.eslintignore

-/app/assets/javascripts/locale/**/app.js
-/builds/
-/coverage/
-/coverage-frontend/
-/node_modules/
-/public/
-/tmp/
-/vendor/
-/sitespeed-result/
-/fixtures/**/*.graphql
-# Storybook build artifacts
-/storybook/public
-spec/fixtures/**/*.graphql

.eslintrc.yml

-extends:
-  - plugin:@gitlab/default
-  - plugin:@gitlab/i18n
-  - plugin:no-jquery/slim
-  - plugin:no-jquery/deprecated-3.4
-  - plugin:no-unsanitized/recommended-legacy
-  - ./tooling/eslint-config/conditionally_ignore.js
-globals:
-  __webpack_public_path__: true
-  gl: false
-  gon: false
-  localStorage: false
-  IS_EE: false
-plugins:
-  - no-jquery
-  - local-rules
-settings:
-  import/resolver:
-    webpack:
-      config: './config/webpack.config.js'
-rules:
-  import/no-commonjs: error
-  import/no-default-export: off
-  no-underscore-dangle:
-    - error
-    - allow:
-        - __
-        - _links
-  import/no-unresolved:
-    - error
-    - ignore:
-        # In FOSS, these import paths are rewritten using
-        # NormalModuleReplacementPlugin, which import/no-unresolved doesn't
-        # consider. See
-        # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/89831.
-        - '^(ee|jh)_component/'
-  lines-between-class-members: off
-  # all offenses of no-jquery/no-animate-toggle are false positives ( $toast.show() )
-  no-jquery/no-animate-toggle: off
-  no-jquery/no-event-shorthand: off
-  no-jquery/no-serialize: error
-  promise/always-return: off
-  promise/no-callback-in-promise: off
-  '@gitlab/no-global-event-off': error
-  '@gitlab/vue-no-new-non-primitive-in-template':
-    - error
-    - allowNames:
-        - 'class(es)?$'
-        - '^style$'
-        - '^to$'
-        - '^$'
-        - '^variables$'
-        - 'attrs?$'
-  '@gitlab/vue-no-undef-apollo-properties': error
-  '@gitlab/tailwind-no-interpolation': error
-  '@gitlab/vue-tailwind-no-interpolation': error
-  no-param-reassign:
-    - error
-    - props: true
-      ignorePropertyModificationsFor:
-        - acc
-        - accumulator
-        - el
-        - element
-        - state
-      ignorePropertyModificationsForRegex:
-        - '^draft'
-  import/order:
-    - error
-    - groups:
-        - builtin
-        - external
-        - internal
-        - parent
-        - sibling
-        - index
-      pathGroups:
-        - pattern: ~/**
-          group: internal
-        - pattern: emojis/**
-          group: internal
-        - pattern: '{ee_,jh_,}empty_states/**'
-          group: internal
-        - pattern: '{ee_,jh_,}icons/**'
-          group: internal
-        - pattern: '{ee_,jh_,}images/**'
-          group: internal
-        - pattern: vendor/**
-          group: internal
-        - pattern: shared_queries/**
-          group: internal
-        - pattern: '{ee_,}spec/**'
-          group: internal
-        - pattern: '{ee_,jh_,}jest/**'
-          group: internal
-        - pattern: '{ee_,jh_,any_}else_ce/**'
-          group: internal
-        - pattern: ee/**
-          group: internal
-        - pattern: '{ee_,jh_,}component/**'
-          group: internal
-        - pattern: jh_else_ee/**
-          group: internal
-        - pattern: jh/**
-          group: internal
-        - pattern: '{test_,}helpers/**'
-          group: internal
-        - pattern: test_fixtures/**
-          group: internal
-      alphabetize:
-        order: ignore
-  'no-restricted-syntax':
-    - error
-    - selector: ImportSpecifier[imported.name='GlSkeletonLoading']
-      message: 'Migrate to GlSkeletonLoader, or import GlDeprecatedSkeletonLoading.'
-    - selector: ImportSpecifier[imported.name='GlSafeHtmlDirective']
-      message: 'Use directive at ~/vue_shared/directives/safe_html.js instead.'
-    - selector: Literal[value=/docs.gitlab.+\u002Fee/]
-      message: 'No hard coded url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: TemplateElement[value.cooked=/docs.gitlab.+\u002Fee/]
-      message: 'No hard coded url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: Literal[value=/(?=.*docs.gitlab.*)(?!.*\u002Fee\b.*)/]
-      message: 'No hard coded url, use `DOCS_URL` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: TemplateElement[value.cooked=/(?=.*docs.gitlab.*)(?!.*\u002Fee\b.*)/]
-      message: 'No hard coded url, use `DOCS_URL` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: Literal[value=/(?=.*about.gitlab.*)(?!.*\u002Fblog\b.*)/]
-      message: 'No hard coded url, use `PROMO_URL` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: TemplateElement[value.cooked=/(?=.*about.gitlab.*)(?!.*\u002Fblog\b.*)/]
-      message: 'No hard coded url, use `PROMO_URL` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: TemplateLiteral[expressions.0.name=DOCS_URL] > TemplateElement[value.cooked=/\u002Fjh|\u002Fee/]
-      message: '`/ee` or `/jh` path found in docs url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-    # This can be removed once GitLab is on Vue 3
-    - selector: MemberExpression[object.type='ThisExpression'][property.name=/(\$delete|\$set)/]
-      message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-  no-restricted-properties:
-    - error
-    - object: window
-      property: open
-      message: 'Use `visitUrl` in `jh_else_ce/lib/utils/url_utility` to avoid cross-site leaks.'
-    # This can be removed once GitLab is on Vue 3
-    - object: vm
-      property: $delete
-      message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-    # This can be removed once GitLab is on Vue 3
-    - object: Vue
-      property: delete
-      message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-    # This can be removed once GitLab is on Vue 3
-    - object: vm
-      property: $set
-      message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-    # This can be removed once GitLab is on Vue 3
-    - object: Vue
-      property: set
-      message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-  no-restricted-imports:
-    - error
-    - paths:
-        - name: mousetrap
-          message: 'Import { Mousetrap } from ~/lib/mousetrap instead.'
-        - name: vuex
-          message: 'See our documentation on "Migrating from VueX" for tips on how to avoid adding new VueX stores.'
-        - name: '@sentry/browser'
-          message: Use "import * as Sentry from '~/sentry/sentry_browser_wrapper';" instead
-      patterns:
-        - group: ['react', 'react-dom/*']
-          message: We do not allow usage of React in our codebase except for the graphql_explorer
-  unicorn/prefer-dom-node-dataset:
-    - error
-  no-unsanitized/method:
-    - error
-    - escape:
-        methods: ['sanitize']
-  no-unsanitized/property:
-    - error
-    - escape:
-        methods: ['sanitize']
-  # This rule will be enabled later.
-  unicorn/no-array-callback-reference: off
-  vue/no-undef-components:
-    - error
-    - ignorePatterns:
-        - '^router-link$'
-        - '^router-view$'
-        - '^gl-emoji$'
-  local-rules/require-valid-help-page-path: 'error'
-  local-rules/vue-require-valid-help-page-link-component: 'error'
