gitlab:doctor:reset_encryption_tokens task fails when there is more than one affected token in a singe model record

Summary

The gtlab:doctor:reset_encryption_tokens rake task was introduced by the the Runner group primarily to help address issues with undecryptable group and project runner tokens.

When used to reset tokens in the application_settings table if more than one token is undecryptable the task fails due to it processing one token at a time and ActiveRecord attempting to decrypt all encrypted values before saving the updated record.

Its usage documentation has been updated to note this limitation (and the fact it only works for tokens, not other types of encrypted values) but I've created this issue to assess whether the task should be enhanced to work to reset multiple tokens in a single record, as implied by the original documentation. Or the documentation amended to make it clear the task is only intended to be used for runner token resets.

Steps to reproduce

Example Project

What is the current bug behavior?

What is the expected correct behavior?

Relevant logs and/or screenshots

Example of errors when trying to reset two undecryptable tokens runners_registration_token, error_tracking_access_token) in the application_settings table:

root@gitlab-latest-v18:~# gitlab-rake gitlab:doctor:secrets VERBOSE=1
I, [2025-07-31T23:36:47.110236 #4437]  INFO -- : Checking encrypted values in the database
I, [2025-07-31T23:37:01.787252 #4437]  INFO -- : - Observability::GroupO11ySetting failures: 0
I, [2025-07-31T23:37:01.795760 #4437]  INFO -- : - DependencyProxy::GroupSetting failures: 0
I, [2025-07-31T23:37:01.802755 #4437]  INFO -- : - VirtualRegistries::Packages::Maven::Upstream failures: 0
I, [2025-07-31T23:37:01.809014 #4437]  INFO -- : - Ai::ActiveContext::Connection failures: 0
I, [2025-07-31T23:37:01.853396 #4437]  INFO -- : - CloudConnector::Keys failures: 0
I, [2025-07-31T23:37:01.876235 #4437]  INFO -- : - ApplicationSetting failures: 1
D, [2025-07-31T23:37:01.876315 #4437] DEBUG -- :   - ApplicationSetting[1]: runners_registration_token, error_tracking_access_token
I, [2025-07-31T23:37:01.891204 #4437]  INFO -- : - Ci::PipelineScheduleInput failures: 0
I, [2025-07-31T23:37:01.899040 #4437]  INFO -- : - Packages::Debian::ProjectDistributionKey failures: 0
I, [2025-07-31T23:37:01.905551 #4437]  INFO -- : - Packages::Debian::GroupDistributionKey failures: 0
I, [2025-07-31T23:37:01.912274 #4437]  INFO -- : - Clusters::Providers::Gcp failures: 0
I, [2025-07-31T23:37:01.919113 #4437]  INFO -- : - Clusters::Providers::Aws failures: 0
I, [2025-07-31T23:37:01.922084 #4437]  INFO -- : - Clusters::Integrations::Prometheus failures: 0
I, [2025-07-31T23:37:01.928789 #4437]  INFO -- : - ServiceDesk::CustomEmailVerification failures: 0
I, [2025-07-31T23:37:01.935117 #4437]  INFO -- : - ServiceDesk::CustomEmailCredential failures: 0
I, [2025-07-31T23:37:01.957419 #4437]  INFO -- : - Integrations::ZentaoTrackerData failures: 0
I, [2025-07-31T23:37:01.979856 #4437]  INFO -- : - Integrations::JiraTrackerData failures: 0
I, [2025-07-31T23:37:02.001580 #4437]  INFO -- : - Integrations::IssueTrackerData failures: 0
I, [2025-07-31T23:37:02.009104 #4437]  INFO -- : - IncidentManagement::ProjectIncidentManagementSetting failures: 0
I, [2025-07-31T23:37:02.015647 #4437]  INFO -- : - ErrorTracking::ProjectErrorTrackingSetting failures: 0
I, [2025-07-31T23:37:02.038461 #4437]  INFO -- : - Clusters::KubernetesNamespace failures: 0
I, [2025-07-31T23:37:02.050380 #4437]  INFO -- : - CloudConnector::ServiceAccessToken failures: 0
I, [2025-07-31T23:37:02.058352 #4437]  INFO -- : - BulkImports::Configuration failures: 0
I, [2025-07-31T23:37:02.065881 #4437]  INFO -- : - Atlassian::Identity failures: 0
