.browserslistrc

 #
 # This list of browsers is a conservative definition, based on
-# https://docs.gitlab.com/ee/install/requirements.html#supported-web-browsers
-# with the following reasoning:
+# https://docs.gitlab.com/ee/install/requirements.html#supported-web-browsers. We
+# also use the following reasoning to choose the target versions:
 #
-# - We should support the latest ESR of Firefox: 91, because it used quite a lot.
-# - We use Edge/Chrome >= 92 because they are about as old as the Firefox ESR
-# - Safari 14.1 because it is the current minor version of the previous major version
+# - Actual Browser usage on gitlab.com
+# - Support second latest version of Firefox ESR
+# - Support Chrome / Edge versions about the same age as the Firefox ESR version chosen
+#
+# If need be we raise versions closer to the actual supported web browsers.
 #
 # See also this epic: https://gitlab.com/groups/gitlab-org/-/epics/3957
 #
-chrome >= 92
-edge >= 92
-firefox >= 91
-safari >= 14.1
\ No newline at end of file
+chrome >= 103
+edge >= 103
+firefox >= 102
+safari >= 15.6
+

.gitignore

@@ -118,8 +118,10 @@ jest-snapshot-test-report.json
 *.local
 /config/vite.gdk.json
 
-# CSS compilation for cssbundling
+# CSS compilation for cssbundling and tailwind
 app/assets/builds/
+config/helpers/tailwind/all_utilities.haml
+config/helpers/tailwind/css_in_js.js
 
 # ruby-lsp
 .index.yml

.gitlab-ci.yml

@@ -27,10 +27,6 @@ default:
   # Default job timeout doesn't work: https://gitlab.com/gitlab-org/gitlab/-/issues/387528
   timeout: 90m
 
-.old-ruby-variables: &old-ruby-variables
-  RUBY_VERSION: "3.0"
-  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_0"
-
 .default-ruby-variables: &default-ruby-variables
   RUBY_VERSION: "3.1"
   OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_1"
@@ -45,6 +41,7 @@ default:
   CREATE_RAILS_TEST_FAILURE_ISSUES: "true"
 
 .default-merge-request-variables: &default-merge-request-variables
+  NO_SOURCEMAPS: "true"
   ADD_SLOW_TEST_NOTE_TO_MERGE_REQUEST: "true"
 
 .if-merge-request-security-canonical-sync: &if-merge-request-security-canonical-sync
@@ -76,55 +73,51 @@ workflow:
     # they serve no purpose and will run anyway when the changes are merged.
     - if: '$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME =~ /^release-tools\/\d+\.\d+\.\d+-rc\d+$/ && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee)?$/ && $CI_PROJECT_PATH == "gitlab-org/gitlab"'
       when: never
-    - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby3_0/'
-      variables:
-        <<: *old-ruby-variables
-        PIPELINE_NAME: 'Ruby $RUBY_VERSION MR'
-        NO_SOURCEMAPS: 'true'
     - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby3_1/'
       variables:
-        <<: *default-ruby-variables
-        PIPELINE_NAME: 'Ruby $RUBY_VERSION MR'
-        NO_SOURCEMAPS: 'true'
-    - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby3_2/'
-      variables:
-        <<: *next-ruby-variables
+        <<: [*default-ruby-variables, *default-merge-request-variables]
         PIPELINE_NAME: 'Ruby $RUBY_VERSION MR'
-        NO_SOURCEMAPS: 'true'
     - if: '$CI_MERGE_REQUEST_LABELS =~ /Community contribution/'
       variables:
-        <<: *default-ruby-variables
+        <<: [*next-ruby-variables, *default-merge-request-variables]
         GITLAB_DEPENDENCY_PROXY_ADDRESS: ""
         PIPELINE_NAME: 'Ruby $RUBY_VERSION MR (community contribution)'
-        NO_SOURCEMAPS: 'true'
+    # This work around https://gitlab.com/gitlab-org/gitlab/-/issues/332411 which prevents usage of dependency proxy
+    # when pipeline is triggered by a project access token.
+    # Example of project bot usernames (the format changed over time):
+    # - project_278964_bot2
+    # - project_278964_bot_7fb4d1cca8242cb399a0b8f483783120
+    - if: '$CI_MERGE_REQUEST_IID && $GITLAB_USER_LOGIN =~ /project_\d+_bot/'
+      variables:
+        <<: [*next-ruby-variables, *default-merge-request-variables]
+        GITLAB_DEPENDENCY_PROXY_ADDRESS: ""
+        PIPELINE_NAME: 'Ruby $RUBY_VERSION MR (triggered by a project token)'
     - <<: *if-merge-request-security-canonical-sync
       variables:
-        <<: *default-ruby-variables
+        <<: [*next-ruby-variables, *default-merge-request-variables]
         PIPELINE_NAME: '$CI_DEFAULT_BRANCH security->canonical sync'
         SKIP_MESSAGE: 'MR only contains changes from the security mirror, which have already been reviewed, tested and deployed.'
     # For (detached) merge request pipelines.
     - if: '$CI_MERGE_REQUEST_IID'
       variables:
-        <<: [*default-ruby-variables, *default-merge-request-variables]
+        <<: [*next-ruby-variables, *default-merge-request-variables]
         PIPELINE_NAME: 'Ruby $RUBY_VERSION MR'
-        NO_SOURCEMAPS: 'true'
     # For the scheduled pipelines, we set specific variables.
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule"'
       variables:
         <<: [*default-ruby-variables, *default-branch-pipeline-failure-variables]
         CRYSTALBALL: "true"
         PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
-    - if: '$CI_COMMIT_BRANCH == "ruby3_0" && $CI_PIPELINE_SOURCE == "schedule"'
-      variables:
-        <<: *old-ruby-variables
-        PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
     - if: '$CI_COMMIT_BRANCH == "ruby3_2" && $CI_PIPELINE_SOURCE == "schedule"'
       variables:
         <<: *next-ruby-variables
         PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
     # This work around https://gitlab.com/gitlab-org/gitlab/-/issues/332411 which prevents usage of dependency proxy
     # when pipeline is triggered by a project access token.
-    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $GITLAB_USER_LOGIN =~ /project_\d+_bot\d*/'
+    # Example of project bot usernames (the format changed over time):
+    # - project_278964_bot2
+    # - project_278964_bot_7fb4d1cca8242cb399a0b8f483783120
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $GITLAB_USER_LOGIN =~ /project_\d+_bot/'
       variables:
         <<: [*default-ruby-variables, *default-branch-pipeline-failure-variables]
         GITLAB_DEPENDENCY_PROXY_ADDRESS: ""
@@ -163,7 +156,7 @@ workflow:
 
