GitHub Actions artifact storage

Pi Daemon retains workflow artifacts only when they are needed to diagnose a failure or prove a security-sensitive release action. GitHub release assets are not Actions artifacts and are governed by the release process instead.

Retention policy

Do not upload caches, complete stores, successful test trees, prompts, model output, credentials, environment dumps, tokens, or arbitrary runner paths as artifacts. A job summary and required check result are the evidence for a successful ordinary CI run.

Pages publication

The Pages workflow calls the shared self-hosted publisher (harryaskham.github.io publish-pages.yml). It builds the pinned Pandoc/Nix site with nix build .#pages, validates the expected files, and deploys a short-lived Pages artifact. Verify the public HTML URLs after a publication.

Inventory and cleanup

Cleanup uses the Actions artifacts API only. It never uses the release-assets endpoint, so published release tarballs and checksum sidecars are out of scope. Always inventory first and delete only reviewed numeric artifact IDs.

Set the repository explicitly and produce a non-mutating inventory:

repo=harryaskham/pi-daemon
gh api "repos/$repo/actions/artifacts" --paginate \
  --jq '.artifacts[] | [.id, .name, .size_in_bytes, .created_at, .expires_at, .expired] | @tsv'

To identify stale successful macOS archives created before this policy, filter the same read-only inventory by exact name and a reviewed cutoff:

repo=harryaskham/pi-daemon
cutoff=2026-08-30T00:00:00Z
gh api "repos/$repo/actions/artifacts" --paginate \
  --jq '.artifacts[] | select(.name | startswith("nix-macos-")) | select(.created_at < "'"$cutoff"'") | [.id, .name, .size_in_bytes, .created_at] | @tsv'

Review that output before any deletion. For each exact approved ID, read it back and then delete it from the Actions artifact endpoint:

repo=harryaskham/pi-daemon
artifact_id=REVIEWED_NUMERIC_ID
gh api "repos/$repo/actions/artifacts/$artifact_id" \
  --jq '[.id, .name, .size_in_bytes, .created_at] | @tsv'
gh api --method DELETE "repos/$repo/actions/artifacts/$artifact_id"

Do not turn this into an unreviewed age-based deletion loop. Do not call repos/$repo/releases/assets/...; that is a separate immutable release surface.