I, [2025-07-31T23:37:02.072997 #4437]  INFO -- : - Alerting::ProjectAlertingSetting failures: 0
I, [2025-07-31T23:37:02.081215 #4437]  INFO -- : - SlackIntegration failures: 0
I, [2025-07-31T23:37:02.087088 #4437]  INFO -- : - RemoteMirror failures: 0
I, [2025-07-31T23:37:02.244501 #4437]  INFO -- : - ProjectSetting failures: 0
I, [2025-07-31T23:37:02.253976 #4437]  INFO -- : - PagesDomainAcmeOrder failures: 0
I, [2025-07-31T23:37:02.278618 #4437]  INFO -- : - PagesDomain failures: 0
I, [2025-07-31T23:37:02.286639 #4437]  INFO -- : - JiraConnectInstallation failures: 0
I, [2025-07-31T23:37:02.294789 #4437]  INFO -- : - GrafanaIntegration failures: 0
I, [2025-07-31T23:37:02.301801 #4437]  INFO -- : - ChatName failures: 0
I, [2025-07-31T23:37:02.306514 #4437]  INFO -- : - DependencyProxy::Packages::Setting failures: 0
I, [2025-07-31T23:37:02.314012 #4437]  INFO -- : - SystemAccess::MicrosoftGraphAccessToken failures: 0
I, [2025-07-31T23:37:02.322432 #4437]  INFO -- : - SystemAccess::MicrosoftApplication failures: 0
I, [2025-07-31T23:37:02.332351 #4437]  INFO -- : - SystemAccess::GroupMicrosoftGraphAccessToken failures: 0
I, [2025-07-31T23:37:02.340519 #4437]  INFO -- : - SystemAccess::GroupMicrosoftApplication failures: 0
I, [2025-07-31T23:37:02.348329 #4437]  INFO -- : - StatusPage::ProjectSetting failures: 0
I, [2025-07-31T23:37:02.380598 #4437]  INFO -- : - ComplianceManagement::ComplianceFramework::ComplianceRequirementsControl failures: 0
I, [2025-07-31T23:37:02.389849 #4437]  INFO -- : - AuditEvents::Instance::ExternalStreamingDestination failures: 0
I, [2025-07-31T23:37:02.398266 #4437]  INFO -- : - AuditEvents::Group::ExternalStreamingDestination failures: 0
I, [2025-07-31T23:37:02.407807 #4437]  INFO -- : - AuditEvents::Instance::GoogleCloudLoggingConfiguration failures: 0
I, [2025-07-31T23:37:02.417334 #4437]  INFO -- : - AuditEvents::Instance::AmazonS3Configuration failures: 0
I, [2025-07-31T23:37:02.425193 #4437]  INFO -- : - AuditEvents::AmazonS3Configuration failures: 0
I, [2025-07-31T23:37:02.434523 #4437]  INFO -- : - AuditEvents::GoogleCloudLoggingConfiguration failures: 0
I, [2025-07-31T23:37:02.441700 #4437]  INFO -- : - AuditEvents::InstanceExternalAuditEventDestination failures: 0
I, [2025-07-31T23:37:02.456788 #4437]  INFO -- : - Ai::SelfHostedModel failures: 0
I, [2025-07-31T23:37:02.467088 #4437]  INFO -- : - MergeRequests::ExternalStatusCheck failures: 0
I, [2025-07-31T23:37:02.477013 #4437]  INFO -- : - AlertManagement::HttpIntegration failures: 0
I, [2025-07-31T23:37:02.485749 #4437]  INFO -- : - RemoteDevelopment::WorkspaceVariable failures: 0
I, [2025-07-31T23:37:02.493815 #4437]  INFO -- : - Clusters::Agents::UrlConfiguration failures: 0
I, [2025-07-31T23:37:02.495809 #4437]  INFO -- : - EE::Gitlab::BackgroundMigration::FixSecretTokensForHttpDestinations::GroupStreamingDestination failures: 0
I, [2025-07-31T23:37:02.497590 #4437]  INFO -- : - EE::Gitlab::BackgroundMigration::FixIncompleteInstanceExternalAuditDestinations::InstanceStreamingDestination failures: 0
I, [2025-07-31T23:37:02.500090 #4437]  INFO -- : - EE::Gitlab::BackgroundMigration::FixIncompleteInstanceExternalAuditDestinations::InstanceExternalAuditEventDestination failures: 0
I, [2025-07-31T23:37:02.502627 #4437]  INFO -- : - EE::Gitlab::BackgroundMigration::FixIncompleteExternalAuditDestinations::GroupStreamingDestination failures: 0
I, [2025-07-31T23:37:02.505017 #4437]  INFO -- : - EE::Gitlab::BackgroundMigration::CreateMissingExternalLinksForVulnerabilities::JiraTrackerData failures: 0
I, [2025-07-31T23:37:02.532342 #4437]  INFO -- : - WebHook failures: 0
I, [2025-07-31T23:37:02.560806 #4437]  INFO -- : - Integration failures: 0
