.gitlab/CODEOWNERS

@@ -6,8 +6,8 @@
 
 .gitlab/CODEOWNERS @gitlab-org/development-leaders @gitlab-org/tw-leadership
 
-## Allows release tooling to update the Gitaly Version
-GITALY_SERVER_VERSION @project_278964_bot6 @gitlab-org/maintainers/rails-backend @gitlab-org/delivery
+## Allows release tooling and Gitaly team members to update the Gitaly Version
+GITALY_SERVER_VERSION @project_278964_bot6 @gitlab-org/maintainers/rails-backend @gitlab-org/delivery @gl-gitaly
 
 ## Files that are excluded from required approval
 ## These rules override the * rule above, so that changes to docs and templates
@@ -990,6 +990,9 @@ lib/gitlab/checks/**
 /app/policies/
 /ee/app/policies/
 /ee/app/models/members/member_role.rb
+/ee/app/models/auth/member_role_ability_loader.rb
+/ee/app/models/preloaders/user_member_roles_in_groups_preloader.rb
+/ee/app/models/preloaders/user_member_roles_in_projects_preloader.rb
 /ee/app/services/member_roles/
 /ee/app/graphql/types/member_roles/
 /ee/app/graphql/mutations/member_roles/
@@ -1165,7 +1168,6 @@ lib/gitlab/checks/**
 /ee/app/helpers/ee/access_tokens_helper.rb
 /ee/app/helpers/ee/auth_helper.rb
 /ee/app/helpers/ee/personal_access_tokens_helper.rb
-/ee/app/models/auth/
 /ee/app/models/concerns/identity_verifiable.rb
 /ee/app/models/concerns/password_complexity.rb
 /ee/app/models/ee/personal_access_token.rb
@@ -1289,7 +1291,6 @@ lib/gitlab/checks/**
 /app/views/projects/pipeline_schedules/
 /app/views/projects/pipelines/
 /app/views/projects/triggers/
-/app/workers/build_hooks_worker.rb
 /app/workers/build_queue_worker.rb
 /app/workers/build_success_worker.rb
 /app/workers/ci_platform_metrics_update_cron_worker.rb
@@ -1413,44 +1414,20 @@ ee/lib/ee/api/entities/project.rb
 [Compliance] @gitlab-org/govern/compliance/engineering
 /app/services/audit_events/build_service.rb
 /ee/app/services/ee/audit_events/build_service.rb
-/ee/spec/services/audit_events/custom_audit_event_service_spec.rb
 /app/models/audit_event.rb
 /app/services/audit_event_service.rb
 /app/services/concerns/audit_event_save_type.rb
-/app/views/profiles/audit_log.html.haml
-/ee/app/assets/javascripts/audit_events/
-/ee/app/controllers/admin/audit_log_reports_controller.rb
-/ee/app/controllers/admin/audit_logs_controller.rb
-/ee/app/controllers/concerns/audit_events/audit_events_params.rb
-/ee/app/controllers/groups/audit_events_controller.rb
-/ee/app/controllers/projects/audit_events_controller.rb
-/ee/app/finders/audit_event_finder.rb
-/ee/app/graphql/types/audit_events/
-/ee/app/helpers/audit_events_helper.rb
-/ee/app/helpers/auditor_user_helper.rb
-/ee/app/models/audit_events/external_audit_event_destination.rb
+/ee/app/models/audit_events/
+/ee/app/models/concerns/audit_events/
 /ee/app/models/concerns/auditable.rb
 /ee/app/models/ee/audit_event.rb
-/ee/app/policies/audit_events/external_audit_event_destination_policy.rb
-/ee/app/presenters/audit_event_presenter.rb
-/ee/app/serializers/audit_event_entity.rb
-/ee/app/serializers/audit_event_serializer.rb
-/ee/app/services/ci/audit_variable_change_service.rb
 /ee/app/services/ee/audit_event_service.rb
-/ee/app/views/admin/users/_auditor_access_level_radio.html.haml
-/ee/app/views/admin/users/_auditor_user_badge.html.haml
-/ee/app/views/shared/icons/_icon_audit_events_purple.svg
-/ee/app/views/shared/promotions/_promote_audit_events.html.haml
-/ee/app/workers/audit_events/audit_event_streaming_worker.rb
-/ee/lib/api/audit_events.rb
-/ee/lib/audit/
-/ee/lib/ee/api/entities/audit_event.rb
+/ee/app/workers/audit_events/
 /ee/lib/ee/gitlab/audit/
 /lib/gitlab/audit/auditor.rb
 /lib/gitlab/audit_json_logger.rb
-/ee/app/graphql/mutations/audit_events/
 /ee/app/models/concerns/audit_events/
-/ee/app/views/projects/audit_events/
+/config/audit_events/types/type_schema.json
 
 ^[Fulfillment::Utilization] @sheldonled @aalakkad @kpalchyk
 /ee/app/assets/javascripts/usage_quotas/components/

