feat(server-nestjs): proactive GitLab mirror token rotation with enforced headroom - #2693
Merged
Merged
Conversation
shikanime
force-pushed
the
feat/gitlab-mirror-token-rotation
branch
from
September 8, 2026 15:17
60a710f to
a9a0c8d
Compare
…rced headroom Mirror tokens were rotated only reactively (missing or invalid at read time), so a silent rotation failure left the token valid until its expiration with no replacement prepared. Add GITLAB_MIRROR_TOKEN_ROTATION_THRESHOLD_DAYS (default 250, roughly a third of the default 365-day token lifetime) to the GitLab config and proactively rotate the group access token when the Vault secret age exceeds it. GITLAB_MIRROR_TOKEN_EXPIRATION_DAYS is now schema-enforced so the rotation threshold stays strictly below the expiration, meaning tokens are always replaced before they expire. Refs #2691 Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr> Change-Id: I6ac7f2390806c4f4c7c426d4d955c8ce6a6a6964
shikanime
force-pushed
the
feat/gitlab-mirror-token-rotation
branch
from
September 8, 2026 15:21
a9a0c8d to
62c50bf
Compare
shikanime
marked this pull request as ready for review
September 8, 2026 15:23
shikanime
added
technical debt
|
0 New Issues
0 Fixed Issues
0 Accepted Issues
StephaneTrebel
approved these changes
Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issues liées
Issues numéro:
#2691
Quel est le comportement actuel ?
Les tokens de miroir ne sont remplacés que de manière réactive (absents ou invalides à la lecture).
Un échec silencieux de rotation laisse alors le token valide jusqu'à son expiration, sans remplaçant préparé.
Quel est le nouveau comportement ?
Ajout de
GITLAB_MIRROR_TOKEN_ROTATION_THRESHOLD_DAYSdans la config GitLab (par défaut 250, environ un tiers de la durée de vie par défaut de 365 jours).Le token d'accès groupe est remplacé de manière préventive dès que l'âge du secret Vault dépasse ce seuil.
GITLAB_MIRROR_TOKEN_EXPIRATION_DAYSest désormais validé par le schéma afin que le seuil de rotation reste strictement inférieur à l'expiration.Les tokens sont donc toujours remplacés avant d'expirer.
Cette PR introduit-elle un breaking change ?
Non.
Autres informations