I, [2025-07-31T23:37:02.576132 #4437]  INFO -- : - ProjectImportData failures: 0
I, [2025-07-31T23:37:02.604801 #4437]  INFO -- : - Snippet failures: 0
I, [2025-07-31T23:37:02.613291 #4437]  INFO -- : - Clusters::Platforms::Kubernetes failures: 0
I, [2025-07-31T23:37:02.621312 #4437]  INFO -- : - GeoNode failures: 0
I, [2025-07-31T23:37:02.703494 #4437]  INFO -- : - User failures: 0
I, [2025-07-31T23:37:02.709099 #4437]  INFO -- : - SystemHook failures: 0
I, [2025-07-31T23:37:02.712484 #4437]  INFO -- : - ServiceHook failures: 0
I, [2025-07-31T23:37:02.715791 #4437]  INFO -- : - GroupHook failures: 0
I, [2025-07-31T23:37:02.718809 #4437]  INFO -- : - ProjectHook failures: 0
I, [2025-07-31T23:37:02.721475 #4437]  INFO -- : - Integrations::MockMonitoring failures: 0
I, [2025-07-31T23:37:02.723986 #4437]  INFO -- : - Integrations::MockCi failures: 0
I, [2025-07-31T23:37:02.726399 #4437]  INFO -- : - Integrations::BeyondIdentity failures: 0
I, [2025-07-31T23:37:02.728881 #4437]  INFO -- : - Integrations::AmazonQ failures: 0
I, [2025-07-31T23:37:02.731125 #4437]  INFO -- : - Integrations::Prometheus failures: 0
I, [2025-07-31T23:37:02.733758 #4437]  INFO -- : - Integrations::GoogleCloudPlatform::WorkloadIdentityFederation failures: 0
I, [2025-07-31T23:37:02.736731 #4437]  INFO -- : - Integrations::GoogleCloudPlatform::ArtifactRegistry failures: 0
I, [2025-07-31T23:37:02.739905 #4437]  INFO -- : - Integrations::GitGuardian failures: 0
I, [2025-07-31T23:37:02.743161 #4437]  INFO -- : - Integrations::Github failures: 0
I, [2025-07-31T23:37:02.745956 #4437]  INFO -- : - Integrations::SquashTm failures: 0
I, [2025-07-31T23:37:02.748391 #4437]  INFO -- : - Integrations::Zentao failures: 0
I, [2025-07-31T23:37:02.750875 #4437]  INFO -- : - Integrations::WebexTeams failures: 0
I, [2025-07-31T23:37:02.754189 #4437]  INFO -- : - Integrations::UnifyCircuit failures: 0
I, [2025-07-31T23:37:02.756762 #4437]  INFO -- : - Integrations::Telegram failures: 0
I, [2025-07-31T23:37:02.758953 #4437]  INFO -- : - Integrations::Teamcity failures: 0
I, [2025-07-31T23:37:02.761380 #4437]  INFO -- : - Integrations::Mattermost failures: 0
I, [2025-07-31T23:37:02.763635 #4437]  INFO -- : - Integrations::MicrosoftTeams failures: 0
I, [2025-07-31T23:37:02.766758 #4437]  INFO -- : - Integrations::Slack failures: 0
I, [2025-07-31T23:37:02.769764 #4437]  INFO -- : - Integrations::Clickup failures: 0
I, [2025-07-31T23:37:02.772635 #4437]  INFO -- : - Integrations::Youtrack failures: 0
I, [2025-07-31T23:37:02.775292 #4437]  INFO -- : - Integrations::Ewm failures: 0
I, [2025-07-31T23:37:02.777718 #4437]  INFO -- : - Integrations::Redmine failures: 0
I, [2025-07-31T23:37:02.781092 #4437]  INFO -- : - Integrations::Pushover failures: 0
I, [2025-07-31T23:37:02.784036 #4437]  INFO -- : - Integrations::Pumble failures: 0
I, [2025-07-31T23:37:02.786970 #4437]  INFO -- : - Integrations::Pivotaltracker failures: 0
I, [2025-07-31T23:37:02.790321 #4437]  INFO -- : - Integrations::PipelinesEmail failures: 0
I, [2025-07-31T23:37:02.792798 #4437]  INFO -- : - Integrations::Phorge failures: 0
I, [2025-07-31T23:37:02.795825 #4437]  INFO -- : - Integrations::Packagist failures: 0
I, [2025-07-31T23:37:02.798182 #4437]  INFO -- : - Integrations::SlackSlashCommands failures: 0
I, [2025-07-31T23:37:02.800572 #4437]  INFO -- : - Integrations::MattermostSlashCommands failures: 0
I, [2025-07-31T23:37:02.802988 #4437]  INFO -- : - Integrations::Matrix failures: 0
I, [2025-07-31T23:37:02.805147 #4437]  INFO -- : - Integrations::JiraCloudApp failures: 0
I, [2025-07-31T23:37:02.807537 #4437]  INFO -- : - Integrations::Jira failures: 0
I, [2025-07-31T23:37:02.809653 #4437]  INFO -- : - Integrations::Jenkins failures: 0
I, [2025-07-31T23:37:02.811934 #4437]  INFO -- : - Integrations::Irker failures: 0
