New upstream version 12.3.8

.dockerignore

@@ -4,11 +4,13 @@
 # the files we need to build the QA image are in these folders.
 # Following are the files we need:
 # - ./config/initializers/0_inject_enterprise_edition_module.rb
+# - ./ee/app/models/license.rb
 # - ./lib/gitlab.rb
 # - ./qa/
 # - ./INSTALLATION_TYPE
 # - ./VERSION
 
+/.git/
 /app/
 /bin/
 /builds/
@@ -23,7 +25,14 @@
 /db/
 /doc/
 /docker/
-/ee/
+/ee/bin/
+/ee/changelogs/
+/ee/config/
+/ee/db/
+/ee/fixtures/
+/ee/lib/
+/ee/locale/
+/ee/spec/
 /fixtures/
 /templates/
 /lint/
@@ -61,6 +70,7 @@
 /locale/
 /log/
 /modules/
+/node_modules/
 /plugins/
 /public/
 /rubocop/

.eslintrc.yml

@@ -8,7 +8,6 @@ globals:
   IS_EE: false
 plugins:
   - import
-  - html
   - "@gitlab/i18n"
   - "@gitlab/vue-i18n"
 settings:

.gitattributes

@@ -1,2 +1,3 @@
+VERSION merge=ours
 Dangerfile gitlab-language=ruby
 db/schema.rb merge=merge_db_schema

.gitignore

@@ -61,22 +61,23 @@ eslint-report.html
 /shared/artifacts/
 /rails_best_practices_output.html
 /tags
-/tmp/*
 /vendor/bundle/*
 /vendor/gitaly-ruby
 /builds*
-/shared/*
 /.gitlab_workhorse_secret
+/.gitlab_pages_shared_secret
 /webpack-report/
 /knapsack/
 /rspec_flaky/
 /locale/**/LC_MESSAGES
 /locale/**/*.time_stamp
 /.rspec
-/plugins/*
 /.gitlab_pages_secret
+/.gitlab_smime_key
+/.gitlab_smime_cert
 package-lock.json
 /junit_*.xml
 /coverage-frontend/
 jsdoc/
 **/tmp/rubocop_cache/**
+.overcommit.yml

.gitlab-ci.yml

@@ -1,5 +1,15 @@
 image: "dev.gitlab.org:5005/gitlab/gitlab-build-images:ruby-2.6.3-golang-1.11-git-2.22-chrome-73.0-node-12.x-yarn-1.16-postgresql-9.6-graphicsmagick-1.3.33"
 
+stages:
+  - prepare
+  - quick-test
+  - test
+  - review-prepare
+  - review
+  - qa
+  - post-test
+  - pages
+
 variables:
   RAILS_ENV: "test"
   NODE_ENV: "test"
@@ -8,28 +18,15 @@ variables:
   GIT_SUBMODULE_STRATEGY: "none"
   GET_SOURCES_ATTEMPTS: "3"
   KNAPSACK_RSPEC_SUITE_REPORT_PATH: knapsack/${CI_PROJECT_NAME}/rspec_report-master.json
+  EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH: knapsack/${CI_PROJECT_NAME}/rspec_report-master-ee.json
   FLAKY_RSPEC_SUITE_REPORT_PATH: rspec_flaky/report-suite.json
   BUILD_ASSETS_IMAGE: "false"
-
-before_script:
-  - date
-  - source scripts/utils.sh
-  - source scripts/prepare_build.sh
-  - date
+  ES_JAVA_OPTS: "-Xms256m -Xmx256m"
+  ELASTIC_URL: "http://elastic:changeme@docker.elastic.co-elasticsearch-elasticsearch:9200"
 
 after_script:
   - date
 
-stages:
-  - build
-  - prepare
-  - merge
-  - test
-  - review
-  - qa
-  - post-test
-  - pages
-
 include:
   - local: .gitlab/ci/global.gitlab-ci.yml
   - local: .gitlab/ci/cng.gitlab-ci.yml

.gitlab/CODEOWNERS

@@ -9,12 +9,13 @@
 app/assets/ @ClemMakesApps @fatihacet @filipa @mikegreiling @timzallmann @kushalpandya @pslaughter
 *.scss @annabeldunstone @ClemMakesApps @fatihacet @filipa @mikegreiling @timzallmann @kushalpandya @pslaughter
 
-# Maintainers from the Database team should review changes in `db/`
-db/ @gl-database
-lib/gitlab/background_migration/ @gl-database
-lib/gitlab/database/ @gl-database
-lib/gitlab/sql/ @gl-database
-/ee/db/ @gl-database
+# Database maintainers should review changes in `db/`
+db/ @gitlab-org/maintainers/database
+lib/gitlab/background_migration/ @gitlab-org/maintainers/database
+lib/gitlab/database/ @gitlab-org/maintainers/database
+lib/gitlab/sql/ @gitlab-org/maintainers/database
+lib/gitlab/github_import/ @gitlab-org/maintainers/database
+/ee/db/ @gitlab-org/maintainers/database
 
 # Feature specific owners
 /ee/lib/gitlab/code_owners/ @reprazent

.gitlab/ci/cng.gitlab-ci.yml

@@ -1,16 +1,16 @@
 cloud-native-image:
   image: ruby:2.6-alpine
-  before_script: []
   dependencies: []
   stage: post-test
   allow_failure: true
   variables:
     GIT_DEPTH: "1"
-  cache: {}
   when: manual
   script:
     - install_gitlab_gem
     - CNG_PROJECT_PATH="gitlab-org/build/CNG" BUILD_TRIGGER_TOKEN=$CI_JOB_TOKEN ./scripts/trigger-build cng
   only:
-    - tags@gitlab-org/gitlab-ce
-    - tags@gitlab-org/gitlab-ee
+    refs:
+      - tags
+    variables:
+      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"

.gitlab/ci/docs.gitlab-ci.yml

@@ -1,76 +1,69 @@
-.review-docs: &review-docs
-  extends: .single-script-job-dedicated-runner
+.review-docs:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .only-docs-changes
+  only:
+    refs:
+      - merge_requests
     variables:
-    SCRIPT_NAME: trigger-build-docs
+      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+  image: ruby:2.6-alpine
+  stage: review
+  dependencies: []
+  variables:
+    GIT_STRATEGY: none
   environment:
     name: review-docs/$CI_COMMIT_REF_SLUG
     # DOCS_REVIEW_APPS_DOMAIN and DOCS_GITLAB_REPO_SUFFIX are CI variables
-    # Discussion: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14236/diffs#note_40140693
+    # Discussion: https://gitlab.com/gitlab-org/gitlab-foss/merge_requests/14236/diffs#note_40140693
     url: http://$CI_ENVIRONMENT_SLUG.$DOCS_REVIEW_APPS_DOMAIN/$DOCS_GITLAB_REPO_SUFFIX
     on_stop: review-docs-cleanup
-
-# Trigger a manual docs build in gitlab-docs only on non docs-only branches.
-# Useful to preview the docs changes live.
-review-docs-deploy-manual:
-  extends:
-    - .review-docs
-    - .no-docs-and-no-qa
-  stage: review
-  script:
+  before_script:
+    # We don't clone the repo by using GIT_STRATEGY: none and only download the
+    # single script we need here so it's much faster than cloning.
+    - apk add --update openssl
+    - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/trigger-build-docs
+    - chmod 755 trigger-build-docs
     - gem install gitlab --no-document
-    - ./$SCRIPT_NAME deploy
-  when: manual
-  only:
-    - branches@gitlab-org/gitlab-ce
-    - branches@gitlab-org/gitlab-ee
 
 # Always trigger a docs build in gitlab-docs only on docs-only branches.
 # Useful to preview the docs changes live.
 review-docs-deploy:
-  <<: *review-docs
-  stage: review
+  extends: .review-docs
   script:
-    - gem install gitlab --no-document
-    - ./$SCRIPT_NAME deploy
-  only:
-    - /(^docs[\/-].+|.+-docs$)/@gitlab-org/gitlab-ce
-    - /(^docs[\/-].+|.+-docs$)/@gitlab-org/gitlab-ee
-  except:
-    - /(^qa[\/-].*|.*-qa$)/
+    - ./trigger-build-docs deploy
+  when: manual
 
 # Cleanup remote environment of gitlab-docs
 review-docs-cleanup:
-  <<: *review-docs
-  stage: review
+  extends: .review-docs
   environment:
     name: review-docs/$CI_COMMIT_REF_SLUG
     action: stop
   script:
-    - gem install gitlab --no-document
-    - ./$SCRIPT_NAME cleanup
+    - ./trigger-build-docs cleanup
   when: manual
-  only:
-    - branches@gitlab-org/gitlab-ce
-    - branches@gitlab-org/gitlab-ee
 
 docs lint:
-  extends: .dedicated-runner
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-only
+    - .only-docs-changes
   image: "registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-docs-lint"
   stage: test
-  cache: {}
   dependencies: []
-  before_script: []
   script:
     - scripts/lint-doc.sh
+    # Lint Markdown
+    - markdownlint --config .markdownlint.json 'doc/**/*.md'
+    # Prepare docs for build
     - mv doc/ /tmp/gitlab-docs/content/$DOCS_GITLAB_REPO_SUFFIX
     - cd /tmp/gitlab-docs
-    # Lint Markdown
-    - bundle exec mdl content/$DOCS_GITLAB_REPO_SUFFIX -c $CI_PROJECT_DIR/.mdlrc
     # Build HTML from Markdown
     - bundle exec nanoc
     # Check the internal links
     - bundle exec nanoc check internal_links
     # Check the internal anchor links
     - bundle exec nanoc check internal_anchors
-  except:
-    - /(^qa[\/-].*|.*-qa$)/

.gitlab/ci/frontend.gitlab-ci.yml

@@ -1,23 +1,22 @@
-.assets-compile-cache: &assets-compile-cache
+.assets-compile-cache:
   cache:
-    key: "assets-compile:vendor_ruby:.yarn-cache:tmp_cache_assets_sprockets:v6"
     paths:
       - vendor/ruby/
       - .yarn-cache/
       - tmp/cache/assets/sprockets
 
-.use-pg: &use-pg
-  services:
-    - name: postgres:9.6.14
-      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
-    - name: redis:alpine
-
 .gitlab:assets:compile-metadata:
-  <<: *assets-compile-cache
-  extends: .dedicated-no-docs-pull-cache-job
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-only
+    - .default-before_script
+    - .assets-compile-cache
+    - .only-code-qa-changes
   image: dev.gitlab.org:5005/gitlab/gitlab-build-images:ruby-2.6.3-git-2.22-chrome-73.0-node-12.x-yarn-1.16-graphicsmagick-1.3.33-docker-18.06.1
-  dependencies:
-    - setup-test-env
+  stage: test
+  dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   services:
     - docker:19.03.0-dind
   variables:
@@ -30,6 +29,14 @@
     NODE_OPTIONS: --max_old_space_size=3584
     DOCKER_DRIVER: overlay2
     DOCKER_HOST: tcp://docker:2375
+  cache:
+    key: "assets-compile:production:vendor_ruby:.yarn-cache:tmp_cache_assets_sprockets:v6"
+  artifacts:
+    name: webpack-report
+    expire_in: 31d
+    paths:
+      - webpack-report/
+      - public/assets/
   script:
     - node --version
     - retry yarn install --frozen-lockfile --production --cache-folder .yarn-cache --prefer-offline
@@ -38,47 +45,39 @@
     - time scripts/build_assets_image
     - scripts/clean-old-cached-assets
     - rm -f /etc/apt/sources.list.d/google*.list  # We don't need to update Chrome here
-    # Play dependent manual jobs
-    - install_api_client_dependencies_with_apt
-    - play_job "review-build-cng" || true  # this job might not exist so ignore the failure if it cannot be played
-    - play_job "schedule:review-build-cng" || true  # this job might not exist so ignore the failure if it cannot be played
-  artifacts:
-    name: webpack-report
-    expire_in: 31d
-    paths:
-      - webpack-report/
-      - public/assets/
   only:
-    - /.+/@gitlab-org/gitlab-ce
-    - /.+/@gitlab-org/gitlab-ee
-    - /.+/@gitlab/gitlabhq
-    - /.+/@gitlab/gitlab-ee
+    variables:
+      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+      - $CI_SERVER_HOST == "dev.gitlab.org"
   tags:
-    - docker
     - gitlab-org
+    - docker
 
 gitlab:assets:compile:
   extends: .gitlab:assets:compile-metadata
+  only:
+    refs:
+      - master
   cache:
     policy: pull-push
-  only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
 
 gitlab:assets:compile pull-cache:
   extends: .gitlab:assets:compile-metadata
-  cache:
-    policy: pull
   except:
     refs:
-      - master@gitlab-org/gitlab-ce
-      - master@gitlab-org/gitlab-ee
-      - /(^docs[\/-].+|.+-docs$)/
+      - master
+  cache:
+    policy: pull
 
 .compile-assets-metadata:
-  extends: .dedicated-runner
-  <<: *use-pg
-  <<: *assets-compile-cache
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-only
+    - .default-before_script
+    - .assets-compile-cache
+    - .only-code-qa-changes
+    - .use-pg
   stage: prepare
   script:
     - node --version
@@ -89,6 +88,8 @@ gitlab:assets:compile pull-cache:
   variables:
     # we override the max_old_space_size to prevent OOM errors
     NODE_OPTIONS: --max_old_space_size=3584
+  cache:
+    key: "assets-compile:test:vendor_ruby:.yarn-cache:tmp_cache_assets_sprockets:v6"
   artifacts:
     expire_in: 7d
     paths:
@@ -97,29 +98,33 @@ gitlab:assets:compile pull-cache:
 
 compile-assets:
   extends: .compile-assets-metadata
+  only:
+    refs:
+      - master
   cache:
     policy: pull-push
-  only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
 
 compile-assets pull-cache:
   extends: .compile-assets-metadata
-  cache:
-    policy: pull
   except:
     refs:
-      - master@gitlab-org/gitlab-ce
-      - master@gitlab-org/gitlab-ee
-      - /(^docs[\/-].+|.+-docs$)/
+      - master
+  cache:
+    policy: pull
+
+.only-code-frontend-job-base:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-only
+    - .default-before_script
+    - .only-code-changes
+    - .use-pg
+  dependencies: ["compile-assets", "compile-assets pull-cache", "setup-test-env"]
 
 karma:
-  extends: .dedicated-no-docs-pull-cache-job
-  <<: *use-pg
-  dependencies:
-    - compile-assets
-    - compile-assets pull-cache
-    - setup-test-env
+  extends: .only-code-frontend-job-base
   variables:
     # we override the max_old_space_size to prevent OOM errors
     NODE_OPTIONS: --max_old_space_size=3584
@@ -142,12 +147,7 @@ karma:
       junit: junit_karma.xml
 
 jest:
-  extends: .dedicated-no-docs-and-no-qa-pull-cache-job
-  <<: *use-pg
-  dependencies:
-    - compile-assets
-    - compile-assets pull-cache
-    - setup-test-env
+  extends: .only-code-frontend-job-base
   script:
     - scripts/gitaly-test-spawn
     - date
@@ -170,36 +170,42 @@ jest:
       - tmp/jest/jest/
     policy: pull-push
 
-qa:internal:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  services: []
-  script:
+.qa-job-base:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-only
+    - .only-code-qa-changes
+  dependencies: []
+  stage: test
+  before_script:
     - cd qa/
     - bundle install
+
+qa:internal:
+  extends: .qa-job-base
+  script:
     - bundle exec rspec
-  dependencies:
-    - setup-test-env
 
 qa:selectors:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  services: []
+  extends: .qa-job-base
   script:
-    - cd qa/
-    - bundle install
     - bundle exec bin/qa Test::Sanity::Selectors
-  dependencies:
-    - setup-test-env
 
-.qa-frontend-node: &qa-frontend-node
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  stage: test
+.qa-frontend-node:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-only
+    - .only-code-changes
+  dependencies: []
   cache:
     key: "$CI_JOB_NAME"
     paths:
       - .yarn-cache/
     policy: pull-push
-  dependencies: []
-  before_script: []
   script:
     - date
     - yarn install --frozen-lockfile --cache-folder .yarn-cache --prefer-offline
@@ -207,44 +213,28 @@ qa:selectors:
     - yarn run webpack-prod
 
 qa-frontend-node:8:
-  <<: *qa-frontend-node
+  extends: .qa-frontend-node
   image: node:carbon
 
 qa-frontend-node:10:
-  <<: *qa-frontend-node
+  extends: .qa-frontend-node
   image: node:dubnium
 
 qa-frontend-node:latest:
-  <<: *qa-frontend-node
+  extends: .qa-frontend-node
   image: node:latest
   allow_failure: true
 
-lint:javascript:report:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  stage: post-test
-  dependencies: []
-  before_script: []
+webpack-dev-server:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-only
+    - .only-code-changes
+  dependencies: ["setup-test-env", "compile-assets", "compile-assets pull-cache"]
+  variables:
+    WEBPACK_MEMORY_TEST: "true"
   script:
-    - date
-    - yarn run eslint-report || true  # ignore exit code
-  artifacts:
-    name: eslint-report
-    expire_in: 31d
-    paths:
-      - eslint-report.html
-
-jsdoc:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  stage: post-test
-  dependencies:
-    - compile-assets
-    - compile-assets pull-cache
-  before_script: []
-  script:
-    - date
-    - yarn run jsdoc || true  # ignore exit code
-  artifacts:
-    name: jsdoc
-    expire_in: 31d
-    paths:
-      - jsdoc/
+    - node --version
+    - node --expose-gc node_modules/.bin/webpack-dev-server --config config/webpack.config.js

.gitlab/ci/global.gitlab-ci.yml

@@ -1,78 +1,125 @@
-.dedicated-runner:
+.default-tags:
+  tags:
+    - gitlab-org
+
+.default-retry:
   retry:
     max: 2  # This is confusing but this means "3 runs at max".
     when:
       - unknown_failure
       - api_failure
       - runner_system_failure
-  tags:
-    - gitlab-org
 
-.default-cache: &default-cache
+.default-before_script:
+  before_script:
+    - date
+    - source scripts/utils.sh
+    - source scripts/prepare_build.sh
+    - date
+
+# Jobs that only need to pull cache
+.default-cache:
+  cache:
     key: "debian-stretch-ruby-2.6.3-node-12.x"
     paths:
       - vendor/ruby
       - .yarn-cache/
       - vendor/gitaly-ruby
-
-.dedicated-runner-default-cache:
-  extends: .dedicated-runner
-  cache:
-    <<: *default-cache
-
-# Jobs that only need to pull cache
-.dedicated-pull-cache-job:
-  extends: .dedicated-runner
-  cache:
-    <<: *default-cache
     policy: pull
-  stage: test
 
-.no-docs:
+.default-only:
+  only:
+    refs:
+      - master
+      - /^[\d-]+-stable(-ee)?$/
+      - /^\d+-\d+-auto-deploy-\d+$/
+      - merge_requests
+      - tags
+
+.only-code-changes:
+  only:
+    changes:
+      - ".gitlab/ci/**/*"
+      - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+      - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
+      - ".csscomb.json"
+      - "Dangerfile"
+      - "Dockerfile.assets"
+      - "*_VERSION"
+      - "Gemfile{,.lock}"
+      - "Rakefile"
+      - "{babel.config,jest.config}.js"
+      - "config.ru"
+      - "{package.json,yarn.lock}"
+      - "{app,bin,config,danger,db,ee,fixtures,haml_lint,lib,public,rubocop,scripts,spec,symbol,vendor}/**/*"
+      - "doc/README.md"  # Some RSpec test rely on this file
+
+.only-qa-changes:
+  only:
+    changes:
+      - ".dockerignore"
+      - "qa/**/*"
+
+.only-docs-changes:
+  only:
+    changes:
+      - ".gitlab/route-map.yml"
+      - "doc/**/*"
+      - ".markdownlint.json"
+
+.only-code-qa-changes:
+  only:
+    changes:
+      - ".gitlab/ci/**/*"
+      - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+      - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
+      - ".csscomb.json"
+      - "Dangerfile"
+      - "Dockerfile.assets"
+      - "*_VERSION"
+      - "Gemfile{,.lock}"
+      - "Rakefile"
+      - "{babel.config,jest.config}.js"
+      - "config.ru"
+      - "{package.json,yarn.lock}"
+      - "{app,bin,config,danger,db,ee,fixtures,haml_lint,lib,public,rubocop,scripts,spec,symbol,vendor}/**/*"
+      - "doc/README.md"  # Some RSpec test rely on this file
+      - ".dockerignore"
+      - "qa/**/*"
+
+.only-review:
+  only:
+    variables:
+      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+    kubernetes: active
   except:
     refs:
-      - /(^docs[\/-].+|.+-docs$)/
+      - master
+      - /^\d+-\d+-auto-deploy-\d+$/
 
-.no-docs-and-no-qa:
-  except:
+.only-review-schedules:
+  only:
     refs:
-      - /(^docs[\/-].+|.+-docs$)/
-      - /(^qa[\/-].*|.*-qa$)/
-
-.dedicated-no-docs-pull-cache-job:
-  extends:
-    - .dedicated-pull-cache-job
-    - .no-docs
-
-.dedicated-no-docs-and-no-qa-pull-cache-job:
-  extends:
-    - .dedicated-pull-cache-job
-    - .no-docs-and-no-qa
-
-# Jobs that do not need a DB
-.dedicated-no-docs-no-db-pull-cache-job:
-  extends: .dedicated-no-docs-pull-cache-job
+      - schedules
     variables:
-    SETUP_DB: "false"
+      - $REVIEW_APP_CLEANUP && $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+    kubernetes: active
 
-# Jobs that need a dedicated runner, with no cache
-.dedicated-no-docs:
-  extends:
-    - .dedicated-runner
-    - .no-docs
+.use-pg:
+  services:
+    - name: postgres:9.6.14
+      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+    - name: redis:alpine
 
-.single-script-job-dedicated-runner:
-  extends: .dedicated-runner
-  image: ruby:2.6-alpine
-  stage: test
-  cache: {}
-  dependencies: []
+.use-pg-10:
+  image: "dev.gitlab.org:5005/gitlab/gitlab-build-images:ruby-2.6.3-golang-1.11-git-2.22-chrome-73.0-node-12.x-yarn-1.16-postgresql-10-graphicsmagick-1.3.33"
+  services:
+    - name: postgres:10.9
+      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+    - name: redis:alpine
+
+.only-ee:
+  only:
     variables:
-    GIT_STRATEGY: none
-  before_script:
-    # We don't clone the repo by using GIT_STRATEGY: none and only download the
-    # single script we need here so it's much faster than cloning.
-    - export SCRIPT_NAME="${SCRIPT_NAME:-$CI_JOB_NAME}"
-    - apk add --update openssl
-    - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/$SCRIPT_NAME
-    - chmod 755 $(basename $SCRIPT_NAME)
+      - $CI_PROJECT_NAME == "gitlab"
+      - $CI_PROJECT_NAME == "gitlab-ee"  # Support former project name for forks/mirrors

.gitlab/ci/memory.gitlab-ci.yml

@@ -1,5 +1,16 @@
+.only-code-memory-job-base:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-only
+    - .default-before_script
+    - .only-code-changes
+
 memory-static:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
+  extends: .only-code-memory-job-base
+  variables:
+    SETUP_DB: "false"
   script:
     # Uses two different reports from the 'derailed_benchmars' gem.
 
