Allow overriding timeout through env var

- Add EXTERNAL_VALIDATION_SERVICE_TIMEOUT override environment variable
  for external validation service, expressed in seconds as an integer,
  defaulting to the DEFAULT_VALIDATION_REQUEST_TIMEOUT value.

changelogs/unreleased/ci-allow-external-validation-request-timeout-override.yml

+---
+title: Make VALIDATION_REQUEST_TIMEOUT configurable
+merge_request: 57521
+author:
+type: changed

doc/administration/external_pipeline_validation.md

@@ -27,7 +27,15 @@ Response Code Legend:
 
 ## Configuration
 
-Set the `EXTERNAL_VALIDATION_SERVICE_URL` to the external service URL and enable `ci_external_validation_service` feature flag.
+To configure external pipeline validation:
+
+1. Set the `EXTERNAL_VALIDATION_SERVICE_URL` environment variable to the external
+   service URL.
+1. Enable the `ci_external_validation_service` feature flag.
+
+By default, requests to the external service time out after five seconds. To override
+the default, set the `EXTERNAL_VALIDATION_SERVICE_TIMEOUT` environment variable to the
+required number of seconds.
 
 ## Payload Schema
 

lib/gitlab/ci/pipeline/chain/validate/external.rb

@@ -10,7 +10,7 @@ module Gitlab
 
             InvalidResponseCode = Class.new(StandardError)
 
-            VALIDATION_REQUEST_TIMEOUT = 5
+            DEFAULT_VALIDATION_REQUEST_TIMEOUT = 5
             ACCEPTED_STATUS = 200
             DOT_COM_REJECTED_STATUS = 406
             GENERAL_REJECTED_STATUS = (400..499).freeze
@@ -70,11 +70,18 @@ module Gitlab
 
             def validate_service_request
               Gitlab::HTTP.post(
-                validation_service_url, timeout: VALIDATION_REQUEST_TIMEOUT,
+                validation_service_url, timeout: validation_service_timeout,
                 body: validation_service_payload.to_json
               )
             end
 
+            def validation_service_timeout
+              timeout = ENV['EXTERNAL_VALIDATION_SERVICE_TIMEOUT'].to_i
+              return timeout if timeout > 0
+
+              DEFAULT_VALIDATION_REQUEST_TIMEOUT
+            end
+
             def validation_service_url
               ENV['EXTERNAL_VALIDATION_SERVICE_URL']
             end

spec/lib/gitlab/ci/pipeline/chain/validate/external_spec.rb

@@ -62,11 +62,42 @@ RSpec.describe Gitlab::Ci::Pipeline::Chain::Validate::External do
     it 'respects the defined payload schema' do
       expect(::Gitlab::HTTP).to receive(:post) do |_url, params|
         expect(params[:body]).to match_schema('/external_validation')
+        expect(params[:timeout]).to eq(described_class::DEFAULT_VALIDATION_REQUEST_TIMEOUT)
       end
 
       perform!
     end
 
+    context 'with EXTERNAL_VALIDATION_SERVICE_TIMEOUT defined' do
+      before do
+        stub_env('EXTERNAL_VALIDATION_SERVICE_TIMEOUT', validation_service_timeout)
+      end
+
+      context 'with valid value' do
+        let(:validation_service_timeout) { '1' }
+
+        it 'uses defined timeout' do
+          expect(::Gitlab::HTTP).to receive(:post) do |_url, params|
+            expect(params[:timeout]).to eq(1)
+          end
+
+          perform!
+        end
+      end
+
+      context 'with invalid value' do
+        let(:validation_service_timeout) { '??' }
+
+        it 'uses default timeout' do
+          expect(::Gitlab::HTTP).to receive(:post) do |_url, params|
+            expect(params[:timeout]).to eq(described_class::DEFAULT_VALIDATION_REQUEST_TIMEOUT)
+          end
+
+          perform!
+        end
+      end
+    end
+
     shared_examples 'successful external authorization' do
       it 'does not drop the pipeline' do
         perform!