-overrides:
-  - files:
-      - '{,ee/,jh/}spec/frontend*/**/*'
-    rules:
-      '@gitlab/require-i18n-strings': off
-      '@gitlab/no-runtime-template-compiler': off
-      '@gitlab/tailwind-no-interpolation': off
-      '@gitlab/vue-tailwind-no-interpolation': off
-      'require-await': error
-      'import/no-dynamic-require': off
-      'no-import-assign': off
-      'no-restricted-syntax':
-        - error
-        - selector: CallExpression[callee.object.name=/(wrapper|vm)/][callee.property.name="setData"]
-          message: 'Avoid using "setData" on VTU wrapper'
-        - selector: MemberExpression[object.type!='ThisExpression'][property.type='Identifier'][property.name='$nextTick']
-          message: 'Using $nextTick from a component instance is discouraged. Import nextTick directly from the Vue package.'
-        - selector: Identifier[name='setImmediate']
-          message: 'Prefer explicit waitForPromises (or equivalent), or jest.runAllTimers (or equivalent) to vague setImmediate calls.'
-        - selector: ImportSpecifier[imported.name='GlSkeletonLoading']
-          message: 'Migrate to GlSkeletonLoader, or import GlDeprecatedSkeletonLoading.'
-        - selector: CallExpression[arguments.length=1][arguments.0.type='Literal'] CallExpression[callee.property.name='toBe'] CallExpression[callee.property.name='attributes'][arguments.length=1][arguments.0.value='disabled']
-          message: Avoid asserting disabled attribute exact value, because Vue.js 2 and Vue.js 3 renders it differently. Use toBeDefined / toBeUndefined instead
-        - selector: MemberExpression[object.object.name='Vue'][object.property.name='config'][property.name='errorHandler']
-          message: 'Use setErrorHandler/resetVueErrorHandler from helpers/set_vue_error_handler.js instead.'
-        - selector: Literal[value=/docs.gitlab.+\u002Fee/]
-          message: 'No hard coded url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: TemplateElement[value.cooked=/docs.gitlab.+\u002Fee/]
-          message: 'No hard coded url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: Literal[value=/(?=.*docs.gitlab.*)(?!.*\u002Fee\b.*)/]
-          message: 'No hard coded url, use `DOCS_URL` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: TemplateElement[value.cooked=/(?=.*docs.gitlab.*)(?!.*\u002Fee\b.*)/]
-          message: 'No hard coded url, use `DOCS_URL` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: Literal[value=/(?=.*about.gitlab.*)(?!.*\u002Fblog\b.*)/]
-          message: 'No hard coded url, use `PROMO_URL` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: TemplateElement[value.cooked=/(?=.*about.gitlab.*)(?!.*\u002Fblog\b.*)/]
-          message: 'No hard coded url, use `PROMO_URL` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: TemplateLiteral[expressions.0.name=DOCS_URL] > TemplateElement[value.cooked=/\u002Fjh|\u002Fee/]
-          message: '`/ee` or `/jh` path found in docs url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-        # This can be removed once GitLab is on Vue 3
-        - selector: CallExpression[callee.property.name=/(\$delete|\$set)/]
-          message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-      no-restricted-properties:
-        - error
-        # This can be removed once GitLab is on Vue 3
-        - object: Vue
-          property: delete
-          message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-        # This can be removed once GitLab is on Vue 3
-        - object: Vue
-          property: set
-          message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-      no-unsanitized/method: off
-      no-unsanitized/property: off
-      local-rules/require-valid-help-page-path: off
-      local-rules/vue-require-valid-help-page-link-component: off
-      no-restricted-imports:
-        - error
-        - paths:
-            - name: mousetrap
-              message: 'Import { Mousetrap } from ~/lib/mousetrap instead.'
-            - name: vuex
-              message: 'See our documentation on "Migrating from VueX" for tips on how to avoid adding new VueX stores.'
-            - name: '@sentry/browser'
-              message: Use "import * as Sentry from '~/sentry/sentry_browser_wrapper';" instead
-            - name: ~/locale
-              importNames:
-                - __
-                - s__
-              message: 'Do not externalize strings in specs: https://docs.gitlab.com/ee/development/i18n/externalization.html#test-files-jest'
-  - files:
-      - 'config/**/*'
-      - 'scripts/**/*'
-      - '*.config.js'
-      - '*.config.*.js'
-      - 'jest_resolver.js'
-    rules:
-      '@gitlab/require-i18n-strings': off
-      import/no-extraneous-dependencies: off
-      import/no-commonjs: off
-      import/no-nodejs-modules: off
-      filenames/match-regex: off
-      no-console: off
-  - files:
-      - '*.stories.js'
-    rules:
-      filenames/match-regex: off
-      '@gitlab/require-i18n-strings': off
-  - files:
-      - '*.graphql'
-    plugins:
-      - '@graphql-eslint'
-    parserOptions:
-      parser: '@graphql-eslint/eslint-plugin'
-      operations: '{,ee/,jh/}app/**/*.graphql'
-      schema: './tmp/tests/graphql/gitlab_schema_apollo.graphql'
-    rules:
-      filenames/match-regex: off
-      spaced-comment: off
-      # TODO: We need a way to include this rule + support ee_else_ce fragments
-      #'@graphql-eslint/unique-fragment-name': error
-      # TODO: Uncomment these rules when then `schema` is available
-      #'@graphql-eslint/fragments-on-composite-type': error
-      #'@graphql-eslint/known-argument-names': error
-      #'@graphql-eslint/known-type-names': error
-      '@graphql-eslint/no-anonymous-operations': error
-      '@graphql-eslint/unique-operation-name': error
-      '@graphql-eslint/require-id-when-available': error
-      '@graphql-eslint/no-unused-variables': error
-      '@graphql-eslint/no-unused-fragments': error
-      '@graphql-eslint/no-duplicate-fields': error
-  - files:
-      - '{,ee/}spec/contracts/consumer/**/*'
-    rules:
-      '@gitlab/require-i18n-strings': off
-  - files:
-      - 'app/assets/javascripts/projects/settings/branch_rules/queries/branch_rules_details.query.graphql'
-      - 'app/assets/javascripts/projects/settings/repository/branch_rules/graphql/mutations/create_branch_rule.mutation.graphql'
-      - 'app/assets/javascripts/projects/settings/repository/branch_rules/graphql/queries/branch_rules.query.graphql'
-      - 'ee/app/assets/javascripts/projects/settings/branch_rules/queries/branch_rules_details.query.graphql'
-      - 'ee/app/assets/javascripts/projects/settings/repository/branch_rules/graphql/queries/branch_rules.query.graphql'
-    rules:
-      '@graphql-eslint/require-id-when-available': off
-  - files:
-      - '{,spec/}tooling/**/*'
-    rules:
-      'no-undef': off
-      'import/no-commonjs': off
-      'import/no-extraneous-dependencies': off
-      'no-restricted-syntax': off
-      '@gitlab/require-i18n-strings': off

