New upstream version 12.8.6

.eslintrc.yml

@@ -10,9 +10,6 @@ globals:
   localStorage: false
   IS_EE: false
 plugins:
-  - import
-  - "@gitlab/i18n"
-  - "@gitlab/vue-i18n"
   - no-jquery
 settings:
   import/resolver:
@@ -42,21 +39,19 @@ rules:
   lines-between-class-members: off
   # Disabled for now, to make the plugin-vue 4.5 -> 5.0 update smoother
   vue/no-confusing-v-for-v-if: error
-  vue/no-unused-components: off
   vue/no-use-v-if-with-v-for: off
   vue/no-v-html: off
   vue/use-v-on-exact: off
-  no-jquery/no-animate: off
   # all offenses of no-jquery/no-animate-toggle are false positives ( $toast.show() )
   no-jquery/no-animate-toggle: off
   no-jquery/no-event-shorthand: off
-  no-jquery/no-fade: off
   no-jquery/no-serialize: error
-  no-jquery/no-sizzle: off
   promise/always-return: off
   promise/no-callback-in-promise: off
+  # Make update to eslint@6 smoother:
+  prefer-object-spread: off
 overrides:
-  files:
-    - '**/spec/**/*'
-  rules:
-    "@gitlab/i18n/no-non-i18n-strings": off
+  - files:
+      - '**/spec/**/*'
+    rules:
+      "@gitlab/i18n/no-non-i18n-strings": off

.gitignore

@@ -7,6 +7,7 @@
 .bundle
 .chef
 .directory
+.eslintcache
 /.envrc
 eslint-report.html
 /.gitlab_shell_secret
@@ -82,6 +83,9 @@ package-lock.json
 jsdoc/
 **/tmp/rubocop_cache/**
 .overcommit.yml
+.overcommit.yml.backup
 .projections.json
 /qa/.rakeTasks
 webpack-dev-server.json
+/.nvimrc
+.solargraph.yml

.gitlab-ci.yml

@@ -1,16 +1,14 @@
-image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-golang-1.12-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-postgresql-9.6-graphicsmagick-1.3.33"
+image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.5-golang-1.12-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.21-postgresql-9.6-graphicsmagick-1.3.34"
 
 stages:
   - sync
   - prepare
-  - quick-test
   - test
   - post-test
   - review-prepare
   - review
   - qa
   - post-qa
-  - notification
   - pages
 
 variables:
@@ -26,9 +24,6 @@ variables:
   ES_JAVA_OPTS: "-Xms256m -Xmx256m"
   ELASTIC_URL: "http://elastic:changeme@elasticsearch:9200"
 
-after_script:
-  - date
-
 include:
   - local: .gitlab/ci/cache-repo.gitlab-ci.yml
   - local: .gitlab/ci/cng.gitlab-ci.yml
@@ -36,13 +31,14 @@ include:
   - local: .gitlab/ci/frontend.gitlab-ci.yml
   - local: .gitlab/ci/global.gitlab-ci.yml
   - local: .gitlab/ci/memory.gitlab-ci.yml
-  - local: .gitlab/ci/notifications.gitlab-ci.yml
   - local: .gitlab/ci/pages.gitlab-ci.yml
   - local: .gitlab/ci/qa.gitlab-ci.yml
   - local: .gitlab/ci/reports.gitlab-ci.yml
   - local: .gitlab/ci/rails.gitlab-ci.yml
   - local: .gitlab/ci/review.gitlab-ci.yml
+  - local: .gitlab/ci/rules.gitlab-ci.yml
   - local: .gitlab/ci/setup.gitlab-ci.yml
+  - local: .gitlab/ci/dev-fixtures.gitlab-ci.yml
   - local: .gitlab/ci/test-metadata.gitlab-ci.yml
   - local: .gitlab/ci/yaml.gitlab-ci.yml
   - local: .gitlab/ci/releases.gitlab-ci.yml

.gitlab/CODEOWNERS

@@ -1,9 +1,13 @@
+# When adding a group as a code owner, make sure to invite the group to the
+# project here: https://gitlab.com/gitlab-org/gitlab/-/project_members
+# As described in https://docs.gitlab.com/ee/user/project/code_owners.html
+
 # Backend Maintainers are the default for all ruby files
 *.rb @gitlab-org/maintainers/rails-backend
 *.rake @gitlab-org/maintainers/rails-backend
 
-# Technical writing team are the default reviewers for everything in `doc/`
-/doc/ @gl-docsteam
+# Technical writing team are the default reviewers for all markdown docs
+*.md @gl-docsteam
 
 # Frontend maintainers should see everything in `app/assets/`
 app/assets/ @gitlab-org/maintainers/frontend
@@ -28,10 +32,17 @@ lib/gitlab/github_import/ @gitlab-org/maintainers/database
 /ee/app/models/project_alias.rb @patrickbajao
 /ee/lib/api/project_aliases.rb @patrickbajao
 
+# Quality owned files
+/qa/ @gl-quality
+
 # Engineering Productivity owned files
 /.gitlab-ci.yml @gl-quality/eng-prod
 /.gitlab/ci/ @gl-quality/eng-prod
+/.gitlab/CODEOWNERS @gl-quality/eng-prod
 Dangerfile @gl-quality/eng-prod
 /danger/ @gl-quality/eng-prod
 /lib/gitlab/danger/ @gl-quality/eng-prod
 /scripts/ @gl-quality/eng-prod
+
+# Delivery owner files
+/.gitlab/ci/releases.gitlab-ci.yml @gitlab-org/delivery

.gitlab/ci/cache-repo.gitlab-ci.yml

@@ -18,16 +18,20 @@
 # runner, or network egress charges will apply:
 # https://cloud.google.com/storage/pricing
 cache-repo:
-  extends:
-    - .only:variables_refs-canonical-dot-com-schedules
+  extends: .cache-repo:rules
   image: gcr.io/google.com/cloudsdktool/cloud-sdk:alpine
   stage: sync
   allow_failure: true
   variables:
-    GIT_DEPTH: 0
+    GIT_STRATEGY: none
     TAR_FILENAME: /tmp/gitlab-master.tar
   script:
+    - cd ..
+    - rm -rf $CI_PROJECT_NAME
+    - git clone --progress $CI_REPOSITORY_URL $CI_PROJECT_NAME
+    - cd $CI_PROJECT_NAME
     - gcloud auth activate-service-account --key-file=$CI_REPO_CACHE_CREDENTIALS
+    - git remote rm origin
     - tar cf $TAR_FILENAME .
     - gzip $TAR_FILENAME
     - gsutil cp $TAR_FILENAME.gz gs://gitlab-ci-git-repo-cache/project-$CI_PROJECT_ID/gitlab-master.tar.gz

.gitlab/ci/cng.gitlab-ci.yml

@@ -1,15 +1,11 @@
 cloud-native-image:
-  extends: .only:variables-canonical-dot-com
+  extends: .cng:rules
   image: ruby:2.6-alpine
   dependencies: []
   stage: post-test
   allow_failure: true
   variables:
     GIT_DEPTH: "1"
-  when: manual
   script:
     - install_gitlab_gem
     - CNG_PROJECT_PATH="gitlab-org/build/CNG" BUILD_TRIGGER_TOKEN=$CI_JOB_TOKEN ./scripts/trigger-build cng
-  only:
-    refs:
-      - tags

.gitlab/ci/dev-fixtures.gitlab-ci.yml

@@ -0,0 +1,35 @@
+.run-dev-fixtures:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg9
+  stage: test
+  needs: ["setup-test-env"]
+  dependencies: ["setup-test-env"]
+  variables:
+    FIXTURE_PATH: "db/fixtures/development"
+    SEED_CYCLE_ANALYTICS: "true"
+    SEED_PRODUCTIVITY_ANALYTICS: "true"
+    CYCLE_ANALYTICS_ISSUE_COUNT: 1
+    SIZE: 0 # number of external projects to fork, requires network connection
+    # SEED_NESTED_GROUPS: "false" # requires network connection
+
+run-dev-fixtures:
+  extends:
+    - .run-dev-fixtures
+    - .dev-fixtures:rules:ee-and-foss
+  script:
+    - scripts/gitaly-test-spawn
+    - RAILS_ENV=test bundle exec rake db:seed_fu
+
+run-dev-fixtures-ee:
+  extends:
+    - .run-dev-fixtures
+    - .dev-fixtures:rules:ee-only
+    - .use-pg9-ee
+  script:
+    - scripts/gitaly-test-spawn
+    - cp ee/db/fixtures/development/* $FIXTURE_PATH
+    - RAILS_ENV=test bundle exec rake db:seed_fu

.gitlab/ci/docs.gitlab-ci.yml

@@ -2,16 +2,16 @@
   extends:
     - .default-tags
     - .default-retry
-    - .only:variables-canonical-dot-com
-    - .only:changes-docs
-  only:
-    refs:
-      - merge_requests
+    - .docs:rules:review-docs
+  allow_failure: true
   image: ruby:2.6-alpine
   stage: review
   dependencies: []
   variables:
-    GIT_STRATEGY: none
+    # We're cloning the repo instead of downloading the script for now
+    # because some repos are private and CI_JOB_TOKEN cannot access files.
+    # See https://gitlab.com/gitlab-org/gitlab/issues/191273
+    GIT_DEPTH: 1
   environment:
     name: review-docs/$DOCS_GITLAB_REPO_SUFFIX-$CI_MERGE_REQUEST_IID
     # DOCS_REVIEW_APPS_DOMAIN and DOCS_GITLAB_REPO_SUFFIX are CI variables
@@ -19,11 +19,7 @@
     url: http://docs-preview-$DOCS_GITLAB_REPO_SUFFIX-$CI_MERGE_REQUEST_IID.$DOCS_REVIEW_APPS_DOMAIN/$DOCS_GITLAB_REPO_SUFFIX
     on_stop: review-docs-cleanup
   before_script:
-    # We don't clone the repo by using GIT_STRATEGY: none and only download the
-    # single script we need here so it's much faster than cloning.
     - apk add --update openssl
-    - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/trigger-build-docs
-    - chmod 755 trigger-build-docs
     - gem install httparty --no-document --version 0.17.3
     - gem install gitlab --no-document --version 4.13.0
 
@@ -32,8 +28,7 @@
 review-docs-deploy:
   extends: .review-docs
   script:
-    - ./trigger-build-docs deploy
-  when: manual
+    - ./scripts/trigger-build-docs deploy
 
 # Cleanup remote environment of gitlab-docs
 review-docs-cleanup:
@@ -42,16 +37,14 @@ review-docs-cleanup:
     name: review-docs/$DOCS_GITLAB_REPO_SUFFIX-$CI_MERGE_REQUEST_IID
     action: stop
   script:
-    - ./trigger-build-docs cleanup
-  when: manual
+    - ./scripts/trigger-build-docs cleanup
 
 docs lint:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-    - .only:changes-docs
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-docs-lint"
+    - .docs:rules:docs-lint
+  image: "registry.gitlab.com/gitlab-org/gitlab-docs:docs-lint"
   stage: test
   dependencies: []
   script:
@@ -70,13 +63,11 @@ docs lint:
 
 graphql-reference-verify:
   extends:
-    - .only-ee
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
     - .default-before_script
-    - .only:changes-code-backstage-qa
+    - .docs:rules:graphql-reference-verify
     - .use-pg9
   stage: test
   needs: ["setup-test-env"]

.gitlab/ci/frontend.gitlab-ci.yml

@@ -4,19 +4,17 @@
       - vendor/ruby/
       - .yarn-cache/
       - tmp/cache/assets/sprockets
+      - tmp/cache/babel-loader
+      - tmp/cache/vue-loader
 
 .gitlab:assets:compile-metadata:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
     - .default-before_script
     - .assets-compile-cache
-    - .only:changes-code-backstage-qa
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-graphicsmagick-1.3.33-docker-19.03.1
-  stage: test
-  dependencies: ["setup-test-env"]
-  needs: ["setup-test-env"]
+  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.5-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.21-graphicsmagick-1.3.34-docker-19.03.1
+  stage: prepare
   services:
     - docker:19.03.0-dind
   variables:
@@ -30,7 +28,7 @@
     DOCKER_DRIVER: overlay2
     DOCKER_HOST: tcp://docker:2375
   cache:
-    key: "assets-compile:production:vendor_ruby:.yarn-cache:tmp_cache_assets_sprockets:v6"
+    key: "assets-compile:production:vendor_ruby:.yarn-cache:tmp_cache_assets_sprockets:tmp_cache_webpack:v9"
   artifacts:
     name: webpack-report
     expire_in: 31d
@@ -45,24 +43,21 @@
     - time scripts/build_assets_image
     - scripts/clean-old-cached-assets
     - rm -f /etc/apt/sources.list.d/google*.list  # We don't need to update Chrome here
-  only:
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE =~ /^gitlab-org($|\/)/  # Matches the gitlab-org group and its subgroups
-      - $CI_SERVER_HOST == "dev.gitlab.org"
   tags:
     - gitlab-org
     - docker
 
 gitlab:assets:compile pull-push-cache:
-  extends: .gitlab:assets:compile-metadata
-  only:
-    refs:
-      - master
+  extends:
+    - .gitlab:assets:compile-metadata
+    - .frontend:rules:gitlab-assets-compile-pull-push-cache
   cache:
     policy: pull-push
 
 gitlab:assets:compile pull-cache:
-  extends: .gitlab:assets:compile-metadata
+  extends:
+    - .gitlab:assets:compile-metadata
+    - .frontend:rules:gitlab-assets-compile-pull-cache
   cache:
     policy: pull
 
@@ -70,10 +65,8 @@ gitlab:assets:compile pull-cache:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
     - .default-before_script
     - .assets-compile-cache
-    - .only:changes-code-backstage-qa
   stage: prepare
   script:
     - node --version
@@ -86,7 +79,7 @@ gitlab:assets:compile pull-cache:
     # we override the max_old_space_size to prevent OOM errors
     NODE_OPTIONS: --max_old_space_size=3584
   cache:
-    key: "assets-compile:v7"
+    key: "assets-compile:v9"
   artifacts:
     expire_in: 7d
     paths:
@@ -94,48 +87,49 @@ gitlab:assets:compile pull-cache:
       - public/assets
 
 compile-assets pull-push-cache:
-  extends: .compile-assets-metadata
-  only:
-    refs:
-      - master
+  extends:
+    - .compile-assets-metadata
+    - .frontend:rules:compile-assets-pull-push-cache
   cache:
     policy: pull-push
 
-compile-assets pull-push-cache foss:
-  extends: [".compile-assets-metadata", ".only-ee-as-if-foss"]
-  only:
-    refs:
-      - master
+compile-assets pull-push-cache as-if-foss:
+  extends:
+    - .compile-assets-metadata
+    - .frontend:rules:compile-assets-pull-push-cache-as-if-foss
+    - .as-if-foss
   cache:
     policy: pull-push
-    key: "assets-compile:v7:foss"
+    key: "assets-compile:v9:foss"
 
 compile-assets pull-cache:
-  extends: .compile-assets-metadata
+  extends:
+    - .compile-assets-metadata
+    - .frontend:rules:compile-assets-pull-cache
   cache:
     policy: pull
 
-compile-assets pull-cache foss:
-  extends: [".compile-assets-metadata", ".only-ee-as-if-foss"]
+compile-assets pull-cache as-if-foss:
+  extends:
+    - .compile-assets-metadata
+    - .frontend:rules:compile-assets-pull-cache-as-if-foss
+    - .as-if-foss
   cache:
     policy: pull
-    key: "assets-compile:v7:foss"
+    key: "assets-compile:v9:foss"
 
-.only-code-frontend-job-base:
+.frontend-job-base:
   extends:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
     - .default-before_script
-    - .only:changes-code-backstage
     - .use-pg9
   stage: test
   needs: ["setup-test-env", "compile-assets pull-cache"]
-  dependencies: ["setup-test-env", "compile-assets pull-cache"]
 
 .karma-base:
-  extends: .only-code-frontend-job-base
+  extends: .frontend-job-base
   variables:
     # we override the max_old_space_size to prevent OOM errors
     NODE_OPTIONS: --max_old_space_size=3584
@@ -147,7 +141,9 @@ compile-assets pull-cache foss:
     - bundle exec rake karma
 
 karma:
-  extends: .karma-base
+  extends:
+    - .karma-base
+    - .frontend:rules:default-frontend-jobs
   coverage: '/^Statements *: (\d+\.\d+%)/'
   artifacts:
     name: coverage-javascript
@@ -160,13 +156,14 @@ karma:
     reports:
       junit: junit_karma.xml
 
-karma-foss:
+karma-as-if-foss:
   extends:
     - .karma-base
-    - .only-ee-as-if-foss
+    - .frontend:rules:default-frontend-jobs-as-if-foss
+    - .as-if-foss
 
 .jest-base:
-  extends: .only-code-frontend-job-base
+  extends: .frontend-job-base
   script:
     - scripts/gitaly-test-spawn
     - date
@@ -180,7 +177,9 @@ karma-foss:
     policy: pull-push
 
 jest:
-  extends: .jest-base
+  extends:
+    - .jest-base
+    - .frontend:rules:default-frontend-jobs
   artifacts:
     name: coverage-frontend
     expire_in: 31d
@@ -192,10 +191,11 @@ jest:
     reports:
       junit: junit_jest.xml
 
-jest-foss:
+jest-as-if-foss:
   extends:
     - .jest-base
-    - .only-ee-as-if-foss
+    - .frontend:rules:default-frontend-jobs-as-if-foss
+    - .as-if-foss
   cache:
     policy: pull
 
@@ -204,8 +204,7 @@ jest-foss:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
-    - .only:changes-code-backstage
+    - .frontend:rules:qa-frontend-node
   stage: test
   dependencies: []
   cache:
@@ -237,11 +236,9 @@ webpack-dev-server:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
-    - .only:changes-code-backstage
+    - .frontend:rules:default-frontend-jobs
   stage: test
   needs: ["setup-test-env", "compile-assets pull-cache"]
-  dependencies: ["setup-test-env", "compile-assets pull-cache"]
   variables:
     WEBPACK_MEMORY_TEST: "true"
     WEBPACK_VENDOR_DLL: "true"

.gitlab/ci/global.gitlab-ci.yml

@@ -9,10 +9,13 @@
       - unknown_failure
       - api_failure
       - runner_system_failure
+      - job_execution_timeout
+      - stuck_or_timeout_failure
 
 .default-before_script:
   before_script:
     - date
+    - '[ "$FOSS_ONLY" = "1" ] && rm -rf ee/ qa/spec/ee/ qa/qa/specs/features/ee/ qa/qa/ee/ qa/qa/ee.rb'
     - export GOPATH=$CI_PROJECT_DIR/.go
     - mkdir -p $GOPATH
     - source scripts/utils.sh
@@ -22,7 +25,7 @@
 # Jobs that only need to pull cache
 .default-cache:
   cache:
-    key: "debian-stretch-ruby-2.6.3-node-12.x"
+    key: "debian-stretch-ruby-2.6.5-pg9.6-node-12.x"
     paths:
       - .go/pkg/mod
       - vendor/ruby
@@ -30,183 +33,18 @@
       - vendor/gitaly-ruby
     policy: pull
 
-.default-only:
-  only:
-    refs:
-      - master
-      - /^[\d-]+-stable(-ee)?$/
-      - /^\d+-\d+-auto-deploy-\d+$/
-      - /^security\//
-      - merge_requests
-      - tags
-
-.only:variables-canonical-dot-com:
-  only:
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE =~ /^gitlab-org($|\/)/  # Matches the gitlab-org group or its subgroups
-
-.only:variables_refs-canonical-dot-com-schedules:
-  extends: .only:variables-canonical-dot-com
-  only:
-    refs:
-      - schedules
-
-.except:refs-deploy:
-  except:
-    refs:
-      - /^\d+-\d+-auto-deploy-\d+$/
-
-.except:refs-master-tags-stable-deploy:
-  except:
-    refs:
-      - master
-      - tags
-      - /^[\d-]+-stable(-ee)?$/
-      - /^\d+-\d+-auto-deploy-\d+$/
-
-.only:kubernetes:
-  only:
-    kubernetes: active
-
-.only-review:
-  extends:
-    - .only:variables-canonical-dot-com
-    - .only:kubernetes
-    - .except:refs-master-tags-stable-deploy
-
-.only-review-schedules:
-  extends:
-    - .only:variables_refs-canonical-dot-com-schedules
-    - .only:kubernetes
-    - .except:refs-deploy
-
-.code-patterns: &code-patterns
-  - ".gitlab/ci/**/*"
-  - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
-  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
-  - ".csscomb.json"
-  - "Dockerfile.assets"
-  - "*_VERSION"
-  - "Gemfile{,.lock}"
-  - "Rakefile"
-  - "{babel.config,jest.config}.js"
-  - "config.ru"
-  - "{package.json,yarn.lock}"
-  - "{,ee/}{app,bin,config,db,haml_lint,lib,locale,public,scripts,symbol,vendor}/**/*"
-  - "doc/api/graphql/reference/*" # Files in this folder are auto-generated
-
-.backstage-patterns: &backstage-patterns
-  - "Dangerfile"
-  - "danger/**/*"
-  - "{,ee/}fixtures/**/*"
-  - "{,ee/}rubocop/**/*"
-  - "{,ee/}spec/**/*"
-  - "doc/README.md"  # Some RSpec test rely on this file
-
-.qa-patterns: &qa-patterns
-  - ".dockerignore"
-  - "qa/**/*"
-
-.docs-patterns: &docs-patterns
-  - ".gitlab/route-map.yml"
-  - "doc/**/*"
-  - ".markdownlint.json"
-
-.only:changes-code:
-  only:
-    changes: *code-patterns
-
-.only:changes-qa:
-  only:
-    changes: *qa-patterns
-
-.only:changes-docs:
-  only:
-    changes: *docs-patterns
-
-.only:changes-code-backstage:
-  only:
-    changes:
-      - ".gitlab/ci/**/*"
-      - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
-      - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
-      - ".csscomb.json"
-      - "Dockerfile.assets"
-      - "*_VERSION"
-      - "Gemfile{,.lock}"
-      - "Rakefile"
-      - "{babel.config,jest.config}.js"
-      - "config.ru"
-      - "{package.json,yarn.lock}"
-      - "{,ee/}{app,bin,config,db,haml_lint,lib,locale,public,scripts,symbol,vendor}/**/*"
-      - "doc/api/graphql/reference/*" # Files in this folder are auto-generated
-      # Backstage changes
-      - "Dangerfile"
-      - "danger/**/*"
-      - "{,ee/}fixtures/**/*"
-      - "{,ee/}rubocop/**/*"
-      - "{,ee/}spec/**/*"
-      - "doc/README.md"  # Some RSpec test rely on this file
-
-.only:changes-code-qa:
-  only:
-    changes:
-      - ".gitlab/ci/**/*"
-      - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
-      - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
-      - ".csscomb.json"
-      - "Dockerfile.assets"
-      - "*_VERSION"
-      - "Gemfile{,.lock}"
-      - "Rakefile"
-      - "{babel.config,jest.config}.js"
-      - "config.ru"
-      - "{package.json,yarn.lock}"
-      - "{,ee/}{app,bin,config,db,haml_lint,lib,locale,public,scripts,symbol,vendor}/**/*"
-      - "doc/api/graphql/reference/*" # Files in this folder are auto-generated
-      # QA changes
-      - ".dockerignore"
-      - "qa/**/*"
-
-.only:changes-code-backstage-qa:
-  only:
-    changes:
-      - ".gitlab/ci/**/*"
-      - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
-      - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
-      - ".csscomb.json"
-      - "Dockerfile.assets"
-      - "*_VERSION"
-      - "Gemfile{,.lock}"
-      - "Rakefile"
-      - "{babel.config,jest.config}.js"
-      - "config.ru"
-      - "{package.json,yarn.lock}"
-      - "{,ee/}{app,bin,config,db,haml_lint,lib,locale,public,scripts,symbol,vendor}/**/*"
-      - "doc/api/graphql/reference/*" # Files in this folder are auto-generated
-      # Backstage changes
-      - "Dangerfile"
-      - "danger/**/*"
-      - "{,ee/}fixtures/**/*"
-      - "{,ee/}rubocop/**/*"
-      - "{,ee/}spec/**/*"
-      - "doc/README.md"  # Some RSpec test rely on this file
-      # QA changes
-      - ".dockerignore"
-      - "qa/**/*"
-
 .use-pg9:
   services:
-    - name: postgres:9.6
+    - name: postgres:9.6.17
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
     - name: redis:alpine
   variables:
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg10:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-golang-1.12-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-postgresql-10-graphicsmagick-1.3.33"
+  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.5-golang-1.12-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.21-postgresql-10-graphicsmagick-1.3.34"
   services:
-    - name: postgres:10.9
+    - name: postgres:10.12
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
     - name: redis:alpine
   variables:
@@ -214,30 +52,23 @@
 
 .use-pg9-ee:
   services:
-    - name: postgres:9.6
+    - name: postgres:9.6.17
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
     - name: redis:alpine
-    - name: elasticsearch:5.6.12
+    - name: elasticsearch:6.4.2
   variables:
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg10-ee:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-golang-1.12-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-postgresql-10-graphicsmagick-1.3.33"
+  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.5-golang-1.12-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.21-postgresql-10-graphicsmagick-1.3.34"
   services:
-    - name: postgres:10.9
+    - name: postgres:10.12
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
     - name: redis:alpine
-    - name: elasticsearch:5.6.12
+    - name: elasticsearch:6.4.2
   variables:
     POSTGRES_HOST_AUTH_METHOD: trust
 
-.only-ee:
-  only:
-    variables:
-      - $CI_PROJECT_NAME == "gitlab"
-      - $CI_PROJECT_NAME == "gitlab-ee"  # Support former project name for forks/mirrors
-
-.only-ee-as-if-foss:
-  extends: .only-ee
+.as-if-foss:
   variables:
     FOSS_ONLY: '1'

.gitlab/ci/memory.gitlab-ci.yml

@@ -3,9 +3,8 @@
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
     - .default-before_script
-    - .only:changes-code
+    - .memory:rules
 
 memory-static:
   extends: .only-code-memory-job-base

.gitlab/ci/notifications.gitlab-ci.yml

@@ -1,23 +0,0 @@
-.notify:
-  image: ruby:2.6-alpine
-  stage: notification
-  dependencies: []
-  cache: {}
-  before_script:
-    - apk update && apk add git curl bash
-    - source scripts/utils.sh
-    - source scripts/notifications.sh
-    - install_gitlab_gem
-  variables:
-    COMMIT_NOTES_URL: "https://${CI_SERVER_HOST}/${CI_PROJECT_PATH}/commit/${CI_COMMIT_SHA}#notes-list"
-
-schedule:package-and-qa:notify-failure:
-  extends:
-    - .only:variables_refs-canonical-dot-com-schedules
-    - .notify
-  script:
-    - 'export NOTIFICATION_MESSAGE=":skull_and_crossbones: Scheduled QA against master failed! :skull_and_crossbones: See ${CI_PIPELINE_URL}. For downstream pipelines, see ${COMMIT_NOTES_URL}"'
-    - 'notify_on_job_failure schedule:package-and-qa qa-master "${NOTIFICATION_MESSAGE}" ci_failing'
-  needs: ["schedule:package-and-qa"]
-  allow_failure: true
-  when: always

.gitlab/ci/pages.gitlab-ci.yml

@@ -3,12 +3,7 @@ pages:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
-    - .only:variables-canonical-dot-com
-    - .only:changes-code-backstage-qa
-  only:
-    refs:
-      - master
+    - .pages:rules
   stage: pages
   dependencies: ["coverage", "karma", "gitlab:assets:compile pull-cache"]
   script:

.gitlab/ci/qa.gitlab-ci.yml

@@ -2,8 +2,6 @@
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-    - .only:changes-code-qa
   stage: test
   dependencies: []
   cache:
@@ -11,24 +9,38 @@
     paths:
       - vendor/ruby
   before_script:
+    - '[ "$FOSS_ONLY" = "1" ] && rm -rf ee/ qa/spec/ee/ qa/qa/specs/features/ee/ qa/qa/ee/ qa/qa/ee.rb'
     - cd qa/
     - bundle install --clean --jobs=$(nproc) --path=vendor --retry=3 --quiet
     - bundle check
 
 qa:internal:
-  extends: .qa-job-base
+  extends:
+    - .qa-job-base
+    - .qa:rules:ee-and-foss
+  script:
+    - bundle exec rspec
+
+qa:internal-as-if-foss:
+  extends:
+    - .qa-job-base
+    - .qa:rules:ee-only
+    - .as-if-foss
   script:
     - bundle exec rspec
 
 qa:selectors:
-  extends: .qa-job-base
+  extends:
+    - .qa-job-base
+    - .qa:rules:ee-and-foss
   script:
     - bundle exec bin/qa Test::Sanity::Selectors
 
-qa:selectors-foss:
+qa:selectors-as-if-foss:
   extends:
     - qa:selectors
-    - .only-ee-as-if-foss
+    - .qa:rules:ee-only
+    - .as-if-foss
 
 .package-and-qa-base:
   image: ruby:2.6-alpine
@@ -40,30 +52,9 @@ qa:selectors-foss:
     - install_gitlab_gem
     - ./scripts/trigger-build omnibus
 
-package-and-qa-manual:
-  extends:
-    - .package-and-qa-base
-    - .default-only
-    - .only:variables-canonical-dot-com
-    - .except:refs-deploy
-    - .only:changes-code
-  when: manual
-  needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
-
 package-and-qa:
   extends:
     - .package-and-qa-base
-    - .default-only
-    - .only:variables-canonical-dot-com
-    - .except:refs-master-tags-stable-deploy
-    - .only:changes-qa
-  needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
-  allow_failure: true
-
-schedule:package-and-qa:
-  extends:
-    - .package-and-qa-base
-    - .default-only
-    - .only:variables_refs-canonical-dot-com-schedules
+    - .qa:rules:package-and-qa
   needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
   allow_failure: true

.gitlab/ci/rails.gitlab-ci.yml

@@ -1,41 +1,23 @@
-.only-master:
-  only:
-    refs:
-      - master
+.rails:needs:setup-and-assets:
+  needs:
+    - job: setup-test-env
+      artifacts: true
+    - job: compile-assets pull-cache
+      artifacts: true
 
-.rake-exec:
+.rails-job-base:
   extends:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
     - .default-before_script
-  variables:
-    SETUP_DB: "false"
-  script:
-    - bundle exec rake $CI_JOB_NAME
-
-.only-code-rails-job-base:
-  extends:
-    - .default-tags
-    - .default-retry
-    - .default-cache
-    - .default-only
-    - .default-before_script
-    - .only:changes-code-backstage
-
-.only-code-qa-rails-job-base:
-  extends:
-    - .default-tags
-    - .default-retry
-    - .default-cache
-    - .default-only
-    - .default-before_script
-    - .only:changes-code-backstage-qa
 
+####################
+# ee and foss jobs #
 setup-test-env:
   extends:
-    - .only-code-qa-rails-job-base
+    - .rails-job-base
+    - .rails:rules:default-refs-code-backstage-qa
     - .use-pg9
   stage: prepare
   script:
@@ -50,14 +32,48 @@ setup-test-env:
   cache:
     policy: pull-push
 