.gitlab/ci/database.gitlab-ci.yml

@@ -45,59 +45,17 @@ db:rollback single-db:
     - .single-db
     - .rails:rules:single-db
 
-db:migrate:multi-version-upgrade-1:
-  stage: test
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}:bundler-${BUNDLER_VERSION}-docker-${DOCKER_VERSION}
+db:migrate:multi-version-upgrade:
   extends:
     - .db-job-base
-    - .use-docker-in-docker
-  variables:
-    UPGRADE_STOP: 16.3.6-ee
-    UPGRADE_STOP_IMAGE: gitlab/gitlab-ee:${UPGRADE_STOP}.0
-    UPGRADE_STOP_TAG: v${UPGRADE_STOP}
-  before_script:
-    # pull, seed, and export data from previous Upgrade Stop
-    - docker pull "${UPGRADE_STOP_IMAGE}"
-    - |
-      docker run \
-        -d \
-        -v ./scripts/data_seeder:/opt/gitlab/embedded/service/gitlab-rails/scripts/data_seeder \
-        -v ./ee/db/seeds/data_seeder:/opt/gitlab/embedded/service/gitlab-rails/ee/db/seeds/data_seeder \
-        -v ./ee/lib/tasks/gitlab/seed:/opt/gitlab/embedded/service/gitlab-rails/ee/lib/tasks/gitlab/seed \
-        --name gitlab \
-        "${UPGRADE_STOP_IMAGE}"
-    - docker exec gitlab bash -c "cd /opt/gitlab/embedded/service/gitlab-rails; REF='${UPGRADE_STOP_TAG}' . scripts/data_seeder/test_resources.sh"
-    - |
-      docker exec gitlab bash -c "cd /opt/gitlab/embedded/service/gitlab-rails; echo \"gem 'gitlab-rspec', path: 'gems/gitlab-rspec'\" >> Gemfile"
-    - docker exec gitlab bash -c "cd /opt/gitlab/embedded/service/gitlab-rails; ruby scripts/data_seeder/globalize_gems.rb; bundle install"
-    - docker exec gitlab bash -c "gitlab-ctl reconfigure"
-    - docker exec gitlab gitlab-rake "ee:gitlab:seed:data_seeder[bulk_data.rb]"
-
-    # dump
-    - docker exec gitlab bash -c "mkdir /tmp/xfer; chown gitlab-psql /tmp/xfer"
-    - |
-      docker exec gitlab bash -c " \
-        runuser -l gitlab-psql -c \"pg_dump -U gitlab-psql -h '/var/opt/gitlab/postgresql' gitlabhq_production | gzip > /tmp/xfer/gitlabhq_production.gz\" \
-      "
   script:
-    - docker cp gitlab:/tmp/xfer/gitlabhq_production.gz .
-  artifacts:
-    paths: ["gitlabhq_production.gz"]
-    expire_in: 3d
-  when: manual
-  allow_failure: true
-
-db:migrate:multi-version-upgrade-2:
-  stage: test
-  extends:
-    - .db-job-base
-  script:
-    - gunzip gitlabhq_production.gz
+    - curl -o latest_upgrade_stop.gz https://gitlab.com/gitlab-org/quality/pg-dump-generator/-/raw/main/pg_dumps/ee/latest_upgrade_stop.gz
+    - gunzip -c latest_upgrade_stop.gz > gitlabhq_production
     - bundle exec rake db:drop db:create
     - apt-get update -qq && apt-get install -y -qq postgresql
-    - psql -h postgres -U postgres -d gitlabhq_test < gitlabhq_production
+    - psql --output /dev/null -v "ON_ERROR_STOP=1" -h postgres -U postgres -d gitlabhq_test < gitlabhq_production
     - bundle exec rake gitlab:db:configure
-  needs: ["db:migrate:multi-version-upgrade-1"]
+  allow_failure: true
 
 db:migrate:reset:
   extends: .db-job-base

.gitlab/ci/docs.gitlab-ci.yml

@@ -73,6 +73,7 @@ docs-lint markdown:
     - yarn_install_script
     - install_gitlab_gem
     - scripts/lint-doc.sh
+    - scripts/lint/check_mermaid.mjs
 
 docs-lint blueprint:
   extends:

.gitlab/ci/includes/as-if-jh.gitlab-ci.yml

@@ -104,7 +104,8 @@ sync-as-if-jh-branch:
 
 start-as-if-jh:
   extends:
-    - .as-if-jh:rules:start-as-if-jh
+    - .as-if-jh:rules:prepare-as-if-jh
+  allow_failure: true
   stage: prepare
   needs:
     - job: "prepare-as-if-jh-branch"

.gitlab/ci/includes/gitlab-com/danger-review.gitlab-ci.yml

 include:
   - project: gitlab-org/quality/pipeline-common
-    ref: 8.4.2
+    ref: 8.4.3
     file:
       - /ci/danger-review.yml
 

