An organization decides to retire a GitHub App-based agent that has been operating for 18 months. Compliance policy requires that all actions the agent took must remain auditable for 7 years. What steps must be taken when retiring the agent to ensure historical auditability is preserved?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Deleting the agent is fine. Deleting its audit trail is a compliance violation. Archive all run logs and trace events to a long-term store before you pull the plug, and document the agent's identity so historical actions stay attributable for the full retention period. The correct answer is B.
Full explanation below image
Full Explanation
Retiring an agent is a two-phase operation: (1) preserving the historical audit record and (2) decommissioning the agent's credentials and access. The two phases must be performed in the right order — archive first, decommission second.
Phase 1 — Archive historical records: Export all GitHub Actions workflow run logs that contain agent activity (GitHub retains workflow logs for a configurable period; logs older than the retention period must already be in an external archive). Export structured audit trail records and trace events from any SIEM or log aggregation system. Document the agent's identity in a compliance record: the GitHub App ID, the installation IDs, the service account username if applicable, and the repositories it operated on. This documentation ensures that historical actions attributed to a specific GitHub App ID in commit metadata and audit logs remain interpretable 7 years later. Archive all documents to a retention-compliant store with the appropriate 7-year retention policy.
Phase 2 — Decommission: Uninstall the GitHub App from all repositories. Revoke all installation tokens. Delete the App registration if the organization will not reuse it.
Option A is incorrect because git history captures commits made by the agent's service account but does not capture the full audit record: workflow run logs, API calls made, tool invocations, or decision rationale.
Option C is incorrect because keeping the App installed but disabled creates a security risk (the App still exists and could be re-enabled) and does not constitute a proper decommission.
Option D is incorrect because transferring the App and archiving the repository does not address the log retention requirement.