.eslintignore

@@ -7,3 +7,5 @@
 /tmp/
 /vendor/
 /sitespeed-result/
+/fixtures/**/*.graphql
+spec/fixtures/**/*.graphql

.eslintrc.yml

@@ -113,3 +113,24 @@ overrides:
       - '*.stories.js'
     rules:
       filenames/match-regex: off
+  - files:
+      - '*.graphql'
+    plugins:
+      - '@graphql-eslint'
+    parserOptions:
+      parser: '@graphql-eslint/eslint-plugin'
+      operations:
+         - '{,ee/,jh/}app/**/*.graphql'
+      # You can run `bundle exec rake gitlab:graphql:schema:dump` and then uncomment this line
+      # schema: './tmp/tests/graphql/gitlab_schema.graphql'
+    rules:
+      filenames/match-regex: off
+      spaced-comment: off
+      # TODO: We need a way to include this rule + support ee_else_ce fragments
+      #'@graphql-eslint/unique-fragment-name': error
+      # TODO: Uncomment these rules when then `schema` is available
+      #'@graphql-eslint/fragments-on-composite-type': error
+      #'@graphql-eslint/known-argument-names': error
+      #'@graphql-eslint/known-type-names': error
+      '@graphql-eslint/no-anonymous-operations': error
+      '@graphql-eslint/unique-operation-name': error

.gitlab/ci/docs.gitlab-ci.yml

@@ -71,6 +71,7 @@ ui-docs-links lint:
   extends:
     - .docs:rules:docs-lint
     - .static-analysis-base
+    - .ruby-cache
   stage: lint
   needs: []
   script:

.gitlab/ci/frontend.gitlab-ci.yml

@@ -133,6 +133,7 @@ update-storybook-yarn-cache:
     paths:
       - tmp/tests/frontend/
       - knapsack/
+      - crystalball/
 
 # Builds FOSS, and EE fixtures in the EE project.
 # Builds FOSS fixtures in the FOSS project.

.gitlab/ci/qa.gitlab-ci.yml

@@ -55,8 +55,17 @@ update-qa-cache:
   before_script:
     - source scripts/utils.sh
     - install_gitlab_gem
+    - tooling/bin/find_change_diffs ${CHANGES_DIFFS_DIR}
   script:
-    - ./scripts/trigger-build omnibus
+    - |
+      tooling/bin/qa/package_and_qa_check ${CHANGES_DIFFS_DIR} && exit_code=$?
+      if [ $exit_code -eq 0 ]; then
+        ./scripts/trigger-build omnibus
+      elif [ $exit_code -eq 1 ]; then
+        exit 1
+      else
+        echo "Downstream jobs will not be triggered because package_and_qa_check exited with code: $exit_code"
+      fi
   # These jobs often time out, so temporarily use private runners and a long timeout: https://gitlab.com/gitlab-org/gitlab/-/issues/238563
   tags:
     - prm
@@ -66,14 +75,19 @@ update-qa-cache:
       artifacts: false
     - job: build-assets-image
       artifacts: false
-
-.package-and-qa-ff-base:
-  needs:
     - detect-tests
+  artifacts:
+    expire_in: 7d
+    paths:
+      - ${CHANGES_FILE}
+      - ${CHANGES_DIFFS_DIR}/*
   variables:
-    CHANGED_FILES: tmp/changed_files.txt
+    CHANGES_FILE: tmp/changed_files.txt
+    CHANGES_DIFFS_DIR: tmp/diffs
+
+.package-and-qa-ff-base:
   script:
-    - export GITLAB_QA_OPTIONS="--set-feature-flags $(scripts/changed-feature-flags --files $(cat $CHANGED_FILES | tr ' ' ',') --state $QA_FF_STATE)"
+    - export GITLAB_QA_OPTIONS="--set-feature-flags $(scripts/changed-feature-flags --files $(cat $CHANGES_FILE | tr ' ' ',') --state $QA_FF_STATE)"
     - echo $GITLAB_QA_OPTIONS
     - ./scripts/trigger-build omnibus
 

.gitlab/ci/rails.gitlab-ci.yml

@@ -6,11 +6,6 @@
     - .default-before_script
     - .rails-cache
 
-.minimal-bundle-install:
-  script:
-    - export BUNDLE_WITHOUT="${BUNDLE_WITHOUT}:default:test:puma:kerberos:metrics:omnibus:ed25519"
-    - bundle_install_script
-
 .base-script:
   script:
     # Only install knapsack after bundle install! Otherwise oddly some native
@@ -27,6 +22,7 @@
   variables:
     DECOMPOSED_DB: "true"
     GITLAB_LOAD_BALANCING_REUSE_PRIMARY_ci: "main"
+    GITLAB_USE_MODEL_LOAD_BALANCING: "true"
 
 .rspec-base:
   extends: .rails-job-base
@@ -241,11 +237,11 @@ update-gitaly-binaries-cache:
 .coverage-base:
   extends:
     - .default-retry
-    - .default-before_script
     - .coverage-cache
-  variables:
-    SETUP_DB: "false"
-    USE_BUNDLE_INSTALL: "false"
+  before_script:
+    - source scripts/utils.sh
+    - export BUNDLE_WITHOUT="${BUNDLE_WITHOUT}:default:test:puma:kerberos:metrics:omnibus:ed25519"
+    - bundle_install_script
 
 rspec migration pg12:
   extends:
@@ -342,27 +338,16 @@ rspec fast_spec_helper minimal:
     - .minimal-rspec-tests
     - .rails:rules:ee-and-foss-fast_spec_helper:minimal
 
-db:migrate:reset:
+db:rollback:
   extends: .db-job-base
   script:
-    - bundle exec rake db:migrate:reset
-
-db:check-schema:
-  extends:
-    - .db-job-base
-    - .rails:rules:ee-mr-and-default-branch-only
-  script:
-    - source scripts/schema_changed.sh
-    - scripts/validate_migration_timestamps
+    - bundle exec rake db:migrate VERSION=20181228175414
+    - bundle exec rake db:migrate SKIP_SCHEMA_VERSION_CHECK=true
 
-db:check-migrations:
-  extends:
-    - .db-job-base
-    - .rails:rules:ee-and-foss-mr-with-migration
+db:migrate:reset:
+  extends: .db-job-base
   script:
-    - git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_NAME:$CI_MERGE_REQUEST_TARGET_BRANCH_NAME --depth 20
-    - scripts/validate_migration_schema
-  allow_failure: true
+    - bundle exec rake db:migrate:reset
 
 db:migrate-from-previous-major-version:
   extends: .db-job-base
@@ -371,7 +356,8 @@ db:migrate-from-previous-major-version:
     SETUP_DB: "false"
     PROJECT_TO_CHECKOUT: "gitlab-foss"
     TAG_TO_CHECKOUT: "v13.12.9"
-  script:
+  before_script:
+    - !reference [.default-before_script, before_script]
     - '[[ -d "ee/" ]] || export PROJECT_TO_CHECKOUT="gitlab"'
     - '[[ -d "ee/" ]] || export TAG_TO_CHECKOUT="${TAG_TO_CHECKOUT}-ee"'
     - retry 'git fetch https://gitlab.com/gitlab-org/$PROJECT_TO_CHECKOUT.git $TAG_TO_CHECKOUT'
@@ -380,13 +366,28 @@ db:migrate-from-previous-major-version:
     - run_timed_command "bundle exec rake db:drop db:create db:structure:load db:migrate db:seed_fu"
     - git checkout -f $CI_COMMIT_SHA
     - SETUP_DB=false USE_BUNDLE_INSTALL=true bash scripts/prepare_build.sh
+  script:
     - run_timed_command "bundle exec rake db:migrate"
 