.gitlab/ci/qa-common/main.gitlab-ci.yml

@@ -15,7 +15,7 @@ include:
       gitlab_auth_token_variable_name: "PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE"
       allure_job_name: "${QA_RUN_TYPE}"
   - project: gitlab-org/quality/pipeline-common
-    ref: 8.4.0
+    ref: 8.4.3
     file:
       - /ci/base.gitlab-ci.yml
       - /ci/knapsack-report.yml

.gitlab/ci/qa.gitlab-ci.yml

@@ -256,16 +256,15 @@ e2e:fulfillment-quarantine-report:
     - apt-get update && apt-get install -y jq
   variables:
     RSPEC_JSON: "tmp/rspec-fulfillment-quarantined.json"
-    NOTES_API: "https://gitlab.com/api/v4/projects/$CI_MERGE_REQUEST_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/notes"
-    USER_API: "https://gitlab.com/api/v4/user"
+    NOTES_API: "https://gitlab.com/api/v4/projects/$CI_MERGE_REQUEST_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/notes?per_page=100"
     FULFILLMENT_SPECS_PATH: "qa/specs/features/ee/browser_ui/11_fulfillment"
+    BOT_USER_ID: 19650898
   script:
     - bundle exec rspec $FULFILLMENT_SPECS_PATH --tag quarantine --format json --out $RSPEC_JSON --dry-run
     - |
       if [[ -f $RSPEC_JSON && $(cat $RSPEC_JSON | jq ".examples[]") ]]
       then # quarantined tests found
-        bot_user_id=$(curl $USER_API -H "PRIVATE-TOKEN: $PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE" | jq ".id")
-        existing_comment=$(curl $NOTES_API -H "PRIVATE-TOKEN: $PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE" | jq ".[] | select((.author | .id | contains($bot_user_id)) and (.body | contains(\"# Quarantined Fulfillment QA E2E Tests\")))")
+        existing_comment=$(curl $NOTES_API -H "PRIVATE-TOKEN: $PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE" | jq ".[] | select((.author | .id | contains($BOT_USER_ID)) and (.body | contains(\"# Quarantined Fulfillment QA E2E Tests\")))")
         if [[ ! -z $existing_comment ]]
         then
           echo 'MR comment already exists, doing nothing'

.gitlab/ci/rails.gitlab-ci.yml

@@ -1203,6 +1203,7 @@ rspec-ee unit pg16:
 rspec-ee unit pg16 es8:
   extends:
     - .rspec-ee-base-pg16-es8
+    - .rails:rules:default-branch-schedule-nightly--code-backstage-ee-only
     - .rspec-ee-unit-parallel
 
 rspec-ee integration pg16:
@@ -1214,6 +1215,7 @@ rspec-ee integration pg16:
 rspec-ee integration pg16 es8:
   extends:
     - .rspec-ee-base-pg16-es8
+    - .rails:rules:default-branch-schedule-nightly--code-backstage-ee-only
     - .rspec-ee-integration-parallel
 
 rspec-ee system pg16:
@@ -1225,6 +1227,7 @@ rspec-ee system pg16:
 rspec-ee system pg16 es8:
   extends:
     - .rspec-ee-base-pg16-es8
+    - .rails:rules:default-branch-schedule-nightly--code-backstage-ee-only
     - .rspec-ee-system-parallel
 # EE: default branch nightly scheduled jobs #
 #####################################