@@ -23,7 +34,9 @@ memory-static:
 # The application is booted in `production` environment.
 # All tests are run without a webserver (directly using Rack::Mock by default).
 memory-on-boot:
-  extends: .rspec-metadata-pg-10
+  extends:
+    - .only-code-memory-job-base
+    - .use-pg-10
   variables:
     NODE_ENV: "production"
     RAILS_ENV: "production"

.gitlab/ci/pages.gitlab-ci.yml

@@ -1,26 +1,25 @@
 pages:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  before_script: []
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-only
+    - .only-code-qa-changes
+  only:
+    refs:
+      - master
+    variables:
+      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
   stage: pages
-  dependencies:
-    - coverage
-    - karma
-    - gitlab:assets:compile
-    - lint:javascript:report
-    - jsdoc
+  dependencies: ["coverage", "karma", "gitlab:assets:compile"]
   script:
     - mv public/ .public/
     - mkdir public/
     - mv coverage/ public/coverage-ruby/ || true
     - mv coverage-javascript/ public/coverage-javascript/ || true
-    - mv eslint-report.html public/ || true
     - mv webpack-report/ public/webpack-report/ || true
     - cp .public/assets/application-*.css public/application.css || true
     - cp .public/assets/application-*.css.gz public/application.css.gz || true
-    - mv jsdoc/ public/jsdoc/ || true
   artifacts:
     paths:
       - public
-  only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee

.gitlab/ci/qa.gitlab-ci.yml

@@ -1,9 +1,8 @@
 .package-and-qa-base:
+  extends: .default-only
   image: ruby:2.6-alpine
-  stage: review  # So even if review-deploy failed we can still run this
-  before_script: []
+  stage: qa
   dependencies: []
-  cache: {}
   variables:
     GIT_DEPTH: "1"
   retry: 0
@@ -12,18 +11,36 @@
     - install_gitlab_gem
     - ./scripts/trigger-build omnibus
   only:
-    - branches@gitlab-org/gitlab-ce
-    - branches@gitlab-org/gitlab-ee
+    variables:
+      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+
+package-and-qa-manual:
+  extends:
+    - .package-and-qa-base
+    - .only-code-changes
+  except:
+    refs:
+      - master
+  when: manual
+  needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
+
+package-and-qa-manual:master:
+  extends:
+    - .package-and-qa-base
+    - .only-code-qa-changes
+  only:
+    refs:
+      - master@gitlab-org/gitlab-foss
+      - master@gitlab-org/gitlab
+  when: manual
+  needs: ["build-qa-image", "gitlab:assets:compile"]
 
 package-and-qa:
-  extends: .package-and-qa-base
-  when: manual
+  extends:
+    - .package-and-qa-base
+    - .only-qa-changes
   except:
-    - /(^qa[\/-].*|.*-qa$)/
-
-package-and-qa-always:
-  extends: .package-and-qa-base
+    refs:
+      - master
+  needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
   allow_failure: true
-  only:
-    - /(^qa[\/-].*|.*-qa$)/@gitlab-org/gitlab-ce
-    - /(^qa[\/-].*|.*-qa$)/@gitlab-org/gitlab-ee

.gitlab/ci/rails.gitlab-ci.yml

@@ -1,52 +1,40 @@
-.use-pg: &use-pg
-  services:
-    - name: postgres:9.6.14
-      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
-    - name: redis:alpine
-
-.use-pg-10: &use-pg-10
-  services:
-    - name: postgres:10.9
-      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
-    - name: redis:alpine
-
-.only-schedules-master: &only-schedules-master
+.only-master:
   only:
-    - schedules@gitlab-org/gitlab-ce
-    - schedules@gitlab-org/gitlab-ee
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
-    - master@gitlab/gitlabhq
-    - master@gitlab/gitlab-ee
+    refs:
+      - master
 
-.gitlab-setup: &gitlab-setup
+.rake-exec:
   extends:
-    - .dedicated-no-docs-and-no-qa-pull-cache-job
-    - .use-pg
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-only
+    - .default-before_script
   variables:
     SETUP_DB: "false"
-  script:
-    # Manually clone gitlab-test and only seed this project in
-    # db/fixtures/development/04_project.rb thanks to SIZE=1 below
-    - git clone https://gitlab.com/gitlab-org/gitlab-test.git
-       /home/git/repositories/gitlab-org/gitlab-test.git
-    - scripts/gitaly-test-spawn
-    - force=yes SIZE=1 FIXTURE_PATH="db/fixtures/development" bundle exec rake gitlab:setup
-  artifacts:
-    when: on_failure
-    expire_in: 1d
-    paths:
-      - log/development.log
-
-.rake-exec: &rake-exec
-  extends: .dedicated-no-docs-no-db-pull-cache-job
   script:
     - bundle exec rake $CI_JOB_NAME
 
-.rspec-metadata: &rspec-metadata
+.only-code-rails-job-base:
   extends:
-    - .dedicated-pull-cache-job
-    - .no-docs-and-no-qa
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-only
+    - .default-before_script
+    - .only-code-changes
+
+.only-code-qa-rails-job-base:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-only
+    - .default-before_script
+    - .only-code-qa-changes
+
+.rspec-base:
+  extends: .only-code-rails-job-base
   stage: test
   script:
     - JOB_NAME=( $CI_JOB_NAME )
@@ -83,29 +71,133 @@
     reports:
       junit: junit_rspec.xml
 
-.rspec-metadata-pg: &rspec-metadata-pg
-  <<: *rspec-metadata
-  <<: *use-pg
+.rspec-base-pg:
+  extends:
+    - .rspec-base
+    - .use-pg
 
-.rspec-metadata-pg-10: &rspec-metadata-pg-10
-  <<: *rspec-metadata
-  <<: *use-pg-10
-  image: "dev.gitlab.org:5005/gitlab/gitlab-build-images:ruby-2.6.3-golang-1.11-git-2.22-chrome-73.0-node-12.x-yarn-1.16-postgresql-10-graphicsmagick-1.3.33"
+.rspec-base-pg-10:
+  extends:
+    - .rspec-base
+    - .use-pg-10
 
-# DB migration, rollback, and seed jobs
-.db-migrate-reset: &db-migrate-reset
-  extends: .dedicated-no-docs-and-no-qa-pull-cache-job
+setup-test-env:
+  extends:
+    - .only-code-qa-rails-job-base
+    - .use-pg
+  stage: prepare
   script:
-    - bundle exec rake db:migrate:reset
-  dependencies:
-    - setup-test-env
+    - bundle exec ruby -Ispec -e 'require "spec_helper" ; TestEnv.init'
+    - scripts/gitaly-test-build  # Do not use 'bundle exec' here
+  artifacts:
+    expire_in: 7d
+    paths:
+      - tmp/tests
+      - config/secrets.yml
+      - vendor/gitaly-ruby
 
-.migration-paths: &migration-paths
-  extends: .dedicated-no-docs-and-no-qa-pull-cache-job
+rspec unit pg:
+  extends: .rspec-base-pg
+  parallel: 20
+
+rspec integration pg:
+  extends: .rspec-base-pg
+  parallel: 6
+
+rspec system pg:
+  extends: .rspec-base-pg
+  parallel: 24
+
+rspec unit pg-10:
+  extends:
+    - .rspec-base-pg-10
+    - .only-master
+  parallel: 20
+
+rspec integration pg-10:
+  extends:
+    - .rspec-base-pg-10
+    - .only-master
+  parallel: 6
+
+rspec system pg-10:
+  extends:
+    - .rspec-base-pg-10
+    - .only-master
+  parallel: 24
+
+rspec-fast-spec-helper:
+  extends: .rspec-base-pg
+  script:
+    - bundle exec rspec spec/fast_spec_helper.rb
+
+rspec quarantine pg:
+  extends:
+    - .rspec-base-pg
+    - .only-master
+  script:
+    - export NO_KNAPSACK=1 CACHE_CLASSES=true
+    - scripts/gitaly-test-spawn
+    - bin/rspec --color --format documentation --tag quarantine -- spec/
+  allow_failure: true
+
+static-analysis:
+  extends: .only-code-qa-rails-job-base
+  dependencies: ["setup-test-env", "compile-assets", "compile-assets pull-cache"]
   variables:
     SETUP_DB: "false"
   script:
-    - git fetch https://gitlab.com/gitlab-org/gitlab-ce.git v11.11.0
+    - scripts/static-analysis
+  cache:
+    key: "debian-stretch-ruby-2.6.3-and-rubocop"
+    paths:
+      - vendor/ruby
+      - tmp/rubocop_cache
+    policy: pull-push
+
+downtime_check:
+  extends:
+    - .rake-exec
+    - .only-code-changes
+  except:
+    refs:
+      - master
+      - tags
+    variables:
+      - $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable(-ee)?$/
+  stage: test
+  dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
+
+.db-job-base:
+  extends:
+    - .only-code-rails-job-base
+    - .use-pg
+  stage: test
+  dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
+
+# DB migration, rollback, and seed jobs
+db:migrate:reset:
+  extends: .db-job-base
+  script:
+    - bundle exec rake db:migrate:reset
+
+db:check-schema:
+  extends: .db-job-base
+  script:
+    - source scripts/schema_changed.sh
+
+db:migrate-from-v11.11.0:
+  extends: .db-job-base
+  variables:
+    SETUP_DB: "false"
+  script:
+    - export PROJECT_TO_CHECKOUT="gitlab-foss"
+    - export TAG_TO_CHECKOUT="v11.11.0"
+    - '[[ ! -d "ee/" ]] || export PROJECT_TO_CHECKOUT="gitlab"'
+    - '[[ ! -d "ee/" ]] || export TAG_TO_CHECKOUT="v11.11.0-ee"'
+    - git fetch https://gitlab.com/gitlab-org/$PROJECT_TO_CHECKOUT.git $TAG_TO_CHECKOUT
     - git checkout -f FETCH_HEAD
     - sed -i "s/gem 'oj', '~> 2.17.4'//" Gemfile
     - sed -i "s/gem 'bootsnap', '~> 1.0.0'/gem 'bootsnap'/" Gemfile
@@ -121,155 +213,32 @@
     - . scripts/prepare_build.sh
     - date
     - bundle exec rake db:migrate
-  dependencies:
-    - setup-test-env
 
-setup-test-env:
-  extends:
-    - .dedicated-runner-default-cache
-    - .no-docs
-    - .use-pg
-  stage: prepare
-  script:
-    - bundle exec ruby -Ispec -e 'require "spec_helper" ; TestEnv.init'
-    - scripts/gitaly-test-build  # Do not use 'bundle exec' here
-  artifacts:
-    expire_in: 7d
-    paths:
-      - tmp/tests
-      - config/secrets.yml
-      - vendor/gitaly-ruby
-
-rspec unit pg:
-  <<: *rspec-metadata-pg
-  parallel: 20
-
-rspec integration pg:
-  <<: *rspec-metadata-pg
-  parallel: 6
-
-rspec system pg:
-  <<: *rspec-metadata-pg
-  parallel: 24
-
-rspec unit pg-10:
-  <<: *rspec-metadata-pg-10
-  <<: *only-schedules-master
-  parallel: 20
-
-rspec integration pg-10:
-  <<: *rspec-metadata-pg-10
-  <<: *only-schedules-master
-  parallel: 6
-
-rspec system pg-10:
-  <<: *rspec-metadata-pg-10
-  <<: *only-schedules-master
-  parallel: 24
-
-rspec-fast-spec-helper:
-  <<: *rspec-metadata-pg
-  script:
-    - bundle exec rspec spec/fast_spec_helper.rb
-
-.rspec-quarantine: &rspec-quarantine
-  <<: *only-schedules-master
-  script:
-    - export CACHE_CLASSES=true
-    - scripts/gitaly-test-spawn
-    - bin/rspec --color --format documentation --tag quarantine -- spec/
-
-rspec quarantine pg:
-  <<: *rspec-metadata-pg
-  <<: *rspec-quarantine
-  allow_failure: true
-
-static-analysis:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  dependencies:
-    - compile-assets
-    - compile-assets pull-cache
-    - setup-test-env
-  script:
-    - scripts/static-analysis
-  cache:
-    key: "debian-stretch-ruby-2.6.3-node-12.x-and-rubocop"
-    paths:
-      - vendor/ruby
-      - .yarn-cache/
-      - tmp/rubocop_cache
-    policy: pull-push
-
-downtime_check:
-  <<: *rake-exec
-  except:
-    refs:
-      - master
-      - tags
-      - /^[\d-]+-stable(-ee)?$/
-      - /(^docs[\/-].+|.+-docs$)/
-      - /(^qa[\/-].*|.*-qa$)/
-  dependencies:
-    - setup-test-env
-
-ee_compat_check:
-  <<: *rake-exec
-  dependencies: []
-  except:
-    refs:
-      - master
-      - tags
-      - /[\d-]+-stable(-ee)?/
-      - /^security-/
-      - branches@gitlab-org/gitlab-ee
-      - branches@gitlab/gitlab-ee
-      - /(^docs[\/-].+|.+-docs$)/
-  retry: 0
-  artifacts:
-    name: "${CI_JOB_NAME}_${CI_COMIT_REF_NAME}_${CI_COMMIT_SHA}"
-    when: always
-    expire_in: 10d
-    paths:
-      - ee_compat_check/patches/*.patch
-
-db:migrate:reset-pg:
-  <<: *db-migrate-reset
-  <<: *use-pg
-
-db:check-schema-pg:
-  <<: *db-migrate-reset
-  <<: *use-pg
-  script:
-    - source scripts/schema_changed.sh
-
-migration:path-pg:
-  <<: *migration-paths
-  <<: *use-pg
-
-.db-rollback: &db-rollback
-  extends: .dedicated-no-docs-and-no-qa-pull-cache-job
+db:rollback:
+  extends: .db-job-base
   script:
     - bundle exec rake db:migrate VERSION=20180101160629
     - bundle exec rake db:migrate SKIP_SCHEMA_VERSION_CHECK=true
-  dependencies:
-    - setup-test-env
 
-db:rollback-pg:
-  <<: *db-rollback
-  <<: *use-pg
-
-gitlab:setup-pg:
-  <<: *gitlab-setup
-  <<: *use-pg
-  dependencies:
-    - setup-test-env
+gitlab:setup:
+  extends: .db-job-base
+  variables:
+    SETUP_DB: "false"
+  script:
+    # Manually clone gitlab-test and only seed this project in
+    # db/fixtures/development/04_project.rb thanks to SIZE=1 below
+    - git clone https://gitlab.com/gitlab-org/gitlab-test.git
+       /home/git/repositories/gitlab-org/gitlab-test.git
+    - scripts/gitaly-test-spawn
+    - force=yes SIZE=1 FIXTURE_PATH="db/fixtures/development" bundle exec rake gitlab:setup
+  artifacts:
+    when: on_failure
+    expire_in: 1d
+    paths:
+      - log/development.log
 
 coverage:
-  # Don't include dedicated-no-docs-no-db-pull-cache-job here since we need to
-  # download artifacts from all the rspec jobs instead of from setup-test-env only
-  extends:
-    - .dedicated-runner-default-cache
-    - .no-docs-and-no-qa
+  extends: .only-code-rails-job-base
   cache:
     policy: pull
   variables:
@@ -286,3 +255,115 @@ coverage:
       - coverage/index.html
       - coverage/assets/
       - tmp/memory_test/
+
+## EE-specific content
+.rspec-base-ee:
+  extends:
+    - .rspec-base
+    - .only-ee
+  script:
+    - JOB_NAME=( $CI_JOB_NAME )
+    - TEST_TOOL=${JOB_NAME[0]}
+    - TEST_LEVEL=${JOB_NAME[1]}
+    - DATABASE=${JOB_NAME[2]}
+    - export KNAPSACK_REPORT_PATH=knapsack/${CI_PROJECT_NAME}/${TEST_TOOL}_${TEST_LEVEL}_${DATABASE}_ee_node_${CI_NODE_INDEX}_${CI_NODE_TOTAL}_report.json
+    - export KNAPSACK_GENERATE_REPORT=true KNAPSACK_LOG_LEVEL=debug KNAPSACK_TEST_DIR=spec
+    - export CACHE_CLASSES=true
+    - cp ${EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH} ${KNAPSACK_REPORT_PATH}
+    - scripts/gitaly-test-spawn
+    - date
+    - 'export KNAPSACK_TEST_FILE_PATTERN=$(ruby -r./lib/quality/test_level.rb -e "puts Quality::TestLevel.new(%(ee/)).pattern(:${TEST_LEVEL})")'
+    - mkdir -p tmp/memory_test
+    - export MEMORY_TEST_PATH="tmp/memory_test/ee_${TEST_TOOL}_${TEST_LEVEL}_${DATABASE}_node_${CI_NODE_INDEX}_${CI_NODE_TOTAL}_memory.csv"
+    - knapsack rspec "--color --format documentation --format RspecJunitFormatter --out junit_rspec.xml --tag level:${TEST_LEVEL} --tag ~geo"
+    - date
+
+.rspec-base-pg-ee:
+  extends: .rspec-base-ee
+  services:
+    - name: postgres:9.6
+      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+    - name: redis:alpine
+    - name: docker.elastic.co/elasticsearch/elasticsearch:5.6.12
+
+rspec unit pg ee:
+  extends: .rspec-base-pg-ee
+  parallel: 7
+
+rspec integration pg ee:
+  extends: .rspec-base-pg-ee
+  parallel: 3
+
+rspec system pg ee:
+  extends: .rspec-base-pg-ee
+  parallel: 5
+
+.rspec-base-geo:
+  extends: .rspec-base-ee
+  parallel: 3
+  script:
+    - JOB_NAME=( $CI_JOB_NAME )
+    - TEST_TOOL=${JOB_NAME[0]}
+    - TEST_LEVEL=${JOB_NAME[1]}
+    - DATABASE=${JOB_NAME[2]}
+    - export KNAPSACK_TEST_FILE_PATTERN="ee/spec/**{,/*/**}/*_spec.rb" KNAPSACK_GENERATE_REPORT=true CACHE_CLASSES=true
+    - export KNAPSACK_REPORT_PATH=knapsack/${CI_PROJECT_NAME}/${TEST_TOOL}_node_${CI_NODE_INDEX}_${CI_NODE_TOTAL}_report.json
+    - cp ${EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH} ${KNAPSACK_REPORT_PATH}
+    - source scripts/prepare_postgres_fdw.sh
+    - scripts/gitaly-test-spawn
+    - mkdir -p tmp/memory_test
+    - export MEMORY_TEST_PATH="tmp/memory_test/ee_${TEST_TOOL}_${TEST_LEVEL}_${DATABASE}_node_${CI_NODE_INDEX}_${CI_NODE_TOTAL}_memory.csv"
+    - knapsack rspec "-Ispec --color --format documentation --format RspecJunitFormatter --out junit_rspec.xml --tag geo"
+
+rspec geo pg ee:
+  extends:
+    - .rspec-base-geo
+    - .use-pg
+  except:
+    variables:
+      - $CI_COMMIT_REF_NAME =~ /(^geo[\/-].*|.*-geo$)/
+
+rspec geo pg-10 ee:
+  extends:
+    - .rspec-base-geo
+    - .use-pg-10
+  except:
+    variables:
+      - $CI_COMMIT_REF_NAME =~ /(^geo[\/-].*|.*-geo$)/
+
+quick-rspec geo pg ee:
+  extends:
+    - .rspec-base-geo
+    - .use-pg
+  stage: quick-test
+  only:
+    variables:
+      - $CI_COMMIT_REF_NAME =~ /(^geo[\/-].*|.*-geo$)/
+
+quick-rspec geo pg-10 ee:
+  extends:
+    - .rspec-base-geo
+    - .use-pg-10
+  stage: quick-test
+  only:
+    variables:
+      - $CI_COMMIT_REF_NAME =~ /(^geo[\/-].*|.*-geo$)/
+
+rspec quarantine pg ee:
+  extends:
+    - rspec quarantine pg
+    - .only-ee
+  script:
+    - export NO_KNAPSACK=1 CACHE_CLASSES=true
+    - scripts/gitaly-test-spawn
+    - bin/rspec --color --format documentation --format RspecJunitFormatter --out junit_rspec.xml --tag quarantine -- ee/spec/
+
+db:rollback geo:
+  extends:
+    - db:rollback
+    - .only-ee
+  script:
+    - bundle exec rake geo:db:migrate VERSION=20170627195211
+    - bundle exec rake geo:db:migrate
+
+## END of EE-specific content

.gitlab/ci/reports.gitlab-ci.yml

@@ -1,26 +1,236 @@
-include:
-  - template: Code-Quality.gitlab-ci.yml
-  - template: Security/SAST.gitlab-ci.yml
-  - template: Security/Dependency-Scanning.gitlab-ci.yml
+# include:
+#   - template: Code-Quality.gitlab-ci.yml
+#   - template: Security/SAST.gitlab-ci.yml
+#   - template: Security/Dependency-Scanning.gitlab-ci.yml
+#   - template: Security/DAST.gitlab-ci.yml
 
+# We need to duplicate this job's definition because it seems it's impossible to
+# override an included `only.refs`.
+# See https://gitlab.com/gitlab-org/gitlab/issues/31371.
 code_quality:
-  extends: .dedicated-no-docs
-  # gitlab-org runners set `privileged: false` but we need to have it set to true
-  # since we're using Docker in Docker
-  tags: []
-  before_script: []
-  cache: {}
-
-sast:
-  extends: .dedicated-no-docs
-  tags: []
-  before_script: []
-  cache: {}
+  extends:
+    - .default-retry
+    - .default-only
+    - .only-code-changes
+  stage: test
+  image: docker:stable
+  allow_failure: true
+  services:
+    - docker:stable-dind
   variables:
-    SAST_BRAKEMAN_LEVEL: 2
+    DOCKER_DRIVER: overlay2
+    DOCKER_TLS_CERTDIR: ""
+  script:
+    - |
+      if ! docker info &>/dev/null; then
+        if [ -z "$DOCKER_HOST" -a "$KUBERNETES_PORT" ]; then
+          export DOCKER_HOST='tcp://localhost:2375'
+        fi
+      fi
+    - docker run
+        --env SOURCE_CODE="$PWD"
+        --volume "$PWD":/code
+        --volume /var/run/docker.sock:/var/run/docker.sock
+        "registry.gitlab.com/gitlab-org/security-products/codequality:12-0-stable" /code
+  artifacts:
+    reports:
+      codequality: gl-code-quality-report.json
+    expire_in: 1 week
+  dependencies: []
+  except:
+    variables:
+      - $CODE_QUALITY_DISABLED
 
+# We need to duplicate this job's definition because it seems it's impossible to
+# override an included `only.refs`.
+# See https://gitlab.com/gitlab-org/gitlab/issues/31371.
+sast:
+  extends:
+    - .default-retry
+    - .default-only
+    - .only-code-changes
+  stage: test
+  image: docker:stable
+  variables:
+    DOCKER_DRIVER: overlay2
+    DOCKER_TLS_CERTDIR: ""
+    SAST_BRAKEMAN_LEVEL: 2
+    SAST_EXCLUDED_PATHS: qa,spec,doc,ee/spec
+  allow_failure: true
+  services:
+    - docker:stable-dind
+  script:
+    - export SAST_VERSION=${SP_VERSION:-$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')}
+    - |
+      if ! docker info &>/dev/null; then
+        if [ -z "$DOCKER_HOST" -a "$KUBERNETES_PORT" ]; then
+          export DOCKER_HOST='tcp://localhost:2375'
+        fi
+      fi
+    - | # this is required to avoid undesirable reset of Docker image ENV variables being set on build stage
+      function propagate_env_vars() {
+        CURRENT_ENV=$(printenv)
+
+        for VAR_NAME; do
+          echo $CURRENT_ENV | grep "${VAR_NAME}=" > /dev/null && echo "--env $VAR_NAME "
+        done
+      }
+    - |
+      docker run \
+        $(propagate_env_vars \
+          SAST_BANDIT_EXCLUDED_PATHS \
+          SAST_ANALYZER_IMAGES \
+          SAST_ANALYZER_IMAGE_PREFIX \
+          SAST_ANALYZER_IMAGE_TAG \
+          SAST_DEFAULT_ANALYZERS \
+          SAST_PULL_ANALYZER_IMAGES \
+          SAST_BRAKEMAN_LEVEL \
+          SAST_FLAWFINDER_LEVEL \
+          SAST_GITLEAKS_ENTROPY_LEVEL \
+          SAST_GOSEC_LEVEL \
+          SAST_EXCLUDED_PATHS \
+          SAST_DOCKER_CLIENT_NEGOTIATION_TIMEOUT \
+          SAST_PULL_ANALYZER_IMAGE_TIMEOUT \
+          SAST_RUN_ANALYZER_TIMEOUT \
+          SAST_JAVA_VERSION \
+          ANT_HOME \
+          ANT_PATH \
+          GRADLE_PATH \
+          JAVA_OPTS \
+          JAVA_PATH \
+          JAVA_8_VERSION \
+          JAVA_11_VERSION \
+          MAVEN_CLI_OPTS \
+          MAVEN_PATH \
+          MAVEN_REPO_PATH \
+          SBT_PATH \
+          FAIL_NEVER \
+        ) \
+        --volume "$PWD:/code" \
+        --volume /var/run/docker.sock:/var/run/docker.sock \
+        "registry.gitlab.com/gitlab-org/security-products/sast:$SAST_VERSION" /app/bin/run /code
+  artifacts:
+    expire_in: 7 days
+    paths:
+      - gl-sast-report.json
+    reports:
+      sast: gl-sast-report.json
+  dependencies: []
+  only:
+    variables:
+      - $GITLAB_FEATURES =~ /\bsast\b/
+  except:
+    variables:
+      - $SAST_DISABLED
+
+# We need to duplicate this job's definition because it seems it's impossible to
+# override an included `only.refs`.
+# See https://gitlab.com/gitlab-org/gitlab/issues/31371.
 dependency_scanning:
-  extends: .dedicated-no-docs
-  tags: []
-  before_script: []
-  cache: {}
+  extends:
+    - .default-retry
+    - .default-only
+    - .only-code-changes
+  stage: test
+  image: docker:stable
+  variables:
+    DOCKER_DRIVER: overlay2
+    DOCKER_TLS_CERTDIR: ""
+  allow_failure: true
+  services:
+    - docker:stable-dind
+  script:
+    - export DS_VERSION=${SP_VERSION:-$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')}
+    - |
+      if ! docker info &>/dev/null; then
+        if [ -z "$DOCKER_HOST" -a "$KUBERNETES_PORT" ]; then
+          export DOCKER_HOST='tcp://localhost:2375'
+        fi
+      fi
+    - | # this is required to avoid undesirable reset of Docker image ENV variables being set on build stage
+      function propagate_env_vars() {
+        CURRENT_ENV=$(printenv)
+
+        for VAR_NAME; do
+          echo $CURRENT_ENV | grep "${VAR_NAME}=" > /dev/null && echo "--env $VAR_NAME "
+        done
+      }
+    - |
+      docker run \
+        $(propagate_env_vars \
+          DS_ANALYZER_IMAGES \
+          DS_ANALYZER_IMAGE_PREFIX \
+          DS_ANALYZER_IMAGE_TAG \
+          DS_DEFAULT_ANALYZERS \
+          DS_EXCLUDED_PATHS \
+          DEP_SCAN_DISABLE_REMOTE_CHECKS \
+          DS_DOCKER_CLIENT_NEGOTIATION_TIMEOUT \
+          DS_PULL_ANALYZER_IMAGE_TIMEOUT \
+          DS_RUN_ANALYZER_TIMEOUT \
+          DS_PYTHON_VERSION \
+          DS_PIP_DEPENDENCY_PATH \
+          PIP_INDEX_URL \
+          PIP_EXTRA_INDEX_URL \
+        ) \
+        --volume "$PWD:/code" \
+        --volume /var/run/docker.sock:/var/run/docker.sock \
+        "registry.gitlab.com/gitlab-org/security-products/dependency-scanning:$DS_VERSION" /code
+  artifacts:
+    reports:
+      dependency_scanning: gl-dependency-scanning-report.json
+  dependencies: []
+  only:
+    variables:
+      - $GITLAB_FEATURES =~ /\bdependency_scanning\b/
+  except:
+    variables:
+      - $DEPENDENCY_SCANNING_DISABLED
+
+# We need to duplicate this job's definition because it seems it's impossible to
+# override an included `only.refs`.
+# See https://gitlab.com/gitlab-org/gitlab/issues/31371.
+dast:
+  extends:
+    - .default-retry
+    - .default-only
+    - .only-code-qa-changes
+    - .only-review
+  stage: qa
+  dependencies: ["review-deploy"]
+  before_script:
+    - export DAST_WEBSITE="$(cat review_app_url.txt)"
+  image:
+    name: "registry.gitlab.com/gitlab-org/security-products/dast:$CI_SERVER_VERSION_MAJOR-$CI_SERVER_VERSION_MINOR-stable"
+  variables:
+  # URL to scan:
+  # DAST_WEBSITE: https://example.com/
+  #
+  # Time limit for target availability (scan is attempted even when timeout):
+  # DAST_TARGET_AVAILABILITY_TIMEOUT: 60
+  #
+  # Set these variables to scan with an authenticated user:
+  # DAST_AUTH_URL: https://example.com/sign-in
+  # DAST_USERNAME: john.doe@example.com
+  # DAST_PASSWORD: john-doe-password
+  # DAST_USERNAME_FIELD: session[user] # the name of username field at the sign-in HTML form
+  # DAST_PASSWORD_FIELD: session[password] # the name of password field at the sign-in HTML form
+  # DAST_AUTH_EXCLUDE_URLS: http://example.com/sign-out,http://example.com/sign-out-2 # optional: URLs to skip during the authenticated scan; comma-separated, no spaces in between
+  #
+  # Perform ZAP Full Scan, which includes both passive and active scanning:
+  # DAST_FULL_SCAN_ENABLED: "true"
+  allow_failure: true
+  script:
+    - export DAST_WEBSITE=${DAST_WEBSITE:-$(cat environment_url.txt)}
+    - /analyze -t $DAST_WEBSITE
+  artifacts:
+    expire_in: 7 days
+    paths:
+      - gl-dast-report.json
+    reports:
+      dast: gl-dast-report.json
+  only:
+    variables:
+      - $GITLAB_FEATURES =~ /\bdast\b/
+  except:
+    variables:
+      - $DAST_DISABLED