-.rspec-base:
-  extends: .only-code-rails-job-base
+static-analysis:
+  extends:
+    - .rails-job-base
+    - .rails:rules:default-refs-code-backstage-qa
+    - .rails:needs:setup-and-assets
   stage: test
-  needs: ["setup-test-env", "retrieve-tests-metadata", "compile-assets pull-cache"]
-  dependencies: ["setup-test-env", "retrieve-tests-metadata", "compile-assets pull-cache"]
+  variables:
+    SETUP_DB: "false"
+  parallel: 2
+  script:
+    - scripts/static-analysis
+  cache:
+    key: "debian-stretch-ruby-2.6-pg9.6-rubocop"
+    paths:
+      - vendor/ruby
+      - tmp/rubocop_cache
+    policy: pull-push
+
+downtime_check:
+  extends:
+    - .rails-job-base
+    - .rails:needs:setup-and-assets
+    - .rails:rules:downtime_check
+  stage: test
+  variables:
+    SETUP_DB: "false"
+  script:
+    - bundle exec rake downtime_check
+
+.rspec-base:
+  extends: .rails-job-base
+  stage: test
+  needs:
+    - job: setup-test-env
+      artifacts: true
+    - job: retrieve-tests-metadata
+      artifacts: true
+    - job: compile-assets pull-cache
+      artifacts: true
   script:
     - source scripts/rspec_helpers.sh
-    - rspec_paralellized_job "--tag ~quarantine --tag ~geo"
+    - rspec_paralellized_job "--tag ~quarantine --tag ~geo --tag ~level:migration"
   artifacts:
     expire_in: 31d
     when: always
@@ -68,169 +84,14 @@ setup-test-env:
       - rspec_profiling/
       - tmp/capybara/
       - tmp/memory_test/
+      - junit_rspec.xml
     reports:
       junit: junit_rspec.xml
 
-.rspec-base-foss:
-  extends: [".rspec-base", ".only-ee-as-if-foss"]
-  needs: ["setup-test-env", "retrieve-tests-metadata", "compile-assets pull-cache foss"]
-  dependencies: ["setup-test-env", "retrieve-tests-metadata", "compile-assets pull-cache foss"]
-
-.rspec-base-pg9:
+.rspec-base-quarantine:
   extends:
     - .rspec-base
     - .use-pg9
-
-.rspec-base-pg9-foss:
-  extends:
-    - .rspec-base-foss
-    - .use-pg9
-
-.rspec-base-pg10:
-  extends:
-    - .rspec-base
-    - .use-pg10
-    - .only-master
-
-rspec migration pg9:
-  extends: .rspec-base-pg9
-  parallel: 4
-
-rspec migration pg9-foss:
-  extends: .rspec-base-pg9-foss
-  parallel: 4
-
-rspec unit pg9:
-  extends: .rspec-base-pg9
-  parallel: 20
-
-rspec unit pg9-foss:
-  extends: .rspec-base-pg9-foss
-  parallel: 20
-
-rspec integration pg9:
-  extends: .rspec-base-pg9
-  parallel: 6
-
-rspec integration pg9-foss:
-  extends: .rspec-base-pg9-foss
-  parallel: 6
-
-rspec system pg9:
-  extends: .rspec-base-pg9
-  parallel: 24
-
-rspec system pg9-foss:
-  extends: .rspec-base-pg9-foss
-  parallel: 24
-
-rspec unit pg10:
-  extends: .rspec-base-pg10
-  parallel: 20
-
-rspec integration pg10:
-  extends: .rspec-base-pg10
-  parallel: 6
-
-rspec system pg10:
-  extends: .rspec-base-pg10
-  parallel: 24
-
-.rspec-ee-base-pg9:
-  extends:
-    - .rspec-base
-    - .only-ee
-    - .use-pg9-ee
-
-.rspec-ee-base-pg10:
-  extends:
-    - .rspec-base
-    - .only-ee
-    - .use-pg10-ee
-
-rspec-ee migration pg9:
-  extends: .rspec-ee-base-pg9
-  parallel: 2
-
-rspec-ee unit pg9:
-  extends: .rspec-ee-base-pg9
-  parallel: 5
-
-rspec-ee integration pg9:
-  extends: .rspec-ee-base-pg9
-  parallel: 3
-
-rspec-ee system pg9:
-  extends: .rspec-ee-base-pg9
-  parallel: 5
-
-rspec-ee migration pg10:
-  extends:
-    - .rspec-ee-base-pg10
-    - .only-master
-  parallel: 2
-
-rspec-ee unit pg10:
-  extends:
-    - .rspec-ee-base-pg10
-    - .only-master
-  parallel: 5
-
-rspec-ee integration pg10:
-  extends:
-    - .rspec-ee-base-pg10
-    - .only-master
-  parallel: 3
-
-rspec-ee system pg10:
-  extends:
-    - .rspec-ee-base-pg10
-    - .only-master
-  parallel: 5
-
-.rspec-ee-base-geo:
-  extends:
-    - .rspec-base
-    - .only-ee
-  script:
-    - source scripts/rspec_helpers.sh
-    - scripts/prepare_postgres_fdw.sh
-    - rspec_paralellized_job "--tag ~quarantine --tag geo"
-
-.rspec-ee-base-geo-pg9:
-  extends:
-    - .rspec-ee-base-geo
-    - .use-pg9-ee
-
-.rspec-ee-base-geo-pg10:
-  extends:
-    - .rspec-ee-base-geo
-    - .use-pg10-ee
-
-rspec-ee unit pg9 geo:
-  extends: .rspec-ee-base-geo-pg9
-  parallel: 2
-
-rspec-ee integration pg9 geo:
-  extends: .rspec-ee-base-geo-pg9
-
-rspec-ee system pg9 geo:
-  extends: .rspec-ee-base-geo-pg9
-
-rspec-ee unit pg10 geo:
-  extends: .rspec-ee-base-geo-pg10
-  parallel: 2
-
-rspec-ee integration pg10 geo:
-  extends: .rspec-ee-base-geo-pg10
-
-rspec-ee system pg10 geo:
-  extends: .rspec-ee-base-geo-pg10
-
-rspec quarantine pg9:
-  extends:
-    - .rspec-base-pg9
-    - .only-master
   variables:
     RSPEC_OPTS: "--tag quarantine -- spec/"
   script:
@@ -238,53 +99,50 @@ rspec quarantine pg9:
     - rspec_simple_job "${RSPEC_OPTS}"
   allow_failure: true
 
-rspec-ee quarantine pg9:
+.rspec-base-pg9:
   extends:
-    - rspec quarantine pg9
-    - .only-ee
-  variables:
-    RSPEC_OPTS: "--tag quarantine -- ee/spec/"
+    - .rspec-base
+    - .rails:rules:ee-and-foss
+    - .use-pg9
+
+.rspec-base-migration:
+  script:
+    - source scripts/rspec_helpers.sh
+    - rspec_paralellized_job "--tag ~quarantine --tag ~geo --tag level:migration"
+
+rspec migration pg9:
+  extends:
+    - .rspec-base-pg9
+    - .rspec-base-migration
+  parallel: 5
+
+rspec unit pg9:
+  extends: .rspec-base-pg9
+  parallel: 20
+
+rspec integration pg9:
+  extends: .rspec-base-pg9
+  parallel: 8
+
+rspec system pg9:
+  extends: .rspec-base-pg9
+  parallel: 24
 
 rspec fast_spec_helper:
   extends: .rspec-base-pg9
   script:
     - bin/rspec spec/fast_spec_helper.rb
 
-static-analysis:
-  extends: .only-code-qa-rails-job-base
-  stage: test
-  needs: ["setup-test-env", "compile-assets pull-cache"]
-  dependencies: ["setup-test-env", "compile-assets pull-cache"]
-  variables:
-    SETUP_DB: "false"
-  parallel: 2
-  script:
-    - scripts/static-analysis
-  cache:
-    key: "debian-stretch-ruby-2.6.3-and-rubocop"
-    paths:
-      - vendor/ruby
-      - tmp/rubocop_cache
-    policy: pull-push
-
-downtime_check:
-  extends:
-    - .rake-exec
-    - .only:changes-code-backstage
-    - .except:refs-master-tags-stable-deploy
-  stage: test
-  needs: ["setup-test-env"]
-  dependencies: ["setup-test-env"]
-
 .db-job-base:
   extends:
-    - .only-code-rails-job-base
+    - .rails-job-base
+    - .rails:rules:ee-and-foss
     - .use-pg9
   stage: test
-  needs: ["setup-test-env"]
-  dependencies: ["setup-test-env"]
+  needs:
+    - job: setup-test-env
+      artifacts: true
 
-# DB migration, rollback, and seed jobs
 db:migrate:reset:
   extends: .db-job-base
   script:
@@ -345,12 +203,14 @@ gitlab:setup:
       - log/development.log
 
 coverage:
-  extends: .only-code-rails-job-base
-  cache:
-    policy: pull
+  extends:
+    - .rails-job-base
+    - .rails:rules:ee-and-foss
+  stage: post-test
   variables:
     SETUP_DB: "false"
-  stage: post-test
+  cache:
+    policy: pull
   script:
     - bundle exec scripts/merge-simplecov
     - bundle exec scripts/gather-test-memory-data
@@ -362,11 +222,181 @@ coverage:
       - coverage/index.html
       - coverage/assets/
       - tmp/memory_test/
+# ee and foss jobs #
+####################
+
+####################
+# master-only jobs #
+rspec quarantine pg9:
+  extends:
+    - .rspec-base-quarantine
+    - .rails:rules:master-refs-code-backstage
+
+.rspec-base-pg10:
+  extends:
+    - .rspec-base
+    - .rails:rules:master-refs-code-backstage
+    - .use-pg10
+
+rspec unit pg10:
+  extends: .rspec-base-pg10
+  parallel: 20
+
+rspec integration pg10:
+  extends: .rspec-base-pg10
+  parallel: 8
+
+rspec system pg10:
+  extends: .rspec-base-pg10
+  parallel: 24
+# master-only jobs #
+####################
+
+#########################
+# ee + master-only jobs #
+rspec-ee quarantine pg9:
+  extends:
+    - .rspec-base-quarantine
+    - .rails:rules:master-refs-code-backstage-ee-only
+  variables:
+    RSPEC_OPTS: "--tag quarantine -- ee/spec/"
+
+rspec-ee migration pg10:
+  extends:
+    - .rspec-ee-base-pg10
+    - .rspec-base-migration
+    - .rails:rules:master-refs-code-backstage
+  parallel: 2
+
+rspec-ee unit pg10:
+  extends:
+    - .rspec-ee-base-pg10
+    - .rails:rules:master-refs-code-backstage
+  parallel: 10
+
+rspec-ee integration pg10:
+  extends:
+    - .rspec-ee-base-pg10
+    - .rails:rules:master-refs-code-backstage
+  parallel: 4
+
+rspec-ee system pg10:
+  extends:
+    - .rspec-ee-base-pg10
+    - .rails:rules:master-refs-code-backstage
+  parallel: 6
+# ee + master-only jobs #
+#########################
+
+#################
+# ee-only jobs #
+.rspec-base-ee:
+  extends:
+    - .rspec-base
+    - .rails:rules:ee-only
+
+.rspec-base-pg9-as-if-foss:
+  extends:
+    - .rspec-base-ee
+    - .as-if-foss
+    - .use-pg9
+  needs:
+    - job: setup-test-env
+      artifacts: true
+    - job: retrieve-tests-metadata
+      artifacts: true
+    - job: compile-assets pull-cache as-if-foss
+      artifacts: true
+
+.rspec-ee-base-pg9:
+  extends:
+    - .rspec-base-ee
+    - .use-pg9-ee
+
+.rspec-ee-base-pg10:
+  extends:
+    - .rspec-base-ee
+    - .use-pg10-ee
+
+rspec migration pg9-as-if-foss:
+  extends:
+    - .rspec-base-pg9-as-if-foss
+    - .rspec-base-migration
+  parallel: 5
+
+rspec unit pg9-as-if-foss:
+  extends: .rspec-base-pg9-as-if-foss
+  parallel: 20
+
+rspec integration pg9-as-if-foss:
+  extends: .rspec-base-pg9-as-if-foss
+  parallel: 8
+
+rspec system pg9-as-if-foss:
+  extends: .rspec-base-pg9-as-if-foss
+  parallel: 24
+
+rspec-ee migration pg9:
+  extends:
+    - .rspec-ee-base-pg9
+    - .rspec-base-migration
+  parallel: 2
+
+rspec-ee unit pg9:
+  extends: .rspec-ee-base-pg9
+  parallel: 10
+
+rspec-ee integration pg9:
+  extends: .rspec-ee-base-pg9
+  parallel: 4
+
+rspec-ee system pg9:
+  extends: .rspec-ee-base-pg9
+  parallel: 6
+
+.rspec-ee-base-geo:
+  extends: .rspec-base-ee
+  script:
+    - source scripts/rspec_helpers.sh
+    - scripts/prepare_postgres_fdw.sh
+    - rspec_paralellized_job "--tag ~quarantine --tag geo"
+
+.rspec-ee-base-geo-pg9:
+  extends:
+    - .rspec-ee-base-geo
+    - .use-pg9-ee
+
+.rspec-ee-base-geo-pg10:
+  extends:
+    - .rspec-ee-base-geo
+    - .use-pg10-ee
+
+rspec-ee unit pg9 geo:
+  extends: .rspec-ee-base-geo-pg9
+  parallel: 2
+
+rspec-ee integration pg9 geo:
+  extends: .rspec-ee-base-geo-pg9
+
+rspec-ee system pg9 geo:
+  extends: .rspec-ee-base-geo-pg9
+
+rspec-ee unit pg10 geo:
+  extends: .rspec-ee-base-geo-pg10
+  parallel: 2
+
+rspec-ee integration pg10 geo:
+  extends: .rspec-ee-base-geo-pg10
+
+rspec-ee system pg10 geo:
+  extends: .rspec-ee-base-geo-pg10
 
 db:rollback geo:
   extends:
     - db:rollback
-    - .only-ee
+    - .rails:rules:ee-only
   script:
     - bundle exec rake geo:db:migrate VERSION=20170627195211
     - bundle exec rake geo:db:migrate
+# ee-only jobs #
+################

.gitlab/ci/releases.gitlab-ci.yml

@@ -1,5 +1,3 @@
----
-
 # Syncs any changes pushed to a stable branch to the corresponding
 # gitlab-foss/CE stable branch. We run this prior to any tests so that random
 # failures don't prevent a sync.
@@ -9,28 +7,22 @@
   image: alpine:edge
   stage: sync
   before_script:
-    - apk add --no-cache --update curl bash
-  after_script: []
+    - apk add --no-cache --update curl bash jq
   script:
     - bash scripts/sync-stable-branch.sh
-  only:
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com"
 
 sync-stable-branch:
-  extends: .merge-train-sync
+  extends:
+    - .releases:rules:canonical-dot-com-gitlab-stable-branch-only
+    - .merge-train-sync
   variables:
     SOURCE_PROJECT: gitlab-org/gitlab
     TARGET_PROJECT: gitlab-org/gitlab-foss
-  only:
-    refs:
-      - /^[\d-]+-stable-ee$/@gitlab-org/gitlab
 
 sync-security-branch:
-  extends: .merge-train-sync
+  extends:
+    - .releases:rules:canonical-dot-com-security-gitlab-stable-branch-only
+    - .merge-train-sync
   variables:
     SOURCE_PROJECT: gitlab-org/security/gitlab
     TARGET_PROJECT: gitlab-org/security/gitlab-foss
-  only:
-    refs:
-      - /^[\d-]+-stable-ee$/@gitlab-org/security/gitlab

.gitlab/ci/reports.gitlab-ci.yml

@@ -1,5 +1,5 @@
 # include:
-#   - template: Code-Quality.gitlab-ci.yml
+#   - template: Jobs/Code-Quality.gitlab-ci.yml
 #   - template: Security/SAST.gitlab-ci.yml
 #   - template: Security/Dependency-Scanning.gitlab-ci.yml
 #   - template: Security/DAST.gitlab-ci.yml
@@ -10,8 +10,7 @@
 code_quality:
   extends:
     - .default-retry
-    - .default-only
-    - .only:changes-code-backstage
+    - .reports:rules:code_quality
   stage: test
   image: docker:stable
   allow_failure: true
@@ -20,7 +19,7 @@ code_quality:
   variables:
     DOCKER_DRIVER: overlay2
     DOCKER_TLS_CERTDIR: ""
-    CODE_QUALITY_IMAGE: "registry.gitlab.com/gitlab-org/security-products/codequality:12-5-stable"
+    CODE_QUALITY_IMAGE: "registry.gitlab.com/gitlab-org/security-products/codequality:0.85.6"
   script:
     - |
       if ! docker info &>/dev/null; then
@@ -38,12 +37,9 @@ code_quality:
     reports:
       codequality: gl-code-quality-report.json
     paths:
-      - gl-code-quality-report.json
-    expire_in: 1 week
+      - gl-code-quality-report.json  # GitLab-specific
+    expire_in: 1 week  # GitLab-specific
   dependencies: []
-  except:
-    variables:
-      - $CODE_QUALITY_DISABLED
 
 # We need to duplicate this job's definition because it seems it's impossible to
 # override an included `only.refs`.
@@ -53,16 +49,22 @@ code_quality:
 sast:
   extends:
     - .default-retry
-    - .default-only
-    - .only:changes-code-backstage-qa
+    - .reports:rules:sast
   stage: test
+  allow_failure: true
+  dependencies: []  # GitLab-specific
+  artifacts:
+    paths:
+      - gl-sast-report.json  # GitLab-specific
+    reports:
+      sast: gl-sast-report.json
+    expire_in: 1 week  # GitLab-specific
   image: docker:stable
   variables:
     DOCKER_DRIVER: overlay2
     DOCKER_TLS_CERTDIR: ""
-    SAST_BRAKEMAN_LEVEL: 2
-    SAST_EXCLUDED_PATHS: qa,spec,doc,ee/spec
-  allow_failure: true
+    SAST_BRAKEMAN_LEVEL: 2  # GitLab-specific
+    SAST_EXCLUDED_PATHS: qa,spec,doc,ee/spec  # GitLab-specific
   services:
     - docker:stable-dind
   script:
@@ -73,61 +75,12 @@ sast:
           export DOCKER_HOST='tcp://localhost:2375'
         fi
       fi
-    - | # this is required to avoid undesirable reset of Docker image ENV variables being set on build stage
-      function propagate_env_vars() {
-        CURRENT_ENV=$(printenv)
-
-        for VAR_NAME; do
-          echo $CURRENT_ENV | grep "${VAR_NAME}=" > /dev/null && echo "--env $VAR_NAME "
-        done
-      }
     - |
-      docker run \
-        $(propagate_env_vars \
-          SAST_BANDIT_EXCLUDED_PATHS \
-          SAST_ANALYZER_IMAGES \
-          SAST_ANALYZER_IMAGE_PREFIX \
-          SAST_ANALYZER_IMAGE_TAG \
-          SAST_DEFAULT_ANALYZERS \
-          SAST_PULL_ANALYZER_IMAGES \
-          SAST_BRAKEMAN_LEVEL \
-          SAST_FLAWFINDER_LEVEL \
-          SAST_GITLEAKS_ENTROPY_LEVEL \
-          SAST_GOSEC_LEVEL \
-          SAST_EXCLUDED_PATHS \
-          SAST_DOCKER_CLIENT_NEGOTIATION_TIMEOUT \
-          SAST_PULL_ANALYZER_IMAGE_TIMEOUT \
-          SAST_RUN_ANALYZER_TIMEOUT \
-          SAST_JAVA_VERSION \
-          ANT_HOME \
-          ANT_PATH \
-          GRADLE_PATH \
-          JAVA_OPTS \
-          JAVA_PATH \
-          JAVA_8_VERSION \
-          JAVA_11_VERSION \
-          MAVEN_CLI_OPTS \
-          MAVEN_PATH \
-          MAVEN_REPO_PATH \
-          SBT_PATH \
-          FAIL_NEVER \
-        ) \
+      ENVS=`printenv | grep -vE '^(DOCKER_|CI|GITLAB_|FF_|HOME|PWD|OLDPWD|PATH|SHLVL|HOSTNAME)' | sed -n '/^[^\t]/s/=.*//p' | sed '/^$/d' | sed 's/^/-e /g' | tr '\n' ' '`
+      docker run "$ENVS" \
         --volume "$PWD:/code" \
         --volume /var/run/docker.sock:/var/run/docker.sock \
         "registry.gitlab.com/gitlab-org/security-products/sast:$SAST_VERSION" /app/bin/run /code
-  artifacts:
-    expire_in: 7 days
-    paths:
-      - gl-sast-report.json
-    reports:
-      sast: gl-sast-report.json
-  dependencies: []
-  only:
-    variables:
-      - $GITLAB_FEATURES =~ /\bsast\b/
-  except:
-    variables:
-      - $SAST_DISABLED
 
 # We need to duplicate this job's definition because it seems it's impossible to
 # override an included `only.refs`.
@@ -135,13 +88,13 @@ sast:
 dependency_scanning:
   extends:
     - .default-retry
-    - .default-only
-    - .only:changes-code-backstage-qa
+    - .reports:rules:dependency_scanning
   stage: test
   image: docker:stable
   variables:
     DOCKER_DRIVER: overlay2
     DOCKER_TLS_CERTDIR: ""
+    DS_EXCLUDED_PATHS: "qa/qa/ee/fixtures/secure_premade_reports,spec,ee/spec"  # GitLab-specific
   allow_failure: true
   services:
     - docker:stable-dind
@@ -173,23 +126,29 @@ dependency_scanning:
           DS_PULL_ANALYZER_IMAGE_TIMEOUT \
           DS_RUN_ANALYZER_TIMEOUT \
           DS_PYTHON_VERSION \
+          DS_PIP_VERSION \
           DS_PIP_DEPENDENCY_PATH \
+          GEMNASIUM_DB_LOCAL_PATH \
+          GEMNASIUM_DB_REMOTE_URL \
+          GEMNASIUM_DB_REF_NAME \
           PIP_INDEX_URL \
           PIP_EXTRA_INDEX_URL \
+          PIP_REQUIREMENTS_FILE \
+          MAVEN_CLI_OPTS \
+          BUNDLER_AUDIT_UPDATE_DISABLED \
+          BUNDLER_AUDIT_ADVISORY_DB_URL \
+          BUNDLER_AUDIT_ADVISORY_DB_REF_NAME \
         ) \
         --volume "$PWD:/code" \
         --volume /var/run/docker.sock:/var/run/docker.sock \
         "registry.gitlab.com/gitlab-org/security-products/dependency-scanning:$DS_VERSION" /code
   artifacts:
+    paths:
+      - gl-dependency-scanning-report.json  # GitLab-specific
     reports:
       dependency_scanning: gl-dependency-scanning-report.json
+    expire_in: 1 week  # GitLab-specific
   dependencies: []
-  only:
-    variables:
-      - $GITLAB_FEATURES =~ /\bdependency_scanning\b/
-  except:
-    variables:
-      - $DEPENDENCY_SCANNING_DISABLED
 
 # We need to duplicate this job's definition because it seems it's impossible to
 # override an included `only.refs`.
@@ -197,40 +156,36 @@ dependency_scanning:
 dast:
   extends:
     - .default-retry
-    - .default-only
-    - .only:changes-code-qa
-    - .only-review
-  stage: qa
-  needs: ["review-deploy"]
-  dependencies: ["review-deploy"]
-  before_script:
-    - export DAST_WEBSITE="$(cat review_app_url.txt)"
+    - .reports:rules:dast
+  needs:
+    - job: review-deploy
+      artifacts: true
+  stage: qa  # GitLab-specific
   image:
-    name: "registry.gitlab.com/gitlab-org/security-products/dast:$CI_SERVER_VERSION_MAJOR-$CI_SERVER_VERSION_MINOR-stable"
+    name: "registry.gitlab.com/gitlab-org/security-products/dast:$DAST_VERSION"
   variables:
-  # URL to scan:
-  # DAST_WEBSITE: https://example.com/
-  #
-  # Time limit for target availability (scan is attempted even when timeout):
-  # DAST_TARGET_AVAILABILITY_TIMEOUT: 60
-  #
-  # Set these variables to scan with an authenticated user:
-  # DAST_AUTH_URL: https://example.com/sign-in
-  # DAST_USERNAME: john.doe@example.com
-  # DAST_PASSWORD: john-doe-password
-  # DAST_USERNAME_FIELD: session[user] # the name of username field at the sign-in HTML form
-  # DAST_PASSWORD_FIELD: session[password] # the name of password field at the sign-in HTML form
-  # DAST_AUTH_EXCLUDE_URLS: http://example.com/sign-out,http://example.com/sign-out-2 # optional: URLs to skip during the authenticated scan; comma-separated, no spaces in between
-  #
-  # Perform ZAP Full Scan, which includes both passive and active scanning:
-  # DAST_FULL_SCAN_ENABLED: "true"
+    # To be done in a later iteration
+    # DAST_USERNAME: "root"
+    # DAST_USERNAME_FIELD: "user[login]"
+    # DAST_PASSWORD_FIELD: "user[passowrd]"
   allow_failure: true
   script:
-    - export DAST_WEBSITE=${DAST_WEBSITE:-$(cat environment_url.txt)}
+    - 'export DAST_WEBSITE="${DAST_WEBSITE:-$(cat environment_url.txt)}"'
+    # To be done in a later iteration
+    # - 'export DAST_AUTH_URL="${DAST_WEBSITE}/users/sign_in"'
+    # - 'export DAST_PASSWORD="${REVIEW_APPS_ROOT_PASSWORD}"'
     - /analyze -t $DAST_WEBSITE
   artifacts:
-    expire_in: 7 days
     paths:
-      - gl-dast-report.json
+      - gl-dast-report.json  # GitLab-specific
     reports:
       dast: gl-dast-report.json
+    expire_in: 1 week  # GitLab-specific
+
+# To be done in a later iteration: https://gitlab.com/gitlab-org/gitlab/issues/31160#note_278188255
+# schedule:dast:
+#   extends:
+#     - dast
+#     - .reports:schedule-dast
+#   variables:
+#     DAST_FULL_SCAN_ENABLED: "true"

.gitlab/ci/review.gitlab-ci.yml

@@ -2,8 +2,7 @@
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-qa-alpine
+  image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-qa-alpine-ruby-2.6
   services:
     - docker:19.03.0-dind
   tags:
@@ -17,9 +16,7 @@
 build-qa-image:
   extends:
     - .review-docker
-    - .only:variables-canonical-dot-com
-    - .except:refs-deploy
-    - .only:changes-code-qa
+    - .review:rules:mr-and-schedule
   stage: prepare
   script:
     - '[[ ! -d "ee/" ]] || export GITLAB_EDITION="ee"'
@@ -30,11 +27,11 @@ build-qa-image:
     - time docker build --cache-from "${QA_MASTER_IMAGE}" --tag ${QA_IMAGE} --file ./qa/Dockerfile ./
     - time docker push ${QA_IMAGE}
 
-.base-review-cleanup:
+review-cleanup:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
+    - .review:rules:review-cleanup
   stage: prepare
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-charts-build-base
   allow_failure: true
@@ -47,52 +44,28 @@ build-qa-image:
   script:
     - ruby -rrubygems scripts/review_apps/automated_cleanup.rb
 
-schedule:review-cleanup:
-  extends:
-    - .base-review-cleanup
-    - .only-review-schedules
-
-manual:review-cleanup:
-  extends:
-    - .base-review-cleanup
-    - .only:changes-code-qa
-  when: manual
-
-.review-build-cng-base:
+review-build-cng:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
+    - .review:rules:mr-and-schedule
   image: ruby:2.6-alpine
   stage: review-prepare
   before_script:
     - source scripts/utils.sh
     - install_api_client_dependencies_with_apk
     - install_gitlab_gem
-  dependencies: []
+  needs:
+    - job: gitlab:assets:compile pull-cache
+      artifacts: false
   script:
     - BUILD_TRIGGER_TOKEN=$REVIEW_APPS_BUILD_TRIGGER_TOKEN ./scripts/trigger-build cng
 
-review-build-cng:
-  extends:
-    - .review-build-cng-base
-    - .only-review
-    - .only:changes-code-qa
-  needs: ["gitlab:assets:compile pull-cache"]
-
-schedule:review-build-cng:
-  extends:
-    - .review-build-cng-base
-    - .only-review-schedules
-  needs: ["gitlab:assets:compile pull-cache"]
-
 .review-workflow-base:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-charts-build-base
-  dependencies: []
   variables:
     HOST_SUFFIX: "${CI_ENVIRONMENT_SLUG}"
     DOMAIN: "-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}"
@@ -103,17 +76,22 @@ schedule:review-build-cng:
     url: https://gitlab-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}
     on_stop: review-stop
 
-.review-deploy-base:
-  extends: .review-workflow-base
+review-deploy:
+  extends:
+    - .review-workflow-base
+    - .review:rules:mr-and-schedule
   stage: review
+  needs:
+    - job: review-build-cng
+      artifacts: false
   allow_failure: true
   before_script:
     - '[[ ! -d "ee/" ]] || export GITLAB_EDITION="ee"'
     - export GITLAB_SHELL_VERSION=$(<GITLAB_SHELL_VERSION)
     - export GITALY_VERSION=$(<GITALY_SERVER_VERSION)
     - export GITLAB_WORKHORSE_VERSION=$(<GITLAB_WORKHORSE_VERSION)
-    - echo "${CI_ENVIRONMENT_URL}" > review_app_url.txt
-    - source scripts/utils.sh
+    - echo "${CI_ENVIRONMENT_URL}" > environment_url.txt
+    - source ./scripts/utils.sh
     - install_api_client_dependencies_with_apk
     - source scripts/review_apps/review-apps.sh
   script:
@@ -125,59 +103,48 @@ schedule:review-build-cng:
     - date
     - deploy || (display_deployment_debug && exit 1)
   artifacts:
-    paths: [review_app_url.txt]
+    paths: [environment_url.txt]
     expire_in: 2 days
     when: always
 
-review-deploy:
-  extends:
-    - .review-deploy-base
-    - .only-review
-    - .only:changes-code-qa
-
-schedule:review-deploy:
-  extends:
-    - .review-deploy-base
-    - .only-review-schedules
-
-.base-review-stop:
-  extends:
-    - .review-workflow-base
-    - .only-review
-    - .only:changes-code-qa
+.review-stop-base:
+  extends: .review-workflow-base
   environment:
     action: stop
+  dependencies: []
   variables:
-    GIT_STRATEGY: none
+    # We're cloning the repo instead of downloading the script for now
+    # because some repos are private and CI_JOB_TOKEN cannot access files.
+    # See https://gitlab.com/gitlab-org/gitlab/issues/191273
+    GIT_DEPTH: 1
   before_script:
-    # We don't clone the repo by using GIT_STRATEGY: none and only download the
-    # single script we need here so it's much faster than cloning.
     - apk add --update openssl
-    - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/review_apps/review-apps.sh
-    - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/utils.sh
-    - source utils.sh
-    - source review-apps.sh
+    - source ./scripts/utils.sh
+    - source ./scripts/review_apps/review-apps.sh
 
 review-stop-failed-deployment:
-  extends: .base-review-stop
+  extends:
+    - .review-stop-base
+    - .review:rules:mr-only-auto
   stage: prepare
   script:
     - delete_failed_release
 
 review-stop:
-  extends: .base-review-stop
+  extends:
+    - .review-stop-base
+    - .review:rules:mr-only-manual
   stage: review
-  when: manual
   allow_failure: true
   script:
     - delete_release
 