.gitlab/CODEOWNERS

@@ -22,6 +22,7 @@
 /doc/**/*.md
 /doc/**/*.jpg
 /doc/**/*.png
+/doc/**/*.svg
 /data/deprecations/*.yml
 
 ## Technical writing files that do not need `*` rule approval,
@@ -1743,10 +1744,12 @@ ee/app/workers/ai/repository_xray/
 [JH Technical Writer] @jihulab/maintainers/technical-writer
 /jh/doc/
 
-^[Geo]
+[Geo]
 /doc/**/geo/ @gitlab-org/geo-team/geo-backend
 /ee/**/geo/ @gitlab-org/geo-team/geo-backend
 /qa/**/geo/ @gitlab-org/geo-team/geo-backend
 geo_* @gitlab-org/geo-team/geo-backend
+
+^[Geo Frontend]
 app/assets/**/geo_* @zcuddy
 frontend/**/geo_* @zcuddy

.gitlab/ci/build-images.gitlab-ci.yml

@@ -28,13 +28,6 @@ build-qa-image as-if-foss:
     - .as-if-foss
     - .qa:rules:test-on-omnibus-ce:follow-up
 
-follow-up:build-qa-image:
-  extends:
-    - build-qa-image
-    - .qa:rules:follow-up-e2e
-  needs:
-    - manual:e2e-test-pipeline-generate
-
 retag-gdk-image:
   extends:
     - .base-image-build
@@ -88,9 +81,3 @@ build-assets-image as-if-foss:
     - .as-if-foss
     - .qa:rules:test-on-omnibus-ce:follow-up
   needs: ["compile-production-assets as-if-foss"]
-
-follow-up:build-assets-image:
-  extends:
-    - build-assets-image
-    - .qa:rules:follow-up-e2e
-  needs: ["follow-up:compile-production-assets"]

.gitlab/ci/frontend.gitlab-ci.yml

@@ -68,13 +68,6 @@ compile-production-assets as-if-foss:
     - .as-if-foss
     - .qa:rules:test-on-omnibus-ce:follow-up
 
-follow-up:compile-production-assets:
-  extends:
-    - compile-production-assets
-    - .qa:rules:follow-up-e2e
-  needs:
-    - manual:e2e-test-pipeline-generate
-
 compile-test-assets:
   extends:
     - .compile-assets-base
@@ -318,7 +311,8 @@ jest:
       junit: junit_jest.xml
   parallel: 11
   script:
-    - run_timed_command "yarn jest:ci:without-fixtures"
+    - if [[ -z "${CI_MERGE_REQUEST_IID}" ]]; then export JEST_COVERAGE="--coverage"; fi
+    - run_timed_command "yarn jest:ci:without-fixtures $JEST_COVERAGE"
 
 jest-with-fixtures:
   extends:
@@ -332,7 +326,8 @@ jest-with-fixtures:
     - !reference [.with-fixtures-needs, needs]
   parallel: 2
   script:
-    - run_timed_command "yarn jest:ci:with-fixtures"
+    - if [[ -z "${CI_MERGE_REQUEST_IID}" ]]; then export JEST_COVERAGE="--coverage"; fi
+    - run_timed_command "yarn jest:ci:with-fixtures $JEST_COVERAGE"
 
 jest vue3:
   extends:

.gitlab/ci/global.gitlab-ci.yml

@@ -139,17 +139,13 @@
 
 .qa-ruby-gems-cache: &qa-ruby-gems-cache
   key:
-    prefix: "qa-ruby-gems-${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}-gemfile-${BUNDLE_GEMFILE}"
+    prefix: "qa-ruby-gems-${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}"
     files:
       - qa/Gemfile.lock
   paths:
     - qa/vendor/ruby
   policy: pull
 
-.qa-ruby-gems-cache-push: &qa-ruby-gems-cache-push
-  <<: *qa-ruby-gems-cache
-  policy: pull-push
-
 .setup-test-env-cache:
   cache:
     - *ruby-gems-cache
@@ -214,7 +210,8 @@
 .qa-cache-push:
   <<: *qa-bundler-variables
   cache:
-    - *qa-ruby-gems-cache-push
+    - <<: *qa-ruby-gems-cache
+      policy: pull-push
 
 .yarn-cache:
   cache:

.gitlab/ci/qa.gitlab-ci.yml

@@ -156,35 +156,6 @@ e2e:test-on-omnibus-ee:
     RELEASE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/build/omnibus-gitlab-mirror/gitlab-ee:${RELEASE_IMAGE_TAG}"
     PIPELINE_NAME: E2E Omnibus GitLab EE
 
-# Same as e2e:test-on-omnibus-ee but runs automatically after manual:e2e-test-pipeline-generate
-follow-up:e2e:test-on-omnibus-ee:
-  extends:
-    - e2e:test-on-omnibus-ee
-    - .qa:rules:follow-up-e2e
-  needs:
-    - follow-up:build-qa-image
-    - follow-up:build-assets-image
-    - manual:e2e-test-pipeline-generate
-
-e2e:post-run-e2e-message:
-  extends:
-    - .predictive-job
-    - .qa:rules:post-run-e2e-message
-  stage: qa
-  variables:
-    ENV_FILE: $CI_PROJECT_DIR/qa_tests_vars.env
-  image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}
-  before_script:
-    - source scripts/utils.sh
-    - install_gitlab_gem
-  script:
-    - scripts/generate-message-to-run-e2e-pipeline.rb
-  needs: []
-  artifacts:
-    expire_in: 1 day
-    paths:
-      - "${CI_PROJECT_DIR}/qa_tests_vars.env"
-
 e2e:test-on-omnibus-ce:
   extends:
     - e2e:test-on-omnibus-ee
@@ -262,7 +233,6 @@ e2e:test-on-cng:
     PIPELINE_NAME: E2E CNG
     DYNAMIC_PIPELINE_YML: test-on-cng-pipeline.yml
     SKIP_MESSAGE: Skipping test-on-cng due to mr containing only quarantine changes!
-  allow_failure: true # TODO: remove once gitlab-org/quality/quality-engineering/team-tasks#3049 is finished
 
 e2e:code-suggestions-eval:
   extends:

.gitlab/ci/rails.gitlab-ci.yml

@@ -47,6 +47,7 @@ setup-test-env:
       - ${TMP_TEST_FOLDER}/repositories/
       - ${TMP_TEST_FOLDER}/second_storage/
       - ${TMP_TEST_GITLAB_WORKHORSE_PATH}/
+      - ${TMP_TEST_FOLDER}/openbao/bin/
       - log/*.log
     when: always
 

.gitlab/ci/reports.gitlab-ci.yml

@@ -83,6 +83,9 @@ secret_detection:
       - gl-dependency-scanning-report.json  # GitLab-specific
     access: 'developer'
     expire_in: 1 week  # GitLab-specific
+  after_script:
+    # Remove sboms in test fixtures so that they are not ingested and scanned.
+    - find spec ee/spec qa -path '**/fixtures/**/gl-sbom*.cdx.json' -delete
 
 gemnasium-dependency_scanning:
   variables:

.gitlab/ci/rules.gitlab-ci.yml

@@ -473,7 +473,8 @@
 
 # Code patterns + .ci-patterns
 .code-patterns: &code-patterns
-  - ".{eslintrc.yml,eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - ".{gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - "eslint.config.mjs"
   - ".browserslistrc"
   - ".stylelintrc"
   - "{,ee/,jh/}{app,bin,config,db,elastic,generator_templates,gems,haml_lint,lib,locale,public,scripts,sidekiq_cluster,storybook,symbol,vendor}/**/*"
@@ -501,7 +502,8 @@
 
 # .code-patterns + .backstage-patterns
 .code-backstage-patterns: &code-backstage-patterns
-  - ".{eslintrc.yml,eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - ".{gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - "eslint.config.mjs"
   - ".browserslistrc"
   - ".stylelintrc"
   - "{,ee/,jh/}{app,bin,config,db,elastic,generator_templates,gems,haml_lint,lib,locale,public,scripts,sidekiq_cluster,storybook,symbol,vendor}/**/*"
@@ -536,7 +538,8 @@
 
 # .code-patterns + .qa-patterns
 .code-qa-patterns: &code-qa-patterns
-  - ".{eslintrc.yml,eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - ".{gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - "eslint.config.mjs"
   - ".browserslistrc"
   - ".stylelintrc"
   - "{,ee/,jh/}{app,bin,config,db,elastic,generator_templates,gems,haml_lint,lib,locale,public,scripts,sidekiq_cluster,storybook,symbol,vendor}/**/*"
@@ -566,7 +569,8 @@
 