.gitlab/ci/review.gitlab-ci.yml

@@ -1,94 +1,87 @@
-.review-only: &review-only
-  only:
-    refs:
-      - branches@gitlab-org/gitlab-ce
-      - branches@gitlab-org/gitlab-ee
-    kubernetes: active
-  except:
-    refs:
-      - master
-      - /^\d+-\d+-auto-deploy-\d+$/
-      - /(^docs[\/-].+|.+-docs$)/
-
-.review-schedules-only: &review-schedules-only
-  only:
-    refs:
-      - schedules@gitlab-org/gitlab-ce
-      - schedules@gitlab-org/gitlab-ee
-    kubernetes: active
-    variables:
-      - $REVIEW_APP_CLEANUP
-  except:
-    refs:
-      - tags
-      - /(^docs[\/-].+|.+-docs$)/
-
-.review-base: &review-base
-  extends: .dedicated-runner
-  <<: *review-only
+.review-base:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-only
+    - .only-review
+    - .only-code-qa-changes
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-charts-build-base
-  cache: {}
   dependencies: []
   before_script:
     - source scripts/utils.sh
 
-.review-docker: &review-docker
-  <<: *review-base
+.review-docker:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-only
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-qa-alpine
   services:
     - docker:19.03.0-dind
   tags:
     - gitlab-org
     - docker
-  variables: &review-docker-variables
+  variables:
     DOCKER_DRIVER: overlay2
     DOCKER_HOST: tcp://docker:2375
-    LATEST_QA_IMAGE: "gitlab/${CI_PROJECT_NAME}-qa:nightly"
-    QA_IMAGE: "${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab/${CI_PROJECT_NAME}-qa:${CI_COMMIT_REF_SLUG}"
+    GITLAB_EDITION: "ce"
 
 build-qa-image:
-  <<: *review-docker
-  stage: test
+  extends:
+    - .review-docker
+    - .only-code-qa-changes
+  only:
+    variables:
+      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+  stage: prepare
   script:
-    - time docker build --cache-from ${LATEST_QA_IMAGE} --tag ${QA_IMAGE} --file ./qa/Dockerfile ./
+    - '[[ ! -d "ee/" ]] || export GITLAB_EDITION="ee"'
+    - export QA_IMAGE="${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab/gitlab-${GITLAB_EDITION}-qa:${CI_COMMIT_REF_SLUG}"
+    - time docker build --cache-from gitlab/gitlab-${GITLAB_EDITION}-qa:nightly --tag ${QA_IMAGE} --file ./qa/Dockerfile ./
     - echo "${CI_JOB_TOKEN}" | docker login --username gitlab-ci-token --password-stdin ${CI_REGISTRY}
     - time docker push ${QA_IMAGE}
 
-.review-build-cng-base: &review-build-cng-base
+.review-build-cng-base:
+  extends:
+    - .default-only
+    - .only-code-qa-changes
   image: ruby:2.6-alpine
-  stage: test
-  when: manual
+  stage: review-prepare
   before_script:
     - source scripts/utils.sh
     - install_api_client_dependencies_with_apk
     - install_gitlab_gem
   dependencies: []
-  cache: {}
   script:
     - BUILD_TRIGGER_TOKEN=$REVIEW_APPS_BUILD_TRIGGER_TOKEN ./scripts/trigger-build cng
 
 review-build-cng:
-  <<: *review-only
-  <<: *review-build-cng-base
+  extends:
+    - .review-build-cng-base
+    - .only-review
+  needs: ["gitlab:assets:compile pull-cache"]
 
 schedule:review-build-cng:
-  <<: *review-schedules-only
-  <<: *review-build-cng-base
+  extends:
+    - .review-build-cng-base
+    - .only-review-schedules
+  needs: ["gitlab:assets:compile"]
 
-.review-deploy-base: &review-deploy-base
-  <<: *review-base
+.review-deploy-base:
+  extends: .review-base
   allow_failure: true
-  retry: 1
   stage: review
   variables:
     HOST_SUFFIX: "${CI_ENVIRONMENT_SLUG}"
     DOMAIN: "-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}"
     GITLAB_HELM_CHART_REF: "master"
-  environment: &review-environment
+    GITLAB_EDITION: "ce"
+  environment:
     name: review/${CI_COMMIT_REF_NAME}
     url: https://gitlab-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}
     on_stop: review-stop
   before_script:
+    - '[[ ! -d "ee/" ]] || export GITLAB_EDITION="ee"'
     - export GITLAB_SHELL_VERSION=$(<GITLAB_SHELL_VERSION)
     - export GITALY_VERSION=$(<GITALY_SERVER_VERSION)
     - export GITLAB_WORKHORSE_VERSION=$(<GITLAB_WORKHORSE_VERSION)
@@ -110,54 +103,70 @@ schedule:review-build-cng:
     when: always
 
 review-deploy:
-  <<: *review-deploy-base
+  extends:
+    - .review-deploy-base
+  needs: ["review-build-cng"]
 
 schedule:review-deploy:
-  <<: *review-deploy-base
-  <<: *review-schedules-only
+  extends:
+    - .review-deploy-base
+    - .only-review-schedules
+  needs: ["schedule:review-build-cng"]
 
 review-stop:
-  <<: *review-only
-  extends: .single-script-job-dedicated-runner
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-charts-build-base
-  stage: review
+  extends:
+    - .review-deploy-base
   when: manual
-  allow_failure: true
-  variables:
-    SCRIPT_NAME: review_apps/review-apps.sh
   environment:
-    <<: *review-environment
     action: stop
-  script:
+  variables:
+    GIT_STRATEGY: none
+  before_script:
+    # We don't clone the repo by using GIT_STRATEGY: none and only download the
+    # single script we need here so it's much faster than cloning.
+    - apk add --update openssl
+    - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/review_apps/review-apps.sh
     - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/utils.sh
     - source utils.sh
-    - source $(basename $SCRIPT_NAME)
-    - delete
+    - source review-apps.sh
+  script:
+    - delete_release
+  artifacts:
+    paths: []
 
-.review-qa-base: &review-qa-base
-  <<: *review-docker
-  allow_failure: true
-  retry: 2
+review-cleanup-failed-deployment:
+  extends: review-stop
+  stage: prepare
+  when: on_success
+  allow_failure: false
+  script:
+    - delete_failed_release
+
+.review-qa-base:
+  extends:
+    - .review-docker
+    - .only-review
+    - .only-code-qa-changes
   stage: qa
   variables:
-    <<: *review-docker-variables
     QA_ARTIFACTS_DIR: "${CI_PROJECT_DIR}/qa"
     QA_CAN_TEST_GIT_PROTOCOL_V2: "false"
+    QA_DEBUG: "true"
     GITLAB_USERNAME: "root"
     GITLAB_PASSWORD: "${REVIEW_APPS_ROOT_PASSWORD}"
     GITLAB_ADMIN_USERNAME: "root"
     GITLAB_ADMIN_PASSWORD: "${REVIEW_APPS_ROOT_PASSWORD}"
     GITHUB_ACCESS_TOKEN: "${REVIEW_APPS_QA_GITHUB_ACCESS_TOKEN}"
     EE_LICENSE: "${REVIEW_APPS_EE_LICENSE}"
-    QA_DEBUG: "true"
-  dependencies:
-    - review-deploy
+  dependencies: ["review-deploy"]
   artifacts:
     paths:
       - ./qa/gitlab-qa-run-*
     expire_in: 7 days
     when: always
   before_script:
+    - '[[ ! -d "ee/" ]] || export GITLAB_EDITION="ee"'
+    - export QA_IMAGE="${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab/gitlab-${GITLAB_EDITION}-qa:${CI_COMMIT_REF_SLUG}"
     - export CI_ENVIRONMENT_URL="$(cat review_app_url.txt)"
     - echo "${CI_ENVIRONMENT_URL}"
     - echo "${QA_IMAGE}"
@@ -166,12 +175,13 @@ review-stop:
     - gem install gitlab-qa --no-document ${GITLAB_QA_VERSION:+ --version ${GITLAB_QA_VERSION}}
 
 review-qa-smoke:
-  <<: *review-qa-base
+  extends: .review-qa-base
+  allow_failure: true
   script:
     - gitlab-qa Test::Instance::Smoke "${QA_IMAGE}" "${CI_ENVIRONMENT_URL}"
 
 review-qa-all:
-  <<: *review-qa-base
+  extends: .review-qa-base
   allow_failure: true
   when: manual
   parallel: 5
@@ -181,20 +191,19 @@ review-qa-all:
     - gitlab-qa Test::Instance::Any "${QA_IMAGE}" "${CI_ENVIRONMENT_URL}" -- --format RspecJunitFormatter --out tmp/rspec-${CI_JOB_ID}.xml --format html --out tmp/rspec.htm --color --format documentation
 
 parallel-spec-reports:
-  extends: .dedicated-runner
-  dependencies:
-    - review-qa-all
+  extends:
+    - .default-tags
+    - .default-only
+    - .only-code-qa-changes
+    - .only-review
   image: ruby:2.6-alpine
-  services: []
-  before_script: []
+  stage: post-test
+  dependencies: ["review-qa-all"]
   variables:
-    SETUP_DB: "false"
     NEW_PARALLEL_SPECS_REPORT: qa/report-new.html
     BASE_ARTIFACT_URL: "${CI_PROJECT_URL}/-/jobs/${CI_JOB_ID}/artifacts/file/qa/"
-  stage: post-test
   allow_failure: true
   when: manual
-  retry: 0
   artifacts:
     when: always
     paths:
@@ -204,15 +213,15 @@ parallel-spec-reports:
       junit: qa/gitlab-qa-run-*/**/rspec-*.xml
   script:
     - apk add --update build-base libxml2-dev libxslt-dev && rm -rf /var/cache/apk/*
-    - gem install nokogiri
+    - gem install nokogiri --no-document
     - cd qa/gitlab-qa-run-*/gitlab-*
     - ARTIFACT_DIRS=$(pwd |rev| awk -F / '{print $1,$2}' | rev | sed s_\ _/_)
-    - cd ../../..
+    - cd -
     - '[[ -f $NEW_PARALLEL_SPECS_REPORT ]] || echo "{}" > ${NEW_PARALLEL_SPECS_REPORT}'
     - scripts/merge-html-reports ${NEW_PARALLEL_SPECS_REPORT} ${BASE_ARTIFACT_URL}${ARTIFACT_DIRS} qa/gitlab-qa-run-*/**/rspec.htm
 
-.review-performance-base: &review-performance-base
-  <<: *review-qa-base
+review-performance:
+  extends: .review-qa-base
   allow_failure: true
   before_script:
     - export CI_ENVIRONMENT_URL="$(cat review_app_url.txt)"
@@ -230,19 +239,17 @@ parallel-spec-reports:
     reports:
       performance: performance.json
 
-review-performance:
-  <<: *review-performance-base
-
 schedule:review-performance:
-  <<: *review-performance-base
-  <<: *review-schedules-only
-  dependencies:
-    - schedule:review-deploy
+  extends:
+    - review-performance
+    - .only-review-schedules
+  dependencies: ["schedule:review-deploy"]
 
 schedule:review-cleanup:
-  <<: *review-base
-  <<: *review-schedules-only
-  stage: build
+  extends:
+    - .review-base
+    - .only-review-schedules
+  stage: prepare
   allow_failure: true
   environment:
     name: review/auto-cleanup
@@ -254,22 +261,23 @@ schedule:review-cleanup:
     - ruby -rrubygems scripts/review_apps/automated_cleanup.rb
 
 danger-review:
-  extends: .dedicated-pull-cache-job
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-only
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:danger
   stage: test
   dependencies: []
-  before_script: []
   only:
     variables:
       - $DANGER_GITLAB_API_TOKEN
   except:
     refs:
       - master
-      - /^\d+-\d+-auto-deploy-\d+$/
-      - /^[\d-]+-stable(-ee)?$/
     variables:
-      - $CI_COMMIT_REF_NAME =~ /^ce-to-ee-.*/
-      - $CI_COMMIT_REF_NAME =~ /.*-stable(-ee)?-prepare-.*/
+      - $CI_COMMIT_REF_NAME =~ /^\d+-\d+-auto-deploy-\d+$/
+      - $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable(-ee)?$/
   script:
     - git version
     - node --version

.gitlab/ci/setup.gitlab-ci.yml

@@ -1,41 +1,48 @@
 # Insurance in case a gem needed by one of our releases gets yanked from
 # rubygems.org in the future.
 cache gems:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .only-code-qa-changes
+  stage: test
+  dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
+  variables:
+    SETUP_DB: "false"
   script:
     - bundle package --all --all-platforms
   artifacts:
     paths:
       - vendor/cache
   only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
+    refs:
+      - master
       - tags
-  dependencies:
-    - setup-test-env
+    variables:
+      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+
+.minimal-job:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-only
+    - .only-code-changes
+  dependencies: []
 
 gitlab_git_test:
-  extends:
-    - .dedicated-runner
-    - .no-docs-and-no-qa
-  variables:
-    SETUP_DB: "false"
-  before_script: []
-  dependencies: []
-  cache: {}
+  extends: .minimal-job
   script:
     - spec/support/prepare-gitlab-git-test-for-commit --check-for-changes
 
 no_ee_check:
-  extends:
-    - .dedicated-runner
-    - .no-docs-and-no-qa
-  variables:
-    SETUP_DB: "false"
-  before_script: []
-  dependencies: []
-  cache: {}
+  extends: .minimal-job
   script:
     - scripts/no-ee-check
   only:
-    - /.+/@gitlab-org/gitlab-ce
+    variables:
+      - $CI_PROJECT_NAME == "gitlab-foss"
+      - $CI_PROJECT_NAME == "gitlab-ce"  # Support former project name for forks/mirrors
+      - $CI_PROJECT_NAME == "gitlabhq"  # Support former project name for dev

.gitlab/ci/test-metadata.gitlab-ci.yml

@@ -1,5 +1,6 @@
-.tests-metadata-state: &tests-metadata-state
-  extends: .dedicated-runner
+.tests-metadata-state:
+  extends:
+    - .default-only
   variables:
     TESTS_METADATA_S3_BUCKET: "gitlab-ce-cache"
   before_script:
@@ -14,7 +15,7 @@
 retrieve-tests-metadata:
   extends:
     - .tests-metadata-state
-    - .no-docs-and-no-qa
+    - .only-code-changes
   stage: prepare
   cache:
     key: tests_metadata
@@ -27,9 +28,13 @@ retrieve-tests-metadata:
     - mkdir -p rspec_profiling/
     - wget -O $FLAKY_RSPEC_SUITE_REPORT_PATH http://${TESTS_METADATA_S3_BUCKET}.s3.amazonaws.com/$FLAKY_RSPEC_SUITE_REPORT_PATH || rm $FLAKY_RSPEC_SUITE_REPORT_PATH
     - '[[ -f $FLAKY_RSPEC_SUITE_REPORT_PATH ]] || echo "{}" > ${FLAKY_RSPEC_SUITE_REPORT_PATH}'
+    - '[[ ! -d "ee/" ]] || wget -O $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH http://${TESTS_METADATA_S3_BUCKET}.s3.amazonaws.com/$EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH || rm $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH'
+    - '[[ ! -d "ee/" ]] || [[ -f $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH ]] || echo "{}" > ${EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH}'
 
 update-tests-metadata:
-  <<: *tests-metadata-state
+  extends:
+    - .tests-metadata-state
+    - .only-code-changes
   stage: post-test
   cache:
     key: tests_metadata
@@ -42,6 +47,9 @@ update-tests-metadata:
     - echo "{}" > ${KNAPSACK_RSPEC_SUITE_REPORT_PATH}
     - scripts/merge-reports ${KNAPSACK_RSPEC_SUITE_REPORT_PATH} knapsack/${CI_PROJECT_NAME}/rspec_*_pg_node_*.json
     - '[[ -z ${TESTS_METADATA_S3_BUCKET} ]] || scripts/sync-reports put $TESTS_METADATA_S3_BUCKET $KNAPSACK_RSPEC_SUITE_REPORT_PATH'
+    - '[[ ! -d "ee/" ]] || echo "{}" > ${EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH}'
+    - '[[ ! -d "ee/" ]] || scripts/merge-reports ${EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH} knapsack/${CI_PROJECT_NAME}/rspec_*_pg_ee_*node_*.json'
+    - '[[ ! -d "ee/" ]] || [[ -z ${TESTS_METADATA_S3_BUCKET} ]] || scripts/sync-reports put $TESTS_METADATA_S3_BUCKET $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH'
     - rm -f knapsack/${CI_PROJECT_NAME}/*_node_*.json
     - scripts/merge-reports ${FLAKY_RSPEC_SUITE_REPORT_PATH} rspec_flaky/all_*_*.json
     - FLAKY_RSPEC_GENERATE_REPORT=1 scripts/prune-old-flaky-specs ${FLAKY_RSPEC_SUITE_REPORT_PATH}
@@ -49,30 +57,26 @@ update-tests-metadata:
     - rm -f rspec_flaky/all_*.json rspec_flaky/new_*.json
     - scripts/insert-rspec-profiling-data
   only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
-    - master@gitlab/gitlabhq
-    - master@gitlab/gitlab-ee
-
-flaky-examples-check:
-  extends: .dedicated-runner
-  image: ruby:2.6-alpine
-  services: []
-  before_script: []
-  variables:
-    SETUP_DB: "false"
-    USE_BUNDLE_INSTALL: "false"
-    NEW_FLAKY_SPECS_REPORT: rspec_flaky/report-new.json
-  stage: post-test
-  allow_failure: true
-  retry: 0
-  only:
-    - branches
-  except:
     refs:
       - master
-      - /(^docs[\/-].+|.+-docs$)/
-      - /(^qa[\/-].*|.*-qa$)/
+    variables:
+      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+      - $CI_SERVER_HOST == "dev.gitlab.org"
+
+flaky-examples-check:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-only
+    - .only-code-changes
+  image: ruby:2.6-alpine
+  stage: post-test
+  variables:
+    NEW_FLAKY_SPECS_REPORT: rspec_flaky/report-new.json
+  allow_failure: true
+  only:
+    refs:
+      - merge_requests
   artifacts:
     expire_in: 30d
     paths:

.gitlab/ci/yaml.gitlab-ci.yml

@@ -1,9 +1,14 @@
 # Yamllint of *.yml for .gitlab-ci.yml.
 # This uses rules from project root `.yamllint`.
 lint-ci-gitlab:
-  extends: .dedicated-runner
-  before_script: []
-  dependencies: []
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-only
+  only:
+    changes:
+      - "**/*.yml"
   image: sdesbure/yamllint:latest
+  dependencies: []
   script:
     - yamllint .gitlab-ci.yml .gitlab/ci lib/gitlab/ci/templates changelogs

.gitlab/issue_templates/Feature proposal.md

@@ -5,7 +5,17 @@
 ### Intended users
 
 <!-- Who will use this feature? If known, include any of the following: types of users (e.g. Developer), personas, or specific company roles (e.g. Release Manager). It's okay to write "Unknown" and fill this field in later.
-Personas can be found at https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/ -->
+
+* [Parker (Product Manager)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#parker-product-manager)
+* [Delaney (Development Team Lead)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#delaney-development-team-lead)
+* [Sasha (Software Developer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sasha-software-developer)
+* [Presley (Product Designer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#presley-product-designer)
+* [Devon (DevOps Engineer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#devon-devops-engineer)
+* [Sidney (Systems Administrator)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sidney-systems-administrator)
+* [Sam (Security Analyst)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sam-security-analyst)
+* [Dana (Data Analyst)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#dana-data-analyst)
+
+Personas are described at https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/ -->
 
 ### Further details
 
@@ -22,7 +32,8 @@ Personas can be found at https://about.gitlab.com/handbook/marketing/product-mar
 ### Documentation
 
 <!-- See the Feature Change Documentation Workflow https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html
-Add all known Documentation Requirements here, per https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html#documentation-requirements -->
+Add all known Documentation Requirements here, per https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html#documentation-requirements
+If this feature requires changing permissions, this document https://docs.gitlab.com/ee/user/permissions.html must be updated accordingly. -->
 
 ### Testing
 
@@ -32,6 +43,10 @@ Add all known Documentation Requirements here, per https://docs.gitlab.com/ee/de
 
 <!-- Define both the success metrics and acceptance criteria. Note that success metrics indicate the desired business outcomes, while acceptance criteria indicate when the solution is working correctly. If there is no way to measure success, link to an issue that will implement a way to measure this. -->
 
+### What is the type of buyer? 
+
+<!-- Which leads to: in which enterprise tier should this feature go? See https://about.gitlab.com/handbook/product/pricing/#four-tiers -->
+
 ### Links / references
 
 /label ~feature

.gitlab/issue_templates/Problem_Validation.md

@@ -0,0 +1,41 @@
+## Problem Statement
+
+<!-- What is the problem we hope to validate and solve? -->
+
+## Reach
+
+<!-- Please describe who suffers from this problem. Consider referring to our personas, which are described at https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/ -->
+
+<!-- Please also quantify the problem's reach using the following values, considering an aggregate across GitLab.com and self-managed:
+
+10.0 = Impacts the vast majority (~80% or greater) of our users, prospects, or customers.
+6.0 = Impacts a large percentage (~50% to ~80%) of the above.
+3.0 = Significant reach (~25% to ~50%).
+1.5 = Small reach (~5% to ~25%).
+0.5 = Minimal reach (Less than ~5%). -->
+
+## Impact
+
+<!-- How do we positively impact the users above and GitLab's business by solving this problem? Please describe briefly, and provide a numerical assessment:
+
+3.0 = Massive impact
+2.0 = High impact
+1.0 = Medium impact
+0.5 = Low impact
+0.25 = Minimal impact -->
+
+## Confidence
+
+<!-- How do we know this is a problem? Please provide and link to any supporting information (e.g. data, customer verbatims) and use this basis to provide a numerical assessment on our confidence level in this problem's severity: 
+
+100% = High confidence
+80% = Medium confidence
+50% = Low confidence -->
+
+## Effort
+
+<!-- How much effort do we think it will be to solve this problem? Please include all counterparts (Product, UX, Engineering, etc) in your assessment and quantify the number of person-months needed to dedicate to the effort. 
+
+For example, if the solution will take a product manager, designer, and engineer two weeks of effort - you may quantify this as 1.5 (based on 0.5 months x 3 people). -->
+
+/label ~"workflow::problem backlog"

.gitlab/merge_request_templates/Documentation.md

@@ -15,6 +15,7 @@
 ## Author's checklist
 
 - [ ] Follow the [Documentation Guidelines](https://docs.gitlab.com/ee/development/documentation/) and [Style Guide](https://docs.gitlab.com/ee/development/documentation/styleguide.html).
+- [ ] If applicable, update the [permissions table](https://docs.gitlab.com/ee/user/permissions.html).
 - [ ] Link docs to and from the higher-level index page, plus other related docs where helpful.
 - [ ] Apply the ~Documentation label.
 