 variables:
   PG_VERSION: "14"
-  DEFAULT_CI_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}.patched-golang-${GO_VERSION}-rust-${RUST_VERSION}-node-18.17-postgresql-${PG_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-2.36-lfs-2.9-chrome-${CHROME_VERSION}-yarn-1.22-graphicsmagick-1.3.36"
+  DEFAULT_CI_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}.patched-golang-${GO_VERSION}-rust-${RUST_VERSION}-node-${NODE_VERSION}-postgresql-${PG_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-2.36-lfs-2.9-chrome-${CHROME_VERSION}-yarn-1.22-graphicsmagick-1.3.36"
   # We set $GITLAB_DEPENDENCY_PROXY to another variable (since it's set at the group level and has higher precedence than .gitlab-ci.yml)
   # so that we can override $GITLAB_DEPENDENCY_PROXY_ADDRESS in workflow rules.
   GITLAB_DEPENDENCY_PROXY_ADDRESS: "${GITLAB_DEPENDENCY_PROXY}"
@@ -184,11 +177,12 @@ variables:
   BUILD_OS: "debian"
   OS_VERSION: "bookworm"
   UBI_VERSION: "8.6"
-  CHROME_VERSION: "120"
+  CHROME_VERSION: "123"
   DOCKER_VERSION: "24.0.5"
   RUBYGEMS_VERSION: "3.4"
   BUNDLER_VERSION: "2.5"
-  GO_VERSION: "1.20"
+  GO_VERSION: "1.21"
+  NODE_VERSION: "20.12"
   RUST_VERSION: "1.73"
 
   FLAKY_RSPEC_SUITE_REPORT_PATH: rspec/flaky/report-suite.json
@@ -199,7 +193,6 @@ variables:
   RSPEC_CHANGED_FILES_PATH: rspec/changed_files.txt
   RSPEC_FAIL_FAST_THRESHOLD: 20
   RSPEC_FAST_QUARANTINE_PATH: rspec/fast_quarantine-gitlab.txt
-  RSPEC_FOSS_IMPACT_PIPELINE_TEMPLATE_YML: .gitlab/ci/rails/rspec-foss-impact.gitlab-ci.yml.erb
   RSPEC_LAST_RUN_RESULTS_FILE: rspec/rspec_last_run_results.txt
   RSPEC_MATCHING_JS_FILES_PATH: rspec/js_matching_files.txt
   RSPEC_MATCHING_TESTS_EE_PATH: rspec/matching_tests-ee.txt
@@ -226,7 +219,7 @@ variables:
   DOCS_REVIEW_APPS_DOMAIN: "docs.gitlab-review.app"
   DOCS_GITLAB_REPO_SUFFIX: "ee"
 
-  REVIEW_APPS_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-bookworm-ruby-3.0:gcloud-383-kubectl-1.26-helm-3.9"
+  REVIEW_APPS_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-bookworm-ruby-3.1:gcloud-383-kubectl-1.26-helm-3.9"
   REVIEW_APPS_DOMAIN: "gitlab-review.app"
   REVIEW_APPS_GCP_PROJECT: "gitlab-review-apps"
   REVIEW_APPS_GCP_REGION: "us-central1"

.gitlab/CODEOWNERS

@@ -31,6 +31,8 @@ GITALY_SERVER_VERSION @project_278964_bot6 @gitlab-org/maintainers/rails-backend
 /scripts/lint-doc.sh @marcel.amirault @eread @axil @sarahgerman @gitlab-org/tw-leadership
 /scripts/lint-docs-metadata.sh @marcel.amirault @eread @axil @sarahgerman @gitlab-org/tw-leadership
 
+config/bounded_contexts.yml @fabiopitino @grzesiek @stanhu @cwoolley-gitlab @tkuah
+
 ^[Source code editing]
 .solargraph.yml.example @igor.drozdov
 
@@ -70,13 +72,29 @@ GITALY_SERVER_VERSION @project_278964_bot6 @gitlab-org/maintainers/rails-backend
 /ee/db/schema_migrations/
 # The following two lines only match db/ root files
 /db/*
+/spec/db/*
 /ee/db/*
+/ee/spec/db/*
 /lib/gitlab/background_migration/
+/spec/lib/gitlab/background_migration/
 /ee/lib/ee/gitlab/background_migration/
+/ee/spec/lib/ee/gitlab/background_migration/
+/lib/gitlab/database.rb
 /lib/gitlab/database/
+/spec/lib/gitlab/database_spec.rb
+/spec/lib/gitlab/database/
+/ee/lib/gitlab/database/
+/ee/spec/lib/gitlab/database/
+/ee/lib/ee/gitlab/database.rb
+/ee/lib/ee/gitlab/database/
+/ee/spec/lib/ee/gitlab/database/
+/ee/spec/lib/ee/gitlab/database_spec.rb
 /lib/gitlab/sql/
+/spec/lib/gitlab/sql/
 /app/finders/
+/spec/finders/
 /ee/app/finders/
+/ee/spec/finders/
 /rubocop/rubocop-migrations.yml
 
 [Pipeline configuration] @gl-quality/eng-prod
@@ -127,6 +145,7 @@ Dangerfile
 
 ^[End-to-end] @gl-quality
 /qa/
+/gems/gitlab-cng/
 
 ^[LDAP] @dblessing @mkozono
 /ee/lib/ee/gitlab/auth/ldap/
@@ -148,6 +167,7 @@ Dangerfile
 /app/presenters/projects/security/
 /spec/presenters/projects/security/
 /ee/app/finders/security/
+/ee/app/finders/sbom/
 /ee/app/models/security/
 /ee/app/models/vulnerabilities/
 /ee/app/policies/vulnerabilities/
@@ -160,6 +180,33 @@ Dangerfile
 /ee/app/assets/javascripts/license_compliance/components/detected_licenses_table.vue
 /ee/spec/frontend/license_compliance/components/detected_licenses_table_spec.js
 