 # .code-patterns + .backstage-patterns + .qa-patterns
 .code-backstage-qa-patterns: &code-backstage-qa-patterns
-  - ".{eslintrc.yml,eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - ".{gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - "eslint.config.mjs"
   - ".browserslistrc"
   - ".stylelintrc"
   - "{,ee/,jh/}{app,bin,config,db,elastic,generator_templates,gems,haml_lint,lib,locale,public,scripts,sidekiq_cluster,storybook,symbol,vendor}/**/*"
@@ -614,7 +618,8 @@
   - ".stylelintrc"
   - "Dockerfile.assets"
   - "vendor/assets/**/*"
-  - ".{eslintrc.yml,eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - ".{gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - "eslint.config.mjs"
   - "*_VERSION"
   - "{,jh/}Gemfile{,.lock}"
   - "{,jh/}Gemfile.next{,.lock}"
@@ -1284,13 +1289,11 @@
     - <<: *if-default-refs
       changes: *workhorse-patterns
     - !reference [".prevent-tier-2-and-below", rules]
-    # Rules to support .qa:rules:test-on-omnibus
+    # Rules to support e2e test execution
     - <<: *if-merge-request
       changes: *dependency-patterns
     - <<: *if-default-refs
       changes: *code-qa-patterns
-    - <<: *if-merge-request
-      changes: *cng-orchestrator-patterns
 
 .frontend:rules:compile-production-assets:
   rules:
@@ -1476,7 +1479,7 @@
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
     - <<: *if-merge-request
-      changes: *code-backstage-patterns
+      when: never
     - <<: *if-default-branch-refs
       changes: *code-backstage-patterns
 
@@ -1653,7 +1656,7 @@
       allow_failure: true
     - <<: *if-default-branch-schedule-nightly
       allow_failure: true
-    # Rules to support .qa:rules:test-on-omnibus-ee
+    # Rules to support e2e test execution
     - <<: *if-merge-request
       changes: *dependency-patterns
       allow_failure: true
@@ -1678,38 +1681,7 @@
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
 
-.qa:rules:test-on-omnibus-common:
-  rules:
-    - !reference [".qa:rules:e2e-test-never-run", rules]
-    - <<: *if-merge-request-labels-run-all-e2e
-    # Run tests automatically for MRs that touch QA files
-    - <<: *if-merge-request
-      changes: *qa-patterns
-    - <<: *if-merge-request-targeting-stable-branch
-      changes: *setup-test-env-patterns
-    - <<: *if-merge-request-not-labels-pipeline-run-e2e-omnibus-once
-      when: never
-    # Otherwise, only run tests in pipeline::tier-3 and above
-    - !reference [".prevent-tier-2-and-below", rules]
-    - <<: *if-merge-request
-      changes: *dependency-patterns
-      variables:
-        OMNIBUS_GITLAB_BUILD_ON_ALL_OS: 'true'
-    - <<: *if-merge-request
-      changes: *feature-flag-development-config-patterns
-    - <<: *if-merge-request
-      changes: *initializers-patterns
-    - <<: *if-merge-request
-      changes: *nodejs-patterns
-    - <<: *if-merge-request
-      changes: *ci-qa-patterns
-    - <<: *if-security-merge-request
-      changes: *code-patterns
-    - <<: *if-merge-request-and-specific-devops-stage
-      changes: *code-patterns
-    - <<: *if-ruby-branch
-
-# .qa:rules:e2e-blocking-base-* are similar to .qa:rules:test-on-omnibus-common, but not allowed to fail.
+# primary triggers for e2e tests
 .qa:rules:e2e-blocking-base-before:
   rules:
     - !reference [".qa:rules:e2e-test-never-run", rules]
@@ -1734,16 +1706,22 @@
         MR_CODE_PATTERNS: "true"
 
 .qa:e2e-test-schedule-variables: &qa-e2e-test-schedule-variables
-  variables:
-    CREATE_TEST_FAILURE_ISSUES: "true"
-    PROCESS_TEST_RESULTS: "true"
-    KNAPSACK_GENERATE_REPORT: "true"
-    QA_SAVE_TEST_METRICS: "true"
-    QA_RUN_IN_PARALLEL: "false" # disable single job parallelization due to incompatibility with knapsack and coverband
+  CREATE_TEST_FAILURE_ISSUES: "true"
+  PROCESS_TEST_RESULTS: "true"
+  QA_SAVE_TEST_METRICS: "true"
 
 .qa:rules:e2e-schedule-blocking:
   rules:
-    - <<: [*if-dot-com-gitlab-org-schedule, *qa-e2e-test-schedule-variables]
+    - <<: *if-default-branch-schedule-nightly
+      variables:
+        <<: *qa-e2e-test-schedule-variables
+        KNAPSACK_GENERATE_REPORT: "true"
+        QA_RUN_IN_PARALLEL: "false"
+        COVERBAND_ENABLED: "true"
+    - <<: *if-dot-com-gitlab-org-schedule
+      variables:
+        <<: *qa-e2e-test-schedule-variables
+        KNAPSACK_GENERATE_REPORT: "false"
 
 .qa:rules:code-suggestions-eval-base:
   rules:
@@ -1771,10 +1749,32 @@
     - <<: *if-merge-request
       changes: *code-patterns
 
-# Note: If any changes are made to this rule, the following should also be updated - .qa:rules:post-run-e2e-message
+# test-on-omnibus-ee rules, these tests are executed in following cases:
+# * for dependency changes to validate omnibus build
+# * stable branch merge request to validate release fixes
+# * manually on-demand for app and e2e code changes
 .qa:rules:test-on-omnibus-ee:
   rules:
-    - !reference [".qa:rules:test-on-omnibus-common", rules]
+    - !reference [".qa:rules:e2e-test-never-run", rules]
+    - <<: *if-merge-request-labels-run-all-e2e
+    # this rule needs to be synced with .notify:rules:notify-test-on-omnibus-failure to produce failure notification in stable branch merge requests
+    - <<: *if-merge-request-targeting-stable-branch
+      changes: *setup-test-env-patterns
+    # add option to trigger test-on-omnibus manually on qa changes ahead of tier-2
+    - <<: *if-merge-request
+      changes: *qa-patterns
+      when: manual
+      allow_failure: true
+    - !reference [".prevent-tier-2-and-below", rules]
+    # validate omnibus is built correctly when rails dependencies change
+    - <<: *if-merge-request
+      changes: *dependency-patterns
+      variables:
+        OMNIBUS_GITLAB_BUILD_ON_ALL_OS: 'true'
+    - <<: *if-merge-request
+      changes: *code-qa-patterns
+      when: manual
+      allow_failure: true
     - !reference [".qa:rules:e2e-schedule-blocking", rules]
 