.gitlab/ci/rails/shared.gitlab-ci.yml

@@ -93,14 +93,30 @@ include:
     - bundle exec gem list gitlab_quality-test_tooling
     - |
       if [ "$CREATE_RAILS_TEST_FAILURE_ISSUES" == "true" ]; then
+        input_file="rspec/rspec-${CI_JOB_ID}.json"
+
+        # The actual failures will always be part of the retry report
+        if [ -f "rspec/rspec-retry-${CI_JOB_ID}.json" ]; then
+          input_file="rspec/rspec-retry-${CI_JOB_ID}.json"
+        fi
+
         bundle exec relate-failure-issue \
           --token "${TEST_FAILURES_PROJECT_TOKEN}" \
           --project "gitlab-org/gitlab" \
-          --input-files "rspec/rspec-*.json" \
+          --input-files "${input_file}" \
           --exclude-labels-for-search "QA,rspec:slow test,knapsack_report" \
           --system-log-files "log" \
           --related-issues-file "rspec/${CI_JOB_ID}-failed-test-issues.json";
       fi
+
+      if [ "$CREATE_RAILS_FLAKY_TEST_ISSUES" == "true" && -f "rspec/rspec-retry-${CI_JOB_ID}.json" ]; then
+        bundle exec flaky-test-issues \
+          --token "${RAILS_FLAKY_TEST_PROJECT_TOKEN}" \
+          --project "gitlab-org/quality/engineering-productivity/flaky-tests" \
+          --merge_request_iid "$CI_MERGE_REQUEST_IID" \
+          --input-files "rspec/rspec-retry-${CI_JOB_ID}.json" || true # We don't want this command to fail the job.
+      fi
+
       if [ "$CREATE_RAILS_SLOW_TEST_ISSUES" == "true" ]; then
         bundle exec slow-test-issues \
           --token "${TEST_FAILURES_PROJECT_TOKEN}" \
@@ -108,6 +124,7 @@ include:
           --input-files "rspec/rspec-*.json" \
           --related-issues-file "rspec/${CI_JOB_ID}-slow-test-issues.json";
       fi
+
       if [ "$ADD_SLOW_TEST_NOTE_TO_MERGE_REQUEST" == "true" ]; then
         bundle exec slow-test-merge-request-report-note \
           --token "${TEST_SLOW_NOTE_PROJECT_TOKEN}" \
@@ -115,6 +132,7 @@ include:
           --input-files "rspec/rspec-*.json" \
           --merge_request_iid "$CI_MERGE_REQUEST_IID";
       fi
+
       if [ "$ALLOW_KNAPSACK_REPORT_CREATE_ISSUES" == "true" ]; then
         bundle exec knapsack-report-issues \
           --token "${KNAPSACK_REPORT_ISSUES_PROJECT_TOKEN}" \

.gitlab/ci/rules.gitlab-ci.yml

@@ -47,9 +47,6 @@
 .if-merge-request-approved: &if-merge-request-approved
   if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:mr-approved/'
 
-.if-merge-request-approved-and-specific-devops-stage: &if-merge-request-approved-and-specific-devops-stage
-  if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && ($CI_MERGE_REQUEST_LABELS =~ /pipeline:mr-approved/ && $CI_MERGE_REQUEST_LABELS =~ /devops::(create|govern|manage|plan|verify|package|monitor|data stores|fulfillment|systems)/)'
-
 .if-merge-request-and-specific-devops-stage: &if-merge-request-and-specific-devops-stage
   if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /devops::(create|govern|manage|plan|verify|package|monitor|data stores|fulfillment|systems)/'
 
@@ -74,6 +71,9 @@
 .if-merge-request-labels-as-if-jh: &if-merge-request-labels-as-if-jh
   if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-as-if-jh/'
 
+.if-merge-request-labels-force-as-if-jh: &if-merge-request-labels-force-as-if-jh
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:force-run-as-if-jh/'
+
 .if-merge-request-labels-update-caches: &if-merge-request-labels-update-caches
   if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:update-cache/'
 
@@ -108,7 +108,7 @@
   if: '$CI_MERGE_REQUEST_LABELS =~ /group::global search/'
 
 .if-merge-request-labels-pipeline-expedite: &if-merge-request-labels-pipeline-expedite
-  if: '($CI_MERGE_REQUEST_LABELS =~ /master:(foss-)?broken/ || $CI_MERGE_REQUEST_LABELS =~ /quarantine/) && $CI_MERGE_REQUEST_LABELS =~ /pipeline:expedite/'
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:expedite/'
 
 .if-merge-request-labels-frontend-and-feature-flag: &if-merge-request-labels-frontend-and-feature-flag
   if: '$CI_MERGE_REQUEST_LABELS =~ /frontend/ && $CI_MERGE_REQUEST_LABELS =~ /feature flag/'
@@ -158,9 +158,6 @@
 .if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified: &if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
   if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE =~ /^gitlab-org($|\/security$)/ && ($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $QA_TESTS'
 
-.if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e: &if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE =~ /^gitlab-org($|\/security$)/ && ($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $QA_MANUAL_FF_PACKAGE_AND_QA'
-
 .if-dot-com-gitlab-org-and-security-tag: &if-dot-com-gitlab-org-and-security-tag
   if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE =~ /^gitlab-org($|\/security$)/ && $CI_COMMIT_TAG'
 
@@ -231,11 +228,12 @@
   - "config/metrics/**/*.yml"
 
 .docs-patterns: &docs-patterns
+  - ".gitlab/ci/docs.gitlab-ci.yml"
   - ".gitlab/route-map.yml"
-  - "doc/**/*"
   - ".markdownlint.yml"
+  - "doc/**/*"
   - "scripts/lint-doc.sh"
-  - ".gitlab/ci/docs.gitlab-ci.yml"
+  - "scripts/lint/check_mermaid.mjs"
 
 .docs-blueprints-patterns: &docs-blueprints-patterns
   - "doc/architecture/blueprints/**/*"
@@ -660,6 +658,7 @@
   - "ee/config/custom_abilities/*.yml"
   - "doc/user/custom_roles/abilities.md"
   - "tooling/custom_roles/docs/templates/custom_abilities.md.erb"
+  - "ee/{lib/,spec/}tasks/gitlab/custom_roles/*"
 