 .review-qa-base:
-  extends:
-    - .review-docker
-    - .only-review
-    - .only:changes-code-qa
+  extends: .review-docker
   stage: qa
+  needs:
+    - job: review-deploy
+      artifacts: true
   allow_failure: true
   variables:
     QA_ARTIFACTS_DIR: "${CI_PROJECT_DIR}/qa"
@@ -189,66 +156,49 @@ review-stop:
     GITLAB_ADMIN_PASSWORD: "${REVIEW_APPS_ROOT_PASSWORD}"
     GITHUB_ACCESS_TOKEN: "${REVIEW_APPS_QA_GITHUB_ACCESS_TOKEN}"
     EE_LICENSE: "${REVIEW_APPS_EE_LICENSE}"
-  needs: ["review-deploy"]
-  dependencies: ["review-deploy"]
-  artifacts:
-    paths:
-      - ./qa/gitlab-qa-run-*
-    expire_in: 7 days
-    when: always
   before_script:
     - '[[ ! -d "ee/" ]] || export GITLAB_EDITION="ee"'
     - export QA_IMAGE="${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab/gitlab-${GITLAB_EDITION}-qa:${CI_COMMIT_REF_SLUG}"
-    - export CI_ENVIRONMENT_URL="$(cat review_app_url.txt)"
+    - export CI_ENVIRONMENT_URL="$(cat environment_url.txt)"
     - echo "${CI_ENVIRONMENT_URL}"
     - echo "${QA_IMAGE}"
     - source scripts/utils.sh
     - install_api_client_dependencies_with_apk
     - gem install gitlab-qa --no-document ${GITLAB_QA_VERSION:+ --version ${GITLAB_QA_VERSION}}
+  artifacts:
+    paths:
+      - ./qa/gitlab-qa-run-*
+    expire_in: 7 days
+    when: always
 
 review-qa-smoke:
-  extends: .review-qa-base
+  extends:
+    - .review-qa-base
+    - .review:rules:mr-only-auto
   script:
     - gitlab-qa Test::Instance::Smoke "${QA_IMAGE}" "${CI_ENVIRONMENT_URL}"
 
 review-qa-all:
-  extends: .review-qa-base
-  when: manual
+  extends:
+    - .review-qa-base
+    - .review:rules:mr-only-manual
   parallel: 5
   script:
     - export KNAPSACK_REPORT_PATH=knapsack/master_report.json
     - export KNAPSACK_TEST_FILE_PATTERN=qa/specs/features/**/*_spec.rb
     - gitlab-qa Test::Instance::Any "${QA_IMAGE}" "${CI_ENVIRONMENT_URL}" -- --format RspecJunitFormatter --out tmp/rspec-${CI_JOB_ID}.xml --format html --out tmp/rspec.htm --color --format documentation
 
-.review-performance-base:
-  extends: .review-docker
-  stage: qa
-  allow_failure: true
-  before_script:
-    - export CI_ENVIRONMENT_URL="$(cat review_app_url.txt)"
-    - echo "${CI_ENVIRONMENT_URL}"
-    - mkdir -p gitlab-exporter
-    - wget -O ./gitlab-exporter/index.js https://gitlab.com/gitlab-org/gl-performance/raw/master/index.js
-    - mkdir -p sitespeed-results
-  script:
-    - docker run --shm-size=1g --rm -v "$(pwd)":/sitespeed.io sitespeedio/sitespeed.io:6.3.1 --plugins.add ./gitlab-exporter --outputFolder sitespeed-results "${CI_ENVIRONMENT_URL}"
-  after_script:
-    - mv sitespeed-results/data/performance.json performance.json
-  artifacts:
-    paths:
-      - sitespeed-results/
-    reports:
-      performance: performance.json
-
 review-performance:
   extends:
-    - .review-performance-base
-    - .only-review
-    - .only:changes-code-qa
-  needs: ["review-deploy"]
-  dependencies: ["review-deploy"]
+    - .review-docker
+    - .review:rules:mr-and-schedule
+  stage: qa
+  needs:
+    - job: review-deploy
+      artifacts: true
+  allow_failure: true
   before_script:
-    - export CI_ENVIRONMENT_URL="$(cat review_app_url.txt)"
+    - export CI_ENVIRONMENT_URL="$(cat environment_url.txt)"
     - echo "${CI_ENVIRONMENT_URL}"
     - mkdir -p gitlab-exporter
     - wget -O ./gitlab-exporter/index.js https://gitlab.com/gitlab-org/gl-performance/raw/master/index.js
@@ -263,34 +213,17 @@ review-performance:
     reports:
       performance: performance.json
 
-schedule:review-performance:
-  extends:
-    - .review-performance-base
-    - .only-review-schedules
-  needs: ["schedule:review-deploy"]
-  dependencies: ["schedule:review-deploy"]
-
 parallel-spec-reports:
   extends:
     - .default-tags
-    - .default-only
-    - .only-review
-    - .only:changes-code-qa
+    - .review:rules:mr-only-manual
   image: ruby:2.6-alpine
   stage: post-qa
   dependencies: ["review-qa-all"]
+  allow_failure: true
   variables:
     NEW_PARALLEL_SPECS_REPORT: qa/report-new.html
     BASE_ARTIFACT_URL: "${CI_PROJECT_URL}/-/jobs/${CI_JOB_ID}/artifacts/file/qa/"
-  allow_failure: true
-  when: manual
-  artifacts:
-    when: always
-    paths:
-      - qa/report-new.html
-      - qa/gitlab-qa-run-*
-    reports:
-      junit: qa/gitlab-qa-run-*/**/rspec-*.xml
   script:
     - apk add --update build-base libxml2-dev libxslt-dev && rm -rf /var/cache/apk/*
     - gem install nokogiri --no-document
@@ -299,20 +232,23 @@ parallel-spec-reports:
     - cd -
     - '[[ -f $NEW_PARALLEL_SPECS_REPORT ]] || echo "{}" > ${NEW_PARALLEL_SPECS_REPORT}'
     - scripts/merge-html-reports ${NEW_PARALLEL_SPECS_REPORT} ${BASE_ARTIFACT_URL}${ARTIFACT_DIRS} qa/gitlab-qa-run-*/**/rspec.htm
+  artifacts:
+    when: always
+    paths:
+      - qa/report-new.html
+      - qa/gitlab-qa-run-*
+    reports:
+      junit: qa/gitlab-qa-run-*/**/rspec-*.xml
 
 danger-review:
   extends:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
-    - .except:refs-master-tags-stable-deploy
+    - .review:rules:danger
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:danger
   stage: test
   dependencies: []
-  only:
-    variables:
-      - $DANGER_GITLAB_API_TOKEN
   script:
     - git version
     - node --version

.gitlab/ci/rules.gitlab-ci.yml

@@ -0,0 +1,500 @@
+##############
+# Conditions #
+##############
+.if-not-canonical-namespace: &if-not-canonical-namespace
+  if: '$CI_PROJECT_NAMESPACE !~ /^gitlab(-org)?($|\/)/'
+
+.if-not-ee: &if-not-ee
+  if: '$CI_PROJECT_NAME !~ /^gitlab(-ee)?$/'
+
+.if-not-foss: &if-not-foss
+  if: '$CI_PROJECT_NAME != "gitlab-foss" && $CI_PROJECT_NAME != "gitlab-ce" && $CI_PROJECT_NAME != "gitlabhq"'
+
+.if-default-refs: &if-default-refs
+  if: '$CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable(-ee)?$/ || $CI_COMMIT_REF_NAME =~ /^\d+-\d+-auto-deploy-\d+$/ || $CI_COMMIT_REF_NAME =~ /^security\// || $CI_MERGE_REQUEST_IID || $CI_COMMIT_TAG'
+
+.if-master-refs: &if-master-refs
+  if: '$CI_COMMIT_REF_NAME == "master"'
+
+.if-master-or-tag: &if-master-or-tag
+  if: '$CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_TAG'
+
+.if-merge-request: &if-merge-request
+  if: '$CI_MERGE_REQUEST_IID'
+
+.if-dot-com-gitlab-org-schedule: &if-dot-com-gitlab-org-schedule
+  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org" && $CI_PIPELINE_SOURCE == "schedule"'
+
+.if-dot-com-gitlab-org-master: &if-dot-com-gitlab-org-master
+  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org" && $CI_COMMIT_REF_NAME == "master"'
+
+.if-dot-com-gitlab-org-merge-request: &if-dot-com-gitlab-org-merge-request
+  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org" && $CI_MERGE_REQUEST_IID'
+
+.if-dot-com-gitlab-org-and-security-merge-request: &if-dot-com-gitlab-org-and-security-merge-request
+  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE =~ /^gitlab-org($|\/security$)/ && $CI_MERGE_REQUEST_IID'
+
+.if-dot-com-gitlab-org-and-security-tag: &if-dot-com-gitlab-org-and-security-tag
+  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE =~ /^gitlab-org($|\/security$)/ && $CI_COMMIT_TAG'
+
+.if-dot-com-ee-schedule: &if-dot-com-ee-schedule
+  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_PIPELINE_SOURCE == "schedule"'
+
+.if-cache-credentials-schedule: &if-cache-credentials-schedule
+  if: '$CI_REPO_CACHE_CREDENTIALS && $CI_PIPELINE_SOURCE == "schedule"'
+
+####################
+# Changes patterns #
+####################
+.yaml-patterns: &yaml-patterns
+  - "**/*.yml"
+
+.docs-patterns: &docs-patterns
+  - ".gitlab/route-map.yml"
+  - "doc/**/*"
+  - ".markdownlint.json"
+
+.backstage-patterns: &backstage-patterns
+  - "Dangerfile"
+  - "danger/**/*"
+  - "{,ee/}fixtures/**/*"
+  - "{,ee/}rubocop/**/*"
+  - "{,ee/}spec/**/*"
+  - "doc/README.md"  # Some RSpec test rely on this file
+
+.code-patterns: &code-patterns
+  - ".gitlab/ci/**/*"
+  - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
+  - ".csscomb.json"
+  - "Dockerfile.assets"
+  - "*_VERSION"
+  - "Gemfile{,.lock}"
+  - "Rakefile"
+  - "{babel.config,jest.config}.js"
+  - "config.ru"
+  - "{package.json,yarn.lock}"
+  - "{,ee/}{app,bin,config,db,haml_lint,lib,locale,public,scripts,symbol,vendor}/**/*"
+  - "doc/api/graphql/reference/*"  # Files in this folder are auto-generated
+
+.qa-patterns: &qa-patterns
+  - ".dockerignore"
+  - "qa/**/*"
+
+.code-backstage-patterns: &code-backstage-patterns
+  - ".gitlab/ci/**/*"
+  - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
+  - ".csscomb.json"
+  - "Dockerfile.assets"
+  - "*_VERSION"
+  - "Gemfile{,.lock}"
+  - "Rakefile"
+  - "{babel.config,jest.config}.js"
+  - "config.ru"
+  - "{package.json,yarn.lock}"
+  - "{,ee/}{app,bin,config,db,haml_lint,lib,locale,public,scripts,symbol,vendor}/**/*"
+  - "doc/api/graphql/reference/*"  # Files in this folder are auto-generated
+  # Backstage changes
+  - "Dangerfile"
+  - "danger/**/*"
+  - "{,ee/}fixtures/**/*"
+  - "{,ee/}rubocop/**/*"
+  - "{,ee/}spec/**/*"
+  - "doc/README.md"  # Some RSpec test rely on this file
+
+.code-qa-patterns: &code-qa-patterns
+  - ".gitlab/ci/**/*"
+  - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
+  - ".csscomb.json"
+  - "Dockerfile.assets"
+  - "*_VERSION"
+  - "Gemfile{,.lock}"
+  - "Rakefile"
+  - "{babel.config,jest.config}.js"
+  - "config.ru"
+  - "{package.json,yarn.lock}"
+  - "{,ee/}{app,bin,config,db,haml_lint,lib,locale,public,scripts,symbol,vendor}/**/*"
+  - "doc/api/graphql/reference/*"  # Files in this folder are auto-generated
+  # QA changes
+  - ".dockerignore"
+  - "qa/**/*"
+
+.code-backstage-qa-patterns: &code-backstage-qa-patterns
+  - ".gitlab/ci/**/*"
+  - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
+  - ".csscomb.json"
+  - "Dockerfile.assets"
+  - "*_VERSION"
+  - "Gemfile{,.lock}"
+  - "Rakefile"
+  - "{babel.config,jest.config}.js"
+  - "config.ru"
+  - "{package.json,yarn.lock}"
+  - "{,ee/}{app,bin,config,db,haml_lint,lib,locale,public,scripts,symbol,vendor}/**/*"
+  - "doc/api/graphql/reference/*"  # Files in this folder are auto-generated
+  # Backstage changes
+  - "Dangerfile"
+  - "danger/**/*"
+  - "{,ee/}fixtures/**/*"
+  - "{,ee/}rubocop/**/*"
+  - "{,ee/}spec/**/*"
+  - "doc/README.md"  # Some RSpec test rely on this file
+  # QA changes
+  - ".dockerignore"
+  - "qa/**/*"
+
+####################
+# Cache repo rules #
+####################
+.cache-repo:rules:
+  rules:
+    - <<: *if-cache-credentials-schedule
+      when: on_success
+
+#############
+# CNG rules #
+#############
+.cng:rules:
+  rules:
+    - <<: *if-dot-com-gitlab-org-and-security-tag
+      when: manual
+
+######################
+# Dev fixtures rules #
+######################
+.dev-fixtures:rules:ee-and-foss:
+  rules:
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+      when: on_success
+
+.dev-fixtures:rules:ee-only:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+      when: on_success
+
+##############
+# Docs rules #
+##############
+.docs:rules:review-docs:
+  rules:
+    - <<: *if-dot-com-gitlab-org-merge-request
+      changes: *docs-patterns
+      when: manual
+
+.docs:rules:docs-lint:
+  rules:
+    - <<: *if-default-refs
+      changes: *docs-patterns
+      when: on_success
+
+.docs:rules:graphql-reference-verify:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
+      when: on_success
+
+##################
+# Frontend rules #
+##################
+.frontend:rules:gitlab-assets-compile-pull-push-cache:
+  rules:
+    - <<: *if-not-canonical-namespace
+      when: never
+    - <<: *if-master-refs
+      changes: *code-backstage-qa-patterns
+      when: on_success
+
+.frontend:rules:gitlab-assets-compile-pull-cache:
+  rules:
+    - <<: *if-not-canonical-namespace
+      when: never
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
+      when: on_success
+
+.frontend:rules:compile-assets-pull-push-cache:
+  rules:
+    - <<: *if-master-refs
+      changes: *code-backstage-qa-patterns
+      when: on_success
+
+.frontend:rules:compile-assets-pull-push-cache-as-if-foss:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-master-refs
+      changes: *code-backstage-qa-patterns
+      when: on_success
+
+.frontend:rules:compile-assets-pull-cache:
+  rules:
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
+      when: on_success
+
+.frontend:rules:compile-assets-pull-cache-as-if-foss:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
+      when: on_success
+
+.frontend:rules:default-frontend-jobs:
+  rules:
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+      when: on_success
+
+.frontend:rules:default-frontend-jobs-as-if-foss:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+      when: on_success
+
+.frontend:rules:qa-frontend-node:
+  rules:
+    - <<: *if-master-refs
+      when: on_success
+
+################
+# Memory rules #
+################
+.memory:rules:
+  rules:
+    - <<: *if-default-refs
+      changes: *code-patterns
+      when: on_success
+
+###############
+# Pages rules #
+###############
+.pages:rules:
+  rules:
+    - <<: *if-dot-com-gitlab-org-master
+      changes: *code-backstage-qa-patterns
+      when: on_success
+
+############
+# QA rules #
+############
+.qa:rules:ee-and-foss:
+  rules:
+    - <<: *if-default-refs
+      changes: *code-qa-patterns
+      when: on_success
+
+.qa:rules:ee-only:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-default-refs
+      changes: *code-qa-patterns
+      when: on_success
+
+.qa:rules:package-and-qa:
+  rules:
+    - <<: *if-dot-com-gitlab-org-merge-request
+      changes: *qa-patterns
+      when: on_success
+    - <<: *if-dot-com-gitlab-org-merge-request
+      changes: *code-patterns
+      when: manual
+    - <<: *if-dot-com-gitlab-org-schedule
+      when: on_success
+
+###############
+# Rails rules #
+###############
+.rails:rules:ee-and-foss:
+  rules:
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+      when: on_success
+
+.rails:rules:default-refs-code-backstage-qa:
+  rules:
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
+      when: on_success
+
+.rails:rules:master-refs-code-backstage:
+  rules:
+    - <<: *if-master-refs
+      changes: *code-backstage-patterns
+      when: on_success
+
+.rails:rules:master-refs-code-backstage-ee-only:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-master-refs
+      changes: *code-backstage-patterns
+      when: on_success
+
+.rails:rules:ee-only:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+      when: on_success
+
+.rails:rules:downtime_check:
+  rules:
+    - <<: *if-merge-request
+      changes: *code-backstage-patterns
+      when: on_success
+
+##################
+# Releases rules #
+##################
+.releases:rules:canonical-dot-com-gitlab-stable-branch-only:
+  rules:
+    - if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable-ee$/'
+
+.releases:rules:canonical-dot-com-security-gitlab-stable-branch-only:
+  rules:
+    - if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/security/gitlab" && $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable-ee$/'
+
+#################
+# Reports rules #
+#################
+.reports:rules:code_quality:
+  rules:
+    - if: '$CODE_QUALITY_DISABLED'
+      when: never
+    # - <<: *if-master-refs  # To be done in a later iteration: https://gitlab.com/gitlab-org/gitlab/issues/31160#note_278188255
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+
+.reports:rules:sast:
+  rules:
+    - if: '$SAST_DISABLED || $GITLAB_FEATURES !~ /\bsast\b/'
+      when: never
+    # - <<: *if-master-refs  # To be done in a later iteration: https://gitlab.com/gitlab-org/gitlab/issues/31160#note_278188255
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
+
+.reports:rules:dependency_scanning:
+  rules:
+    - if: '$DEPENDENCY_SCANNING_DISABLED || $GITLAB_FEATURES !~ /\bdependency_scanning\b/'
+      when: never
+    # - <<: *if-master-refs  # To be done in a later iteration: https://gitlab.com/gitlab-org/gitlab/issues/31160#note_278188255
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
+
+.reports:rules:dast:
+  rules:
+    - if: '$DAST_DISABLED || $GITLAB_FEATURES !~ /\bdast\b/'
+      when: never
+    - <<: *if-dot-com-gitlab-org-merge-request
+      changes: *code-qa-patterns
+
+.reports:schedule-dast:
+  rules:
+    - if: '$DAST_DISABLED || $GITLAB_FEATURES !~ /\bdast\b/'
+      when: never
+    - <<: *if-dot-com-gitlab-org-schedule
+
+################
+# Review rules #
+################
+.review:rules:mr-and-schedule:
+  rules:
+    - <<: *if-dot-com-gitlab-org-merge-request
+      changes: *code-qa-patterns
+      when: on_success
+    - <<: *if-dot-com-gitlab-org-schedule
+      when: on_success
+
+.review:rules:mr-only-auto:
+  rules:
+    - <<: *if-dot-com-gitlab-org-merge-request
+      changes: *code-qa-patterns
+      when: on_success
+
+.review:rules:mr-only-manual:
+  rules:
+    - <<: *if-dot-com-gitlab-org-merge-request
+      changes: *code-qa-patterns
+      when: manual
+
+.review:rules:review-cleanup:
+  rules:
+    - <<: *if-dot-com-gitlab-org-merge-request
+      changes: *code-qa-patterns
+      when: manual
+    - <<: *if-dot-com-gitlab-org-schedule
+      when: on_success
+
+.review:rules:danger:
+  rules:
+    - if: '$DANGER_GITLAB_API_TOKEN && $CI_MERGE_REQUEST_IID'
+      when: on_success
+
+###############
+# Setup rules #
+###############
+.setup:rules:cache-gems:
+  rules:
+    - <<: *if-not-canonical-namespace
+      when: never
+    - <<: *if-master-or-tag
+      changes: *code-backstage-qa-patterns
+      when: on_success
+
+.setup:rules:gitlab_git_test:
+  rules:
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+      when: on_success
+
+.setup:rules:no_ee_check:
+  rules:
+    - <<: *if-not-foss
+      when: never
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+      when: on_success
+
+#######################
+# Test metadata rules #
+#######################
+.test-metadata:rules:retrieve-tests-metadata:
+  rules:
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+      when: on_success
+
+.test-metadata:rules:update-tests-metadata:
+  rules:
+    - <<: *if-dot-com-ee-schedule
+      changes: *code-backstage-patterns
+      when: on_success
+
+.test-metadata:rules:flaky-examples-check:
+  rules:
+    - <<: *if-merge-request
+      changes: *code-backstage-patterns
+      when: on_success
+
+
+##############
+# YAML rules #
+##############
+.yaml:rules:
+  rules:
+    - <<: *if-default-refs
+      changes: *yaml-patterns

.gitlab/ci/setup.gitlab-ci.yml

@@ -6,11 +6,11 @@ cache gems:
     - .default-retry
     - .default-cache
     - .default-before_script
-    - .only:variables-canonical-dot-com
-    - .only:changes-code-backstage-qa
+    - .setup:rules:cache-gems
   stage: test
-  dependencies: ["setup-test-env"]
-  needs: ["setup-test-env"]
+  needs:
+    - job: setup-test-env
+      artifacts: true
   variables:
     SETUP_DB: "false"
   script:
@@ -18,30 +18,23 @@ cache gems:
   artifacts:
     paths:
       - vendor/cache
-  only:
-    refs:
-      - master
-      - tags
 
 .minimal-job:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-    - .only:changes-code-backstage
   dependencies: []
 
 gitlab_git_test:
-  extends: .minimal-job
+  extends:
+    - .minimal-job
+    - .setup:rules:gitlab_git_test
   script:
     - spec/support/prepare-gitlab-git-test-for-commit --check-for-changes
 
 no_ee_check:
-  extends: .minimal-job
+  extends:
+    - .minimal-job
+    - .setup:rules:no_ee_check
   script:
     - scripts/no-ee-check
-  only:
-    variables:
-      - $CI_PROJECT_NAME == "gitlab-foss"
-      - $CI_PROJECT_NAME == "gitlab-ce"  # Support former project name for forks/mirrors
-      - $CI_PROJECT_NAME == "gitlabhq"  # Support former project name for dev

.gitlab/ci/test-metadata.gitlab-ci.yml

@@ -1,7 +1,4 @@
 .tests-metadata-state:
-  extends:
-    - .default-only
-    - .only:changes-code-backstage
   variables:
     TESTS_METADATA_S3_BUCKET: "gitlab-ce-cache"
   before_script:
@@ -19,7 +16,9 @@
       - rspec_profiling/
 
 retrieve-tests-metadata:
-  extends: .tests-metadata-state
+  extends:
+    - .tests-metadata-state
+    - .test-metadata:rules:retrieve-tests-metadata
   stage: prepare
   cache:
     policy: pull
@@ -28,7 +27,9 @@ retrieve-tests-metadata:
     - retrieve_tests_metadata
 
 update-tests-metadata:
-  extends: .tests-metadata-state
+  extends:
+    - .tests-metadata-state
+    - .test-metadata:rules:update-tests-metadata
   stage: post-test
   cache:
     policy: push
@@ -36,27 +37,17 @@ update-tests-metadata:
     - retry gem install fog-aws mime-types activesupport rspec_profiling postgres-copy --no-document
     - source scripts/rspec_helpers.sh
     - update_tests_metadata
-  only:
-    refs:
-      - schedules
-    variables:
-      # Only update the Knapsack metadata on GitLab.com/gitlab-org/gitlab
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab"
 
 flaky-examples-check:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-    - .only:changes-code-backstage
+    - .test-metadata:rules:flaky-examples-check
   image: ruby:2.6-alpine
   stage: post-test
   variables:
     NEW_FLAKY_SPECS_REPORT: rspec_flaky/report-new.json
   allow_failure: true
-  only:
-    refs:
-      - merge_requests
   artifacts:
     expire_in: 30d
     paths:
@@ -64,4 +55,4 @@ flaky-examples-check:
   script:
     - '[[ -f $NEW_FLAKY_SPECS_REPORT ]] || echo "{}" > ${NEW_FLAKY_SPECS_REPORT}'
     - scripts/merge-reports ${NEW_FLAKY_SPECS_REPORT} rspec_flaky/new_*_*.json
-    - scripts/detect-new-flaky-examples $NEW_FLAKY_SPECS_REPORT
+    - scripts/flaky_examples/detect-new-flaky-examples $NEW_FLAKY_SPECS_REPORT

.gitlab/ci/yaml.gitlab-ci.yml

@@ -4,11 +4,11 @@ lint-ci-gitlab:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-  only:
-    changes:
-      - "**/*.yml"
+    - .yaml:rules
   image: sdesbure/yamllint:latest
   dependencies: []
+  variables:
+    LINT_PATHS: .gitlab-ci.yml .gitlab/ci lib/gitlab/ci/templates changelogs
   script:
-    - yamllint .gitlab-ci.yml .gitlab/ci lib/gitlab/ci/templates changelogs
+    - '[[ ! -d "ee/" ]] || export LINT_PATHS="$LINT_PATHS ee/changelogs"'
+    - yamllint $LINT_PATHS

.gitlab/issue_templates/Coding style proposal.md

@@ -1,16 +0,0 @@
-## Description of the proposal
-
-<!--
-Please describe the proposal and add a link to the source (for example, http://www.betterspecs.org/).
--->
-
-- [ ] Mention the proposal in the next backend weekly call and the #backend channel to encourage contribution
-- [ ] Proceed with the proposal once 50% of the maintainers have weighed in, and 80% of the votes are :+1:
-- [ ] Once approved, mention it again in the next backend weekly call and the #backend channel
-
-
-/label ~"development guidelines"
-/label ~"Style decision"
-/label ~documentation
-
-/cc @gitlab-org/maintainers/rails-backend

.gitlab/issue_templates/Feature proposal.md

@@ -6,6 +6,7 @@
 
 <!-- Who will use this feature? If known, include any of the following: types of users (e.g. Developer), personas, or specific company roles (e.g. Release Manager). It's okay to write "Unknown" and fill this field in later.
 
+* [Rachel (Release Manager)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#rachel-release-manager)
 * [Parker (Product Manager)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#parker-product-manager)
 * [Delaney (Development Team Lead)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#delaney-development-team-lead)
 * [Sasha (Software Developer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sasha-software-developer)
@@ -35,15 +36,24 @@ Personas are described at https://about.gitlab.com/handbook/marketing/product-ma
 Add all known Documentation Requirements here, per https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html#documentation-requirements
 If this feature requires changing permissions, this document https://docs.gitlab.com/ee/user/permissions.html must be updated accordingly. -->
 
-### Testing
+### Availability & Testing
 
-<!-- What risks does this change pose? How might it affect the quality of the product? What additional test coverage or changes to tests will be needed? Will it require cross-browser testing? See the test engineering process for further help: https://about.gitlab.com/handbook/engineering/quality/test-engineering/ -->
+<!-- This section needs to be retained and filled in during the workflow planning breakdown phase of this feature proposal, if not earlier.
+
+ What risks does this change pose to our availability? How might it affect the quality of the product? What additional test coverage or changes to tests will be needed? Will it require cross-browser testing?
+
+Please list the test areas (unit, integration and end-to-end) that needs to be added or updated to ensure that this feature will work as intended. Please use the list below as guidance.
+* Unit test changes
+* Integration test changes
+* End-to-end test change
+
+See the test engineering planning process and reach out to your counterpart Software Engineer in Test for assistance: https://about.gitlab.com/handbook/engineering/quality/test-engineering/#test-planning -->
 
 ### What does success look like, and how can we measure that?
 
 <!-- Define both the success metrics and acceptance criteria. Note that success metrics indicate the desired business outcomes, while acceptance criteria indicate when the solution is working correctly. If there is no way to measure success, link to an issue that will implement a way to measure this. -->
 
-### What is the type of buyer? 
+### What is the type of buyer?
 
 <!-- Which leads to: in which enterprise tier should this feature go? See https://about.gitlab.com/handbook/product/pricing/#four-tiers -->
 

.gitlab/issue_templates/QA failure.md

@@ -0,0 +1,65 @@
+<!---
+Before opening a new QA failure issue, make sure to first search for it in the
+QA failures board: https://gitlab.com/groups/gitlab-org/-/boards/1385578
+
+The issue should have the following:
+
+- The relative path of the failing spec file in the title, e.g. if the login
+  test fails, include `qa/specs/features/browser_ui/1_manage/login/log_in_spec.rb` in the title.
+  This is required so that existing issues can easily be found by searching for the spec file.
+- If the issue is about multiple test failures, include the path for each failing spec file in the description.
+- A link to the failing job.
+- The stack trace from the job's logs in the "Stack trace" section below.
+- A screenshot (if available), and HTML capture (if available), in the "Screenshot / HTML page" section below.
+--->
+
+### Summary
+
+
+
+### Stack trace
+
+```
+PUT STACK TRACE HERE
+```
+
+### Screenshot / HTML page
+
+<!--
+Attach the screenshot and HTML snapshot of the page from the job's artifacts:
+1. Download the job's artifacts and unarchive them.
+1. Open the `gitlab-qa-run-2020-*/gitlab-{ce,ee}-qa-*/{,ee}/{api,browser_ui}/<path to failed test>` folder.
+1. Select the `.png` and `.html` files that appears in the job logs (look for `HTML screenshot: /path/to/html/page.html` / `Image screenshot: `/path/to/html/page.png`).
+1. Drag and drop them here.
+-->
+
+### Possible fixes
+
+
+<!-- Default due date. -->
+/due in 2 weeks
+
+<!-- Base labels. -->
+/label ~Quality ~QA ~bug ~S1
+
+<!--
+Choose the stage that appears in the test path, e.g. ~"devops::create" for
+`qa/specs/features/browser_ui/3_create/web_ide/add_file_template_spec.rb`.
+-->
+/label ~devops::
+
+<!--
+Select a label for where the failure was found, e.g. if the failure occurred in
+a nightly pipeline, select ~"found:nightly".
+-->
+/label ~found:
+
+<!--
+https://about.gitlab.com/handbook/engineering/quality/guidelines/#priorities:
+- ~P1: Tests that are needed to verify fundamental GitLab functionality.
+- ~P2: Tests that deal with external integrations which may take a longer time to debug and fix.
+-->
+/label ~P
+
+<!-- Select the current milestone if ~P1 or the next milestone if ~P2. -->
+/milestone %

.gitlab/issue_templates/Security Release.md

@@ -16,37 +16,27 @@ Set the title to: `Security Release: 12.2.X, 12.1.X, and 12.0.X`
 * 12.1.X: {release task link}
 * 12.0.X: {release task link}
 
-## Security Issues:
+## Issues in GitLab Security
 
-* {https://gitlab.com/gitlab-org/gitlab/issues link}
-
-## Security Issues in dev.gitlab.org:
-
-### CE
-
-- {https://dev.gitlab.org/gitlab/gitlabhq/issues link}
+* {https://gitlab.com/gitlab-org/security/gitlab/issues/ link}
 
 | Version | MR |
 |---------|----|
-| 12.2 | {https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/ link} |
-| 12.1 | {https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/ link} |
-| 12.0 | {https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/ link} |
-| master | {https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/ link} |
+| 12.2 | {https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests link} |
+| 12.1 | {https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests link} |
+| 12.0 | {https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests link} |
+| master | {https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests link} |
 
+## Issues in Omnibus-GitLab
 
-
-### EE
-
-* {https://dev.gitlab.org/gitlab/gitlabhq/issues/ link}
-
+* {https://gitlab.com/gitlab-org/security/gitlab/issues/ link}
 
 | Version | MR |
 |---------|----|
-| 12.2 | {https://dev.gitlab.org/gitlab/gitlab-ee/merge_requests/ link} |
-| 12.1 | {https://dev.gitlab.org/gitlab/gitlab-ee/merge_requests/ link} |
-| 12.0 | {https://dev.gitlab.org/gitlab/gitlab-ee/merge_requests/ link} |
-| master | {https://dev.gitlab.org/gitlab/gitlab-ee/merge_requests/ link} |
-
+| 12.2 | {https://dev.gitlab.org/gitlab/omnibus-gitlab/merge_requests/ link} |
+| 12.1 | {https://dev.gitlab.org/gitlab/omnibus-gitlab/merge_requests/ link} |
+| 12.0 | {https://dev.gitlab.org/gitlab/omnibus-gitlab/merge_requests/ link} |
+| master | {https://dev.gitlab.org/gitlab/omnibus-gitlab/merge_requests/ link} |
 
 ## QA
 {QA issue link}
@@ -54,7 +44,7 @@ Set the title to: `Security Release: 12.2.X, 12.1.X, and 12.0.X`
 ## Blog post
 
 Dev: {https://dev.gitlab.org/gitlab/www-gitlab-com/merge_requests/ link}<br/>
-gitlab.com: {https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/ link}
+GitLab.com: {https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/ link}
 
 ## Email notification
 {https://gitlab.com/gitlab-com/marketing/general/issues/ link}

.gitlab/issue_templates/Technical Evaluation.md

@@ -0,0 +1,23 @@
+<!-- Instructions: Use this template for a proof of concept or when a deeper technical evaluation is required. Please weigh tech evaluation issues and follow the instructions below accordingly. --> 
+
+### Topic to Evaluate
+
+<!-- Describe the related issue and challenge we need to establish a proof of concept for-->
+* [Link to other Issue](link)
+
+### Tasks to  Evaluate
+
+<!-- Outline the tasks with issues that you need evaluate as a part of the implementation issue -->
+
+- [ ] Add task
+- [ ] Add task
+- [ ] Add task
+
+### Risks and Implementation Considerations 
+
+<!-- Idenitfy any risks found in the research, whether this is performance, impacts to other functionality or other bugs -->
+
+### Team
+
+- [ ] Add ~"workflow::planning breakdown" ~feature and the corresponding `~devops::<stage>` and `~group::<group>` labels.
+- [ ] Ping the PM and EM.