 # Note: If any changes are made to this rule, the following should also be updated - .qa:rules:test-on-omnibus-ce:follow-up
@@ -1833,11 +1833,10 @@
       changes: *gdk-component-patterns
     - <<: *if-dot-com-gitlab-org-schedule
       variables:
-        CREATE_TEST_FAILURE_ISSUES: "true"
-        PROCESS_TEST_RESULTS: "true"
+        <<: *qa-e2e-test-schedule-variables
         KNAPSACK_GENERATE_REPORT: "true"
-        QA_SAVE_TEST_METRICS: "true"
         COVERBAND_ENABLED: "true"
+        QA_RUN_IN_PARALLEL: "false"
 
 .qa:rules:e2e:test-on-cng:
   rules:
@@ -1852,20 +1851,7 @@
     - !reference [".qa:rules:e2e-blocking-base-before", rules]
     - !reference [".prevent-tier-2-and-below", rules]
     - !reference [".qa:rules:e2e-blocking-base-after", rules]
-    - <<: *if-default-branch-schedule-nightly
-      variables:
-        CREATE_TEST_FAILURE_ISSUES: "true"
-        PROCESS_TEST_RESULTS: "true"
-        KNAPSACK_GENERATE_REPORT: "true"
-        QA_SAVE_TEST_METRICS: "true"
-        QA_RUN_IN_PARALLEL: "false" # disable single job parallelization due to incompatibility with knapsack
-    - <<: *if-dot-com-gitlab-org-schedule
-      variables:
-        CREATE_TEST_FAILURE_ISSUES: "true"
-        PROCESS_TEST_RESULTS: "true"
-        KNAPSACK_GENERATE_REPORT: "false"
-        QA_SAVE_TEST_METRICS: "true"
-        QA_RUN_IN_PARALLEL: "true"
+    - !reference [".qa:rules:e2e-schedule-blocking", rules]
 
 .qa:rules:test-on-omnibus-nightly:
   rules:
@@ -1875,72 +1861,9 @@
     - <<: *if-default-branch-schedule-nightly
       allow_failure: true
       variables:
+        <<: *qa-e2e-test-schedule-variables
         KNAPSACK_GENERATE_REPORT: "true"
-        PROCESS_TEST_RESULTS: "true"
-        CREATE_TEST_FAILURE_ISSUES: "true"
-        QA_SAVE_TEST_METRICS: "true"
-
-# These provide a manual way to trigger follow-up:e2e:test-on-omnibus-ee
-# It is fine if they're overlapping with the automatic ones.
-# It'll not hurt and it can simplify the rules, decoupling them.
-# If any changes are made to this rule, the following should also be updated:
-# 1) .qa:rules:follow-up-e2e
-# 2) .qa:rules:post-run-e2e-message
-.qa:rules:manual-e2e:
-  rules:
-    - !reference [".qa:rules:e2e-test-never-run", rules]
-    - !reference [".qa:rules:code-merge-request-manual", rules]
-
-# These are based on `.qa:rules:manual-e2e` but with manual jobs changed to automatic.
-# If any changes are made to this rule, the following should also be updated:
-# 1) .qa:rules:manual-e2e
-.qa:rules:follow-up-e2e:
-  rules:
-    - !reference [".qa:rules:e2e-test-never-run", rules]
-    - !reference [".qa:rules:code-merge-request-allowed-to-fail", rules]
-
-# These are based on `qa:rules:test-on-omnibus-ee` but with when:never in all except for code-patterns in merge requests
-.qa:rules:post-run-e2e-message:
-  rules:
-    # From .qa:rules:test-on-omnibus-common
-    - !reference [".qa:rules:e2e-test-never-run", rules]
-    - <<: *if-merge-request-not-labels-pipeline-run-e2e-omnibus-once
-      when: never
-    - <<: *if-ruby-branch
-      when: never
-    - <<: *if-merge-request-labels-run-all-e2e
-      when: never
-    - <<: *if-merge-request
-      changes: *qa-patterns
-      when: never
-    - <<: *if-merge-request-targeting-stable-branch
-      changes: *setup-test-env-patterns
-      when: never
-    - !reference [".prevent-tier-2-and-below", rules]
-    - <<: *if-merge-request
-      changes: *dependency-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *feature-flag-development-config-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *initializers-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *nodejs-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *ci-qa-patterns
-      when: never
-    - <<: *if-security-merge-request
-      changes: *code-patterns
-      when: never
-    - <<: *if-merge-request-and-specific-devops-stage
-      when: never
-    - <<: *if-dot-com-gitlab-org-schedule
-      when: never
-    # From .qa:rules:manual-e2e
-    - !reference [".qa:rules:code-merge-request-allowed-to-fail", rules]
+        QA_RUN_IN_PARALLEL: "false"
 
 .qa:rules:fulfillment-e2e-quarantine-report:
   rules:
@@ -3087,8 +3010,6 @@
       changes:
         - ".gitlab/ci/test-metadata.gitlab-ci.yml"
         - "scripts/rspec_helpers.sh"
-      when: manual
-      allow_failure: true
     - <<: *if-merge-request-not-approved
       when: never
     - <<: *if-merge-request
@@ -3430,25 +3351,14 @@
     - <<: *if-merge-request-labels-run-observability-e2e-tests-current-branch
       when: never
     - <<: *if-merge-request-labels-run-observability-e2e-tests-main-branch
-      allow_failure: true
     - <<: *if-merge-request
       changes: *observability-code-patterns
-      allow_failure: true
-    - <<: *if-merge-request
-      changes: *code-patterns
-      when: manual
-      allow_failure: true
 