+^[Composition Analysis backend] @gitlab-org/secure/composition-analysis-be
+/app/events/package_metadata/
+/app/models/concerns/enums/package_metadata.rb
+/ee/app/finders/sbom/possibly_affected_occurences_finder.rb
+/ee/app/models/package_metadata/
+/ee/app/models/sbom/
+/ee/app/services/package_metadata/
+/ee/app/services/sbom/ingestion/
+/ee/app/services/security/ingestion/
+/ee/app/workers/package_metadata/
+/ee/lib/gitlab/license_scanning.rb
+/ee/lib/gitlab/license_scanning/
+/ee/lib/gitlab/vulnerability_scanning/
+/ee/lib/sbom/
+/ee/spec/lib/gitlab/license_scanning/
+/ee/spec/lib/gitlab/license_scanning_spec.rb
+/ee/spec/lib/gitlab/vulnerability_scanning/
+/ee/spec/lib/sbom/
+/ee/spec/models/package_metadata/
+/ee/spec/models/sbom/
+/lib/gitlab/ci/parsers/sbom/
+/lib/gitlab/ci/reports/sbom/
+/lib/sbom/
+/spec/lib/gitlab/ci/parsers/sbom/
+/spec/lib/gitlab/ci/reports/sbom/
+/spec/lib/sbom/
+
 ^[Secure] @gitlab-org/secure/dynamic-analysis-be
 /ee/app/services/app_sec/dast/
 
@@ -276,7 +323,7 @@ Dangerfile
 /ee/spec/services/software_license_policies/**
 /spec/finders/security/license_compliance_jobs_finder_spec.rb
 
-^[Secure::Static Analysis] @gitlab-org/secure/static-analysis
+[Secure::Secret Detection] @gitlab-org/secure/secret-detection
 /ee/lib/gitlab/checks/secrets_check.rb
 /ee/spec/lib/gitlab/checks/secrets_check_spec.rb
 /ee/spec/support/shared_contexts/secrets_check_shared_contexts.rb
@@ -290,20 +337,33 @@ Dangerfile
 /ee/spec/lib/gitlab/code_owners/
 /doc/user/project/code_owners.md
 
-^[Merge Requests backend] @garyh @patrickbajao @marc_shaw @kerrizor
+[Merge Requests backend] @code-review-be/engineers
+/app/controllers/projects/merge_requests_controller.rb
 /app/controllers/projects/merge_requests/
-/app/models/merge_request.rb @garyh @patrickbajao @marc_shaw @kerrizor @dskim_gitlab
-/app/services/merge_requests/ @garyh @patrickbajao @marc_shaw @kerrizor @dskim_gitlab
-/app/workers/merge_requests/ @garyh @patrickbajao @marc_shaw @kerrizor @dskim_gitlab
-/app/workers/merge_request_mergeability_check_worker.rb @garyh @patrickbajao @marc_shaw @kerrizor @dskim_gitlab
-/lib/gitlab/diff/ @garyh @patrickbajao @marc_shaw @kerrizor @dskim_gitlab
-/lib/gitlab/discussions_diff/ @garyh @patrickbajao @marc_shaw @kerrizor @dskim_gitlab
-/lib/gitlab/quick_actions/ @garyh @patrickbajao @marc_shaw @kerrizor @dskim_gitlab
-
-/ee/app/models/ee/merge_request.rb @garyh @patrickbajao @marc_shaw @kerrizor @dskim_gitlab
-/ee/app/services/merge_requests/ @garyh @patrickbajao @marc_shaw @kerrizor @dskim_gitlab
-/ee/app/workers/merge_requests/ @garyh @patrickbajao @marc_shaw @kerrizor @dskim_gitlab
-/ee/app/workers/merge_request_reset_approvals_worker.rb @garyh @patrickbajao @marc_shaw @kerrizor @dskim_gitlab
+/app/models/merge_request.rb
+/app/services/merge_requests/
+/app/workers/merge_requests/
+/app/workers/merge_request_cleanup_refs_worker.rb
+/app/workers/merge_request_mergeability_check_worker.rb
+/app/workers/new_merge_request_worker.rb
+/app/workers/schedule_merge_request_cleanup_refs_worker.rb
+/app/workers/update_head_pipeline_for_merge_request_worker.rb
+/app/workers/update_merge_requests_worker.rb
+/ee/app/controllers/ee/projects/merge_requests_controller.rb
+/ee/app/controllers/ee/projects/merge_requests/
+/ee/app/models/ee/merge_request.rb
+/ee/app/services/merge_requests/
+/ee/app/services/ee/merge_requests
+/ee/app/workers/merge_requests/
+/ee/app/workers/ee/merge_requests
+/ee/app/workers/merge_request_reset_approvals_worker.rb
+/ee/lib/ee/gitlab/quick_actions/merge_request_actions.rb
+/lib/gitlab/diff/file_collection/merge_request_diff.rb
+/lib/gitlab/diff/file_collection/merge_request_diff_base.rb
+/lib/gitlab/diff/file_collection/merge_request_diff_batch.rb
+/lib/gitlab/diff/file_collection/paginated_diffs.rb
+/lib/gitlab/diff/file_collection/paginated_merge_request_diff.rb
+/lib/gitlab/quick_actions/merge_request_actions.rb
 