.gitlab/merge_request_templates/Database changes.md

@@ -1,50 +0,0 @@
-## What does this MR do?
-
-<!--
-Describe in detail what your merge request does, why it does that, etc. Merge
-requests without an adequate description will not be reviewed until one is
-added.
-
-Please also keep this description up-to-date with any discussion that takes
-place so that reviewers can understand your intent. This is especially
-important if they didn't participate in the discussion.
-
-Make sure to remove this comment when you are done.
--->
-
-Add a description of your merge request here.
-
-## Database checklist
-
-- [ ] Conforms to the [database guides](https://docs.gitlab.com/ee/development/README.html#database-guides)
-
-When adding migrations:
-
-- [ ] Updated `db/schema.rb`
-- [ ] Added a `down` method so the migration can be reverted
-- [ ] Added the output of the migration(s) to the MR body
-- [ ] Added tests for the migration in `spec/migrations` if necessary (e.g. when migrating data)
-- [ ] Added rollback procedure. Include either a rollback procedure or description how to rollback changes 
-
-When adding or modifying queries to improve performance:
-
-- [ ] Included data that shows the performance improvement, preferably in the form of a benchmark
-- [ ] Included the output of `EXPLAIN (ANALYZE, BUFFERS)` of the relevant queries
-
-When adding foreign keys to existing tables:
-
-- [ ] Included a migration to remove orphaned rows in the source table before adding the foreign key
-- [ ] Removed any instances of `dependent: ...` that may no longer be necessary
-
-When adding tables:
-
-- [ ] Ordered columns based on the [Ordering Table Columns](https://docs.gitlab.com/ee/development/ordering_table_columns.html) guidelines
-- [ ] Added foreign keys to any columns pointing to data in other tables
-- [ ] Added indexes for fields that are used in statements such as `WHERE`, `ORDER BY`, `GROUP BY`, and `JOIN`s
-
-When removing columns, tables, indexes or other structures:
-
-- [ ] Removed these in a post-deployment migration
-- [ ] Made sure the application no longer uses (or ignores) these structures
-
-/label ~database ~"database::review pending"

.gitlab/merge_request_templates/New static analysis check.md

@@ -0,0 +1,27 @@
+## Description of the proposal
+
+<!--
+Please describe the proposal and add a link to the source (for example, http://www.betterspecs.org/).
+-->
+
+### Check-list
+
+- [ ] Make sure this MR enables a static analysis check rule for new usage but
+  ignores current offenses
+- [ ] Create a follow-up issue to fix the current offenses as a separate iteration: ISSUE_LINK
+- [ ] Mention this proposal in the relevant Slack channels (e.g. `#development`, `#backend`, `#frontend`)
+- [ ] If there is a choice to make between two potential styles, set up an emoji vote in the MR:
+  - CHOICE_A: :a:
+  - CHOICE_B: :b:
+  - Vote yourself for both choices so that people know these are the choices
+- [ ] The MR doesn't have significant objections, and is getting a majority of :+1: vs :-1: (remember that [we don't need to reach a consensus](https://about.gitlab.com/handbook/values/#collaboration-is-not-consensus))
+- [ ] (If applicable) One style is getting a majority of vote (compared to the other choice)
+- [ ] (If applicable) Update the MR with the chosen style
+- [ ] Follow the [review process](https://docs.gitlab.com/ee/development/code_review.html) as usual
+- [ ] Once approved and merged by a maintainer, mention it again:
+  - [ ] In the relevant Slack channels (e.g. `#development`, `#backend`, `#frontend`)
+  - [ ] (Optional depending on the impact of the change) In the Engineering Week in Review
+
+/label ~"Engineering Productivity" ~"Style decision" ~"development guidelines" ~"static analysis"
+
+/cc @gitlab-org/maintainers/rails-backend

.overcommit.yml.example

@@ -15,6 +15,13 @@
 #
 # Uncomment the following lines to make the configuration take effect.
 
+# Make sure to run `cd tooling/overcommit && make && cd -`
+gemfile: 'tooling/overcommit/gems.rb'
+
+PostCheckout:
+  BundleInstall:
+    enabled: true
+
 PreCommit:
   AuthorName:
     enabled: false
@@ -35,6 +42,19 @@ PreCommit:
 #    on_warn: fail # Treat all warnings as failures
   ScssLint:
     enabled: true
+
+CommitMsg:
+  TextWidth:
+    enabled: true
+    min_subject_width: 8 # three 2-letter words with 2 spaces
+    max_subject_width: 72
+    quiet: false
+
+  EmptyMessage:
+    enabled: true
+    required: true
+    description: 'Checking for empty commit message'
+
 #PostCheckout:
 #  ALL: # Special hook name that customizes all hooks of this type
 #    quiet: true # Change all post-checkout hooks to only display output on failure

.rubocop.yml

@@ -155,11 +155,10 @@ Rails/ApplicationRecord:
     # as they need to be as decoupled from application code as possible
     - db/**/*.rb
     - lib/gitlab/background_migration/**/*.rb
+    - ee/lib/ee/gitlab/background_migration/**/*.rb
     - lib/gitlab/database/**/*.rb
     - spec/**/*.rb
     - ee/db/**/*.rb
-    - ee/lib/gitlab/background_migration/**/*.rb
-    - ee/lib/ee/gitlab/background_migration/**/*.rb
     - ee/spec/**/*.rb
 
 # GitLab ###################################################################
@@ -233,13 +232,8 @@ RSpec/FactoriesInMigrationSpecs:
     - 'spec/migrations/**/*.rb'
     - 'ee/spec/migrations/**/*.rb'
     - 'spec/lib/gitlab/background_migration/**/*.rb'
-    - 'ee/spec/lib/gitlab/background_migration/**/*.rb'
-
-Cop/IncludeActionViewContext:
-  Enabled: true
-  Exclude:
-    - 'spec/**/*'
-    - 'ee/spec/**/*'
+    - 'spec/lib/ee/gitlab/background_migration/**/*.rb'
+    - 'ee/spec/lib/ee/gitlab/background_migration/**/*.rb'
 
 Cop/IncludeSidekiqWorker:
   Enabled: true
@@ -299,3 +293,63 @@ Graphql/Descriptions:
 
 RSpec/AnyInstanceOf:
   Enabled: false
+
+# Cops for upgrade to gitlab-styles 3.1.0
+RSpec/ImplicitSubject:
+  Enabled: false
+
+RSpec/LeakyConstantDeclaration:
+  Enabled: false
+
+RSpec/EmptyLineAfterHook:
+  Enabled: false
+
+RSpec/HooksBeforeExamples:
+  Enabled: false
+
+RSpec/EmptyLineAfterExample:
+  Enabled: false
+
+RSpec/Be:
+  Enabled: false
+
+RSpec/DescribedClass:
+  Enabled: false
+
+RSpec/SharedExamples:
+  Enabled: false
+
+RSpec/EmptyLineAfterExampleGroup:
+  Enabled: false
+
+RSpec/ReceiveNever:
+  Enabled: false
+
+RSpec/MissingExampleGroupArgument:
+  Enabled: false
+
+RSpec/UnspecifiedException:
+  Enabled: false
+
+# Work in progress. See https://gitlab.com/gitlab-org/gitlab/issues/196163
+RSpec/HaveGitlabHttpStatus:
+  Enabled: true
+  Exclude:
+    - 'spec/support/matchers/have_gitlab_http_status.rb'
+  Include:
+    - 'spec/support/**/*'
+    - 'ee/spec/support/**/*'
+    - 'spec/features/**/*'
+    - 'ee/spec/features/**/*'
+    - 'spec/controllers/**/*'
+    - 'ee/spec/controllers/**/*'
+    - 'spec/requests/*.rb'
+    - 'ee/spec/requests/*.rb'
+    - 'spec/requests/api/*/**/*.rb'
+    - 'ee/spec/requests/api/*/**/*.rb'
+
+Style/MultilineWhenThen:
+  Enabled: false
+
+Style/FloatDivision:
+  Enabled: false

.rubocop_todo.yml

@@ -1,25 +1,26 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config`
-# on 2019-05-04 16:01:00 +0000 using RuboCop version 0.68.1.
+# on 2020-01-16 11:53:06 -0800 using RuboCop version 0.74.0.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
-# Offense count: 264
+# Offense count: 299
+# Cop supports --auto-correct.
 Capybara/CurrentPathExpectation:
   Enabled: false
 
-# Offense count: 1097
+# Offense count: 1432
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, IndentationWidth.
 # SupportedStyles: with_first_argument, with_fixed_indentation
 Layout/AlignArguments:
   Enabled: false
 
-# Offense count: 824
+# Offense count: 1630
 # Cop supports --auto-correct.
-# Configuration parameters: EnforcedHashRocketStyle, EnforcedColonStyle, EnforcedLastArgumentHashStyle.
+# Configuration parameters: AllowMultipleStyles, EnforcedHashRocketStyle, EnforcedColonStyle, EnforcedLastArgumentHashStyle.
 # SupportedHashRocketStyles: key, separator, table
 # SupportedColonStyles: key, separator, table
 # SupportedLastArgumentHashStyles: always_inspect, always_ignore, ignore_implicit, ignore_explicit
@@ -32,40 +33,25 @@ Layout/ClosingHeredocIndentation:
   Exclude:
     - 'app/graphql/mutations/merge_requests/set_wip.rb'
     - 'ee/db/geo/migrate/20180322062741_migrate_ci_job_artifacts_to_separate_registry.rb'
-    - 'ee/db/migrate/20160204190809_update_jenkins_service_category.rb'
-    - 'ee/lib/gitlab/background_migration/prune_orphaned_geo_events.rb'
     - 'ee/lib/gitlab/geo/health_check.rb'
     - 'lib/gitlab/background_migration/populate_untracked_uploads.rb'
-    - 'qa/qa/service/kubernetes_cluster.rb'
     - 'spec/features/merge_request/user_sees_diff_spec.rb'
     - 'spec/lib/gitlab/asciidoc_spec.rb'
     - 'spec/lib/gitlab/checks/project_moved_spec.rb'
     - 'spec/rubocop/cop/active_record_association_reload_spec.rb'
     - 'spec/services/task_list_toggle_service_spec.rb'
 
-# Offense count: 14
+# Offense count: 9
 # Cop supports --auto-correct.
 Layout/ClosingParenthesisIndentation:
   Exclude:
     - 'db/post_migrate/20180704145007_update_project_indexes.rb'
     - 'ee/db/geo/migrate/20180405074130_add_partial_index_project_repository_verification.rb'
-    - 'ee/db/migrate/20180308234102_add_partial_index_to_project_repository_states_checksum_columns.rb'
-    - 'ee/db/post_migrate/20180605213516_fix_partial_index_to_project_repository_states_checksum_columns.rb'
-    - 'ee/lib/ee/gitlab/usage_data.rb'
     - 'spec/services/issues/resolve_discussions_spec.rb'
     - 'spec/services/projects/update_service_spec.rb'
     - 'spec/support/helpers/stub_object_storage.rb'
     - 'spec/workers/remove_unreferenced_lfs_objects_worker_spec.rb'
 
-# Offense count: 2
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: leading, trailing
-Layout/DotPosition:
-  Exclude:
-    - 'app/models/concerns/relative_positioning.rb'
-    - 'app/models/group.rb'
-
 # Offense count: 69
 # Cop supports --auto-correct.
 Layout/EmptyLinesAroundArguments:
@@ -81,74 +67,61 @@ Layout/EmptyLinesAroundArguments:
     - 'lib/banzai/pipeline/single_line_pipeline.rb'
     - 'spec/features/markdown/copy_as_gfm_spec.rb'
 
-# Offense count: 160
+# Offense count: 305
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, IndentationWidth.
 # SupportedStyles: special_inside_parentheses, consistent, align_brackets
 Layout/IndentFirstArrayElement:
   Enabled: false
 
-# Offense count: 631
+# Offense count: 1005
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, IndentationWidth.
 # SupportedStyles: special_inside_parentheses, consistent, align_braces
 Layout/IndentFirstHashElement:
   Enabled: false
 
-# Offense count: 5
+# Offense count: 4
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, IndentationWidth.
 # SupportedStyles: consistent, align_parentheses
 Layout/IndentFirstParameter:
   Exclude:
-    - 'app/models/ci/pipeline_schedule.rb'
     - 'lib/gitlab/cross_project_access.rb'
     - 'lib/gitlab/data_builder/push.rb'
     - 'spec/support/helpers/repo_helpers.rb'
     - 'spec/support/helpers/stub_object_storage.rb'
 
-# Offense count: 5
-# Cop supports --auto-correct.
-Layout/LeadingBlankLines:
-  Exclude:
-    - 'app/workers/update_project_statistics_worker.rb'
-    - 'db/migrate/20161007073613_create_user_activities.rb'
-    - 'ee/spec/helpers/boards_helper_spec.rb'
-    - 'lib/tasks/yarn.rake'
-    - 'spec/javascripts/fixtures/merge_requests_diffs.rb'
-
-# Offense count: 30
+# Offense count: 54
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, IndentationWidth.
 # SupportedStyles: aligned, indented
 Layout/MultilineOperationIndentation:
   Enabled: false
 
-# Offense count: 13
+# Offense count: 10
 # Cop supports --auto-correct.
 Layout/RescueEnsureAlignment:
   Exclude:
     - 'app/models/blob_viewer/dependency_manager.rb'
-    - 'app/models/ci/pipeline.rb'
     - 'app/models/project.rb'
     - 'app/services/prometheus/proxy_service.rb'
     - 'app/workers/delete_stored_files_worker.rb'
     - 'app/workers/reactive_caching_worker.rb'
     - 'config/initializers/1_settings.rb'
     - 'config/initializers/trusted_proxies.rb'
-    - 'ee/db/migrate/20151113115819_canonicalize_kerberos_identities.rb'
     - 'lib/gitlab/background_migration/archive_legacy_traces.rb'
     - 'lib/gitlab/highlight.rb'
     - 'lib/tasks/gitlab/lfs/migrate.rake'
 
-# Offense count: 344
+# Offense count: 522
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: require_no_space, require_space
 Layout/SpaceInLambdaLiteral:
   Enabled: false
 
-# Offense count: 583
+# Offense count: 796
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, EnforcedStyleForEmptyBraces, SpaceBeforeBlockParameters.
 # SupportedStyles: space, no_space
@@ -156,18 +129,13 @@ Layout/SpaceInLambdaLiteral:
 Layout/SpaceInsideBlockBraces:
   Enabled: false
 
-# Offense count: 255
+# Offense count: 315
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: space, no_space
 Layout/SpaceInsideParens:
   Enabled: false
 
-# Offense count: 1
-Lint/DisjunctiveAssignmentInConstructor:
-  Exclude:
-    - 'app/models/uploads/base.rb'
-
 # Offense count: 19
 Lint/DuplicateMethods:
   Exclude:
@@ -185,55 +153,27 @@ Lint/DuplicateMethods:
     - 'lib/gitlab/git/tree.rb'
     - 'lib/gitlab/git/wiki_page.rb'
 
-# Offense count: 2
-Lint/InterpolationCheck:
-  Exclude:
-    - 'spec/features/issues/filtered_search/filter_issues_spec.rb'
-    - 'spec/services/quick_actions/interpret_service_spec.rb'
-
-# Offense count: 326
+# Offense count: 122
 # Configuration parameters: MaximumRangeSize.
 Lint/MissingCopEnableDirective:
   Enabled: false
 
-# Offense count: 2
-# Cop supports --auto-correct.
-# Configuration parameters: Whitelist.
-# Whitelist: present?, blank?, presence, try, try!
-Lint/SafeNavigationConsistency:
-  Exclude:
-    - 'lib/gitlab/gpg/commit.rb'
-
-# Offense count: 2
-# Cop supports --auto-correct.
-Lint/ToJSON:
-  Exclude:
-    - 'lib/gitlab/cycle_analytics/usage_data.rb'
-    - 'lib/gitlab/template/base_template.rb'
-
-# Offense count: 7
+# Offense count: 6
 Lint/UriEscapeUnescape:
   Exclude:
     - 'app/controllers/application_controller.rb'
     - 'app/models/project_services/drone_ci_service.rb'
     - 'spec/lib/google_api/auth_spec.rb'
     - 'spec/requests/api/files_spec.rb'
-    - 'spec/requests/api/internal/base_spec.rb'
 
-# Offense count: 1
-# Configuration parameters: CheckForMethodsWithNoSideEffects.
-Lint/Void:
-  Exclude:
-    - 'lib/gitlab/git/diff_collection.rb'
-
-# Offense count: 158
+# Offense count: 165
 # Cop supports --auto-correct.
 # Configuration parameters: AutoCorrect, AllowHeredoc, AllowURI, URISchemes, IgnoreCopDirectives, IgnoredPatterns.
 # URISchemes: http, https
 Metrics/LineLength:
   Max: 176
 
-# Offense count: 94
+# Offense count: 143
 # Configuration parameters: ExpectMatchingDefinition, Regex, IgnoreExecutableScripts, AllowedAcronyms.
 # AllowedAcronyms: CLI, DSL, ACL, API, ASCII, CPU, CSS, DNS, EOF, GUID, HTML, HTTP, HTTPS, ID, IP, JSON, LHS, QPS, RAM, RHS, RPC, SLA, SMTP, SQL, SSH, TCP, TLS, TTL, UDP, UI, UID, UUID, URI, URL, UTF8, VM, XML, XMPP, XSRF, XSS
 Naming/FileName:
@@ -250,37 +190,32 @@ Naming/HeredocDelimiterCase:
     - 'spec/support/helpers/repo_helpers.rb'
     - 'spec/support/helpers/seed_repo.rb'
 
-# Offense count: 197
+# Offense count: 211
 # Configuration parameters: Blacklist.
 # Blacklist: (?-mix:(^|\s)(EO[A-Z]{1}|END)(\s|$))
 Naming/HeredocDelimiterNaming:
   Enabled: false
 
-# Offense count: 125
+# Offense count: 139
 # Cop supports --auto-correct.
 # Configuration parameters: PreferredName.
 Naming/RescuedExceptionsVariableName:
   Enabled: false
 
-# Offense count: 7081
+# Offense count: 9913
 # Configuration parameters: Prefixes.
 # Prefixes: when, with, without
 RSpec/ContextWording:
   Enabled: false
 
-# Offense count: 407
-# Cop supports --auto-correct.
-RSpec/EmptyLineAfterFinalLet:
-  Enabled: false
-
-# Offense count: 719
+# Offense count: 879
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: method_call, block
 RSpec/ExpectChange:
   Enabled: false
 
-# Offense count: 512
+# Offense count: 660
 RSpec/ExpectInHook:
   Enabled: false
 
@@ -294,13 +229,6 @@ RSpec/ItBehavesLike:
     - 'spec/lib/gitlab/git/repository_spec.rb'
     - 'spec/services/notification_service_spec.rb'
 
-# Offense count: 3
-RSpec/IteratedExpectation:
-  Exclude:
-    - 'spec/features/admin/admin_settings_spec.rb'
-    - 'spec/lib/gitlab/gitlab_import/client_spec.rb'
-    - 'spec/lib/gitlab/legacy_github_import/client_spec.rb'
-
 # Offense count: 68
 # Cop supports --auto-correct.
 RSpec/LetBeforeExamples:
@@ -316,56 +244,35 @@ RSpec/LetBeforeExamples:
     - 'spec/rubocop/cop/migration/update_column_in_batches_spec.rb'
     - 'spec/serializers/pipeline_details_entity_spec.rb'
 
-# Offense count: 1
+# Offense count: 2018
 # Cop supports --auto-correct.
-RSpec/MultipleSubjects:
-  Exclude:
-    - 'spec/services/merge_requests/create_from_issue_service_spec.rb'
-
-# Offense count: 4
-RSpec/OverwritingSetup:
-  Exclude:
-    - 'spec/lib/gitlab/background_migration/migrate_events_to_push_event_payloads_spec.rb'
-    - 'spec/models/email_spec.rb'
-    - 'spec/services/merge_requests/add_todo_when_build_fails_service_spec.rb'
-    - 'spec/services/notes/quick_actions_service_spec.rb'
-
-# Offense count: 1828
-# Cop supports --auto-correct.
-# Configuration parameters: Strict, EnforcedStyle.
+# Configuration parameters: Strict, EnforcedStyle, AllowedExplicitMatchers.
 # SupportedStyles: inflected, explicit
 RSpec/PredicateMatcher:
   Enabled: false
 
-# Offense count: 57
+# Offense count: 69
 RSpec/RepeatedExample:
   Enabled: false
 
-# Offense count: 474
+# Offense count: 584
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: and_return, block
 RSpec/ReturnFromStub:
   Enabled: false
 
-# Offense count: 188
+# Offense count: 380
 RSpec/ScatteredLet:
   Enabled: false
 
-# Offense count: 10
+# Offense count: 8
 RSpec/ScatteredSetup:
   Exclude:
-    - 'spec/controllers/projects/templates_controller_spec.rb'
     - 'spec/lib/gitlab/bitbucket_import/importer_spec.rb'
     - 'spec/requests/api/jobs_spec.rb'
     - 'spec/services/projects/create_service_spec.rb'
 
-# Offense count: 1
-# Cop supports --auto-correct.
-RSpec/SharedContext:
-  Exclude:
-    - 'spec/features/admin/admin_groups_spec.rb'
-
 # Offense count: 4
 RSpec/VoidExpect:
   Exclude:
@@ -374,6 +281,21 @@ RSpec/VoidExpect:
     - 'spec/models/ci/runner_spec.rb'
     - 'spec/services/users/destroy_service_spec.rb'
 
+# Offense count: 10
+# Cop supports --auto-correct.
+Rails/ApplicationController:
+  Exclude:
+    - 'app/controllers/acme_challenges_controller.rb'
+    - 'app/controllers/chaos_controller.rb'
+    - 'app/controllers/health_controller.rb'
+    - 'app/controllers/metrics_controller.rb'
+    - 'ee/app/controllers/oauth/geo_auth_controller.rb'
+    - 'ee/spec/helpers/ee/services_helper_spec.rb'
+    - 'lib/gitlab/base_doorkeeper_controller.rb'
+    - 'lib/gitlab/request_forgery_protection.rb'
+    - 'spec/controllers/concerns/continue_params_spec.rb'
+    - 'spec/lib/marginalia_spec.rb'
+
 # Offense count: 8
 # Cop supports --auto-correct.
 Rails/BelongsTo:
@@ -383,39 +305,37 @@ Rails/BelongsTo:
     - 'ee/app/models/prometheus_alert.rb'
     - 'ee/app/models/prometheus_alert_event.rb'
 
-# Offense count: 80
+# Offense count: 151
 # Configuration parameters: Include.
 # Include: db/migrate/*.rb
 Rails/CreateTableWithTimestamps:
   Enabled: false
 
-# Offense count: 222
+# Offense count: 266
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: slashes, arguments
 Rails/FilePath:
   Enabled: false
 
-# Offense count: 167
+# Offense count: 211
 # Configuration parameters: Include.
 # Include: app/models/**/*.rb
 Rails/HasManyOrHasOneDependent:
   Enabled: false
 
-# Offense count: 2
+# Offense count: 431
 # Configuration parameters: Include.
-# Include: app/controllers/**/*.rb
-Rails/IgnoredSkipActionFilterOption:
-  Exclude:
-    - 'app/controllers/projects/snippets_controller.rb'
-    - 'app/controllers/snippets_controller.rb'
+# Include: app/helpers/**/*.rb
+Rails/HelperInstanceVariable:
+  Enabled: false
 
-# Offense count: 87
+# Offense count: 103
 # Configuration parameters: Include.
 # Include: app/models/**/*.rb
 Rails/InverseOf:
   Enabled: false
 
-# Offense count: 46
+# Offense count: 51
 # Configuration parameters: Include.
 # Include: app/controllers/**/*.rb
 Rails/LexicallyScopedActionFilter:
@@ -430,39 +350,22 @@ Rails/LinkToBlank:
     - 'ee/app/helpers/ee/user_callouts_helper.rb'
     - 'ee/app/helpers/license_helper.rb'
 
-# Offense count: 1
-# Cop supports --auto-correct.
+# Offense count: 35
 # Configuration parameters: Include.
-# Include: app/models/**/*.rb
-Rails/RedundantAllowNil:
-  Exclude:
-    - 'app/models/application_setting.rb'
+# Include: **/Rakefile, **/*.rake
+Rails/RakeEnvironment:
+  Enabled: false
 
-# Offense count: 2
-# Configuration parameters: Include.
-# Include: db/migrate/*.rb
-Rails/ReversibleMigration:
-  Exclude:
-    - 'db/migrate/20160824103857_drop_unused_ci_tables.rb'
-
-# Offense count: 860
+# Offense count: 868
 # Configuration parameters: Blacklist, Whitelist.
 # Blacklist: decrement!, decrement_counter, increment!, increment_counter, toggle!, touch, update_all, update_attribute, update_column, update_columns, update_counters
 Rails/SkipsModelValidations:
   Enabled: false
 
-# Offense count: 1
-# Configuration parameters: Environments.
-# Environments: development, test, production
-Rails/UnknownEnv:
-  Exclude:
-    - 'db/migrate/20171124125748_populate_missing_merge_request_statuses.rb'
-
-# Offense count: 11
+# Offense count: 8
 # Cop supports --auto-correct.
 Security/YAMLLoad:
   Exclude:
-    - 'lib/gitlab/background_migration/deserialize_merge_request_diffs_and_commits.rb'
     - 'lib/gitlab/redis/wrapper.rb'
     - 'lib/system_check/incoming_email/imap_authentication_check.rb'
     - 'spec/config/mail_room_spec.rb'
@@ -475,7 +378,7 @@ Security/YAMLLoad:
 Style/AccessModifierDeclarations:
   Enabled: false
 
-# Offense count: 121
+# Offense count: 127
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: percent_q, bare_percent
@@ -488,25 +391,18 @@ Style/CommentedKeyword:
     - 'lib/tasks/gitlab/backup.rake'
     - 'spec/tasks/gitlab/backup_rake_spec.rb'
 
-# Offense count: 1
-# Cop supports --auto-correct.
-Style/Dir:
-  Exclude:
-    - 'qa/qa.rb'
-
-# Offense count: 7
+# Offense count: 6
 # Cop supports --auto-correct.
 Style/EachWithObject:
   Exclude:
     - 'lib/expand_variables.rb'
     - 'lib/gitlab/ci/ansi2html.rb'
-    - 'lib/gitlab/ee_compat_check.rb'
     - 'lib/gitlab/hook_data/issuable_builder.rb'
     - 'lib/gitlab/i18n/po_linter.rb'
     - 'lib/gitlab/import_export/members_mapper.rb'
     - 'lib/gitlab/import_export/relation_factory.rb'
 
-# Offense count: 34
+# Offense count: 41
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: empty, nil, both
@@ -520,7 +416,7 @@ Style/EmptyLambdaParameter:
     - 'app/models/ci/build.rb'
     - 'app/models/ci/runner.rb'
 
-# Offense count: 9
+# Offense count: 8
 # Cop supports --auto-correct.
 Style/EmptyLiteral:
   Exclude:
@@ -528,58 +424,51 @@ Style/EmptyLiteral:
     - 'lib/gitlab/git/diff_collection.rb'
     - 'lib/gitlab/gitaly_client.rb'
     - 'spec/helpers/merge_requests_helper_spec.rb'
-    - 'spec/lib/gitlab/request_context_spec.rb'
     - 'spec/lib/gitlab/workhorse_spec.rb'
     - 'spec/requests/api/jobs_spec.rb'
     - 'spec/support/shared_examples/chat_slash_commands_shared_examples.rb'
 
-# Offense count: 180
+# Offense count: 148
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: compact, expanded
 Style/EmptyMethod:
   Enabled: false
 
-# Offense count: 203
+# Offense count: 346
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: format, sprintf, percent
 Style/FormatString:
   Enabled: false
 
-# Offense count: 669
+# Offense count: 692
 # Configuration parameters: MinBodyLength.
 Style/GuardClause:
   Enabled: false
 
 # Offense count: 27
+# Configuration parameters: AllowIfModifier.
 Style/IfInsideElse:
   Enabled: false
 
-# Offense count: 1346
+# Offense count: 1474
 # Cop supports --auto-correct.
 Style/IfUnlessModifier:
   Enabled: false
 
-# Offense count: 186
+# Offense count: 314
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: line_count_dependent, lambda, literal
 Style/Lambda:
   Enabled: false
 
-# Offense count: 3
-# Cop supports --auto-correct.
-Style/LineEndConcatenation:
-  Exclude:
-    - 'spec/lib/gitlab/gfm/reference_rewriter_spec.rb'
-    - 'spec/lib/gitlab/incoming_email_spec.rb'
-
-# Offense count: 18
+# Offense count: 17
 Style/MethodMissingSuper:
   Enabled: false
 
-# Offense count: 18
+# Offense count: 17
 Style/MissingRespondToMissing:
   Enabled: false
 
@@ -602,54 +491,40 @@ Style/MultilineIfModifier:
     - 'app/services/ci/process_pipeline_service.rb'
     - 'lib/api/commit_statuses.rb'
 