 .observability-backend-current-branch:rules:
   rules:
     - <<: *if-merge-request-labels-run-observability-e2e-tests-main-branch
       when: never
     - <<: *if-merge-request-labels-run-observability-e2e-tests-current-branch
-      allow_failure: true
-    - <<: *if-merge-request
-      changes: *code-patterns
-      when: manual
-      allow_failure: true
 
 ##########################
 # Pre-merge checks rules #

.gitlab/ci/setup.gitlab-ci.yml

@@ -211,16 +211,6 @@ e2e-test-pipeline-generate:
       - '*-pipeline.yml'
       - "${CI_PROJECT_DIR}/qa_tests_vars.env"
 
-# This is the manual start of the chain of E2E jobs
-# After playing this, it'll follow up with:
-# follow-up:compile-production-assets -> follow-up:build-assets-image --\
-#                                                                       \-> follow-up:e2e:test-on-omnibus-ee
-# follow-up:build-qa-image ---------------------------------------------/
-manual:e2e-test-pipeline-generate:
-  extends:
-    - e2e-test-pipeline-generate
-    - .qa:rules:manual-e2e
-
 # This is the start of the chain of E2E jobs for CE
 # After playing this, it'll follow up with:
 # compile-production-assets as-if-foss -> build-assets-image as-if-foss --\

.gitlab/ci/test-metadata.gitlab-ci.yml

 .tests-metadata-state:
-  image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}
-  before_script:
-    - source scripts/utils.sh
   artifacts:
     expire_in: 31d
     paths:
@@ -13,21 +10,26 @@
 retrieve-tests-metadata:
   extends:
     - .tests-metadata-state
+    - .fast-no-clone-job
     - .test-metadata:rules:retrieve-tests-metadata
   # We use a smaller image for this job only (update-tests-metadata compiles some gems)
-  image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}-slim
+  image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}-alpine3.20
   stage: prepare
   needs: []
+  variables:
+    FILES_TO_DOWNLOAD: >
+      scripts/setup/tests-metadata.rb
+  before_script:
+    - apk add --no-cache --update curl  # Not present in ruby-alpine, so we add it manually
+    - !reference [".fast-no-clone-job", before_script]
   script:
-    - apt-get update && apt-get install -y curl  # Not present in ruby-slim, so we add it manually
-    - install_gitlab_gem
-    - source ./scripts/rspec_helpers.sh
-    - retrieve_tests_metadata
+    - ruby scripts/setup/tests-metadata.rb retrieve
 
 update-tests-metadata:
   extends:
     - .tests-metadata-state
     - .test-metadata:rules:update-tests-metadata
+  image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}
   stage: post-test
   needs:
     - job: retrieve-tests-metadata
@@ -42,9 +44,27 @@ update-tests-metadata:
       optional: true
     - job: rspec:artifact-collector ee remainder
       optional: true
+  variables:
+    FLAKY_RSPEC_GENERATE_REPORT: "true"
   script:
-    - run_timed_command "retry gem install fog-aws mime-types activesupport rspec_profiling postgres-copy --no-document"
-    - source ./scripts/rspec_helpers.sh
+    - source scripts/utils.sh
+    - source scripts/rspec_helpers.sh
     - test -f "${FLAKY_RSPEC_SUITE_REPORT_PATH}" || echo -e "\e[31m" 'Consider add ~"pipeline:run-all-rspec" to run full rspec jobs' "\e[0m"
+    - run_timed_command "retry gem install fog-aws mime-types activesupport rspec_profiling postgres-copy --no-document"
     - update_tests_metadata
     - update_tests_mapping
+
+verify-tests-metadata:
+  extends:
+    - .default-retry
+    - .ruby-cache
+    - .test-metadata:rules:update-tests-metadata
+  image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}
+  stage: post-test
+  needs:
+    - update-tests-metadata
+  before_script:
+    - source scripts/utils.sh
+    - bundle_install_script
+  script:
+    - bundle exec scripts/setup/tests-metadata.rb verify

.gitlab/ci/test-on-cng/main.gitlab-ci.yml

@@ -98,6 +98,7 @@ workflow:
         --admin-password "${GITLAB_ADMIN_PASSWORD}" \
         --admin-token "${GITLAB_QA_ADMIN_ACCESS_TOKEN}" \
         --chart-sha "${GITLAB_HELM_CHART_REF}" \
+        --retry 1 \
         --ci \
         ${EXTRA_DEPLOY_VALUES}
   after_script:
@@ -223,6 +224,14 @@ export-test-metrics:
   variables:
     QA_METRICS_REPORT_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/test-metrics-*.json
 
+export-code-paths-mapping:
+  extends:
+    - .export-code-paths-mapping
+  variables:
+    QA_CODE_PATHS_MAPPING_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/test-code-paths-mapping-*.json
+  rules:
+    - if: '$COVERBAND_ENABLED == "true"'
+
 notify-slack:
   extends:
     - .notify-slack

.gitlab/ci/version.yml

@@ -5,7 +5,7 @@ variables:
   EXIFTOOL_VERSION: "12.60"
   GCLOUD_VERSION: "413"
   GIT_VERSION: "2.45"
-  GO_VERSION: "1.22"
+  GO_VERSION: "1.23"
   GRAPHICSMAGICK_VERSION: "1.3.36"
   HELM_VERSION: "3.16"
   KIND_VERSION: "0.24"
@@ -15,7 +15,7 @@ variables:
   OS_VERSION: "bookworm"
   RUBY_VERSION_DEFAULT: "3.2.5"
   RUBY_VERSION_NEXT: "3.2.5"
-  RUBYGEMS_VERSION: "3.4"
+  RUBYGEMS_VERSION: "3.5"
   RUST_VERSION: "1.73"
   UBI_VERSION: "8.6"
   YARN_VERSION: "1.22"

.gitlab/merge_request_templates/Default.md

@@ -10,6 +10,12 @@ especially important if they didn't participate in the discussion.
 