-db:rollback:
-  extends: .db-job-base
+db:check-schema:
+  extends:
+    - db:migrate-from-previous-major-version
+    - .rails:rules:ee-mr-and-default-branch-only
+  variables:
+    TAG_TO_CHECKOUT: "v14.4.0"
   script:
-    - bundle exec rake db:migrate VERSION=20181228175414
-    - bundle exec rake db:migrate SKIP_SCHEMA_VERSION_CHECK=true
+    - run_timed_command "bundle exec rake db:migrate"
+    - scripts/schema_changed.sh
+    - scripts/validate_migration_timestamps
+
+db:check-migrations:
+  extends:
+    - .db-job-base
+    - .rails:rules:ee-and-foss-mr-with-migration
+  script:
+    - git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_NAME:$CI_MERGE_REQUEST_TARGET_BRANCH_NAME --depth 20
+    - scripts/validate_migration_schema
+  allow_failure: true
 
 db:gitlabcom-database-testing:
   extends: .rails:rules:db:gitlabcom-database-testing
@@ -476,21 +477,38 @@ rspec:coverage:
   # so we use `dependencies` here.
   dependencies:
     - setup-test-env
+    # FOSS/EE jobs
     - rspec migration pg12
     - rspec unit pg12
     - rspec integration pg12
     - rspec system pg12
+    # FOSS/EE minimal jobs
+    - rspec migration pg12 minimal
+    - rspec unit pg12 minimal
+    - rspec integration pg12 minimal
+    - rspec system pg12 minimal
+    # EE jobs
     - rspec-ee migration pg12
     - rspec-ee unit pg12
     - rspec-ee integration pg12
     - rspec-ee system pg12
+    # EE minimal jobs
+    - rspec-ee migration pg12 minimal
+    - rspec-ee unit pg12 minimal
+    - rspec-ee integration pg12 minimal
+    - rspec-ee system pg12 minimal
+    # Geo jobs
     - rspec-ee unit pg12 geo
     - rspec-ee integration pg12 geo
     - rspec-ee system pg12 geo
+    # Geo minimal jobs
+    - rspec-ee unit pg12 geo minimal
+    - rspec-ee integration pg12 geo minimal
+    - rspec-ee system pg12 geo minimal
+    # Memory jobs
     - memory-static
     - memory-on-boot
   script:
-    - !reference [.minimal-bundle-install, script]
     - run_timed_command "bundle exec scripts/merge-simplecov"
     - run_timed_command "bundle exec scripts/gather-test-memory-data"
   coverage: '/LOC \((\d+\.\d+%)\) covered.$/'
@@ -515,13 +533,60 @@ rspec:feature-flags:
     - job: "haml-lint ee"
       optional: true
   script:
-    - !reference [.minimal-bundle-install, script]
     - if [ "$CI_COMMIT_BRANCH" == "$CI_DEFAULT_BRANCH" ]; then
         run_timed_command "bundle exec scripts/used-feature-flags" || (scripts/slack master-broken "☠️ \`${CI_JOB_NAME}\` failed! ☠️ See ${CI_JOB_URL}" ci_failing "GitLab Bot" && exit 1);
       else
         run_timed_command "bundle exec scripts/used-feature-flags";
       fi
 
+rspec:skipped-flaky-tests-report:
+  extends:
+    - .default-retry
+    - .rails:rules:skipped-flaky-tests-report
+  image: ruby:2.7-alpine
+  stage: post-test
+  # We cannot use needs since it would mean needing 84 jobs (since most are parallelized)
+  # so we use `dependencies` here.
+  dependencies:
+    # FOSS/EE jobs
+    - rspec migration pg12
+    - rspec unit pg12
+    - rspec integration pg12
+    - rspec system pg12
+    # FOSS/EE minimal jobs
+    - rspec migration pg12 minimal
+    - rspec unit pg12 minimal
+    - rspec integration pg12 minimal
+    - rspec system pg12 minimal
+    # EE jobs
+    - rspec-ee migration pg12
+    - rspec-ee unit pg12
+    - rspec-ee integration pg12
+    - rspec-ee system pg12
+    # EE minimal jobs
+    - rspec-ee migration pg12 minimal
+    - rspec-ee unit pg12 minimal
+    - rspec-ee integration pg12 minimal
+    - rspec-ee system pg12 minimal
+    # Geo jobs
+    - rspec-ee unit pg12 geo
+    - rspec-ee integration pg12 geo
+    - rspec-ee system pg12 geo
+    # Geo minimal jobs
+    - rspec-ee unit pg12 geo minimal
+    - rspec-ee integration pg12 geo minimal
+    - rspec-ee system pg12 geo minimal
+  variables:
+    SKIPPED_FLAKY_TESTS_REPORT: skipped_flaky_tests_report.txt
+  before_script:
+    - mkdir -p rspec_flaky
+  script:
+    - find rspec_flaky/ -type f -name 'skipped_flaky_tests_*_report.txt' -exec cat {} + >> "${SKIPPED_FLAKY_TESTS_REPORT}"
+  artifacts:
+    expire_in: 31d
+    paths:
+      - ${SKIPPED_FLAKY_TESTS_REPORT}
+
 # EE/FOSS: default refs (MRs, default branch, schedules) jobs #
 #######################################################
 

.gitlab/ci/reports.gitlab-ci.yml

@@ -96,6 +96,13 @@ retire-js-dependency_scanning:
 gemnasium-python-dependency_scanning:
   rules: !reference [".reports:rules:gemnasium-python-dependency_scanning", rules]
 
+yarn-audit-dependency_scanning:
+  extends: .ds-analyzer
+  image: "registry.gitlab.com/gitlab-org/security-products/analyzers/npm-audit:1.4.0"
+  variables:
+    TOOL: yarn
+  rules: !reference [".reports:rules:yarn-audit-dependency_scanning", rules]
+
 # Analyze dependencies for malicious behavior
 # See https://gitlab.com/gitlab-com/gl-security/security-research/package-hunter
 .package_hunter-base:

.gitlab/ci/review-apps/main.gitlab-ci.yml

@@ -35,10 +35,11 @@ review-build-cng:
   extends:
     - .default-retry
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-helm3.5-kubectl1.17
+  resource_group: "review/${CI_COMMIT_REF_NAME}"
   variables:
     HOST_SUFFIX: "${CI_ENVIRONMENT_SLUG}"
     DOMAIN: "-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}"
-    GITLAB_HELM_CHART_REF: "v5.2.1"
+    GITLAB_HELM_CHART_REF: "v5.4.1"
   environment:
     name: review/${CI_COMMIT_REF_SLUG}${FREQUENCY}
     url: https://gitlab-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}
@@ -51,7 +52,6 @@ review-deploy:
     - .review:rules:review-deploy
   stage: deploy
   needs: ["review-build-cng"]
-  resource_group: "review/${CI_COMMIT_REF_NAME}"
   before_script:
     - export GITLAB_SHELL_VERSION=$(<GITLAB_SHELL_VERSION)
     - export GITALY_VERSION=$(<GITALY_SERVER_VERSION)

.gitlab/ci/review-apps/qa.gitlab-ci.yml

@@ -34,7 +34,7 @@
 
 .allure-report-base:
   image:
-    name: ${GITLAB_DEPENDENCY_PROXY}andrcuns/allure-report-publisher:0.3.6
+    name: ${GITLAB_DEPENDENCY_PROXY}andrcuns/allure-report-publisher:0.4.1
     entrypoint: [""]
   stage: post-qa
   variables:

.gitlab/ci/rules.gitlab-ci.yml

@@ -58,6 +58,9 @@
 .if-merge-request-labels-run-decomposed: &if-merge-request-labels-run-decomposed
   if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-decomposed/'
 
+.if-merge-request-labels-run-review-app: &if-merge-request-labels-run-review-app
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-review-app/'
+
 .if-security-merge-request: &if-security-merge-request
   if: '$CI_PROJECT_NAMESPACE == "gitlab-org/security" && $CI_MERGE_REQUEST_IID'
 
@@ -112,6 +115,9 @@
 .if-security-pipeline-merge-result: &if-security-pipeline-merge-result
   if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH && $CI_PROJECT_NAMESPACE == "gitlab-org/security" && $GITLAB_USER_LOGIN == "gitlab-release-tools-bot"'
 
+.if-skip-flaky-tests-automatically: &if-skip-flaky-tests-automatically
+  if: '$SKIP_FLAKY_TESTS_AUTOMATICALLY == "true"'
+
 ####################
 # Changes patterns #
 ####################
@@ -164,6 +170,7 @@
 
 .nodejs-patterns: &nodejs-patterns
   - '{package.json,*/package.json,*/*/package.json}'
+  - '{yarn.lock,*/yarn.lock,*/*/yarn.lock}'
 
 .python-patterns: &python-patterns
   - '{requirements.txt,*/requirements.txt,*/*/requirements.txt}'
@@ -447,6 +454,7 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-run-review-app
     - <<: *if-dot-com-gitlab-org-and-security-merge-request
       changes: *ci-build-images-patterns
     - <<: *if-dot-com-gitlab-org-and-security-merge-request
@@ -459,6 +467,7 @@
   rules:
     - <<: *if-not-canonical-namespace
       when: never
+    - <<: *if-merge-request-labels-run-review-app
     - <<: *if-auto-deploy-branches
     - changes: *ci-build-images-patterns
     - changes: *code-qa-patterns
@@ -540,6 +549,7 @@
   rules:
     - <<: *if-not-canonical-namespace
       when: never
+    - <<: *if-merge-request-labels-run-review-app
     - <<: *if-auto-deploy-branches
     - changes: *code-qa-patterns
 