-# Offense count: 72
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: literals, strict
-Style/MutableConstant:
-  Enabled: false
-
-# Offense count: 28
+# Offense count: 34
 # Cop supports --auto-correct.
 # Configuration parameters: Whitelist.
 # Whitelist: be, be_a, be_an, be_between, be_falsey, be_kind_of, be_instance_of, be_truthy, be_within, eq, eql, end_with, include, match, raise_error, respond_to, start_with
 Style/NestedParenthesizedCalls:
   Enabled: false
 
-# Offense count: 31
+# Offense count: 25
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, MinBodyLength.
 # SupportedStyles: skip_modifier_ifs, always
 Style/Next:
   Enabled: false
 
-# Offense count: 67
+# Offense count: 71
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedOctalStyle.
 # SupportedOctalStyles: zero_with_o, zero_only
 Style/NumericLiteralPrefix:
   Enabled: false
 
-# Offense count: 186
+# Offense count: 234
 # Cop supports --auto-correct.
 # Configuration parameters: AutoCorrect, EnforcedStyle, IgnoredMethods.
 # SupportedStyles: predicate, comparison
 Style/NumericPredicate:
   Enabled: false
 
-# Offense count: 2
-# Cop supports --auto-correct.
-Style/OrAssignment:
-  Exclude:
-    - 'lib/api/commit_statuses.rb'
-    - 'lib/gitlab/project_transfer.rb'
-
-# Offense count: 79
+# Offense count: 106
 # Cop supports --auto-correct.
 Style/ParallelAssignment:
   Enabled: false
 
-# Offense count: 1390
+# Offense count: 1692
 # Cop supports --auto-correct.
 # Configuration parameters: PreferredDelimiters.
 Style/PercentLiteralDelimiters:
@@ -671,28 +546,14 @@ Style/PerlBackrefs:
     - 'lib/gitlab/search_results.rb'
     - 'lib/gitlab/sherlock/query.rb'
 
-# Offense count: 129
+# Offense count: 165
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: compact, exploded
 Style/RaiseArgs:
   Enabled: false
 
-# Offense count: 3
-# Cop supports --auto-correct.
-Style/RedundantBegin:
-  Exclude:
-    - 'app/models/merge_request.rb'
-    - 'app/services/projects/import_service.rb'
-    - 'lib/gitlab/health_checks/base_abstract_check.rb'
-
-# Offense count: 1
-# Cop supports --auto-correct.
-Style/RedundantConditional:
-  Exclude:
-    - 'lib/system_check/helpers.rb'
-
-# Offense count: 360
+# Offense count: 221
 # Cop supports --auto-correct.
 Style/RedundantFreeze:
   Enabled: false
@@ -712,31 +573,31 @@ Style/RedundantReturn:
     - 'lib/gitlab/utils.rb'
     - 'lib/google_api/auth.rb'
 
-# Offense count: 700
+# Offense count: 739
 # Cop supports --auto-correct.
 Style/RedundantSelf:
   Enabled: false
 
-# Offense count: 28
+# Offense count: 80
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, AllowInnerSlashes.
 # SupportedStyles: slashes, percent_r, mixed
 Style/RegexpLiteral:
   Enabled: false
 
-# Offense count: 41
+# Offense count: 42
 # Cop supports --auto-correct.
 Style/RescueModifier:
   Enabled: false
 
-# Offense count: 197
+# Offense count: 237
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: implicit, explicit
 Style/RescueStandardError:
   Enabled: false
 
-# Offense count: 5
+# Offense count: 4
 # Cop supports --auto-correct.
 Style/SelfAssignment:
   Exclude:
@@ -751,27 +612,21 @@ Style/SingleLineMethods:
   Exclude:
     - 'lib/gitlab/ci/ansi2html.rb'
 
-# Offense count: 91
+# Offense count: 94
 # Cop supports --auto-correct.
 # Configuration parameters: .
 # SupportedStyles: use_perl_names, use_english_names
 Style/SpecialGlobalVars:
   EnforcedStyle: use_perl_names
 
-# Offense count: 1
-# Cop supports --auto-correct.
-Style/StderrPuts:
-  Exclude:
-    - 'config/initializers/rspec_profiling.rb'
-
-# Offense count: 65
+# Offense count: 75
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: single_quotes, double_quotes
 Style/StringLiteralsInInterpolation:
   Enabled: false
 
-# Offense count: 187
+# Offense count: 216
 # Cop supports --auto-correct.
 # Configuration parameters: IgnoredMethods.
 # IgnoredMethods: respond_to, define_method
@@ -790,41 +645,7 @@ Style/TernaryParentheses:
     - 'spec/requests/api/pipeline_schedules_spec.rb'
     - 'spec/support/capybara.rb'
 
-# Offense count: 3
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyleForMultiline.
-# SupportedStylesForMultiline: comma, consistent_comma, no_comma
-Style/TrailingCommaInArguments:
-  Exclude:
-    - 'spec/features/markdown/copy_as_gfm_spec.rb'
-
-# Offense count: 10
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyleForMultiline.
-# SupportedStylesForMultiline: comma, consistent_comma, no_comma
-Style/TrailingCommaInArrayLiteral:
-  Exclude:
-    - 'ee/spec/models/project_spec.rb'
-    - 'spec/lib/gitlab/diff/position_tracer_spec.rb'
-    - 'spec/lib/gitlab/metrics/dashboard/processor_spec.rb'
-
-# Offense count: 2
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyleForMultiline.
-# SupportedStylesForMultiline: comma, consistent_comma, no_comma
-Style/TrailingCommaInHashLiteral:
-  Exclude:
-    - 'lib/gitlab/ci/ansi2html.rb'
-    - 'lib/gitlab/kubernetes.rb'
-
-# Offense count: 2
-# Cop supports --auto-correct.
-Style/UnlessElse:
-  Exclude:
-    - 'lib/backup/manager.rb'
-    - 'lib/gitlab/project_search_results.rb'
-
-# Offense count: 10
+# Offense count: 8
 # Cop supports --auto-correct.
 Style/UnneededCondition:
   Exclude:
@@ -832,19 +653,10 @@ Style/UnneededCondition:
     - 'app/helpers/environment_helper.rb'
     - 'app/models/project.rb'
     - 'app/services/issuable/clone/base_service.rb'
-    - 'app/services/prometheus/adapter_service.rb'
     - 'lib/gitlab/email/message/repository_push.rb'
-    - 'lib/gitlab/prometheus_client.rb'
     - 'spec/lib/rspec_flaky/flaky_example_spec.rb'
 
-# Offense count: 73
+# Offense count: 99
 # Cop supports --auto-correct.
 Style/UnneededInterpolation:
   Enabled: false
-
-# Offense count: 2
-# Cop supports --auto-correct.
-Style/UnneededSort:
-  Exclude:
-    - 'app/models/concerns/resolvable_discussion.rb'
-    - 'lib/gitlab/highlight.rb'

.ruby-version

@@ -1 +1 @@
-2.6.3
+2.6.5

.vale.ini

@@ -0,0 +1,40 @@
+# Vale configuration file, taken from https://errata-ai.github.io/vale/config/
+
+# The relative path to the folder containing linting rules (styles)
+# -----------------------------------------------------------------
+StylesPath = doc/.linting/vale/styles
+
+# Minimum alert level
+# -------------------
+# The minimum alert level to display (suggestion, warning, or error).
+# If integrated into CI, builds fail by default on error-level alerts,
+# unless you execute Vale with the --no-exit flag
+MinAlertLevel = suggestion
+
+# Should Vale parse any file formats other than .md files as Markdown?
+# --------------------------------------------------------------------
+[formats]
+mdx = md
+
+# What file types should Vale test?
+# ----------------------------------
+[*.md]
+
+# Styles to load
+# --------------
+# What styles, located in the StylesPath folder, should Vale load?
+# Vale also currently includes write-good, proselint, joblint, and vale
+BasedOnStyles = gitlab
+
+# Enabling or disabling specific rules in a style
+# -----------------------------------------------
+# To disable a rule in an enabled style, use the following format:
+# {style}.{filename} = NO
+# To enable a single rule in a disabled style, use the following format:
+# vale.Editorializing = YES
+
+# Altering the severity of a rule in a style
+# ------------------------------------------
+# To change the reporting level (suggestion, warning, error) of a rule,
+# use the following format: {style}.{filename} = {level}
+# vale.Hedging = error

CHANGELOG-EE.md

@@ -1,5 +1,253 @@
 Please view this file on the master branch, on stable branches it's out of date.
 
+## 12.8.5
+
+- No changes.
+
+## 12.8.4
+
+- Unreleased due to tagging failure.
+
+## 12.8.3
+
+- Unreleased due to tagging failure.
+
+## 12.8.2
+
+### Security (5 changes)
+
+- Don't show Contribution Analytics to users who are not group members.
+- Update epic tree when group is transfered.
+- Fix Service Side Request Forgery in JenkinsDeprecatedService.
+- Enforce vulnerability feedback pipeline is in the same project.
+- Enforce existing vulnerability feedback pipeline is in the same project.
+
+
+## 12.8.1
+
+### Performance (1 change)
+
+- Geo - Fix query to retrieve Job Artifacts when selective sync is disabled. !25388
+
+
+## 12.8.0
+
+### Removed (1 change)
+
+- Remove confidence labels from security report. !24033
+
+### Fixed (33 changes, 1 of them is from the community)
+
+- Fix UI on Project Audit Events when the feature not available. !16032 (Takuya Noguchi)
+- Group SSO handles locked users gracefully instead of showing 500 error. !20329
+- Fix incorrect security status counts. !22650
+- Fix include subgroups in security status. !22653
+- Make sure type is set properly in Elasticsearch query when doing global search. !22821
+- Include users from all sub-projects and shared groups when counting billing seats currently in use. !22967
+- Fix vulnerability finding list endpoint query timeout on instance security dashboard. !23232
+- Add app validation for any-approver rule uniqueness. !23241
+- Fix 500 error in global search for blob, wiki_blob and commit search. !23326
+- Fix group hook triggering from subgroup project. !23333
+- Change conditions when user uses license seat. !23522
+- Accept group path as ID when fetching notes from API. !23535
+- Fixes a bug that prevented auto-remediation on the pipeline security dashboard. !23677
+- Fix nav link in security submenu. !23775
+- Order epic related issues by relative_position. !23776
+- Correctly display the number of approvals for a merge request. !23827
+- Fix orphan issues that were promoted to epics. !23916
+- Fix rendering of design management references. !24001
+- Fix 500 error when browsing the roadmap page for a group the user is not authorized to view. !24002
+- Use project slug instead of name for Error Tracking Settings Display. !24176
+- Display error message in MR License Report if it fails to load. !24201
+- Fix display logic of Securty Report MR widget. !24204
+- Set SSL certificates path env when calling ES indexer. !24213
+- Allow submit to event to trigger a new search. !24262
+- Fix npm package uploads when bundleDependencies is set to false. !24355
+- Resolve 500 error after Web IDE terminal use. !24443
+- Added commas to current active user count when appropriate. !24549
+- Hide duplicate company/individual question on trial selection. !24567
+- Update invalid SPDX identifiers in software licenses table. !24829
+- Cleanup deprecated package dependency links. !24868
+- Fix to display a link to the logs in both embed and dashboard. !25288
+- Disable self-approval at the Instance level - Fix approvals filtering. !25385
+- Allow user to close sidebar while editing boardlist and save wip limit.
+
+### Changed (13 changes)
+
+- Display generic error in codeclimate MR widget when base_path is null. !21666
+- Adjust skip trial copy in trial sign up flow for SaaS users who are logged in. !22923
+- Use export icon instead of download for the export button in the Dependencies List. !23094
+- Apply darker color to column headers and scan names in secure features configuration. !23104
+- Redacts quick actions used by support bot. !23353
+- Remove Code Review Analytics feature flag. !23418
+- Delete description change history - Frontend. !23568
+- Support moving the design repository of a project when the project is transferred to a new namespace. !23573
+- Display proper error messages on vulnerabilities fetch failure. !23812
+- Add date range validation for Cycle Analytics at the backend side. !24254
+- Exclude GitLab generated bot users from using a license seat. !24275
+- Changes the standalone vulnerabilty endpoint. !24777
+- Move Productivity Analytics page to the group level. !25329
+
+### Performance (1 change)
+
+- Geo - Fix query to retrieve Job Artifacts when selective sync is disabled. !25388
+
+### Added (42 changes, 1 of them is from the community)
+
+- Create DesignAtVersion model, exposing it with GraphQL. !15260
+- Add Group-level compliance dashboard MVC. !20844
+- Adds sorting to package api. !20963
+- Allow to soft delete issuables description history. !21439
+- Display warning flash if design upload is skipped. !21615
+- Ask if a user is trying GitLab for his company or for his individual usage. !22280
+- Support design tab link references for issues. !22330
+- Allow using custom user name for service desk emails. !22478
+- Raise exception if any namespaces runner minutes were not reset. !22636
+- Adds vulnerability management state dropdown. !22823
+- Add additional license information to admin dashboard. !22866
+- Add sort by date to audit logs and events. !22887
+- Add Group WebHooks API. !22994 (Rajendra Kadam)
+- Add API route to confirm a vulnerability. !23099
+- Creates the standalone vulnerability list page. !23438
+- Show license badge for Gitlab.com member overview. !23521
+- Create audit log when username changes. !23576
+- Resolve Disable self-approval at the Instance level. !23731
+- Add time picker to logs page. !23837
+- Introduce Credentials Inventory for Groups that enforce Group Managed Accounts. !23944
+- Add API for protected environments. !23964
+- Prompt users to check their account settings. !23994
+- Allow to pick a subgroup to hold the Insights config. !24053
+- Add health_status column to issues and epics tables. !24202
+- Add a link in dashboard to allow users to go to the logs page. !24240
+- Record audit event when user is deleted. !24257
+- Time Series chart filtered time range (datazoom) becomes reflected in the View logs link. !24343
+- Scope merge request approval rules to protected branches using API search. !24344
+- Add application limit for ES indexed field length. !24345
+- Add affected projects feature to instance security dashboard. !24644
+- Add trial field to namespaces API. !24666
+- Make elasticsearch bulk parameters configurable. !24688
+- Add feature filter for users. !24765
+- Design view: moveable `new comment` pin. !24769
+- Record audit event when user is added. !24855
+- Add group identification headers to epic emails. !24878
+- Record audit event when user is blocked. !24930
+- Moveable design note pins. !24934
+- Add NuGet Repository. !25157
+- Add single-level Epics to EE Premium. !25184
+- Show View logs link in embed metrics. !25217
+- Add usage ping counter for events. !199874
+
+### Other (1 change)
+
+- Prepare DB structure for GMA forking changes. !22002
+
+
+## 12.7.5
+
+### Fixed (1 change)
+
+- Fix DB connection pool size for Geo database. !24021
+
+
+## 12.7.3
+
+- No changes.
+
+## 12.7.1
+
+### Fixed (1 change)
+
+- Fix create/delete API calls for approval rules. !23107
+
+
+## 12.7.0
+
+### Removed (2 changes)
+
+- Remove `project_ci_cd_settings.merge_trains_enabled` column. !19701
+- Remove old pipeline security report view in favor of the Security Dashboard. !22152
+
+### Fixed (20 changes, 1 of them is from the community)
+
+- Add error flashes to Design view. !20889
+- Pending (unsubmitted) review comments with multiple lines now display whitespace before being submitted. !21435
+- Fixed GitLab admin not seeing merge requests in Jira Development Panel Integration. !21467
+- fix CSS shadowbox on focus. !21785 (allenlai18)
+- Fix GraphQL access to groups with SAML SSO Enforcement. !21922
+- Remove spinner when approval require input is changed. !22186
+- Add billing plans box to profiles. !22270
+- Use full reference in Epic Issue GraphQL query. !22292
+- Support new Azure SCIM pre-setup check. !22348
+- Show expiry details in Audit events when changing acesss levels. !22412
+- Fix PruneOrphanedGeoEvents to pass in demodulized name to BackgroundMigrationWorker. !22451
+- Update widget on click dropdown item when creating epic from epic. !22511
+- Ensure When userWithId Is Picked User IDs are Sent. !22528
+- Fix initial sorting of non-persisted Cycle Analytics stages. !22541
+- The Active tab on the Admin Users page should include bots. !22543
+- Fix reply emails with attachments for epics. !22547
+- Fix child epics depth validation. !22729
+- Users without a license do not use a seat. !23146
+- Fix access to horizontal scrollbar when zooming in on a design.
+- fix positioning of design overlay pins when viewing design.
+
+### Changed (13 changes)
+
+- Rename "Production" stage in Cycle Analytics to "Total". !21450
+- Update copy for start a free gold trial screen. !21820
+- Show Geo node's name in admin page. !21876
+- Improve validation message when a design extension is unsupported. !21888
+- Prevent spiders indexing contribution analytics. !21896
+- Replace depricatedModal (Geo) with GlModal. !22125
+- Allow namespaces in a trial to upgrade to any plan. !22273
+- DAST vendored template pins DAST to latest major version. !22371
+- Rename productivity analytics date parameters. !22377
+- Rename Contribution Analytics endpoint URL. !22877
+- Move 'Allow admins to disable users ability to change profile name' feature to Premium tier. !23034
+- Change security dashboard's filters bar background. !23094
+- Add First & last name on the trial form. !33742
+
+### Performance (3 changes)
+
+- Cache vulnerability summary per project/group. !21373
+- Fix N+1 SQL queries with protected environments. !22101
+- Optimize Group#for_epics scope. !22375
+
+### Added (26 changes)
+
+- GitLab Pages - Storage size Limitations by Project or Group. !17725
+- Add Instance Security Dashboard feature. !18008
+- Add NPM dist-tag support. !20636
+- Track resource weight changes. !21515
+- Add support for custom email templates for service desk. !21745
+- members list to group sso page. !21852
+- Alow to filter by saml identity linked for group members API. !21931
+- Added submit_review quick action. !22061
+- Adds project_id and project_path to package group api. !22089
+- Add trial_ends_on to Namespaces API. !22121
+- Uniquifies path slug creation from trial new group name. !22147
+- Capture Release actions in the audit log page. !22167
+- Add ability to cancel a design discussion. !22241
+- Enable License compliance feature for all instances. !22250
+- Add support for license_scanning artifact report. !22277
+- Add trial counters to usage ping. !22279
+- Support gl-license-scanning-report.json file. !22312
+- Includes _link object in packages list api. !22503
+- Geo - Replicate project designs repositories. !22544
+- Add information about epic to Issue list csv export. !22662
+- Scope approval rules by protected branches via API. !22673
+- Prevent a child pipeline to create further child pipelines. !22675
+- Adds pipeline object to package API. !22854
+- Add zooming functionality to designs in Design view. !22863
+- Introduce Code Review Analytics page. !23031
+- Add support for work in progress limits - Max issue count only.
+
+### Other (3 changes, 1 of them is from the community)
+
+- Generate appropriate Vue key for licenses list table. !21566 (allenlai18)
+- Limit size of search query for non ES searches. !22208
+- Remove "creations" in gitlab_subscription_histories on gitlab.com. !22278
+
+
 ## 12.6.7
 
 - No changes.
@@ -16,10 +264,6 @@ Please view this file on the master branch, on stable branches it's out of date.
 
 - No changes.
 
-## 12.6.3
-
-- No changes.
-
 ## 12.6.2
 
 ### Security (2 changes)
@@ -128,6 +372,10 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Update the alerts used in the Dependency List to follow GitLab design guidelines. !21760
 
 
+## 12.5.8
+
+- No changes.
+
 ## 12.5.5
 
 - No changes.
@@ -248,6 +496,10 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Remove IIFEs from jira_connect.js file. !19248 (nuwe1)
 
 
+## 12.4.8
+
+- No changes.
+
 ## 12.4.5
 
 - No changes.

GITALY_SERVER_VERSION

@@ -1 +1 @@
-12.6.8
+12.8.6

GITLAB_ELASTICSEARCH_INDEXER_VERSION

@@ -1 +1 @@
-1.5.0
+2.1.0

GITLAB_PAGES_VERSION

@@ -1 +1 @@
-1.12.0
+1.16.0

GITLAB_SHELL_VERSION

@@ -1 +1 @@
-10.3.0
+11.0.0

GITLAB_WORKHORSE_VERSION

@@ -1 +1 @@
-8.20.0
+8.21.0

Gemfile

@@ -1,6 +1,6 @@
 source 'https://rubygems.org'
 
-gem 'rails', '5.2.3'
+gem 'rails', '6.0.2'
 
 gem 'bootsnap', '~> 1.4'
 
@@ -19,21 +19,21 @@ gem 'default_value_for', '~> 3.3.0'
 gem 'pg', '~> 1.1'
 
 gem 'rugged', '~> 0.28'
-gem 'grape-path-helpers', '~> 1.1'
+gem 'grape-path-helpers', '~> 1.2'
 
 gem 'faraday', '~> 0.12'
 gem 'marginalia', '~> 1.8.0'
 
 # Authentication libraries
 gem 'devise', '~> 4.6'
-gem 'doorkeeper', '~> 4.3'
-gem 'doorkeeper-openid_connect', '~> 1.5'
+gem 'doorkeeper', '~> 5.0.2'
+gem 'doorkeeper-openid_connect', '~> 1.6.3'
 gem 'omniauth', '~> 1.8'
 gem 'omniauth-auth0', '~> 2.0.0'
 gem 'omniauth-azure-oauth2', '~> 0.0.9'
 gem 'omniauth-cas3', '~> 1.1.4'
 gem 'omniauth-facebook', '~> 4.0.0'
-gem 'omniauth-github', '~> 1.3'
+gem 'omniauth-github', '~> 1.4'
 gem 'omniauth-gitlab', '~> 1.0.2'
 gem 'omniauth-google-oauth2', '~> 0.6.0'
 gem 'omniauth-kerberos', '~> 0.3.0', group: :kerberos
@@ -67,7 +67,7 @@ gem 'u2f', '~> 0.2.1'
 gem 'validates_hostname', '~> 1.0.6'
 gem 'rubyzip', '~> 2.0.0', require: 'zip'
 # GitLab Pages letsencrypt support
-gem 'acme-client', '~> 2.0.2'
+gem 'acme-client', '~> 2.0.5'
 
 # Browser detection
 gem 'browser', '~> 2.5'
@@ -84,10 +84,10 @@ gem 'net-ldap'
 # API
 gem 'grape', '~> 1.1.0'
 gem 'grape-entity', '~> 0.7.1'
-gem 'rack-cors', '~> 1.0.0', require: 'rack/cors'
+gem 'rack-cors', '~> 1.0.6', require: 'rack/cors'
 
 # GraphQL API
-gem 'graphql', '~> 1.9.11'
+gem 'graphql', '~> 1.9.12'
 # NOTE: graphiql-rails v1.5+ doesn't work: https://gitlab.com/gitlab-org/gitlab/issues/31771
 # TODO: remove app/views/graphiql/rails/editors/show.html.erb when https://github.com/rmosolgo/graphiql-rails/pull/71 is released:
 # https://gitlab.com/gitlab-org/gitlab/issues/31747
@@ -129,15 +129,15 @@ gem 'unf', '~> 0.1.4'
 gem 'seed-fu', '~> 2.3.7'
 
 # Search
-gem 'elasticsearch-model', '~> 0.1.9'
-gem 'elasticsearch-rails', '~> 0.1.9', require: 'elasticsearch/rails/instrumentation'
-gem 'elasticsearch-api',   '5.0.3'
+gem 'elasticsearch-model', '~> 6.1'
+gem 'elasticsearch-rails', '~> 6.1', require: 'elasticsearch/rails/instrumentation'
+gem 'elasticsearch-api',   '~> 6.8'
 gem 'aws-sdk'
 gem 'faraday_middleware-aws-signers-v4'
 
 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.12'
-gem 'deckar01-task_list', '2.2.1'
+gem 'deckar01-task_list', '2.3.1'
 gem 'gitlab-markup', '~> 1.7.0'
 gem 'github-markup', '~> 1.7.0', require: 'github/markup'
 gem 'commonmarker', '~> 0.20'
@@ -148,8 +148,8 @@ gem 'creole', '~> 0.5.0'
 gem 'wikicloth', '0.8.1'
 gem 'asciidoctor', '~> 2.0.10'
 gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
-gem 'asciidoctor-plantuml', '0.0.9'
-gem 'rouge', '~> 3.11.0'
+gem 'asciidoctor-plantuml', '0.0.10'
+gem 'rouge', '~> 3.15.0'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
 gem 'nokogiri', '~> 1.10.5'
@@ -249,7 +249,7 @@ gem 'asana', '~> 0.9'
 gem 'ruby-fogbugz', '~> 0.2.1'
 
 # Kubernetes integration
-gem 'kubeclient', '~> 4.4.0'
+gem 'kubeclient', '~> 4.6.0'
 
 # Sanitize user input
 gem 'sanitize', '~> 4.6'
@@ -283,7 +283,7 @@ gem 'rack-proxy', '~> 0.6.0'
 gem 'sassc-rails', '~> 2.1.0'
 gem 'uglifier', '~> 2.7.2'
 
-gem 'addressable', '~> 2.5.2'
+gem 'addressable', '~> 2.7'
 gem 'font-awesome-rails', '~> 4.7'
 gem 'gemojione', '~> 3.3'
 gem 'gon', '~> 6.2'
@@ -301,11 +301,11 @@ gem 'sentry-raven', '~> 2.9'
 gem 'premailer-rails', '~> 1.10.3'
 
 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.5'
+gem 'gitlab-labkit', '0.9.1'
 
 # I18n
 gem 'ruby_parser', '~> 3.8', require: false
-gem 'rails-i18n', '~> 5.1'
+gem 'rails-i18n', '~> 6.0'
 gem 'gettext_i18n_rails', '~> 1.8.0'
 gem 'gettext_i18n_rails_js', '~> 1.3'
 gem 'gettext', '~> 3.2.2', require: false, group: :development
@@ -349,7 +349,7 @@ end
 group :development, :test do
   gem 'bullet', '~> 6.0.2', require: !!ENV['ENABLE_BULLET']
   gem 'pry-byebug', '~> 3.5.1', platform: :mri
-  gem 'pry-rails', '~> 0.3.4'
+  gem 'pry-rails', '~> 0.3.9'
 
   gem 'awesome_print', require: false
 
@@ -366,11 +366,11 @@ group :development, :test do
   gem 'spring', '~> 2.0.0'
   gem 'spring-commands-rspec', '~> 1.0.4'
 
-  gem 'gitlab-styles', '~> 2.7', require: false
+  gem 'gitlab-styles', '~> 3.1.0', require: false
   # Pin these dependencies, otherwise a new rule could break the CI pipelines
-  gem 'rubocop', '~> 0.69.0'
-  gem 'rubocop-performance', '~> 1.1.0'
-  gem 'rubocop-rspec', '~> 1.22.1'
+  gem 'rubocop', '~> 0.74.0'
+  gem 'rubocop-performance', '~> 1.4.1'
+  gem 'rubocop-rspec', '~> 1.37.0'
 
   gem 'scss_lint', '~> 0.56.0', require: false
   gem 'haml_lint', '~> 0.34.0', require: false
@@ -381,11 +381,13 @@ group :development, :test do
 
   gem 'knapsack', '~> 1.17'
 
-  gem 'stackprof', '~> 0.2.13', require: false
-
   gem 'simple_po_parser', '~> 1.1.2', require: false
 
   gem 'timecop', '~> 0.8.0'
+
+  gem 'png_quantizator', '~> 0.2.1', require: false
+
+  gem 'parallel', '~> 1.19', require: false
 end
 
 # Gems required in omnibus-gitlab pipeline
@@ -415,7 +417,7 @@ group :test do
   gem 'guard-rspec'
 end
 
-gem 'octokit', '~> 4.9'
+gem 'octokit', '~> 4.15'
 
 gem 'mail_room', '~> 0.10.0'
 
@@ -423,6 +425,7 @@ gem 'email_reply_trimmer', '~> 0.1'
 gem 'html2text'
 
 gem 'ruby-prof', '~> 1.0.0'
+gem 'stackprof', '~> 0.2.15', require: false
 gem 'rbtrace', '~> 0.4', require: false
 gem 'memory_profiler', '~> 0.9', require: false
 gem 'benchmark-memory', '~> 0.1', require: false
@@ -452,13 +455,13 @@ group :ed25519 do
 end
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 1.73.0'
+gem 'gitaly', '~> 1.86.0'
 
 gem 'grpc', '~> 1.24.0'
 
 gem 'google-protobuf', '~> 3.8.0'
 
-gem 'toml-rb', '~> 1.0.0', require: false
+gem 'toml-rb', '~> 1.0.0'
 
 # Feature toggles
 gem 'flipper', '~> 0.17.1'
@@ -477,3 +480,15 @@ gem 'gitlab-net-dns', '~> 0.9.1'
 gem 'countries', '~> 3.0'
 
 gem 'retriable', '~> 3.1.2'
+
+gem 'liquid', '~> 4.0'
+
+# LRU cache
+gem 'lru_redux'
+
+gem 'erubi', '~> 1.9.0'
+
+# Locked as long as quoted-printable encoding issues are not resolved
+# Monkey-patched in `config/initializers/mail_encoding_patch.rb`
+# See https://gitlab.com/gitlab-org/gitlab/issues/197386
+gem 'mail', '= 2.7.1'

