fix: monotonic release timestamp for LRU rotation, clarify isInvalid TTL

Signed-off-by: Joana Maia <jmaia@contractor.linuxfoundation.org>

Author: joanagmaia

services/apps/security_best_practices_worker/src/types.ts

@@ -55,5 +55,5 @@ export interface ITokenInfo {
   lastUsed: Date
   isRateLimited: boolean
   rateLimitedAt?: string // ISO timestamp; used to auto-reset after 1 hour
-  isInvalid?: boolean // permanent auth failure — never auto-resets
+  isInvalid?: boolean // 401 auth failure; persists until the Redis token cache expires (24h TTL) — after a full idle day the token re-enters the pool fresh, giving re-provisioned PATs a natural recovery path
 }

services/apps/security_best_practices_worker/src/workflows/triggerSecurityInsightsCheckForRepos.ts

@@ -21,6 +21,12 @@ const { findObsoleteRepos, initializeTokenInfos, updateTokenInfos, getCurrentTim
 
 const ONE_HOUR_MS = 60 * 60 * 1000
 
+// Monotonic offset added to nowMs on each releaseToken so lastUsed is strictly increasing
+// per release even when currentTimeMs hasn't refreshed. Without this, sequential releases in
+// the same iteration all share currentTimeMs, the stable sort in getNextToken falls back to
+// env order, and the first PAT gets re-selected repeatedly instead of rotating LRU.
+let releaseCounter = 0
+
 export async function triggerSecurityInsightsCheckForRepos(
   args: ITriggerSecurityInsightsCheckForReposParams,
 ): Promise<void> {
@@ -254,7 +260,7 @@ async function releaseToken(tokenInfos: ITokenInfo[], token: string, nowMs: numb
   const tokenInfo = tokenInfos.find((tokenInfo) => tokenInfo.token === token)
   if (tokenInfo) {
     tokenInfo.inUse = false
-    tokenInfo.lastUsed = new Date(nowMs)
+    tokenInfo.lastUsed = new Date(nowMs + releaseCounter++)
   }
 }