.gitlab-ci.yml

@@ -121,7 +121,7 @@ workflow:
         PIPELINE_NAME: 'Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch pipeline'
 
 variables:
-  PG_VERSION: "13"
+  PG_VERSION: "14"
   DEFAULT_CI_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}.patched-golang-${GO_VERSION}-rust-${RUST_VERSION}-node-18.16-postgresql-${PG_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-2.36-lfs-2.9-chrome-${CHROME_VERSION}-yarn-1.22-graphicsmagick-1.3.36"
   # We set $GITLAB_DEPENDENCY_PROXY to another variable (since it's set at the group level and has higher precedence than .gitlab-ci.yml)
   # so that we can override $GITLAB_DEPENDENCY_PROXY_ADDRESS in workflow rules.

.gitlab/CODEOWNERS

@@ -653,7 +653,7 @@ lib/gitlab/checks/**
 /doc/architecture/blueprints/database/scalability/patterns/ @aqualls
 /doc/architecture/blueprints/database_scaling/ @aqualls
 /doc/ci/ @marcel.amirault
-/doc/ci/chatops/ @eread @ashrafkhamis
+/doc/ci/chatops/ @phillipwells
 /doc/ci/cloud_deployment/ @phillipwells
 /doc/ci/docker/using_docker_images.md @fneill
 /doc/ci/environments/ @phillipwells
@@ -676,7 +676,7 @@ lib/gitlab/checks/**
 /doc/development/bulk_import.md @eread @ashrafkhamis
 /doc/development/cached_queries.md @jglassman1
 /doc/development/cascading_settings.md @jglassman1
-/doc/development/chatops_on_gitlabcom.md @eread @ashrafkhamis
+/doc/development/chatops_on_gitlabcom.md @phillipwells
 /doc/development/cicd/ @marcel.amirault
 /doc/development/code_intelligence/ @aqualls
 /doc/development/code_owners/ @aqualls @msedlakjakubowski

.gitlab/ci/build-images.gitlab-ci.yml

@@ -62,3 +62,46 @@ build-assets-image as-if-foss:
     - .as-if-foss
     - .build-images:rules:build-assets-image-as-if-foss
   needs: ["compile-production-assets as-if-foss"]
+
+trigger-omnibus:
+  stage: build-images
+  extends:
+    - .qa:rules:package-and-test-ee
+  needs:
+    - trigger-omnibus-env
+  inherit:
+    variables: false
+  variables:
+    GITALY_SERVER_VERSION: $GITALY_SERVER_VERSION
+    GITLAB_ELASTICSEARCH_INDEXER_VERSION: $GITLAB_ELASTICSEARCH_INDEXER_VERSION
+    GITLAB_KAS_VERSION: $GITLAB_KAS_VERSION
+    GITLAB_METRICS_EXPORTER_VERSION: $GITLAB_METRICS_EXPORTER_VERSION
+    GITLAB_PAGES_VERSION: $GITLAB_PAGES_VERSION
+    GITLAB_SHELL_VERSION: $GITLAB_SHELL_VERSION
+    GITLAB_WORKHORSE_VERSION: $GITLAB_WORKHORSE_VERSION
+    GITLAB_VERSION: $CI_COMMIT_SHA
+    GITLAB_ASSETS_TAG: $GITLAB_ASSETS_TAG
+    IMAGE_TAG: $CI_COMMIT_SHA
+    TOP_UPSTREAM_SOURCE_PROJECT: $CI_PROJECT_PATH
+    SECURITY_SOURCES: $SECURITY_SOURCES
+    CACHE_UPDATE: $OMNIBUS_GITLAB_CACHE_UPDATE
+    RUBY3_BUILD: $OMNIBUS_GITLAB_RUBY3_BUILD
+    RUBY2_BUILD: $OMNIBUS_GITLAB_RUBY2_BUILD
+    CACHE_EDITION: $OMNIBUS_GITLAB_CACHE_EDITION
+    BUILD_ON_ALL_OS: $OMNIBUS_GITLAB_BUILD_ON_ALL_OS
+    SKIP_QA_TEST: "true"
+    ee: $EE
+  trigger:
+    project: gitlab-org/build/omnibus-gitlab-mirror
+    branch: $TRIGGER_BRANCH
+    strategy: depend
+
+trigger-omnibus as-if-foss:
+  extends:
+    - trigger-omnibus
+    - .qa:rules:package-and-test-ce
+  needs:
+    - trigger-omnibus-env as-if-foss
+  variables:
+    # Override gitlab repository so that omnibus doesn't use foss repository for CE build
+    GITLAB_ALTERNATIVE_REPO: $CI_PROJECT_URL

.gitlab/ci/ci-templates.gitlab-ci.yml

@@ -4,7 +4,7 @@ templates-shellcheck:
     - .default-before_script
     - .default-retry
     - .ruby-cache
-    - .use-pg14
+    - .use-pg15
   stage: test
   needs:
     - setup-test-env

.gitlab/ci/dev-fixtures.gitlab-ci.yml

@@ -3,7 +3,7 @@
     - .default-retry
     - .ruby-cache
     - .default-before_script
-    - .use-pg13
+    - .use-pg14
   stage: test
   needs: ["setup-test-env"]
   variables:
@@ -29,7 +29,7 @@ run-dev-fixtures-ee:
   extends:
     - .run-dev-fixtures
     - .dev-fixtures:rules:ee-only
-    - .use-pg13-es7-ee
+    - .use-pg14-es7-ee
   script:
     - cp ee/db/fixtures/development/* $FIXTURE_PATH
     - *run-dev-fixtures-script

.gitlab/ci/frontend.gitlab-ci.yml

@@ -129,7 +129,7 @@ retrieve-frontend-fixtures:
     - .default-retry
     - .default-before_script
     - .ruby-cache
-    - .use-pg13
+    - .use-pg14
   stage: fixtures
   needs: ["setup-test-env", "retrieve-tests-metadata", "retrieve-frontend-fixtures"]
   variables:

.gitlab/ci/glfm.gitlab-ci.yml

@@ -2,7 +2,7 @@ glfm-verify:
   extends:
     - .rails-job-base
     - .glfm:rules:glfm-verify
-    - .use-pg13
+    - .use-pg14
   stage: test
   needs: ["setup-test-env"]
   script:

.gitlab/ci/global.gitlab-ci.yml

@@ -249,6 +249,18 @@
     POSTGRES_HOST_AUTH_METHOD: trust
     PG_VERSION: "14"
 
+.use-pg15:
+  services:
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:postgres-15-pgvector-0.4.1
+      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+      alias: postgres
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:redis-cluster-6.2.12
+      alias: rediscluster # configure connections in config/redis.yml
+    - name: redis:6.2-alpine
+  variables:
+    POSTGRES_HOST_AUTH_METHOD: trust
+    PG_VERSION: "15"
+
 .use-pg12-es7-ee:
   services:
     - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:postgres-12-pgvector-0.4.1
@@ -303,6 +315,24 @@
     ZOEKT_INDEX_BASE_URL: http://zoekt-ci-image:6060
     ZOEKT_SEARCH_BASE_URL: http://zoekt-ci-image:6070
 
+.use-pg15-es7-ee:
+  services:
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:postgres-15-pgvector-0.4.1
+      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+      alias: postgres
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:redis-cluster-6.2.12
+      alias: rediscluster # configure connections in config/redis.yml
+    - name: redis:6.2-alpine
+    - name: elasticsearch:7.17.6
+      command: ["elasticsearch", "-E", "discovery.type=single-node", "-E", "xpack.security.enabled=false"]
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.0
+      alias: zoekt-ci-image
+  variables:
+    POSTGRES_HOST_AUTH_METHOD: trust
+    PG_VERSION: "15"
+    ZOEKT_INDEX_BASE_URL: http://zoekt-ci-image:6060
+    ZOEKT_SEARCH_BASE_URL: http://zoekt-ci-image:6070
+
 .use-pg13-es8-ee:
   services:
     - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:postgres-13-pgvector-0.4.1
@@ -341,6 +371,25 @@
     ZOEKT_INDEX_BASE_URL: http://zoekt-ci-image:6060
     ZOEKT_SEARCH_BASE_URL: http://zoekt-ci-image:6070
 
+.use-pg15-es8-ee:
+  services:
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:postgres-15-pgvector-0.4.1
+      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+      alias: postgres
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:redis-cluster-6.2.12
+      alias: rediscluster # configure connections in config/redis.yml
+    - name: redis:6.0-alpine
+    - name: elasticsearch:8.6.2
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.0
+      alias: zoekt-ci-image
+  variables:
+    POSTGRES_HOST_AUTH_METHOD: trust
+    PG_VERSION: "15"
+    ES_SETTING_DISCOVERY_TYPE: "single-node"
+    ES_SETTING_XPACK_SECURITY_ENABLED: "false"
+    ZOEKT_INDEX_BASE_URL: http://zoekt-ci-image:6060
+    ZOEKT_SEARCH_BASE_URL: http://zoekt-ci-image:6070
+
 .use-pg13-opensearch1-ee:
   services:
     - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:postgres-13-pgvector-0.4.1
@@ -417,6 +466,44 @@
     ZOEKT_INDEX_BASE_URL: http://zoekt-ci-image:6060
     ZOEKT_SEARCH_BASE_URL: http://zoekt-ci-image:6070
 
+.use-pg15-opensearch1-ee:
+  services:
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:postgres-15-pgvector-0.4.1
+      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+      alias: postgres
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:redis-cluster-6.2.12
+      alias: rediscluster # configure connections in config/redis.yml
+    - name: redis:6.0-alpine
+    - name: opensearchproject/opensearch:1.3.5
+      alias: elasticsearch
+      command: ["bin/opensearch", "-E", "discovery.type=single-node", "-E", "plugins.security.disabled=true"]
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.0
+      alias: zoekt-ci-image
+  variables:
+    POSTGRES_HOST_AUTH_METHOD: trust
+    PG_VERSION: "15"
+    ZOEKT_INDEX_BASE_URL: http://zoekt-ci-image:6060
+    ZOEKT_SEARCH_BASE_URL: http://zoekt-ci-image:6070
+
+.use-pg15-opensearch2-ee:
+  services:
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:postgres-15-pgvector-0.4.1
+      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+      alias: postgres
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:redis-cluster-6.2.12
+      alias: rediscluster # configure connections in config/redis.yml
+    - name: redis:6.0-alpine
+    - name: opensearchproject/opensearch:2.2.1
+      alias: elasticsearch
+      command: ["bin/opensearch", "-E", "discovery.type=single-node", "-E", "plugins.security.disabled=true"]
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.0
+      alias: zoekt-ci-image
+  variables:
+    POSTGRES_HOST_AUTH_METHOD: trust
+    PG_VERSION: "15"
+    ZOEKT_INDEX_BASE_URL: http://zoekt-ci-image:6060
+    ZOEKT_SEARCH_BASE_URL: http://zoekt-ci-image:6070
+
 .use-kaniko:
   image:
     name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:kaniko

.gitlab/ci/memory.gitlab-ci.yml

@@ -20,7 +20,7 @@ memory-on-boot:
   extends:
     - .only-code-memory-job-base
     - .production
-    - .use-pg13
+    - .use-pg14
   stage: test
   needs: ["setup-test-env", "compile-test-assets"]
   variables:

.gitlab/ci/package-and-test-nightly/main.gitlab-ci.yml

@@ -18,16 +18,6 @@ workflow:
 # ==========================================
 # Prepare stage
 # ==========================================
-trigger-omnibus-env:
-  extends:
-    - .trigger-omnibus-env
-
-trigger-omnibus:
-  extends:
-    - .trigger-omnibus
-  needs:
-    - trigger-omnibus-env
-
 download-knapsack-report:
   extends:
     - .download-knapsack-report

.gitlab/ci/package-and-test/main.gitlab-ci.yml

@@ -20,30 +20,6 @@ check-release-set:
         echo "Omnibus installation image is set to '$RELEASE'"
       fi
 
-trigger-omnibus-env:
-  extends:
-    - .trigger-omnibus-env
-    - .rules:omnibus-build
-
-trigger-omnibus-env-ce:
-  extends:
-    - .trigger-omnibus-env-ce
-    - .rules:omnibus-build-ce
-
-trigger-omnibus:
-  extends:
-    - .trigger-omnibus
-    - .rules:omnibus-build
-  needs:
-    - trigger-omnibus-env
-
-trigger-omnibus-ce:
-  extends:
-    - .trigger-omnibus-ce
-    - .rules:omnibus-build-ce
-  needs:
-    - trigger-omnibus-env-ce
-
 download-knapsack-report:
   extends:
     - .download-knapsack-report

.gitlab/ci/qa-common/main.gitlab-ci.yml

@@ -6,7 +6,7 @@ workflow:
 
 include:
   - project: gitlab-org/quality/pipeline-common
-    ref: 7.2.0
+    ref: 7.2.3
     file:
       - /ci/base.gitlab-ci.yml
       - /ci/allure-report.yml
@@ -67,94 +67,6 @@ stages:
   # blocking merges due to flaky tests.
   allow_failure: true
 
-.trigger-omnibus-env:
-  stage: .pre
-  needs:
-    # We need this job because we need its `cached-assets-hash.txt` artifact, so that we can pass the assets image tag to the downstream omnibus-gitlab pipeline.
-    - pipeline: $PARENT_PIPELINE_ID
-      job: build-assets-image
-  variables:
-    BUILD_ENV: build.env
-  before_script:
-    - |
-      # This is duplicating the function from `scripts/utils.sh` since `.gitlab/ci/package-and-test/main.gitlab-ci.yml` can be included in other projects.
-      function assets_image_tag() {
-        local cache_assets_hash_file="cached-assets-hash.txt"
-
-        if [[ -n "${CI_COMMIT_TAG}" ]]; then
-          echo -n "${CI_COMMIT_REF_NAME}"
-        elif [[ -f "${cache_assets_hash_file}" ]]; then
-          echo -n "assets-hash-$(cat ${cache_assets_hash_file} | cut -c1-10)"
-        else
-          echo -n "${CI_COMMIT_SHA}"
-        fi
-      }
-  script:
-    - |
-      SECURITY_SOURCES=$([[ ! "$CI_PROJECT_NAMESPACE" =~ ^gitlab-org\/security ]] || echo "true")
-      echo "SECURITY_SOURCES=${SECURITY_SOURCES:-false}" > $BUILD_ENV
-      echo "OMNIBUS_GITLAB_CACHE_UPDATE=${OMNIBUS_GITLAB_CACHE_UPDATE:-false}" >> $BUILD_ENV
-      for version_file in *_VERSION; do echo "$version_file=$(cat $version_file)" >> $BUILD_ENV; done
-      echo "OMNIBUS_GITLAB_RUBY3_BUILD=${OMNIBUS_GITLAB_RUBY3_BUILD:-false}" >> $BUILD_ENV
-      echo "OMNIBUS_GITLAB_RUBY2_BUILD=${OMNIBUS_GITLAB_RUBY2_BUILD:-false}" >> $BUILD_ENV
-      echo "OMNIBUS_GITLAB_CACHE_EDITION=${OMNIBUS_GITLAB_CACHE_EDITION:-GITLAB}" >> $BUILD_ENV
-      echo "OMNIBUS_GITLAB_BUILD_ON_ALL_OS=${OMNIBUS_GITLAB_BUILD_ON_ALL_OS:-false}" >> $BUILD_ENV
-      echo "GITLAB_ASSETS_TAG=$(assets_image_tag)" >> $BUILD_ENV
-      echo "EE=$([[ $FOSS_ONLY == '1' ]] && echo 'false' || echo 'true')" >> $BUILD_ENV
-      target_branch_name="${CI_MERGE_REQUEST_TARGET_BRANCH_NAME:-${CI_COMMIT_REF_NAME}}"
-      echo "TRIGGER_BRANCH=$([[ "${target_branch_name}" =~ ^[0-9-]+-stable(-ee)?$ ]] && echo ${target_branch_name%-ee} || echo 'master')" >> $BUILD_ENV
-    - |
-      echo "Built environment file for omnibus build:"
-      cat $BUILD_ENV
-  artifacts:
-    expire_in: 3 days
-    reports:
-      dotenv: $BUILD_ENV
-    paths:
-      - $BUILD_ENV
-
-.trigger-omnibus-env-ce:
-  extends: .trigger-omnibus-env
-  needs:
-    - pipeline: $PARENT_PIPELINE_ID
-      job: build-assets-image as-if-foss
-
-.trigger-omnibus:
-  stage: .pre
-  inherit:
-    variables: false
-  variables:
-    GITALY_SERVER_VERSION: $GITALY_SERVER_VERSION
-    GITLAB_ELASTICSEARCH_INDEXER_VERSION: $GITLAB_ELASTICSEARCH_INDEXER_VERSION
-    GITLAB_KAS_VERSION: $GITLAB_KAS_VERSION
-    GITLAB_METRICS_EXPORTER_VERSION: $GITLAB_METRICS_EXPORTER_VERSION
-    GITLAB_PAGES_VERSION: $GITLAB_PAGES_VERSION
-    GITLAB_SHELL_VERSION: $GITLAB_SHELL_VERSION
-    GITLAB_WORKHORSE_VERSION: $GITLAB_WORKHORSE_VERSION
-    GITLAB_VERSION: $CI_COMMIT_SHA
-    GITLAB_ASSETS_TAG: $GITLAB_ASSETS_TAG
-    IMAGE_TAG: $CI_COMMIT_SHA
-    TOP_UPSTREAM_SOURCE_PROJECT: $CI_PROJECT_PATH
-    SECURITY_SOURCES: $SECURITY_SOURCES
-    CACHE_UPDATE: $OMNIBUS_GITLAB_CACHE_UPDATE
-    RUBY3_BUILD: $OMNIBUS_GITLAB_RUBY3_BUILD
-    RUBY2_BUILD: $OMNIBUS_GITLAB_RUBY2_BUILD
-    CACHE_EDITION: $OMNIBUS_GITLAB_CACHE_EDITION
-    BUILD_ON_ALL_OS: $OMNIBUS_GITLAB_BUILD_ON_ALL_OS
-    SKIP_QA_TEST: "true"
-    ee: $EE
-  trigger:
-    project: gitlab-org/build/omnibus-gitlab-mirror
-    branch: $TRIGGER_BRANCH
-    strategy: depend
-
-.trigger-omnibus-ce:
-  extends:
-    - .trigger-omnibus
-  variables:
-    # Override gitlab repository so that omnibus doesn't use foss repository for CE build
-    GITLAB_ALTERNATIVE_REPO: $CI_PROJECT_URL
-
 .download-knapsack-report:
   extends:
     - .gitlab-qa-image

.gitlab/ci/qa-common/rules.gitlab-ci.yml

@@ -56,18 +56,6 @@
   rules:
     - when: always
 
-.rules:omnibus-build:
-  rules:
-    - if: $SKIP_OMNIBUS_TRIGGER == "true"
-      when: never
-    - if: $FOSS_ONLY != "1"
-
-.rules:omnibus-build-ce:
-  rules:
-    - if: $SKIP_OMNIBUS_TRIGGER == "true"
-      when: never
-    - if: $FOSS_ONLY == "1"
-
 .rules:update-cache:
   rules:
     - if: '$UPDATE_QA_CACHE == "true"'

.gitlab/ci/qa.gitlab-ci.yml

@@ -84,8 +84,8 @@ e2e:package-and-test-ee:
     - .e2e-trigger-base
     - .qa:rules:package-and-test-ee
   needs:
-    - build-assets-image
     - build-qa-image
+    - trigger-omnibus
     - e2e-test-pipeline-generate
   variables:
     RELEASE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/build/omnibus-gitlab-mirror/gitlab-ee:${CI_COMMIT_SHA}"
@@ -98,8 +98,8 @@ e2e:package-and-test-ce:
     - e2e:package-and-test-ee
     - .qa:rules:package-and-test-ce
   needs:
-    - build-assets-image as-if-foss
     - build-qa-image as-if-foss
+    - trigger-omnibus as-if-foss
     - e2e-test-pipeline-generate
   variables:
     FOSS_ONLY: "1"
@@ -126,10 +126,8 @@ e2e:package-and-test-nightly:
     - .e2e-trigger-base
     - .qa:rules:package-and-test-nightly
   needs:
-    - build-assets-image
-    - build-assets-image as-if-foss
     - build-qa-image
-    - build-qa-image as-if-foss
+    - trigger-omnibus
     - e2e-test-pipeline-generate
   variables:
     GITLAB_SEMVER_VERSION: $GITLAB_SEMVER_VERSION
@@ -145,8 +143,7 @@ e2e:test-on-gdk:
   stage: qa
   needs:
     - build-gdk-image
-    - job: e2e-test-pipeline-generate
-      artifacts: true
+    - e2e-test-pipeline-generate
   variables:
     ALLURE_JOB_NAME: e2e-test-on-gdk
     QA_RUN_TYPE: e2e-test-on-gdk

.gitlab/ci/rails/rspec-foss-impact.gitlab-ci.yml.erb

@@ -22,7 +22,7 @@ dont-interrupt-me:
     - echo "This jobs makes sure this pipeline won't be interrupted! See https://docs.gitlab.com/ee/ci/yaml/#interruptible."
 
 .base-rspec-foss-impact:
-  extends: .rspec-base-pg13-as-if-foss
+  extends: .rspec-base-pg14-as-if-foss
   needs:
     - pipeline: $PARENT_PIPELINE_ID
       job: detect-tests

.gitlab/ci/rails/shared.gitlab-ci.yml

@@ -109,11 +109,16 @@ include:
     - .rspec-base
     - .use-pg13
 
-.rspec-base-pg13-as-if-foss:
+.rspec-base-pg14:
+  extends:
+    - .rspec-base
+    - .use-pg14
+
+.rspec-base-pg14-as-if-foss:
   extends:
     - .rspec-base
     - .as-if-foss
-    - .use-pg13
+    - .use-pg14
   needs:
     - job: "setup-test-env"
     - job: "retrieve-tests-metadata"
@@ -121,10 +126,10 @@ include:
     - job: "detect-tests"
       optional: true
 
-.rspec-base-pg14:
+.rspec-base-pg15:
   extends:
     - .rspec-base
-    - .use-pg14
+    - .use-pg15
 
 .rspec-ee-base-pg12:
   extends:
@@ -177,11 +182,34 @@ include:
     - .use-pg14-opensearch2-ee
     - .rails:rules:run-search-tests
 
+.rspec-ee-base-pg15:
+  extends:
+    - .rspec-base
+    - .use-pg15-es7-ee
+
+.rspec-ee-base-pg15-es8:
+  extends:
+    - .rspec-base
+    - .use-pg15-es8-ee
+    - .rails:rules:run-search-tests
+
+.rspec-ee-base-pg15-opensearch1:
+  extends:
+    - .rspec-base
+    - .use-pg15-opensearch1-ee
+    - .rails:rules:run-search-tests
+
+.rspec-ee-base-pg15-opensearch2:
+  extends:
+    - .rspec-base
+    - .use-pg15-opensearch2-ee
+    - .rails:rules:run-search-tests
+
 .db-job-base:
   extends:
     - .rails-job-base
     - .rails:rules:ee-and-foss-migration
-    - .use-pg13
+    - .use-pg14
   stage: test
   needs: ["setup-test-env"]
 # rspec job base specs

.gitlab/ci/reports.gitlab-ci.yml

@@ -74,13 +74,6 @@ gemnasium-dependency_scanning:
 gemnasium-python-dependency_scanning:
   rules: !reference [".reports:rules:gemnasium-python-dependency_scanning", rules]
 
-yarn-audit-dependency_scanning:
-  extends: .ds-analyzer
-  image: "${REGISTRY_HOST}/${REGISTRY_GROUP}/security-products/analyzers/npm-audit:1"
-  variables:
-    TOOL: yarn
-  rules: !reference [".reports:rules:yarn-audit-dependency_scanning", rules]
-
 # Analyze dependencies for malicious behavior
 # See https://gitlab.com/gitlab-com/gl-security/security-research/package-hunter
 .package_hunter-base:

.gitlab/ci/rules.gitlab-ci.yml

@@ -12,10 +12,10 @@
   if: '$CI_PROJECT_NAME != "gitlab-foss" && $CI_PROJECT_NAME != "gitlab-ce" && $CI_PROJECT_NAME != "gitlabhq"'
 
 .if-jh: &if-jh
-  # Example of these projects:
+  # Matches these two projects:
   # https://jihulab.com/gitlab-cn/gitlab
   # https://gitlab.com/gitlab-org-sandbox/gitlab-jh-validation
-  if: '$CI_PROJECT_PATH =~ /^gitlab-(jh|cn)\/.*/ || $CI_PROJECT_NAME =~ /^gitlab-jh/'
+  if: '$CI_PROJECT_PATH == "gitlab-cn/gitlab" || $CI_PROJECT_PATH == "gitlab-org-sandbox/gitlab-jh-validation"'
 
 .if-force-ci: &if-force-ci
   if: '$FORCE_GITLAB_CI'
@@ -2313,17 +2313,6 @@
     - <<: *if-default-refs
       changes: *python-patterns
 
-.reports:rules:yarn-audit-dependency_scanning:
-  rules:
-    - <<: *if-merge-request-labels-pipeline-expedite
-      when: never
-    - if: '$DEPENDENCY_SCANNING_DISABLED || $GITLAB_FEATURES !~ /\bdependency_scanning\b/'
-      when: never
-    # Run Dependency Scanning on master until https://gitlab.com/gitlab-org/gitlab/-/issues/361657 is resolved
-    - <<: *if-default-branch-refs
-    - <<: *if-default-refs
-      changes: *nodejs-patterns
-
 .reports:rules:test-dast:
   rules:
     - <<: *if-merge-request-labels-pipeline-expedite

.gitlab/ci/setup.gitlab-ci.yml

@@ -83,7 +83,7 @@ verify-approvals:
 generate-frontend-fixtures-mapping:
   extends:
     - .setup:rules:generate-frontend-fixtures-mapping
-    - .use-pg13
+    - .use-pg14
     - .ruby-cache
   needs: ["setup-test-env"]
   stage: prepare
@@ -172,3 +172,45 @@ e2e-test-pipeline-generate:
     paths:
       - '*-pipeline.yml'
       - "${CI_PROJECT_DIR}/qa_tests_vars.env"
+
+trigger-omnibus-env:
+  stage: prepare
+  extends:
+    - .qa:rules:package-and-test-ee
+  needs:
+    # We need this job because we need its `cached-assets-hash.txt` artifact, so that we can pass the assets image tag to the downstream omnibus-gitlab pipeline.
+    - compile-production-assets
+  variables:
+    BUILD_ENV: build.env
+  before_script:
+    - source scripts/utils.sh
+  script:
+    - |
+      SECURITY_SOURCES=$([[ ! "$CI_PROJECT_NAMESPACE" =~ ^gitlab-org\/security ]] || echo "true")
+      echo "SECURITY_SOURCES=${SECURITY_SOURCES:-false}" > $BUILD_ENV
+      echo "OMNIBUS_GITLAB_CACHE_UPDATE=${OMNIBUS_GITLAB_CACHE_UPDATE:-false}" >> $BUILD_ENV
+      for version_file in *_VERSION; do echo "$version_file=$(cat $version_file)" >> $BUILD_ENV; done
+      echo "OMNIBUS_GITLAB_RUBY3_BUILD=${OMNIBUS_GITLAB_RUBY3_BUILD:-false}" >> $BUILD_ENV
+      echo "OMNIBUS_GITLAB_RUBY2_BUILD=${OMNIBUS_GITLAB_RUBY2_BUILD:-false}" >> $BUILD_ENV
+      echo "OMNIBUS_GITLAB_CACHE_EDITION=${OMNIBUS_GITLAB_CACHE_EDITION:-GITLAB}" >> $BUILD_ENV
+      echo "OMNIBUS_GITLAB_BUILD_ON_ALL_OS=${OMNIBUS_GITLAB_BUILD_ON_ALL_OS:-false}" >> $BUILD_ENV
+      echo "GITLAB_ASSETS_TAG=$(assets_image_tag)" >> $BUILD_ENV
+      echo "EE=$([[ $FOSS_ONLY == '1' ]] && echo 'false' || echo 'true')" >> $BUILD_ENV
+      target_branch_name="${CI_MERGE_REQUEST_TARGET_BRANCH_NAME:-${CI_COMMIT_REF_NAME}}"
+      echo "TRIGGER_BRANCH=$([[ "${target_branch_name}" =~ ^[0-9-]+-stable(-ee)?$ ]] && echo ${target_branch_name%-ee} || echo 'master')" >> $BUILD_ENV
+    - |
+      echo "Built environment file for omnibus build:"
+      cat $BUILD_ENV
+  artifacts:
+    expire_in: 3 days
+    reports:
+      dotenv: $BUILD_ENV
+    paths:
+      - $BUILD_ENV
+
+trigger-omnibus-env as-if-foss:
+  extends:
+    - trigger-omnibus-env
+    - .qa:rules:package-and-test-ce
+  needs:
+    - compile-production-assets as-if-foss