 ^[Merge Requests frontend] @slashmanov @iamphill @thomasrandolph
 /app/assets/javascripts/diffs
@@ -461,6 +521,7 @@ lib/gitlab/checks/**
 ^[Documentation Pages]
 # This block is managed by the rake script at lib/tasks/gitlab/tw/codeowners.rake, manual updates will be overwritten!
 # Begin rake-managed-docs-block
+/doc/administration/analytics.md @lciutacu
 /doc/administration/analytics/ @lciutacu
 /doc/administration/application_settings_cache.md @jglassman1
 /doc/administration/audit_event_reports.md @eread
@@ -553,6 +614,7 @@ lib/gitlab/checks/**
 /doc/administration/settings/email.md @msedlakjakubowski
 /doc/administration/settings/external_authorization.md @jglassman1
 /doc/administration/settings/files_api_rate_limits.md @msedlakjakubowski
+/doc/administration/settings/git_http_rate_limits.md @msedlakjakubowski
 /doc/administration/settings/git_lfs_rate_limits.md @msedlakjakubowski
 /doc/administration/settings/gitaly_timeouts.md @eread
 /doc/administration/settings/import_and_export_settings.md @eread @ashrafkhamis
@@ -625,6 +687,7 @@ lib/gitlab/checks/**
 /doc/api/freeze_periods.md @phillipwells
 /doc/api/geo_nodes.md @axil
 /doc/api/geo_sites.md @axil
+/doc/api/google_cloud_integration.md @jglassman1
 /doc/api/graphql/audit_report.md @eread
 /doc/api/graphql/branch_rules.md @msedlakjakubowski
 /doc/api/graphql/custom_emoji.md @msedlakjakubowski
@@ -730,7 +793,7 @@ lib/gitlab/checks/**
 /doc/api/snippet_repository_storage_moves.md @msedlakjakubowski
 /doc/api/snippets.md @msedlakjakubowski
 /doc/api/statistics.md @jglassman1
-/doc/api/status_checks.md @eread
+/doc/api/status_checks.md @rdickenson
 /doc/api/suggestions.md @msedlakjakubowski
 /doc/api/system_hooks.md @eread @ashrafkhamis
 /doc/api/tags.md @msedlakjakubowski
@@ -742,10 +805,10 @@ lib/gitlab/checks/**
 /doc/api/topics.md @lciutacu
 /doc/api/users.md @jglassman1
 /doc/api/version.md @phillipwells
-/doc/api/visual_review_discussions.md @marcel.amirault @lyspin
 /doc/api/vulnerabilities.md @rdickenson
 /doc/api/vulnerability_exports.md @rdickenson
 /doc/api/vulnerability_findings.md @rdickenson
+/doc/architecture/blueprints/autoflow/ @phillipwells
 /doc/architecture/blueprints/cells/ @lciutacu
 /doc/architecture/blueprints/ci_builds_runner_fleet_metrics/ @fneill
 /doc/architecture/blueprints/google_artifact_registry_integration/ @marcel.amirault
@@ -759,13 +822,11 @@ lib/gitlab/checks/**
 /doc/ci/examples/authenticating-with-hashicorp-vault/ @marcel.amirault
 /doc/ci/examples/deployment/ @phillipwells
 /doc/ci/examples/semantic-release.md @phillipwells
+/doc/ci/gitlab_google_cloud_integration/ @marcel.amirault
 /doc/ci/interactive_web_terminal/ @fneill
 /doc/ci/jobs/ci_job_token.md @marcel.amirault
-/doc/ci/jobs/index.md @marcel.amirault @lyspin
 /doc/ci/jobs/job_artifacts.md @marcel.amirault
 /doc/ci/jobs/job_artifacts_troubleshooting.md @marcel.amirault
-/doc/ci/jobs/job_control.md @marcel.amirault @lyspin
-/doc/ci/jobs/job_troubleshooting.md @marcel.amirault @lyspin
 /doc/ci/pipelines/pipeline_security.md @marcel.amirault
 /doc/ci/resource_groups/ @phillipwells
 /doc/ci/runners/ @fneill
@@ -773,6 +834,7 @@ lib/gitlab/checks/**
 /doc/ci/secure_files/ @marcel.amirault
 /doc/ci/services/ @fneill
 /doc/ci/ssh_keys/ @marcel.amirault
+/doc/ci/steps/ @fneill
 /doc/ci/test_cases/ @msedlakjakubowski
 /doc/ci/testing/code_quality.md @rdickenson
 /doc/ci/testing/code_quality_troubleshooting.md @rdickenson
@@ -802,9 +864,8 @@ lib/gitlab/checks/**
 /doc/development/navigation_sidebar.md @gitlab-org/manage/foundations/engineering
 /doc/development/omnibus.md @gitlab-org/distribution
 /doc/development/organization/ @abdwdd @alexpooley @manojmj
-/doc/development/permissions.md @gitlab-org/govern/authentication/approvers
-/doc/development/permissions/ @gitlab-org/govern/authentication/approvers
-/doc/development/permissions/custom_roles.md @gitlab-org/govern/authorization/approvers
+/doc/development/permissions.md @gitlab-org/govern/authorization/approvers
+/doc/development/permissions/ @gitlab-org/govern/authorization/approvers
 /doc/development/pipelines/ @gl-quality/eng-prod
 /doc/development/policies.md @gitlab-org/govern/authentication/approvers
 /doc/development/search/ @gitlab-org/search-team/migration-maintainers
@@ -820,13 +881,13 @@ lib/gitlab/checks/**
 /doc/integration/advanced_search/ @ashrafkhamis
 /doc/integration/akismet.md @phillipwells
 /doc/integration/arkose.md @phillipwells
-/doc/integration/datadog.md @eread @ashrafkhamis
+/doc/integration/datadog.md @fneill
 /doc/integration/diffblue_cover.md @marcel.amirault @lyspin
 /doc/integration/external-issue-tracker.md @eread @ashrafkhamis
 /doc/integration/gitpod.md @ashrafkhamis
 /doc/integration/gmail_action_buttons_for_gitlab.md @eread @ashrafkhamis
 /doc/integration/index.md @eread @ashrafkhamis
-/doc/integration/jenkins.md @eread @ashrafkhamis
+/doc/integration/jenkins.md @marcel.amirault @lyspin
 /doc/integration/jira/ @eread @ashrafkhamis
 /doc/integration/mattermost/ @axil
 /doc/integration/partner_marketplace.md @fneill
@@ -866,6 +927,7 @@ lib/gitlab/checks/**
 /doc/tutorials/move_personal_project_to_group/ @lciutacu
 /doc/tutorials/product_analytics_onboarding_website_project/ @lciutacu
 /doc/tutorials/protected_workflow/ @aqualls
+/doc/tutorials/reviews/ @aqualls
 /doc/tutorials/scan_execution_policy/ @rdickenson
 /doc/tutorials/scan_result_policy/ @rdickenson
 /doc/tutorials/scrum_events/ @msedlakjakubowski
@@ -873,6 +935,7 @@ lib/gitlab/checks/**
 /doc/tutorials/website_project_with_analytics/ @lciutacu
 /doc/update/ @axil
 /doc/user/ai_features.md @sselhorn
+/doc/user/ai_features_enable.md @sselhorn
 /doc/user/analytics/ @lciutacu
 /doc/user/analytics/ci_cd_analytics.md @phillipwells
 /doc/user/application_security/ @rdickenson
@@ -886,6 +949,10 @@ lib/gitlab/checks/**
 /doc/user/discussions/ @aqualls
 /doc/user/emoji_reactions.md @msedlakjakubowski
 /doc/user/enterprise_user/ @jglassman1
+/doc/user/get_started/get_started_managing_code.md @msedlakjakubowski
+/doc/user/get_started/get_started_managing_infrastructure.md @phillipwells
+/doc/user/get_started/get_started_planning_work.md @msedlakjakubowski
+/doc/user/get_started/get_started_projects.md @lciutacu
 /doc/user/gitlab_duo_chat.md @sselhorn
 /doc/user/gitlab_duo_examples.md @sselhorn
 /doc/user/group/access_and_permissions.md @lciutacu
@@ -947,8 +1014,12 @@ lib/gitlab/checks/**
 /doc/user/project/index.md @lciutacu
 /doc/user/project/insights/ @lciutacu
 /doc/user/project/integrations/ @eread @ashrafkhamis
+/doc/user/project/integrations/bamboo.md @marcel.amirault @lyspin
 /doc/user/project/integrations/beyond_identity.md @msedlakjakubowski
 /doc/user/project/integrations/git_guardian.md @msedlakjakubowski
+/doc/user/project/integrations/github.md @marcel.amirault @lyspin
+/doc/user/project/integrations/google_artifact_management.md @marcel.amirault
+/doc/user/project/integrations/harbor.md @marcel.amirault
 /doc/user/project/issues/csv_import.md @eread @ashrafkhamis
 /doc/user/project/members/ @lciutacu
 /doc/user/project/merge_requests/ @aqualls
@@ -958,10 +1029,11 @@ lib/gitlab/checks/**
 /doc/user/project/merge_requests/methods/ @msedlakjakubowski
 /doc/user/project/merge_requests/reviews/data_usage.md @sselhorn
 /doc/user/project/merge_requests/squash_and_merge.md @msedlakjakubowski
-/doc/user/project/merge_requests/status_checks.md @eread
+/doc/user/project/merge_requests/status_checks.md @rdickenson
 /doc/user/project/ml/experiment_tracking/ @sselhorn
 /doc/user/project/ml/model_registry/ @sselhorn
 /doc/user/project/organize_work_with_projects.md @lciutacu
+/doc/user/project/project_topics.md @lciutacu
 /doc/user/project/releases/ @phillipwells
 /doc/user/project/releases/release_evidence.md @eread
 /doc/user/project/remote_development/ @ashrafkhamis
@@ -971,9 +1043,9 @@ lib/gitlab/checks/**
 /doc/user/project/repository/web_editor.md @ashrafkhamis
 /doc/user/project/settings/import_export.md @eread @ashrafkhamis
 /doc/user/project/settings/import_export_troubleshooting.md @eread @ashrafkhamis
+/doc/user/project/settings/index.md @lciutacu
 /doc/user/project/settings/migrate_projects.md @lciutacu
 /doc/user/project/settings/project_access_tokens.md @jglassman1
-/doc/user/project/settings/project_features_permissions.md @lciutacu
 /doc/user/project/troubleshooting.md @lciutacu
 /doc/user/project/use_project_as_go_package.md @lciutacu
 /doc/user/project/web_ide/ @ashrafkhamis
@@ -1172,7 +1244,7 @@ lib/gitlab/checks/**
 /ee/app/controllers/groups/scim_oauth_controller.rb
 /ee/app/controllers/oauth/
 /ee/app/controllers/omniauth_kerberos_controller.rb
-/ee/app/controllers/users/identity_verification_controller.rb
+/ee/app/controllers/users/registrations_identity_verification_controller.rb
 /ee/app/finders/auth/
 /ee/app/helpers/ee/access_tokens_helper.rb
 /ee/app/helpers/ee/auth_helper.rb
@@ -1349,11 +1421,11 @@ lib/gitlab/checks/**
 
