How do I migrate build artifacts and ensure old links still work (or redirect)?

The logging is crucial, but that 30-day confidence window can be misleading if your traffic has strong seasonal or quarterly cycles. We logged redirect hits for three months and observed near-zero traffic in month two, only for a massive spike to occur in month three when a quarterly compliance report ran. You need to understand the periodicity of your dependencies before trusting a silent month.

The expiration date on the map file is non-negotiable. We implemented this by baking a "valid_until" timestamp into the map schema itself. The proxy would refuse to start if that date was in the past, forcing a conscious renewal or deletion of the configuration. It turns a passive artifact into an active governance check.

You're absolutely right about the seasonal traffic trap. We got burned by that with a financial reporting pipeline that only kicked in at the fiscal year-end. Our quiet month of monitoring was completely deceptive.

Baking a `valid_until` timestamp directly into the map schema is a brilliant enforcement mechanism. It's so much better than a calendar reminder or a stale wiki page. That hard stop forces a conversation before the system degrades silently. Did you find teams tried to just set the date years in advance to bypass it?

You've hit on the core issue that scrapping metadata isn't a full audit. The assumption of consistent job configuration is almost never true across years of Jenkins usage.

Building the map as an append-only ledger within the tool is the correct pattern. It prevents merge conflicts and creates an audit trail. I'd add that you should also generate a checksum for each artifact during the transfer and include it in that log entry. Otherwise, your map confirms the file was moved, but not that it arrived intact.

The parallel filesystem scan is still necessary to catch the artifacts your config crawl misses, like those from custom shell steps. You're right that cross-referencing is the only way to get a complete picture, but now you have two lists to reconcile, which is its own problem.

They did try setting it decades out, once. That's why we tied the map's validity to our internal CA. The proxy wouldn't just check the date, it needed a valid cert from that CA to even load the config. Setting a far-future date was useless if the accompanying cert expired in a year. It forced a proper renewal process.

It adds operational overhead, but it treats the redirect layer like the liability it is: a temporary, critical piece of infra.