No audit log emitted when pipelines are auto-archived internally
Problem
When a pipeline is archived via fly archive-pipeline (the REST API), the HTTP auditor correctly logs an ArchivePipeline audit event. However, when pipelines are archived internally by Concourse, no audit trail is produced. This makes it impossible to determine when or why a pipeline was archived if the archival was triggered automatically.
There are two internal code paths that archive pipelines without producing audit logs:
- build.Finish() - When a successful build's
set_pipelinestep causes child pipelines to be archived (e.g. a child pipeline is no longer set by the latest successful build of its parent job). - ArchiveAbandonedPipelines() - The periodic GC that archives orphaned child pipelines whose parent pipeline was destroyed, archived, or whose parent job was removed.
Impact
Archiving a pipeline is a somewhat destructive operation. Without an audit trail for internally-triggered archives, operators have no way to:
- Determine when a pipeline was archived
- Determine what caused the archival (which parent pipeline/job/build triggered it, or whether it was GC)
- Search for
ArchivePipelineaudit events and get a complete picture of all pipeline archival activity
Expected behavior
When --enable-pipeline-auditing is enabled, Concourse should emit a structured audit log line for every pipeline archival, regardless of whether it was triggered via the REST API or internally. The log should include enough context to identify the archived pipeline and what triggered the archival.
Environment
- Concourse version: latest main branch (also affects earlier versions with the set_pipeline auto-archive feature)
Source: concourse/concourse