.gitignore

@@ -61,11 +61,9 @@ eslint-report.html
 /shared/artifacts/
 /rails_best_practices_output.html
 /tags
-/tmp/*
 /vendor/bundle/*
 /vendor/gitaly-ruby
 /builds*
-/shared/*
 /.gitlab_workhorse_secret
 /webpack-report/
 /knapsack/
@@ -73,7 +71,6 @@ eslint-report.html
 /locale/**/LC_MESSAGES
 /locale/**/*.time_stamp
 /.rspec
-/plugins/*
 /.gitlab_pages_secret
 /.gitlab_smime_key
 /.gitlab_smime_cert
@@ -81,4 +78,5 @@ package-lock.json
 /junit_*.xml
 /coverage-frontend/
 jsdoc/
-**/tmp/rubocop_cache/**
\ No newline at end of file
+**/tmp/rubocop_cache/**
+.overcommit.yml

.gitlab-ci.yml

@@ -5,6 +5,7 @@ stages:
   - prepare
   - quick-test
   - test
+  - review-prepare
   - review
   - qa
   - post-test
@@ -18,8 +19,11 @@ variables:
   GIT_SUBMODULE_STRATEGY: "none"
   GET_SOURCES_ATTEMPTS: "3"
   KNAPSACK_RSPEC_SUITE_REPORT_PATH: knapsack/${CI_PROJECT_NAME}/rspec_report-master.json
+  EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH: knapsack/${CI_PROJECT_NAME}/rspec_report-master-ee.json
   FLAKY_RSPEC_SUITE_REPORT_PATH: rspec_flaky/report-suite.json
   BUILD_ASSETS_IMAGE: "false"
+  ES_JAVA_OPTS: "-Xms256m -Xmx256m"
+  ELASTIC_URL: "http://elastic:changeme@docker.elastic.co-elasticsearch-elasticsearch:9200"
 
 after_script:
   - date
@@ -38,3 +42,4 @@ include:
   - local: .gitlab/ci/setup.gitlab-ci.yml
   - local: .gitlab/ci/test-metadata.gitlab-ci.yml
   - local: .gitlab/ci/yaml.gitlab-ci.yml
+  - local: .gitlab/ci/ee-specific-checks.gitlab-ci.yml

.gitlab/ci/docs.gitlab-ci.yml

@@ -74,7 +74,7 @@ docs lint:
   script:
     - scripts/lint-doc.sh
     # Lint Markdown
-    - markdownlint --config .markdownlint.json doc/**/*.md
+    - markdownlint --config .markdownlint.json 'doc/**/*.md'
     # Prepare docs for build
     - mv doc/ /tmp/gitlab-docs/content/$DOCS_GITLAB_REPO_SUFFIX
     - cd /tmp/gitlab-docs

.gitlab/ci/ee-specific-checks.gitlab-ci.yml

+.ee-specific-check:
+  extends: .default-tags
+  dependencies: []
+  only:
+    - branches@gitlab-org/gitlab-ee
+  except:
+    - master
+    - tags
+    - /[\d-]+-stable(-ee)?/
+    - /[\d-]+-auto-deploy-\d{7}/
+    - /^security-/
+    - /\bce\-to\-ee\b/
+
+ee-files-location-check:
+  extends: .ee-specific-check
+  script:
+    - scripts/ee-files-location-check
+
+ee-specific-lines-check:
+  extends: .ee-specific-check
+  script:
+    - scripts/ee-specific-lines-check

