refactor(gitlab): make credential migration stateless#4649
Merged
Conversation
…tch procedures Drop the gitlab_credential_migration_jobs table, lease fencing, phase state machine, and CLI script. The admin router now exposes backfillNextBatch, verifyDecryptability, and scrubNextBatch procedures that walk keyset pages; migration state lives in the data itself, so a migrated row simply stops matching the selection query. Scrub remains gated by an exact confirmation string plus a keypair-match guard on every call.
Contributor
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryReviewed the stateless, cursor-paged rewrite of GitLab credential migration (backfill/verify/scrub logic, keyset selection queries, admin router, and the associated table-drop migration); no high-confidence CRITICAL/WARNING/SUGGESTION issues were found in changed code, and no dangling references to the deleted job/job-repository modules remain. Files Reviewed (17 files)
Reviewed by claude-sonnet-5 · Input: 24 · Output: 10.2K · Cached: 502.1K Review guidance: REVIEW.md from base branch |
jeanduplessis
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the stateful DB-job design for the GitLab credential migration (introduced in #4625) with a stateless, cursor-paged design:
gitlab_credential_migration_jobstable (migration0191), along with the job repository, lease fencing, phase state machine, and CLI script.backfillNextBatch,verifyDecryptability, andscrubNextBatchprocedures. Each processes one keyset page and returnsnextCursor; the operator walks the table until it returns null.verifyDecryptabilitybeforehand.credential-migration-selection.ts(keyset selection queries) andcredential-migration-verify.ts(decryptability and key-match checks).Operator flow: audit via SQL →
backfillNextBatchto completion →verifyDecryptabilityacross all pages →scrubNextBatchto completion → re-audit.Verification
Visual Changes
N/A
Reviewer Notes
credential-migration.ts(per-integration backfill/scrub guards),credential-migration-selection.ts(keyset queries), andcredential-migration-verify.ts(decryptability checks).0191drops the jobs table, which was only ever used by the admin tooling from feat(gitlab): add admin job runner for credential migration #4625.