Gemfile.lock

@@ -4,65 +4,78 @@ GEM
     RedCloth (4.3.2)
     abstract_type (0.0.7)
     ace-rails-ap (4.1.2)
-    acme-client (2.0.2)
+    acme-client (2.0.5)
       faraday (~> 0.9, >= 0.9.1)
-    actioncable (5.2.3)
-      actionpack (= 5.2.3)
+    actioncable (6.0.2)
+      actionpack (= 6.0.2)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailer (5.2.3)
-      actionpack (= 5.2.3)
-      actionview (= 5.2.3)
-      activejob (= 5.2.3)
+    actionmailbox (6.0.2)
+      actionpack (= 6.0.2)
+      activejob (= 6.0.2)
+      activerecord (= 6.0.2)
+      activestorage (= 6.0.2)
+      activesupport (= 6.0.2)
+      mail (>= 2.7.1)
+    actionmailer (6.0.2)
+      actionpack (= 6.0.2)
+      actionview (= 6.0.2)
+      activejob (= 6.0.2)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (5.2.3)
-      actionview (= 5.2.3)
-      activesupport (= 5.2.3)
+    actionpack (6.0.2)
+      actionview (= 6.0.2)
+      activesupport (= 6.0.2)
       rack (~> 2.0)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.2.3)
-      activesupport (= 5.2.3)
+      rails-html-sanitizer (~> 1.0, >= 1.2.0)
+    actiontext (6.0.2)
+      actionpack (= 6.0.2)
+      activerecord (= 6.0.2)
+      activestorage (= 6.0.2)
+      activesupport (= 6.0.2)
+      nokogiri (>= 1.8.5)
+    actionview (6.0.2)
+      activesupport (= 6.0.2)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.2.3)
-      activesupport (= 5.2.3)
+      rails-html-sanitizer (~> 1.1, >= 1.2.0)
+    activejob (6.0.2)
+      activesupport (= 6.0.2)
       globalid (>= 0.3.6)
-    activemodel (5.2.3)
-      activesupport (= 5.2.3)
-    activerecord (5.2.3)
-      activemodel (= 5.2.3)
-      activesupport (= 5.2.3)
-      arel (>= 9.0)
+    activemodel (6.0.2)
+      activesupport (= 6.0.2)
+    activerecord (6.0.2)
+      activemodel (= 6.0.2)
+      activesupport (= 6.0.2)
     activerecord-explain-analyze (0.1.0)
       activerecord (>= 4)
       pg
-    activestorage (5.2.3)
-      actionpack (= 5.2.3)
-      activerecord (= 5.2.3)
+    activestorage (6.0.2)
+      actionpack (= 6.0.2)
+      activejob (= 6.0.2)
+      activerecord (= 6.0.2)
       marcel (~> 0.3.1)
-    activesupport (5.2.3)
+    activesupport (6.0.2)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
+      zeitwerk (~> 2.2)
     acts-as-taggable-on (6.5.0)
       activerecord (>= 5.0, < 6.1)
     adamantium (0.2.0)
       ice_nine (~> 0.11.0)
       memoizable (~> 0.4.0)
-    addressable (2.5.2)
-      public_suffix (>= 2.0.2, < 4.0)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
     aes_key_wrap (1.0.1)
     akismet (3.0.0)
     apollo_upload_server (2.0.0.beta.3)
       graphql (>= 1.8)
       rails (>= 4.2)
-    arel (9.0.0)
     asana (0.9.3)
       faraday (~> 0.9)
       faraday_middleware (~> 0.9)
@@ -71,7 +84,7 @@ GEM
     asciidoctor (2.0.10)
     asciidoctor-include-ext (0.3.1)
       asciidoctor (>= 1.5.6, < 3.0.0)
-    asciidoctor-plantuml (0.0.9)
+    asciidoctor-plantuml (0.0.10)
       asciidoctor (>= 1.5.6, < 3.0.0)
     ast (2.4.0)
     atlassian-jwt (0.2.0)
@@ -117,7 +130,7 @@ GEM
       activemodel (>= 5.0)
     brakeman (4.2.1)
     browser (2.5.3)
-    builder (3.2.3)
+    builder (3.2.4)
     bullet (6.0.2)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
@@ -171,7 +184,7 @@ GEM
       unicode_utils (~> 1.4)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
-    crass (1.0.5)
+    crass (1.0.6)
     creole (0.5.0)
     css_parser (1.7.0)
       addressable
@@ -192,19 +205,20 @@ GEM
     database_cleaner (1.7.0)
     debug_inspector (0.0.3)
     debugger-ruby_core_source (1.3.8)
-    deckar01-task_list (2.2.1)
+    deckar01-task_list (2.3.1)
       html-pipeline
     declarative (0.0.10)
     declarative-option (0.1.0)
     default_value_for (3.3.0)
       activerecord (>= 3.2.0, < 6.1)
-    derailed_benchmarks (1.3.5)
+    derailed_benchmarks (1.4.2)
       benchmark-ips (~> 2)
       get_process_mem (~> 0)
       heapy (~> 0)
       memory_profiler (~> 0)
       rack (>= 1)
-      rake (> 10, < 13)
+      rake (> 10, < 14)
+      ruby-statistics (>= 2.1)
       thor (~> 0.19)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
@@ -229,23 +243,23 @@ GEM
     docile (1.3.1)
     domain_name (0.5.20180417)
       unf (>= 0.0.5, < 1.0.0)
-    doorkeeper (4.3.2)
+    doorkeeper (5.0.2)
       railties (>= 4.2)
-    doorkeeper-openid_connect (1.5.0)
-      doorkeeper (~> 4.3)
+    doorkeeper-openid_connect (1.6.3)
+      doorkeeper (>= 5.0, < 5.2)
       json-jwt (~> 1.6)
     ed25519 (1.2.4)
-    elasticsearch (5.0.3)
-      elasticsearch-api (= 5.0.3)
-      elasticsearch-transport (= 5.0.3)
-    elasticsearch-api (5.0.3)
+    elasticsearch (6.8.0)
+      elasticsearch-api (= 6.8.0)
+      elasticsearch-transport (= 6.8.0)
+    elasticsearch-api (6.8.0)
       multi_json
-    elasticsearch-model (0.1.9)
+    elasticsearch-model (6.1.0)
       activesupport (> 3)
-      elasticsearch (> 0.4)
+      elasticsearch (> 1)
       hashie
-    elasticsearch-rails (0.1.9)
-    elasticsearch-transport (5.0.3)
+    elasticsearch-rails (6.1.0)
+    elasticsearch-transport (6.8.0)
       faraday
       multi_json
     email_reply_trimmer (0.1.6)
@@ -270,7 +284,7 @@ GEM
     factory_bot_rails (5.1.0)
       factory_bot (~> 5.1.0)
       railties (>= 4.2.0)
-    faraday (0.12.2)
+    faraday (0.15.4)
       multipart-post (>= 1.2, < 3)
     faraday-http-cache (2.0.0)
       faraday (~> 0.8)
@@ -286,6 +300,9 @@ GEM
     fast_gettext (1.6.0)
     ffaker (2.10.0)
     ffi (1.11.3)
+    ffi-compiler (1.0.1)
+      ffi (>= 1.0.0)
+      rake
     flipper (0.17.1)
     flipper-active_record (0.17.1)
       activerecord (>= 4.2, < 7)
@@ -345,7 +362,8 @@ GEM
     gemoji (3.0.1)
     gemojione (3.3.0)
       json
-    get_process_mem (0.2.3)
+    get_process_mem (0.2.5)
+      ffi (~> 1.0)
     gettext (3.2.9)
       locale (>= 2.0.5)
       text (>= 1.3.0)
@@ -357,12 +375,12 @@ GEM
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
     git (1.5.0)
-    gitaly (1.73.0)
+    gitaly (1.86.0)
       grpc (~> 1.0)
     github-markup (1.7.0)
     gitlab-chronic (0.10.5)
       numerizer (~> 0.2)
-    gitlab-labkit (0.7.0)
+    gitlab-labkit (0.9.1)
       actionpack (>= 5.0.0, < 6.1.0)
       activesupport (>= 5.0.0, < 6.1.0)
       grpc (~> 1.19)
@@ -379,11 +397,12 @@ GEM
       gitlab-puma (>= 2.7, < 5)
     gitlab-sidekiq-fetcher (0.5.2)
       sidekiq (~> 5)
-    gitlab-styles (2.8.0)
-      rubocop (~> 0.69.0)
+    gitlab-styles (3.1.0)
+      rubocop (~> 0.74.0)
       rubocop-gitlab-security (~> 0.1.0)
-      rubocop-performance (~> 1.1.0)
-      rubocop-rspec (~> 1.19)
+      rubocop-performance (~> 1.4.1)
+      rubocop-rails (~> 2.0)
+      rubocop-rspec (~> 1.36)
     gitlab_chronic_duration (0.10.6.2)
       numerizer (~> 0.2)
     gitlab_omniauth-ldap (2.1.1)
@@ -426,16 +445,17 @@ GEM
     grape-entity (0.7.1)
       activesupport (>= 4.0)
       multi_json (>= 1.3.2)
-    grape-path-helpers (1.1.0)
+    grape-path-helpers (1.2.0)
       activesupport
       grape (~> 1.0)
       rake (~> 12)
-    grape_logging (1.7.0)
+    grape_logging (1.8.3)
       grape
+      rack
     graphiql-rails (1.4.10)
       railties
       sprockets-rails
-    graphql (1.9.11)
+    graphql (1.9.12)
     graphql-docs (1.6.0)
       commonmarker (~> 0.16)
       escape_utils (~> 1.2)
@@ -477,7 +497,7 @@ GEM
       tilt
     hangouts-chat (0.0.5)
     hashdiff (0.3.8)
-    hashie (3.5.7)
+    hashie (3.6.0)
     hashie-forbidden_attributes (0.1.1)
       hashie (>= 3.0)
     health_check (2.6.0)
@@ -492,20 +512,21 @@ GEM
     html2text (0.2.0)
       nokogiri (~> 1.6)
     htmlentities (4.3.4)
-    http (3.3.0)
+    http (4.2.0)
       addressable (~> 2.3)
       http-cookie (~> 1.0)
       http-form_data (~> 2.0)
-      http_parser.rb (~> 0.6.0)
+      http-parser (~> 1.2.0)
     http-cookie (1.0.3)
       domain_name (~> 0.5)
     http-form_data (2.1.1)
-    http_parser.rb (0.6.0)
+    http-parser (1.2.1)
+      ffi-compiler (>= 1.0, < 2.0)
     httparty (0.16.4)
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     httpclient (2.8.3)
-    i18n (1.7.0)
+    i18n (1.8.2)
       concurrent-ruby (~> 1.0)
     i18n_data (0.8.0)
     icalendar (2.4.1)
@@ -519,7 +540,7 @@ GEM
     jaeger-client (0.10.0)
       opentracing (~> 0.3)
       thrift
-    jaro_winkler (1.5.3)
+    jaro_winkler (1.5.4)
     jira-ruby (1.7.1)
       activesupport
       atlassian-jwt
@@ -556,8 +577,8 @@ GEM
     kramdown (2.1.0)
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
-    kubeclient (4.4.0)
-      http (~> 3.0)
+    kubeclient (4.6.0)
+      http (>= 3.0, < 5.0)
       recursive-open-struct (~> 1.0, >= 1.0.4)
       rest-client (~> 2.0)
     launchy (2.4.3)
@@ -577,6 +598,7 @@ GEM
       xml-simple
     licensee (8.9.2)
       rugged (~> 0.24)
+    liquid (4.0.3)
     listen (3.1.5)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
@@ -587,9 +609,10 @@ GEM
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.3.1)
+    loofah (2.4.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
+    lru_redux (1.1.0)
     lumberjack (1.0.13)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
@@ -602,20 +625,20 @@ GEM
     memoist (0.16.0)
     memoizable (0.4.2)
       thread_safe (~> 0.3, >= 0.3.1)
-    memory_profiler (0.9.13)
+    memory_profiler (0.9.14)
     method_source (0.9.2)
     mime-types (3.2.2)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2019.0331)
-    mimemagic (0.3.2)
+    mimemagic (0.3.3)
     mini_magick (4.9.5)
     mini_mime (1.0.2)
     mini_portile2 (2.4.0)
     minitest (5.11.3)
     msgpack (1.3.1)
-    multi_json (1.13.1)
+    multi_json (1.14.1)
     multi_xml (0.6.0)
-    multipart-post (2.0.0)
+    multipart-post (2.1.1)
     murmurhash3 (0.1.6)
     mustermann (1.0.3)
     mustermann-grape (1.0.0)
@@ -623,13 +646,13 @@ GEM
     nakayoshi_fork (0.0.4)
     nap (1.1.0)
     nenv (0.3.0)
-    net-ldap (0.16.0)
+    net-ldap (0.16.2)
     net-ntp (2.1.3)
     net-ssh (5.2.0)
     netrc (0.11.0)
     nio4r (2.5.2)
     no_proxy_fix (0.1.2)
-    nokogiri (1.10.5)
+    nokogiri (1.10.7)
       mini_portile2 (~> 2.4.0)
     nokogumbo (1.5.0)
       nokogiri
@@ -644,7 +667,8 @@ GEM
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 3)
-    octokit (4.9.0)
+    octokit (4.15.0)
+      faraday (>= 0.9)
       sawyer (~> 0.8.0, >= 0.5.3)
     omniauth (1.9.0)
       hashie (>= 3.4.6, < 3.7.0)
@@ -664,7 +688,7 @@ GEM
       omniauth (~> 1.2)
     omniauth-facebook (4.0.0)
       omniauth-oauth2 (~> 1.2)
-    omniauth-github (1.3.0)
+    omniauth-github (1.4.0)
       omniauth (~> 1.5)
       omniauth-oauth2 (>= 1.4.0, < 2.0)
     omniauth-gitlab (1.0.3)
@@ -725,13 +749,14 @@ GEM
       rubypants (~> 0.2)
     orm_adapter (0.5.0)
     os (1.0.0)
-    parallel (1.17.0)
-    parser (2.6.3.0)
+    parallel (1.19.1)
+    parser (2.6.5.0)
       ast (~> 2.4.0)
     parslet (1.8.2)
     peek (1.1.0)
       railties (>= 4.0.0)
-    pg (1.1.4)
+    pg (1.2.2)
+    png_quantizator (0.2.1)
     po_to_json (1.0.1)
       json (>= 1.6.0)
     premailer (1.11.1)
@@ -753,9 +778,9 @@ GEM
     pry-byebug (3.5.1)
       byebug (~> 9.1)
       pry (~> 0.10)
-    pry-rails (0.3.6)
+    pry-rails (0.3.9)
       pry (>= 0.10.4)
-    public_suffix (3.1.1)
+    public_suffix (4.0.3)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.1.6)
     rack (2.0.7)
@@ -778,18 +803,20 @@ GEM
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
     rack-timeout (0.5.1)
-    rails (5.2.3)
-      actioncable (= 5.2.3)
-      actionmailer (= 5.2.3)
-      actionpack (= 5.2.3)
-      actionview (= 5.2.3)
-      activejob (= 5.2.3)
-      activemodel (= 5.2.3)
-      activerecord (= 5.2.3)
-      activestorage (= 5.2.3)
-      activesupport (= 5.2.3)
+    rails (6.0.2)
+      actioncable (= 6.0.2)
+      actionmailbox (= 6.0.2)
+      actionmailer (= 6.0.2)
+      actionpack (= 6.0.2)
+      actiontext (= 6.0.2)
+      actionview (= 6.0.2)
+      activejob (= 6.0.2)
+      activemodel (= 6.0.2)
+      activerecord (= 6.0.2)
+      activestorage (= 6.0.2)
+      activesupport (= 6.0.2)
       bundler (>= 1.3.0)
-      railties (= 5.2.3)
+      railties (= 6.0.2)
       sprockets-rails (>= 2.0.0)
     rails-controller-testing (1.0.4)
       actionpack (>= 5.0.1.x)
@@ -800,15 +827,15 @@ GEM
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.3.0)
       loofah (~> 2.3)
-    rails-i18n (5.1.1)
+    rails-i18n (6.0.0)
       i18n (>= 0.7, < 2)
-      railties (>= 5.0, < 6)
-    railties (5.2.3)
-      actionpack (= 5.2.3)
-      activesupport (= 5.2.3)
+      railties (>= 6.0.0, < 7)
+    railties (6.0.2)
+      actionpack (= 6.0.2)
+      activesupport (= 6.0.2)
       method_source
       rake (>= 0.8.7)
-      thor (>= 0.19.0, < 2.0)
+      thor (>= 0.20.3, < 2.0)
     rainbow (3.0.0)
     raindrops (0.19.0)
     rake (12.3.3)
@@ -862,7 +889,7 @@ GEM
     retriable (3.1.2)
     rinku (2.0.0)
     rotp (2.1.2)
-    rouge (3.11.0)
+    rouge (3.15.0)
     rqrcode (0.7.0)
       chunky_png
     rqrcode-rails3 (0.1.7)
@@ -904,7 +931,7 @@ GEM
       pg
       rails
       sqlite3
-    rubocop (0.69.0)
+    rubocop (0.74.0)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
       parser (>= 2.6)
@@ -913,10 +940,13 @@ GEM
       unicode-display_width (>= 1.4.0, < 1.7)
     rubocop-gitlab-security (0.1.1)
       rubocop (>= 0.51)
-    rubocop-performance (1.1.0)
-      rubocop (>= 0.67.0)
-    rubocop-rspec (1.22.2)
-      rubocop (>= 0.52.1)
+    rubocop-performance (1.4.1)
+      rubocop (>= 0.71.0)
+    rubocop-rails (2.4.0)
+      rack (>= 1.1)
+      rubocop (>= 0.72.0)
+    rubocop-rspec (1.37.0)
+      rubocop (>= 0.68.1)
     ruby-enum (0.7.2)
       i18n
     ruby-fogbugz (0.2.1)
@@ -925,6 +955,7 @@ GEM
     ruby-progressbar (1.10.1)
     ruby-saml (1.7.2)
       nokogiri (>= 1.5.10)
+    ruby-statistics (2.1.1)
     ruby_dep (1.5.0)
     ruby_parser (3.13.1)
       sexp_processor (~> 4.9)
@@ -951,9 +982,9 @@ GEM
       sprockets (> 3.0)
       sprockets-rails
       tilt
-    sawyer (0.8.1)
-      addressable (>= 2.3.5, < 2.6)
-      faraday (~> 0.8, < 1.0)
+    sawyer (0.8.2)
+      addressable (>= 2.3.5)
+      faraday (> 0.8, < 2.0)
     scss_lint (0.56.0)
       rake (>= 0.9, < 13)
       sass (~> 3.5.3)
@@ -1006,7 +1037,7 @@ GEM
       sprockets (>= 3.0.0)
     sqlite3 (1.3.13)
     sshkey (2.0.0)
-    stackprof (0.2.13)
+    stackprof (0.2.15)
     state_machines (0.5.0)
     state_machines-activemodel (0.7.1)
       activemodel (>= 4.1)
@@ -1043,7 +1074,7 @@ GEM
     truncato (0.7.11)
       htmlentities (~> 4.3.1)
       nokogiri (>= 1.7.0, <= 2.0)
-    tzinfo (1.2.5)
+    tzinfo (1.2.6)
       thread_safe (~> 0.1)
     u2f (0.2.1)
     uber (0.1.0)
@@ -1099,9 +1130,9 @@ GEM
       hashdiff
     webpack-rails (0.9.11)
       railties (>= 3.2.0)
-    websocket-driver (0.7.0)
+    websocket-driver (0.7.1)
       websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.3)
+    websocket-extensions (0.1.4)
     wikicloth (0.8.1)
       builder
       expression_parser
@@ -1110,6 +1141,7 @@ GEM
     xml-simple (1.1.5)
     xpath (3.2.0)
       nokogiri (~> 1.8)
+    zeitwerk (2.2.2)
 
 PLATFORMS
   ruby
@@ -1117,16 +1149,16 @@ PLATFORMS
 DEPENDENCIES
   RedCloth (~> 4.3.2)
   ace-rails-ap (~> 4.1.0)
-  acme-client (~> 2.0.2)
+  acme-client (~> 2.0.5)
   activerecord-explain-analyze (~> 0.1)
   acts-as-taggable-on (~> 6.0)
-  addressable (~> 2.5.2)
+  addressable (~> 2.7)
   akismet (~> 3.0)
   apollo_upload_server (~> 2.0.0.beta3)
   asana (~> 0.9)
   asciidoctor (~> 2.0.10)
   asciidoctor-include-ext (~> 0.3.1)
-  asciidoctor-plantuml (= 0.0.9)
+  asciidoctor-plantuml (= 0.0.10)
   atlassian-jwt (~> 0.2.0)
   attr_encrypted (~> 3.1.0)
   awesome_print
@@ -1156,7 +1188,7 @@ DEPENDENCIES
   creole (~> 0.5.0)
   danger (~> 6.0)
   database_cleaner (~> 1.7.0)
-  deckar01-task_list (= 2.2.1)
+  deckar01-task_list (= 2.3.1)
   default_value_for (~> 3.3.0)
   derailed_benchmarks
   device_detector
@@ -1165,14 +1197,15 @@ DEPENDENCIES
   diff_match_patch (~> 0.1.0)
   diffy (~> 3.1.0)
   discordrb-webhooks-blackst0ne (~> 3.3)
-  doorkeeper (~> 4.3)
-  doorkeeper-openid_connect (~> 1.5)
+  doorkeeper (~> 5.0.2)
+  doorkeeper-openid_connect (~> 1.6.3)
   ed25519 (~> 1.2)
-  elasticsearch-api (= 5.0.3)
-  elasticsearch-model (~> 0.1.9)
-  elasticsearch-rails (~> 0.1.9)
+  elasticsearch-api (~> 6.8)
+  elasticsearch-model (~> 6.1)
+  elasticsearch-rails (~> 6.1)
   email_reply_trimmer (~> 0.1)
   email_spec (~> 2.2.0)
+  erubi (~> 1.9.0)
   escape_utils (~> 1.1)
   factory_bot_rails (~> 5.1.0)
   faraday (~> 0.12)
@@ -1197,17 +1230,17 @@ DEPENDENCIES
   gettext (~> 3.2.2)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 1.73.0)
+  gitaly (~> 1.86.0)
   github-markup (~> 1.7.0)
   gitlab-chronic (~> 0.10.5)
-  gitlab-labkit (~> 0.5)
+  gitlab-labkit (= 0.9.1)
   gitlab-license (~> 1.0)
   gitlab-markup (~> 1.7.0)
   gitlab-net-dns (~> 0.9.1)
   gitlab-puma (~> 4.3.1.gitlab.2)
   gitlab-puma_worker_killer (~> 0.1.1.gitlab.1)
   gitlab-sidekiq-fetcher (= 0.5.2)
-  gitlab-styles (~> 2.7)
+  gitlab-styles (~> 3.1.0)
   gitlab_chronic_duration (~> 0.10.6.2)
   gitlab_omniauth-ldap (~> 2.1.1)
   gon (~> 6.2)
@@ -1216,10 +1249,10 @@ DEPENDENCIES
   gpgme (~> 2.0.19)
   grape (~> 1.1.0)
   grape-entity (~> 0.7.1)
-  grape-path-helpers (~> 1.1)
+  grape-path-helpers (~> 1.2)
   grape_logging (~> 1.7)
   graphiql-rails (~> 1.4.10)
-  graphql (~> 1.9.11)
+  graphql (~> 1.9.12)
   graphql-docs (~> 1.6.0)
   grpc (~> 1.24.0)
   gssapi
@@ -1242,12 +1275,15 @@ DEPENDENCIES
   jwt (~> 2.1.0)
   kaminari (~> 1.0)
   knapsack (~> 1.17)
-  kubeclient (~> 4.4.0)
+  kubeclient (~> 4.6.0)
   letter_opener_web (~> 1.3.4)
   license_finder (~> 5.4)
   licensee (~> 8.9)
+  liquid (~> 4.0)
   lograge (~> 0.5)
   loofah (~> 2.2)
+  lru_redux
+  mail (= 2.7.1)
   mail_room (~> 0.10.0)
   marginalia (~> 1.8.0)
   memory_profiler (~> 0.9)
@@ -1261,14 +1297,14 @@ DEPENDENCIES
   net-ssh (~> 5.2)
   nokogiri (~> 1.10.5)
   oauth2 (~> 1.4)
-  octokit (~> 4.9)
+  octokit (~> 4.15)
   omniauth (~> 1.8)
   omniauth-auth0 (~> 2.0.0)
   omniauth-authentiq (~> 0.3.3)
   omniauth-azure-oauth2 (~> 0.0.9)
   omniauth-cas3 (~> 1.1.4)
   omniauth-facebook (~> 4.0.0)
-  omniauth-github (~> 1.3)
+  omniauth-github (~> 1.4)
   omniauth-gitlab (~> 1.0.2)
   omniauth-google-oauth2 (~> 0.6.0)
   omniauth-kerberos (~> 0.3.0)
@@ -1281,21 +1317,23 @@ DEPENDENCIES
   omniauth_crowd (~> 2.2.0)
   omniauth_openid_connect (~> 0.3.3)
   org-ruby (~> 0.9.12)
+  parallel (~> 1.19)
   peek (~> 1.1)
   pg (~> 1.1)
+  png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
   prometheus-client-mmap (~> 0.10.0)
   pry-byebug (~> 3.5.1)
-  pry-rails (~> 0.3.4)
+  pry-rails (~> 0.3.9)
   rack (~> 2.0.7)
   rack-attack (~> 6.2.0)
-  rack-cors (~> 1.0.0)
+  rack-cors (~> 1.0.6)
   rack-oauth2 (~> 1.9.3)
   rack-proxy (~> 0.6.0)
   rack-timeout
-  rails (= 5.2.3)
+  rails (= 6.0.2)
   rails-controller-testing
-  rails-i18n (~> 5.1)
+  rails-i18n (~> 6.0)
   rainbow (~> 3.0)
   raindrops (~> 0.18)
   rblineprof (~> 0.3.6)
@@ -1309,7 +1347,7 @@ DEPENDENCIES
   request_store (~> 1.3)
   responders (~> 3.0)
   retriable (~> 3.1.2)
-  rouge (~> 3.11.0)
+  rouge (~> 3.15.0)
   rqrcode-rails3 (~> 0.1.7)
   rspec-parameterized
   rspec-rails (~> 4.0.0.beta3)
@@ -1317,9 +1355,9 @@ DEPENDENCIES
   rspec-set (~> 0.1.3)
   rspec_junit_formatter
   rspec_profiling (~> 0.0.5)
-  rubocop (~> 0.69.0)
-  rubocop-performance (~> 1.1.0)
-  rubocop-rspec (~> 1.22.1)
+  rubocop (~> 0.74.0)
+  rubocop-performance (~> 1.4.1)
+  rubocop-rspec (~> 1.37.0)
   ruby-fogbugz (~> 0.2.1)
   ruby-prof (~> 1.0.0)
   ruby-progressbar
@@ -1344,7 +1382,7 @@ DEPENDENCIES
   spring-commands-rspec (~> 1.0.4)
   sprockets (~> 3.7.0)
   sshkey (~> 2.0)
-  stackprof (~> 0.2.13)
+  stackprof (~> 0.2.15)
   state_machines-activerecord (~> 0.6.0)
   sys-filesystem (~> 1.1.6)
   test-prof (~> 0.10.0)

Guardfile

@@ -2,7 +2,7 @@
 
 # More info at https://github.com/guard/guard#readme
 
-cmd = ENV['SPRING'] ? 'spring rspec' : 'bundle exec rspec'
+cmd = ENV['GUARD_CMD'] || (ENV['SPRING'] ? 'spring rspec' : 'bundle exec rspec')
 
 guard :rspec, cmd: cmd do
   require "guard/rspec/dsl"

README.md

@@ -79,12 +79,12 @@ Instructions on how to start GitLab and how to run the tests can be found in the
 GitLab is a Ruby on Rails application that runs on the following software:
 
 - Ubuntu/Debian/CentOS/RHEL/OpenSUSE
-- Ruby (MRI) 2.6.3
+- Ruby (MRI) 2.6.5
 - Git 2.8.4+
 - Redis 2.8+
-- PostgreSQL (preferred) or MySQL
+- PostgreSQL 9.6+
 
-For more information please see the [architecture documentation](https://docs.gitlab.com/ce/development/architecture.html).
+For more information please see the [architecture](https://docs.gitlab.com/ee/development/architecture.html) and [requirements](https://docs.gitlab.com/ee/install/requirements.html) documentation.
 
 ## UX design
 

VERSION

@@ -1 +1 @@
-12.6.8
+12.8.6

app/assets/images/ext_snippet_icons/logo.svg

@@ -0,0 +1 @@
+<svg width="100" height="32" xmlns="http://www.w3.org/2000/svg"><g fill-rule="nonzero" fill="none"><path fill="#8C929D" d="M67.67 8.11h-2.06l.009 15.364h8.348v-1.9H67.68l-.01-13.465zM81.913 20.778a3.517 3.517 0 01-2.553 1.078c-1.57 0-2.203-.775-2.203-1.787 0-1.522 1.059-2.25 3.309-2.25.487.002.974.04 1.456.113v2.846h-.01zm-2.137-9.313a6.826 6.826 0 00-4.387 1.579l.728 1.267c.841-.492 1.872-.983 3.356-.983 1.693 0 2.44.87 2.44 2.326v.747a9.4 9.4 0 00-1.428-.114c-3.612 0-5.446 1.267-5.446 3.914 0 2.374 1.456 3.565 3.659 3.565 1.484 0 2.912-.68 3.404-1.787l.378 1.503h1.456v-7.866c-.01-2.487-1.087-4.151-4.16-4.151zM90.587 21.926c-.776 0-1.456-.094-1.967-.33v-7.102c.7-.586 1.57-1.011 2.676-1.011 1.995 0 2.76 1.408 2.76 3.687 0 3.234-1.238 4.756-3.47 4.756m.87-10.457a3.775 3.775 0 00-2.836 1.257V10.74l-.01-2.629h-2.013l.01 14.987c1.01.425 2.391.652 3.895.652 3.848 0 5.701-2.458 5.701-6.704-.01-3.356-1.72-5.578-4.746-5.578M45.228 9.776c1.825 0 3.006.605 3.772 1.22l.889-1.541c-1.2-1.06-2.827-1.627-4.567-1.627-4.387 0-7.46 2.676-7.46 8.075 0 5.654 3.319 7.857 7.11 7.857a12.083 12.083 0 004.577-.888L49.5 16.83v-1.9h-5.63v1.9h3.594l.047 4.586c-.473.236-1.286.425-2.392.425-3.045 0-5.087-1.92-5.087-5.957-.01-4.113 2.1-6.108 5.19-6.108M59.744 8.107H57.73l.01 2.582v8.916c0 2.487 1.078 4.15 4.15 4.15.416.002.83-.036 1.24-.113v-1.806c-.31.047-.624.07-.937.066-1.692 0-2.44-.87-2.44-2.326v-6.145h3.376v-1.683h-3.373l-.009-3.64h-.003zM52.608 23.474h2.014V11.75h-2.014zM52.608 10.133h2.014V8.119h-2.014z"/><path d="M31.864 17.907l-1.788-5.496-3.538-10.9a.612.612 0 00-1.16 0L21.84 12.406H10.085L6.547 1.512a.612.612 0 00-1.16 0L1.855 12.405.066 17.907c-.162.5.015 1.05.44 1.36L15.963 30.5l15.456-11.233a1.22 1.22 0 00.446-1.36" fill="#FC6D26"/><path d="M15.966 30.49l5.875-18.086H10.09z" fill="#E24329"/><path d="M15.962 30.49l-5.877-18.086H1.859z" fill="#FC6D26"/><path d="M1.852 12.41L.063 17.906c-.162.5.015 1.05.441 1.36L15.959 30.5 1.852 12.41z" fill="#FCA326"/><path d="M1.854 12.41h8.237L6.546 1.517a.612.612 0 00-1.16 0L1.854 12.41z" fill="#E24329"/><path d="M15.966 30.49l5.875-18.086h8.236z" fill="#FC6D26"/><path d="M30.074 12.41l1.79 5.496a1.219 1.219 0 01-.44 1.36L15.966 30.49l14.107-18.08z" fill="#FCA326"/><path d="M30.079 12.41H21.84L25.38 1.517a.612.612 0 011.16 0l3.539 10.893z" fill="#E24329"/></g></svg>

app/assets/javascripts/alerts_service_settings/components/alerts_service_form.vue