 %{first_multiline_commit}
 
+## References
+**Please include [cross links](https://handbook.gitlab.com/handbook/communication/#start-with-a-merge-request:~:text=Cross%20link%20issues,alternate%20if%20duplicate.) to any resources that are relevant to this MR**
+This will give reviewers and future readers helpful context to give an efficient review of the changes introduced.
+
+- 
+
 ## MR acceptance checklist
 
 **Please evaluate this MR against the [MR acceptance checklist](https://docs.gitlab.com/ee/development/code_review.html#acceptance-checklist).**

.rubocop.yml

@@ -1128,6 +1128,7 @@ Search/NamespacedClass:
   Enabled: true
   Exclude:
     - 'config/**/*.rb'
+    - 'ee/config/**/*.rb'
     - 'db/**/*.rb'
     - 'ee/db/**/*.rb'
     - 'ee/bin/**/*'
@@ -1199,10 +1200,8 @@ Style/SymbolProc:
     - each_batch
     - each_sub_batch
 
-# Short-hand Hash syntax does not work prior 3.1.
-# See https://gitlab.com/gitlab-org/gitlab/-/issues/435940#note_1703307479
 Style/HashSyntax:
-  EnforcedShorthandSyntax: never
+  EnforcedShorthandSyntax: either_consistent
 
 Gitlab/LicenseAvailableUsage:
   Enabled: true

.rubocop_todo/database/avoid_using_pluck_without_limit.yml

@@ -139,7 +139,6 @@ Database/AvoidUsingPluckWithoutLimit:
     - 'ee/app/services/approval_rules/params_filtering_service.rb'
     - 'ee/app/services/click_house/data_ingestion/ci_finished_builds_sync_service.rb'
     - 'ee/app/services/ee/groups/destroy_service.rb'
-    - 'ee/app/services/ee/search/global_service.rb'
     - 'ee/app/services/epics/update_dates_service.rb'
     - 'ee/app/services/gitlab_subscriptions/preview_billable_user_change_service.rb'
     - 'ee/app/services/security/merge_request_security_report_generation_service.rb'

.rubocop_todo/gemspec/add_runtime_dependency.yml

 ---
+# Cop supports --autocorrect.
 Gemspec/AddRuntimeDependency:
   Details: grace period

.rubocop_todo/gitlab/avoid_gitlab_instance_checks.yml

@@ -27,7 +27,6 @@ Gitlab/AvoidGitlabInstanceChecks:
     - 'config/initializers/active_record_transaction_observer.rb'
     - 'config/initializers/active_record_transaction_patches.rb'
     - 'config/initializers/check_forced_decomposition.rb'
-    - 'config/initializers/gitlab_suggested_reviewers_secret.rb'
     - 'config/initializers/rack_multipart_patch.rb'
     - 'config/initializers/validate_puma.rb'
     - 'config/initializers/warden.rb'
@@ -77,6 +76,7 @@ Gitlab/AvoidGitlabInstanceChecks:
     - 'ee/app/workers/gitlab_subscriptions/refresh_seats_worker.rb'
     - 'ee/app/workers/gitlab_subscriptions/schedule_refresh_seats_worker.rb'
     - 'ee/app/workers/update_all_mirrors_worker.rb'
+    - 'ee/config/initializers/gitlab_suggested_reviewers_secret.rb'
     - 'ee/lib/api/code_suggestions.rb'
     - 'ee/lib/api/scim/instance_scim.rb'
     - 'ee/lib/ee/api/namespaces.rb'

.rubocop_todo/gitlab/bounded_contexts.yml

@@ -684,7 +684,6 @@ Gitlab/BoundedContexts:
     - 'app/models/activity_pub.rb'
     - 'app/models/activity_pub/releases_subscription.rb'
     - 'app/models/admin/abuse_report_assignee.rb'
-    - 'app/models/admin/abuse_report_label.rb'
     - 'app/models/alert_management.rb'
     - 'app/models/alert_management/alert.rb'
     - 'app/models/alert_management/alert_assignee.rb'
@@ -1284,7 +1283,6 @@ Gitlab/BoundedContexts:
     - 'app/policies/abuse_report_policy.rb'
     - 'app/policies/achievements/achievement_policy.rb'
     - 'app/policies/achievements/user_achievement_policy.rb'
-    - 'app/policies/admin/abuse_report_label_policy.rb'
     - 'app/policies/alert_management/alert_policy.rb'
     - 'app/policies/alert_management/http_integration_policy.rb'
     - 'app/policies/application_setting/term_policy.rb'
@@ -1370,7 +1368,6 @@ Gitlab/BoundedContexts:
     - 'app/policies/todo_policy.rb'
     - 'app/policies/upload_policy.rb'
     - 'app/policies/user_policy.rb'
-    - 'app/policies/wiki_page/meta_policy.rb'
     - 'app/policies/wiki_page_policy.rb'
     - 'app/policies/wiki_policy.rb'
     - 'app/policies/work_item_policy.rb'
@@ -2963,7 +2960,7 @@ Gitlab/BoundedContexts:
     - 'ee/app/models/package_metadata/advisory.rb'
     - 'ee/app/models/package_metadata/affected_package.rb'
     - 'ee/app/models/package_metadata/checkpoint.rb'
-    - 'ee/app/models/package_metadata/epss.rb'
+    - 'ee/app/models/package_metadata/cve_enrichment.rb'
     - 'ee/app/models/package_metadata/license.rb'
     - 'ee/app/models/package_metadata/package.rb'
     - 'ee/app/models/package_metadata/package_version.rb'