 # CI/CD templates require approval from specific owners.
 /lib/gitlab/ci/templates/ @gitlab-org/maintainers/cicd-templates
-/lib/gitlab/ci/templates/Security/ @gonzoyumo @twoodham @amarpatel
+/lib/gitlab/ci/templates/Security/ @gonzoyumo @twoodham @amarpatel @theoretick @thiagocsf @agroleau
 /lib/gitlab/ci/templates/Security/API-Fuzzing.*.yml @gitlab-org/secure/dynamic-analysis
 /lib/gitlab/ci/templates/Security/Container-Scanning.*.yml @gitlab-org/secure/composition-analysis-be
 /lib/gitlab/ci/templates/Security/Coverage-Fuzzing.*.yml @gitlab-org/secure/dynamic-analysis
-/lib/gitlab/ci/templates/Security/DAST.*.yml @gitlab-org/secure/dynamic-analysis
+/lib/gitlab/ci/templates/Security/DAST*.yml @gitlab-org/secure/dynamic-analysis
 /lib/gitlab/ci/templates/Security/Dependency-Scanning.*.yml @gitlab-org/secure/composition-analysis-be
 /lib/gitlab/ci/templates/Security/License-Scanning.*.yml @gitlab-org/secure/composition-analysis-be
 /lib/gitlab/ci/templates/Security/SAST.*.yml @gitlab-org/secure/static-analysis
@@ -1490,7 +1562,7 @@ ee/lib/ee/api/entities/project.rb
 /ee/spec/frontend/**/remote_development/
 
 ^[Govern::Anti-abuse] @gitlab-org/modelops/anti-abuse
-/ee/app/controllers/users/identity_verification_controller.rb
+/ee/app/controllers/users/registrations_identity_verification_controller.rb
 /ee/app/models/concerns/identity_verifiable.rb
 /ee/config/routes/identity_verification.rb
 

.gitlab/ci/as-if-foss.gitlab-ci.yml

@@ -32,7 +32,7 @@ prepare-as-if-foss-branch:
     - git add -A
     # --allow-empty accounts for the edge case where FOSS matchess EE repository
     # and a merge request only contains EE related changes.
-    - git commit -m 'Update from merge request' --allow-empty # TODO: Mark which SHA we add
+    - git commit -m 'Update from merge request' --allow-empty  # TODO: Mark which SHA we add
     - git push -f "${FOSS_REPOSITORY}" "${AS_IF_FOSS_BRANCH}"
 