@@ -1258,12 +1268,12 @@
 
 .rails:rules:detect-tests:
   rules:
-    - changes: *code-backstage-patterns
+    - changes: *code-backstage-qa-patterns
     - <<: *if-merge-request-labels-run-all-rspec
 
 .rails:rules:detect-previous-failed-tests:
   rules:
-    - <<: *if-not-canonical-namespace
+    - <<: *if-security-merge-request
       when: never
     - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-merge-request
@@ -1271,7 +1281,7 @@
 
 .rails:rules:rerun-previous-failed-tests:
   rules:
-    - <<: *if-not-canonical-namespace
+    - <<: *if-security-merge-request
       when: never
     - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-merge-request
@@ -1346,6 +1356,14 @@
       when: never
     - changes: *code-backstage-patterns
 
+.rails:rules:skipped-flaky-tests-report:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-skip-flaky-tests-automatically
+      changes: *code-backstage-patterns
+    - changes: *ci-patterns
+
 #########################
 # Static analysis rules #
 #########################
@@ -1470,6 +1488,12 @@
       when: never
     - changes: *python-patterns
 
+.reports:rules:yarn-audit-dependency_scanning:
+  rules:
+    - if: '$DEPENDENCY_SCANNING_DISABLED || $GITLAB_FEATURES !~ /\bdependency_scanning\b/'
+      when: never
+    - changes: *nodejs-patterns
+
 .reports:rules:schedule-dast:
   rules:
     - if: '$DAST_DISABLED || $GITLAB_FEATURES !~ /\bdast\b/'
@@ -1505,6 +1529,7 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-run-review-app
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *ci-review-patterns
     - <<: *if-dot-com-gitlab-org-merge-request
@@ -1521,6 +1546,7 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-run-review-app
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *ci-review-patterns
     - <<: *if-dot-com-gitlab-org-merge-request
@@ -1536,6 +1562,7 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-run-review-app
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *ci-review-patterns
     - <<: *if-dot-com-gitlab-org-merge-request
@@ -1554,6 +1581,7 @@
       when: never
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-run-review-app
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *ci-review-patterns
     - <<: *if-dot-com-gitlab-org-merge-request
@@ -1569,6 +1597,7 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-run-review-app
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *code-qa-patterns
 
@@ -1576,6 +1605,7 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-run-review-app
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *ci-review-patterns
     - <<: *if-dot-com-gitlab-org-merge-request
@@ -1590,11 +1620,17 @@
 
 # The rule needs to be duplicated between `on_success` and `on_failure`
 # because the jobs `needs` the previous job to complete.
+# With `when: always`, and the `review-qa-*` jobs are manual, the `allure-report-qa-*` jobs
+# would start running before the qa jobs have started.
 # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63844#note_599012559
 .review:rules:review-qa-smoke-report:
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-run-review-app
+      when: on_success
+    - <<: *if-merge-request-labels-run-review-app
+      when: on_failure
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *ci-review-patterns
       when: on_success
@@ -1622,6 +1658,7 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-run-review-app
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *code-patterns
       when: manual
@@ -1634,11 +1671,17 @@
 
 # The rule needs to be duplicated between `on_success` and `on_failure`
 # because the jobs `needs` the previous job to complete.
+# With `when: always`, and the `review-qa-*` jobs are manual, the `allure-report-qa-*` jobs
+# would start running before the qa jobs have started.
 # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63844#note_599012559
 .review:rules:review-qa-all-report:
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-run-review-app
+      when: on_success
+    - <<: *if-merge-request-labels-run-review-app
+      when: on_failure
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *code-patterns
       when: manual
@@ -1673,6 +1716,9 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-run-review-app
+      when: manual
+      allow_failure: true
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *code-qa-patterns
       when: manual

.gitlab/ci/setup.gitlab-ci.yml

@@ -129,6 +129,7 @@ add-jh-folder:
     - curl --location -o "jh-folder.tar.gz" "https://gitlab.com/gitlab-jh/gitlab/-/archive/main-jh/gitlab-main-jh.tar.gz?path=jh"
     - tar -xf "jh-folder.tar.gz"
     - mv gitlab-main-jh-jh/jh/ ./
+    - cp Gemfile.lock jh/
     - ls -l jh/
   artifacts:
     expire_in: 2d

