Remove project_access_token_upgrade_card feature flag

David Hamp-Gonsalvesrequested to merge
618752-remove-project-access-token-upgrade-card-ff into master

What does this MR do and why?

Removes the feature flag project_access_token_upgrade_card from gitlab-org/gitlab, making the guarded behavior permanent.

The flag gated a Premium upgrade card shown on the project access tokens settings page. The card is shown to Free-tier users who can read billing on the root namespace but cannot create project access tokens. It was introduced in !251177 (merged).

Merge timing

The flag has completed its production rollout. It was ramped on gprd on 2026-09-15 (10%, then 30%), then 50% on 2026-09-16, then fully enabled (100%) on 2026-09-16 at 13:44 UTC. See the feature-flag-log entry.

This MR is no longer a draft.

Per the handbook, a flag should be globally enabled on production for at least one day before removal, with 2-4 working days as a general rule of thumb, and it needs to be exposed to all users (a percentage rollout doesn't count toward that). As of today (Friday 2026-09-18), the flag has been at 100% for 2 working days.

Reviews are welcome now, but please hold the merge until Monday 2026-09-21 or later, which puts us at 3+ working days at 100%.

Changes

  • ee/app/helpers/ee/access_tokens_helper.rb: removed the Feature.enabled?(:project_access_token_upgrade_card, project.root_ancestor) guard from show_project_access_token_upgrade_card?. All other conditions are unchanged: instance is SaaS, project has a group, the root namespace does not already have the resource_access_token licensed feature, the user cannot already create tokens, and the user can read billing on the root ancestor.
  • Deleted ee/config/feature_flags/gitlab_com_derisk/project_access_token_upgrade_card.yml.
  • ee/spec/helpers/ee/access_tokens_helper_spec.rb: dropped the flag stub and the "when the feature flag is disabled" context.
  • ee/spec/features/projects/settings/owner_views_project_access_tokens_upgrade_card_spec.rb: replaced the flag-on/flag-off contexts. The upgrade-card example now runs unconditionally. The example covering the legacy "Project access token creation is disabled in this group." subheader now runs with stub_saas_features(gitlab_com_subscriptions: false) instead of the flag being off, so that view branch keeps coverage.

Self-managed and other non-SaaS instances are unaffected. The card stays gated on Gitlab::Saas.feature_available?(:gitlab_com_subscriptions).

Testing

  • ee/spec/helpers/ee/access_tokens_helper_spec.rb and spec/helpers/access_tokens_helper_spec.rb were run locally: 42 examples, 0 failures.
  • RuboCop is clean on the changed files.
  • The feature spec could not be run locally. The local checkout's compiled webpack manifest is stale and missing the newer duo_panel entrypoint, so every page-rendering spec fails while rendering the shared layout, regardless of this change. Leaving it to CI.

Related

Edited by David Hamp-Gonsalves

Merge request reports