.license_encryption_key.pub

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Hxv3MkkZbMrKtIs6np9
+ccP4OwGBkNhIvhPjcQP48hbbascv5RqsOquQGrYSD2ZrE/kbkRdkIcoHEeTZLif+
+bDKFZFI7o5x0H92o9/GSvxHJhQ8mkmvwxD7lssGShwZEm8WG+U7BZqUV/gGmCDqe
+9W8H8Fq2B0ck8IXjbQ4Zz+JlyV/NHZTZcs69plFiLKh4N6GYVftOVwSomh0bbypP
+OB9WnLC7RC9a2LRrhtf8sqa2rRFmtyMMfgFFzLMzS+w+1K4+QLnWP1gKQVzaFnzk
+pnwKPrqbGFYbRztIVEWbs8jPYlLkGb8ME4C84YVtQgbQcbyisU/VW3wUGkhT+J0k
+xwIDAQAB
+-----END PUBLIC KEY-----

.markdownlint.json

@@ -0,0 +1,30 @@
+{
+  "default": true,
+  "first-header-h1": true,
+  "header-style": {
+    "style": "atx"
+  },
+  "ul-style": {
+    "style": "dash"
+  },
+  "line-length": false,
+  "no-duplicate-header": {
+    "allow_different_nesting": true
+  },
+  "no-trailing-punctuation": {
+    "punctuation": ".,;:!。，；：！？"
+  },
+  "ol-prefix": {
+    "style": "one"
+  },
+  "no-inline-html": false,
+  "hr-style": {
+    "style": "---"
+  },
+  "no-emphasis-as-heading": false,
+  "fenced-code-language": false,
+  "first-line-h1": false,
+  "code-block-style": {
+    "style": "fenced"
+  }
+}

.mdlrc

@@ -1,7 +0,0 @@
-# This is the options file for mdl, configured in .gitlab/ci/docs.gitlab-ci.yml,
-# and related to the style file ./mdlrc.style
-
-# See https://github.com/markdownlint/markdownlint/blob/master/docs/configuration.md
-
-ignore_front_matter true
-style File.expand_path('.mdlrc.style', __dir__)

.mdlrc.style

@@ -1,32 +0,0 @@
-# This is the style file for mdl, configured in .gitlab/ci/docs.gitlab-ci.yml,
-# and related to the options file ./mdlrc
-
-# See https://github.com/markdownlint/markdownlint/blob/master/docs/RULES.md
-# for more detailed information on the rules and styles.
-
-rule "MD001"
-rule "MD002"
-rule "MD003", :style => :atx
-rule "MD006"
-rule "MD010"
-rule "MD011"
-rule "MD012"
-rule "MD019"
-rule "MD022"
-rule "MD023"
-rule "MD025"
-rule "MD028"
-rule "MD029", :style => :one
-rule "MD030"
-rule "MD032"
-rule "MD034"
-rule "MD037"
-rule "MD038"
-
-# Should not be used currently:
-
-# rule "MD004", :style => :dash # unordered list style - dash
-# False positives, see https://github.com/markdownlint/markdownlint/issues/261
- 
-# rule "MD039" # Spaces inside link text
-# Crashes when link text has certain punctuation

.overcommit.yml.example

@@ -0,0 +1,28 @@
+# Use this file to configure the Overcommit hooks you wish to use. This will
+# extend the default configuration defined in:
+# https://github.com/sds/overcommit/blob/master/config/default.yml
+#
+# At the topmost level of this YAML file is a key representing type of hook
+# being run (e.g. pre-commit, commit-msg, etc.). Within each type you can
+# customize each hook, such as whether to only run it on certain files (via
+# `include`), whether to only display output if it fails (via `quiet`), etc.
+#
+# For a complete list of hooks, see:
+# https://github.com/sds/overcommit/tree/master/lib/overcommit/hook
+#
+# For a complete list of options that you can use to customize hooks, see:
+# https://github.com/sds/overcommit#configuration
+#
+# Uncomment the following lines to make the configuration take effect.
+
+PreCommit:
+  RuboCop:
+    enabled: true
+#    on_warn: fail # Treat all warnings as failures
+#
+#PostCheckout:
+#  ALL: # Special hook name that customizes all hooks of this type
+#    quiet: true # Change all post-checkout hooks to only display output on failure
+#
+#  IndexTags:
+#    enabled: true # Generate a tags file with `ctags` each time HEAD changes

.rubocop.yml

@@ -50,7 +50,9 @@ Style/FrozenStringLiteralComment:
     - 'config/**/*'
     - 'danger/**/*'
     - 'db/**/*'
-    - 'ee/**/*'
+    - 'ee/db/**/*'
+    - 'ee/spec/**/*'
+    - 'ee/lib/tasks/**/*'
     - 'lib/tasks/**/*'
     - 'qa/**/*'
     - 'rubocop/**/*'
@@ -91,6 +93,7 @@ Naming/FileName:
     - JSON
     - LDAP
     - SAML
+    - SSO
     - IO
     - HMAC
     - QA
@@ -178,6 +181,9 @@ Gitlab/ModuleWithInstanceVariables:
 
 Gitlab/HTTParty:
   Enabled: true
+  Exclude:
+    - 'spec/**/*'
+    - 'ee/spec/**/*'
 
 GitlabSecurity/PublicSend:
   Enabled: true
@@ -211,3 +217,73 @@ ActiveRecordAssociationReload:
   Exclude:
     - 'spec/**/*'
     - 'ee/spec/**/*'
+
+RSpec/FactoriesInMigrationSpecs:
+  Enabled: true
+  Include:
+    - 'spec/migrations/**/*.rb'
+    - 'ee/spec/migrations/**/*.rb'
+    - 'spec/lib/gitlab/background_migration/**/*.rb'
+    - 'ee/spec/lib/gitlab/background_migration/**/*.rb'
+
+Cop/IncludeActionViewContext:
+  Enabled: true
+  Exclude:
+    - 'spec/**/*'
+    - 'ee/spec/**/*'
+
+Cop/IncludeSidekiqWorker:
+  Enabled: true
+  Exclude:
+    - 'spec/**/*'
+    - 'ee/spec/**/*'
+
+Gitlab/Union:
+  Enabled: true
+  Exclude:
+    - 'spec/**/*'
+    - 'ee/spec/**/*'
+
+Cop/SidekiqOptionsQueue:
+  Enabled: true
+  Exclude:
+    - 'spec/**/*.rb'
+    - 'ee/spec/**/*.rb'
+
+Graphql/AuthorizeTypes:
+  Enabled: true
+  Exclude:
+    - 'spec/**/*.rb'
+    - 'ee/spec/**/*.rb'
+
+RSpec/EnvAssignment:
+  Enable: true
+  Include:
+    - 'spec/**/*.rb'
+    - 'ee/spec/**/*.rb'
+  Exclude:
+    - 'spec/**/fast_spec_helper.rb'
+    - 'ee/spec/**/fast_spec_helper.rb'
+    - 'spec/**/spec_helper.rb'
+    - 'ee/spec/**/spec_helper.rb'
+RSpec/BeSuccessMatcher:
+  Enabled: true
+  Include:
+    - 'spec/controllers/**/*'
+    - 'ee/spec/controllers/**/*'
+    - 'spec/support/shared_examples/controllers/**/*'
+    - 'ee/spec/support/shared_examples/controllers/**/*'
+    - 'spec/support/controllers/**/*'
+    - 'ee/spec/support/controllers/**/*'
+
+Scalability/FileUploads:
+  Enabled: true
+  Include:
+    - 'lib/api/**/*.rb'
+    - 'ee/lib/api/**/*.rb'
+
+Graphql/Descriptions:
+  Enabled: true
+  Include:
+    - 'app/graphql/**/*'
+    - 'ee/app/graphql/**/*'

.rubocop_todo.yml

@@ -218,7 +218,7 @@ Lint/UriEscapeUnescape:
     - 'app/models/project_services/drone_ci_service.rb'
     - 'spec/lib/google_api/auth_spec.rb'
     - 'spec/requests/api/files_spec.rb'
-    - 'spec/requests/api/internal_spec.rb'
+    - 'spec/requests/api/internal/base_spec.rb'
 
 # Offense count: 1
 # Configuration parameters: CheckForMethodsWithNoSideEffects.
@@ -565,16 +565,6 @@ Style/EmptyLiteral:
 Style/EmptyMethod:
   Enabled: false
 
-# Offense count: 40
-# Cop supports --auto-correct.
-Style/Encoding:
-  Enabled: false
-
-# Offense count: 2
-Style/EvalWithLocation:
-  Exclude:
-    - 'app/models/service.rb'
-
 # Offense count: 203
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.

16790-render-xml-artifacts.yml

@@ -0,0 +1,5 @@
+---
+title: Render xml artifact files in GitLab
+merge_request: 16790
+author:
+type: added

CHANGELOG.md

@@ -2,9 +2,28 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
-## 12.2.9
+## 12.3.8
 
-### Security (14 changes)
+- No changes.
+
+## 12.3.7
+
+### Security (9 changes)
+
+- Check permissions before showing a forked project's source.
+- Encrypt application setting tokens.
+- Update Workhorse and Gitaly to fix a security issue.
+- Hide commit counts from guest users in Cycle Analytics.
+- Limit potential for DNS rebind SSRF in chat notifications.
+- Fix 500 error caused by invalid byte sequences in links.
+- Ensure are cleaned by ImportExport::AttributeCleaner.
+- Remove notes regarding Related Branches from Issue activity feeds for guest users.
+- Escape namespace in label references to prevent XSS.
+
+
+## 12.3.6
+
+### Security (15 changes)
 
 - Standardize error response when route is missing.
 - Do not display project labels that are not visible for user accessing group labels.
@@ -17,38 +36,331 @@ entry.
 - Return 404 on LFS request if project doesn't exist.
 - Mask sentry auth token in Error Tracking dashboard.
 - Fixes a Open Redirect issue in `InternalRedirect`.
+- Remove deploy access level when project/group link is deleted.
 - Sanitize search text to prevent XSS.
 - Sanitize all wiki markup formats with GitLab sanitization pipelines.
 - Fix stored XSS issue for grafana_url.
 
 
-## 12.2.8
+## 12.3.5
 
-- No changes.
+### Security (1 change)
 
-## 12.2.7
+- Limit search for IID to a type to avoid leaking records with the same IID that the user does not have access to.
+
+
+## 12.3.4
+
+### Fixed (2 changes)
+
+- Fix cannot merge icon showing in dropdown for users who can merge. !17306
+- Fix pipelines for merge requests in project exports. !17844
+
+
+## 12.3.3
 
 ### Security (1 change)
 
 - Fix private feature Elasticsearch leak.
 
 
-## 12.2.6
+## 12.3.2
 
-### Security (10 changes)
+### Security (12 changes)
 
+- Fix Gitaly SearchBlobs flag RPC injection.
 - Add a policy check for system notes that may not be visible due to cross references to private items.
 - Display only participants that user has permission to see on milestone page.
 - Do not disclose project milestones on group milestones page when project milestones access is disabled in project settings.
+- Check permissions before showing head pipeline blocking merge requests.
 - Fix new project path being disclosed through unsubscribe link of issue/merge requests.
 - Prevent bypassing email verification using Salesforce.
 - Do not show resource label events referencing not accessible labels.
 - Cancel all running CI jobs triggered by the user who is just blocked.
-- Fix Gitaly SearchBlobs flag RPC injection [Gitaly v1.59.3].
+- Fix Gitaly SearchBlobs flag RPC injection.
 - Only render fixed number of mermaid blocks.
 - Prevent GitLab accounts takeover if SAML is configured.
 
 
+## 12.3.1
+
+### Fixed (4 changes)
+
+- Fix ordering of issue board lists not being persisted. !17356
+- Fix error when duplicate users are merged in approvers list. !17406
+- Fix bug that caused a merge to show an error message. !17466
+- Fix CSS leak in job log.
+
+
+## 12.3.0
+
+### Security (23 changes)
+
+- Filter out old system notes for epics in notes api endpoint response.
+- Fix SSRF via DNS rebinding in Kubernetes Integration.
+- Fix project import restricted visibility bypass via API.
+- Prevent disclosure of merge request ID via email.
+- Use admin_group authorization in Groups::RunnersController.
+- Gitaly: ignore git redirects.
+- Prevent DNS rebind on JIRA service integration.
+- Make sure HTML text is always escaped when replacing label/milestone references.
+- Fix HTML injection for label description.
+- Avoid exposing unaccessible repo data upon GFM post processing.
+- Remove EXIF from users/personal snippet uploads.
+- Fix weak session management by clearing password reset tokens after login (username/email) are updated.
+- Added image proxy to mitigate potential stealing of IP addresses.
+- Restrict MergeRequests#test_reports to authenticated users with read-access on Builds.
+- Ensure only authorised users can create notes on Merge Requests and Issues.
+- Send TODOs for comments on commits correctly.
+- Check permissions before responding in MergeController#pipeline_status.
+- Limit the size of issuable description and comments.
+- Enforce max chars and max render time in markdown math.
+- Speed up regexp in namespace format by failing fast after reaching maximum namespace depth.
+- Add :login_recaptcha_protection_enabled setting to prevent bots from brute-force attacks.
+- Upgrade pages to 1.8.1.
+- Show cross-referenced MR-id in issues' activities only to authorized users.
+
+### Removed (1 change)
+
+- Removed redundant index on releases table. !31487
+
+### Fixed (78 changes, 25 of them are from the community)
+
+- Avoid Devise "401 Unauthorized" responses. !16519
+- Allow close status to be shown on locked issues. !16685
+- Changed todo/done quick actions to work not only for first usage. !16837 (Marc Schwede)
+- Adds missing error handling. !16896 (toptalo)
+- Prevent the user from seeing an invalid "Purchase more minutes" prompt. !16979
+- Fix missing board lists when other users collapse / expand the list. !17318
+- Uses projects_authorizations.access_level in MembersFinder. !28887 (Jacopo Beschi @jacopo-beschi)
+- Let project reporters create issue from group boards. !29866
+- Remove margin from user header. !30878 (lucyfox)
+- Improve application settings API. !31149 (Mathieu Parent)
+- Fix encoding of special characters in "Find File". !31311 (Jan Beckmann)
+- Avoid conflicts between ArchiveTracesCronWorker and ArchiveTraceWorker. !31376
+- Disable "Transfer group" button when no group is selected. !31387 (Jan Beckmann)
+- Prevent archived projects from showing up in global search. !31498 (David Palubin)
+- Fixed embeded metrics tooltip inconsistent styling. !31517
+- Fix 500 errors caused by pattern matching with variables in CI Lint. !31719
+- Fixed removing directories in Web IDE. !31727
+- All of discussion expand/collapse button is clickable. !31730
+- Only show /copy_metadata quick action when usable. !31735 (Lee Tickett)
+- Read pipelines from public projects through API without an access token. !31816
+- fix charts scroll handle icon to use gitlab svg. !31825
+- Remove "Commit" from pipeline status tooltips. !31861
+- Fix top-nav search bar dropdown on xl displays. !31864 (Kemais Ehlers)
+- Fix loading icon causing text to jump in file row of Web IDE. !31884
+- Fix MR reports section loading icon alignment. !31897
+- Fix broken git clone box on wiki git access page. !31898
+- Exempt user gitlab-ci-token from rate limiting. !31909
+- Fix search preserving space when change branch. !31973 (minghuan lei)
+- Fix file header style and position during scroll in a merge conflict resolution. !31991
+- Allow latency measurements of sidekiq jobs taking > 2.5s. !32001
+- Return correct user for manual deployments. !32004
+- Fix style of secondary profile tab buttons. !32010 (Wolfgang Faust)
+- Fix serverless entry page layout. !32029
+- Fix HTML rendering for fast-forward rebases in merge request widget. !32032
+- Update the timestamp in Operations > Environments to show correct deployment date for manual deploy jobs. !32072
+- Fix dropdowns closing when click is released outside the dropdown. !32084
+- Hide duplicate board list while dragging. !32099
+- Don't check external authorization when disabling the service. !32102 (Robert Schilling)
+- Makes custom Pages domain open as external link in new tab. !32130 (jakeburden)
+- Change default visibility level for FogBugz imported projects to Private. !32142
+- Move visual review toolbar code to NPM. !32159
+- Fix parsing of months in time tracking commands. !32165
+- Wrong format on MS teams integration push events with multi line commit messages. !32180 (Massimeddu Cireddu)
+- Guard against deleted project feature entry in project permissions. !32187
+- Fix ref switcher separators from conflicting with branch names. !32198
+- Fix performance bar on Puma. !32213
+- Remove token field from runners edit form. !32231
+- Fix 500 error in CI lint when included templates are an array. !32232
+- Fix users cannot access job detail page when deployable does not exist. !32247
+- Do not translate system notes into author's language. !32264
+- Fix moving issues API failing when text includes commit URLs. !32317
+- Fix issue due notification emails not being threaded correctly. !32325
+- Allow project feature permissions to be overridden during import with override_params. !32348
+- Handle invalid mirror url. !32353 (Lee Tickett)
+- New project milestone primary button. !32355 (Lee Tickett)
+- Display `more information` docs link on error tracking page when users do not have permissions to enable that feature. !32365 (Romain Maneschi)
+- Quick action label must be first in issue comment. !32367 (Romain Maneschi)
+- Fix for missing avatar images dislpayed in commit trailers. !32374 (Jesse Hall @jessehall3)
+- Make it harder to delete issuables accidentally. !32376
+- Replaced vue resource to axios in the  Markdown field preview component. !32386 (Prakash Chokalingam @prakash_Chokalingam)
+- Fix create MR from issue using a tag as ref. !32392 (Jacopo Beschi @jacopo-beschi)
+- Add X-GitLab-NotificationReason header to note emails. !32422
+- Expand textarea for CA cert in cluster form. !32508
+- Prevent empty external authorization classification labels from overriding the default label. !32517 (Will Chandler)
+- Allow not resolvable urls when dns rebind protection is disabled. !32523
+- Avoid checking dns rebind protection when validating. !32577
+- Passing job rules downstream and E2E specs for job:rules configuration. !32609
+- Quote branch names in how to merge instructions. !32639 (Lee Tickett)
+- Fix removal of install pods. !32667
+- Fix sharing localStorage with all MRs. !32699
+- Default the asset proxy whitelist to the installation domain. !32703
+- Add some padding to details markdown element. !32716
+- Use `ChronicDuration` in a thread-safe way. !32817
+- Fix watch button styling and notifications buttons consistency. !32827
+- Fix encoding error in MR diffs when using external diffs. !32862 (Hiroyuki Sato)
+- Add bottom margin to snippet title. !32877
+- Bump markdown cache version to fix any incorrect links from asset proxy defaults.
+- Persist `needs:` validation as config error.
+
+### Changed (39 changes, 6 of them are from the community)
+
+- Extend pipeline graph scroll area to full width. !14870
+- Frontend support for saving issue board preferences on the current user. !16421
+- Switch Milestone and Release to a many-to-many relationship. !16517
+- Align project selector search box better with design system. !16795
+- Adds the runners_token of the group if the user that requests the group info is admin of it. !16831 (Ignacio Lorenzo Subirá Otal nachootal@gmail.com)
+- Upgrade to Gitaly v1.65.0. !17135
+- Make flash notifications sticky. !30141
+- Add Issue and Merge Request titles to Todo items. !30435 (Arun Kumar Mohan)
+- Remove wiki page slug dialog step when creating wiki page. !31362
+- Improve system notes for Zoom links. !31410 (Jacopo Beschi @jacopo-beschi)
+- Updated WebIDE default commit options. !31449
+- Remove oauth form from GitHub CI/CD only import authentication. !31488
+- Update assignee (cannot merge) style. !31545
+- Updated latest pipeline tag tooltip to be more descriptive. !31624
+- Add optional label_id parameter to label API for PUT and DELETE. !31804
+- Updates issues REST API to allow extended sort options. !31849
+- Fix to show renamed file in mr. !31888
+- Replaced expand diff icons. !31907
+- Upgrade to Gitaly 1.60.0. !31981
+- Make MR pipeline widget text more descriptive. !32025
+- Fix wording on milestone due date when milestone is due today. !32096
+- Improve search result labels. !32101
+- Limit access request emails to ten most recently active owners or maintainers. !32141
+- Improve chatops help output. !32208
+- Update merge train documentation. !32218
+- Add caret icons to the monitoring dashboard. !32239
+- Install cert-manager v0.9.1. !32243
+- Bring text mail for new issue & MR more in line. !32254
+- Add cluster domain warning. !32260
+- Rename epic column state to state_id. !32270
+- Use moved instead of closed in issue references. !32277 (juliette-derancourt)
+- Standardize use of `content` parameter in snippets API. !32296
+- Show meaningful message on /due quick action with invalid date. !32349 (Jacopo Beschi @jacopo-beschi)
+- Remove dynamically constructed feature flags starting with prometheus_transaction_. !32395 (Jacopo Beschi @jacopo-beschi)
+- Indicate on Issue Status if an Issue was Duplicated. !32472
+- Avoid dns rebinding checks when the domain is whitelisted. !32603
+- Upgrade to Gitaly v1.62.0. !32608
+- Unified presentation of the filter input field for projects listings. !32706
+- Hide resolve thread button from guest. !32859
+
+### Performance (20 changes)
+
+- Lower search counters. !11777
+- Considerably improve the query performance for MR discussions load. !16635
+- Eliminate Gitaly N+1 queries with notes API. !32089
+- Optimise UpdateBuildQueueService. !32095
+- Remove N+1 SQL query loading project feature in dashboard. !32169
+- Reduce the number of SQL requests on MR-show. !32192
+- Makes LFS object linker process OIDs in batches. !32268
+- Preload routes information to fix N+1 issue. !32352
+- Reduce N+1 when doing project export. !32423
+- Skip requesting diverging commit counts if no branches are listed. !32496
+- Support selective highlighting of lines. !32514
+- Replace indexes for counting active users. !32538
+- Create partial index for gitlab-monitor CI metrics. !32546
+- Optimize queries for snippet listings. !32576
+- Preprocess wiki attachments with GitLab-Workhorse. !32663
+- Create index for users.unconfirmed_email. !32664
+- Optimize /admin/applications so that it does not timeout. !32852
+- Replace events index with partial one. !32874
+- Partial index for namespaces.type. !32876
+- Fix member expiration not always working. !32951
+
+### Added (42 changes, 10 of them are from the community)
+
+- Enable modsecurity in nginx-ingress apps. !15774
+- Database table for tracking programming language trends over time. !16491
+- Add DAST full scan domain validation. !16680
+- Add not param to Issues API endpoint. !16748
+- Allow specifying timeout per-job in .gitlab-ci.yml. !16777 (Michał Siwek)
+- Document forwarding CI variables to docker build in Auto DevOps. !16783
+- Add links for latest pipelines. !20865 (Alex Ives)
+- New interruptible attribute for CI/CD jobs. !23464 (Cédric Tabin)
+- API: Promote project labels to group labels. !25218 (Robert Schilling)
+- Introduced Build::Rules configuration for Ci::Build. !29011
+- Notification emails can be signed with SMIME. !30644 (Diego Louzán)
+- Allow milestones to be associated with a release (backend). !30816
+- Enable serving static objects from an external storage. !31025
+- Save collapsed option for board lists in database. !31069
+- Apply quickactions when modifying comments. !31136
+- Add SwaggerUI Pages template for .gitlab-ci.yml. !31183 (mdhtr)
+- Add ability to see project deployments at cluster level (FE). !31575
+- Create component to display area and line charts in monitor dashboards. !31639
+- Add persistance to last choice of projects sorting on projects dashboard page. !31669
+- Run Pipeline button & API for MR Pipelines. !31722
+- Add service to transfer Group Milestones when transferring a Project. !31778
+- Allow $CI_REGISTRY_USER to delete tags. !31796
+- Support adding and removing labels w/ push opts. !31831
+- Enable line charts in dashbaord panels and embedded charts. !31920
+- Add First and Last name columns to User model. !31985
+- Add option to allow OAuth providers to bypass two factor. !31996 (Dodocat)
+- Expose namespace storage statistics with GraphQL. !32012
+- Add usage pings for merge request creating. !32059
+- Add warning about initial deployment delay for GitLab Pages sites. !32122
+- Allow Knative to be installed on group and instance level clusters. !32128
+- Add a close issue slack slash command. !32150
+- Support chat notifications to be fired for protected branches. !32176
+- Add system hooks for project/group membership updates. !32371 (Brandon Williams)
+- Add source and merge_request fields to pipeline event webhook. !32373 (Bian Jiaping)
+- Allow ECDSA certificates for pages domains. !32393
+- Show link to cluster used on job page. !32446
+- Group level JupyterHub. !32512
+- Creates utility parser for the job log. !32555
+- Expose update project service endpoint JSON. !32759
+- Expose 'protected' field for Tag API endpoint. !32790 (Andrea Leone)
+- Create table `alerts_service_data`. !32860
+- Creates base components for the new job log.
+
+### Other (42 changes, 13 of them are from the community)
+
+- Setting NOT NULL constraint to users.private_profile column. !14838
+- Schedule productivity analytics recalculation for EE. !15137
+- Document Lambda deploys via GitLab CI/CD. !16858
+- Add Redis interceptor tracing. !30238
+- Encrypt existing and new deploy tokens. !30679
+- Clean up keyboard shortcuts help modal, removing and adding as needed. !31642
+- Add warning to pages domains that obtaining/deploying SSL certificates through Let's Encrypt can take some time. !31765
+- Add new API method in Api.js: projectUsers. !31801
+- Upgrade babel to 7.5.5. !31819 (Takuya Noguchi)
+- Update docs to reflect the rename of gitlab-monitor to gitlab-exporter. !31901
+- Count comments on commits and merge requests. !31912
+- Resolve Badge counter: Very low contrast between foreground and background colors. !31922
+- Add index to improve group cluster deployments query performance. !31988
+- Replace finished_at with deployed_at for the internal API Deployment entity. !32000
+- Update to GitLab Shell v9.4.0. !32009
+- Default clusters namespace_per_environment column to true. !32139
+- Remove deprecation message for milestone tabs. !32252
+- Refactored Karma spec to Jest for mr_widget_auto_merge_failed. !32282 (Illya Klymov)
+- Update GitLab Runner Helm Chart to 0.8.0. !32289
+- Refactor showStagedIcon property to reflect the behavior its name represents. !32333 (Arun Kumar Mohan)
+- Upgrade pages to 1.8.0. !32334
+- Change prioritized labels empty state message. !32338 (Lee Tickett)
+- make test of note app with comments disabled dry. !32383 (Romain Maneschi)
+- Use new location for gitlab-runner helm charts. !32384
+- Mention in docs how to disable project snippets. !32391 (Jacopo Beschi @jacopo-beschi)
+- delete animation width on global search input. !32399 (Romain Maneschi)
+- Remove vue resource from sidebar service. !32400 (Lee Tickett)
+- Remove vue resource from issue. !32421 (Lee Tickett)
+- Remove vue resource from remove issue. !32425 (Lee Tickett)
+- Remove vue-resource from PerformanceBarService. !32428 (Lee Tickett)
+- Added warning note on the project container registry setting informing users that the registry is public for public projects. !32447
+- Admin dashboard: Fetch and render statistics async. !32449
+- Update GitLab Workhorse to v8.10.0. !32501
+- Remove Users.support_bot column. !32554
+- Add padding to left of "Sort by" in members dropdown. !32602
+- Log errors for failed pipeline creation in PostReceive. !32633
+- Avoid prefilling target branch when source branch is the default one. !32701
+- Bump Kubeclient to 4.4.0. !32811
+- Remove vue-resource from notes service. !32934 (Lee Tickett)
+- Added board name to page title in boards view.
+- Remove vue resource from group service. (Lee Tickett)
+- Updates tooltip of 'detached' label/state.
+
+
 ## 12.2.5
 
 ### Security (1 change)
@@ -75,6 +387,10 @@ entry.
 
 ## 12.2.3
 
+- No changes.
+
+## 12.2.2
+
 ### Security (22 changes)
 
 - Ensure only authorised users can create notes on Merge Requests and Issues.
@@ -101,12 +417,17 @@ entry.
 - Fix SSRF via DNS rebinding in Kubernetes Integration.
 