 ##################
 # Conditions set #
@@ -893,8 +892,6 @@
     - <<: *if-merge-request
       changes: *dependency-patterns
     - <<: *if-merge-request-labels-run-all-e2e
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
     - <<: *if-merge-request
       changes: *feature-flag-development-config-patterns
     - <<: *if-merge-request
@@ -980,9 +977,6 @@
       changes: *nodejs-patterns
     - <<: *if-merge-request
       changes: *ci-qa-patterns
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
-      when: manual
     - <<: *if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
       changes: *code-patterns
     - <<: *if-merge-request
@@ -1011,8 +1005,6 @@
     - <<: *if-merge-request
       changes: *dependency-patterns
     - <<: *if-merge-request-labels-run-all-e2e
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
     - <<: *if-merge-request
       changes: *feature-flag-development-config-patterns
     - <<: *if-merge-request
@@ -1247,8 +1239,6 @@
     # Rules to support .qa:rules:package-and-test
     - <<: *if-default-branch-schedule-nightly
     - <<: *if-merge-request-labels-run-all-e2e
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
     - <<: *if-merge-request
       changes: *dependency-patterns
     - <<: *if-force-ci
@@ -1480,17 +1470,23 @@
     - <<: *if-foss-schedule
     - <<: *if-merge-request-labels-update-caches
 
-.qa:rules:code-merge-request-manual:
+.qa:rules:code-merge-request:
+  rules:
+    - <<: *if-merge-request
+      changes: *code-patterns
+
+.qa:rules:code-merge-request-allowed-to-fail:
   rules:
     - <<: *if-merge-request
       changes: *code-patterns
-      when: manual
       allow_failure: true
 
-.qa:rules:code-merge-request:
+.qa:rules:code-merge-request-manual:
   rules:
     - <<: *if-merge-request
       changes: *code-patterns
+      when: manual
+      allow_failure: true
 
 .qa:rules:internal:
   rules:
@@ -1528,9 +1524,6 @@
       allow_failure: true
     - <<: *if-merge-request-labels-run-all-e2e
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
-      allow_failure: true
     - <<: *if-merge-request
       changes: *feature-flag-development-config-patterns
       allow_failure: true
@@ -1551,13 +1544,13 @@
     - <<: *if-merge-request-targeting-stable-branch
       changes: *setup-test-env-patterns
     - <<: *if-ruby-branch
+    - <<: *if-merge-request
+      changes: *qa-patterns
     - <<: *if-merge-request
       changes: *dependency-patterns
       variables:
         OMNIBUS_GITLAB_BUILD_ON_ALL_OS: 'true'
     - <<: *if-merge-request-labels-run-all-e2e
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
     - <<: *if-merge-request
       changes: *feature-flag-development-config-patterns
     - <<: *if-merge-request
@@ -1566,16 +1559,14 @@
       changes: *nodejs-patterns
     - <<: *if-merge-request
       changes: *ci-qa-patterns
-    - <<: *if-merge-request
-      changes: *qa-patterns
     - <<: *if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
       changes: *code-patterns
     - <<: *if-force-ci
+    - <<: *if-merge-request-and-specific-devops-stage
+      changes: *code-patterns
     # From .qa:rules:package-and-test-schedule
     - <<: *if-dot-com-gitlab-org-schedule
-    # From .qa:rules:code-merge-request-manual
-    - <<: *if-merge-request
-      changes: *code-patterns
+    - !reference [".qa:rules:code-merge-request", rules]
 
 .qa:rules:package-and-test-never-run:
   rules:
@@ -1594,16 +1585,19 @@
       allow_failure: true
     - <<: *if-ruby-branch
       allow_failure: true
+    # Run tests automatically for MRs that touch QA files
+    - <<: *if-merge-request
+      changes: *qa-patterns
+      allow_failure: true
+    # Otherwise, only run tests after the MR is approved
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-merge-request
       changes: *dependency-patterns
       variables:
         OMNIBUS_GITLAB_BUILD_ON_ALL_OS: 'true'
     - <<: *if-merge-request-labels-run-all-e2e
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
-      when: manual
-      allow_failure: true
     - <<: *if-merge-request
       changes: *feature-flag-development-config-patterns
       allow_failure: true
@@ -1616,16 +1610,13 @@
     - <<: *if-merge-request
       changes: *ci-qa-patterns
       allow_failure: true
-    - <<: *if-merge-request
-      changes: *qa-patterns
-      allow_failure: true
     - <<: *if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
       changes: *code-patterns
       allow_failure: true
     - <<: *if-force-ci
       when: manual
       allow_failure: true
-    - <<: *if-merge-request-approved-and-specific-devops-stage
+    - <<: *if-merge-request-and-specific-devops-stage
       changes: *code-patterns
       allow_failure: true
       # We used to have a rule at the end here that would catch any remaining code MRs and allow the job to be run
@@ -1760,7 +1751,7 @@
 
