.ymlStandardize prerelease performance retention +1/-1

Standardize prerelease performance retention

• Increases performance result retention from 7 days to the organization-standard 10 days.

.github/workflows/pre-release.yml

release.ymlCap temporary release SBOM retention +1/-1

Cap temporary release SBOM retention

• Reduces Actions retention for release SBOMs and the release binary from 365 days to 10 days. The comment clarifies that SBOMs are also attached to the GitHub release for durable access.

.github/workflows/release.yml

semgrep-sast.ymlShorten Semgrep result retention +1/-1

Shorten Semgrep result retention

• Reduces Semgrep JSON, SARIF, and text artifact retention from 30 days to 10 days.

.github/workflows/semgrep-sast.yml

weekly-security-scan.ymlShorten TruffleHog result retention +1/-1

Shorten TruffleHog result retention

• Reduces weekly secret-scan artifact retention from 90 days to 10 days.

.github/workflows/weekly-security-scan.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can group findings by type and pick your Finding display, from Minimal to Full

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