 
-## 12.2.2
-
-- Unreleased due to QA failure.
-
 ## 12.2.1
 
+### Fixed (2 changes)
+
+- Fix for embedded metrics undefined params. !31975
+- Fix "ERR value is not an integer or out of range" errors. !32126
+
+### Performance (1 change)
+
+- Fix Gitaly N+1 calls with listing issues/MRs via API. !31938
+
 ### Fixed (3 changes)
 
 - Fix for embedded metrics undefined params. !31975
@@ -694,6 +1015,34 @@ entry.
 - Removes EE differences for app/views/admin/users/show.html.haml.
 
 
+## 12.0.7
+
+### Security (22 changes)
+
+- Ensure only authorised users can create notes on Merge Requests and Issues.
+- Add :login_recaptcha_protection_enabled setting to prevent bots from brute-force attacks.
+- Queries for Upload should be scoped by model.
+- Speed up regexp in namespace format by failing fast after reaching maximum namespace depth.
+- Limit the size of issuable description and comments.
+- Send TODOs for comments on commits correctly.
+- Restrict MergeRequests#test_reports to authenticated users with read-access on Builds.
+- Added image proxy to mitigate potential stealing of IP addresses.
+- Filter out old system notes for epics in notes api endpoint response.
+- Avoid exposing unaccessible repo data upon GFM post processing.
+- Fix HTML injection for label description.
+- Make sure HTML text is always escaped when replacing label/milestone references.
+- Prevent DNS rebind on JIRA service integration.
+- Use admin_group authorization in Groups::RunnersController.
+- Prevent disclosure of merge request ID via email.
+- Show cross-referenced MR-id in issues' activities only to authorized users.
+- Enforce max chars and max render time in markdown math.
+- Check permissions before responding in MergeController#pipeline_status.
+- Remove EXIF from users/personal snippet uploads.
+- Fix project import restricted visibility bypass via API.
+- Fix weak session management by clearing password reset tokens after login (username/email) are updated.
+- Fix SSRF via DNS rebinding in Kubernetes Integration.
+
+
 ## 12.0.6
 
 - No changes.
@@ -740,16 +1089,16 @@ entry.
 
 ### Security (10 changes)
 
+- Prevent bypass of restriction disabling web password sign in.
 - Hide confidential issue title on unsubscribe for anonymous users.
+- Resolve: Milestones leaked via search API.
 - Fix url redaction for issue links.
+- Add extra fields for handling basic auth on import by url page.
 - Fix confidential issue label disclosure on milestone view.
 - Filter relative links in wiki for XSS.
-- Prevent XSS injection in note imports.
-- Resolve: Milestones leaked via search API.
-- Prevent bypass of restriction disabling web password sign in.
-- Add extra fields for handling basic auth on import by url page.
-- Protect Gitlab::HTTP against DNS rebinding attack.
 - Prevent invalid branch for merge request.
+- Prevent XSS injection in note imports.
+- Protect Gitlab::HTTP against DNS rebinding attack.
 
 ### Removed (5 changes, 1 of them is from the community)
 
@@ -759,7 +1108,7 @@ entry.
 - Make Kubernetes service templates readonly. !29044
 - Remove Content-Type override for Mattermost OAuth login. (Harrison Healey)
 
-### Fixed (116 changes, 28 of them are from the community)
+### Fixed (115 changes, 28 of them are from the community)
 
 - Fix col-sm-* in forms to keep layout. !24885 (Takuya Noguchi)
 - Avoid 500 when rendering users ATOM data. !25408
@@ -772,7 +1121,6 @@ entry.
 - Bring secondary button styles up to design standard. !27920
 - Use FindOrCreateService to create labels and check for existing ones. !27987 (Matt Duren)
 - Fix "too many loops" error by handling gracefully cron schedules for non existent days. !28002
-- Handle errors in successful notes reply. !28082
 - Fix 500 error when accessing charts with an anonymous user. !28091 (Diego Silva)
 - Allow user to set primary email first when 2FA is required. !28097 (Kartikey Tanna)
 - Auto-DevOps: allow to disable rollout status check. !28130 (Sergej Nikolaev <kinolaev@gmail.com>)
@@ -869,14 +1217,14 @@ entry.
 - Move Dropdown to Stick to MR View App Button. !29767
 - Fix IDE commit using latest ref in branch and overriding contents. !29769
 - Revert concurrent pipeline creation for pipeline schedules. !29794
-- Fix layout of group milestone header.
-- Fix remote mirrors not updating after tag push.
+- Fix border radii on diff files and repo files.
 - Fix padding of unclickable pipeline dropdown items to match links.
+- Fix pipeline schedules when owner is nil.
+- Fix remote mirrors not updating after tag push.
+- Fix layout of group milestone header.
+- Fixed show whitespace button not refetching diff content.
 - Change resolve button text to mark comment as resolved.
 - Align system note within discussion with other notes.
-- Fix border radii on diff files and repo files.
-- Fixed show whitespace button not refetching diff content.
-- Fix pipeline schedules when owner is nil.
 
 ### Changed (35 changes, 13 of them are from the community)
 
@@ -976,9 +1324,9 @@ entry.
 - Link to an external dashboard from metrics dashboard. !29369
 - Add labels to note event payload. !29384 (Sujay Patel)
 - Add Join meeting button to issues with Zoom links. !29454
-- Make task completion status available via GraphQL.
 - Add backtraces to Peek performance bar for SQL calls.
 - Added diff suggestion feature discovery popover.
+- Make task completion status available via GraphQL.
 
 ### Other (62 changes, 14 of them are from the community)
 
@@ -1033,17 +1381,17 @@ entry.
 - Changed the 'Created' label to 'Last Updated' on the container registry table to more accurately reflect what the date represents. !29464
 - Update GitLab Pages to v1.6.1. !29559
 - Indent collapsible sections. !29804
-- Group download buttons into a .btn-group.
-- Change default color of award emoji button.
-- Use blue for activity stream links; use monospace font for commit sha.
-- Remove fixed height from MR diff headers.
-- Moves the table pagination shared component.
-- Add warning that gitlab-secrets isn't included in backup.
-- Update merge request tabs so they no longer scroll.
-- Reduce height of issue board input to align with buttons.
-- Increase height of move issue dropdown.
 - Use grid and correct border radius for status badge.
+- Remove fixed height from MR diff headers.
+- Use blue for activity stream links; use monospace font for commit sha.
 - Moves snowplow to CE repo.
+- Reduce height of issue board input to align with buttons.
+- Change default color of award emoji button.
+- Group download buttons into a .btn-group.
+- Add warning that gitlab-secrets isn't included in backup.
+- Increase height of move issue dropdown.
+- Update merge request tabs so they no longer scroll.
+- Moves the table pagination shared component.
 
 
 ## 11.11.8
@@ -1112,7 +1460,7 @@ entry.
 
 - Destroy project remote mirrors instead of disabling. !27087
 
-### Fixed (74 changes, 19 of them are from the community)
+### Fixed (75 changes, 19 of them are from the community)
 
 - Don't create a temp reference for branch comparisons within project. !24038
 - Fix some label links not appearing on group labels page and label title being a link on project labels page. !24060 (Tanya Pazitny)
@@ -1173,6 +1521,7 @@ entry.
 - Fix uploading of LFS tracked file through UI. !28052
 - Render Next badge only for gitlab.com. !28056
 - Fix update head pipeline process of Pipelines for merge requests. !28057
+- Handle errors in successful notes reply. !28082
 - Fix visual issues in set status modal. !28147
 - Use a path for the related merge requests endpoint. !28171
 - disable SSH key validation in key details view. !28180 (Roger Meier)
@@ -1183,10 +1532,10 @@ entry.
 - Fix project visibility level validation. !28305 (Peter Marko)
 - Fix incorrect prefix used in new uploads for personal snippets. !28337
 - Fix Rugged get_tree_entries recursive flag not working. !28494
-- Fixes next badge being always visible.
 - Next badge must visible when canary flag is true.
-- Adds arrow icons to select option in CI/CD settings.
 - Vertically aligns the play button for stages.
+- Fixes next badge being always visible.
+- Adds arrow icons to select option in CI/CD settings.
 - Allow replying to individual notes from API.
 
 ### Changed (19 changes, 3 of them are from the community)
@@ -1253,10 +1602,10 @@ entry.
 - Leave project/group from access granted email. !27892
 - Allow Sentry client-side DSN to be passed on gitlab.yml. !27967
 - GraphQL: improve evaluation of query complexity based on arguments and query limits. !28017
-- Adds badge for Canary environment and help link.
 - Support negative matches.
-- Show category icons in user popover.
 - Added Omniauth UltraAuth strategy to GitLab. (Kartikey Tanna)
+- Adds badge for Canary environment and help link.
+- Show category icons in user popover.
 
 ### Other (29 changes, 8 of them are from the community)
 
@@ -1286,9 +1635,22 @@ entry.
 - Remove the note in the docs that multi-line suggestions are not yet available. !28119 (hardysim)
 - Update gitlab-shell to v9.1.0. !28184
 - Add EE fixtures to SeedFu list. !28241
+- Add some frozen string to spec/**/*.rb. (gfyoung)
 - Replaces CSS with BS4 utility class for pipeline schedules.
 - Creates a vendors folder for external CSS.
-- Add some frozen string to spec/**/*.rb. (gfyoung)
+
+### Performance (1 change)
+
+- Add improvements to global search of issues and merge requests. !27817
+
+
+## 11.10.7 (2019-06-26)
+
+### Fixed (3 changes)
+
+- Remove a default git depth in Pipelines for merge requests. !28926
+- Fix label click scrolling to top. !29202
+- Fix scrolling to top on assignee change. !29500
 
 
 ## 11.10.8 (2019-06-27)
@@ -1328,7 +1690,6 @@ entry.
 
 - Fix input group height.
 
-
 ## 11.10.4 (2019-05-01)
 
 ### Fixed (12 changes)
@@ -1704,31 +2065,11 @@ entry.
 
 ## 11.9.3 (2019-03-27)
 
-### Security (8 changes)
-
-- Disallow guest users from accessing Releases.
-- Fix PDF.js vulnerability.
-- Hide "related branches" when user does not have permission.
-- Fix XSS in resolve conflicts form.
-- Added rake task for removing EXIF data from existing uploads.
-- Return cached languages if they've been detected before.
-- Disallow updating namespace when updating a project.
-- Use UntrustedRegexp for matching refs policy.
-
+- No changes.
 
 ## 11.9.2 (2019-03-26)
 
-### Security (8 changes)
-
-- Disallow guest users from accessing Releases.
-- Fix PDF.js vulnerability.
-- Hide "related branches" when user does not have permission.
-- Fix XSS in resolve conflicts form.
-- Added rake task for removing EXIF data from existing uploads.
-- Return cached languages if they've been detected before.
-- Disallow updating namespace when updating a project.
-- Use UntrustedRegexp for matching refs policy.
-
+- No changes.
 
 ## 11.9.1 (2019-03-25)
 
@@ -2343,16 +2684,7 @@ entry.
 
 ## 11.7.8 (2019-03-26)
 
-### Security (7 changes)
-
-- Disallow guest users from accessing Releases.
-- Fix PDF.js vulnerability.
-- Hide "related branches" when user does not have permission.
-- Fix XSS in resolve conflicts form.
-- Added rake task for removing EXIF data from existing uploads.
-- Disallow updating namespace when updating a project.
-- Use UntrustedRegexp for matching refs policy.
-
+- No changes.
 
 ## 11.7.7 (2019-03-19)
 
@@ -2362,7 +2694,7 @@ entry.
 - Fixed ability to see private groups by users not belonging to given group.
 
 
-## 11.7.5 (2019-02-06)
+## 11.7.5 (2019-02-05)
 
 ### Fixed (8 changes)
 
@@ -2601,10 +2933,9 @@ entry.
 
 ## 11.6.11 (2019-04-23)
 
-### Security (2 changes)
+### Security (1 change)
 
 - Fixed ability to see private groups by users not belonging to given group.
-- Fix XSS in resolve conflicts form.
 
 ### Fixed (2 changes)
 
@@ -2650,6 +2981,13 @@ entry.
 - Fix leaking private repository information in API.
 
 
+## 11.6.9 (2019-02-04)
+
+### Security (1 change)
+
+- Use sanitized user status message for user popover.
+
+
 ## 11.6.8 (2019-01-30)
 
 - No changes.
@@ -3174,7 +3512,6 @@ entry.
 - Fix a race condition intermittently breaking GitLab startup. !23028
 - Adds margin after a deleted branch name in the activity feed. !23038
 - Ignore environment validation failure. !23100
-- Fixes broken borders for reports section in MR widget.
 - Adds CI favicon back to jobs page.
 - Redirect to the pipeline builds page when a build is canceled. (Eva Kadlecova)
 - Fixed diff stats not showing when performance bar is enabled.
@@ -3183,12 +3520,13 @@ entry.
 - Fix bug causing not all emails to show up in commit email selectbox.
 - Remove duplicate escape in job sidebar.
 - Fixing styling issues on the scheduled pipelines page.
+- Fixes broken test in master.
 - Renders stuck block when runners are stuck.
 - Removes extra border from test reports in the merge request widget.
+- Fixes broken borders for reports section in MR widget.
 - Only render link to branch when branch still exists in pipeline page.
 - Fixed source project not filtering in merge request creation compare form.
 - Do not reload self on hooks when creating deployment.
-- Fixes broken test in master.
 
 ### Changed (38 changes, 12 of them are from the community)
 
@@ -9646,4 +9984,3 @@ entry.
 ## 8.15.8 through 0.8.0
 
 - See [changelogs/archive.md](changelogs/archive.md)
-

CONTRIBUTING.md

@@ -1,13 +1,9 @@
-## Developer Certificate of Origin + License
+## Contributor license agreement
 
-By contributing to GitLab B.V., You accept and agree to the following terms and
-conditions for Your present and future Contributions submitted to GitLab B.V.
-Except for the license granted herein to GitLab B.V. and recipients of software
-distributed by GitLab B.V., You reserve all right, title, and interest in and to
-Your Contributions. All Contributions are subject to the following DCO + License
-terms.
-
-[DCO + License](https://gitlab.com/gitlab-org/dco/blob/master/README.md)
+By submitting code as an individual you agree to the
+[individual contributor license agreement](doc/legal/individual_contributor_license_agreement.md).
+By submitting code as an entity you agree to the
+[corporate contributor license agreement](doc/legal/corporate_contributor_license_agreement.md).
 
 All Documentation content that resides under the [doc/ directory](/doc) of this
 repository is licensed under Creative Commons:

Dangerfile

@@ -1,23 +1,12 @@
 # frozen_string_literal: true
+
+require_relative 'lib/gitlab_danger'
+
 danger.import_plugin('danger/plugins/helper.rb')
 danger.import_plugin('danger/plugins/roulette.rb')
 
 unless helper.release_automation?
-  danger.import_dangerfile(path: 'danger/metadata')
-  danger.import_dangerfile(path: 'danger/changes_size')
-  danger.import_dangerfile(path: 'danger/changelog')
-  danger.import_dangerfile(path: 'danger/specs')
-  danger.import_dangerfile(path: 'danger/gemfile')
-  danger.import_dangerfile(path: 'danger/database')
-  danger.import_dangerfile(path: 'danger/documentation')
-  danger.import_dangerfile(path: 'danger/frozen_string')
-  danger.import_dangerfile(path: 'danger/commit_messages')
-  danger.import_dangerfile(path: 'danger/duplicate_yarn_dependencies')
-  danger.import_dangerfile(path: 'danger/prettier')
-  danger.import_dangerfile(path: 'danger/eslint')
-  danger.import_dangerfile(path: 'danger/roulette')
-  danger.import_dangerfile(path: 'danger/single_codebase')
-  danger.import_dangerfile(path: 'danger/gitlab_ui_wg')
-  danger.import_dangerfile(path: 'danger/ce_ee_vue_templates')
-  danger.import_dangerfile(path: 'danger/only_documentation')
+  GitlabDanger.new(helper.gitlab_helper).rule_names.each do |file|
+    danger.import_dangerfile(path: File.join('danger', file))
+  end
 end

GITALY_SERVER_VERSION

@@ -1 +1 @@
-1.59.3
+1.65.2

GITLAB_ELASTICSEARCH_INDEXER_VERSION

@@ -1 +1 @@
-1.2.0
+1.3.0

GITLAB_PAGES_VERSION

@@ -1 +1 @@
-1.7.2
+1.9.0

GITLAB_SHELL_VERSION

@@ -1 +1 @@
-9.3.0
+10.0.0

GITLAB_WORKHORSE_VERSION

@@ -1 +1 @@
-8.8.1
+8.10.1

Gemfile

@@ -48,6 +48,9 @@ gem 'omniauth-salesforce', '~> 1.0.5'
 gem 'rack-oauth2', '~> 1.9.3'
 gem 'jwt', '~> 2.1.0'
 
+# Kerberos authentication. EE-only
+gem 'gssapi', group: :kerberos
+
 # Spam and anti-bot protection
 gem 'recaptcha', '~> 4.11', require: 'recaptcha/rails'
 gem 'akismet', '~> 2.0'
@@ -83,7 +86,10 @@ gem 'grape-entity', '~> 0.7.1'
 gem 'rack-cors', '~> 1.0.0', require: 'rack/cors'
 
 # GraphQL API
-gem 'graphql', '~> 1.8.0'
+gem 'graphql', '~> 1.9.11'
+# NOTE: graphiql-rails v1.5+ doesn't work: https://gitlab.com/gitlab-org/gitlab-ce/issues/67293
+# TODO: remove app/views/graphiql/rails/editors/show.html.erb when https://github.com/rmosolgo/graphiql-rails/pull/71 is released:
+# https://gitlab.com/gitlab-org/gitlab-ce/issues/67263
 gem 'graphiql-rails', '~> 1.4.10'
 gem 'apollo_upload_server', '~> 2.0.0.beta3'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]
@@ -106,7 +112,7 @@ gem 'fog-aws', '~> 3.5'
 # Locked until fog-google resolves https://github.com/fog/fog-google/issues/421.
 # Also see config/initializers/fog_core_patch.rb.
 gem 'fog-core', '= 2.1.0'
-gem 'fog-google', '~> 1.8'
+gem 'fog-google', '~> 1.9'
 gem 'fog-local', '~> 0.6'
 gem 'fog-openstack', '~> 1.0'
 gem 'fog-rackspace', '~> 0.1.1'
@@ -121,6 +127,13 @@ gem 'unf', '~> 0.1.4'
 # Seed data
 gem 'seed-fu', '~> 2.3.7'
 
+# Search
+gem 'elasticsearch-model', '~> 0.1.9'
+gem 'elasticsearch-rails', '~> 0.1.9', require: 'elasticsearch/rails/instrumentation'
+gem 'elasticsearch-api',   '5.0.3'
+gem 'aws-sdk'
+gem 'faraday_middleware-aws-signers-v4'
+
 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.8'
 gem 'deckar01-task_list', '2.2.0'
@@ -171,7 +184,7 @@ gem 'acts-as-taggable-on', '~> 6.0'
 gem 'sidekiq', '~> 5.2.7'
 gem 'sidekiq-cron', '~> 1.0'
 gem 'redis-namespace', '~> 1.6.0'
-gem 'gitlab-sidekiq-fetcher', '0.5.1', require: 'sidekiq-reliable-fetch'
+gem 'gitlab-sidekiq-fetcher', '0.5.2', require: 'sidekiq-reliable-fetch'
 
 # Cron Parser
 gem 'fugit', '~> 1.2.1'
@@ -215,7 +228,8 @@ gem 'discordrb-webhooks-blackst0ne', '~> 3.3', require: false
 gem 'hipchat', '~> 1.5.0'
 
 # Jira integration
-gem 'jira-ruby', '~> 1.4'
+gem 'jira-ruby', '~> 1.7'
+gem 'atlassian-jwt', '~> 0.2.0'
 
 # Flowdock integration
 gem 'flowdock', '~> 0.7'
@@ -233,7 +247,7 @@ gem 'asana', '~> 0.8.1'
 gem 'ruby-fogbugz', '~> 0.2.1'
 
 # Kubernetes integration
-gem 'kubeclient', '~> 4.2.2'
+gem 'kubeclient', '~> 4.4.0'
 
 # Sanitize user input
 gem 'sanitize', '~> 4.6'
@@ -262,7 +276,7 @@ gem 'fast_blank'
 
 # Parse time & duration
 gem 'chronic', '~> 0.10.2'
-gem 'chronic_duration', '~> 0.10.6'
+gem 'gitlab_chronic_duration', '~> 0.10.6.1'
 
 gem 'webpack-rails', '~> 0.9.10'
 gem 'rack-proxy', '~> 0.6.0'
@@ -275,16 +289,17 @@ gem 'font-awesome-rails', '~> 4.7'
 gem 'gemojione', '~> 3.3'
 gem 'gon', '~> 6.2'
 gem 'request_store', '~> 1.3'
-gem 'virtus', '~> 1.0.1'
 gem 'base32', '~> 0.3.0'
 
+gem "gitlab-license", "~> 1.0"
+
 # Sentry integration
 gem 'sentry-raven', '~> 2.9'
 
 gem 'premailer-rails', '~> 1.9.7'
 
 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.4.2'
+gem 'gitlab-labkit', '~> 0.5'
 
 # I18n
 gem 'ruby_parser', '~> 3.8', require: false
@@ -296,7 +311,8 @@ gem 'gettext', '~> 3.2.2', require: false, group: :development
 gem 'batch-loader', '~> 1.4.0'
 
 # Perf bar
-gem 'peek', '~> 1.0.1'
+# https://gitlab.com/gitlab-org/gitlab-ee/issues/13996
+gem 'gitlab-peek', '~> 0.0.1', require: 'peek'
 
 # Snowplow events tracking
 gem 'snowplow-tracker', '~> 0.6.1'
@@ -310,13 +326,14 @@ group :metrics do
   gem 'influxdb', '~> 0.2', require: false
 
   # Prometheus
-  gem 'prometheus-client-mmap', '~> 0.9.8'
+  gem 'prometheus-client-mmap', '~> 0.9.10'
   gem 'raindrops', '~> 0.18'
 end
 
 group :development do
   gem 'foreman', '~> 0.84.0'
   gem 'brakeman', '~> 4.2', require: false
+  gem 'danger', '~> 6.0', require: false
 
   gem 'letter_opener_web', '~> 1.3.4'
   gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false
@@ -368,15 +385,12 @@ group :development, :test do
   gem 'haml_lint', '~> 0.31.0', require: false
   gem 'simplecov', '~> 0.16.1', require: false
   gem 'bundler-audit', '~> 0.5.0', require: false
-  gem 'mdl', '~> 0.5.0', require: false
 
   gem 'benchmark-ips', '~> 2.3.0', require: false
 
   gem 'license_finder', '~> 5.4', require: false
   gem 'knapsack', '~> 1.17'
 
-  gem 'activerecord_sane_schema_dumper', '1.0'
-
   gem 'stackprof', '~> 0.2.10', require: false
 
   gem 'simple_po_parser', '~> 1.1.2', require: false
@@ -402,7 +416,7 @@ gem 'mail_room', '~> 0.9.1'
 gem 'email_reply_trimmer', '~> 0.1'
 gem 'html2text'
 
-gem 'ruby-prof', '~> 0.17.0'
+gem 'ruby-prof', '~> 1.0.0'
 gem 'rbtrace', '~> 0.4', require: false
 gem 'memory_profiler', '~> 0.9', require: false
 gem 'benchmark-memory', '~> 0.1', require: false
@@ -418,6 +432,9 @@ gem 'health_check', '~> 2.6.0'
 gem 'vmstat', '~> 2.3.0'
 gem 'sys-filesystem', '~> 1.1.6'
 
+# NTP client
+gem 'net-ntp'
+
 # SSH host key support
 gem 'net-ssh', '~> 5.2'
 gem 'sshkey', '~> 2.0'
@@ -441,7 +458,14 @@ gem 'toml-rb', '~> 1.0.0', require: false
 gem 'flipper', '~> 0.13.0'
 gem 'flipper-active_record', '~> 0.13.0'
 gem 'flipper-active_support_cache_store', '~> 0.13.0'
+gem 'unleash', '~> 0.1.5'
 
 # Structured logging
 gem 'lograge', '~> 0.5'
 gem 'grape_logging', '~> 1.7'
+
+# DNS Lookup
+gem 'net-dns', '~> 0.9.0'
+
+# Countries list
+gem 'countries', '~> 3.0'