 # These are based on `.qa:rules:trigger-omnibus` except:
 # 1. Automatic jobs changed to `when: never.`
-# 2. For specific devops stage, do not run for code-patterns
+# 2. Do not run for specific devops stage
 # If any changes are made to this rule, `.qa:rules:follow-up-e2e` should also be updated.
 .qa:rules:manual-omnibus-and-follow-up-e2e:
   rules:
@@ -1768,43 +1759,6 @@
     - <<: *if-merge-request-and-specific-devops-stage
       when: never
     - !reference [".qa:rules:code-merge-request-manual", rules]
-    - <<: *if-dot-com-gitlab-org-schedule
-      when: never
-    - <<: *if-merge-request-targeting-stable-branch
-      changes: *setup-test-env-patterns
-      when: never
-    - <<: *if-ruby-branch
-      when: never
-    - <<: *if-merge-request
-      changes: *dependency-patterns
-      when: never
-    - <<: *if-merge-request-labels-run-all-e2e
-      when: never
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
-      when: manual
-      allow_failure: true
-    - <<: *if-merge-request
-      changes: *feature-flag-development-config-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *initializers-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *nodejs-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *ci-qa-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *qa-patterns
-      when: never
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
-      changes: *code-patterns
-      when: never
-    - <<: *if-force-ci
-      when: manual
-      allow_failure: true
 
 # These are based on `.qa:rules:manual-omnibus-and-follow-up-e2e` but with manual jobs changed to automatic
 .qa:rules:follow-up-e2e:
@@ -1812,44 +1766,7 @@
     - !reference [".qa:rules:package-and-test-never-run", rules]
     - <<: *if-merge-request-and-specific-devops-stage
       when: never
-    - <<: *if-merge-request
-      changes: *code-patterns
-      allow_failure: true
-    - <<: *if-dot-com-gitlab-org-schedule
-      when: never
-    - <<: *if-merge-request-targeting-stable-branch
-      changes: *setup-test-env-patterns
-      when: never
-    - <<: *if-ruby-branch
-      when: never
-    - <<: *if-merge-request
-      changes: *dependency-patterns
-      when: never
-    - <<: *if-merge-request-labels-run-all-e2e
-      when: never
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
-      allow_failure: true
-    - <<: *if-merge-request
-      changes: *feature-flag-development-config-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *initializers-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *nodejs-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *ci-qa-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *qa-patterns
-      when: never
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
-      changes: *code-patterns
-      when: never
-    - <<: *if-force-ci
-      allow_failure: true
+    - !reference [".qa:rules:code-merge-request-allowed-to-fail", rules]
 
 # These are based on `qa:rules:package-and-test-ee` but with when:never in all except for code-patterns in merge requests
 .qa:rules:post-run-e2e-message:
@@ -1866,9 +1783,6 @@
       when: never
     - <<: *if-merge-request-labels-run-all-e2e
       when: never
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
-      when: never
     - <<: *if-merge-request
       changes: *feature-flag-development-config-patterns
       when: never
@@ -1897,10 +1811,7 @@
     # Do not run on unapproved MR
     - <<: *if-merge-request-not-approved
       when: never
-    # From .qa:rules:code-merge-request-manual
-    - <<: *if-merge-request
-      changes: *code-patterns
-      allow_failure: true
+    - !reference [".qa:rules:code-merge-request-allowed-to-fail", rules]
 
 .qa:rules:fulfillment-e2e-quarantine-report:
   rules:
@@ -2049,6 +1960,9 @@
   rules:
     - <<: *if-fork-merge-request
       changes: *code-backstage-patterns
+    - <<: *if-merge-request
+      changes: *core-backend-patterns
+      when: never
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
     - <<: *if-merge-request-approved
@@ -2831,6 +2745,15 @@
   rules:
     - if: '$CI_FETCH_REPO_GIT_STRATEGY == "none"'
 
+.setup:rules:check-default-pipeline-status:
+  rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:ignore-master-status/'
+      when: never
+    - <<: *if-default-refs
+      allow_failure: true
+
 .setup:rules:gitlab_git_test:
   rules:
     - <<: *if-merge-request-labels-pipeline-expedite
@@ -3018,8 +2941,6 @@
       changes: *code-backstage-qa-patterns
     - <<: *if-security-merge-request
       changes: *db-patterns
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
 
 .as-if-foss:rules:start-as-if-foss:allow-failure:manual:
   rules:
@@ -3118,10 +3039,6 @@
       changes: *db-patterns
       allow_failure: true
       when: manual
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
-      allow_failure: true
-      when: manual
 
 .as-if-foss:rules:start-as-if-foss:allow-failure:
   rules:
@@ -3197,15 +3114,18 @@
     - <<: *if-security-merge-request
       changes: *db-patterns
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
-      changes: *feature-flag-development-config-patterns
-      allow_failure: true
 