I, [2025-07-31T23:37:02.814782 #4437]  INFO -- : - Integrations::Harbor failures: 0
I, [2025-07-31T23:37:02.817486 #4437]  INFO -- : - Integrations::HangoutsChat failures: 0
I, [2025-07-31T23:37:02.819631 #4437]  INFO -- : - Integrations::GooglePlay failures: 0
I, [2025-07-31T23:37:02.822914 #4437]  INFO -- : - Integrations::GitlabSlackApplication failures: 0
I, [2025-07-31T23:37:02.825860 #4437]  INFO -- : - Integrations::ExternalWiki failures: 0
I, [2025-07-31T23:37:02.828847 #4437]  INFO -- : - Integrations::EmailsOnPush failures: 0
I, [2025-07-31T23:37:02.832975 #4437]  INFO -- : - Integrations::DroneCi failures: 0
I, [2025-07-31T23:37:02.836183 #4437]  INFO -- : - Integrations::Discord failures: 0
I, [2025-07-31T23:37:02.839292 #4437]  INFO -- : - Integrations::DiffblueCover failures: 0
I, [2025-07-31T23:37:02.842557 #4437]  INFO -- : - Integrations::Datadog failures: 0
I, [2025-07-31T23:37:02.845973 #4437]  INFO -- : - Integrations::CustomIssueTracker failures: 0
I, [2025-07-31T23:37:02.849295 #4437]  INFO -- : - Integrations::Confluence failures: 0
I, [2025-07-31T23:37:02.852559 #4437]  INFO -- : - Integrations::Campfire failures: 0
I, [2025-07-31T23:37:02.856519 #4437]  INFO -- : - Integrations::Buildkite failures: 0
I, [2025-07-31T23:37:02.860077 #4437]  INFO -- : - Integrations::Bugzilla failures: 0
I, [2025-07-31T23:37:02.863859 #4437]  INFO -- : - Integrations::Bamboo failures: 0
I, [2025-07-31T23:37:02.867306 #4437]  INFO -- : - Integrations::Assembla failures: 0
I, [2025-07-31T23:37:02.870800 #4437]  INFO -- : - Integrations::Asana failures: 0
I, [2025-07-31T23:37:02.874044 #4437]  INFO -- : - Integrations::AppleAppStore failures: 0
I, [2025-07-31T23:37:02.876911 #4437]  INFO -- : - PersonalSnippet failures: 0
I, [2025-07-31T23:37:02.879026 #4437]  INFO -- : - ProjectSnippet failures: 0
I, [2025-07-31T23:37:02.888821 #4437]  INFO -- : - Dast::SiteProfileSecretVariable failures: 0
I, [2025-07-31T23:37:02.899431 #4437]  INFO -- : - Ci::JobVariable failures: 0
I, [2025-07-31T23:37:02.909581 #4437]  INFO -- : - Ci::Trigger failures: 0
I, [2025-07-31T23:37:02.911460 #4437]  INFO -- : - Gitlab::BackgroundMigration::EncryptCiTriggerToken::CiTrigger failures: 0
I, [2025-07-31T23:37:02.916322 #4437]  INFO -- : - Gitlab::BackgroundMigration::BackfillPCiPipelineVariablesFromCiTriggerRequests::CiPipelineVariable failures: 0
I, [2025-07-31T23:37:02.925865 #4437]  INFO -- : - Ci::GroupVariable failures: 0
I, [2025-07-31T23:37:02.936379 #4437]  INFO -- : - Ci::Variable failures: 0
I, [2025-07-31T23:37:02.946045 #4437]  INFO -- : - Ci::PipelineScheduleVariable failures: 0
I, [2025-07-31T23:37:02.955134 #4437]  INFO -- : - Ci::InstanceVariable failures: 0
I, [2025-07-31T23:37:02.958359 #4437]  INFO -- : - Ci::PipelineVariable failures: 0
I, [2025-07-31T23:37:02.968472 #4437]  INFO -- : - Operations::FeatureFlagsClient failures: 0
I, [2025-07-31T23:37:02.978563 #4437]  INFO -- : - RemoteDevelopment::WorkspaceToken failures: 0
I, [2025-07-31T23:37:02.988045 #4437]  INFO -- : - ScimOauthAccessToken failures: 0
I, [2025-07-31T23:37:02.996436 #4437]  INFO -- : - GroupScimAuthAccessToken failures: 0
I, [2025-07-31T23:37:03.026550 #4437]  INFO -- : - Clusters::AgentToken failures: 0
I, [2025-07-31T23:37:03.059626 #4437]  INFO -- : - DeployToken failures: 0
I, [2025-07-31T23:37:03.353518 #4437]  INFO -- : - Project failures: 0
I, [2025-07-31T23:37:03.363448 #4437]  INFO -- : - Group failures: 0
I, [2025-07-31T23:37:03.388265 #4437]  INFO -- : - Ci::Runner failures: 0
I, [2025-07-31T23:37:15.785842 #4437]  INFO -- : - Ci::Build failures: 0
I, [2025-07-31T23:37:15.785917 #4437]  INFO -- : Total: 1 row(s) affected
I, [2025-07-31T23:37:15.785940 #4437]  INFO -- : Done!