.gitlab/ci/frontend.gitlab-ci.yml

@@ -13,7 +13,9 @@
     - .default-before_script
     - .except-docs
   image: dev.gitlab.org:5005/gitlab/gitlab-build-images:ruby-2.6.3-git-2.22-chrome-73.0-node-12.x-yarn-1.16-graphicsmagick-1.3.33-docker-18.06.1
+  stage: test
   dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   services:
     - docker:19.03.0-dind
   variables:
@@ -42,10 +44,6 @@
     - time scripts/build_assets_image
     - scripts/clean-old-cached-assets
     - rm -f /etc/apt/sources.list.d/google*.list  # We don't need to update Chrome here
-    # Play dependent manual jobs
-    - install_api_client_dependencies_with_apt
-    - play_job "review-build-cng" || true  # this job might not exist so ignore the failure if it cannot be played
-    - play_job "schedule:review-build-cng" || true  # this job might not exist so ignore the failure if it cannot be played
   only:
     - /.+/@gitlab-org/gitlab-ce
     - /.+/@gitlab-org/gitlab-ee
@@ -186,7 +184,8 @@ jest:
     - .default-retry
     - .default-cache
     - .except-docs
-  dependencies: ["setup-test-env"]
+  dependencies: []
+  stage: test
   variables:
     SETUP_DB: "false"
   before_script:
@@ -233,41 +232,3 @@ qa-frontend-node:latest:
   extends: .qa-frontend-node
   image: node:latest
   allow_failure: true
-
-lint:javascript:report:
-  extends:
-    - .default-tags
-    - .default-retry
-    - .default-cache
-    - .except-docs
-  variables:
-    SETUP_DB: "false"
-  stage: post-test
-  dependencies: []
-  script:
-    - date
-    - yarn run eslint-report || true  # ignore exit code
-  artifacts:
-    name: eslint-report
-    expire_in: 31d
-    paths:
-      - eslint-report.html
-
-jsdoc:
-  extends:
-    - .default-tags
-    - .default-retry
-    - .default-cache
-    - .except-docs
-  variables:
-    SETUP_DB: "false"
-  stage: post-test
-  dependencies: ["compile-assets", "compile-assets pull-cache"]
-  script:
-    - date
-    - yarn run jsdoc || true  # ignore exit code
-  artifacts:
-    name: jsdoc
-    expire_in: 31d
-    paths:
-      - jsdoc/

.gitlab/ci/pages.gitlab-ci.yml

@@ -9,17 +9,15 @@ pages:
       - master@gitlab-org/gitlab-ce
       - master@gitlab-org/gitlab-ee
   stage: pages
-  dependencies: ["coverage", "karma", "gitlab:assets:compile", "lint:javascript:report", "jsdoc"]
+  dependencies: ["coverage", "karma", "gitlab:assets:compile"]
   script:
     - mv public/ .public/
     - mkdir public/
     - mv coverage/ public/coverage-ruby/ || true
     - mv coverage-javascript/ public/coverage-javascript/ || true
-    - mv eslint-report.html public/ || true
     - mv webpack-report/ public/webpack-report/ || true
     - cp .public/assets/application-*.css public/application.css || true
     - cp .public/assets/application-*.css.gz public/application.css.gz || true
-    - mv jsdoc/ public/jsdoc/ || true
   artifacts:
     paths:
       - public

.gitlab/ci/qa.gitlab-ci.yml

 .package-and-qa-base:
   image: ruby:2.6-alpine
   stage: qa
-  needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
   dependencies: []
   variables:
     GIT_DEPTH: "1"
@@ -11,24 +10,33 @@
     - install_gitlab_gem
     - ./scripts/trigger-build omnibus
   only:
-    - branches@gitlab-org/gitlab-ce
-    - branches@gitlab-org/gitlab-ee
-  except:
-    - master
+    refs:
+      - branches@gitlab-org/gitlab-ce
+      - branches@gitlab-org/gitlab-ee
 
 package-and-qa-manual:
-  extends:
-    - .package-and-qa-base
-    - .except-docs-qa
-  when: manual
+  extends: .package-and-qa-base
   except:
-    - master
-    - /(^docs[\/-].+|.+-docs$)/
-    - /(^qa[\/-].*|.*-qa$)
+    refs:
+      - master
+      - /(^docs[\/-].+|.+-docs$)/
+      - /(^qa[\/-].*|.*-qa$)/
+  when: manual
+  needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
+
+package-and-qa-manual:master:
+  extends: .package-and-qa-base
+  only:
+    refs:
+      - master
+  when: manual
+  needs: ["build-qa-image", "gitlab:assets:compile"]
 
 package-and-qa:
   extends: .package-and-qa-base
-  allow_failure: true
   only:
-    - /(^qa[\/-].*|.*-qa$)/@gitlab-org/gitlab-ce
-    - /(^qa[\/-].*|.*-qa$)/@gitlab-org/gitlab-ee
+    refs:
+      - /(^qa[\/-].*|.*-qa$)/@gitlab-org/gitlab-ce
+      - /(^qa[\/-].*|.*-qa$)/@gitlab-org/gitlab-ee
+  needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
+  allow_failure: true