 prepare-as-if-foss-env:
@@ -67,6 +67,10 @@ start-as-if-foss:
   variables:
     START_AS_IF_FOSS: $START_AS_IF_FOSS
     RUBY_VERSION: $RUBY_VERSION
+    # Variables for `detect-tests` to work in FOSS
+    FIND_CHANGES_MERGE_REQUEST_PROJECT_PATH: $FIND_CHANGES_MERGE_REQUEST_PROJECT_PATH
+    FIND_CHANGES_MERGE_REQUEST_IID: $FIND_CHANGES_MERGE_REQUEST_IID
+    # Enabling each individual jobs
     ENABLE_RSPEC: $ENABLE_RSPEC
     ENABLE_RSPEC_FAST_SPEC_HELPER: $ENABLE_RSPEC_FAST_SPEC_HELPER
     ENABLE_RSPEC_PRAEFECT: $ENABLE_RSPEC_PRAEFECT
@@ -85,11 +89,17 @@ start-as-if-foss:
     ENABLE_COMPILE_STORYBOOK: $ENABLE_COMPILE_STORYBOOK
     ENABLE_COMPILE_TEST_ASSETS: $ENABLE_COMPILE_TEST_ASSETS
     ENABLE_CACHE_ASSETS: $ENABLE_CACHE_ASSETS
+    ENABLE_DETECT_TESTS: $ENABLE_DETECT_TESTS
     ENABLE_ESLINT: $ENABLE_ESLINT
     ENABLE_GENERATE_APOLLO_GRAPHQL_SCHEMA: $ENABLE_GENERATE_APOLLO_GRAPHQL_SCHEMA
     ENABLE_GRAPHQL_SCHEMA_DUMP: $ENABLE_GRAPHQL_SCHEMA_DUMP
     ENABLE_JEST: $ENABLE_JEST
     ENABLE_JEST_INTEGRATION: $ENABLE_JEST_INTEGRATION
+    ENABLE_RSPEC_PREDICTIVE_PIPELINE_GENERATE: $ENABLE_RSPEC_PREDICTIVE_PIPELINE_GENERATE
+    ENABLE_RSPEC_PREDICTIVE_TRIGGER: $ENABLE_RSPEC_PREDICTIVE_TRIGGER
+    ENABLE_RSPEC_PREDICTIVE_TRIGGER_SINGLE_DB: $ENABLE_RSPEC_PREDICTIVE_TRIGGER_SINGLE_DB
+    ENABLE_RSPEC_PREDICTIVE_TRIGGER_SINGLE_DB_CI_CONNECTION: $ENABLE_RSPEC_PREDICTIVE_TRIGGER_SINGLE_DB_CI_CONNECTION
+    ENABLE_RUBOCOP: $ENABLE_RUBOCOP
     ENABLE_QA_INTERNAL: $ENABLE_QA_INTERNAL
     ENABLE_QA_SELECTORS: $ENABLE_QA_SELECTORS
     ENABLE_STATIC_ANALYSIS: $ENABLE_STATIC_ANALYSIS

.gitlab/ci/build-images.gitlab-ci.yml

@@ -29,6 +29,13 @@ build-qa-image as-if-foss:
     - .as-if-foss
     - .build-images:rules:build-qa-image-as-if-foss
 
+follow-up:build-qa-image:
+  extends:
+    - build-qa-image
+    - .qa:rules:follow-up-e2e
+  needs:
+    - manual:e2e-test-pipeline-generate
+
 retag-gdk-image:
   extends:
     - .base-image-build
@@ -49,7 +56,7 @@ build-gdk-image:
     - .base-image-build-buildx
     - .build-images:rules:build-gdk-image
   tags:
-    - saas-linux-xlarge-amd64
+    - docker
   stage: build-images
   needs:
     - job: retag-gdk-image
@@ -82,3 +89,9 @@ build-assets-image as-if-foss:
     - .as-if-foss
     - .build-images:rules:build-assets-image-as-if-foss
   needs: ["compile-production-assets as-if-foss"]
+
+follow-up:build-assets-image:
+  extends:
+    - build-assets-image
+    - .qa:rules:follow-up-e2e
+  needs: ["follow-up:compile-production-assets"]

.gitlab/ci/database.gitlab-ci.yml

@@ -45,9 +45,11 @@ db:rollback single-db:
     - .single-db
     - .rails:rules:single-db
 
+# https://docs.gitlab.com/ee/development/database/dbmigrate:multi-version-upgrade-job.html
 db:migrate:multi-version-upgrade:
   extends:
     - .db-job-base
+    - .rails:rules:db:migrate:multi-version-upgrade
   script:
     - curl -o latest_upgrade_stop.gz https://gitlab.com/gitlab-org/quality/pg-dump-generator/-/raw/main/pg_dumps/ee/latest_upgrade_stop.gz
     - gunzip -c latest_upgrade_stop.gz > gitlabhq_production
@@ -55,7 +57,12 @@ db:migrate:multi-version-upgrade:
     - apt-get update -qq && apt-get install -y -qq postgresql
     - psql --output /dev/null -v "ON_ERROR_STOP=1" -h postgres -U postgres -d gitlabhq_test < gitlabhq_production
     - bundle exec rake gitlab:db:configure
-  allow_failure: true
+
+# Validate minimum PG version supported by GitLab
+db:migrate:multi-version-upgrade-pg13:
+  extends:
+    - db:migrate:multi-version-upgrade
+    - .use-pg13
 
 db:migrate:reset:
   extends: .db-job-base

.gitlab/ci/docs.gitlab-ci.yml

@@ -42,7 +42,7 @@ review-docs-cleanup:
 docs-lint links:
   extends:
     - .docs:rules:docs-lint
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-html:alpine-3.18-ruby-3.2.2-08fa6df8
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-html:alpine-3.19-ruby-3.2.3-a5032206
   stage: lint
   needs: []
   script:
@@ -87,7 +87,7 @@ docs-lint blueprint:
 
 docs code_quality:
   extends:
-    - .reports:rules:code_quality
+    - .reports:rules:docs_code_quality
     - .docs-markdown-lint-image
   stage: lint
   needs: []

.gitlab/ci/frontend.gitlab-ci.yml

@@ -3,7 +3,7 @@
     - .default-retry
     - .default-before_script
     - .assets-compile-cache
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}-node-18.17:rubygems-${RUBYGEMS_VERSION}-git-2.33-lfs-2.9-yarn-1.22-graphicsmagick-1.3.36
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}-node-${NODE_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-2.33-lfs-2.9-yarn-1.22-graphicsmagick-1.3.36
   variables:
     SETUP_DB: "false"
     WEBPACK_VENDOR_DLL: "true"
@@ -58,6 +58,13 @@ compile-production-assets as-if-foss:
     - .as-if-foss
     - .frontend:rules:compile-production-assets-as-if-foss
 
+follow-up:compile-production-assets:
+  extends:
+    - compile-production-assets
+    - .qa:rules:follow-up-e2e
+  needs:
+    - manual:e2e-test-pipeline-generate
+
 compile-test-assets:
   extends:
     - .compile-assets-base
@@ -66,8 +73,7 @@ compile-test-assets:
     expire_in: 7d
     paths:
       - public/assets/
-      - node_modules/@gitlab/svgs/dist/icons.json  # app/helpers/icons_helper.rb uses this file
-      - node_modules/@gitlab/svgs/dist/file_icons/file_icons.json  # app/helpers/icons_helper.rb uses this file
+      - config/helpers/tailwind/  # Assets created during tailwind compilation
       - "${WEBPACK_COMPILE_LOG_PATH}"
     when: always
 