.gitlab/issue_templates/Experiment Rollout.md

@@ -105,5 +105,16 @@ In this rollout issue, ensure the scoped `experiment::` label is kept accurate.
 /chatops run feature set <experiment-key> false
 ```
 
+## Experiment Successful Cleanup Concerns
+
+_Items to be considered if candidate experience is to become a permanent part of GitLab_
+
+<!-- 
+Add a list of items raised during MR review or otherwise that may need further thought/consideration
+before becoming permanent parts of the product.
+
+Example: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/70451#note_727246104
+-->
+
 /label ~"feature flag" ~"devops::growth" ~"growth experiment" ~"experiment-rollout" ~Engineering ~"workflow::scheduling" ~"experiment::pending"
 /milestone %"Next 1-3 releases" 

.gitlab/issue_templates/Feature Flag Roll Out.md

@@ -77,7 +77,10 @@ Are there any other stages or teams involved that need to be kept in the loop?
 
 ### Global rollout on production
 
-All `/chatops` commands that target production should be done in the `#production` slack channel for visibility.
+For visibility, all `/chatops` commands that target production should be:
+
+- Executed in the `#production` slack channel.
+- Cross-posted (with the command results) to the responsible team's slack channel (`#g_TEAM_NAME`).
 
 - [ ] [Incrementally roll out](https://docs.gitlab.com/ee/development/feature_flags/controls.html#process) the feature.
   - If the feature flag in code has [an actor](https://docs.gitlab.com/ee/development/feature_flags/#feature-actors), perform **actor-based** rollout.

.gitlab/issue_templates/Feature Proposal - basic.md

 <!-- This template is a great use for issues that are feature::additions or technical tasks for larger issues.-->
 
-### Proposal 
+### Proposal
 
 <!-- Use this section to explain the feature and how it will work. It can be helpful to add technical details, design proposals, and links to related epics or issues. -->
 
 <!-- Consider adding related issues and epics to this issue. You can also reference the Feature Proposal Template (https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/issue_templates/Feature%20proposal%20-%20detailed.md) for additional details to consider adding to this issue. Additionally, as a data oriented organization, when your feature exits planning breakdown, consider adding the `What does success look like, and how can we measure that?` section.
 -->
 
+<!-- Label reminders
+Use the following resources to find the appropriate labels:
+- https://gitlab.com/gitlab-org/gitlab/-/labels
+- https://about.gitlab.com/handbook/product/categories/features/
+-->
+
 /label ~"type::feature" ~feature::addition ~"group::" ~"section::" ~"Category:" ~"GitLab Core"/~"GitLab Premium"/~"GitLab Ultimate"

.gitlab/issue_templates/Feature Proposal - lean.md

-<!-- This issue template can be used a great starting point for feature requests. The last section "Release notes" can be used as a summary of the feature and is also required if you want to have your release post blog MR auto generated using the release post item generator:  https://about.gitlab.com/handbook/marketing/blog/release-posts/#release-post-item-generator. The remaining sections are the backbone for every feature in GitLab. -->
+<!-- This issue template can be used as a great starting point for feature requests. The section "Release notes" can be used as a summary of the feature and is also required if you want to have your release post blog MR auto generated using the release post item generator:  https://about.gitlab.com/handbook/marketing/blog/release-posts/#release-post-item-generator. The remaining sections are the backbone for every feature in GitLab.
 
-### Release notes 
+The goal of this template is brevity for quick/smaller iterations. For a more thorough list of considerations for larger features or feature sets, you can leverage the detailed [feature proposal](https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/issue_templates/Feature%20proposal%20-%20detailed.md). -->
+
+### Release notes
 
 <!-- What is the problem and solution you're proposing? This content sets the overall vision for the feature and serves as the release notes that will populate in various places, including the [release post blog](https://about.gitlab.com/releases/categories/releases/) and [Gitlab project releases](https://gitlab.com/gitlab-org/gitlab/-/releases). " -->
 
-### Problem to solve 
+### Problem to solve
 
 <!-- What is the user problem you are trying to solve with this issue? -->
 
-### Proposal 
+### Proposal
 
 <!-- Use this section to explain the feature and how it will work. It can be helpful to add technical details, design proposals, and links to related epics or issues. -->
 
-### Intended Users
+### Intended users
 
 <!-- Who will use this feature? If known, include any of the following: types of users (e.g. Developer), personas, or specific company roles (e.g. Release Manager). It's okay to write "Unknown" and fill this field in later.
 
@@ -32,11 +34,11 @@ Personas are described at https://about.gitlab.com/handbook/marketing/product-ma
 * [Allison (Application Ops)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#allison-application-ops)
 * [Priyanka (Platform Engineer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#priyanka-platform-engineer)
 * [Dana (Data Analyst)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#dana-data-analyst)
-* [Eddie (Content Editor)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#eddie-content-editor) 
+* [Eddie (Content Editor)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#eddie-content-editor)
 
 -->
 
-### Metrics 
+### Metrics
 
 <!-- How are you going to track uage of this feature? Think about user behavior and their interaction with the product. What indicates someone is getting value from it?
 
@@ -44,94 +46,10 @@ Create tracking issue using the Snowplow event tracking template. See https://gi
 
 -->
 
-
-/label ~"type::feature" ~"group::" ~"section::"  ~"Category::" ~"GitLab Free"/~"GitLab Premium"/~"GitLab Ultimate"
-
-
-<!--- Use the following resources to find the appropriate labels:
+<!-- Label reminders
+Use the following resources to find the appropriate labels:
 - https://gitlab.com/gitlab-org/gitlab/-/labels
 - https://about.gitlab.com/handbook/product/categories/features/
+-->
 
-Consider adding related issues and epics to this issue. You can also reference the Feature Proposal Template (https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/issue_templates/Feature%20proposal%20-%20detailed.md) for additional details to consider adding to this issue. Additionally, as a data oriented organization, when your feature exits planning breakdown, consider adding the `What does success look like, and how can we measure that?` section.
-
-Other sections to consider adding: 
-
-### Intended users
-
-Who will use this feature? If known, include any of the following: types of users (e.g. Developer), personas, or specific company roles (e.g. Release Manager). It's okay to write "Unknown" and fill this field in later.
-
-Personas are described at https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/
-
-* [Cameron (Compliance Manager)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#cameron-compliance-manager)
-* [Parker (Product Manager)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#parker-product-manager)
-* [Delaney (Development Team Lead)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#delaney-development-team-lead)
-* [Presley (Product Designer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#presley-product-designer)
-* [Sasha (Software Developer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sasha-software-developer)
-* [Devon (DevOps Engineer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#devon-devops-engineer)
-* [Sidney (Systems Administrator)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sidney-systems-administrator)
-* [Sam (Security Analyst)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sam-security-analyst)
-* [Rachel (Release Manager)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#rachel-release-manager) 
-* [Alex (Security Operations Engineer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#alex-security-operations-engineer)
-* [Simone (Software Engineer in Test)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#simone-software-engineer-in-test)
-* [Allison (Application Ops)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#allison-application-ops) 
-* [Priyanka (Platform Engineer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#priyanka-platform-engineer)
-* [Dana (Data Analyst)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#dana-data-analyst)
-
-
-### User experience goal
-
-What is the single user experience workflow this problem addresses? 
-For example, "The user should be able to use the UI/API/.gitlab-ci.yml with GitLab to <perform a specific task>"
-https://about.gitlab.com/handbook/engineering/ux/ux-research-training/user-story-mapping/ 
-
-
-### Further details
-
-Include use cases, benefits, goals, or any other details that will help us understand the problem better. 
-
-### Permissions and Security
-
-<!-- What permissions are required to perform the described actions? Are they consistent with the existing permissions as documented for users, groups, and projects as appropriate? Is the proposed behavior consistent between the UI, API, and other access methods (e.g. email replies)?
-Consider adding checkboxes and expectations of users with certain levels of membership https://docs.gitlab.com/ee/user/permissions.html
-* [ ] Add expected impact to members with no access (0)
-* [ ] Add expected impact to Guest (10) members
-* [ ] Add expected impact to Reporter (20) members
-* [ ] Add expected impact to Developer (30) members 
-* [ ] Add expected impact to Maintainer (40) members
-* [ ] Add expected impact to Owner (50) members 
-
-### Documentation
-
- See the Feature Change Documentation Workflow https://docs.gitlab.com/ee/development/documentation/workflow.html#for-a-product-change
-
-* Add all known Documentation Requirements in this section. See https://docs.gitlab.com/ee/development/documentation/workflow.html
-* If this feature requires changing permissions, update the permissions document. See https://docs.gitlab.com/ee/user/permissions.html 
-
-### Availability & Testing
-
-This section needs to be retained and filled in during the workflow planning breakdown phase of this feature proposal, if not earlier.
-
-What risks does this change pose to our availability? How might it affect the quality of the product? What additional test coverage or changes to tests will be needed? Will it require cross-browser testing?
-
-Please list the test areas (unit, integration and end-to-end) that needs to be added or updated to ensure that this feature will work as intended. Please use the list below as guidance.
-* Unit test changes
-* Integration test changes
-* End-to-end test change
-
-See the test engineering planning process and reach out to your counterpart Software Engineer in Test for assistance: https://about.gitlab.com/handbook/engineering/quality/test-engineering/#test-planning 
-
-### What does success look like, and how can we measure that?
-
-Define both the success metrics and acceptance criteria. Note that success metrics indicate the desired business outcomes, while acceptance criteria indicate when the solution is working correctly. If there is no way to measure success, link to an issue that will implement a way to measure this. 
-
-### What is the type of buyer?
-
-What is the buyer persona for this feature? See https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/buyer-persona/
-In which enterprise tier should this feature go? See https://about.gitlab.com/handbook/product/pricing/#three-tiers
-
-### Is this a cross-stage feature?
-
-Communicate if this change will affect multiple Stage Groups or product areas. We recommend always start with the assumption that a feature request will have an impact into another Group. Loop in the most relevant PM and Product Designer from that Group to provide strategic support to help align the Group's broader plan and vision, as well as to avoid UX and technical debt. https://about.gitlab.com/handbook/product/#cross-stage-features -->
-
-/label ~documentation
-/label ~direction
+/label ~"type::feature" ~"group::" ~"section::"  ~"Category::" ~"GitLab Free"/~"GitLab Premium"/~"GitLab Ultimate" ~documentation ~direction

.gitlab/issue_templates/Feature proposal - detailed.md

@@ -31,6 +31,14 @@ Personas are described at https://about.gitlab.com/handbook/marketing/product-ma
 * [Eddie (Content Editor)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#eddie-content-editor)
 -->
 
+### Metrics 
+
+<!-- How are you going to track uage of this feature? Think about user behavior and their interaction with the product. What indicates someone is getting value from it?
+
+Create tracking issue using the Snowplow event tracking template. See https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/issue_templates/Snowplow%20event%20tracking.md
+
+-->
+
 ### User experience goal
 
 <!-- What is the single user experience workflow this problem addresses?

.gitlab/issue_templates/Geo Replicate a new Git repository type.md

@@ -111,115 +111,9 @@ Geo secondary sites have a [Geo tracking database](https://gitlab.com/gitlab-org
 
 - [ ] Be sure to commit the relevant changes in `ee/db/geo/structure.sql`
 
-### Add verification state fields on the Geo primary site
+### Add verification state to the Model
 
-The Geo primary site needs to checksum every replicable in order for secondaries to verify their own checksums. To do this, Geo requires fields on the Model. There are two ways to add the necessary verification state fields. If the table is large and wide, then it may be a good idea to add verification state fields to a separate table (Option 2). Consult a database expert if needed.
-
-#### Add verification state fields to the model table (Option 1)
-
-- [ ] Create the migration file in `db/migrate`:
-
-  ```shell
-  bin/rails generate migration AddVerificationStateToCoolWidgets
-  ```
-
-- [ ] Replace the contents of the migration file with:
-
-  ```ruby
-  # frozen_string_literal: true
-
-  class AddVerificationStateToCoolWidgets < ActiveRecord::Migration[6.0]
-    def change
-      change_table(:cool_widgets) do |t|
-        t.integer :verification_state, default: 0, limit: 2, null: false
-        t.column :verification_started_at, :datetime_with_timezone
-        t.integer :verification_retry_count, limit: 2, null: false
-        t.column :verification_retry_at, :datetime_with_timezone
-        t.column :verified_at, :datetime_with_timezone
-        t.binary :verification_checksum, using: 'verification_checksum::bytea'
-
-        t.text :verification_failure # rubocop:disable Migration/AddLimitToTextColumns
-      end
-    end
-  end
-  ```
-
-- [ ] If deviating from the above example, then be sure to order columns according to [our guidelines](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/development/ordering_table_columns.md).
-- [ ] If `cool_widgets` is a high-traffic table, follow [the database documentation to use `with_lock_retries`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/development/migration_style_guide.md#when-to-use-the-helper-method)
-- [ ] Adding a `text` column also [requires](../database/strings_and_the_text_data_type.md#add-a-text-column-to-an-existing-table) setting a limit. Create the migration file in `db/migrate`:
-
-  ```shell
-  bin/rails generate migration AddVerificationFailureLimitToCoolWidgets
-  ```
-
-- [ ] Replace the contents of the migration file with:
-
-  ```ruby
-  # frozen_string_literal: true
-
-  class AddVerificationFailureLimitToCoolWidgets < ActiveRecord::Migration[6.0]
-    include Gitlab::Database::MigrationHelpers
-
-    disable_ddl_transaction!
-
-    CONSTRAINT_NAME = 'cool_widget_verification_failure_text_limit'
-
-    def up
-      add_text_limit :cool_widget, :verification_failure, 255, constraint_name: CONSTRAINT_NAME
-    end
-
-    def down
-      remove_check_constraint(:cool_widget, CONSTRAINT_NAME)
-    end
-  end
-  ```
-
-- [ ] Add indexes on verification fields to ensure verification can be performed efficiently. Some or all of these indexes can be omitted if the table is guaranteed to be small. Ask a database expert if you are considering omitting indexes. Create the migration file in `db/migrate`:
-
-  ```shell
-  bin/rails generate migration AddVerificationIndexesToCoolWidgets
-  ```
-
-- [ ] Replace the contents of the migration file with:
-
-  ```ruby
-  # frozen_string_literal: true
-
-  class AddVerificationIndexesToCoolWidgets < ActiveRecord::Migration[6.0]
-    include Gitlab::Database::MigrationHelpers
-
-    VERIFICATION_STATE_INDEX_NAME = "index_cool_widgets_on_verification_state"
-    PENDING_VERIFICATION_INDEX_NAME = "index_cool_widgets_pending_verification"
-    FAILED_VERIFICATION_INDEX_NAME = "index_cool_widgets_failed_verification"
-    NEEDS_VERIFICATION_INDEX_NAME = "index_cool_widgets_needs_verification"
-
-    disable_ddl_transaction!
-
-    def up
-      add_concurrent_index :cool_widgets, :verification_state, name: VERIFICATION_STATE_INDEX_NAME
-      add_concurrent_index :cool_widgets, :verified_at, where: "(verification_state = 0)", order: { verified_at: 'ASC NULLS FIRST' }, name: PENDING_VERIFICATION_INDEX_NAME
-      add_concurrent_index :cool_widgets, :verification_retry_at, where: "(verification_state = 3)", order: { verification_retry_at: 'ASC NULLS FIRST' }, name: FAILED_VERIFICATION_INDEX_NAME
-      add_concurrent_index :cool_widgets, :verification_state, where: "(verification_state = 0 OR verification_state = 3)", name: NEEDS_VERIFICATION_INDEX_NAME
-    end
-
-    def down
-      remove_concurrent_index_by_name :cool_widgets, VERIFICATION_STATE_INDEX_NAME
-      remove_concurrent_index_by_name :cool_widgets, PENDING_VERIFICATION_INDEX_NAME
-      remove_concurrent_index_by_name :cool_widgets, FAILED_VERIFICATION_INDEX_NAME
-      remove_concurrent_index_by_name :cool_widgets, NEEDS_VERIFICATION_INDEX_NAME
-    end
-  end
-  ```
-
-- [ ] Run database migrations:
-
-  ```shell
-  bin/rake db:migrate
-  ```
-
-- [ ] Be sure to commit the relevant changes in `db/structure.sql`
-
-#### Add verification state fields to a separate table (Option 2)
+The Geo primary site needs to checksum every replicable so secondaries can verify their own checksums. To do this, Geo requires the Model to have an associated table to track verification state.
 
 - [ ] Create the migration file in `db/migrate`:
 
@@ -273,6 +167,7 @@ The Geo primary site needs to checksum every replicable in order for secondaries
   ```
 