@@ -0,0 +1,168 @@
+<script>
+import { GlButton, GlFormGroup, GlFormInput, GlModal, GlModalDirective } from '@gitlab/ui';
+import _ from 'underscore';
+import ClipboardButton from '~/vue_shared/components/clipboard_button.vue';
+import ToggleButton from '~/vue_shared/components/toggle_button.vue';
+import axios from '~/lib/utils/axios_utils';
+import { s__, __, sprintf } from '~/locale';
+import createFlash from '~/flash';
+
+export default {
+  COPY_TO_CLIPBOARD: __('Copy'),
+  RESET_KEY: __('Reset key'),
+  components: {
+    GlButton,
+    GlFormGroup,
+    GlFormInput,
+    GlModal,
+    ClipboardButton,
+    ToggleButton,
+  },
+  directives: {
+    'gl-modal': GlModalDirective,
+  },
+  props: {
+    initialAuthorizationKey: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    formPath: {
+      type: String,
+      required: true,
+    },
+    url: {
+      type: String,
+      required: true,
+    },
+    learnMoreUrl: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    initialActivated: {
+      type: Boolean,
+      required: true,
+    },
+  },
+  data() {
+    return {
+      activated: this.initialActivated,
+      loadingActivated: false,
+      authorizationKey: this.initialAuthorizationKey,
+    };
+  },
+  computed: {
+    learnMoreDescription() {
+      return sprintf(
+        s__(
+          'AlertService|%{linkStart}Learn more%{linkEnd} about configuring this endpoint to receive alerts.',
+        ),
+        {
+          linkStart: `<a href="${_.escape(
+            this.learnMoreUrl,
+          )}" target="_blank" rel="noopener noreferrer">`,
+          linkEnd: '</a>',
+        },
+        false,
+      );
+    },
+    sectionDescription() {
+      const desc = s__(
+        'AlertService|Each alert source must be authorized using the following URL and authorization key.',
+      );
+      const learnMoreDesc = this.learnMoreDescription ? ` ${this.learnMoreDescription}` : '';
+
+      return `${desc}${learnMoreDesc}`;
+    },
+  },
+  watch: {
+    activated() {
+      this.updateIcon();
+    },
+  },
+  methods: {
+    updateIcon() {
+      return document.querySelectorAll('.js-service-active-status').forEach(icon => {
+        if (icon.dataset.value === this.activated.toString()) {
+          icon.classList.remove('d-none');
+        } else {
+          icon.classList.add('d-none');
+        }
+      });
+    },
+    resetKey() {
+      return axios
+        .put(this.formPath, { service: { token: '' } })
+        .then(res => {
+          this.authorizationKey = res.data.token;
+        })
+        .catch(() => {
+          createFlash(__('Failed to reset key. Please try again.'));
+        });
+    },
+    toggleActivated(value) {
+      this.loadingActivated = true;
+      return axios
+        .put(this.formPath, { service: { active: value } })
+        .then(() => {
+          this.activated = value;
+          this.loadingActivated = false;
+        })
+        .catch(() => {
+          createFlash(__('Update failed. Please try again.'));
+          this.loadingActivated = false;
+        });
+    },
+  },
+};
+</script>
+
+<template>
+  <div>
+    <p v-html="sectionDescription"></p>
+    <gl-form-group :label="__('Active')" label-for="activated" label-class="label-bold">
+      <toggle-button
+        id="activated"
+        :disabled-input="loadingActivated"
+        :is-loading="loadingActivated"
+        :value="activated"
+        @change="toggleActivated"
+      />
+    </gl-form-group>
+    <gl-form-group :label="__('URL')" label-for="url" label-class="label-bold">
+      <div class="input-group">
+        <gl-form-input id="url" :readonly="true" :value="url" />
+        <span class="input-group-append">
+          <clipboard-button :text="url" :title="$options.COPY_TO_CLIPBOARD" />
+        </span>
+      </div>
+    </gl-form-group>
+    <gl-form-group
+      :label="__('Authorization key')"
+      label-for="authorization-key"
+      label-class="label-bold"
+    >
+      <div class="input-group">
+        <gl-form-input id="authorization-key" :readonly="true" :value="authorizationKey" />
+        <span class="input-group-append">
+          <clipboard-button :text="authorizationKey" :title="$options.COPY_TO_CLIPBOARD" />
+        </span>
+      </div>
+      <gl-button v-gl-modal.authKeyModal class="mt-2">{{ $options.RESET_KEY }}</gl-button>
+      <gl-modal
+        modal-id="authKeyModal"
+        :title="$options.RESET_KEY"
+        :ok-title="$options.RESET_KEY"
+        ok-variant="danger"
+        @ok="resetKey"
+      >
+        {{
+          __(
+            'Resetting the authorization key for this project will require updating the authorization key in every alert source it is enabled in.',
+          )
+        }}
+      </gl-modal>
+    </gl-form-group>
+  </div>
+</template>

app/assets/javascripts/alerts_service_settings/index.js

@@ -0,0 +1,27 @@
+import Vue from 'vue';
+import { parseBoolean } from '~/lib/utils/common_utils';
+import AlertsServiceForm from './components/alerts_service_form.vue';
+
+export default el => {
+  if (!el) {
+    return null;
+  }
+
+  const { activated: activatedStr, formPath, authorizationKey, url, learnMoreUrl } = el.dataset;
+  const activated = parseBoolean(activatedStr);
+
+  return new Vue({
+    el,
+    render(createElement) {
+      return createElement(AlertsServiceForm, {
+        props: {
+          initialActivated: activated,
+          formPath,
+          learnMoreUrl,
+          initialAuthorizationKey: authorizationKey,
+          url,
+        },
+      });
+    },
+  });
+};

app/assets/javascripts/api.js

@@ -24,6 +24,7 @@ const Api = {
   projectMergeRequestChangesPath: '/api/:version/projects/:id/merge_requests/:mrid/changes',
   projectMergeRequestVersionsPath: '/api/:version/projects/:id/merge_requests/:mrid/versions',
   projectRunnersPath: '/api/:version/projects/:id/runners',
+  projectProtectedBranchesPath: '/api/:version/projects/:id/protected_branches',
   mergeRequestsPath: '/api/:version/merge_requests',
   groupLabelsPath: '/groups/:namespace_path/-/labels',
   issuableTemplatePath: '/:namespace_path/:project_path/templates/:type/:key',
@@ -44,6 +45,8 @@ const Api = {
   releasePath: '/api/:version/projects/:id/releases/:tag_name',
   mergeRequestsPipeline: '/api/:version/projects/:id/merge_requests/:merge_request_iid/pipelines',
   adminStatisticsPath: '/api/:version/application/statistics',
+  pipelineSinglePath: '/api/:version/projects/:id/pipelines/:pipeline_id',
+  lsifPath: '/api/:version/projects/:id/commits/:commit_id/lsif/info',
 
   group(groupId, callback) {
     const url = Api.buildUrl(Api.groupPath).replace(':id', groupId);
@@ -54,10 +57,15 @@ const Api = {
     });
   },
 
-  groupMembers(id) {
+  groupMembers(id, options) {
     const url = Api.buildUrl(this.groupMembersPath).replace(':id', encodeURIComponent(id));
 
-    return axios.get(url);
+    return axios.get(url, {
+      params: {
+        per_page: DEFAULT_PER_PAGE,
+        ...options,
+      },
+    });
   },
 
   // Return groups list. Filtered by query
@@ -142,6 +150,12 @@ const Api = {
     return axios.get(url);
   },
 
+  // Update a single project
+  updateProject(projectPath, data) {
+    const url = Api.buildUrl(Api.projectPath).replace(':id', encodeURIComponent(projectPath));
+    return axios.put(url, data);
+  },
+
   /**
    * Get all projects for a forked relationship to a specified project
    * @param {string} projectPath - Path or ID of a project
@@ -207,6 +221,22 @@ const Api = {
     return axios.get(url, config);
   },
 
+  projectProtectedBranches(id, query = '') {
+    const url = Api.buildUrl(Api.projectProtectedBranchesPath).replace(
+      ':id',
+      encodeURIComponent(id),
+    );
+
+    return axios
+      .get(url, {
+        params: {
+          search: query,
+          per_page: DEFAULT_PER_PAGE,
+        },
+      })
+      .then(({ data }) => data);
+  },
+
   mergeRequests(params = {}) {
     const url = Api.buildUrl(Api.mergeRequestsPath);
 
@@ -437,6 +467,22 @@ const Api = {
     return axios.get(url);
   },
 
+  pipelineSingle(id, pipelineId) {
+    const url = Api.buildUrl(this.pipelineSinglePath)
+      .replace(':id', encodeURIComponent(id))
+      .replace(':pipeline_id', encodeURIComponent(pipelineId));
+
+    return axios.get(url);
+  },
+
+  lsifData(projectPath, commitId, path) {
+    const url = Api.buildUrl(this.lsifPath)
+      .replace(':id', encodeURIComponent(projectPath))
+      .replace(':commit_id', commitId);
+
+    return axios.get(url, { params: { path } });
+  },
+
   buildUrl(url) {
     return joinPaths(gon.relative_url_root || '', url.replace(':version', gon.api_version));
   },

app/assets/javascripts/awards_handler.js

@@ -2,13 +2,13 @@
 
 import $ from 'jquery';
 import _ from 'underscore';
+import { GlBreakpointInstance as bp } from '@gitlab/ui/dist/utils';
 import Cookies from 'js-cookie';
 import { __ } from './locale';
 import { updateTooltipTitle } from './lib/utils/common_utils';
 import { isInVueNoteablePage } from './lib/utils/dom_utils';
 import flash from './flash';
 import axios from './lib/utils/axios_utils';
-import bp from './breakpoints';
 
 const animationEndEventString = 'animationend webkitAnimationEnd MSAnimationEnd oAnimationEnd';
 const transitionEndEventString = 'transitionend webkitTransitionEnd oTransitionEnd MSTransitionEnd';
@@ -266,7 +266,7 @@ export class AwardsHandler {
       top: `${$addBtn.offset().top + $addBtn.outerHeight()}px`,
     };
     // for xs screen we position the element on center
-    if (bp.getBreakpointSize() === 'xs') {
+    if (bp.getBreakpointSize() === 'xs' || bp.getBreakpointSize() === 'sm') {
       css.left = '5%';
     } else if (position === 'right') {
       css.left = `${$addBtn.offset().left - $menu.outerWidth() + 20}px`;
@@ -506,6 +506,8 @@ export class AwardsHandler {
     const options = {
       scrollTop: $('.awards').offset().top - 110,
     };
+
+    // eslint-disable-next-line no-jquery/no-animate
     return $('body, html').animate(options, 200);
   }
 

app/assets/javascripts/behaviors/markdown/constants.js

@@ -0,0 +1,3 @@
+// https://prosemirror.net/docs/ref/#model.ParseRule.priority
+export const DEFAULT_PARSE_RULE_PRIORITY = 50;
+export const HIGHER_PARSE_RULE_PRIORITY = 1 + DEFAULT_PARSE_RULE_PRIORITY;

app/assets/javascripts/behaviors/markdown/copy_as_gfm.js

@@ -183,7 +183,7 @@ export class CopyAsGFM {
 }
 
 // Export CopyAsGFM as a global for rspec to access
-// see /spec/features/copy_as_gfm_spec.rb
+// see /spec/features/markdown/copy_as_gfm_spec.rb
 if (process.env.NODE_ENV !== 'production') {
   window.CopyAsGFM = CopyAsGFM;
 }

app/assets/javascripts/behaviors/markdown/editor_extensions.js

@@ -53,7 +53,7 @@ import InlineHTML from './marks/inline_html';
 // The nodes and marks referenced here transform that same HTML to GFM to be copied to the clipboard.
 // Every filter in lib/banzai/pipeline/gfm_pipeline.rb that generates HTML
 // from GFM should have a node or mark here.
-// The GFM-to-HTML-to-GFM cycle is tested in spec/features/copy_as_gfm_spec.rb.
+// The GFM-to-HTML-to-GFM cycle is tested in spec/features/markdown/copy_as_gfm_spec.rb.
 
 export default [
   new Doc(),

app/assets/javascripts/behaviors/markdown/marks/inline_html.js

@@ -1,7 +1,7 @@
 /* eslint-disable class-methods-use-this */
 
 import { Mark } from 'tiptap';
-import _ from 'underscore';
+import { escape as esc } from 'lodash';
 
 // Transforms generated HTML back to GFM for Banzai::Filter::MarkdownFilter
 export default class InlineHTML extends Mark {
@@ -35,7 +35,7 @@ export default class InlineHTML extends Mark {
       mixable: true,
       open(state, mark) {
         return `<${mark.attrs.tag}${
-          mark.attrs.title ? ` title="${state.esc(_.escape(mark.attrs.title))}"` : ''
+          mark.attrs.title ? ` title="${state.esc(esc(mark.attrs.title))}"` : ''
         }>`;
       },
       close(state, mark) {

app/assets/javascripts/behaviors/markdown/marks/math.js

@@ -2,6 +2,7 @@
 
 import { Mark } from 'tiptap';
 import { defaultMarkdownSerializer } from 'prosemirror-markdown';
+import { HIGHER_PARSE_RULE_PRIORITY } from '../constants';
 
 // Transforms generated HTML back to GFM for Banzai::Filter::MathFilter
 export default class MathMark extends Mark {
@@ -15,7 +16,7 @@ export default class MathMark extends Mark {
         // Matches HTML generated by Banzai::Filter::MathFilter
         {
           tag: 'code.code.math[data-math-style=inline]',
-          priority: 51,
+          priority: HIGHER_PARSE_RULE_PRIORITY,
         },
         // Matches HTML after being transformed by app/assets/javascripts/behaviors/markdown/render_math.js
         {

app/assets/javascripts/behaviors/markdown/nodes/audio.js

@@ -1,53 +1,9 @@
-/* eslint-disable class-methods-use-this */
-
-import { Node } from 'tiptap';
-import { defaultMarkdownSerializer } from 'prosemirror-markdown';
+import Playable from './playable';
 
 // Transforms generated HTML back to GFM for Banzai::Filter::AudioLinkFilter
-export default class Audio extends Node {
-  get name() {
-    return 'audio';
-  }
-
-  get schema() {
-    return {
-      attrs: {
-        src: {},
-        alt: {
-          default: null,
-        },
-      },
-      group: 'block',
-      draggable: true,
-      parseDOM: [
-        {
-          tag: '.audio-container',
-          skip: true,
-        },
-        {
-          tag: '.audio-container p',
-          priority: 51,
-          ignore: true,
-        },
-        {
-          tag: 'audio[src]',
-          getAttrs: el => ({ src: el.getAttribute('src'), alt: el.dataset.title }),
-        },
-      ],
-      toDOM: node => [
-        'audio',
-        {
-          src: node.attrs.src,
-          controls: true,
-          'data-setup': '{}',
-          'data-title': node.attrs.alt,
-        },
-      ],
-    };
-  }
-
-  toMarkdown(state, node) {
-    defaultMarkdownSerializer.nodes.image(state, node);
-    state.closeBlock(node);
+export default class Audio extends Playable {
+  constructor() {
+    super();
+    this.mediaType = 'audio';
   }
 }

app/assets/javascripts/behaviors/markdown/nodes/image.js

@@ -3,6 +3,7 @@
 import { Image as BaseImage } from 'tiptap-extensions';
 import { defaultMarkdownSerializer } from 'prosemirror-markdown';
 import { placeholderImage } from '~/lazy_loader';
+import { HIGHER_PARSE_RULE_PRIORITY } from '../constants';
 
 export default class Image extends BaseImage {
   get schema() {
@@ -23,7 +24,7 @@ export default class Image extends BaseImage {
         // Matches HTML generated by Banzai::Filter::ImageLinkFilter
         {
           tag: 'a.no-attachment-icon',
-          priority: 51,
+          priority: HIGHER_PARSE_RULE_PRIORITY,
           skip: true,
         },
         // Matches HTML generated by Banzai::Filter::ImageLazyLoadFilter

app/assets/javascripts/behaviors/markdown/nodes/ordered_task_list.js

@@ -1,6 +1,7 @@
 /* eslint-disable class-methods-use-this */
 
 import { Node } from 'tiptap';
+import { HIGHER_PARSE_RULE_PRIORITY } from '../constants';
 
 // Transforms generated HTML back to GFM for Banzai::Filter::TaskListFilter
 export default class OrderedTaskList extends Node {
@@ -14,7 +15,7 @@ export default class OrderedTaskList extends Node {
       content: '(task_list_item|list_item)+',
       parseDOM: [
         {
-          priority: 51,
+          priority: HIGHER_PARSE_RULE_PRIORITY,
           tag: 'ol.task-list',
         },
       ],

app/assets/javascripts/behaviors/markdown/nodes/playable.js

@@ -0,0 +1,73 @@
+/* eslint-disable class-methods-use-this */
+/* eslint-disable @gitlab/i18n/no-non-i18n-strings */
+
+import { Node } from 'tiptap';
+import { defaultMarkdownSerializer } from 'prosemirror-markdown';
+import { HIGHER_PARSE_RULE_PRIORITY } from '../constants';
+
+/**
+ * Abstract base class for playable media, like video and audio.
+ * Must not be instantiated directly. Subclasses must set
+ * the `mediaType` property in their constructors.
+ * @abstract
+ */
+export default class Playable extends Node {
+  constructor() {
+    super();
+    this.mediaType = '';
+    this.extraElementAttrs = {};
+  }
+
+  get name() {
+    return this.mediaType;
+  }
+
+  get schema() {
+    const attrs = {
+      src: {},
+      alt: {
+        default: null,
+      },
+    };
+
+    const parseDOM = [
+      {
+        tag: `.${this.mediaType}-container`,
+        skip: true,
+      },
+      {
+        tag: `.${this.mediaType}-container p`,
+        priority: HIGHER_PARSE_RULE_PRIORITY,
+        ignore: true,
+      },
+      {
+        tag: `${this.mediaType}[src]`,
+        getAttrs: el => ({ src: el.src, alt: el.dataset.title }),
+      },
+    ];
+
+    const toDOM = node => [
+      this.mediaType,
+      {
+        src: node.attrs.src,
+        controls: true,
+        'data-setup': '{}',
+        'data-title': node.attrs.alt,
+        ...this.extraElementAttrs,
+      },
+    ];
+
+    return {
+      attrs,
+      group: 'block',
+      draggable: true,
+      parseDOM,
+      toDOM,
+    };
+  }
+
+  toMarkdown(state, node) {
+    defaultMarkdownSerializer.nodes.image(state, node);
+    state.closeBlock(node);
+  }
+}

app/assets/javascripts/behaviors/markdown/nodes/reference.js

@@ -1,6 +1,7 @@
 /* eslint-disable class-methods-use-this */
 
 import { Node } from 'tiptap';
+import { HIGHER_PARSE_RULE_PRIORITY } from '../constants';
 
 // Transforms generated HTML back to GFM for Banzai::Filter::ReferenceFilter and subclasses
 export default class Reference extends Node {
@@ -23,7 +24,7 @@ export default class Reference extends Node {
       parseDOM: [
         {
           tag: 'a.gfm:not([data-link=true])',
-          priority: 51,
+          priority: HIGHER_PARSE_RULE_PRIORITY,
           getAttrs: el => ({
             className: el.className,
             referenceType: el.dataset.referenceType,

app/assets/javascripts/behaviors/markdown/nodes/table_header_row.js

@@ -1,6 +1,7 @@
 /* eslint-disable class-methods-use-this */
 
 import TableRow from './table_row';
+import { HIGHER_PARSE_RULE_PRIORITY } from '../constants';
 
 const CENTER_ALIGN = 'center';
 
@@ -16,7 +17,7 @@ export default class TableHeaderRow extends TableRow {
       parseDOM: [
         {
           tag: 'thead tr',
-          priority: 51,
+          priority: HIGHER_PARSE_RULE_PRIORITY,
         },
       ],
       toDOM: () => ['tr', 0],

app/assets/javascripts/behaviors/markdown/nodes/table_of_contents.js

@@ -2,6 +2,7 @@
 
 import { Node } from 'tiptap';
 import { __ } from '~/locale';
+import { HIGHER_PARSE_RULE_PRIORITY } from '../constants';
 
 // Transforms generated HTML back to GFM for Banzai::Filter::TableOfContentsFilter
 export default class TableOfContents extends Node {
@@ -16,11 +17,11 @@ export default class TableOfContents extends Node {
       parseDOM: [
         {
           tag: 'ul.section-nav',
-          priority: 51,
+          priority: HIGHER_PARSE_RULE_PRIORITY,
         },
         {
           tag: 'p.table-of-contents',
-          priority: 51,
+          priority: HIGHER_PARSE_RULE_PRIORITY,
         },
       ],
       toDOM: () => ['p', { class: 'table-of-contents' }, __('Table of Contents')],

app/assets/javascripts/behaviors/markdown/nodes/task_list.js

@@ -1,6 +1,7 @@
 /* eslint-disable class-methods-use-this */
 
 import { Node } from 'tiptap';
+import { HIGHER_PARSE_RULE_PRIORITY } from '../constants';
 
 // Transforms generated HTML back to GFM for Banzai::Filter::TaskListFilter
 export default class TaskList extends Node {
@@ -14,7 +15,7 @@ export default class TaskList extends Node {
       content: '(task_list_item|list_item)+',
       parseDOM: [
         {
-          priority: 51,
+          priority: HIGHER_PARSE_RULE_PRIORITY,
           tag: 'ul.task-list',
         },
       ],

app/assets/javascripts/behaviors/markdown/nodes/task_list_item.js

@@ -1,6 +1,7 @@
 /* eslint-disable class-methods-use-this */
 
 import { Node } from 'tiptap';
+import { HIGHER_PARSE_RULE_PRIORITY } from '../constants';
 
 // Transforms generated HTML back to GFM for Banzai::Filter::TaskListFilter
 export default class TaskListItem extends Node {
@@ -20,7 +21,7 @@ export default class TaskListItem extends Node {
       content: 'paragraph block*',
       parseDOM: [
         {
-          priority: 51,
+          priority: HIGHER_PARSE_RULE_PRIORITY,
           tag: 'li.task-list-item',
           getAttrs: el => {
             const checkbox = el.querySelector('input[type=checkbox].task-list-item-checkbox');

app/assets/javascripts/behaviors/markdown/nodes/video.js

@@ -1,54 +1,10 @@
-/* eslint-disable class-methods-use-this */
-
-import { Node } from 'tiptap';
-import { defaultMarkdownSerializer } from 'prosemirror-markdown';
+import Playable from './playable';
 
 // Transforms generated HTML back to GFM for Banzai::Filter::VideoLinkFilter
-export default class Video extends Node {
-  get name() {
-    return 'video';
-  }
-
-  get schema() {
-    return {
-      attrs: {
-        src: {},
-        alt: {
-          default: null,
-        },
-      },
-      group: 'block',
-      draggable: true,
-      parseDOM: [
-        {
-          tag: '.video-container',
-          skip: true,
-        },
-        {
-          tag: '.video-container p',
-          priority: 51,
-          ignore: true,
-        },
-        {
-          tag: 'video[src]',
-          getAttrs: el => ({ src: el.getAttribute('src'), alt: el.dataset.title }),
-        },
-      ],
-      toDOM: node => [
-        'video',
-        {
-          src: node.attrs.src,
-          width: '400',
-          controls: true,
-          'data-setup': '{}',
-          'data-title': node.attrs.alt,
-        },
-      ],
-    };
-  }
-
-  toMarkdown(state, node) {
-    defaultMarkdownSerializer.nodes.image(state, node);
-    state.closeBlock(node);
+export default class Video extends Playable {
+  constructor() {
+    super();
+    this.mediaType = 'video';
+    this.extraElementAttrs = { width: '400' };
   }
 }

app/assets/javascripts/behaviors/markdown/paste_markdown_table.js

@@ -0,0 +1,122 @@
+const maxColumnWidth = (rows, columnIndex) => Math.max(...rows.map(row => row[columnIndex].length));
+
+export default class PasteMarkdownTable {
+  constructor(clipboardData) {
+    this.data = clipboardData;
+    this.columnWidths = [];
+    this.rows = [];
+    this.tableFound = this.parseTable();
+  }
+
+  isTable() {
+    return this.tableFound;
+  }
+
+  convertToTableMarkdown() {
+    this.calculateColumnWidths();
+
+    const markdownRows = this.rows.map(
+      row =>
+        // | Name         | Title | Email Address  |
+        // |--------------|-------|----------------|
+        // | Jane Atler   | CEO   | jane@acme.com  |
+        // | John Doherty | CTO   | john@acme.com  |
+        // | Sally Smith  | CFO   | sally@acme.com |
+        `| ${row.map((column, index) => this.formatColumn(column, index)).join(' | ')} |`,
+    );
+
+    // Insert a header break (e.g. -----) to the second row
+    markdownRows.splice(1, 0, this.generateHeaderBreak());
+
+    return markdownRows.join('\n');
+  }
+
+  // Private methods below
+
+  // To determine whether the cut data is a table, the following criteria
+  // must be satisfied with the clipboard data:
+  //
+  // 1. MIME types "text/plain" and "text/html" exist
+  // 2. The "text/html" data must have a single <table> element
+  // 3. The number of rows in the "text/plain" data matches that of the "text/html" data
+  // 4. The max number of columns in "text/plain" matches that of the "text/html" data
+  parseTable() {
+    if (!this.data.types.includes('text/html') || !this.data.types.includes('text/plain')) {
+      return false;
+    }
+
+    const htmlData = this.data.getData('text/html');
+    this.doc = new DOMParser().parseFromString(htmlData, 'text/html');
+    const tables = this.doc.querySelectorAll('table');
+
+    // We're only looking for exactly one table. If there happens to be
+    // multiple tables, it's possible an application copied data into
+    // the clipboard that is not related to a simple table. It may also be
+    // complicated converting multiple tables into Markdown.
+    if (tables.length !== 1) {
+      return false;
+    }
+
+    const text = this.data.getData('text/plain').trim();
+    const splitRows = text.split(/[\n\u0085\u2028\u2029]|\r\n?/g);
+
+    // Now check that the number of rows matches between HTML and text
+    if (this.doc.querySelectorAll('tr').length !== splitRows.length) {
+      return false;
+    }
+
+    this.rows = splitRows.map(row => row.split('\t'));
+    this.normalizeRows();
+
+    // Check that the max number of columns in the HTML matches the number of
+    // columns in the text. GitHub, for example, copies a line number and the
+    // line itself into the HTML data.
+    if (!this.columnCountsMatch()) {
+      return false;
+    }
+
+    return true;
+  }
+
+  // Ensure each row has the same number of columns
+  normalizeRows() {
+    const rowLengths = this.rows.map(row => row.length);
+    const maxLength = Math.max(...rowLengths);
+
+    this.rows.forEach(row => {
+      while (row.length < maxLength) {
+        row.push('');
+      }
+    });
+  }
+
+  calculateColumnWidths() {
+    this.columnWidths = this.rows[0].map((_column, columnIndex) =>
+      maxColumnWidth(this.rows, columnIndex),
+    );
+  }
+
+  columnCountsMatch() {
+    const textColumnCount = this.rows[0].length;
+    let htmlColumnCount = 0;
+
+    this.doc.querySelectorAll('table tr').forEach(row => {
+      htmlColumnCount = Math.max(row.cells.length, htmlColumnCount);
+    });
+
+    return textColumnCount === htmlColumnCount;
+  }
+
+  formatColumn(column, index) {
+    const spaces = Array(this.columnWidths[index] - column.length + 1).join(' ');
+    return column + spaces;
+  }
+
+  generateHeaderBreak() {
+    // Add 3 dashes to line things up: there is additional spacing for the pipe characters
+    const dashes = this.columnWidths.map((width, index) =>
+      Array(this.columnWidths[index] + 3).join('-'),
+    );
+    return `|${dashes.join('|')}|`;
+  }
+}

app/assets/javascripts/behaviors/markdown/render_mermaid.js

@@ -1,4 +1,5 @@
 import flash from '~/flash';
+import $ from 'jquery';
 import { sprintf, __ } from '../../locale';
 
 // Renders diagrams and flowcharts from text using Mermaid in any element with the
@@ -18,9 +19,12 @@ import { sprintf, __ } from '../../locale';
 // This is an arbitrary number; Can be iterated upon when suitable.
 const MAX_CHAR_LIMIT = 5000;
 
-export default function renderMermaid($els) {
+function renderMermaids($els) {
   if (!$els.length) return;
 
+  // A diagram may have been truncated in search results which will cause errors, so abort the render.
+  if (document.querySelector('body').dataset.page === 'search:show') return;
+
   import(/* webpackChunkName: 'mermaid' */ 'mermaid')
     .then(mermaid => {
       mermaid.initialize({
@@ -92,3 +96,19 @@ export default function renderMermaid($els) {
       flash(`Can't load mermaid module: ${err}`);
     });
 }
+
+export default function renderMermaid($els) {
+  if (!$els.length) return;
+
+  const visibleMermaids = $els.filter(function filter() {
+    return $(this).closest('details').length === 0;
+  });
+
+  renderMermaids(visibleMermaids);
+
+  $els.closest('details').one('toggle', function toggle() {
+    if (this.open) {
+      renderMermaids($(this).find('.js-render-mermaid'));
+    }
+  });
+}

app/assets/javascripts/behaviors/requires_input.js

@@ -1,5 +1,5 @@
 import $ from 'jquery';
-import _ from 'underscore';
+import { isEmpty } from 'lodash';
 import '../commons/bootstrap';
 
 // Requires Input behavior
@@ -23,10 +23,10 @@ $.fn.requiresInput = function requiresInput() {
 
   function requireInput() {
     // Collect the input values of *all* required fields
-    const values = _.map($(fieldSelector, $form), field => field.value);
+    const values = Array.from($(fieldSelector, $form)).map(field => field.value);
 
     // Disable the button if any required fields are empty
-    if (values.length && _.some(values, _.isEmpty)) {
+    if (values.length && values.some(isEmpty)) {
       $button.disable();
     } else {
       $button.enable();

app/assets/javascripts/behaviors/shortcuts/shortcuts.js

@@ -1,6 +1,9 @@
 import $ from 'jquery';
 import Cookies from 'js-cookie';
 import Mousetrap from 'mousetrap';
+import Vue from 'vue';
+import { disableShortcuts, shouldDisableShortcuts } from './shortcuts_toggle';
+import ShortcutsToggle from './shortcuts_toggle.vue';
 import axios from '../../lib/utils/axios_utils';
 import { refreshCurrentPage, visitUrl } from '../../lib/utils/url_utility';
 import findAndFollowLink from '../../lib/utils/navigation_utility';
@@ -15,6 +18,15 @@ Mousetrap.stopCallback = (e, element, combo) => {
   return defaultStopCallback(e, element, combo);
 };
 
+function initToggleButton() {
+  return new Vue({
+    el: document.querySelector('.js-toggle-shortcuts'),
+    render(createElement) {
+      return createElement(ShortcutsToggle);
+    },
+  });
+}
+
 export default class Shortcuts {
   constructor() {
     this.onToggleHelp = this.onToggleHelp.bind(this);
@@ -48,6 +60,14 @@ export default class Shortcuts {
       $(this).remove();
       e.preventDefault();
     });
+
+    $('.js-shortcuts-modal-trigger')
+      .off('click')
+      .on('click', this.onToggleHelp);
+
+    if (shouldDisableShortcuts()) {
+      disableShortcuts();
+    }
   }
 
   onToggleHelp(e) {
@@ -104,7 +124,8 @@ export default class Shortcuts {
         }
 
         return $('.js-more-help-button').remove();
-      });
+      })
+      .then(initToggleButton);
   }
 
   focusFilter(e) {

app/assets/javascripts/behaviors/shortcuts/shortcuts_blob.js

@@ -1,26 +1,67 @@
 import Mousetrap from 'mousetrap';
-import { getLocationHash, visitUrl } from '../../lib/utils/url_utility';
+import {
+  getLocationHash,
+  updateHistory,
+  urlIsDifferent,
+  urlContainsSha,
+  getShaFromUrl,
+} from '~/lib/utils/url_utility';
+import { updateRefPortionOfTitle } from '~/repository/utils/title';
 import Shortcuts from './shortcuts';
 
 const defaults = {
   skipResetBindings: false,
   fileBlobPermalinkUrl: null,
+  fileBlobPermalinkUrlElement: null,
 };
 