 ##################
 # as-if-jh rules #
 ##################
 .as-if-jh:rules:prepare-as-if-jh:
   rules:
+    - !reference [".strict-ee-only-rules", rules]
+    - <<: *if-merge-request-labels-force-as-if-jh
+    - if: '$CI_AS_IF_JH_ENABLED != "true"'
+      when: never
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-merge-request-labels-as-if-jh
     - <<: *if-merge-request
       changes: *feature-flag-development-config-patterns
@@ -3229,24 +3149,19 @@
 # dependencies changes.
 .as-if-jh:rules:sync-as-if-jh:
   rules:
+    - !reference [".strict-ee-only-rules", rules]
+    - <<: *if-merge-request-labels-force-as-if-jh
+      changes: *dependency-patterns
+    - if: '$CI_AS_IF_JH_ENABLED != "true"'
+      when: never
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-merge-request-labels-as-if-jh
       changes: *dependency-patterns
       # Ideally, we should be able to do this:
       # - <<: *if-dot-com-gitlab-org-merge-request
       #   changes: *feature-flag-development-config-patterns && *dependency-patterns
 
-# This rule should share the same logic with .as-if-jh:rules:prepare-as-if-jh
-# Because the jobs using this need jobs using the preparation rules
-.as-if-jh:rules:start-as-if-jh:
-  rules:
-    - <<: *if-merge-request-labels-as-if-jh
-      when: never # See https://gitlab.com/gitlab-org/gitlab/-/issues/442194
-      allow_failure: true  # See https://gitlab.com/gitlab-org/gitlab/-/issues/351136
-    - <<: *if-merge-request
-      changes: *feature-flag-development-config-patterns
-      when: never # See https://gitlab.com/gitlab-org/gitlab/-/issues/442194
-      allow_failure: true  # See https://gitlab.com/gitlab-org/gitlab/-/issues/351136
-
 ##############################
 # release-environments rules #
 ##############################

.gitlab/ci/setup.gitlab-ci.yml

@@ -57,6 +57,18 @@ clone-gitlab-repo:
       - '*'
     expire_in: '12 hours'
 
+master-pipeline-status:
+  extends:
+    - .default-retry
+    - .setup:rules:check-default-pipeline-status
+  stage: sync
+  image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}-slim
+  before_script:
+    - source ./scripts/utils.sh
+    - install_gitlab_gem
+  script:
+    - scripts/check_default_pipeline_status.rb
+
 gitlab_git_test:
   extends:
     - .predictive-job

.gitlab/issue_templates/Doc_cleanup.md

 <!--
 * Use this template for documentation issues identified
-* by [Vale](https://docs.gitlab.com/ee/development/documentation/testing.html#vale)
-* or [markdownlint](https://docs.gitlab.com/ee/development/documentation/testing.html#markdownlint).
+* by [Vale](https://docs.gitlab.com/ee/development/documentation/testing/vale.html)
+* or [markdownlint](https://docs.gitlab.com/ee/development/documentation/testing/markdownlint.html).
 * This template is meant to describe work for first-time contributors or
 * for work during Hackathons.
 *

.gitleaksignore

@@ -2,4 +2,5 @@ afedb913baf4203aa688421873fdb9f94649578e:doc/api/users.md:generic-api-key:2201
 spec/frontend/lib/utils/secret_detection_spec.js:generic-api-key:34
 spec/frontend/lib/utils/secret_detection_spec.js:generic-api-key:35
 spec/frontend/lib/utils/secret_detection_spec.js:generic-api-key:38
-spec/frontend/lib/utils/secret_detection_spec.js:generic-api-key:39
+spec/frontend/lib/utils/secret_detection_spec.js:generic-api-key:39
\ No newline at end of file
+spec/frontend/lib/utils/secret_detection_spec.js:generic-api-key:40
\ No newline at end of file

.markdownlint.yml

@@ -16,7 +16,6 @@ header-style:                     # MD003
 hr-style:                         # MD035
   style: "---"
 line-length: false                # MD013
-link-fragments: false             # MD051
 no-duplicate-heading:             # MD024
   siblings_only: true
 no-emphasis-as-heading: false     # MD036

.rubocop.yml

@@ -330,6 +330,13 @@ Rails/InverseOf:
     - app/models/**/*.rb
     - ee/app/models/**/*.rb
 
+Rails/MigrationTimestamp:
+  Enabled: true
+  Include:
+    - 'db/migrate/*.rb'
+    - 'db/post_migrate/*.rb'
+    - 'ee/db/geo/migrate/*.rb'
+
 # This is currently exiting with a rubocop exception error and should be
 # resolved hopefully a future update
 # An error occurred while Rails/UniqueValidationWithoutIndex cop was inspecting
@@ -490,6 +497,24 @@ BackgroundMigration/DictionaryFile:
   Include:
     - 'db/post_migrate/*.rb'
 