 - [ ] If deviating from the above example, then be sure to order columns according to [our guidelines](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/development/ordering_table_columns.md).
+
 - [ ] Run database migrations:
 
   ```shell
@@ -287,7 +182,14 @@ That's all of the required database changes.
 
 #### Step 1. Implement replication and verification
 
-- [ ] Include `Gitlab::Geo::ReplicableModel` in the `CoolWidget` class, and specify the Replicator class `with_replicator Geo::CoolWidgetReplicator`.
+- [ ] Add the following lines to the `cool_widget` model to accomplish some important tasks:
+  - Include `Gitlab::Geo::ReplicableModel` in the `CoolWidget` class, and specify the Replicator class `with_replicator Geo::CoolWidgetReplicator`.
+  - Include the `::Gitlab::Geo::VerificationState` concern.
+  - Delegate verification related methods to the `cool_widget_state` model.
+  - For verification, override some scopes to use the `cool_widget_states` table instead of the model table.
+  - Implement the `verification_state_object` method to return the object that holds
+    the verification details
+  - Override some methods to use the `cool_widget_states` table in verification-related queries.
 
   Pay some attention to method `pool_repository`. Not every repository type uses repository pooling. As Geo prefers to use repository snapshotting, it can lead to data loss. Make sure to overwrite `pool_repository` so it returns nil for repositories that do not have pools.
 
@@ -297,6 +199,7 @@ That's all of the required database changes.
   # frozen_string_literal: true
 
   class CoolWidget < ApplicationRecord
+    ...
     include ::Gitlab::Geo::ReplicableModel
     include ::Gitlab::Geo::VerificationState
 
@@ -304,31 +207,62 @@ That's all of the required database changes.
 
     mount_uploader :file, CoolWidgetUploader
 
+    has_one :cool_widget_state, autosave: false, inverse_of: :cool_widget, class_name: 'Geo::CoolWidgetState'
+
+    delegate :verification_retry_at, :verification_retry_at=,
+             :verified_at, :verified_at=,
+             :verification_checksum, :verification_checksum=,
+             :verification_failure, :verification_failure=,
+             :verification_retry_count, :verification_retry_count=,
+             :verification_state=, :verification_state,
+             :verification_started_at=, :verification_started_at,
+             to: :cool_widget_state
+    ...
+
+    scope :with_verification_state, ->(state) { joins(:cool_widget_state).where(cool_widget_states: { verification_state: verification_state_value(state) }) }
+    scope :checksummed, -> { joins(:cool_widget_state).where.not(cool_widget_states: { verification_checksum: nil } ) }
+    scope :not_checksummed, -> { joins(:cool_widget_state).where(cool_widget_states: { verification_checksum: nil } ) }
+
     # Override the `all` default if not all records can be replicated. For an
     # example of an existing Model that needs to do this, see
     # `EE::MergeRequestDiff`.
     # scope :available_replicables, -> { all }
 
-    # @param primary_key_in [Range, CoolWidget] arg to pass to primary_key_in scope
-    # @return [ActiveRecord::Relation<CoolWidget>] everything that should be synced to this node, restricted by primary key
-    def self.replicables_for_current_secondary(primary_key_in)
-      # This issue template does not help you write this method.
-      #
-      # This method is called only on Geo secondary sites. It is called when
-      # we want to know which records to replicate. This is not easy to automate
-      # because for example:
-      #
-      # * The "selective sync" feature allows admins to choose which namespaces #   to replicate, per secondary site. Most Models are scoped to a
-      #   namespace, but the nature of the relationship to a namespace varies
-      #   between Models.
-      # * The "selective sync" feature allows admins to choose which shards to
-      #   replicate, per secondary site. Repositories are associated with
-      #   shards. Most blob types are not, but Project Uploads are.
-      # * Remote stored replicables are not replicated, by default. But the
-      #   setting `sync_object_storage` enables replication of remote stored
-      #   replicables.
-      #
-      # Search the codebase for examples, and consult a Geo expert if needed.
+    def verification_state_object
+      cool_widget_state
+    end
+    ...
+
+    class_methods do
+      extend ::Gitlab::Utils::Override
+      ...
+
+      # @param primary_key_in [Range, CoolWidget] arg to pass to primary_key_in scope
+      # @return [ActiveRecord::Relation<CoolWidget>] everything that should be synced to this node, restricted by primary key
+      def replicables_for_current_secondary(primary_key_in)
+        # This issue template does not help you write this method.
+        #
+        # This method is called only on Geo secondary sites. It is called when
+        # we want to know which records to replicate. This is not easy to automate
+        # because for example:
+        #
+        # * The "selective sync" feature allows admins to choose which namespaces #   to replicate, per secondary site. Most Models are scoped to a
+        #   namespace, but the nature of the relationship to a namespace varies
+        #   between Models.
+        # * The "selective sync" feature allows admins to choose which shards to
+        #   replicate, per secondary site. Repositories are associated with
+        #   shards. Most blob types are not, but Project Uploads are.
+        # * Remote stored replicables are not replicated, by default. But the
+        #   setting `sync_object_storage` enables replication of remote stored
+        #   replicables.
+        #
+        # Search the codebase for examples, and consult a Geo expert if needed.
+      end
+
+      override :verification_state_table_class
+      def verification_state_table_class
+        CoolWidgetState
+      end
     end
 
     # Geo checks this method in FrameworkRepositorySyncService to avoid
@@ -336,6 +270,11 @@ That's all of the required database changes.
     def pool_repository
       nil
     end
+    ...
+
+    def cool_widget_state
+      super || build_cool_widget_state
+    end
 
     ...
   end
@@ -343,6 +282,15 @@ That's all of the required database changes.
 
 - [ ] Implement `CoolWidget.replicables_for_current_secondary` above.
 - [ ] Ensure `CoolWidget.replicables_for_current_secondary` is well-tested. Search the codebase for `replicables_for_current_secondary` to find examples of parameterized table specs. You may need to add more `FactoryBot` traits.
+- [ ] Add the following shared examples to `ee/spec/models/ee/cool_widget_spec.rb`:
+
+  ```ruby
+    include_examples 'a replicable model with a separate table for verification state' do
+      let(:verifiable_model_record) { build(:cool_widget) } # add extra params if needed to make sure the record is included in `available_verifiables`
+      let(:unverifiable_model_record) { build(:cool_widget) } # add extra params if needed to make sure the record is NOT included in `available_verifiables`
+    end
+  ```
+
 - [ ] Create `ee/app/replicators/geo/cool_widget_replicator.rb`. Implement the `#repository` method which should return a `<Repository>` instance, and implement the class method `.model` to return the `CoolWidget` class:
 
   ```ruby
@@ -365,6 +313,10 @@ That's all of the required database changes.
         ::Gitlab::GitAccessCoolWidget
       end
 
