This task was discussed in the 2025-02-12 RelEng check-in meeting. I believe the consensus there was that we should disable the setting and also follow up by extending/removing the expiration date of active tokens directly via the rails console. Does that sound like what was concluded to you as well @brennen?

This task was discussed in the 2025-02-12 RelEng check-in meeting. I believe the consensus there was that we should disable the setting and also follow up by extending/removing the expiration date of active tokens directly via the rails console. Does that sound like what was concluded to you as well @brennen?

Yep, concur.

Looks like for the settings API we want:

• require_personal_access_token_expiry
• service_access_tokens_expiration_enforced

brennen opened https://gitlab.wikimedia.org/repos/releng/gitlab-settings/-/merge_requests/68

disable forced token expiry

Looks like there's a tool for handling expiration removal: https://docs.gitlab.com/administration/raketasks/tokens/ - will experiment with that.

brennen merged https://gitlab.wikimedia.org/repos/releng/gitlab-settings/-/merge_requests/68

disable forced token expiry

Mentioned in SAL (#wikimedia-releng) [2025-02-21T22:54:12Z] <brennen> gitlab: removing expiration date for 14 tokens expiring in 2025 (T385930)

In T385930#10572444, @brennen wrote:

I removed the expiry from 14 personal access tokens in total expiring in 2025. I'm operating on the assumption that stuff which already expired at the end of 2024 has probably been fixed by now. We can maybe revisit if there's anything lingering.

Yesterday gitlab emailed the https://gitlab.wikimedia.org/pywikibugs account to let it know that it's PAT named "read-only" would expire on 2025-05-11. I guess this means that the attempt to remove expiration from all tokens set to expire in 2025 didn't completely work. For this particular instance I just issued a new non-expiring token and rotated the credentials for the bot to use it. I have left the other token attached to the account, so we could try to use that to verify another attempt at removing expiry if folks are interested in trying that.

Same thing for gitlab-exporter, we got a 60 day expiry notification yesterday.

In T385930#10661714, @LSobanski wrote:

Same thing for gitlab-exporter, we got a 60 day expiry notification yesterday.

I double checked the gitlab-exporter token and it also had a expiration date. So I rotated the token and added a small description here https://wikitech.wikimedia.org/wiki/GitLab/Monitoring#Custom_exporter. The new token has no expiry date anymore.