.gitlab/ci/rails.gitlab-ci.yml

@@ -165,7 +165,9 @@ downtime_check:
       - /^[\d-]+-stable(-ee)?$/
       - /(^docs[\/-].+|.+-docs$)/
       - /(^qa[\/-].*|.*-qa$)/
+  stage: test
   dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
 
 ee_compat_check:
   extends: .rake-exec
@@ -195,7 +197,9 @@ db:migrate:reset:
     - .default-before_script
     - .use-pg
     - .except-docs-qa
+  stage: test
   dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   script:
     - bundle exec rake db:migrate:reset
 
@@ -207,7 +211,9 @@ db:check-schema:
     - .default-before_script
     - .use-pg
     - .except-docs-qa
+  stage: test
   dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   script:
     - source scripts/schema_changed.sh
 
@@ -219,7 +225,9 @@ db:migrate-from-v11.11.0:
     - .default-before_script
     - .use-pg
     - .except-docs-qa
+  stage: test
   dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   variables:
     SETUP_DB: "false"
   script:
@@ -248,7 +256,9 @@ db:rollback:
     - .default-before_script
     - .use-pg
     - .except-docs-qa
+  stage: test
   dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   script:
     - bundle exec rake db:migrate VERSION=20180101160629
     - bundle exec rake db:migrate SKIP_SCHEMA_VERSION_CHECK=true
@@ -261,7 +271,9 @@ gitlab:setup:
     - .default-before_script
     - .use-pg
     - .except-docs-qa
+  stage: test
   dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   variables:
     SETUP_DB: "false"
   script:

.gitlab/ci/reports.gitlab-ci.yml

@@ -17,13 +17,23 @@ sast:
   variables:
     SAST_BRAKEMAN_LEVEL: 2
     SAST_EXCLUDED_PATHS: qa,spec,doc
+  artifacts:
+    expire_in: 7 days
+    paths:
+      - gl-sast-report.json
 
 dependency_scanning:
   extends: .reports
 
 dast:
-  extends: .reports
+  extends:
+    - .reports
+    - .review-only
   stage: qa
   dependencies: ["review-deploy"]
   before_script:
     - export DAST_WEBSITE="$(cat review_app_url.txt)"
+  artifacts:
+    expire_in: 7 days
+    paths:
+      - gl-dast-report.json

.gitlab/ci/review.gitlab-ci.yml

@@ -22,7 +22,9 @@
     - source scripts/utils.sh
 
 .review-docker:
-  extends: .review-base
+  extends:
+    - .default-tags
+    - .default-retry
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-qa-alpine
   services:
     - docker:19.03.0-dind
@@ -36,7 +38,13 @@
     QA_IMAGE: "${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab/${CI_PROJECT_NAME}-qa:${CI_COMMIT_REF_SLUG}"
 
 build-qa-image:
-  extends: .review-docker
+  extends:
+    - .review-docker
+    - .except-docs
+  only:
+    refs:
+      - branches@gitlab-org/gitlab-ce
+      - branches@gitlab-org/gitlab-ee
   stage: test
   script:
     - time docker build --cache-from ${LATEST_QA_IMAGE} --tag ${QA_IMAGE} --file ./qa/Dockerfile ./
@@ -45,8 +53,7 @@ build-qa-image:
 
 .review-build-cng-base:
   image: ruby:2.6-alpine
-  stage: test
-  when: manual
+  stage: review-prepare
   before_script:
     - source scripts/utils.sh
     - install_api_client_dependencies_with_apk
@@ -59,17 +66,20 @@ review-build-cng:
   extends:
     - .review-build-cng-base
     - .review-only
+  needs: ["gitlab:assets:compile pull-cache"]
 
 schedule:review-build-cng:
   extends:
     - .review-build-cng-base
     - .review-schedules-only
+  needs: ["gitlab:assets:compile"]
 
 review-deploy:
   extends: .review-base
   allow_failure: true
   retry: 1
   stage: review
+  needs: ["review-build-cng"]
   variables:
     HOST_SUFFIX: "${CI_ENVIRONMENT_SLUG}"
     DOMAIN: "-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}"
@@ -120,11 +130,14 @@ review-stop:
     - source utils.sh
     - source review-apps.sh
   script:
-    - delete
-  artifacts: {}
+    - delete_release
+  artifacts:
+    paths: []
 
 .review-qa-base:
-  extends: .review-docker
+  extends:
+    - .review-docker
+    - .review-only
   retry: 2
   stage: qa
   variables:

.gitlab/ci/setup.gitlab-ci.yml

@@ -7,7 +7,9 @@ cache gems:
     - .default-cache
     - .default-before_script
     - .except-docs
+  stage: test
   dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   variables:
     SETUP_DB: "false"
   script:

.gitlab/ci/yaml.gitlab-ci.yml

@@ -4,6 +4,7 @@ lint-ci-gitlab:
   extends:
     - .default-tags
     - .default-retry
+    - .except-docs
   image: sdesbure/yamllint:latest
   dependencies: []
   script:

.gitlab/issue_templates/Feature proposal.md

@@ -17,12 +17,13 @@ Personas can be found at https://about.gitlab.com/handbook/marketing/product-mar
 
 ### Permissions and Security
 
-<!-- What permissions are required to perform the described actions? Are they consistent with the existing permissions as documented for users, groups, and projects as appropriate? Is the proposed behavior consistent between the UI, API, and other access methods (e.g. email replies)? -->
+<!-- What permissions are required to perform the described actions? Are they consistent with the existing permissions as documented for users, groups, and projects as appropriate? Is the proposed behavior consistent between the UI, API, and other access methods (e.g. email replies)?-->
 
 ### Documentation
 
 <!-- See the Feature Change Documentation Workflow https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html
-Add all known Documentation Requirements here, per https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html#documentation-requirements -->
+Add all known Documentation Requirements here, per https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html#documentation-requirements
+If this feature requires changing permissions, this document https://docs.gitlab.com/ee/user/permissions.html must be updated accordingly. -->
 
 ### Testing
 

.overcommit.yml.example

+# Use this file to configure the Overcommit hooks you wish to use. This will
+# extend the default configuration defined in:
+# https://github.com/sds/overcommit/blob/master/config/default.yml
+#
+# At the topmost level of this YAML file is a key representing type of hook
+# being run (e.g. pre-commit, commit-msg, etc.). Within each type you can
+# customize each hook, such as whether to only run it on certain files (via
+# `include`), whether to only display output if it fails (via `quiet`), etc.
+#
+# For a complete list of hooks, see:
+# https://github.com/sds/overcommit/tree/master/lib/overcommit/hook
+#
+# For a complete list of options that you can use to customize hooks, see:
+# https://github.com/sds/overcommit#configuration
+#
+# Uncomment the following lines to make the configuration take effect.
+
+PreCommit:
+  RuboCop:
+    enabled: true
+#    on_warn: fail # Treat all warnings as failures
+#
+#PostCheckout:
+#  ALL: # Special hook name that customizes all hooks of this type
+#    quiet: true # Change all post-checkout hooks to only display output on failure
+#
+#  IndexTags:
+#    enabled: true # Generate a tags file with `ctags` each time HEAD changes

.rubocop.yml

@@ -50,7 +50,9 @@ Style/FrozenStringLiteralComment:
     - 'config/**/*'
     - 'danger/**/*'
     - 'db/**/*'
-    - 'ee/**/*'
+    - 'ee/db/**/*'
+    - 'ee/spec/**/*'
+    - 'ee/lib/tasks/**/*'
     - 'lib/tasks/**/*'
     - 'qa/**/*'
     - 'rubocop/**/*'
@@ -91,6 +93,7 @@ Naming/FileName:
     - JSON
     - LDAP
     - SAML
+    - SSO
     - IO
     - HMAC
     - QA
@@ -261,7 +264,14 @@ RSpec/EnvAssignment:
   Exclude:
     - 'spec/**/fast_spec_helper.rb'
     - 'ee/spec/**/fast_spec_helper.rb'
-    - 'spec/**/rails_helper.rb'
-    - 'ee/spec/**/rails_helper.rb'
     - 'spec/**/spec_helper.rb'
     - 'ee/spec/**/spec_helper.rb'
+RSpec/BeSuccessMatcher:
+  Enabled: true
+  Include:
+    - 'spec/controllers/**/*'
+    - 'ee/spec/controllers/**/*'
+    - 'spec/support/shared_examples/controllers/**/*'
+    - 'ee/spec/support/shared_examples/controllers/**/*'
+    - 'spec/support/controllers/**/*'
+    - 'ee/spec/support/controllers/**/*'

.rubocop_todo.yml

@@ -218,7 +218,7 @@ Lint/UriEscapeUnescape:
     - 'app/models/project_services/drone_ci_service.rb'
     - 'spec/lib/google_api/auth_spec.rb'
     - 'spec/requests/api/files_spec.rb'
-    - 'spec/requests/api/internal_spec.rb'
+    - 'spec/requests/api/internal/base_spec.rb'
 
 # Offense count: 1
 # Configuration parameters: CheckForMethodsWithNoSideEffects.
@@ -570,11 +570,6 @@ Style/EmptyMethod:
 Style/Encoding:
   Enabled: false
 
-# Offense count: 2
-Style/EvalWithLocation:
-  Exclude:
-    - 'app/models/service.rb'
-
 # Offense count: 203
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.