+      def self.no_repo_message
+        git_access_class.error_message(:no_repo)
+      end
+
       # The feature flag follows the format `geo_#{replicable_name}_replication`,
       # so here it would be `geo_cool_widget_replication`
       def self.replication_enabled_by_default?
@@ -403,6 +355,9 @@ That's all of the required database changes.
   ```
 
 - [ ] Make sure a Geo secondary site can request and download Cool Widgets on the Geo primary site. You may need to make some changes to `Gitlab::GitAccessCoolWidget`. For example, see [this change for Group-level Wikis](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/54914/diffs?commit_id=0f2b36f66697b4addbc69bd377ee2818f648dd33).
+
+- [ ] Make sure a Geo secondary site can replicate Cool Widgets where repository does not exist on the Geo primary site. The only way to know about this is to parse the error text. You may need to make some changes to `Gitlab::CoolWidgetReplicator.no_repo_message` to return the proper error message. For example, see [this change for Group-level Wikis](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74133).
+
 - [ ] Generate the feature flag definition file by running the feature flag command and following the command prompts:
 
   ```shell
@@ -529,13 +484,7 @@ That's all of the required database changes.
 
 - [ ] Make sure the factory also allows setting a `project` attribute. If the model does not have a direct relation to a project, you can use a `transient` attribute. Check out `spec/factories/merge_request_diffs.rb` for an example.
 
-##### If you added verification state fields to a separate table (option 2 above), then you need to make additional model and factory changes
-
-If you did not add verification state fields to a separate table, `cool_widget_states`, then skip to [Step 2. Implement metrics gathering](#step-2-implement-metrics-gathering).
-
-Otherwise, you can follow [the example of Merge Request Diffs](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63309).
-
-- [ ] Add a `Geo::CoolWidgetState` model in `ee/app/models/geo/cool_widget_state.rb`:
+- [ ] Following [the example of Merge Request Diffs](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63309) add a `Geo::CoolWidgetState` model in `ee/app/models/ee/geo/cool_widget_state.rb`:
 
   ``` ruby
   # frozen_string_literal: true
@@ -569,63 +518,6 @@ Otherwise, you can follow [the example of Merge Request Diffs](https://gitlab.co
   end
   ```
 
-- [ ] Add the following lines to the `cool_widget` model to accomplish some important tasks:
-  - Include the `::Gitlab::Geo::VerificationState` concern.
-  - Delegate verification related methods to the `cool_widget_state` model.
-  - Override some scopes to use the `cool_widget_states` table instead of the model table, for verification.
-  - Override some methods to use the `cool_widget_states` table in verification related queries.
-
-  ```ruby
-  class CoolWidget < ApplicationRecord
-    ...
-    include ::Gitlab::Geo::VerificationState
-
-    has_one :cool_widget_state, autosave: true, inverse_of: :cool_widget, class_name: 'Geo::CoolWidgetState'
-
-    delegate :verification_retry_at, :verification_retry_at=,
-             :verified_at, :verified_at=,
-             :verification_checksum, :verification_checksum=,
-             :verification_failure, :verification_failure=,
-             :verification_retry_count, :verification_retry_count=,
-             :verification_state=, :verification_state,
-             :verification_started_at=, :verification_started_at,
-             to: :cool_widget_state
-    ...
-
-    scope :with_verification_state, ->(state) { joins(:cool_widget_state).where(cool_widget_states: { verification_state: verification_state_value(state) }) }
-    scope :checksummed, -> { joins(:cool_widget_state).where.not(cool_widget_states: { verification_checksum: nil } ) }
-    scope :not_checksummed, -> { joins(:cool_widget_state).where(cool_widget_states: { verification_checksum: nil } ) }
-
-    ...
-
-    class_methods do
-      extend ::Gitlab::Utils::Override
-      ...
-      override :verification_state_table_name
-      def verification_state_table_name
-        'cool_widget_states'
-      end
-
-      override :verification_state_model_key
-      def verification_state_model_key
-        'cool_widget_id'
-      end
-
-      override :verification_arel_table
-      def verification_arel_table
-        CoolWidgetState.arel_table
-      end
-    end
-    ...
-
-    def cool_widget_state
-      super || build_cool_widget_state
-    end
-
-    ...
-  end
-  ```
-
 #### Step 2. Implement metrics gathering
 
 Metrics are gathered by `Geo::MetricsUpdateWorker`, persisted in `GeoNodeStatus` for display in the UI, and sent to Prometheus:

.gitlab/issue_templates/Geo Replicate a new blob type.md

@@ -37,6 +37,7 @@ It is also a good idea to first open a proof-of-concept merge request. It can be
 You can look into the following examples of MRs for implementing replication/verification for a new blob type:
 - [Add db changes](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/60935) and [add verification for MR diffs using SSF](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63309)
 - [Verify Terraform state versions](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/58800)
+- [Verify LFS objects](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63981)
 
 ### Modify database schemas to prepare to add Geo support for Cool Widgets
 
@@ -114,113 +115,9 @@ Geo secondary sites have a [Geo tracking database](https://gitlab.com/gitlab-org
 
 ### Add verification state fields on the Geo primary site
 
-The Geo primary site needs to checksum every replicable in order for secondaries to verify their own checksums. To do this, Geo requires fields on the Model. There are two ways to add the necessary verification state fields. If the table is large and wide, then it may be a good idea to add verification state fields to a separate table (Option 2). Consult a database expert if needed.
+The Geo primary site needs to checksum every replicable so secondaries can verify their own checksums. To do this, Geo requires fields on the Model. Add verification state fields to a separate table. Consult a database expert if needed.
 
