.gitlab/CODEOWNERS

@@ -39,6 +39,7 @@ config/bounded_contexts.yml @fabiopitino @grzesiek @stanhu @cwoolley-gitlab @tku
 ^[Backend] @gitlab-org/maintainers/rails-backend
 *.rb
 *.rake
+.rubocop_todo/
 
 ^[Frontend] @gitlab-org/maintainers/frontend
 *.scss
@@ -137,7 +138,6 @@ Dangerfile
 
 ^[Backend Static Code Analysis] @gl-quality/eng-prod @dstull
 .rubocop*.yml
-.rubocop_todo/
 /gems/config/rubocop.yml
 /rubocop/
 /spec/rubocop/
@@ -523,7 +523,6 @@ lib/gitlab/checks/**
 /doc/administration/audit_event_reports.md @eread
 /doc/administration/audit_event_schema.md @eread
 /doc/administration/audit_event_streaming/ @eread
-/doc/administration/audit_event_types.md @eread
 /doc/administration/auditor_users.md @jglassman1
 /doc/administration/auth/ @jglassman1
 /doc/administration/backup_restore/ @axil
@@ -596,13 +595,10 @@ lib/gitlab/checks/**
 /doc/administration/redis/ @axil
 /doc/administration/reference_architectures/ @axil
 /doc/administration/reply_by_email_postfix_setup.md @axil
-/doc/administration/reporting/ @phillipwells
-/doc/administration/reporting/spamcheck.md @axil
+/doc/administration/reporting/ @axil
 /doc/administration/repository_checks.md @eread
 /doc/administration/repository_storage_paths.md @eread
 /doc/administration/restart_gitlab.md @axil
-/doc/administration/review_abuse_reports.md @phillipwells
-/doc/administration/review_spam_logs.md @phillipwells
 /doc/administration/server_hooks.md @eread
 /doc/administration/settings/account_and_limit_settings.md @msedlakjakubowski
 /doc/administration/settings/continuous_integration.md @marcel.amirault @lyspin
@@ -621,6 +617,7 @@ lib/gitlab/checks/**
 /doc/administration/settings/package_registry_rate_limits.md @phillipwells
 /doc/administration/settings/project_integration_management.md @eread @ashrafkhamis
 /doc/administration/settings/push_event_activities_limit.md @msedlakjakubowski
+/doc/administration/settings/rate_limit_on_groups_api.md @lciutacu
 /doc/administration/settings/rate_limit_on_issues_creation.md @msedlakjakubowski
 /doc/administration/settings/rate_limit_on_members_api.md @lciutacu
 /doc/administration/settings/rate_limit_on_notes_creation.md @msedlakjakubowski
@@ -684,6 +681,8 @@ lib/gitlab/checks/**
 /doc/api/geo_nodes.md @axil
 /doc/api/geo_sites.md @axil
 /doc/api/google_cloud_integration.md @jglassman1
+/doc/api/graphql/audit_event_streaming_groups.md @eread
+/doc/api/graphql/audit_event_streaming_instances.md @eread
 /doc/api/graphql/audit_report.md @eread
 /doc/api/graphql/branch_rules.md @msedlakjakubowski
 /doc/api/graphql/custom_emoji.md @msedlakjakubowski
@@ -875,12 +874,9 @@ lib/gitlab/checks/**
 /doc/install/ @axil
 /doc/integration/ @jglassman1
 /doc/integration/advanced_search/ @ashrafkhamis
-/doc/integration/akismet.md @phillipwells
-/doc/integration/arkose.md @phillipwells
 /doc/integration/datadog.md @fneill
 /doc/integration/diffblue_cover.md @marcel.amirault @lyspin
 /doc/integration/external-issue-tracker.md @eread @ashrafkhamis
-/doc/integration/github.md @marcel.amirault @lyspin
 /doc/integration/gitpod.md @ashrafkhamis
 /doc/integration/gmail_action_buttons_for_gitlab.md @eread @ashrafkhamis
 /doc/integration/index.md @eread @ashrafkhamis
@@ -888,7 +884,7 @@ lib/gitlab/checks/**
 /doc/integration/jira/ @eread @ashrafkhamis
 /doc/integration/mattermost/ @axil
 /doc/integration/partner_marketplace.md @fneill
-/doc/integration/recaptcha.md @phillipwells
+/doc/integration/snowflake.md @eread
 /doc/integration/sourcegraph.md @msedlakjakubowski
 /doc/integration/trello_power_up.md @eread @ashrafkhamis
 /doc/integration/vault.md @phillipwells
@@ -898,8 +894,6 @@ lib/gitlab/checks/**
 /doc/raketasks/spdx.md @rdickenson
 /doc/raketasks/x509_signatures.md @msedlakjakubowski
 /doc/security/ @jglassman1
-/doc/security/email_verification.md @phillipwells
-/doc/security/identity_verification.md @phillipwells
 /doc/solutions/ @jfullam @brianwald @Darwinjs
 /doc/subscriptions/ @fneill
 /doc/subscriptions/gitlab_dedicated/ @lyspin
@@ -941,9 +935,10 @@ lib/gitlab/checks/**
 /doc/user/application_security/ @rdickenson
 /doc/user/asciidoc.md @msedlakjakubowski
 /doc/user/clusters/ @phillipwells
-/doc/user/compliance/ @rdickenson
-/doc/user/compliance/compliance_center/ @eread
-/doc/user/compliance/index.md @eread
+/doc/user/compliance/ @eread
+/doc/user/compliance/license_approval_policies.md @rdickenson
+/doc/user/compliance/license_list.md @rdickenson
+/doc/user/compliance/license_scanning_of_cyclonedx_files/ @rdickenson
 /doc/user/custom_roles.md @jglassman1
 /doc/user/custom_roles/ @jglassman1
 /doc/user/discussions/ @aqualls
@@ -971,9 +966,7 @@ lib/gitlab/checks/**
 /doc/user/group/issues_analytics/ @lciutacu
 /doc/user/group/iterations/ @msedlakjakubowski
 /doc/user/group/manage.md @lciutacu
-/doc/user/group/moderate_users.md @phillipwells
 /doc/user/group/planning_hierarchy/ @msedlakjakubowski
-/doc/user/group/reporting/ @phillipwells
 /doc/user/group/repositories_analytics/ @marcel.amirault @lyspin
 /doc/user/group/roadmap/ @msedlakjakubowski
 /doc/user/group/saml_sso/ @jglassman1
@@ -1054,7 +1047,6 @@ lib/gitlab/checks/**
 /doc/user/project/web_ide/ @ashrafkhamis
 /doc/user/project/working_with_projects.md @lciutacu
 /doc/user/public_access.md @lciutacu
-/doc/user/report_abuse.md @phillipwells
 /doc/user/reserved_names.md @lciutacu
 /doc/user/search/ @ashrafkhamis
 /doc/user/search/command_palette.md @sselhorn
@@ -1249,12 +1241,10 @@ lib/gitlab/checks/**
 /ee/app/controllers/groups/scim_oauth_controller.rb
 /ee/app/controllers/oauth/
 /ee/app/controllers/omniauth_kerberos_controller.rb
-/ee/app/controllers/users/registrations_identity_verification_controller.rb
 /ee/app/finders/auth/
 /ee/app/helpers/ee/access_tokens_helper.rb
 /ee/app/helpers/ee/auth_helper.rb
 /ee/app/helpers/ee/personal_access_tokens_helper.rb
-/ee/app/models/concerns/identity_verifiable.rb
 /ee/app/models/concerns/password_complexity.rb
 /ee/app/models/ee/personal_access_token.rb
 /ee/app/models/ee/project_authorization.rb
@@ -1565,8 +1555,10 @@ ee/lib/ee/api/entities/project.rb
 /ee/spec/frontend/remote_development/
 /ee/spec/frontend/**/remote_development/
 
-^[Govern::Anti-abuse] @gitlab-org/modelops/anti-abuse
+[Govern::Anti-abuse] @gitlab-org/modelops/anti-abuse
 /ee/app/controllers/users/registrations_identity_verification_controller.rb
+/ee/app/controllers/users/base_identity_verification_controller.rb
+/ee/app/controllers/users/identity_verification_controller.rb
 /ee/app/models/concerns/identity_verifiable.rb
 /ee/config/routes/identity_verification.rb
 

.gitlab/ci/as-if-foss.gitlab-ci.yml

@@ -95,6 +95,7 @@ start-as-if-foss:
     ENABLE_GRAPHQL_SCHEMA_DUMP: $ENABLE_GRAPHQL_SCHEMA_DUMP
     ENABLE_JEST: $ENABLE_JEST
     ENABLE_JEST_INTEGRATION: $ENABLE_JEST_INTEGRATION
+    ENABLE_JEST_PREDICTIVE: $ENABLE_JEST_PREDICTIVE
     ENABLE_RSPEC_PREDICTIVE_PIPELINE_GENERATE: $ENABLE_RSPEC_PREDICTIVE_PIPELINE_GENERATE
     ENABLE_RSPEC_PREDICTIVE_TRIGGER: $ENABLE_RSPEC_PREDICTIVE_TRIGGER
     ENABLE_RSPEC_PREDICTIVE_TRIGGER_SINGLE_DB: $ENABLE_RSPEC_PREDICTIVE_TRIGGER_SINGLE_DB

.gitlab/ci/frontend.gitlab-ci.yml

@@ -77,12 +77,6 @@ compile-test-assets:
       - "${WEBPACK_COMPILE_LOG_PATH}"
     when: always
 
-compile-test-assets as-if-foss:
-  extends:
-    - compile-test-assets
-    - .frontend:rules:compile-test-assets-as-if-foss
-    - .as-if-foss
-
 update-assets-compile-production-cache:
   extends:
     - compile-production-assets
@@ -180,23 +174,6 @@ rspec-all frontend_fixture:
     - "compile-test-assets"
   parallel: 7
 
-# Builds FOSS fixtures in the EE project, with the `ee/` folder removed (due to `as-if-foss`).
-rspec-all frontend_fixture as-if-foss:
-  extends:
-    - .frontend-fixtures-base
-    - .frontend:rules:frontend_fixture-as-if-foss
-    - .as-if-foss
-  variables:
-    # We explicitly disable Crystalball here so as even in scheduled pipelines we don't need it
-    # since it's already enabled for `rspec-all frontend_fixture` there.
-    CRYSTALBALL: "false"
-    WEBPACK_VENDOR_DLL: "true"
-    KNAPSACK_GENERATE_REPORT: ""
-    FLAKY_RSPEC_GENERATE_REPORT: ""
-  needs:
-    - !reference [.frontend-fixtures-base, needs]
-    - "compile-test-assets as-if-foss"
-
 # Uploads EE fixtures in the EE project.
 # Uploads FOSS fixtures in the FOSS project.
 upload-frontend-fixtures:
@@ -257,7 +234,7 @@ graphql-schema-dump:
 .jest-base:
   extends: .frontend-test-base
   script:
-    - run_timed_command "yarn jest:ci"
+    - run_timed_command "yarn jest:ci:without-fixtures"
 
 jest-build-cache:
   extends:
@@ -287,7 +264,7 @@ jest-build-cache-vue3:
     - .frontend:rules:jest-vue3
     - .vue3
 
-jest:
+jest-with-fixtures:
   extends:
     - .jest-base
     - .frontend:rules:jest
@@ -305,7 +282,38 @@ jest:
       - tmp/tests/frontend/
     reports:
       junit: junit_jest.xml
-  parallel: 12
+  parallel: 2
+  script:
+    - run_timed_command "yarn jest:ci:with-fixtures"
+
+jest:
+  extends:
+    - .jest-base
+    - .frontend:rules:jest
+  needs:
+    - job: jest-build-cache
+      optional: true
+  artifacts:
+    name: coverage-frontend
+    expire_in: 31d
+    when: always
+    paths:
+      - coverage-frontend/
+      - junit_jest.xml
+      - tmp/tests/frontend/
+    reports:
+      junit: junit_jest.xml
+  parallel: 11
+
+jest-with-fixtures vue3:
+  extends:
+    - jest-with-fixtures
+    - .frontend:rules:jest-vue3
+    - .vue3
+  needs:
+    - "rspec-all frontend_fixture"
+    - job: jest-build-cache-vue3
+      optional: true
 
 jest vue3:
   extends:
@@ -313,7 +321,6 @@ jest vue3:
     - .frontend:rules:jest-vue3
     - .vue3
   needs:
-    - "rspec-all frontend_fixture"
     - job: jest-build-cache-vue3
       optional: true
 
@@ -322,20 +329,11 @@ jest predictive:
     - jest
     - .frontend:rules:jest:predictive
   needs:
-    - !reference [jest, needs]
+    - !reference [jest-with-fixtures, needs]
     - "detect-tests"
   script:
     - if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then run_timed_command "yarn jest:ci:predictive"; fi
 
-jest predictive as-if-foss:
-  extends:
-    - jest predictive
-    - .frontend:rules:jest:predictive-as-if-foss
-    - .as-if-foss
-  needs:
-    - "rspec-all frontend_fixture as-if-foss"
-    - "detect-tests"
-
 jest-integration:
   extends:
     - .frontend-test-base
@@ -389,6 +387,8 @@ coverage-frontend:
   needs:
     - job: "jest"
       optional: true
+    - job: "jest-with-fixtures"
+      optional: true
     - job: "jest predictive"
       optional: true
   stage: post-test

.gitlab/ci/global.gitlab-ci.yml

@@ -321,7 +321,7 @@
 
 .ai-gateway-services:
   services:
-    - name: registry.gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/model-gateway:84ed0661
+    - name: registry.gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/model-gateway:latest
       alias: ai-gateway
 
 .use-pg13:

.gitlab/ci/includes/gitlab-com/danger-review.gitlab-ci.yml

 include:
-  - project: gitlab-org/quality/pipeline-common
-    ref: 8.11.0
-    file:
-      - /ci/danger-review.yml
+  - component: gitlab.com/gitlab-org/components/danger-review/danger-review@1.2.0
+    inputs:
+      job_image: "${DEFAULT_CI_IMAGE}"
+      # By default DANGER_DANGERFILE_PREFIX is not defined but allows JiHu to
+      # use a different prefix.
+      # See https://jihulab.com/gitlab-cn/gitlab/-/blob/main-jh/jh/.gitlab-ci.yml
+      dangerfile: "${DANGER_DANGERFILE_PREFIX}Dangerfile"
+      dry_run: true
 
 danger-review:
   extends:
@@ -11,15 +15,7 @@ danger-review:
     - .review:rules:danger
   variables:
     BUNDLE_WITH: "danger"
-  image: "${DEFAULT_CI_IMAGE}"
   before_script:
     - source scripts/utils.sh
     - bundle_install_script
     - yarn_install_script
-
-danger-review-local:
-  extends: danger-review
-  before_script:
-    - !reference ["danger-review", "before_script"]
-    # We unset DANGER_GITLAB_API_TOKEN so that Danger will run as local from `danger-review:script`
-    - unset DANGER_GITLAB_API_TOKEN

.gitlab/ci/rails.gitlab-ci.yml

@@ -306,6 +306,59 @@ rspec system pg14 praefect:
     - .rspec-system-parallel
     - .rails:rules:praefect-with-db
 
+# Test jobs that run without Gitaly's transactions enabled. These will be removed once
+# transactions are always in use in Gitaly.
+rspec migration pg14 no_gitaly_transactions:
+  extends:
+    - rspec migration pg14
+    - .gitaly-without-transactions
+
+rspec background_migration pg14 no_gitaly_transactions:
+  extends:
+    - rspec background_migration pg14
+    - .gitaly-without-transactions
+
+rspec unit pg14 no_gitaly_transactions:
+  extends:
+    - rspec unit pg14
+    - .gitaly-without-transactions
+
+rspec integration pg14 no_gitaly_transactions:
+  extends:
+    - rspec integration pg14
+    - .gitaly-without-transactions
+
+rspec system pg14 no_gitaly_transactions:
+  extends:
+    - rspec system pg14
+    - .gitaly-without-transactions
+
+rspec-ee migration pg14 no_gitaly_transactions:
+  extends:
+    - rspec-ee migration pg14
+    - .gitaly-without-transactions
+
+rspec-ee background_migration pg14 no_gitaly_transactions:
+  extends:
+    - rspec-ee background_migration pg14
+    - .gitaly-without-transactions
+
+rspec-ee unit pg14 no_gitaly_transactions:
+  extends:
+    - rspec-ee unit pg14
+    - .gitaly-without-transactions
+
+rspec-ee integration pg14 no_gitaly_transactions:
+  extends:
+    - rspec-ee integration pg14
+    - .gitaly-without-transactions
+
+rspec-ee system pg14 no_gitaly_transactions:
+  extends:
+    - rspec-ee system pg14
+    - .gitaly-without-transactions
+
+
 # Dedicated job to test DB library code against PG13.
 # Note that these are already tested against PG13 in the `rspec unit pg13` / `rspec-ee unit pg13` jobs.
 rspec db-library-code pg13:

.gitlab/ci/rails/shared.gitlab-ci.yml

@@ -56,6 +56,16 @@ include:
   variables:
     GITALY_PRAEFECT_WITH_DB: '1'
 
+.gitaly-with-transactions:
+  variables:
+    GITALY_TRANSACTIONS_ENABLED: "true"
+
+.gitaly-without-transactions:
+  extends:
+    - .rails:rules:gitaly-without-transactions
+  variables:
+    GITALY_TRANSACTIONS_ENABLED: "false"
+
 .rspec-base-needs:
   needs:
     - job: "clone-gitlab-repo"
@@ -68,6 +78,7 @@ include:
     - .rails-job-base
     - .base-artifacts
     - .repo-from-artifacts
+    - .gitaly-with-transactions
   stage: test
   variables:
     RUBY_GC_MALLOC_LIMIT: 67108864
@@ -210,17 +221,6 @@ include:
     - !reference [.base-script, script]
     - rspec_section rspec_parallelized_job "--fail-fast=${RSPEC_FAIL_FAST_THRESHOLD} --tag click_house"
 
-.rspec-base-pg14-as-if-foss:
-  extends:
-    - .rspec-base
-    - .as-if-foss
-    - .use-pg14
-  needs:
-    - !reference [.rspec-base-needs, needs]
-    - job: "compile-test-assets as-if-foss"
-    - job: "detect-tests"
-      optional: true
-
 .rspec-base-pg15:
   extends:
     - .rspec-base

.gitlab/ci/release-environments/main.gitlab-ci.yml

@@ -18,6 +18,10 @@ stages:
       - GIT_DEPTH
       - GIT_STRATEGY
 
+workflow:
+  auto_cancel:
+    on_new_commit: none
+
 variables:
   GIT_DEPTH: 20
   GIT_STRATEGY: fetch
@@ -46,6 +50,15 @@ release-environments-deploy-env:
     expire_in: 7 days
     when: always
 
+release-environments-update-resource-group:
+  stage: prepare
+  script:
+    # Make sure pipelines run in order
+    # See https://docs.gitlab.com/ee/ci/resource_groups/index.html#change-the-process-mode
+    - |
+      curl --request PUT --data "process_mode=oldest_first" --header "PRIVATE-TOKEN:${ENVIRONMENT_API_TOKEN}" \
+      "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/resource_groups/release-environment-${CI_COMMIT_REF_SLUG}"
+
 release-environments-notification-start:
   stage: start
   extends: .inherit_variables
@@ -67,12 +80,14 @@ release-environments-deploy:
     branch: main
     strategy: depend
   needs: ["release-environments-deploy-env"]
+  resource_group: release-environment-${CI_COMMIT_REF_SLUG}
 
 release-environments-qa:
   stage: qa
   extends:
     - .qa-base
   timeout: 30m
+  parallel: 5
   variables:
     QA_SCENARIO: "Test::Instance::Smoke"
     RELEASE: "${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab-ee-qa:${CI_COMMIT_SHA}"
@@ -80,6 +95,7 @@ release-environments-qa:
     GITLAB_INITIAL_ROOT_PASSWORD: "${RELEASE_ENVIRONMENTS_ROOT_PASSWORD}"
     QA_PRAEFECT_REPOSITORY_STORAGE: "default"
     SIGNUP_DISABLED: "true"
+  resource_group: release-environment-${CI_COMMIT_REF_SLUG}
 
 release-environments-notification-failure:
   stage: finish

.gitlab/ci/rules.gitlab-ci.yml

@@ -408,9 +408,6 @@
 .frontend-predictive-patterns: &frontend-predictive-patterns
   - "{,ee/,jh/}{app/assets/javascripts,spec/frontend}/**/*"
 
-.frontend-predictive-patterns-as-if-foss: &frontend-predictive-patterns-as-if-foss
-  - "{app/assets/javascripts,spec/frontend}/**/*"
-
 # Frontend view patterns + .qa-patterns
 .frontend-qa-patterns: &frontend-qa-patterns
   - "{,ee/,jh/}{app/assets,app/components,app/helpers,app/presenters,app/views}/**/*"
@@ -1259,17 +1256,6 @@
     - <<: *if-default-refs
       changes: *workhorse-patterns
 
-.frontend:rules:compile-test-assets-as-if-foss:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-    - <<: *if-merge-request-labels-run-all-rspec
-    - <<: *if-merge-request-labels-frontend-and-feature-flag
-    - <<: *if-default-refs
-      changes: *code-backstage-qa-patterns
-    - <<: *if-default-refs
-      changes: *workhorse-patterns
-
 .frontend:rules:default-frontend-jobs:
   rules:
     - <<: *if-merge-request-labels-pipeline-expedite
@@ -1336,20 +1322,6 @@
     - <<: *if-default-refs
       changes: *code-backstage-patterns
 
-.frontend:rules:frontend_fixture-as-if-foss:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-merge-request-labels-pipeline-expedite
-      when: never
-    - <<: *if-merge-request-labels-as-if-foss
-    - <<: *if-merge-request-labels-run-all-rspec
-    - <<: *if-merge-request-labels-run-all-jest
-    - <<: *if-merge-request-labels-frontend-and-feature-flag
-    - <<: *if-security-merge-request
-      changes: *code-backstage-patterns
-    - <<: *if-merge-request
-      changes: *frontend-predictive-patterns-as-if-foss
-
 .frontend:rules:upload-frontend-fixtures:
   rules:
     # The new strategy to upload fixtures as generic packages is experimental and can be disabled by removing the `REUSE_FRONTEND_FIXTURES_ENABLED` variable
@@ -1402,6 +1374,7 @@
     - <<: *if-merge-request
       changes: *frontend-dependency-patterns
       when: never
+    - if: '$ENABLE_JEST_PREDICTIVE == "true"'
     - <<: *if-merge-request
       changes: [".gitlab/ci/frontend.gitlab-ci.yml"]  # When this file is modified, we run full Jest jobs
       when: never
@@ -1426,20 +1399,6 @@
     - <<: *if-default-refs
       changes: *code-backstage-patterns
 
-.frontend:rules:jest:predictive-as-if-foss:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - !reference [".frontend:rules:predictive-default-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-      when: never
-    - <<: *if-merge-request
-      changes: *frontend-dependency-patterns
-      when: never
-    - <<: *if-fork-merge-request
-      when: never
-    - <<: *if-merge-request
-      changes: *frontend-predictive-patterns-as-if-foss
-
 .frontend:rules:coverage-frontend:
   rules:
     - <<: *if-not-ee
@@ -1813,6 +1772,9 @@
     - <<: [*if-dot-com-gitlab-org-schedule, *qa-e2e-test-schedule-variables]
     - <<: *if-merge-request
       changes: *qa-patterns
+    - <<: *if-merge-request
+      changes:
+        - gems/gitlab-cng/**/*.rb
 
 .qa:rules:package-and-test-nightly:
   rules:
@@ -2036,6 +1998,11 @@
     - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-praefect-with-db/'
       allow_failure: true
 
+.rails:rules:gitaly-without-transactions:
+  rules:
+    - <<: *if-schedule-maintenance
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-without-gitaly-transactions/'
+
 .rails:rules:ee-and-foss-migration:
   rules:
     - <<: *if-fork-merge-request
@@ -2378,7 +2345,6 @@
     - <<: *if-merge-request
       changes: *rubocop-patterns
 
-
 .rails:rules:detect-previous-failed-tests:
   rules:
     - !reference [".rails:rules:previous-failed-tests-default-rules", rules]

.gitlab/ci/test-on-cng/main.gitlab-ci.yml

@@ -53,6 +53,8 @@ workflow:
     - source scripts/qa/cng_deploy/cng-kind.sh
     - cd qa && bundle install
     - bundle exec cng create cluster --ci
+    # Currently this only performs pre-deploy setup
+    - bundle exec cng create deployment --ci
     - deploy ${GITLAB_DOMAIN}
   script:
     - export QA_COMMAND="bundle exec bin/qa ${QA_SCENARIO:=Test::Instance::All} $QA_GITLAB_URL -- --force-color --order random --format documentation"

.rubocop.yml

@@ -549,6 +549,7 @@ Gitlab/BoundedContexts:
     - '**/app/channels/**/*'
     - '**/app/components/**/*'
     - '**/app/controllers/**/*'
+    - '**/app/helpers/**/*'
     - '**/app/presenters/**/*'
     - '**/app/serializers/**/*'
     - '**/lib/tasks/**/*'

.rubocop_todo/cop/ignored_columns.yml

 ---
 Cop/IgnoredColumns:
   Exclude:
-    - 'ee/lib/ee/gitlab/background_migration/create_vulnerability_links.rb'
-    - 'ee/lib/ee/gitlab/background_migration/migrate_vulnerabilities_feedback_to_vulnerabilities_state_transition.rb'
     - 'spec/lib/gitlab/database/partitioning/sliding_list_strategy_spec.rb'

.rubocop_todo/gemspec/deprecated_attribute_assignment.yml

----
-# Cop supports --autocorrect.
-Gemspec/DeprecatedAttributeAssignment:
-  Details: grace period
-  Exclude:
-    - 'spec/fixtures/packages/rubygems/package.gemspec'

.rubocop_todo/gitlab/avoid_current_organization.yml

----
-Gitlab/AvoidCurrentOrganization:
-  Details: grace period
-  Exclude:
-    - 'app/services/groups/create_service.rb'

.rubocop_todo/gitlab/feature_flag_without_actor.yml

@@ -125,7 +125,7 @@ Gitlab/FeatureFlagWithoutActor:
     - 'ee/app/controllers/groups/billings_controller.rb'
     - 'ee/app/controllers/users/base_identity_verification_controller.rb'
     - 'ee/app/finders/ee/merge_requests_finder.rb'
-    - 'ee/app/finders/member_management/member_approval_finder.rb'
+    - 'ee/app/finders/gitlab_subscriptions/member_management/member_approval_finder.rb'
     - 'ee/app/graphql/mutations/ai/action.rb'
     - 'ee/app/graphql/resolvers/ai/code_suggestions_access_resolver.rb'
     - 'ee/app/graphql/resolvers/ai/user_chat_access_resolver.rb'
@@ -222,10 +222,9 @@ Gitlab/FeatureFlagWithoutActor:
     - 'ee/lib/gitlab/llm/tanuki_bot.rb'
     - 'ee/lib/gitlab/search/index_curator.rb'
     - 'ee/lib/gitlab/search/zoekt/client.rb'
-    - 'ee/lib/gitlab/tracking/ai_tracking.rb'
     - 'ee/lib/gitlab/usage_data_counters/epic_activity_unique_counter.rb'
     - 'ee/lib/gitlab_subscriptions/billable_users_utils.rb'
-    - 'ee/lib/member_management/promotion_management_utils.rb'
+    - 'ee/lib/gitlab_subscriptions/member_management/promotion_management_utils.rb'
     - 'ee/lib/search/cluster_health_check/elastic.rb'
     - 'ee/lib/search/zoekt/circuit_breaker.rb'
     - 'ee/lib/tasks/gitlab/elastic.rake'

.rubocop_todo/gitlab/namespaced_class.yml

@@ -864,6 +864,7 @@ Gitlab/NamespacedClass:
     - 'ee/app/models/board_label.rb'
     - 'ee/app/models/board_user_preference.rb'
     - 'ee/app/models/burndown.rb'
+    - 'ee/app/models/click_house_model.rb'
     - 'ee/app/models/dast_scanner_profile.rb'
     - 'ee/app/models/dast_site.rb'
     - 'ee/app/models/dast_site_profile.rb'

.rubocop_todo/graphql/descriptions.yml

@@ -66,7 +66,6 @@ Graphql/Descriptions:
     - 'ee/app/graphql/ee/types/branch_protections/base_access_level_type.rb'
     - 'ee/app/graphql/ee/types/branch_rules/branch_protection_type.rb'
     - 'ee/app/graphql/ee/types/issue_type.rb'
-    - 'ee/app/graphql/ee/types/merge_request_type.rb'
     - 'ee/app/graphql/ee/types/projects/branch_rule_type.rb'
     - 'ee/app/graphql/ee/types/user_merge_request_interaction_type.rb'
     - 'ee/app/graphql/resolvers/epics_resolver.rb'

.rubocop_todo/layout/first_array_element_indentation.yml

@@ -9,21 +9,6 @@ Layout/FirstArrayElementIndentation:
     - 'app/models/group.rb'
     - 'app/models/user.rb'
     - 'app/services/labels/transfer_service.rb'
-    - 'ee/app/finders/autocomplete/project_invited_groups_finder.rb'
-    - 'ee/app/models/ee/application_setting.rb'
-    - 'ee/app/models/protected_environment.rb'
-    - 'ee/app/services/vulnerabilities/create_service_base.rb'
-    - 'ee/lib/ee/api/helpers/award_emoji.rb'
-    - 'ee/spec/controllers/admin/licenses/usage_exports_controller_spec.rb'
-    - 'ee/spec/controllers/projects/merge_requests_controller_spec.rb'
-    - 'ee/spec/features/boards/boards_licensed_features_spec.rb'
-    - 'ee/spec/features/groups/analytics/cycle_analytics/charts_spec.rb'
-    - 'ee/spec/features/groups/group_roadmap_spec.rb'
-    - 'ee/spec/frontend/fixtures/dast_profiles.rb'
-    - 'ee/spec/frontend/fixtures/search.rb'
-    - 'ee/spec/graphql/resolvers/analytics/contribution_analytics/contributions_resolver_spec.rb'
-    - 'ee/spec/graphql/types/dast_scanner_profile_type_spec.rb'
-    - 'ee/spec/graphql/types/dast_site_profile_type_spec.rb'
     - 'lib/gitlab/object_hierarchy.rb'
     - 'lib/gitlab/project_authorizations.rb'
     - 'qa/qa/specs/features/api/12_systems/gitaly/automatic_failover_and_recovery_spec.rb'
@@ -33,24 +18,3 @@ Layout/FirstArrayElementIndentation:
     - 'qa/qa/specs/features/browser_ui/5_package/package_registry/npm/npm_project_level_spec.rb'
     - 'qa/qa/specs/features/ee/api/9_data_stores/elasticsearch/index_tests/main_index/blob_index_spec.rb'
     - 'qa/qa/specs/features/ee/api/9_data_stores/elasticsearch/nightly_elasticsearch_test_spec.rb'
-    - 'spec/controllers/projects/pipelines_controller_spec.rb'
-    - 'spec/finders/groups/accepting_project_transfers_finder_spec.rb'
-    - 'spec/graphql/mutations/commits/create_spec.rb'
-    - 'spec/graphql/resolvers/environments/nested_environments_resolver_spec.rb'
-    - 'spec/graphql/types/commit_signatures/verification_status_enum_spec.rb'
-    - 'spec/lib/gitlab/analytics/usage_trends/workers_argument_builder_spec.rb'
-    - 'spec/lib/gitlab/background_migration/delete_orphaned_operational_vulnerabilities_spec.rb'
-    - 'spec/lib/gitlab/backtrace_cleaner_spec.rb'
-    - 'spec/lib/gitlab/ci/config/entry/id_token_spec.rb'
-    - 'spec/lib/gitlab/ci/secure_files/x509_name_spec.rb'
-    - 'spec/lib/gitlab/database/load_balancing/rack_middleware_spec.rb'
-    - 'spec/lib/gitlab/database/load_balancing/service_discovery/sampler_spec.rb'
-    - 'spec/lib/gitlab/diff/inline_diff_spec.rb'
-    - 'spec/lib/gitlab/github_import/parallel_scheduling_spec.rb'
-    - 'spec/lib/gitlab/pagination/keyset/in_operator_optimization/query_builder_spec.rb'
-    - 'spec/lib/gitlab/usage_data/topology_spec.rb'
-    - 'spec/models/group_group_link_spec.rb'
-    - 'spec/models/project_group_link_spec.rb'
-    - 'spec/models/user_preference_spec.rb'
-    - 'spec/services/issues/referenced_merge_requests_service_spec.rb'
-    - 'spec/services/security/merge_reports_service_spec.rb'