root@gitlab-latest-v18:~# DRY_RUN=false VERBOSE=true MODEL_NAMES=ApplicationSetting TOKEN_NAMES=runners_registration_token,error_tracking_access_token gitlab-rake gitlab:doctor:reset_encrypted_tokens
I, [2025-07-31T23:38:48.658372 #4593]  INFO -- : Resetting runners_registration_token, error_tracking_access_token on ApplicationSetting if they can not be read
D, [2025-07-31T23:39:04.701644 #4593] DEBUG -- : > Fix ApplicationSetting[1].runners_registration_token
rake aborted!
TypeError: no implicit conversion of nil into String
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/crypto_helper.rb:39:in `block in aes256_gcm_decrypt'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/crypto_helper.rb:38:in `each'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/crypto_helper.rb:38:in `each_with_index'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/crypto_helper.rb:38:in `aes256_gcm_decrypt'


/opt/gitlab/embedded/service/gitlab-rails/lib/authn/token_field/encryption_helper.rb:19:in `decrypt_token'


/opt/gitlab/embedded/service/gitlab-rails/lib/authn/token_field/encrypted.rb:82:in `get_encrypted_token'


/opt/gitlab/embedded/service/gitlab-rails/lib/authn/token_field/encrypted.rb:117:in `token_set?'