-#### Add verification state fields to the model table (Option 1)
-
-- [ ] Create the migration file in `db/migrate`:
-
-  ```shell
-  bin/rails generate migration AddVerificationStateToCoolWidgets
-  ```
-
-- [ ] Replace the contents of the migration file with:
-
-  ```ruby
-  # frozen_string_literal: true
-
-  class AddVerificationStateToCoolWidgets < ActiveRecord::Migration[6.0]
-    def change
-      change_table(:cool_widgets) do |t|
-        t.integer :verification_state, default: 0, limit: 2, null: false
-        t.column :verification_started_at, :datetime_with_timezone
-        t.integer :verification_retry_count, limit: 2, null: false
-        t.column :verification_retry_at, :datetime_with_timezone
-        t.column :verified_at, :datetime_with_timezone
-        t.binary :verification_checksum, using: 'verification_checksum::bytea'
-
-        t.text :verification_failure # rubocop:disable Migration/AddLimitToTextColumns
-      end
-    end
-  end
-  ```
-
-- [ ] If deviating from the above example, then be sure to order columns according to [our guidelines](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/development/ordering_table_columns.md).
-- [ ] If `cool_widgets` is a high-traffic table, follow [the database documentation to use `with_lock_retries`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/development/migration_style_guide.md#when-to-use-the-helper-method)
-- [ ] Adding a `text` column also [requires](../database/strings_and_the_text_data_type.md#add-a-text-column-to-an-existing-table) setting a limit. Create the migration file in `db/migrate`:
-
-  ```shell
-  bin/rails generate migration AddVerificationFailureLimitToCoolWidgets
-  ```
-
-- [ ] Replace the contents of the migration file with:
-
-  ```ruby
-  # frozen_string_literal: true
-
-  class AddVerificationFailureLimitToCoolWidgets < ActiveRecord::Migration[6.0]
-    include Gitlab::Database::MigrationHelpers
-
-    disable_ddl_transaction!
-
-    CONSTRAINT_NAME = 'cool_widget_verification_failure_text_limit'
-
-    def up
-      add_text_limit :cool_widget, :verification_failure, 255, constraint_name: CONSTRAINT_NAME
-    end
-
-    def down
-      remove_check_constraint(:cool_widget, CONSTRAINT_NAME)
-    end
-  end
-  ```
-
-- [ ] Add indexes on verification fields to ensure verification can be performed efficiently. Some or all of these indexes can be omitted if the table is guaranteed to be small. Ask a database expert if you are considering omitting indexes. Create the migration file in `db/migrate`:
-
-  ```shell
-  bin/rails generate migration AddVerificationIndexesToCoolWidgets
-  ```
-
-- [ ] Replace the contents of the migration file with:
-
-  ```ruby
-  # frozen_string_literal: true
-
-  class AddVerificationIndexesToCoolWidgets < ActiveRecord::Migration[6.0]
-    include Gitlab::Database::MigrationHelpers
-
-    VERIFICATION_STATE_INDEX_NAME = "index_cool_widgets_on_verification_state"
-    PENDING_VERIFICATION_INDEX_NAME = "index_cool_widgets_pending_verification"
-    FAILED_VERIFICATION_INDEX_NAME = "index_cool_widgets_failed_verification"
-    NEEDS_VERIFICATION_INDEX_NAME = "index_cool_widgets_needs_verification"
-
-    disable_ddl_transaction!
-
-    def up
-      add_concurrent_index :cool_widgets, :verification_state, name: VERIFICATION_STATE_INDEX_NAME
-      add_concurrent_index :cool_widgets, :verified_at, where: "(verification_state = 0)", order: { verified_at: 'ASC NULLS FIRST' }, name: PENDING_VERIFICATION_INDEX_NAME
-      add_concurrent_index :cool_widgets, :verification_retry_at, where: "(verification_state = 3)", order: { verification_retry_at: 'ASC NULLS FIRST' }, name: FAILED_VERIFICATION_INDEX_NAME
-      add_concurrent_index :cool_widgets, :verification_state, where: "(verification_state = 0 OR verification_state = 3)", name: NEEDS_VERIFICATION_INDEX_NAME
-    end
-
-    def down
-      remove_concurrent_index_by_name :cool_widgets, VERIFICATION_STATE_INDEX_NAME
-      remove_concurrent_index_by_name :cool_widgets, PENDING_VERIFICATION_INDEX_NAME
-      remove_concurrent_index_by_name :cool_widgets, FAILED_VERIFICATION_INDEX_NAME
-      remove_concurrent_index_by_name :cool_widgets, NEEDS_VERIFICATION_INDEX_NAME
-    end
-  end
-  ```
-
-- [ ] Run database migrations:
-
-  ```shell
-  bin/rake db:migrate
-  ```
-
-- [ ] Be sure to commit the relevant changes in `db/structure.sql`
-
-#### Add verification state fields to a separate table (Option 2)
+#### Add verification state fields to a new table
 
 - [ ] Create the migration file in `db/migrate`:
 
@@ -274,12 +171,15 @@ The Geo primary site needs to checksum every replicable in order for secondaries
   ```
 
 - [ ] If deviating from the above example, then be sure to order columns according to [our guidelines](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/development/ordering_table_columns.md).
+
 - [ ] Run database migrations:
 
   ```shell
   bin/rake db:migrate
   ```
 
+- [ ] If `cool_widgets` is a high-traffic table, follow [the database documentation to use `with_lock_retries`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/development/migration_style_guide.md#when-to-use-the-helper-method)
+
 - [ ] Be sure to commit the relevant changes in `db/structure.sql`
 
 That's all of the required database changes.
@@ -288,14 +188,22 @@ That's all of the required database changes.
 
 #### Step 1. Implement replication and verification
 
-- [ ] Include `Gitlab::Geo::ReplicableModel` in the `CoolWidget` class, and specify the Replicator class `with_replicator Geo::CoolWidgetReplicator`.
+- [ ] Add the following lines to the `cool_widget` model to accomplish some important tasks:
+  - Include `Gitlab::Geo::ReplicableModel` in the `CoolWidget` class, and specify the Replicator class `with_replicator Geo::CoolWidgetReplicator`.
+  - Include the `::Gitlab::Geo::VerificationState` concern.
+  - Delegate verification related methods to the `cool_widget_state` model.
+  - For verification, override some scopes to use the `cool_widget_states` table instead of the model table.
+  - Implement the `verification_state_object` method to return the object that holds
+    the verification details
+  - Override some methods to use the `cool_widget_states` table in verification-related queries.
 
   At this point the `CoolWidget` class should look like this:
 
   ```ruby
   # frozen_string_literal: true
-
+  
   class CoolWidget < ApplicationRecord
+    ...
     include ::Gitlab::Geo::ReplicableModel
     include ::Gitlab::Geo::VerificationState
 
@@ -303,38 +211,84 @@ That's all of the required database changes.
 
     mount_uploader :file, CoolWidgetUploader
 
+    has_one :cool_widget_state, autosave: false, inverse_of: :cool_widget, class_name: 'Geo::CoolWidgetState'
+
+    delegate :verification_retry_at, :verification_retry_at=,
+             :verified_at, :verified_at=,
+             :verification_checksum, :verification_checksum=,
+             :verification_failure, :verification_failure=,
+             :verification_retry_count, :verification_retry_count=,
+             :verification_state=, :verification_state,
+             :verification_started_at=, :verification_started_at,
+             to: :cool_widget_state
+    ...
+
+    scope :with_verification_state, ->(state) { joins(:cool_widget_state).where(cool_widget_states: { verification_state: verification_state_value(state) }) }
+    scope :checksummed, -> { joins(:cool_widget_state).where.not(cool_widget_states: { verification_checksum: nil } ) }
+    scope :not_checksummed, -> { joins(:cool_widget_state).where(cool_widget_states: { verification_checksum: nil } ) }
+
     # Override the `all` default if not all records can be replicated. For an
     # example of an existing Model that needs to do this, see
     # `EE::MergeRequestDiff`.
     # scope :available_replicables, -> { all }
 