+# See https://gitlab.com/gitlab-org/gitlab/-/issues/442751
+Gitlab/AvoidCurrentOrganization:
+  Enabled: true
+  Exclude:
+    - 'app/controllers/**/*'
+    - 'ee/app/controllers/**/*'
+    - 'app/helpers/**/*'
+    - 'ee/app/helpers/**/*'
+    - 'app/views/**/*'
+    - 'ee/app/views/**/*'
+    - 'lib/api/**/*'
+    - 'ee/lib/api/**/*'
+    - 'app/graphql/**/*'
+    - 'ee/app/graphql/**/*'
+    - 'lib/gitlab/middleware/organizations/current.rb'
+    - 'spec/**/*'
+    - 'ee/spec/**/*'
+
 # See https://gitlab.com/groups/gitlab-org/-/epics/7374
 Gitlab/AvoidGitlabInstanceChecks:
   Enabled: true

.rubocop_todo/capybara/testid_finders.yml

----
-Capybara/TestidFinders:
-  Exclude:
-    - 'spec/features/merge_request/user_interacts_with_batched_mr_diffs_spec.rb'
-    - 'spec/features/projects/settings/registry_settings_cleanup_tags_spec.rb'
-    - 'spec/features/projects/settings/registry_settings_spec.rb'
-    - 'spec/features/projects/show/user_sees_collaboration_links_spec.rb'
-    - 'spec/features/projects/sub_group_issuables_spec.rb'
-    - 'spec/features/projects/terraform_spec.rb'
-    - 'spec/features/projects/tree/create_directory_spec.rb'
-    - 'spec/features/projects/tree/create_file_spec.rb'
-    - 'spec/features/projects/work_items/work_item_children_spec.rb'
-    - 'spec/features/projects/work_items/work_item_spec.rb'
-    - 'spec/features/protected_branches_spec.rb'
-    - 'spec/features/runners_spec.rb'
-    - 'spec/features/search/user_searches_for_code_spec.rb'
-    - 'spec/features/search/user_searches_for_issues_spec.rb'
-    - 'spec/features/search/user_searches_for_merge_requests_spec.rb'
-    - 'spec/features/search/user_searches_for_milestones_spec.rb'
-    - 'spec/features/search/user_searches_for_wiki_pages_spec.rb'
-    - 'spec/features/search/user_uses_search_filters_spec.rb'
-    - 'spec/features/tags/developer_deletes_tag_spec.rb'
-    - 'spec/features/tags/maintainer_deletes_protected_tag_spec.rb'
-    - 'spec/features/triggers_spec.rb'
-    - 'spec/features/user_sees_revert_modal_spec.rb'

.rubocop_todo/database/avoid_using_pluck_without_limit.yml

@@ -89,7 +89,6 @@ Database/AvoidUsingPluckWithoutLimit:
     - 'app/services/merge_requests/push_options_handler_service.rb'
     - 'app/services/merge_requests/pushed_branches_service.rb'
     - 'app/services/packages/cleanup/execute_policy_service.rb'
-    - 'app/services/projects/slack_application_install_service.rb'
     - 'app/services/projects/unlink_fork_service.rb'
     - 'ee/app/finders/ee/issuables/label_filter.rb'
     - 'ee/app/finders/ee/merge_requests_finder.rb'

.rubocop_todo/gitlab/avoid_current_organization.yml

+---
+Gitlab/AvoidCurrentOrganization:
+  Details: grace period
+  Exclude:
+    - 'app/models/organizations/organization_setting.rb'
+    - 'app/services/groups/create_service.rb'

.rubocop_todo/gitlab/avoid_gitlab_instance_checks.yml

@@ -78,7 +78,6 @@ Gitlab/AvoidGitlabInstanceChecks:
     - 'ee/app/models/gitlab_subscription.rb'
     - 'ee/app/models/gitlab_subscriptions/add_on_purchase.rb'
     - 'ee/app/models/gitlab_subscriptions/upcoming_reconciliation.rb'
-    - 'ee/app/models/namespaces/storage/enforcement.rb'
     - 'ee/app/policies/ee/global_policy.rb'
     - 'ee/app/policies/ee/group_policy.rb'
     - 'ee/app/policies/ee/project_policy.rb'

.rubocop_todo/gitlab/namespaced_class.yml

@@ -712,7 +712,6 @@ Gitlab/NamespacedClass:
     - 'app/workers/authorized_projects_worker.rb'
     - 'app/workers/auto_merge_process_worker.rb'
     - 'app/workers/background_migration_worker.rb'
-    - 'app/workers/build_hooks_worker.rb'
     - 'app/workers/build_queue_worker.rb'
     - 'app/workers/build_success_worker.rb'
     - 'app/workers/bulk_import_worker.rb'