/opt/gitlab/embedded/service/gitlab-rails/lib/authn/token_field/base.rb:57:in `ensure_token'


/opt/gitlab/embedded/service/gitlab-rails/lib/authn/token_field/encrypted.rb:38:in `ensure_token'


/opt/gitlab/embedded/service/gitlab-rails/app/models/concerns/token_authenticatable.rb:65:in `block in add_authentication_token_field'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/connection_proxy.rb:127:in `public_send'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/connection_proxy.rb:127:in `block in write_using_load_balancer'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/load_balancer.rb:145:in `block in read_write'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/load_balancer.rb:232:in `retry_with_backoff'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/load_balancer.rb:135:in `read_write'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/connection_proxy.rb:126:in `write_using_load_balancer'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/connection_proxy.rb:78:in `transaction'


/opt/gitlab/embedded/service/gitlab-rails/lib/authn/token_field/base.rb:70:in `reset_token!'


/opt/gitlab/embedded/service/gitlab-rails/app/models/concerns/token_authenticatable.rb:75:in `block in add_authentication_token_field'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:51:in `public_send'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:51:in `rescue in fix_attribute'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:47:in `fix_attribute'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:39:in `block (2 levels) in fix_model'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:38:in `each'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:38:in `block in fix_model'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:37:in `with_index'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:37:in `fix_model'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:23:in `block in run!'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:22:in `each'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:22:in `run!'


/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/doctor/secrets.rake:27:in `block (3 levels) in <top (required)>'


/opt/gitlab/embedded/bin/bundle:25:in `load'


/opt/gitlab/embedded/bin/bundle:25:in `<main>'



Caused by:
TypeError: no implicit conversion of nil into String
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/crypto_helper.rb:39:in `block in aes256_gcm_decrypt'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/crypto_helper.rb:38:in `each'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/crypto_helper.rb:38:in `each_with_index'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/crypto_helper.rb:38:in `aes256_gcm_decrypt'


/opt/gitlab/embedded/service/gitlab-rails/lib/authn/token_field/encryption_helper.rb:19:in `decrypt_token'


/opt/gitlab/embedded/service/gitlab-rails/lib/authn/token_field/encrypted.rb:82:in `get_encrypted_token'


/opt/gitlab/embedded/service/gitlab-rails/lib/authn/token_field/encrypted.rb:117:in `token_set?'


/opt/gitlab/embedded/service/gitlab-rails/lib/authn/token_field/base.rb:63:in `ensure_token!'


/opt/gitlab/embedded/service/gitlab-rails/app/models/concerns/token_authenticatable.rb:70:in `block in add_authentication_token_field'


/opt/gitlab/embedded/service/gitlab-rails/app/models/application_setting_implementation.rb:569:in `runners_registration_token'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:48:in `public_send'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:48:in `fix_attribute'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:39:in `block (2 levels) in fix_model'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:38:in `each'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:38:in `block in fix_model'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:37:in `with_index'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:37:in `fix_model'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:23:in `block in run!'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:22:in `each'


/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/doctor/reset_tokens.rb:22:in `run!'


/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/doctor/secrets.rake:27:in `block (3 levels) in <top (required)>'


/opt/gitlab/embedded/bin/bundle:25:in `load'


/opt/gitlab/embedded/bin/bundle:25:in `<main>'


Tasks: TOP => gitlab:doctor:reset_encrypted_tokens
(See full trace by running task with --trace)

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info

  (For installations with omnibus-gitlab package run and paste the output of: \\\`sudo gitlab-rake gitlab:env:info\\\`)  (For installations from source run and paste the output of: \\\`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production\\\`)   

Results of GitLab application Check

Expand for output related to the GitLab application check

 (For installations with omnibus-gitlab package run and paste the output of: \`sudo gitlab-rake gitlab:check SANITIZE=true\`)  (For installations from source run and paste the output of: \`sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true\`)  (we will only investigate if the tests are passing)  

Possible fixes

Patch release information for backports

If the bug fix needs to be backported in a patch release to a version under the maintenance policy, please follow the steps on the patch release runbook for GitLab engineers.

Refer to the internal "Release Information" dashboard for information about the next patch release, including the targeted versions, expected release date, and current status.

High-severity bug remediation

To remediate high-severity issues requiring an internal release for single-tenant SaaS instances, refer to the internal release process for engineers.