Project access tokens persist after the deletion of project
As investigated in https://gitlab.com/gitlab-org/gitlab/-/issues/430288+, we found that group and resource access tokens persist even after the group / project is deleted.
To resolve that, we need:
- a background migration to cleanup resource access tokens and the associated bot users where the group / project has already been deleted
- make sure we delete the resource access tokens during the deletion of group / project
- consider revoking access tokens even earlier. Eg. on .com, projects even on the free tier are subject to delayed deletion, but the tokens are usable despite the group / project is hidden on the UI.
Edited by Imre Farkas