Gemfile.lock

@@ -41,8 +41,6 @@ GEM
     activerecord-explain-analyze (0.1.0)
       activerecord (>= 4)
       pg
-    activerecord_sane_schema_dumper (1.0)
-      rails (>= 5, < 6)
     activestorage (5.2.3)
       actionpack (= 5.2.3)
       activerecord (= 5.2.3)
@@ -76,10 +74,20 @@ GEM
     asciidoctor-plantuml (0.0.9)
       asciidoctor (>= 1.5.6, < 3.0.0)
     ast (2.4.0)
+    atlassian-jwt (0.2.0)
+      jwt (~> 2.1.0)
     attr_encrypted (3.1.0)
       encryptor (~> 3.0.0)
     attr_required (1.0.1)
     awesome_print (1.8.0)
+    aws-sdk (2.9.32)
+      aws-sdk-resources (= 2.9.32)
+    aws-sdk-core (2.9.32)
+      aws-sigv4 (~> 1.0)
+      jmespath (~> 1.0)
+    aws-sdk-resources (2.9.32)
+      aws-sdk-core (= 2.9.32)
+    aws-sigv4 (1.0.0)
     axiom-types (0.1.1)
       descendants_tracker (~> 0.0.4)
       ice_nine (~> 0.11.0)
@@ -136,23 +144,31 @@ GEM
     childprocess (0.9.0)
       ffi (~> 1.0, >= 1.0.11)
     chronic (0.10.2)
-    chronic_duration (0.10.6)
-      numerizer (~> 0.1.1)
     chunky_png (1.3.5)
     citrus (3.0.2)
+    claide (1.0.3)
+    claide-plugins (0.9.2)
+      cork
+      nap
+      open4 (~> 1.3)
     coderay (1.1.2)
     coercible (1.0.0)
       descendants_tracker (~> 0.0.1)
+    colored2 (3.1.2)
     commonmarker (0.17.13)
       ruby-enum (~> 0.5)
     concord (0.1.5)
       adamantium (~> 0.2.0)
       equalizer (~> 0.0.9)
     concurrent-ruby (1.1.5)
-    concurrent-ruby-ext (1.1.5)
-      concurrent-ruby (= 1.1.5)
     connection_pool (2.2.2)
     contracts (0.11.0)
+    cork (0.3.0)
+      colored2 (~> 3.1)
+    countries (3.0.0)
+      i18n_data (~> 0.8.0)
+      sixarm_ruby_unaccent (~> 1.1)
+      unicode_utils (~> 1.4)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
     crass (1.0.4)
@@ -160,6 +176,19 @@ GEM
     css_parser (1.5.0)
       addressable
     daemons (1.2.6)
+    danger (6.0.9)
+      claide (~> 1.0)
+      claide-plugins (>= 0.9.2)
+      colored2 (~> 3.1)
+      cork (~> 0.1)
+      faraday (~> 0.9)
+      faraday-http-cache (~> 2.0)
+      git (~> 1.5)
+      kramdown (~> 2.0)
+      kramdown-parser-gfm (~> 1.0)
+      no_proxy_fix
+      octokit (~> 4.7)
+      terminal-table (~> 1)
     database_cleaner (1.7.0)
     debug_inspector (0.0.3)
     debugger-ruby_core_source (1.3.8)
@@ -205,6 +234,19 @@ GEM
       doorkeeper (~> 4.3)
       json-jwt (~> 1.6)
     ed25519 (1.2.4)
+    elasticsearch (5.0.3)
+      elasticsearch-api (= 5.0.3)
+      elasticsearch-transport (= 5.0.3)
+    elasticsearch-api (5.0.3)
+      multi_json
+    elasticsearch-model (0.1.9)
+      activesupport (> 3)
+      elasticsearch (> 0.4)
+      hashie
+    elasticsearch-rails (0.1.9)
+    elasticsearch-transport (5.0.3)
+      faraday
+      multi_json
     email_reply_trimmer (0.1.6)
     email_spec (2.2.0)
       htmlentities (~> 4.3.3)
@@ -229,8 +271,13 @@ GEM
       railties (>= 3.0.0)
     faraday (0.12.2)
       multipart-post (>= 1.2, < 3)
+    faraday-http-cache (2.0.0)
+      faraday (~> 0.8)
     faraday_middleware (0.12.2)
       faraday (>= 0.7.4, < 1.0)
+    faraday_middleware-aws-signers-v4 (0.1.7)
+      aws-sdk-resources (~> 2)
+      faraday (~> 0.9)
     faraday_middleware-multi_json (0.0.6)
       faraday_middleware
       multi_json
@@ -263,7 +310,7 @@ GEM
       excon (~> 0.58)
       formatador (~> 0.2)
       mime-types
-    fog-google (1.8.2)
+    fog-google (1.9.1)
       fog-core (<= 2.1.0)
       fog-json (~> 1.2)
       fog-xml (~> 0.1.0)
@@ -310,23 +357,30 @@ GEM
       gettext_i18n_rails (>= 0.7.1)
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
+    git (1.5.0)
     gitaly (1.58.0)
       grpc (~> 1.0)
     github-markup (1.7.0)
-    gitlab-labkit (0.4.2)
+    gitlab-labkit (0.5.2)
       actionpack (~> 5)
       activesupport (~> 5)
       grpc (~> 1.19)
       jaeger-client (~> 0.10)
       opentracing (~> 0.4)
+      redis (> 3.0.0, < 5.0.0)
+    gitlab-license (1.0.0)
     gitlab-markup (1.7.0)
-    gitlab-sidekiq-fetcher (0.5.1)
+    gitlab-peek (0.0.1)
+      railties (>= 4.0.0)
+    gitlab-sidekiq-fetcher (0.5.2)
       sidekiq (~> 5)
     gitlab-styles (2.8.0)
       rubocop (~> 0.69.0)
       rubocop-gitlab-security (~> 0.1.0)
       rubocop-performance (~> 1.1.0)
       rubocop-rspec (~> 1.19)
+    gitlab_chronic_duration (0.10.6.1)
+      numerizer (~> 0.1.1)
     gitlab_omniauth-ldap (2.1.1)
       net-ldap (~> 0.16)
       omniauth (~> 1.3)
@@ -376,7 +430,7 @@ GEM
     graphiql-rails (1.4.10)
       railties
       sprockets-rails
-    graphql (1.8.1)
+    graphql (1.9.11)
     graphql-docs (1.6.0)
       commonmarker (~> 0.16)
       escape_utils (~> 1.2)
@@ -388,6 +442,8 @@ GEM
     grpc (1.19.0)
       google-protobuf (~> 3.1)
       googleapis-common-protos-types (~> 1.0.0)
+    gssapi (1.2.0)
+      ffi (>= 1.0.1)
     haml (5.0.4)
       temple (>= 0.8.0)
       tilt
@@ -433,6 +489,7 @@ GEM
     httpclient (2.8.3)
     i18n (1.6.0)
       concurrent-ruby (~> 1.0)
+    i18n_data (0.8.0)
     icalendar (2.4.1)
     ice_nine (0.11.2)
     influxdb (0.2.3)
@@ -445,10 +502,12 @@ GEM
       opentracing (~> 0.3)
       thrift
     jaro_winkler (1.5.3)
-    jira-ruby (1.4.1)
+    jira-ruby (1.7.1)
       activesupport
+      atlassian-jwt
       multipart-post
       oauth (~> 0.5, >= 0.5.0)
+    jmespath (1.3.1)
     js_regex (3.1.1)
       character_set (~> 1.1)
       regexp_parser (~> 1.1)
@@ -476,8 +535,10 @@ GEM
     kgio (2.11.2)
     knapsack (1.17.0)
       rake
-    kramdown (1.17.0)
-    kubeclient (4.2.2)
+    kramdown (2.1.0)
+    kramdown-parser-gfm (1.1.0)
+      kramdown (~> 2.0)
+    kubeclient (4.4.0)
       http (~> 3.0)
       recursive-open-struct (~> 1.0, >= 1.0.4)
       rest-client (~> 2.0)
@@ -512,10 +573,6 @@ GEM
     mail_room (0.9.1)
     marcel (0.3.3)
       mimemagic (~> 0.3.2)
-    mdl (0.5.0)
-      kramdown (~> 1.12, >= 1.12.0)
-      mixlib-cli (~> 1.7, >= 1.7.0)
-      mixlib-config (~> 2.2, >= 2.2.1)
     memoist (0.16.0)
     memoizable (0.4.2)
       thread_safe (~> 0.3, >= 0.3.1)
@@ -529,21 +586,23 @@ GEM
     mini_mime (1.0.1)
     mini_portile2 (2.4.0)
     minitest (5.11.3)
-    mixlib-cli (1.7.0)
-    mixlib-config (2.2.18)
-      tomlrb
     msgpack (1.3.0)
     multi_json (1.13.1)
     multi_xml (0.6.0)
     multipart-post (2.0.0)
+    murmurhash3 (0.1.6)
     mustermann (1.0.3)
     mustermann-grape (1.0.0)
       mustermann (~> 1.0.0)
     nakayoshi_fork (0.0.4)
+    nap (1.1.0)
+    net-dns (0.9.0)
     net-ldap (0.16.0)
+    net-ntp (2.1.3)
     net-ssh (5.2.0)
     netrc (0.11.0)
     nio4r (2.3.1)
+    no_proxy_fix (0.1.2)
     nokogiri (1.10.4)
       mini_portile2 (~> 2.4.0)
     nokogumbo (1.5.0)
@@ -620,6 +679,7 @@ GEM
       addressable (~> 2.5)
       omniauth (~> 1.3)
       openid_connect (~> 1.1)
+    open4 (1.3.4)
     openid_connect (1.1.6)
       activemodel
       attr_required (>= 1.0.0)
@@ -640,10 +700,6 @@ GEM
     parser (2.6.3.0)
       ast (~> 2.4.0)
     parslet (1.8.2)
-    peek (1.0.1)
-      concurrent-ruby (>= 0.9.0)
-      concurrent-ruby-ext (>= 0.9.0)
-      railties (>= 4.0.0)
     pg (1.1.4)
     po_to_json (1.0.1)
       json (>= 1.6.0)
@@ -659,7 +715,7 @@ GEM
       parser
       unparser
     procto (0.0.3)
-    prometheus-client-mmap (0.9.8)
+    prometheus-client-mmap (0.9.10)
     pry (0.11.3)
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
@@ -714,7 +770,7 @@ GEM
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.0.4)
+    rails-html-sanitizer (1.2.0)
       loofah (~> 2.2, >= 2.2.2)
     rails-i18n (5.1.1)
       i18n (>= 0.7, < 2)
@@ -837,7 +893,7 @@ GEM
       i18n
     ruby-fogbugz (0.2.1)
       crack (~> 0.4)
-    ruby-prof (0.17.0)
+    ruby-prof (1.0.0)
     ruby-progressbar (1.10.1)
     ruby-saml (1.7.2)
       nokogiri (>= 1.5.10)
@@ -903,6 +959,7 @@ GEM
       json (>= 1.8, < 3)
       simplecov-html (~> 0.10.0)
     simplecov-html (0.10.2)
+    sixarm_ruby_unaccent (1.2.0)
     slack-notifier (1.5.1)
     snowplow-tracker (0.6.1)
       contracts (~> 0.7, <= 0.11)
@@ -934,7 +991,9 @@ GEM
     sys-filesystem (1.1.6)
       ffi
     sysexits (1.2.0)
-    temple (0.8.0)
+    temple (0.8.1)
+    terminal-table (1.8.0)
+      unicode-display_width (~> 1.1, >= 1.1.1)
     test-prof (0.2.5)
     text (1.3.1)
     thin (1.7.2)
@@ -944,14 +1003,13 @@ GEM
     thor (0.19.4)
     thread_safe (0.3.6)
     thrift (0.11.0.0)
-    tilt (2.0.8)
+    tilt (2.0.9)
     timecop (0.8.1)
     timfel-krb5-auth (0.8.3)
     toml (0.2.0)
       parslet (~> 1.8.0)
     toml-rb (1.0.0)
       citrus (~> 3.0, > 3.0)
-    tomlrb (1.2.8)
     truncato (0.7.11)
       htmlentities (~> 4.3.1)
       nokogiri (>= 1.7.0, <= 2.0)
@@ -966,6 +1024,7 @@ GEM
       unf_ext
     unf_ext (0.0.7.5)
     unicode-display_width (1.6.0)
+    unicode_utils (1.4.0)
     unicorn (5.4.1)
       kgio (~> 2.6)
       raindrops (~> 0.7)
@@ -973,6 +1032,8 @@ GEM
       get_process_mem (~> 0)
       unicorn (>= 4, < 6)
     uniform_notifier (1.10.0)
+    unleash (0.1.5)
+      murmurhash3 (~> 0.1.6)
     unparser (0.4.5)
       abstract_type (~> 0.0.7)
       adamantium (~> 0.2.0)
@@ -1028,7 +1089,6 @@ DEPENDENCIES
   ace-rails-ap (~> 4.1.0)
   acme-client (~> 2.0.2)
   activerecord-explain-analyze (~> 0.1)
-  activerecord_sane_schema_dumper (= 1.0)
   acts-as-taggable-on (~> 6.0)
   addressable (~> 2.5.2)
   akismet (~> 2.0)
@@ -1037,8 +1097,10 @@ DEPENDENCIES
   asciidoctor (~> 2.0.10)
   asciidoctor-include-ext (~> 0.3.1)
   asciidoctor-plantuml (= 0.0.9)
+  atlassian-jwt (~> 0.2.0)
   attr_encrypted (~> 3.1.0)
   awesome_print
+  aws-sdk
   babosa (~> 1.0.2)
   base32 (~> 0.3.0)
   batch-loader (~> 1.4.0)
@@ -1058,11 +1120,12 @@ DEPENDENCIES
   carrierwave (~> 1.3)
   charlock_holmes (~> 0.7.5)
   chronic (~> 0.10.2)
-  chronic_duration (~> 0.10.6)
   commonmarker (~> 0.17)
   concurrent-ruby (~> 1.1)
   connection_pool (~> 2.0)
+  countries (~> 3.0)
   creole (~> 0.5.0)
+  danger (~> 6.0)
   database_cleaner (~> 1.7.0)
   deckar01-task_list (= 2.2.0)
   default_value_for (~> 3.2.0)
@@ -1075,11 +1138,15 @@ DEPENDENCIES
   doorkeeper (~> 4.3)
   doorkeeper-openid_connect (~> 1.5)
   ed25519 (~> 1.2)
+  elasticsearch-api (= 5.0.3)
+  elasticsearch-model (~> 0.1.9)
+  elasticsearch-rails (~> 0.1.9)
   email_reply_trimmer (~> 0.1)
   email_spec (~> 2.2.0)
   escape_utils (~> 1.1)
   factory_bot_rails (~> 4.8.2)
   faraday (~> 0.12)
+  faraday_middleware-aws-signers-v4
   fast_blank
   ffaker (~> 2.10)
   flipper (~> 0.13.0)
@@ -1089,7 +1156,7 @@ DEPENDENCIES
   fog-aliyun (~> 0.3)
   fog-aws (~> 3.5)
   fog-core (= 2.1.0)
-  fog-google (~> 1.8)
+  fog-google (~> 1.9)
   fog-local (~> 0.6)
   fog-openstack (~> 1.0)
   fog-rackspace (~> 0.1.1)
@@ -1103,10 +1170,13 @@ DEPENDENCIES
   gettext_i18n_rails_js (~> 1.3)
   gitaly (~> 1.58.0)
   github-markup (~> 1.7.0)
-  gitlab-labkit (~> 0.4.2)
+  gitlab-labkit (~> 0.5)
+  gitlab-license (~> 1.0)
   gitlab-markup (~> 1.7.0)
-  gitlab-sidekiq-fetcher (= 0.5.1)
+  gitlab-peek (~> 0.0.1)
+  gitlab-sidekiq-fetcher (= 0.5.2)
   gitlab-styles (~> 2.7)
+  gitlab_chronic_duration (~> 0.10.6.1)
   gitlab_omniauth-ldap (~> 2.1.1)
   gon (~> 6.2)
   google-api-client (~> 0.23)
@@ -1117,9 +1187,10 @@ DEPENDENCIES
   grape-path-helpers (~> 1.1)
   grape_logging (~> 1.7)
   graphiql-rails (~> 1.4.10)
-  graphql (~> 1.8.0)
+  graphql (~> 1.9.11)
   graphql-docs (~> 1.6.0)
   grpc (~> 1.19.0)
+  gssapi
   haml_lint (~> 0.31.0)
   hamlit (~> 2.8.8)
   hangouts-chat (~> 0.0.5)
@@ -1132,27 +1203,28 @@ DEPENDENCIES
   icalendar
   influxdb (~> 0.2)
   invisible_captcha (~> 0.12.1)
-  jira-ruby (~> 1.4)
+  jira-ruby (~> 1.7)
   js_regex (~> 3.1)
   json-schema (~> 2.8.0)
   jwt (~> 2.1.0)
   kaminari (~> 1.0)
   knapsack (~> 1.17)
-  kubeclient (~> 4.2.2)
+  kubeclient (~> 4.4.0)
   letter_opener_web (~> 1.3.4)
   license_finder (~> 5.4)
   licensee (~> 8.9)
   lograge (~> 0.5)
   loofah (~> 2.2)
   mail_room (~> 0.9.1)
-  mdl (~> 0.5.0)
   memory_profiler (~> 0.9)
   method_source (~> 0.8)
   mimemagic (~> 0.3.2)
   mini_magick
   minitest (~> 5.11.0)
   nakayoshi_fork (~> 0.0.4)
+  net-dns (~> 0.9.0)
   net-ldap
+  net-ntp
   net-ssh (~> 5.2)
   nokogiri (~> 1.10.4)
   oauth2 (~> 1.4)
@@ -1176,10 +1248,9 @@ DEPENDENCIES
   omniauth_crowd (~> 2.2.0)
   omniauth_openid_connect (~> 0.3.1)
   org-ruby (~> 0.9.12)
-  peek (~> 1.0.1)
   pg (~> 1.1)
   premailer-rails (~> 1.9.7)
-  prometheus-client-mmap (~> 0.9.8)
+  prometheus-client-mmap (~> 0.9.10)
   pry-byebug (~> 3.5.1)
   pry-rails (~> 0.3.4)
   puma (~> 3.12)
@@ -1217,7 +1288,7 @@ DEPENDENCIES
   rubocop-performance (~> 1.1.0)
   rubocop-rspec (~> 1.22.1)
   ruby-fogbugz (~> 0.2.1)
-  ruby-prof (~> 0.17.0)
+  ruby-prof (~> 1.0.0)
   ruby-progressbar
   ruby_parser (~> 3.8)
   rubyzip (~> 1.2.2)
@@ -1253,9 +1324,9 @@ DEPENDENCIES
   unf (~> 0.1.4)
   unicorn (~> 5.4.1)
   unicorn-worker-killer (~> 0.4.4)
+  unleash (~> 0.1.5)
   validates_hostname (~> 1.0.6)
   version_sorter (~> 2.2.4)
-  virtus (~> 1.0.1)
   vmstat (~> 2.3.0)
   webmock (~> 3.5.1)
   webpack-rails (~> 0.9.10)

PHILOSOPHY.md

@@ -1 +1,4 @@
-This document is intended to communicate the product philosophy GitLab uses in creating GitLab Community Edition. The principles can be found in the [Product Section of the GitLab Handbook](https://about.gitlab.com/handbook/product/#product-at-gitlab).
+To learn about the product philosophy GitLab the company uses in creating GitLab
+the product, visit our [Product Handbook page].
+
+[Product Handbook page]: https://about.gitlab.com/handbook/product/#product-at-gitlab

PROCESS.md

@@ -267,9 +267,7 @@ The two scenarios below can [bypass the exception request in the release process
 When a bug is found:
 1. Create an issue describing the problem in the most detailed way possible.
 1. If possible, provide links to real examples and how to reproduce the problem.
-1. Label the issue properly, using the [team label](https://docs.gitlab.com/ee/development/contributing/issue_workflow.html#team-labels),
-   the [subject label](https://docs.gitlab.com/ee/development/contributing/issue_workflow.html#subject-labels)
-   and any other label that may apply in the specific case
+1. Label the issue properly, by respecting the [Partial triage level](https://about.gitlab.com/handbook/engineering/issue-triage/#partial-triage).
 1. Notify the respective Engineering Manager to evaluate and apply the [Severity label](https://docs.gitlab.com/ee/development/contributing/issue_workflow.html#severity-labels) and [Priority label](https://docs.gitlab.com/ee/development/contributing/issue_workflow.html#priority-labels).
 The counterpart Product Manager is included to weigh-in on prioritization as needed.
 1. If the ~bug is **NOT** a regression:

README.md

@@ -1,14 +1,15 @@
 # GitLab
 
-## Test coverage
-
-- [![Ruby coverage](https://gitlab.com/gitlab-org/gitlab-ce/badges/master/coverage.svg?job=coverage)](https://gitlab-org.gitlab.io/gitlab-ce/coverage-ruby) Ruby
-- [![JavaScript coverage](https://gitlab.com/gitlab-org/gitlab-ce/badges/master/coverage.svg?job=karma)](https://gitlab-org.gitlab.io/gitlab-ce/coverage-javascript) JavaScript
-
 ## Canonical source
 
 The canonical source of GitLab Community Edition is [hosted on GitLab.com](https://gitlab.com/gitlab-org/gitlab-ce/).
 
+The source of GitLab Enterprise Edition is [hosted on GitLab.com](https://gitlab.com/gitlab-org/gitlab-ee).
+
+## Free trial
+
+You can request a free trial of GitLab Ultimate [on our website](https://about.gitlab.com/free-trial/).
+
 ## Open source software to collaborate on code
 
 To see how GitLab looks please see the [features page on our website](https://about.gitlab.com/features/).
@@ -103,7 +104,7 @@ For upgrading information please see our [update page](https://about.gitlab.com/
 
 ## Documentation
 
-All documentation can be found on [docs.gitlab.com/ce/](https://docs.gitlab.com/ce/).
+All documentation can be found on <https://docs.gitlab.com>.
 
 ## Getting help
 

VERSION

@@ -1 +1 @@
-12.2.9
+12.3.8

app/assets/javascripts/admin/statistics_panel/components/app.vue

@@ -0,0 +1,45 @@
+<script>
+import { mapState, mapGetters, mapActions } from 'vuex';
+import { GlLoadingIcon } from '@gitlab/ui';
+import statisticsLabels from '../constants';
+
+export default {
+  components: {
+    GlLoadingIcon,
+  },
+  data() {
+    return {
+      statisticsLabels,
+    };
+  },
+  computed: {
+    ...mapState(['isLoading', 'statistics']),
+    ...mapGetters(['getStatistics']),
+  },
+  mounted() {
+    this.fetchStatistics();
+  },
+  methods: {
+    ...mapActions(['fetchStatistics']),
+  },
+};
+</script>
+
+<template>
+  <div class="info-well">
+    <div class="well-segment admin-well admin-well-statistics">
+      <h4>{{ __('Statistics') }}</h4>
+      <gl-loading-icon v-if="isLoading" size="md" class="my-3" />
+      <template v-else>
+        <p
+          v-for="statistic in getStatistics(statisticsLabels)"
+          :key="statistic.key"
+          class="js-stats"
+        >
+          {{ statistic.label }}
+          <span class="light float-right">{{ statistic.value }}</span>
+        </p>
+      </template>
+    </div>
+  </div>
+</template>

app/assets/javascripts/admin/statistics_panel/constants.js

@@ -0,0 +1,14 @@
+import { s__ } from '~/locale';
+
+const statisticsLabels = {
+  forks: s__('AdminStatistics|Forks'),
+  issues: s__('AdminStatistics|Issues'),
+  mergeRequests: s__('AdminStatistics|Merge Requests'),
+  notes: s__('AdminStatistics|Notes'),
+  snippets: s__('AdminStatistics|Snippets'),
+  sshKeys: s__('AdminStatistics|SSH Keys'),
+  milestones: s__('AdminStatistics|Milestones'),
+  activeUsers: s__('AdminStatistics|Active Users'),
+};
+
+export default statisticsLabels;

app/assets/javascripts/admin/statistics_panel/index.js

@@ -0,0 +1,22 @@
+import Vue from 'vue';
+import StatisticsPanelApp from './components/app.vue';
+import createStore from './store';
+
+export default function(el) {
+  if (!el) {
+    return false;
+  }
+
+  const store = createStore();
+
+  return new Vue({
+    el,
+    store,
+    components: {
+      StatisticsPanelApp,
+    },
+    render(h) {
+      return h(StatisticsPanelApp);
+    },
+  });
+}

app/assets/javascripts/admin/statistics_panel/store/actions.js

@@ -0,0 +1,28 @@
+import Api from '~/api';
+import { s__ } from '~/locale';
+import createFlash from '~/flash';
+import { convertObjectPropsToCamelCase } from '~/lib/utils/common_utils';
+import * as types from './mutation_types';
+
+export const requestStatistics = ({ commit }) => commit(types.REQUEST_STATISTICS);
+
+export const fetchStatistics = ({ dispatch }) => {
+  dispatch('requestStatistics');
+
+  Api.adminStatistics()
+    .then(({ data }) => {
+      dispatch('receiveStatisticsSuccess', convertObjectPropsToCamelCase(data, { deep: true }));
+    })
+    .catch(error => dispatch('receiveStatisticsError', error));
+};
+
+export const receiveStatisticsSuccess = ({ commit }, statistics) =>
+  commit(types.RECEIVE_STATISTICS_SUCCESS, statistics);
+
+export const receiveStatisticsError = ({ commit }, error) => {
+  commit(types.RECEIVE_STATISTICS_ERROR, error);
+  createFlash(s__('AdminDashboard|Error loading the statistics. Please try again'));
+};
+
+// prevent babel-plugin-rewire from generating an invalid default during karma tests
+export default () => {};

app/assets/javascripts/admin/statistics_panel/store/getters.js

@@ -0,0 +1,17 @@
+/**
+ * Merges the statisticsLabels with the state's data
+ * and returns an array of the following form:
+ * [{ key: "forks", label: "Forks", value: 50 }]
+ */
+export const getStatistics = state => labels =>
+  Object.keys(labels).map(key => {
+    const result = {
+      key,
+      label: labels[key],
+      value: state.statistics && state.statistics[key] ? state.statistics[key] : null,
+    };
+    return result;
+  });
+
+// prevent babel-plugin-rewire from generating an invalid default during karma tests
+export default () => {};

app/assets/javascripts/admin/statistics_panel/store/index.js

@@ -0,0 +1,16 @@
+import Vue from 'vue';
+import Vuex from 'vuex';
+import * as actions from './actions';
+import * as getters from './getters';
+import mutations from './mutations';
+import state from './state';
+
+Vue.use(Vuex);
+
+export default () =>
+  new Vuex.Store({
+    actions,
+    getters,
+    mutations,
+    state: state(),
+  });

app/assets/javascripts/admin/statistics_panel/store/mutation_types.js

@@ -0,0 +1,3 @@
+export const REQUEST_STATISTICS = 'REQUEST_STATISTICS';
+export const RECEIVE_STATISTICS_SUCCESS = 'RECEIVE_STATISTICS_SUCCESS';
+export const RECEIVE_STATISTICS_ERROR = 'RECEIVE_STATISTICS_ERROR';

app/assets/javascripts/admin/statistics_panel/store/mutations.js

@@ -0,0 +1,16 @@
+import * as types from './mutation_types';
+
+export default {
+  [types.REQUEST_STATISTICS](state) {
+    state.isLoading = true;
+  },
+  [types.RECEIVE_STATISTICS_SUCCESS](state, data) {
+    state.isLoading = false;
+    state.error = null;
+    state.statistics = data;
+  },
+  [types.RECEIVE_STATISTICS_ERROR](state, error) {
+    state.isLoading = false;
+    state.error = error;
+  },
+};

app/assets/javascripts/admin/statistics_panel/store/state.js

@@ -0,0 +1,5 @@
+export default () => ({
+  error: null,
+  isLoading: false,
+  statistics: null,
+});

app/assets/javascripts/analytics/cycle_analytics/mixins/add_stage_mixin.js

@@ -0,0 +1,11 @@
+export default {
+  data() {
+    return {
+      isCustomStageForm: false,
+    };
+  },
+  methods: {
+    showAddStageForm: () => {},
+    hideAddStageForm: () => {},
+  },
+};

app/assets/javascripts/api.js

@@ -14,6 +14,7 @@ const Api = {
   projectPath: '/api/:version/projects/:id',
   forkedProjectsPath: '/api/:version/projects/:id/forks',
   projectLabelsPath: '/:namespace_path/:project_path/-/labels',
+  projectUsersPath: '/api/:version/projects/:id/users',
   projectMergeRequestsPath: '/api/:version/projects/:id/merge_requests',
   projectMergeRequestPath: '/api/:version/projects/:id/merge_requests/:mrid',
   projectMergeRequestChangesPath: '/api/:version/projects/:id/merge_requests/:mrid/changes',
@@ -35,6 +36,8 @@ const Api = {
   branchSinglePath: '/api/:version/projects/:id/repository/branches/:branch',
   createBranchPath: '/api/:version/projects/:id/repository/branches',
   releasesPath: '/api/:version/projects/:id/releases',
+  mergeRequestsPipeline: '/api/:version/projects/:id/merge_requests/:merge_request_iid/pipelines',
+  adminStatisticsPath: 'api/:version/application/statistics',
 
   group(groupId, callback) {
     const url = Api.buildUrl(Api.groupPath).replace(':id', groupId);
@@ -108,6 +111,20 @@ const Api = {
       });
   },
 
+  projectUsers(projectPath, query = '', options = {}) {
+    const url = Api.buildUrl(this.projectUsersPath).replace(':id', encodeURIComponent(projectPath));
+
+    return axios
+      .get(url, {
+        params: {
+          search: query,
+          per_page: 20,
+          ...options,
+        },
+      })
+      .then(({ data }) => data);
+  },
+
   // Return single project
   project(projectPath) {
     const url = Api.buildUrl(Api.projectPath).replace(':id', encodeURIComponent(projectPath));
@@ -355,12 +372,25 @@ const Api = {
     });
   },
 
+  postMergeRequestPipeline(id, { mergeRequestId }) {
+    const url = Api.buildUrl(this.mergeRequestsPipeline)
+      .replace(':id', encodeURIComponent(id))
+      .replace(':merge_request_iid', mergeRequestId);
+
+    return axios.post(url);
+  },
+
   releases(id) {
     const url = Api.buildUrl(this.releasesPath).replace(':id', encodeURIComponent(id));
 
     return axios.get(url);
   },
 
+  adminStatistics() {
+    const url = Api.buildUrl(this.adminStatisticsPath);
+    return axios.get(url);
+  },
+
   buildUrl(url) {
     return joinPaths(gon.relative_url_root || '', url.replace(':version', gon.api_version));
   },

app/assets/javascripts/behaviors/markdown/render_metrics.js

@@ -2,7 +2,7 @@ import Vue from 'vue';
 import Metrics from '~/monitoring/components/embed.vue';
 import { createStore } from '~/monitoring/stores';
 
-// TODO: Handle copy-pasting - https://gitlab.com/gitlab-org/gitlab-ce/issues/64369.
+// TODO: Handle copy-pasting - https://gitlab.com/gitlab-org/gitlab-foss/issues/64369.
 export default function renderMetrics(elements) {
   if (!elements.length) {
     return;

app/assets/javascripts/behaviors/preview_markdown.js

@@ -1,4 +1,4 @@
-/* eslint-disable func-names, no-var, object-shorthand, prefer-arrow-callback */
+/* eslint-disable func-names, no-var, prefer-arrow-callback */
 
 import $ from 'jquery';
 import axios from '~/lib/utils/axios_utils';
@@ -82,7 +82,7 @@ MarkdownPreview.prototype.fetchMarkdownPreview = function(text, url, success) {
     })
     .then(({ data }) => {
       this.ajaxCache = {
-        text: text,
+        text,
         response: data,
       };
       success(data);

app/assets/javascripts/behaviors/shortcuts/shortcuts.js

@@ -46,7 +46,6 @@ export default class Shortcuts {
 
     $(document).on('click.more_help', '.js-more-help-button', function clickMoreHelp(e) {
       $(this).remove();
-      $('.hidden-shortcut').show();
       e.preventDefault();
     });
   }
@@ -104,7 +103,6 @@ export default class Shortcuts {
           return results;
         }
 
-        $('.hidden-shortcut').show();
         return $('.js-more-help-button').remove();
       });
   }

app/assets/javascripts/behaviors/shortcuts/shortcuts_issuable.js

@@ -6,7 +6,7 @@ import { CopyAsGFM } from '../markdown/copy_as_gfm';
 import { getSelectedFragment } from '~/lib/utils/common_utils';
 
 export default class ShortcutsIssuable extends Shortcuts {
-  constructor(isMergeRequest) {
+  constructor() {
     super();
 
     Mousetrap.bind('a', () => ShortcutsIssuable.openSidebarDropdown('assignee'));
@@ -14,12 +14,6 @@ export default class ShortcutsIssuable extends Shortcuts {
     Mousetrap.bind('l', () => ShortcutsIssuable.openSidebarDropdown('labels'));
     Mousetrap.bind('r', ShortcutsIssuable.replyWithSelectedText);
     Mousetrap.bind('e', ShortcutsIssuable.editIssue);
-
-    if (isMergeRequest) {
-      this.enabledHelp.push('.hidden-shortcut.merge_requests');
-    } else {
-      this.enabledHelp.push('.hidden-shortcut.issues');
-    }
   }
 
   static replyWithSelectedText() {

app/assets/javascripts/behaviors/shortcuts/shortcuts_navigation.js

@@ -23,7 +23,5 @@ export default class ShortcutsNavigation extends Shortcuts {
     Mousetrap.bind('g e', () => findAndFollowLink('.shortcuts-environments'));
     Mousetrap.bind('g l', () => findAndFollowLink('.shortcuts-metrics'));
     Mousetrap.bind('i', () => findAndFollowLink('.shortcuts-new-issue'));
-
-    this.enabledHelp.push('.hidden-shortcut.project');
   }
 }

app/assets/javascripts/behaviors/shortcuts/shortcuts_network.js

@@ -11,7 +11,5 @@ export default class ShortcutsNetwork extends ShortcutsNavigation {
     Mousetrap.bind(['down', 'j'], graph.scrollDown);
     Mousetrap.bind(['shift+up', 'shift+k'], graph.scrollTop);
     Mousetrap.bind(['shift+down', 'shift+j'], graph.scrollBottom);
-
-    this.enabledHelp.push('.hidden-shortcut.network');
   }
 }

app/assets/javascripts/behaviors/shortcuts/shortcuts_wiki.js

@@ -6,8 +6,6 @@ export default class ShortcutsWiki extends ShortcutsNavigation {
   constructor() {
     super();
     Mousetrap.bind('e', ShortcutsWiki.editWiki);
-
-    this.enabledHelp.push('.hidden-shortcut.wiki');
   }
 
   static editWiki() {

app/assets/javascripts/blob/blob_file_dropzone.js

@@ -1,4 +1,4 @@
-/* eslint-disable func-names, object-shorthand, prefer-arrow-callback */
+/* eslint-disable func-names, prefer-arrow-callback */
 
 import $ from 'jquery';
 import Dropzone from 'dropzone';
@@ -32,7 +32,7 @@ export default class BlobFileDropzone {
       url: form.attr('action'),
       // Rails uses a hidden input field for PUT
       // http://stackoverflow.com/questions/21056482/how-to-set-method-put-in-form-tag-in-rails
-      method: method,
+      method,
       clickable: true,
       uploadMultiple: false,
       paramName: 'file',
@@ -42,7 +42,7 @@ export default class BlobFileDropzone {
       addRemoveLinks: true,
       previewsContainer: '.dropzone-previews',
       headers: csrf.headers,
-      init: function() {
+      init() {
         this.on('addedfile', function() {
           toggleLoading(submitButton, submitButtonLoadingIcon, false);
           dropzoneMessage.addClass(HIDDEN_CLASS);
@@ -69,7 +69,7 @@ export default class BlobFileDropzone {
         });
       },
       // Override behavior of adding error underneath preview
-      error: function(file, errorMessage) {
+      error(file, errorMessage) {
         const stripped = $('<div/>')
           .html(errorMessage)
           .text();

app/assets/javascripts/blob/template_selector.js

@@ -1,4 +1,4 @@
-/* eslint-disable class-methods-use-this, no-unused-vars */
+/* eslint-disable class-methods-use-this */
 
 import $ from 'jquery';
 
@@ -61,7 +61,7 @@ export default class TemplateSelector {
     return this.requestFile(item);
   }
 
-  requestFile(item) {
+  requestFile() {
     // This `requestFile` method is an abstract method that should
     // be added by all subclasses.
   }

app/assets/javascripts/blob/viewer/index.js

@@ -1,4 +1,5 @@
 import $ from 'jquery';
+import '~/behaviors/markdown/render_gfm';
 import Flash from '../../flash';
 import { handleLocationHash } from '../../lib/utils/common_utils';
 import axios from '../../lib/utils/axios_utils';
@@ -105,7 +106,6 @@ export default class BlobViewer {
 
   toggleCopyButtonState() {
     if (!this.copySourceBtn) return;
-
     if (this.simpleViewer.getAttribute('data-loaded')) {
       this.copySourceBtn.setAttribute('title', __('Copy source to clipboard'));
       this.copySourceBtn.classList.remove('disabled');
@@ -152,7 +152,6 @@ export default class BlobViewer {
     this.activeViewer = newViewer;
 
     this.toggleCopyButtonState();
-
     BlobViewer.loadViewer(newViewer)
       .then(viewer => {
         $(viewer).renderGFM();

app/assets/javascripts/boards/components/board.js

@@ -50,6 +50,9 @@ export default Vue.extend({
     };
   },
   computed: {
+    isLoggedIn() {
+      return Boolean(gon.current_user_id);
+    },
     counterTooltip() {
       const { issuesSize } = this.list;
       return `${n__('%d issue', '%d issues', issuesSize)}`;
@@ -106,7 +109,11 @@ export default Vue.extend({
     Sortable.create(this.$el.parentNode, sortableOptions);
   },
   created() {
-    if (this.list.isExpandable && AccessorUtilities.isLocalStorageAccessSafe()) {
+    if (
+      this.list.isExpandable &&
+      AccessorUtilities.isLocalStorageAccessSafe() &&
+      !this.isLoggedIn
+    ) {
       const isCollapsed = localStorage.getItem(`${this.uniqueKey}.expanded`) === 'false';
 
       this.list.isExpanded = !isCollapsed;
@@ -120,10 +127,14 @@ export default Vue.extend({
       if (this.list.isExpandable) {
         this.list.isExpanded = !this.list.isExpanded;
 
-        if (AccessorUtilities.isLocalStorageAccessSafe()) {
+        if (AccessorUtilities.isLocalStorageAccessSafe() && !this.isLoggedIn) {
           localStorage.setItem(`${this.uniqueKey}.expanded`, this.list.isExpanded);
         }
 
+        if (this.isLoggedIn) {
+          this.list.update();
+        }
+
         // When expanding/collapsing, the tooltip on the caret button sometimes stays open.
         // Close all tooltips manually to prevent dangling tooltips.
         $('.tooltip').tooltip('hide');

app/assets/javascripts/boards/components/board_card.vue

@@ -83,6 +83,7 @@ export default {
     }"
     :index="index"
     :data-issue-id="issue.id"
+    data-qa-selector="board_card"
     class="board-card p-3 rounded"
     @mousedown="mouseDown"
     @mousemove="mouseMove"

app/assets/javascripts/boards/components/board_list.vue

@@ -227,6 +227,7 @@ export default {
   <div
     :class="{ 'd-none': !list.isExpanded, 'd-flex flex-column': list.isExpanded }"
     class="board-list-component position-relative h-100"
+    data-qa-selector="board_list_cards_area"
   >
     <div v-if="loading" class="board-list-loading text-center" :aria-label="__('Loading issues')">
       <gl-loading-icon />

app/assets/javascripts/boards/components/board_new_issue.vue

@@ -2,9 +2,9 @@
 import $ from 'jquery';
 import { GlButton } from '@gitlab/ui';
 import { getMilestone } from 'ee_else_ce/boards/boards_util';
+import ListIssue from 'ee_else_ce/boards/models/issue';
 import eventHub from '../eventhub';
 import ProjectSelect from './project_select.vue';
-import ListIssue from '../models/issue';
 import boardsStore from '../stores/boards_store';
 
 export default {
@@ -54,6 +54,9 @@ export default {
       const assignees = this.list.assignee ? [this.list.assignee] : [];
       const milestone = getMilestone(this.list);
 
+      const { weightFeatureAvailable } = boardsStore;
+      const { weight } = weightFeatureAvailable ? boardsStore.state.currentBoard : {};
+
       const issue = new ListIssue({
         title: this.title,
         labels,
@@ -61,6 +64,7 @@ export default {
         assignees,
         milestone,
         project_id: this.selectedProject.id,
+        weight,
       });
 
       eventHub.$emit(`scroll-board-list-${this.list.id}`);
@@ -114,7 +118,7 @@ export default {
           name="issue_title"
           autocomplete="off"
         />
-        <project-select v-if="groupId" :group-id="groupId" />
+        <project-select v-if="groupId" :group-id="groupId" :list="list" />
         <div class="clearfix prepend-top-10">
           <gl-button
             ref="submit-button"

app/assets/javascripts/boards/components/board_sidebar.js

@@ -22,6 +22,8 @@ export default Vue.extend({
   components: {
     AssigneeTitle,
     Assignees,
+    SidebarEpicsSelect: () =>
+      import('ee_component/sidebar/components/sidebar_item_epics_select.vue'),
     RemoveBtn,
     Subscriptions,
     TimeTracker,

app/assets/javascripts/boards/components/boards_selector.vue

@@ -226,6 +226,7 @@ export default {
   <div class="boards-switcher js-boards-selector append-right-10">
     <span class="boards-selector-wrapper js-boards-selector-wrapper">
       <gl-dropdown
+        data-qa-selector="boards_dropdown"
         toggle-class="dropdown-menu-toggle js-dropdown-toggle"
         menu-class="flex-column dropdown-extended-height"
         :text="board.name"
@@ -244,6 +245,7 @@ export default {
         <div
           v-if="!loading"
           ref="content"
+          data-qa-selector="boards_dropdown_content"
           class="dropdown-content flex-fill"
           @scroll.passive="throttledSetScrollFade"
         >

app/assets/javascripts/boards/components/new_list_dropdown.js

@@ -1,7 +1,9 @@
-/* eslint-disable func-names, no-new, promise/catch-or-return */
+/* eslint-disable func-names, no-new */
 
 import $ from 'jquery';
+import { __ } from '~/locale';
 import axios from '~/lib/utils/axios_utils';
+import flash from '~/flash';
 import CreateLabelDropdown from '../../create_label';
 import boardsStore from '../stores/boards_store';
 
@@ -26,17 +28,22 @@ $(document)
 
 export default function initNewListDropdown() {
   $('.js-new-board-list').each(function() {
-    const $this = $(this);
+    const $dropdownToggle = $(this);
+    const $dropdown = $dropdownToggle.closest('.dropdown');
     new CreateLabelDropdown(
-      $this.closest('.dropdown').find('.dropdown-new-label'),
-      $this.data('namespacePath'),
-      $this.data('projectPath'),
+      $dropdown.find('.dropdown-new-label'),
+      $dropdownToggle.data('namespacePath'),
+      $dropdownToggle.data('projectPath'),
     );
 
-    $this.glDropdown({
+    $dropdownToggle.glDropdown({
       data(term, callback) {
-        axios.get($this.attr('data-list-labels-path')).then(({ data }) => {
-          callback(data);
+        axios
+          .get($dropdownToggle.attr('data-list-labels-path'))
+          .then(({ data }) => callback(data))
+          .catch(() => {
+            $dropdownToggle.data('bs.dropdown').hide();
+            flash(__('Error fetching labels.'));
           });
       },
       renderRow(label) {

app/assets/javascripts/boards/components/project_select.vue

@@ -6,6 +6,7 @@ import Icon from '~/vue_shared/components/icon.vue';
 import { GlLoadingIcon } from '@gitlab/ui';
 import eventHub from '../eventhub';
 import Api from '../../api';
+import { featureAccessLevel } from '~/pages/projects/shared/permissions/constants';
 
 export default {
   name: 'BoardProjectSelect',
@@ -19,6 +20,10 @@ export default {
       required: true,
       default: 0,
     },
+    list: {
+      type: Object,
+      required: true,
+    },
   },
   data() {
     return {
@@ -49,6 +54,12 @@ export default {
       selectable: true,
       data: (term, callback) => {
         this.loading = true;
+        const additionalAttrs = {};
+
+        if (this.list.type && this.list.type !== 'backlog') {
+          additionalAttrs.min_access_level = featureAccessLevel.EVERYONE;
+        }
+
         return Api.groupProjects(
           this.groupId,
           term,
@@ -56,6 +67,7 @@ export default {
             with_issues_enabled: true,
             with_shared: false,
             include_subgroups: true,
+            ...additionalAttrs,
           },
           projects => {
             this.loading = false;

app/assets/javascripts/boards/components/sidebar/remove_issue.vue

@@ -1,10 +1,10 @@
 <script>
-import Vue from 'vue';
+import axios from '~/lib/utils/axios_utils';
 import Flash from '../../../flash';
 import { __ } from '../../../locale';
 import boardsStore from '../../stores/boards_store';
 
-export default Vue.extend({
+export default {
   props: {
     issue: {
       type: Object,
@@ -35,7 +35,7 @@ export default Vue.extend({
       }
 
       // Post the remove data
-      Vue.http.patch(this.updateUrl, data).catch(() => {
+      axios.patch(this.updateUrl, data).catch(() => {
         Flash(__('Failed to remove issue from board, please try again.'));
 
         lists.forEach(list => {
@@ -71,7 +71,7 @@ export default Vue.extend({
       return req;
     },
   },
-});
+};
 </script>
 <template>
   <div class="block list">

app/assets/javascripts/boards/models/issue.js

@@ -3,7 +3,7 @@
 /* global ListMilestone */
 /* global ListAssignee */
 
-import Vue from 'vue';
+import axios from '~/lib/utils/axios_utils';
 import './label';
 import { convertObjectPropsToCamelCase } from '~/lib/utils/common_utils';
 import IssueProject from './project';
@@ -11,11 +11,6 @@ import boardsStore from '../stores/boards_store';
 
 class ListIssue {
   constructor(obj, defaultAvatar) {
-    this.id = obj.id;
-    this.iid = obj.iid;
-    this.title = obj.title;
-    this.confidential = obj.confidential;
-    this.dueDate = obj.due_date;
     this.subscribed = obj.subscribed;
     this.labels = [];
     this.assignees = [];
@@ -25,6 +20,16 @@ class ListIssue {
       subscriptions: true,
     };
     this.isLoading = {};
+
+    this.refreshData(obj, defaultAvatar);
+  }
+
+  refreshData(obj, defaultAvatar) {
+    this.id = obj.id;
+    this.iid = obj.iid;
+    this.title = obj.title;
+    this.confidential = obj.confidential;
+    this.dueDate = obj.due_date;
     this.sidebarInfoEndpoint = obj.issue_sidebar_endpoint;
     this.referencePath = obj.reference_path;
     this.path = obj.real_path;
@@ -42,12 +47,14 @@ class ListIssue {
       this.milestone_id = obj.milestone.id;
     }
 
-    obj.labels.forEach(label => {
-      this.labels.push(new ListLabel(label));
-    });
+    if (obj.labels) {
+      this.labels = obj.labels.map(label => new ListLabel(label));
+    }
 
+    if (obj.assignees) {
       this.assignees = obj.assignees.map(a => new ListAssignee(a, defaultAvatar));
     }
+  }
 
   addLabel(label) {
     if (!this.findLabel(label)) {
@@ -133,7 +140,7 @@ class ListIssue {
     }
 
     const projectPath = this.project ? this.project.path : '';
-    return Vue.http.patch(`${this.path}.json`, data).then(({ body = {} } = {}) => {
+    return axios.patch(`${this.path}.json`, data).then(({ data: body = {} } = {}) => {
       /**
        * Since post implementation of Scoped labels, server can reject
        * same key-ed labels. To keep the UI and server Model consistent,

app/assets/javascripts/boards/models/list.js

@@ -1,9 +1,9 @@
-/* eslint-disable no-underscore-dangle, class-methods-use-this, consistent-return, no-shadow, no-param-reassign */
-/* global ListIssue */
+/* eslint-disable no-underscore-dangle, class-methods-use-this, consistent-return, no-shadow */
 
 import { __ } from '~/locale';
 import ListLabel from './label';
 import ListAssignee from './assignee';
+import ListIssue from 'ee_else_ce/boards/models/issue';
 import { urlParamsToObject } from '~/lib/utils/common_utils';
 import boardsStore from '../stores/boards_store';
 import ListMilestone from './milestone';
@@ -45,7 +45,7 @@ class List {
     const typeInfo = this.getTypeInfo(this.type);
     this.preset = Boolean(typeInfo.isPreset);
     this.isExpandable = Boolean(typeInfo.isExpandable);
-    this.isExpanded = true;
+    this.isExpanded = !obj.collapsed;
     this.page = 1;
     this.loading = true;
     this.loadingMore = false;
@@ -113,7 +113,8 @@ class List {
   }
 
   update() {
-    gl.boardService.updateList(this.id, this.position).catch(() => {
+    const collapsed = !this.isExpanded;
+    return gl.boardService.updateList(this.id, this.position, collapsed).catch(() => {
       // TODO: handle request error
     });
   }
@@ -259,12 +260,7 @@ class List {
   }
 
   onNewIssueResponse(issue, data) {
-    issue.id = data.id;
-    issue.iid = data.iid;
-    issue.project = data.project;
-    issue.path = data.real_path;
-    issue.referencePath = data.reference_path;
-    issue.assignableLabelsEndpoint = data.assignable_labels_endpoint;
+    issue.refreshData(data);
 
     if (this.issuesSize > 1) {
       const moveBeforeId = this.issues[1].id;

app/assets/javascripts/boards/services/board_service.js

@@ -2,7 +2,7 @@
 /**
  * This file is intended to be deleted.
  * The existing functions will removed one by one in favor of using the board store directly.
- * see https://gitlab.com/gitlab-org/gitlab-ce/issues/61621
+ * see https://gitlab.com/gitlab-org/gitlab-foss/issues/61621
  */
 
 import boardsStore from '~/boards/stores/boards_store';
@@ -32,8 +32,8 @@ export default class BoardService {
     return boardsStore.createList(entityId, entityType);
   }
 
-  updateList(id, position) {
-    return boardsStore.updateList(id, position);
+  updateList(id, position, collapsed) {
+    return boardsStore.updateList(id, position, collapsed);
   }
 
   destroyList(id) {

app/assets/javascripts/boards/stores/boards_store.js

@@ -82,7 +82,7 @@ const boardsStore = {
         this.state.lists = _.sortBy(this.state.lists, 'position');
       })
       .catch(() => {
-        // https://gitlab.com/gitlab-org/gitlab-ce/issues/30821
+        // https://gitlab.com/gitlab-org/gitlab-foss/issues/30821
       });
     this.removeBlankState();
   },
@@ -278,10 +278,11 @@ const boardsStore = {
     });
   },
 