@@ -168,7 +174,7 @@ retrieve-frontend-fixtures:
 rspec-all frontend_fixture:
   extends:
     - .frontend-fixtures-base
-    - .frontend:rules:default-frontend-jobs
+    - .frontend:rules:frontend_fixture
   needs:
     - !reference [.frontend-fixtures-base, needs]
     - "compile-test-assets"
@@ -242,6 +248,12 @@ graphql-schema-dump:
     - yarn_install_script
   stage: test
 
+.vue3:
+  variables:
+    VUE_VERSION: 3
+    NODE_OPTIONS: --max-old-space-size=7680
+  allow_failure: true
+
 .jest-base:
   extends: .frontend-test-base
   script:
@@ -264,6 +276,12 @@ jest:
       junit: junit_jest.xml
   parallel: 12
 
+jest vue3:
+  extends:
+    - jest
+    - .frontend:rules:jest-vue3
+    - .vue3
+
 jest predictive:
   extends:
     - jest
@@ -276,19 +294,17 @@ jest predictive:
 
 jest predictive as-if-foss:
   extends:
-    - .jest-base
-    - .frontend:rules:jest:predictive:as-if-foss
+    - jest predictive
+    - .frontend:rules:jest:predictive-as-if-foss
     - .as-if-foss
   needs:
     - "rspec-all frontend_fixture as-if-foss"
     - "detect-tests"
-  script:
-    - if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then run_timed_command "yarn jest:ci:predictive"; fi
 
 jest-integration:
   extends:
     - .frontend-test-base
-    - .frontend:rules:default-frontend-jobs
+    - .frontend:rules:jest-integration
   script:
     - run_timed_command "yarn jest:integration --ci"
   needs: ["rspec-all frontend_fixture", "graphql-schema-dump"]
@@ -296,7 +312,7 @@ jest-integration:
 jest-snapshot-vue3:
   extends:
     - .jest-base
-    - .frontend:rules:jest-snapshot
+    - .frontend:rules:jest-snapshot-vue3
   needs: ["rspec-all frontend_fixture"]
   variables:
     VUE_VERSION: 3
@@ -411,7 +427,7 @@ bundle-size-review:
 compile-storybook:
   extends:
     - .compile-storybook-base
-    - .frontend:rules:default-frontend-jobs
+    - .frontend:rules:compile-storybook
   needs:
     - !reference [.compile-storybook-base, needs]
     - job: "rspec-all frontend_fixture"

.gitlab/ci/gitlab-gems.gitlab-ci.yml

@@ -44,3 +44,6 @@ include:
   - local: .gitlab/ci/templates/gem.gitlab-ci.yml
     inputs:
       gem_name: "gitlab-housekeeper"
+  - local: .gitlab/ci/templates/gem.gitlab-ci.yml
+    inputs:
+      gem_name: "gitlab-cng"

.gitlab/ci/global.gitlab-ci.yml

@@ -197,6 +197,7 @@
     BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES: "true"
     BUNDLE_SILENCE_ROOT_WARNING: "true"
     BUNDLE_PATH: vendor
+    BUNDLE_WITHOUT: development
 
 .qa-cache:
   <<: *qa-bundler-variables
@@ -305,6 +306,22 @@
     - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.8
       alias: zoekt-ci-image
 
+.ai-gateway-variables:
+  variables:
+    AIGW_AUTH__BYPASS_EXTERNAL: true
+    AIGW_VERTEX_TEXT_MODEL__PROJECT: $VERTEX_AI_PROJECT
+    AIGW_VERTEX_TEXT_MODEL__JSON_KEY: $VERTEX_AI_CREDENTIALS
+    AIGW_FASTAPI__DOCS_URL: "/docs"
+    AIGW_FASTAPI__OPENAPI_URL: "/openapi.json"
+    AIGW_FASTAPI__API_PORT: 5052
+    ANTHROPIC_API_KEY: $ANTHROPIC_API_KEY_FOR_SERVICE
+    # CI_DEBUG_SERVICES: "true" # Enable this variable when you debug ai-gateway boot failure.
+
+.ai-gateway-services:
+  services:
+    - name: registry.gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/model-gateway:latest
+      alias: ai-gateway
+
 .use-pg13:
   extends:
     - .pg-base-variables
@@ -359,9 +376,11 @@
   extends:
     - .use-pg14
     - .zoekt-variables
+    - .ai-gateway-variables
   services:
     - !reference [.db-services-with-auto-explain, services]
     - !reference [.es7-services, services]
+    - !reference [.ai-gateway-services, services]
 
 .use-pg15-es7-ee:
   extends:

.gitlab/ci/includes/gitlab-com/danger-review.gitlab-ci.yml

 include:
   - project: gitlab-org/quality/pipeline-common
-    ref: 8.4.4
+    ref: 8.10.0
     file:
       - /ci/danger-review.yml
 
@@ -9,10 +9,12 @@ danger-review:
     - .default-retry
     - .ruby-node-cache
     - .review:rules:danger
+  variables:
+    BUNDLE_WITH: "danger"
   image: "${DEFAULT_CI_IMAGE}"
   before_script:
     - source scripts/utils.sh
-    - bundle_install_script "--with danger"
+    - bundle_install_script
     - yarn_install_script
 
 danger-review-local:

.gitlab/ci/package-and-test/main.gitlab-ci.yml

@@ -598,6 +598,19 @@ ai-gateway-no-seat-assigned:
     - if: $QA_SUITES =~ /Test::Integration::AiGatewayNoSeatAssigned/
     - !reference [.rules:test:manual, rules]
 
+ai-gateway-no-add-on:
+  extends:
+    - .ai-gateway-base
+  variables:
+    QA_SCENARIO: Test::Integration::AiGatewayNoAddOn
+  before_script:
+    - export QA_EE_ACTIVATION_CODE=$QA_EE_ACTIVATION_CODE_NO_ADD_ON
+    - !reference [.ai-gateway-base, before_script]
+  rules:
+    - !reference [.rules:test:qa, rules]
+    - if: $QA_SUITES =~ /Test::Integration::AiGatewayNoAddOn/
+    - !reference [.rules:test:manual, rules]
+
 ai-gateway-no-license:
   extends:
     - .ai-gateway-base