CHANGELOG.md

@@ -2,6 +2,55 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
+## 12.2.4
+
+### Fixed (7 changes)
+
+- Add syntax highlighting for line expansion. !31821
+- Fix issuable sidebar icon on notification disabled. !32134
+- Upgrade Mermaid to v8.2.4. !32186
+- Fix Piwik not working. !32234
+- Fix snippets API not working with visibility level. !32286
+- Fix upload URLs in Markdown for users without access to project repository. !32448
+- Update Mermaid to v8.2.6. !32502
+
+### Performance (1 change)
+
+- Fix N+1 Gitaly calls in /api/v4/projects/:id/issues. !32171
+
+
+## 12.2.3
+
+### Security (22 changes)
+
+- Ensure only authorised users can create notes on Merge Requests and Issues.
+- Gitaly: ignore git redirects.
+- Add :login_recaptcha_protection_enabled setting to prevent bots from brute-force attacks.
+- Speed up regexp in namespace format by failing fast after reaching maximum namespace depth.
+- Limit the size of issuable description and comments.
+- Send TODOs for comments on commits correctly.
+- Restrict MergeRequests#test_reports to authenticated users with read-access on Builds.
+- Added image proxy to mitigate potential stealing of IP addresses.
+- Filter out old system notes for epics in notes api endpoint response.
+- Avoid exposing unaccessible repo data upon GFM post processing.
+- Fix HTML injection for label description.
+- Make sure HTML text is always escaped when replacing label/milestone references.
+- Prevent DNS rebind on JIRA service integration.
+- Use admin_group authorization in Groups::RunnersController.
+- Prevent disclosure of merge request ID via email.
+- Show cross-referenced MR-id in issues' activities only to authorized users.
+- Enforce max chars and max render time in markdown math.
+- Check permissions before responding in MergeController#pipeline_status.
+- Remove EXIF from users/personal snippet uploads.
+- Fix project import restricted visibility bypass via API.
+- Fix weak session management by clearing password reset tokens after login (username/email) are updated.
+- Fix SSRF via DNS rebinding in Kubernetes Integration.
+
+
+## 12.2.2
+
+- Unreleased due to QA failure.
+
 ## 12.2.1
 ### Fixed (3 changes)
@@ -591,6 +640,34 @@ entry.
 - Removes EE differences for app/views/admin/users/show.html.haml.
+## 12.0.7
+
+### Security (22 changes)
+
+- Ensure only authorised users can create notes on Merge Requests and Issues.
+- Add :login_recaptcha_protection_enabled setting to prevent bots from brute-force attacks.
+- Queries for Upload should be scoped by model.
+- Speed up regexp in namespace format by failing fast after reaching maximum namespace depth.
+- Limit the size of issuable description and comments.
+- Send TODOs for comments on commits correctly.
+- Restrict MergeRequests#test_reports to authenticated users with read-access on Builds.
+- Added image proxy to mitigate potential stealing of IP addresses.
+- Filter out old system notes for epics in notes api endpoint response.
+- Avoid exposing unaccessible repo data upon GFM post processing.
+- Fix HTML injection for label description.
+- Make sure HTML text is always escaped when replacing label/milestone references.
+- Prevent DNS rebind on JIRA service integration.
+- Use admin_group authorization in Groups::RunnersController.
+- Prevent disclosure of merge request ID via email.
+- Show cross-referenced MR-id in issues' activities only to authorized users.
+- Enforce max chars and max render time in markdown math.
+- Check permissions before responding in MergeController#pipeline_status.
+- Remove EXIF from users/personal snippet uploads.
+- Fix project import restricted visibility bypass via API.
+- Fix weak session management by clearing password reset tokens after login (username/email) are updated.
+- Fix SSRF via DNS rebinding in Kubernetes Integration.
+
+
 ## 12.0.6
 - No changes.

GITALY_SERVER_VERSION

-1.60.0
+1.61.0

GITLAB_ELASTICSEARCH_INDEXER_VERSION

-1.2.0
+1.3.0

GITLAB_PAGES_VERSION

-1.7.1
+1.8.0