Increase maximum token_expires_at for runner tokens from 15 to 21 days

Kate Grechishkinarequested to merge
feature/627824-increase-runner-token-expiry-to-21-days into master

What does this MR do and why?

Raises MAXIMUM_TOKEN_EXPIRY_DURATION in EE::Ci::Runners::CreateRunnerService from 15.days to 21.days, allowing users to set token_expires_at up to 21 days in the future when creating a runner token via POST /api/v4/user/runners or the RunnerCreate GraphQL mutation.

This aligns the upper bound with 3-week sprint and on-call rotation cycles, reducing operational overhead for teams that currently have to work around the 15-day cap by re-creating runners more frequently than their process requires.

Admin-configured instance/group/project runner token expiration intervals continue to act as a hard ceiling, so administrators retain full control. No new permissions are required.

Files changed:

  • ee/app/services/ee/ci/runners/create_runner_service.rb — constant updated from 15.days to 21.days
  • ee/app/graphql/ee/mutations/ci/runner/create.rb — GraphQL argument description updated
  • doc/api/users.md — REST API docs updated
  • doc/api/graphql/reference/_index.md and experimental/input_objects.md — auto-generated GraphQL reference docs updated
  • doc/api/openapi/openapi_v2.yaml and openapi_v3.yaml — OpenAPI specs updated
  • ee/spec/services/ci/runners/create_runner_service_spec.rb — spec context updated to use 22.days.from_now
  • ee/spec/requests/api/user_runners_spec.rb — spec context updated to use 22.days.from_now
  • ee/spec/requests/api/graphql/mutations/ci/runner/create_spec.rb — spec context updated to use 22.days.from_now

References

#627824 (closed)

Screenshots or screen recordings

N/A — no UI changes.

Before After
MAXIMUM_TOKEN_EXPIRY_DURATION = 15.days MAXIMUM_TOKEN_EXPIRY_DURATION = 21.days

How to set up and validate locally

  1. In a GDK with an EE license, create a runner token with token_expires_at set to 20 days in the future (previously rejected, now accepted): 
    curl --request POST \
  --header "PRIVATE-TOKEN: <your_token>" \
  --header "Content-Type: application/json" \
  --data '{"runner_type":"instance_type","token_expires_at":"<20_days_from_now_iso8601>"}' \
  "http://localhost:3000/api/v4/user/runners"
  2. Verify the runner is created successfully.
  3. Verify that token_expires_at set to 22 days in the future is still rejected.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports