Merge branch '391607-cleanup-old-tokens' into 'master'

Reclaim disk space used by old job tokens

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/176025



Merged-by: Adam Hegyi <ahegyi@gitlab.com>
Approved-by: Tianwen Chen <tchen@gitlab.com>
Approved-by: Adam Hegyi <ahegyi@gitlab.com>
Co-authored-by: Marius Bobin <mbobin@gitlab.com>

db/docs/batched_background_migrations/remove_old_job_tokens.yml

+---
+migration_job_name: RemoveOldJobTokens
+description: Reclaim disk space taken by old job tokens
+feature_category: continuous_integration
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/176025
+milestone: '17.8'
+queued_migration_version: 20241217154001
+finalized_by: # version of the migration that finalized this BBM

db/post_migrate/20241217154001_queue_remove_old_job_tokens.rb

+# frozen_string_literal: true
+
+class QueueRemoveOldJobTokens < Gitlab::Database::Migration[2.2]
+  milestone '17.8'
+  restrict_gitlab_migration gitlab_schema: :gitlab_ci
+
+  MIGRATION = "RemoveOldJobTokens"
+  DELAY_INTERVAL = 2.minutes
+  BATCH_SIZE = 1000
+  SUB_BATCH_SIZE = 100
+
+  def up
+    queue_batched_background_migration(
+      MIGRATION,
+      :p_ci_builds,
+      :id,
+      job_interval: DELAY_INTERVAL,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :p_ci_builds, :id, [])
+  end
+end

db/schema_migrations/20241217154001

+6efa41f564e0a16989e98d28b9d31c614142b5b95b1978b14d497275ca71a3ba
\ No newline at end of file

lib/gitlab/background_migration/remove_old_job_tokens.rb

+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class RemoveOldJobTokens < BatchedMigrationJob
+      operation_name :remove_old_tokens
+      feature_category :continuous_integration
+
+      ACTIVE_STATUSES = %w[
+        waiting_for_resource
+        preparing
+        waiting_for_callback
+        pending
+        running
+      ].freeze
+
+      def perform
+        each_sub_batch do |sub_batch|
+          sub_batch
+            .where.not(status: ACTIVE_STATUSES)
+            .where.not(token_encrypted: nil)
+            .where(created_at: ...1.month.ago)
+            .update_all(token_encrypted: nil)
+        end
+      end
+    end
+  end
+end

spec/lib/gitlab/background_migration/remove_old_job_tokens_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::BackgroundMigration::RemoveOldJobTokens,
+  feature_category: :continuous_integration, migration: :gitlab_ci do
+  let(:connection) { Ci::ApplicationRecord.connection }
+  let(:pipelines_table) { table(:p_ci_pipelines, database: :ci, primary_key: :id) }
+  let(:builds_table) { table(:p_ci_builds, database: :ci, primary_key: :id) }
+
+  let(:default_attributes) { { project_id: 500, partition_id: 100 } }
+  let!(:old_pipeline) { pipelines_table.create!(default_attributes) }
+  let!(:new_pipeline) { pipelines_table.create!(default_attributes) }
+
+  let(:all_statuses) do
+    %w[created
+      waiting_for_resource
+      preparing
+      waiting_for_callback
+      pending
+      running
+      success
+      failed
+      canceling
+      canceled
+      skipped
+      manual
+      scheduled]
+  end
+
+  let(:active_statuses) { described_class::ACTIVE_STATUSES }
+  let(:inactive_statuses) { all_statuses - active_statuses }
+
+  before do
+    insert_jobs(pipeline: old_pipeline, created_at: 2.months.ago)
+    insert_jobs(pipeline: new_pipeline, created_at: 1.week.ago)
+  end
+
+  describe '#perform' do
+    subject(:migration) do
+      described_class.new(
+        start_id: builds_table.minimum(:id),
+        end_id: builds_table.maximum(:id),
+        batch_table: :p_ci_builds,
+        batch_column: :id,
+        sub_batch_size: 100,
+        pause_ms: 0,
+        connection: connection
+      )
+    end
+
+    it 'nullifies tokens for old not running jobs', :aggregate_failures do
+      expect(builds_table.where(token_encrypted: nil).any?).to be_falsey
+
+      expect { migration.perform }.to not_change { builds_table.count }
+
+      expect(builds_for(new_pipeline).where.not(token_encrypted: nil).count)
+        .to eq(all_statuses.count)
+
+      expect(builds_for(old_pipeline, status: active_statuses, token_encrypted: nil))
+        .to be_empty
+
+      expect(builds_for(old_pipeline, status: inactive_statuses, token_encrypted: nil).count)
+        .to eq(inactive_statuses.count)
+    end
+  end
+
+  def insert_jobs(pipeline:, created_at:)
+    data = all_statuses.map do |status|
+      default_attributes.merge(
+        status: status,
+        token_encrypted: SecureRandom.hex,
+        commit_id: pipeline.id,
+        created_at: created_at
+      )
+    end
+
+    builds_table.insert_all(data, unique_by: [:id, :partition_id])
+  end
+
+  def builds_for(pipeline, attrs = {})
+    builds_table.where(commit_id: pipeline, **attrs)
+  end
+end

spec/migrations/20241217154001_queue_remove_old_job_tokens_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueRemoveOldJobTokens, migration: :gitlab_ci, feature_category: :continuous_integration do
+  let!(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          gitlab_schema: :gitlab_ci,
+          table_name: :p_ci_builds,
+          column_name: :id,
+          interval: described_class::DELAY_INTERVAL,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE
+        )
+      }
+    end
+  end
+end