+function eventHasModifierKeys(event) {
+  // We ignore alt because I don't think alt clicks normally do anything special?
+  return event.ctrlKey || event.metaKey || event.shiftKey;
+}
+
 export default class ShortcutsBlob extends Shortcuts {
   constructor(opts) {
     const options = Object.assign({}, defaults, opts);
     super(options.skipResetBindings);
     this.options = options;
 
+    this.shortcircuitPermalinkButton();
+
     Mousetrap.bind('y', this.moveToFilePermalink.bind(this));
   }
 
   moveToFilePermalink() {
-    if (this.options.fileBlobPermalinkUrl) {
+    const permalink = this.options.fileBlobPermalinkUrl;
+
+    if (permalink) {
       const hash = getLocationHash();
       const hashUrlString = hash ? `#${hash}` : '';
-      visitUrl(`${this.options.fileBlobPermalinkUrl}${hashUrlString}`);
+
+      if (urlIsDifferent(permalink)) {
+        updateHistory({
+          url: `${permalink}${hashUrlString}`,
+          title: document.title,
+        });
+      }
+
+      if (urlContainsSha({ url: permalink })) {
+        updateRefPortionOfTitle(getShaFromUrl({ url: permalink }));
+      }
+    }
+  }
+
+  shortcircuitPermalinkButton() {
+    const button = this.options.fileBlobPermalinkUrlElement;
+    const handleButton = e => {
+      if (!eventHasModifierKeys(e)) {
+        e.preventDefault();
+        this.moveToFilePermalink();
+      }
+    };
+
+    if (button) {
+      button.addEventListener('click', handleButton);
     }
   }
 }

app/assets/javascripts/behaviors/shortcuts/shortcuts_toggle.js

@@ -0,0 +1,22 @@
+import Mousetrap from 'mousetrap';
+import 'mousetrap/plugins/pause/mousetrap-pause';
+
+const shorcutsDisabledKey = 'shortcutsDisabled';
+
+export const shouldDisableShortcuts = () => {
+  try {
+    return localStorage.getItem(shorcutsDisabledKey) === 'true';
+  } catch (e) {
+    return false;
+  }
+};
+
+export function enableShortcuts() {
+  localStorage.setItem(shorcutsDisabledKey, false);
+  Mousetrap.unpause();
+}
+
+export function disableShortcuts() {
+  localStorage.setItem(shorcutsDisabledKey, true);
+  Mousetrap.pause();
+}

app/assets/javascripts/behaviors/shortcuts/shortcuts_toggle.vue

@@ -0,0 +1,60 @@
+<script>
+import { GlToggle, GlSprintf } from '@gitlab/ui';
+import AccessorUtilities from '~/lib/utils/accessor';
+import { disableShortcuts, enableShortcuts, shouldDisableShortcuts } from './shortcuts_toggle';
+
+export default {
+  components: {
+    GlSprintf,
+    GlToggle,
+  },
+  data() {
+    return {
+      localStorageUsable: AccessorUtilities.isLocalStorageAccessSafe(),
+      shortcutsEnabled: !shouldDisableShortcuts(),
+    };
+  },
+  methods: {
+    onChange(value) {
+      this.shortcutsEnabled = value;
+      if (value) {
+        enableShortcuts();
+      } else {
+        disableShortcuts();
+      }
+    },
+  },
+};
+</script>
+
+<template>
+  <div v-if="localStorageUsable" class="d-inline-flex align-items-center js-toggle-shortcuts">
+    <gl-toggle
+      v-model="shortcutsEnabled"
+      aria-describedby="shortcutsToggle"
+      class="prepend-left-10 mb-0"
+      label-position="right"
+      @change="onChange"
+    >
+      <template #labelOn>
+        <gl-sprintf
+          :message="__('%{screenreaderOnlyStart}Keyboard shorcuts%{screenreaderOnlyEnd} Enabled')"
+        >
+          <template #screenreaderOnly="{ content }">
+            <span class="sr-only">{{ content }}</span>
+          </template>
+        </gl-sprintf>
+      </template>
+      <template #labelOff>
+        <gl-sprintf
+          :message="__('%{screenreaderOnlyStart}Keyboard shorcuts%{screenreaderOnlyEnd} Disabled')"
+        >
+          <template #screenreaderOnly="{ content }">
+            <span class="sr-only">{{ content }}</span>
+          </template>
+        </gl-sprintf>
+      </template>
+    </gl-toggle>
+    <div id="shortcutsToggle" class="sr-only">{{ __('Enable or disable keyboard shortcuts') }}</div>
+  </div>
+</template>

app/assets/javascripts/blob/components/blob_content.vue

@@ -0,0 +1,51 @@
+<script>
+import { GlLoadingIcon } from '@gitlab/ui';
+import { RichViewer, SimpleViewer } from '~/vue_shared/components/blob_viewers';
+import BlobContentError from './blob_content_error.vue';
+
+export default {
+  components: {
+    GlLoadingIcon,
+    BlobContentError,
+  },
+  props: {
+    content: {
+      type: String,
+      default: '',
+      required: false,
+    },
+    loading: {
+      type: Boolean,
+      default: true,
+      required: false,
+    },
+    activeViewer: {
+      type: Object,
+      required: true,
+    },
+  },
+  computed: {
+    viewer() {
+      switch (this.activeViewer.type) {
+        case 'rich':
+          return RichViewer;
+        default:
+          return SimpleViewer;
+      }
+    },
+    viewerError() {
+      return this.activeViewer.renderError;
+    },
+  },
+};
+</script>
+<template>
+  <div class="blob-viewer" :data-type="activeViewer.type">
+    <gl-loading-icon v-if="loading" size="md" color="dark" class="my-4 mx-auto" />
+
+    <template v-else>
+      <blob-content-error v-if="viewerError" :viewer-error="viewerError" />
+      <component :is="viewer" v-else ref="contentViewer" :content="content" />
+    </template>
+  </div>
+</template>

app/assets/javascripts/blob/components/blob_content_error.vue

@@ -0,0 +1,15 @@
+<script>
+export default {
+  props: {
+    viewerError: {
+      type: String,
+      required: true,
+    },
+  },
+};
+</script>
+<template>
+  <div class="file-content code">
+    <div class="text-center py-4" v-html="viewerError"></div>
+  </div>
+</template>

app/assets/javascripts/blob/components/blob_embeddable.vue

@@ -0,0 +1,41 @@
+<script>
+import { GlFormInputGroup, GlButton, GlIcon } from '@gitlab/ui';
+import { __ } from '~/locale';
+
+export default {
+  components: {
+    GlFormInputGroup,
+    GlButton,
+    GlIcon,
+  },
+  props: {
+    url: {
+      type: String,
+      required: true,
+    },
+  },
+  data() {
+    return {
+      optionValues: [
+        // eslint-disable-next-line no-useless-escape
+        { name: __('Embed'), value: `<script src='${this.url}.js'><\/script>` },
+        { name: __('Share'), value: this.url },
+      ],
+    };
+  },
+};
+</script>
+<template>
+  <gl-form-input-group
+    id="embeddable-text"
+    :predefined-options="optionValues"
+    readonly
+    select-on-click
+  >
+    <template #append>
+      <gl-button new-style data-clipboard-target="#embeddable-text">
+        <gl-icon name="copy-to-clipboard" :title="__('Copy')" />
+      </gl-button>
+    </template>
+  </gl-form-input-group>
+</template>

app/assets/javascripts/blob/components/blob_header.vue

@@ -0,0 +1,82 @@
+<script>
+import ViewerSwitcher from './blob_header_viewer_switcher.vue';
+import DefaultActions from './blob_header_default_actions.vue';
+import BlobFilepath from './blob_header_filepath.vue';
+import { SIMPLE_BLOB_VIEWER } from './constants';
+
+export default {
+  components: {
+    ViewerSwitcher,
+    DefaultActions,
+    BlobFilepath,
+  },
+  props: {
+    blob: {
+      type: Object,
+      required: true,
+    },
+    hideDefaultActions: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    hideViewerSwitcher: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    activeViewerType: {
+      type: String,
+      required: false,
+      default: SIMPLE_BLOB_VIEWER,
+    },
+  },
+  data() {
+    return {
+      viewer: this.hideViewerSwitcher ? null : this.activeViewerType,
+    };
+  },
+  computed: {
+    showViewerSwitcher() {
+      return !this.hideViewerSwitcher && Boolean(this.blob.simpleViewer && this.blob.richViewer);
+    },
+    showDefaultActions() {
+      return !this.hideDefaultActions;
+    },
+  },
+  watch: {
+    viewer(newVal, oldVal) {
+      if (!this.hideViewerSwitcher && newVal !== oldVal) {
+        this.$emit('viewer-changed', newVal);
+      }
+    },
+  },
+  methods: {
+    proxyCopyRequest() {
+      this.$emit('copy');
+    },
+  },
+};
+</script>
+<template>
+  <div class="js-file-title file-title-flex-parent">
+    <blob-filepath :blob="blob">
+      <template #filepathPrepend>
+        <slot name="prepend"></slot>
+      </template>
+    </blob-filepath>
+
+    <div class="file-actions d-none d-sm-block">
+      <viewer-switcher v-if="showViewerSwitcher" v-model="viewer" />
+
+      <slot name="actions"></slot>
+
+      <default-actions
+        v-if="showDefaultActions"
+        :raw-path="blob.rawPath"
+        :active-viewer="viewer"
+        @copy="proxyCopyRequest"
+      />
+    </div>
+  </div>
+</template>

app/assets/javascripts/blob/components/blob_header_default_actions.vue

@@ -0,0 +1,74 @@
+<script>
+import { GlButton, GlButtonGroup, GlIcon, GlTooltipDirective } from '@gitlab/ui';
+import {
+  BTN_COPY_CONTENTS_TITLE,
+  BTN_DOWNLOAD_TITLE,
+  BTN_RAW_TITLE,
+  RICH_BLOB_VIEWER,
+  SIMPLE_BLOB_VIEWER,
+} from './constants';
+
+export default {
+  components: {
+    GlIcon,
+    GlButtonGroup,
+    GlButton,
+  },
+  directives: {
+    GlTooltip: GlTooltipDirective,
+  },
+  props: {
+    rawPath: {
+      type: String,
+      required: true,
+    },
+    activeViewer: {
+      type: String,
+      default: SIMPLE_BLOB_VIEWER,
+      required: false,
+    },
+  },
+  computed: {
+    downloadUrl() {
+      return `${this.rawPath}?inline=false`;
+    },
+    copyDisabled() {
+      return this.activeViewer === RICH_BLOB_VIEWER;
+    },
+  },
+  BTN_COPY_CONTENTS_TITLE,
+  BTN_DOWNLOAD_TITLE,
+  BTN_RAW_TITLE,
+};
+</script>
+<template>
+  <gl-button-group>
+    <gl-button
+      v-gl-tooltip.hover
+      :aria-label="$options.BTN_COPY_CONTENTS_TITLE"
+      :title="$options.BTN_COPY_CONTENTS_TITLE"
+      :disabled="copyDisabled"
+      data-clipboard-target="#blob-code-content"
+    >
+      <gl-icon name="copy-to-clipboard" :size="14" />
+    </gl-button>
+    <gl-button
+      v-gl-tooltip.hover
+      :aria-label="$options.BTN_RAW_TITLE"
+      :title="$options.BTN_RAW_TITLE"
+      :href="rawPath"
+      target="_blank"
+    >
+      <gl-icon name="doc-code" :size="14" />
+    </gl-button>
+    <gl-button
+      v-gl-tooltip.hover
+      :aria-label="$options.BTN_DOWNLOAD_TITLE"
+      :title="$options.BTN_DOWNLOAD_TITLE"
+      :href="downloadUrl"
+      target="_blank"
+    >
+      <gl-icon name="download" :size="14" />
+    </gl-button>
+  </gl-button-group>
+</template>

app/assets/javascripts/blob/components/blob_header_filepath.vue

@@ -0,0 +1,47 @@
+<script>
+import FileIcon from '~/vue_shared/components/file_icon.vue';
+import ClipboardButton from '~/vue_shared/components/clipboard_button.vue';
+import { numberToHumanSize } from '~/lib/utils/number_utils';
+
+export default {
+  components: {
+    FileIcon,
+    ClipboardButton,
+  },
+  props: {
+    blob: {
+      type: Object,
+      required: true,
+    },
+  },
+  computed: {
+    blobSize() {
+      return numberToHumanSize(this.blob.size);
+    },
+    gfmCopyText() {
+      return `\`${this.blob.path}\``;
+    },
+  },
+};
+</script>
+<template>
+  <div class="file-header-content d-flex align-items-center lh-100">
+    <slot name="filepathPrepend"></slot>
+
+    <file-icon :file-name="blob.path" :size="18" aria-hidden="true" css-classes="mr-2" />
+    <strong
+      v-if="blob.name"
+      class="file-title-name qa-file-title-name mr-1 js-blob-header-filepath"
+      >{{ blob.name }}</strong
+    >
+
+    <small class="mr-2">{{ blobSize }}</small>
+
+    <clipboard-button
+      :text="blob.path"
+      :gfm="gfmCopyText"
+      :title="__('Copy file path')"
+      css-class="btn-clipboard btn-transparent lh-100 position-static"
+    />
+  </div>
+</template>

app/assets/javascripts/blob/components/blob_header_viewer_switcher.vue

@@ -0,0 +1,70 @@
+<script>
+import { GlButton, GlButtonGroup, GlIcon, GlTooltipDirective } from '@gitlab/ui';
+import {
+  RICH_BLOB_VIEWER,
+  RICH_BLOB_VIEWER_TITLE,
+  SIMPLE_BLOB_VIEWER,
+  SIMPLE_BLOB_VIEWER_TITLE,
+} from './constants';
+
+export default {
+  components: {
+    GlIcon,
+    GlButtonGroup,
+    GlButton,
+  },
+  directives: {
+    GlTooltip: GlTooltipDirective,
+  },
+  props: {
+    value: {
+      type: String,
+      default: SIMPLE_BLOB_VIEWER,
+      required: false,
+    },
+  },
+  computed: {
+    isSimpleViewer() {
+      return this.value === SIMPLE_BLOB_VIEWER;
+    },
+    isRichViewer() {
+      return this.value === RICH_BLOB_VIEWER;
+    },
+  },
+  methods: {
+    switchToViewer(viewer) {
+      if (viewer !== this.value) {
+        this.$emit('input', viewer);
+      }
+    },
+  },
+  SIMPLE_BLOB_VIEWER,
+  RICH_BLOB_VIEWER,
+  SIMPLE_BLOB_VIEWER_TITLE,
+  RICH_BLOB_VIEWER_TITLE,
+};
+</script>
+<template>
+  <gl-button-group class="js-blob-viewer-switcher ml-2">
+    <gl-button
+      v-gl-tooltip.hover
+      :aria-label="$options.SIMPLE_BLOB_VIEWER_TITLE"
+      :title="$options.SIMPLE_BLOB_VIEWER_TITLE"
+      :selected="isSimpleViewer"
+      :class="{ active: isSimpleViewer }"
+      @click="switchToViewer($options.SIMPLE_BLOB_VIEWER)"
+    >
+      <gl-icon name="code" :size="14" />
+    </gl-button>
+    <gl-button
+      v-gl-tooltip.hover
+      :aria-label="$options.RICH_BLOB_VIEWER_TITLE"
+      :title="$options.RICH_BLOB_VIEWER_TITLE"
+      :selected="isRichViewer"
+      :class="{ active: isRichViewer }"
+      @click="switchToViewer($options.RICH_BLOB_VIEWER)"
+    >
+      <gl-icon name="document" :size="14" />
+    </gl-button>
+  </gl-button-group>
+</template>

app/assets/javascripts/blob/components/constants.js

@@ -0,0 +1,11 @@
+import { __ } from '~/locale';
+
+export const BTN_COPY_CONTENTS_TITLE = __('Copy file contents');
+export const BTN_RAW_TITLE = __('Open raw');
+export const BTN_DOWNLOAD_TITLE = __('Download');
+
+export const SIMPLE_BLOB_VIEWER = 'simple';
+export const SIMPLE_BLOB_VIEWER_TITLE = __('Display source');
+
+export const RICH_BLOB_VIEWER = 'rich';
+export const RICH_BLOB_VIEWER_TITLE = __('Display rendered file');

app/assets/javascripts/blob/file_template_mediator.js

@@ -117,11 +117,7 @@ export default class FileTemplateMediator {
         selector.hide();
       }
     });
-
-    if (this.editor.getValue() !== '') {
-      this.setTypeSelectorToggleText(item.name);
-    }
-
+    this.setTypeSelectorToggleText(item.name);
     this.cacheToggleText();
   }
 

app/assets/javascripts/blob/notebook/index.js

@@ -75,10 +75,10 @@ export default () => {
           class="text-center"
           v-if="error">
           <span v-if="loadError">
-            An error occurred whilst loading the file. Please try again later.
+            An error occurred while loading the file. Please try again later.
           </span>
           <span v-else>
-            An error occurred whilst parsing the file.
+            An error occurred while parsing the file.
           </span>
         </p>
       </div>

app/assets/javascripts/blob/pdf/index.js

@@ -1,5 +1,6 @@
 import Vue from 'vue';
 import pdfLab from '../../pdf/index.vue';
+import { GlLoadingIcon } from '@gitlab/ui';
 
 export default () => {
   const el = document.getElementById('js-pdf-viewer');
@@ -8,6 +9,7 @@ export default () => {
     el,
     components: {
       pdfLab,
+      GlLoadingIcon,
     },
     data() {
       return {
@@ -32,11 +34,7 @@ export default () => {
         <div
           class="text-center loading"
           v-if="loading && !error">
-          <i
-            class="fa fa-spinner fa-spin"
-            aria-hidden="true"
-            aria-label="PDF loading">
-          </i>
+          <gl-loading-icon class="mt-5" size="lg"/>
         </div>
         <pdf-lab
           v-if="!loadError"
@@ -47,10 +45,10 @@ export default () => {
           class="text-center"
           v-if="error">
           <span v-if="loadError">
-            An error occurred whilst loading the file. Please try again later.
+            An error occurred while loading the file. Please try again later.
           </span>
           <span v-else>
-            An error occurred whilst decoding the file.
+            An error occurred while decoding the file.
           </span>
         </p>
       </div>

app/assets/javascripts/boards/components/board.js

@@ -3,7 +3,7 @@ import Sortable from 'sortablejs';
 import Vue from 'vue';
 import { GlButtonGroup, GlButton, GlTooltip } from '@gitlab/ui';
 import isWipLimitsOn from 'ee_else_ce/boards/mixins/is_wip_limits';
-import { n__, s__ } from '~/locale';
+import { s__, __, sprintf } from '~/locale';
 import Icon from '~/vue_shared/components/icon.vue';
 import Tooltip from '~/vue_shared/directives/tooltip';
 import AccessorUtilities from '../../lib/utils/accessor';
@@ -67,10 +67,13 @@ export default Vue.extend({
         !this.disabled && this.list.type !== ListType.closed && this.list.type !== ListType.blank
       );
     },
-    counterTooltip() {
+    issuesTooltip() {
       const { issuesSize } = this.list;
-      return `${n__('%d issue', '%d issues', issuesSize)}`;
+
+      return sprintf(__('%{issuesSize} issues'), { issuesSize });
     },
+    // Only needed to make karma pass.
+    weightCountToolTip() {}, // eslint-disable-line vue/return-in-computed-property
     caretTooltip() {
       return this.list.isExpanded ? s__('Boards|Collapse') : s__('Boards|Expand');
     },

app/assets/javascripts/boards/components/board_list.vue

@@ -181,6 +181,8 @@ export default {
 
         boardsStore.startMoving(list, issue);
 
+        this.$root.$emit('bv::hide::tooltip');
+
         sortableStart();
       },
       onAdd: e => {
@@ -256,7 +258,7 @@ export default {
         let toList;
         if (to) {
           const containerEl = to.closest('.js-board-list');
-          toList = boardsStore.findList('id', Number(containerEl.dataset.board));
+          toList = boardsStore.findList('id', Number(containerEl.dataset.board), '');
         }
 
         /**

app/assets/javascripts/boards/components/boards_selector.vue

@@ -9,7 +9,6 @@ import {
   GlDropdownItem,
 } from '@gitlab/ui';
 
-import Icon from '~/vue_shared/components/icon.vue';
 import httpStatusCodes from '~/lib/utils/http_status';
 import boardsStore from '../stores/boards_store';
 import BoardForm from './board_form.vue';
@@ -19,7 +18,6 @@ const MIN_BOARDS_TO_VIEW_RECENT = 10;
 export default {
   name: 'BoardsSelector',
   components: {
-    Icon,
     BoardForm,
     GlLoadingIcon,
     GlSearchBoxByType,

app/assets/javascripts/boards/components/issue_card_inner.vue

@@ -161,6 +161,14 @@ export default {
   <div>
     <div class="d-flex board-card-header" dir="auto">
       <h4 class="board-card-title append-bottom-0 prepend-top-0">
+        <icon
+          v-if="issue.blocked"
+          v-gl-tooltip
+          name="issue-block"
+          :title="__('Blocked issue')"
+          class="issue-blocked-icon append-right-4"
+          :aria-label="__('Blocked issue')"
+        />
         <icon
           v-if="issue.confidential"
           v-gl-tooltip
@@ -233,7 +241,7 @@ export default {
           :key="assignee.id"
           :link-href="assigneeUrl(assignee)"
           :img-alt="avatarUrlTitle(assignee)"
-          :img-src="assignee.avatar"
+          :img-src="assignee.avatar || assignee.avatar_url"
           :img-size="24"
           class="js-no-trigger"
           tooltip-placement="bottom"

app/assets/javascripts/boards/components/issue_count.vue

@@ -25,7 +25,7 @@ export default {
 </script>
 
 <template>
-  <div class="issue-count">
+  <div class="issue-count text-nowrap">
     <span class="js-issue-size" :class="{ 'text-danger': issuesExceedMax }">
       {{ issuesSize }}
     </span>

app/assets/javascripts/boards/components/modal/list.vue

@@ -1,6 +1,6 @@
 <script>
+import { GlBreakpointInstance as bp } from '@gitlab/ui/dist/utils';
 import Icon from '~/vue_shared/components/icon.vue';
-import bp from '../../../breakpoints';
 import ModalStore from '../../stores/modal_store';
 import IssueCardInner from '../issue_card_inner.vue';
 
@@ -105,9 +105,9 @@ export default {
     setColumnCount() {
       const breakpoint = bp.getBreakpointSize();
 
-      if (breakpoint === 'lg' || breakpoint === 'md') {
+      if (breakpoint === 'xl' || breakpoint === 'lg') {
         this.columns = 3;
-      } else if (breakpoint === 'sm') {
+      } else if (breakpoint === 'md') {
         this.columns = 2;
       } else {
         this.columns = 1;

app/assets/javascripts/boards/mixins/sortable_default_options.js

@@ -26,6 +26,7 @@ export function getBoardSortableDefaultOptions(obj) {
     scrollSpeed: 20,
     onStart: sortableStart,
     onEnd: sortableEnd,
+    fallbackTolerance: 1,
   });
 
   Object.keys(obj).forEach(key => {

app/assets/javascripts/boards/models/issue.js

@@ -37,6 +37,7 @@ class ListIssue {
     this.project_id = obj.project_id;
     this.timeEstimate = obj.time_estimate;
     this.assignableLabelsEndpoint = obj.assignable_labels_endpoint;
+    this.blocked = obj.blocked;
 
     if (obj.project) {
       this.project = new IssueProject(obj.project);

app/assets/javascripts/boards/models/list.js

@@ -83,27 +83,7 @@ class List {
   }
 
   save() {
-    const entity = this.label || this.assignee || this.milestone;
-    let entityType = '';
-    if (this.label) {
-      entityType = 'label_id';
-    } else if (this.assignee) {
-      entityType = 'assignee_id';
-    } else if (IS_EE && this.milestone) {
-      entityType = 'milestone_id';
-    }
-
-    return boardsStore
-      .createList(entity.id, entityType)
-      .then(res => res.data)
-      .then(data => {
-        this.id = data.id;
-        this.type = data.list_type;
-        this.position = data.position;
-        this.label = data.label;
-
-        return this.getIssues();
-      });
+    return boardsStore.saveList(this);
   }
 
   destroy() {
@@ -181,50 +161,7 @@ class List {
   }
 
   addMultipleIssues(issues, listFrom, newIndex) {
-    let moveBeforeId = null;
-    let moveAfterId = null;
-
-    const listHasIssues = issues.every(issue => this.findIssue(issue.id));
-
-    if (!listHasIssues) {
-      if (newIndex !== undefined) {
-        if (this.issues[newIndex - 1]) {
-          moveBeforeId = this.issues[newIndex - 1].id;
-        }
-
-        if (this.issues[newIndex]) {
-          moveAfterId = this.issues[newIndex].id;
-        }
-
-        this.issues.splice(newIndex, 0, ...issues);
-      } else {
-        this.issues.push(...issues);
-      }
-
-      if (this.label) {
-        issues.forEach(issue => issue.addLabel(this.label));
-      }
-
-      if (this.assignee) {
-        if (listFrom && listFrom.type === 'assignee') {
-          issues.forEach(issue => issue.removeAssignee(listFrom.assignee));
-        }
-        issues.forEach(issue => issue.addAssignee(this.assignee));
-      }
-
-      if (IS_EE && this.milestone) {
-        if (listFrom && listFrom.type === 'milestone') {
-          issues.forEach(issue => issue.removeMilestone(listFrom.milestone));
-        }
-        issues.forEach(issue => issue.addMilestone(this.milestone));
-      }
-
-      if (listFrom) {
-        this.issuesSize += issues.length;
-
-        this.updateMultipleIssues(issues, listFrom, moveBeforeId, moveAfterId);
-      }
-    }
+    boardsStore.addMultipleListIssues(this, issues, listFrom, newIndex);
   }
 
   addIssue(issue, listFrom, newIndex) {

app/assets/javascripts/boards/stores/boards_store.js

@@ -1,4 +1,4 @@
-/* eslint-disable no-shadow */
+/* eslint-disable no-shadow, no-param-reassign */
 /* global List */
 
 import $ from 'jquery';
@@ -131,6 +131,53 @@ const boardsStore = {
     listFrom.update();
   },
 
+  addMultipleListIssues(list, issues, listFrom, newIndex) {
+    let moveBeforeId = null;
+    let moveAfterId = null;
+
+    const listHasIssues = issues.every(issue => list.findIssue(issue.id));
+
+    if (!listHasIssues) {
+      if (newIndex !== undefined) {
+        if (list.issues[newIndex - 1]) {
+          moveBeforeId = list.issues[newIndex - 1].id;
+        }
+
+        if (list.issues[newIndex]) {
+          moveAfterId = list.issues[newIndex].id;
+        }
+
+        list.issues.splice(newIndex, 0, ...issues);
+      } else {
+        list.issues.push(...issues);
+      }
+
+      if (list.label) {
+        issues.forEach(issue => issue.addLabel(list.label));
+      }
+
+      if (list.assignee) {
+        if (listFrom && listFrom.type === 'assignee') {
+          issues.forEach(issue => issue.removeAssignee(listFrom.assignee));
+        }
+        issues.forEach(issue => issue.addAssignee(list.assignee));
+      }
+
+      if (IS_EE && list.milestone) {
+        if (listFrom && listFrom.type === 'milestone') {
+          issues.forEach(issue => issue.removeMilestone(listFrom.milestone));
+        }
+        issues.forEach(issue => issue.addMilestone(list.milestone));
+      }
+
+      if (listFrom) {
+        list.issuesSize += issues.length;
+
+        list.updateMultipleIssues(issues, listFrom, moveBeforeId, moveAfterId);
+      }
+    }
+  },
+
   startMoving(list, issue) {
     Object.assign(this.moving, { list, issue });
   },
@@ -408,6 +455,29 @@ const boardsStore = {
     return axios.delete(`${this.state.endpoints.listsEndpoint}/${id}`);
   },
 
+  saveList(list) {
+    const entity = list.label || list.assignee || list.milestone;
+    let entityType = '';
+    if (list.label) {
+      entityType = 'label_id';
+    } else if (list.assignee) {
+      entityType = 'assignee_id';
+    } else if (IS_EE && list.milestone) {
+      entityType = 'milestone_id';
+    }
+
+    return this.createList(entity.id, entityType)
+      .then(res => res.data)
+      .then(data => {
+        list.id = data.id;
+        list.type = data.list_type;
+        list.position = data.position;
+        list.label = data.label;
+
+        return list.getIssues();
+      });
+  },
+
   getIssuesForList(id, filter = {}) {
     const data = { id };
     Object.keys(filter).forEach(key => {

app/assets/javascripts/breakpoints.js

@@ -1,22 +0,0 @@
-export const breakpoints = {
-  lg: 1200,
-  md: 992,
-  sm: 768,
-  xs: 0,
-};
-
-const BreakpointInstance = {
-  windowWidth: () => window.innerWidth,
-  getBreakpointSize() {
-    const windowWidth = this.windowWidth();
-
-    const breakpoint = Object.keys(breakpoints).find(key => windowWidth > breakpoints[key]);
-
-    return breakpoint;
-  },
-  isDesktop() {
-    return ['lg', 'md'].includes(this.getBreakpointSize());
-  },
-};
-
-export default BreakpointInstance;

app/assets/javascripts/broadcast_notification.js

@@ -0,0 +1,21 @@
+import Cookies from 'js-cookie';
+
+const handleOnDismiss = ({ currentTarget }) => {
+  currentTarget.removeEventListener('click', handleOnDismiss);
+  const {
+    dataset: { id },
+  } = currentTarget;
+
+  Cookies.set(`hide_broadcast_notification_message_${id}`, true);
+
+  const notification = document.querySelector(`.js-broadcast-notification-${id}`);
+  notification.parentNode.removeChild(notification);
+};
+
+export default () => {
+  const dismissButton = document.querySelector('.js-dismiss-current-broadcast-notification');
+
+  if (dismissButton) {
+    dismissButton.addEventListener('click', handleOnDismiss);
+  }
+};

app/assets/javascripts/ci_variable_list/ajax_variable_list.js

@@ -1,4 +1,4 @@
-import _ from 'underscore';
+import { escape as esc } from 'lodash';
 import axios from '../lib/utils/axios_utils';
 import { s__ } from '../locale';
 import Flash from '../flash';
@@ -10,7 +10,7 @@ function generateErrorBoxContent(errors) {
   const errorList = [].concat(errors).map(
     errorString => `
     <li>
-      ${_.escape(errorString)}
+      ${esc(errorString)}
     </li>
   `,
   );

app/assets/javascripts/clusters/clusters_bundle.js

@@ -53,6 +53,7 @@ export default class Clusters {
       helpPath,
       ingressHelpPath,
       ingressDnsHelpPath,
+      ingressModSecurityHelpPath,
       environmentsHelpPath,
       clustersHelpPath,
       deployBoardsHelpPath,
@@ -69,6 +70,7 @@ export default class Clusters {
       helpPath,
       ingressHelpPath,
       ingressDnsHelpPath,
+      ingressModSecurityHelpPath,
       environmentsHelpPath,
       clustersHelpPath,
       deployBoardsHelpPath,
@@ -169,6 +171,7 @@ export default class Clusters {
             ingressHelpPath: this.state.ingressHelpPath,
             managePrometheusPath: this.state.managePrometheusPath,
             ingressDnsHelpPath: this.state.ingressDnsHelpPath,
+            ingressModSecurityHelpPath: this.state.ingressModSecurityHelpPath,
             cloudRunHelpPath: this.state.cloudRunHelpPath,
             providerType: this.state.providerType,
             preInstalledKnative: this.state.preInstalledKnative,