-  updateList(id, position) {
+  updateList(id, position, collapsed) {
     return axios.put(`${this.state.endpoints.listsEndpoint}/${id}`, {
       list: {
         position,
+        collapsed,
       },
     });
   },

app/assets/javascripts/boards/stores/boards_store_ee.js

@@ -1,4 +1,4 @@
-// this is just to make ee_else_ce happy and will be cleaned up in https://gitlab.com/gitlab-org/gitlab-ce/issues/59807
+// this is just to make ee_else_ce happy and will be cleaned up in https://gitlab.com/gitlab-org/gitlab-foss/issues/59807
 
 export default {
   initEESpecific() {},

app/assets/javascripts/branches/divergence_graph.js

@@ -25,6 +25,11 @@ export default endpoint => {
   const names = [...document.querySelectorAll('.js-branch-item')].map(
     ({ dataset }) => dataset.name,
   );
+
+  if (names.length === 0) {
+    return true;
+  }
+
   return axios
     .get(endpoint, {
       params: { names },

app/assets/javascripts/ci_variable_list/ci_variable_list.js

@@ -54,7 +54,7 @@ export default class VariableList {
       environment_scope: {
         // We can't use a `.js-` class here because
         // gl_dropdown replaces the <input> and doesn't copy over the class
-        // See https://gitlab.com/gitlab-org/gitlab-ce/issues/42458
+        // See https://gitlab.com/gitlab-org/gitlab-foss/issues/42458
         selector: `input[name="${this.formField}[variables_attributes][][environment_scope]"]`,
         default: '*',
       },

app/assets/javascripts/clusters/clusters_bundle.js

@@ -14,6 +14,8 @@ import ClustersStore from './stores/clusters_store';
 import Applications from './components/applications.vue';
 import setupToggleButtons from '../toggle_buttons';
 
+const Environments = () => import('ee_component/clusters/components/environments.vue');
+
 Vue.use(GlToast);
 
 /**
@@ -37,6 +39,7 @@ export default class Clusters {
       updateKnativePath,
       installPrometheusPath,
       managePrometheusPath,
+      clusterEnvironmentsPath,
       hasRbac,
       clusterType,
       clusterStatus,
@@ -44,6 +47,9 @@ export default class Clusters {
       helpPath,
       ingressHelpPath,
       ingressDnsHelpPath,
+      environmentsHelpPath,
+      clustersHelpPath,
+      deployBoardsHelpPath,
       clusterId,
     } = document.querySelector('.js-edit-cluster-form').dataset;
 
@@ -52,7 +58,14 @@ export default class Clusters {
     this.clusterBannerDismissedKey = `cluster_${this.clusterId}_banner_dismissed`;
 
     this.store = new ClustersStore();
-    this.store.setHelpPaths(helpPath, ingressHelpPath, ingressDnsHelpPath);
+    this.store.setHelpPaths(
+      helpPath,
+      ingressHelpPath,
+      ingressDnsHelpPath,
+      environmentsHelpPath,
+      clustersHelpPath,
+      deployBoardsHelpPath,
+    );
     this.store.setManagePrometheusPath(managePrometheusPath);
     this.store.updateStatus(clusterStatus);
     this.store.updateStatusReason(clusterStatusReason);
@@ -67,6 +80,7 @@ export default class Clusters {
       installJupyterEndpoint: installJupyterPath,
       installKnativeEndpoint: installKnativePath,
       updateKnativeEndpoint: updateKnativePath,
+      clusterEnvironmentsEndpoint: clusterEnvironmentsPath,
     });
 
     this.installApplication = this.installApplication.bind(this);
@@ -95,12 +109,27 @@ export default class Clusters {
       setupToggleButtons(toggleButtonsContainer);
     }
     this.initApplications(clusterType);
+    this.initEnvironments();
+
+    if (clusterEnvironmentsPath && this.environments) {
+      this.store.toggleFetchEnvironments(true);
+
+      this.initPolling(
+        'fetchClusterEnvironments',
+        data => this.handleClusterEnvironmentsSuccess(data),
+        () => this.handleEnvironmentsPollError(),
+      );
+    }
 
     this.updateContainer(null, this.store.state.status, this.store.state.statusReason);
 
     this.addListeners();
-    if (statusPath) {
-      this.initPolling();
+    if (statusPath && !this.environments) {
+      this.initPolling(
+        'fetchClusterStatus',
+        data => this.handleClusterStatusSuccess(data),
+        () => this.handlePollError(),
+      );
     }
   }
 
@@ -131,6 +160,40 @@ export default class Clusters {
     });
   }
 
+  initEnvironments() {
+    const { store } = this;
+    const el = document.querySelector('#js-cluster-environments');
+
+    if (!el) {
+      return;
+    }
+
+    this.environments = new Vue({
+      el,
+      data() {
+        return {
+          state: store.state,
+        };
+      },
+      render(createElement) {
+        return createElement(Environments, {
+          props: {
+            isFetching: this.state.fetchingEnvironments,
+            environments: this.state.environments,
+            environmentsHelpPath: this.state.environmentsHelpPath,
+            clustersHelpPath: this.state.clustersHelpPath,
+            deployBoardsHelpPath: this.state.deployBoardsHelpPath,
+          },
+        });
+      },
+    });
+  }
+
+  handleClusterEnvironmentsSuccess(data) {
+    this.store.toggleFetchEnvironments(false);
+    this.store.updateEnvironments(data.data);
+  }
+
   static initDismissableCallout() {
     const callout = document.querySelector('.js-cluster-security-warning');
     PersistentUserCallout.factory(callout);
@@ -164,21 +227,16 @@ export default class Clusters {
     eventHub.$off('uninstallApplication');
   }
 
-  initPolling() {
+  initPolling(method, successCallback, errorCallback) {
     this.poll = new Poll({
       resource: this.service,
-      method: 'fetchData',
-      successCallback: data => this.handleSuccess(data),
-      errorCallback: () => Clusters.handleError(),
+      method,
+      successCallback,
+      errorCallback,
     });
 
     if (!Visibility.hidden()) {
       this.poll.makeRequest();
-    } else {
-      this.service
-        .fetchData()
-        .then(data => this.handleSuccess(data))
-        .catch(() => Clusters.handleError());
     }
 
     Visibility.change(() => {
@@ -190,11 +248,21 @@ export default class Clusters {
     });
   }
 
+  handlePollError() {
+    this.constructor.handleError();
+  }
+
+  handleEnvironmentsPollError() {
+    this.store.toggleFetchEnvironments(false);
+
+    this.handlePollError();
+  }
+
   static handleError() {
     Flash(s__('ClusterIntegration|Something went wrong on our end.'));
   }
 
-  handleSuccess(data) {
+  handleClusterStatusSuccess(data) {
     const prevStatus = this.store.state.status;
     const prevApplicationMap = Object.assign({}, this.store.state.applications);
 
@@ -390,6 +458,10 @@ export default class Clusters {
       this.poll.stop();
     }
 
+    if (this.environments) {
+      this.environments.$destroy();
+    }
+
     this.applications.$destroy();
   }
 }

app/assets/javascripts/clusters/components/applications.vue

@@ -397,7 +397,6 @@ export default {
         </div>
       </application-row>
       <application-row
-        v-if="isProjectCluster"
         id="jupyter"
         :logo-url="jupyterhubLogo"
         :title="applications.jupyter.title"
@@ -459,7 +458,6 @@ export default {
         </div>
       </application-row>
       <application-row
-        v-if="isProjectCluster"
         id="knative"
         :logo-url="knativeLogo"
         :title="applications.knative.title"

app/assets/javascripts/clusters/services/clusters_service.js

@@ -17,7 +17,7 @@ export default class ClusterService {
     };
   }
 
-  fetchData() {
+  fetchClusterStatus() {
     return axios.get(this.options.endpoint);
   }
 
@@ -33,6 +33,10 @@ export default class ClusterService {
     return axios.delete(this.appInstallEndpointMap[appId], params);
   }
 
+  fetchClusterEnvironments() {
+    return axios.get(this.options.clusterEnvironmentsEndpoint);
+  }
+
   static updateCluster(endpoint, data) {
     return axios.put(endpoint, data);
   }

app/assets/javascripts/clusters/stores/clusters_store.js

@@ -32,6 +32,9 @@ export default class ClusterStore {
     this.state = {
       helpPath: null,
       ingressHelpPath: null,
+      environmentsHelpPath: null,
+      clustersHelpPath: null,
+      deployBoardsHelpPath: null,
       status: null,
       rbac: false,
       statusReason: null,
@@ -55,7 +58,7 @@ export default class ClusterStore {
           ...applicationInitialState,
           title: s__('ClusterIntegration|GitLab Runner'),
           version: null,
-          chartRepo: 'https://gitlab.com/charts/gitlab-runner',
+          chartRepo: 'https://gitlab.com/gitlab-org/charts/gitlab-runner',
           updateAvailable: null,
           updateSuccessful: false,
           updateFailed: false,
@@ -80,13 +83,25 @@ export default class ClusterStore {
           updateFailed: false,
         },
       },
+      environments: [],
+      fetchingEnvironments: false,
     };
   }
 
-  setHelpPaths(helpPath, ingressHelpPath, ingressDnsHelpPath) {
+  setHelpPaths(
+    helpPath,
+    ingressHelpPath,
+    ingressDnsHelpPath,
+    environmentsHelpPath,
+    clustersHelpPath,
+    deployBoardsHelpPath,
+  ) {
     this.state.helpPath = helpPath;
     this.state.ingressHelpPath = ingressHelpPath;
     this.state.ingressDnsHelpPath = ingressDnsHelpPath;
+    this.state.environmentsHelpPath = environmentsHelpPath;
+    this.state.clustersHelpPath = clustersHelpPath;
+    this.state.deployBoardsHelpPath = deployBoardsHelpPath;
   }
 
   setManagePrometheusPath(managePrometheusPath) {
@@ -191,4 +206,22 @@ export default class ClusterStore {
       }
     });
   }
+
+  toggleFetchEnvironments(isFetching) {
+    this.state.fetchingEnvironments = isFetching;
+  }
+
+  updateEnvironments(environments = []) {
+    this.state.environments = environments.map(environment => ({
+      name: environment.name,
+      project: environment.project,
+      environmentPath: environment.environment_path,
+      lastDeployment: environment.last_deployment,
+      rolloutStatus: {
+        status: environment.rollout_status ? environment.rollout_status.status : null,
+        instances: environment.rollout_status ? environment.rollout_status.instances : [],
+      },
+      updatedAt: environment.updated_at,
+    }));
+  }
 }

app/assets/javascripts/commit/image_file.js

@@ -1,4 +1,4 @@
-/* eslint-disable func-names, no-var, prefer-arrow-callback, no-else-return, consistent-return, prefer-template, one-var, no-unused-vars, no-return-assign, no-unused-expressions, no-sequences */
+/* eslint-disable func-names, no-var, prefer-arrow-callback, no-else-return, consistent-return, prefer-template, one-var, no-return-assign, no-unused-expressions, no-sequences */
 
 import $ from 'jquery';
 
@@ -12,11 +12,8 @@ export default class ImageFile {
     this.requestImageInfo(
       $('.two-up.view .frame.deleted img', this.file),
       (function(_this) {
-        return function(deletedWidth, deletedHeight) {
-          return _this.requestImageInfo($('.two-up.view .frame.added img', _this.file), function(
-            width,
-            height,
-          ) {
+        return function() {
+          return _this.requestImageInfo($('.two-up.view .frame.added img', _this.file), function() {
             _this.initViewModes();
 
             // Load two-up view after images are loaded
@@ -112,7 +109,7 @@ export default class ImageFile {
     maxHeight = 0;
     $('.frame', view)
       .each(
-        (function(_this) {
+        (function() {
           return function(index, frame) {
             var height, width;
             width = $(frame).width();
@@ -196,13 +193,7 @@ export default class ImageFile {
       return $('.onion-skin.view', this.file).each(
         (function(_this) {
           return function(index, view) {
-            var $frame,
-              $track,
-              $dragger,
-              $frameAdded,
-              framePadding,
-              ref,
-              dragging = false;
+            var $frame, $track, $dragger, $frameAdded, framePadding, ref;
             (ref = _this.prepareFrames(view)), ([maxWidth, maxHeight] = ref);
             $frame = $('.onion-skin-frame', view);
             $frameAdded = $('.frame.added', view);

app/assets/javascripts/commit/pipelines/pipelines_table.vue

@@ -1,14 +1,19 @@
 <script>
-import PipelinesService from '../../pipelines/services/pipelines_service';
-import PipelineStore from '../../pipelines/stores/pipelines_store';
-import pipelinesMixin from '../../pipelines/mixins/pipelines';
-import TablePagination from '../../vue_shared/components/pagination/table_pagination.vue';
-import { getParameterByName } from '../../lib/utils/common_utils';
-import CIPaginationMixin from '../../vue_shared/mixins/ci_pagination_api_mixin';
+import { GlButton, GlLoadingIcon } from '@gitlab/ui';
+import PipelinesService from '~/pipelines/services/pipelines_service';
+import PipelineStore from '~/pipelines/stores/pipelines_store';
+import pipelinesMixin from '~/pipelines/mixins/pipelines';
+import eventHub from '~/pipelines/event_hub';
+import TablePagination from '~/vue_shared/components/pagination/table_pagination.vue';
+import { getParameterByName } from '~/lib/utils/common_utils';
+import CIPaginationMixin from '~/vue_shared/mixins/ci_pagination_api_mixin';
+import bp from '~/breakpoints';
 
 export default {
   components: {
     TablePagination,
+    GlButton,
+    GlLoadingIcon,
   },
   mixins: [pipelinesMixin, CIPaginationMixin],
   props: {
@@ -33,6 +38,21 @@ export default {
       required: false,
       default: 'child',
     },
+    canRunPipeline: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    projectId: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    mergeRequestId: {
+      type: Number,
+      required: false,
+      default: 0,
+    },
   },
 
   data() {
@@ -53,6 +73,41 @@ export default {
     shouldRenderErrorState() {
       return this.hasError && !this.isLoading;
     },
+    /**
+     * The Run Pipeline button can only be rendered when:
+     * - In MR view -  we use `canRunPipeline` for that purpose
+     * - If the latest pipeline has the `detached_merge_request_pipeline` flag
+     *
+     * @returns {Boolean}
+     */
+    canRenderPipelineButton() {
+      return this.canRunPipeline && this.latestPipelineDetachedFlag;
+    },
+    /**
+     * Checks if either `detached_merge_request_pipeline` or
+     * `merge_request_pipeline` are tru in the first
+     * object in the pipelines array.
+     *
+     * @returns {Boolean}
+     */
+    latestPipelineDetachedFlag() {
+      const latest = this.state.pipelines[0];
+      return (
+        latest &&
+        latest.flags &&
+        (latest.flags.detached_merge_request_pipeline || latest.flags.merge_request_pipeline)
+      );
+    },
+    /**
+     * When we are on Desktop and the button is visible
+     * we need to add a negative margin to the table
+     * to make it inline with the button
+     *
+     * @returns {Boolean}
+     */
+    shouldAddNegativeMargin() {
+      return this.canRenderPipelineButton && bp.isDesktop();
+    },
   },
   created() {
     this.service = new PipelinesService(this.endpoint);
@@ -77,6 +132,22 @@ export default {
         this.$el.parentElement.dispatchEvent(updatePipelinesEvent);
       }
     },
+    /**
+     * When the user clicks on the Run Pipeline button
+     * we need to make a post request and
+     * to update the table content once the request is finished.
+     *
+     * We are emitting an event through the eventHub using the old pattern
+     * to make use of the code in mixins/pipelines.js that handles all the
+     * table events
+     *
+     */
+    onClickRunPipeline() {
+      eventHub.$emit('runMergeRequestPipeline', {
+        projectId: this.projectId,
+        mergeRequestId: this.mergeRequestId,
+      });
+    },
   },
 };
 </script>
@@ -99,11 +170,25 @@ export default {
     />
 
     <div v-else-if="shouldRenderTable" class="table-holder">
+      <div v-if="canRenderPipelineButton" class="nav justify-content-end">
+        <gl-button
+          v-if="canRenderPipelineButton"
+          variant="success"
+          class="js-run-mr-pipeline prepend-top-10 btn-wide-on-xs"
+          :disabled="state.isRunningMergeRequestPipeline"
+          @click="onClickRunPipeline"
+        >
+          <gl-loading-icon v-if="state.isRunningMergeRequestPipeline" inline />
+          {{ s__('Pipelines|Run Pipeline') }}
+        </gl-button>
+      </div>
+
       <pipelines-table-component
         :pipelines="state.pipelines"
         :update-graph-dropdown="updateGraphDropdown"
         :auto-devops-help-path="autoDevopsHelpPath"
         :view-type="viewType"
+        :class="{ 'negative-margin-top': shouldAddNegativeMargin }"
       />
     </div>
 

app/assets/javascripts/compare_autocomplete.js

@@ -1,4 +1,4 @@
-/* eslint-disable func-names, one-var, no-var, object-shorthand, no-else-return */
+/* eslint-disable func-names, one-var, no-var, no-else-return */
 
 import $ from 'jquery';
 import { __ } from './locale';
@@ -15,7 +15,7 @@ export default function initCompareAutocomplete(limitTo = null, clickHandler = (
     const $fieldInput = $(`input[name="${$dropdown.data('fieldName')}"]`, $dropdownContainer);
     const $filterInput = $('input[type="search"]', $dropdownContainer);
     $dropdown.glDropdown({
-      data: function(term, callback) {
+      data(term, callback) {
         const params = {
           ref: $dropdown.data('ref'),
           search: term,
@@ -43,7 +43,7 @@ export default function initCompareAutocomplete(limitTo = null, clickHandler = (
       filterRemote: Boolean($dropdown.data('refsUrl')),
       fieldName: $dropdown.data('fieldName'),
       filterInput: 'input[type="search"]',
-      renderRow: function(ref) {
+      renderRow(ref) {
         var link;
         if (ref.header != null) {
           return $('<li />')
@@ -58,10 +58,10 @@ export default function initCompareAutocomplete(limitTo = null, clickHandler = (
           return $('<li />').append(link);
         }
       },
-      id: function(obj, $el) {
+      id(obj, $el) {
         return $el.attr('data-ref');
       },
-      toggleLabel: function(obj, $el) {
+      toggleLabel(obj, $el) {
         return $el.text().trim();
       },
       clicked: () => clickHandler($dropdown),

app/assets/javascripts/contextual_sidebar.js

@@ -5,7 +5,7 @@ import bp from './breakpoints';
 import { parseBoolean } from '~/lib/utils/common_utils';
 
 // NOTE: at 1200px nav sidebar should not overlap the content
-// https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/24555#note_134136110
+// https://gitlab.com/gitlab-org/gitlab-foss/merge_requests/24555#note_134136110
 const NAV_SIDEBAR_BREAKPOINT = 1200;
 
 export const SIDEBAR_COLLAPSED_CLASS = 'js-sidebar-collapsed';

app/assets/javascripts/create_cluster/eks_cluster/components/cluster_form_dropdown.vue

@@ -0,0 +1,182 @@
+<script>
+import DropdownSearchInput from '~/vue_shared/components/dropdown/dropdown_search_input.vue';
+import DropdownHiddenInput from '~/vue_shared/components/dropdown/dropdown_hidden_input.vue';
+import DropdownButton from '~/vue_shared/components/dropdown/dropdown_button.vue';
+
+export default {
+  components: {
+    DropdownButton,
+    DropdownSearchInput,
+    DropdownHiddenInput,
+  },
+  props: {
+    fieldName: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    placeholder: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    defaultValue: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    value: {
+      type: Object,
+      required: false,
+      default: () => null,
+    },
+    labelProperty: {
+      type: String,
+      required: false,
+      default: 'name',
+    },
+    valueProperty: {
+      type: String,
+      required: false,
+      default: 'value',
+    },
+    items: {
+      type: Array,
+      required: false,
+      default: () => [],
+    },
+    loading: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    disabled: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    loadingText: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    disabledText: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    hasErrors: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    errorMessage: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    searchFieldPlaceholder: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    emptyText: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    searchFn: {
+      type: Function,
+      required: false,
+      default: searchQuery => item => item.name.toLowerCase().indexOf(searchQuery) > -1,
+    },
+  },
+  data() {
+    return {
+      searchQuery: '',
+      selectedItem: null,
+    };
+  },
+  computed: {
+    toggleText() {
+      if (this.loading && this.loadingText) {
+        return this.loadingText;
+      }
+
+      if (this.disabled && this.disabledText) {
+        return this.disabledText;
+      }
+
+      if (!this.selectedItem) {
+        return this.placeholder;
+      }
+
+      return this.selectedItemLabel;
+    },
+    results() {
+      if (!this.items) {
+        return [];
+      }
+
+      return this.items.filter(this.searchFn(this.searchQuery));
+    },
+    selectedItemLabel() {
+      return this.selectedItem && this.selectedItem[this.labelProperty];
+    },
+    selectedItemValue() {
+      return (this.selectedItem && this.selectedItem[this.valueProperty]) || '';
+    },
+  },
+  methods: {
+    select(item) {
+      this.selectedItem = item;
+      this.$emit('input', item);
+    },
+  },
+};
+</script>
+
+<template>
+  <div>
+    <div class="js-gcp-machine-type-dropdown dropdown">
+      <dropdown-hidden-input :name="fieldName" :value="selectedItemValue" />
+      <dropdown-button
+        :class="{ 'border-danger': hasErrors }"
+        :is-disabled="disabled"
+        :is-loading="loading"
+        :toggle-text="toggleText"
+      />
+      <div class="dropdown-menu dropdown-select">
+        <dropdown-search-input v-model="searchQuery" :placeholder-text="searchFieldPlaceholder" />
+        <div class="dropdown-content">
+          <ul>
+            <li v-if="!results.length">
+              <span class="js-empty-text menu-item">
+                {{ emptyText }}
+              </span>
+            </li>
+            <li v-for="item in results" :key="item.id">
+              <button class="js-dropdown-item" type="button" @click.prevent="select(item)">
+                <slot name="item" :item="item">
+                  {{ item.name }}
+                </slot>
+              </button>
+            </li>
+          </ul>
+        </div>
+      </div>
+    </div>
+    <span
+      v-if="hasErrors && errorMessage"
+      :class="[
+        'form-text js-eks-dropdown-error-message',
+        {
+          'text-danger': hasErrors,
+          'text-muted': !hasErrors,
+        },
+      ]"
+    >
+      {{ errorMessage }}
+    </span>
+  </div>
+</template>

app/assets/javascripts/create_cluster/eks_cluster/components/create_eks_cluster.vue

@@ -0,0 +1,14 @@
+<script>
+import ServiceCredentialsForm from './service_credentials_form.vue';
+import EksClusterConfigurationForm from './eks_cluster_configuration_form.vue';
+
+export default {
+  components: {
+    ServiceCredentialsForm,
+    EksClusterConfigurationForm,
+  },
+};
+</script>
+<template>
+  <eks-cluster-configuration-form />
+</template>

app/assets/javascripts/create_cluster/eks_cluster/components/eks_cluster_configuration_form.vue

@@ -0,0 +1,25 @@
+<script>
+import RoleNameDropdown from './role_name_dropdown.vue';
+import SecurityGroupDropdown from './security_group_dropdown.vue';
+import SubnetDropdown from './subnet_dropdown.vue';
+import VPCDropdown from './vpc_dropdown.vue';
+
+export default {
+  components: {
+    RoleNameDropdown,
+    SecurityGroupDropdown,
+    SubnetDropdown,
+    VPCDropdown,
+  },
+};
+</script>
+<template>
+  <form name="eks-cluster-configuration-form">
+    <div class="form-group">
+      <label class="label-bold" name="role" for="eks-role">
+        {{ s__('ClusterIntegration|Role name') }}
+      </label>
+      <role-name-dropdown />
+    </div>
+  </form>
+</template>

app/assets/javascripts/create_cluster/eks_cluster/components/role_name_dropdown.vue

@@ -0,0 +1,53 @@
+<script>
+import { sprintf, s__ } from '~/locale';
+
+import ClusterFormDropdown from './cluster_form_dropdown.vue';
+
+export default {
+  components: {
+    ClusterFormDropdown,
+  },
+  props: {
+    roles: {
+      type: Array,
+      required: false,
+      default: () => [],
+    },
+    loading: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+  },
+  computed: {
+    helpText() {
+      return sprintf(
+        s__(
+          'ClusterIntegration|Select the IAM Role to allow Amazon EKS and the Kubernetes control plane to manage AWS resources on your behalf. To use a new role name, first create one on %{startLink}Amazon Web Services%{endLink}.',
+        ),
+        {
+          startLink:
+            '<a href="https://console.aws.amazon.com/iam/home?#roles" target="_blank" rel="noopener noreferrer">',
+          endLink: '</a>',
+        },
+        false,
+      );
+    },
+  },
+};
+</script>
+<template>
+  <div>
+    <cluster-form-dropdown
+      field-id="eks-role-name"
+      field-name="eks-role-name"
+      :items="roles"
+      :loading="loading"
+      :loading-text="s__('ClusterIntegration|Loading IAM Roles')"
+      :placeholder="s__('ClusterIntergation|Select role name')"
+      :search-field-placeholder="s__('ClusterIntegration|Search IAM Roles')"
+      :empty-text="s__('ClusterIntegration|No IAM Roles found')"
+    />
+    <p class="form-text text-muted" v-html="helpText"></p>
+  </div>
+</template>

app/assets/javascripts/create_cluster/eks_cluster/components/service_credentials_form.vue

@@ -0,0 +1,3 @@
+<template>
+  <form name="service-credentials-form"></form>
+</template>

app/assets/javascripts/create_cluster/eks_cluster/index.js

@@ -0,0 +1,19 @@
+import Vue from 'vue';
+import Vuex from 'vuex';
+import CreateEksCluster from './components/create_eks_cluster.vue';
+import createStore from './store';
+
+Vue.use(Vuex);
+
+export default () =>
+  new Vue({
+    el: '.js-create-eks-cluster-form-container',
+    store: createStore(),
+    components: {
+      CreateEksCluster,
+    },
+    data() {},
+    render(createElement) {
+      return createElement('create-eks-cluster');
+    },
+  });