fix(contributor-check): raise artifact retention to 90 days

[aaronpowell]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services. (N/A — not a submission)
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory. (N/A — infrastructure bug fix to an existing workflow)
• The file follows the required naming convention. (N/A)
• The content is clearly structured and follows the example format. (N/A)
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot. (N/A)
• I have run npm start and verified that README.md is up to date. (ran npm run build; no README changes needed for this fix)
• I am targeting the main branch for this pull request.

---

Description

Fixes contributor-check.yml's artifact retention so the submission gate's "Contributor risk signal" infrastructure check stops permanently failing on PRs that take longer than a few days to review.

Root cause: .github/workflows/contributor-check.yml uploads the contributor-check-result artifact with retention-days: 3. eng/submission-gate.mjs's readContributorRiskArtifact() downloads that artifact via gh run download to read the contributor risk signal. Once the artifact expires (after 3 days), the download fails, the error is caught and treated as null, and the gate reports a permanent "infrastructure failure" ("Contributor risk signal") that can only be cleared by a maintainer commenting /rerun-checks to regenerate a fresh artifact.

Reproduced directly: gh run download 37007671556 --repo github/awesome-copilot --name contributor-check-result returns "no valid artifacts found to download" — the artifact (uploaded 2026-10-02, 338 bytes, upload itself succeeded) expired under the 3-day retention before PR #3871 was reviewed.

Fix: raise retention-days from 3 to 90 (GitHub's standard default) for the contributor-check-result artifact upload step, so the artifact survives long enough to be read regardless of how long a PR waits for review.

I checked whether anything else in the repo relies on the 3-day window (eng/submission-gate.mjs, its tests, and docs) — nothing hard-codes or assumes a specific retention period; readContributorRiskArtifact() simply fails closed on any gh run download error, so no other changes were needed.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

Validation performed:

• npm ci — installed dependencies (js-yaml was missing before this).
• node --test eng/submission-gate.test.mjs — 47/47 tests passed.
• npm run build — succeeded, regenerated marketplace.json (no README diff from this change).
• bash eng/fix-line-endings.sh — only the intended line was flagged as changed.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 2 approvals from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• .github/workflows/contributor-check.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Submission gate tests	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	✅ Passed	Passed · logs

Review

• Approvals: 0/2
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 2 more approval(s); an approval from a maintainer with admin or maintain permission
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for a17ff2f · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[Copilot]

Copilot review overview

🟢 Approval recommended

The scoped retention change preserves artifact compatibility and introduces no identified blocking issues.

Review effort: Balanced
Findings: None

What changed in this PR

Extends contributor-risk artifact availability to reduce submission-gate failures on PRs awaiting review.

Changes:

• Increases contributor-check-result retention from 3 to 90 days.

File	Description
.github/​workflows/​contributor-check.yml	Retains contributor-risk artifacts for 90 days.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.