-    # @param primary_key_in [Range, CoolWidget] arg to pass to primary_key_in scope
-    # @return [ActiveRecord::Relation<CoolWidget>] everything that should be synced to this node, restricted by primary key
-    def self.replicables_for_current_secondary(primary_key_in)
-      # This issue template does not help you write this method.
-      #
-      # This method is called only on Geo secondary sites. It is called when
-      # we want to know which records to replicate. This is not easy to automate
-      # because for example:
-      #
-      # * The "selective sync" feature allows admins to choose which namespaces #   to replicate, per secondary site. Most Models are scoped to a
-      #   namespace, but the nature of the relationship to a namespace varies
-      #   between Models.
-      # * The "selective sync" feature allows admins to choose which shards to
-      #   replicate, per secondary site. Repositories are associated with
-      #   shards. Most blob types are not, but Project Uploads are.
-      # * Remote stored replicables are not replicated, by default. But the
-      #   setting `sync_object_storage` enables replication of remote stored
-      #   replicables.
-      #
-      # Search the codebase for examples, and consult a Geo expert if needed.
+    def verification_state_object
+      cool_widget_state
     end
     ...
+
+    class_methods do
+      extend ::Gitlab::Utils::Override
+      ...
+
+      # @param primary_key_in [Range, CoolWidget] arg to pass to primary_key_in scope
+      # @return [ActiveRecord::Relation<CoolWidget>] everything that should be synced to this node, restricted by primary key
+      def self.replicables_for_current_secondary(primary_key_in)
+        # This issue template does not help you write this method.
+        #
+        # This method is called only on Geo secondary sites. It is called when
+        # we want to know which records to replicate. This is not easy to automate
+        # because for example:
+        #
+        # * The "selective sync" feature allows admins to choose which namespaces #   to replicate, per secondary site. Most Models are scoped to a
+        #   namespace, but the nature of the relationship to a namespace varies
+        #   between Models.
+        # * The "selective sync" feature allows admins to choose which shards to
+        #   replicate, per secondary site. Repositories are associated with
+        #   shards. Most blob types are not, but Project Uploads are.
+        # * Remote stored replicables are not replicated, by default. But the
+        #   setting `sync_object_storage` enables replication of remote stored
+        #   replicables.
+        #
+        # Search the codebase for examples, and consult a Geo expert if needed.
+      end
+
+      override :verification_state_table_class
+      def verification_state_table_class
+        CoolWidgetState
+      end
+    end
+    ...
+
+    def cool_widget_state
+      super || build_cool_widget_state
+    end
+
+    ...
   end
   ```
 
 - [ ] Implement `CoolWidget.replicables_for_current_secondary` above.
 - [ ] Ensure `CoolWidget.replicables_for_current_secondary` is well-tested. Search the codebase for `replicables_for_current_secondary` to find examples of parameterized table specs. You may need to add more `FactoryBot` traits.
+- [ ] Add the following shared examples to `ee/spec/models/ee/cool_widget_spec.rb`:
+
+  ```ruby
+    include_examples 'a replicable model with a separate table for verification state' do
+      let(:verifiable_model_record) { build(:cool_widget) } # add extra params if needed to make sure the record is included in `available_verifiables`
+      let(:unverifiable_model_record) { build(:cool_widget) } # add extra params if needed to make sure the record is NOT included in `available_verifiables`
+    end
+  ```
+
 - [ ] Create `ee/app/replicators/geo/cool_widget_replicator.rb`. Implement the `#carrierwave_uploader` method which should return a `CarrierWave::Uploader`, and implement the class method `.model` to return the `CoolWidget` class:
 
   ```ruby
@@ -498,13 +452,7 @@ That's all of the required database changes.
 
 - [ ] Make sure the factory also allows setting a `project` attribute. If the model does not have a direct relation to a project, you can use a `transient` attribute. Check out `spec/factories/merge_request_diffs.rb` for an example.
 
-##### If you added verification state fields to a separate table (option 2 above), then you need to make additional model and factory changes
-
-If you did not add verification state fields to a separate table, `cool_widget_states`, then skip to [Step 2. Implement metrics gathering](#step-2-implement-metrics-gathering).
-
-Otherwise, you can follow [the example of Merge Request Diffs](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63309).
-
-- [ ] Add a `Geo::CoolWidgetState` model in `ee/app/models/ee/geo/cool_widget_state.rb`:
+- [ ] Following [the example of Merge Request Diffs](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63309) add a `Geo::CoolWidgetState` model in `ee/app/models/ee/geo/cool_widget_state.rb`:
 
   ``` ruby
   module Geo
@@ -536,63 +484,6 @@ Otherwise, you can follow [the example of Merge Request Diffs](https://gitlab.co
   end
   ```
 
-- [ ] Add the following lines to the `cool_widget` model to accomplish some important tasks:
-  - Include the `::Gitlab::Geo::VerificationState` concern.
-  - Delegate verification related methods to the `cool_widget_state` model.
-  - Override some scopes to use the `cool_widget_states` table instead of the model table, for verification.
-  - Override some methods to use the `cool_widget_states` table in verification related queries.
-
-  ```ruby
-  class CoolWidget < ApplicationRecord
-    ...
-    include ::Gitlab::Geo::VerificationState
-
-    has_one :cool_widget_state, autosave: true, inverse_of: :cool_widget, class_name: 'Geo::CoolWidgetState'
-
-    delegate :verification_retry_at, :verification_retry_at=,
-             :verified_at, :verified_at=,
-             :verification_checksum, :verification_checksum=,
-             :verification_failure, :verification_failure=,
-             :verification_retry_count, :verification_retry_count=,
-             :verification_state=, :verification_state,
-             :verification_started_at=, :verification_started_at,
-             to: :cool_widget_state
-    ...
-
-    scope :with_verification_state, ->(state) { joins(:cool_widget_state).where(cool_widget_states: { verification_state: verification_state_value(state) }) }
-    scope :checksummed, -> { joins(:cool_widget_state).where.not(cool_widget_states: { verification_checksum: nil } ) }
-    scope :not_checksummed, -> { joins(:cool_widget_state).where(cool_widget_states: { verification_checksum: nil } ) }
-
-    ...
-
-    class_methods do
-      extend ::Gitlab::Utils::Override
-      ...
-      override :verification_state_table_name
-      def verification_state_table_name
-        'cool_widget_states'
-      end
-
-      override :verification_state_model_key
-      def verification_state_model_key
-        'cool_widget_id'
-      end
-
-      override :verification_arel_table
-      def verification_arel_table
-        CoolWidgetState.arel_table
-      end
-    end
-    ...
-
-    def cool_widget_state
-      super || build_cool_widget_state
-    end
-
-    ...
-  end
-  ```
-
 #### Step 2. Implement metrics gathering
 
 Metrics are gathered by `Geo::MetricsUpdateWorker`, persisted in `GeoNodeStatus` for display in the UI, and sent to Prometheus:

.gitlab/issue_templates/Problem Validation.md

+<!-- This template is used as a starting point for understing and articulating a customer problem.
+Learn more about it in the handbook: https://about.gitlab.com/handbook/product-development-flow/#validation-phase-2-problem-validation 
+-->
+
 ## Problem Statement
 
 <!-- What is the problem we hope to validate? Reference how to write a real customer problem statement at https://productcoalition.com/how-to-write-a-good-customer-problem-statement-a815f80189ba for guidance. -->
@@ -45,4 +49,8 @@ For example, if the solution will take a product manager, designer, and engineer
 - [ ] The problem is well described and detailed with necessary requirements for product design to understand the problem
 - [ ] The problem is well described and detailed with necessary requirements for engineering to understand the problem
 
+## Research Issue
+
+<!-- Link to the Problem Validation Research issue that will be executed by the UX Researcher. https://gitlab.com/gitlab-org/ux-research/ -->
+
 /label ~"workflow::validation backlog" ~devops:: ~category: ~group::

.gitlab/issue_templates/Security developer workflow.md

@@ -12,7 +12,7 @@ Set the title to: `Description of the original issue`
 - [ ] Make sure the issue really needs to follow the security release workflow.
   - Verify if the issue you're working on `gitlab-org/gitlab` is confidential, if it's public fix should be placed on GitLab canonical and no backports are required.
   - If the issue you're fixing doesn't appear to be something that can be exploited by a malicious person and is instead simply a security enhancement do not hesitate to ping `@gitlab-com/gl-security/appsec` to discuss if the issue can be fixed in the canonical repository.
-- [ ] **IMPORTANT**: Mark this [issue as linked] to the Security Release Tracking Issue. You can find it on the topic of the `#releases` Slack channel. This issue
+- [ ] **IMPORTANT**: Mark this [issue as linked] to the Security Release Tracking Issue. You can find it [here](https://gitlab.com/gitlab-org/gitlab/-/issues?sort=created_date&state=opened&label_name[]=upcoming+security+release). This issue
 MUST be linked for the release bot to know that the associated merge requests should be merged for this security release.
 - Fill out the [Links section](#links):
   - [ ] Next to **Issue on GitLab**, add a link to the `gitlab-org/gitlab` issue that describes the security vulnerability.