#9699·concourse

No audit log emitted when pipelines are auto-archived internally

Author: databus23Created Sep 4, 2026Updated Sep 4, 2026

Problem

When a pipeline is archived via fly archive-pipeline (the REST API), the HTTP auditor correctly logs an ArchivePipeline audit event. However, when pipelines are archived internally by Concourse, no audit trail is produced. This makes it impossible to determine when or why a pipeline was archived if the archival was triggered automatically.

There are two internal code paths that archive pipelines without producing audit logs:

  1. build.Finish() - When a successful build's set_pipeline step causes child pipelines to be archived (e.g. a child pipeline is no longer set by the latest successful build of its parent job).
  2. ArchiveAbandonedPipelines() - The periodic GC that archives orphaned child pipelines whose parent pipeline was destroyed, archived, or whose parent job was removed.

Impact

Archiving a pipeline is a somewhat destructive operation. Without an audit trail for internally-triggered archives, operators have no way to:

  • Determine when a pipeline was archived
  • Determine what caused the archival (which parent pipeline/job/build triggered it, or whether it was GC)
  • Search for ArchivePipeline audit events and get a complete picture of all pipeline archival activity

Expected behavior

When --enable-pipeline-auditing is enabled, Concourse should emit a structured audit log line for every pipeline archival, regardless of whether it was triggered via the REST API or internally. The log should include enough context to identify the archived pipeline and what triggered the archival.

Environment

  • Concourse version: latest main branch (also affects earlier versions with the set_pipeline auto-archive feature)