.gitlab/ci/preflight.gitlab-ci.yml

@@ -24,6 +24,11 @@
     - .ruby-cache
     - .preflight:rules:rails-production-server-boot
     - .use-pg13
+  artifacts:
+    expire_in: 7d
+    when: always
+    paths:
+      - log/
 
 # Test the puma configuration present in `config/puma.rb.example`
 rails-production-server-boot-puma-example:
@@ -62,7 +67,7 @@ ruby_syntax:
   image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}
   parallel:
     matrix:
-      - RUBY_VERSION: ["3.0", "3.1", "3.2"]
+      - RUBY_VERSION: ["3.1", "3.2"]
   script:
     - run_timed_command "fail_on_warnings scripts/lint/check_ruby_syntax.rb"
 

.gitlab/ci/qa-common/main.gitlab-ci.yml

@@ -5,7 +5,7 @@ workflow:
   name: $PIPELINE_NAME
 
 include:
-  - component: "gitlab.com/gitlab-org/quality/pipeline-common/allure-report@8.3.0"
+  - component: "gitlab.com/gitlab-org/quality/pipeline-common/allure-report@8.10.0"
     inputs:
       job_name: "e2e-test-report"
       job_stage: "report"
@@ -15,7 +15,7 @@ include:
       gitlab_auth_token_variable_name: "PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE"
       allure_job_name: "${QA_RUN_TYPE}"
   - project: gitlab-org/quality/pipeline-common
-    ref: 8.5.1
+    ref: 8.10.0
     file:
       - /ci/base.gitlab-ci.yml
       - /ci/knapsack-report.yml
@@ -42,6 +42,7 @@ stages:
   variables:
     BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES: "true"
     BUNDLE_SILENCE_ROOT_WARNING: "true"
+    BUNDLE_WITHOUT: development
 
 .qa-install:
   extends:
@@ -59,7 +60,6 @@ stages:
   extends:
     - .bundler-variables
     - .qa-base
-    - .gitlab-qa-report
   stage: test
   tags:
     - e2e

.gitlab/ci/qa-common/rules.gitlab-ci.yml

@@ -164,12 +164,12 @@ include:
 
 .rules:test:smoke-for-omnibus-mr:
   rules:
-    - if: '$CI_PROJECT_NAME == "omnibus-gitlab" && $PIPELINE_TYPE =~ /TRIGGERED_(CE|EE)_PIPELINE/ && $QA_OMNIBUS_MR_TESTS == "only-smoke-reliable"'
+    - if: '$CI_PROJECT_NAME == "omnibus-gitlab" && $PIPELINE_TYPE =~ /TRIGGERED_(CE|EE)_PIPELINE/ && $QA_OMNIBUS_MR_TESTS == "only-smoke"'
       variables:
-        QA_RSPEC_TAGS: "--tag smoke --tag reliable --tag ~orchestrated --tag ~skip_live_env"
-    - if: '$CI_PROJECT_NAME == "omnibus-gitlab" && $PIPELINE_TYPE =~ /TRIGGERED_(CE|EE)_PIPELINE/ && $QA_OMNIBUS_MR_TESTS == "except-smoke-reliable"'
+        QA_RSPEC_TAGS: "--tag smoke --tag ~orchestrated --tag ~skip_live_env"
+    - if: '$CI_PROJECT_NAME == "omnibus-gitlab" && $PIPELINE_TYPE =~ /TRIGGERED_(CE|EE)_PIPELINE/ && $QA_OMNIBUS_MR_TESTS == "except-smoke"'
       variables:
-        QA_RSPEC_TAGS: "--tag ~smoke --tag ~reliable --tag ~orchestrated --tag ~skip_live_env --tag ~transient"
+        QA_RSPEC_TAGS: "--tag ~smoke --tag ~orchestrated --tag ~skip_live_env --tag ~transient"
 
 # ------------------------------------------
 # Report

.gitlab/ci/qa-common/variables.gitlab-ci.yml

@@ -13,4 +13,6 @@ variables:
   QA_RUN_ALL_TESTS: "true"
   # Used by gitlab-qa to set up a volume for `${CI_PROJECT_DIR}/qa/rspec:/home/gitlab/qa/rspec/`
   QA_RSPEC_REPORT_PATH: "${CI_PROJECT_DIR}/qa/rspec"
-  QA_OMNIBUS_MR_TESTS: "only-smoke-reliable"
+  QA_OMNIBUS_MR_TESTS: "only-smoke"
+  # Retry failed specs in separate process
+  QA_RETRY_FAILED_SPECS: "true"

.gitlab/ci/qa.gitlab-ci.yml

@@ -62,7 +62,9 @@ cache-qa-gems:
 
 # E2E runners have separate infra setup and different cache bucket
 cache-qa-gems-e2e-runners:
-  extends: cache-qa-gems
+  extends:
+    - cache-qa-gems
+    - .qa:rules:update-gem-cache-e2e
   tags:
     - e2e
 
@@ -99,11 +101,13 @@ trigger-omnibus:
     branch: $TRIGGER_BRANCH
     strategy: depend
 
-# Same as trigger-omnibus but is manual and runs follow-up-e2e:package-and-test-ee automatically right after
-trigger-omnibus-and-follow-up-e2e:
+follow-up:trigger-omnibus:
   extends:
     - trigger-omnibus
-    - .qa:rules:manual-omnibus-and-follow-up-e2e
+    - .qa:rules:follow-up-e2e
+  needs:
+    - follow-up:trigger-omnibus-env
+    - follow-up:build-assets-image
 
 trigger-omnibus as-if-foss:
   extends:
@@ -130,19 +134,15 @@ e2e:package-and-test-ee:
     QA_RUN_TYPE: e2e-package-and-test
     PIPELINE_NAME: E2E Omnibus GitLab EE
 
-# Same as e2e:package-and-test-ee but runs automatically after trigger-omnibus-and-follow-up-e2e
-follow-up-e2e:package-and-test-ee:
+# Same as e2e:package-and-test-ee but runs automatically after manual:e2e-test-pipeline-generate
+follow-up:e2e:package-and-test-ee:
   extends:
-    - .e2e-trigger-base
+    - e2e:package-and-test-ee
     - .qa:rules:follow-up-e2e
   needs:
-    - build-qa-image
-    - trigger-omnibus-and-follow-up-e2e
-    - e2e-test-pipeline-generate
-  variables:
-    RELEASE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/build/omnibus-gitlab-mirror/gitlab-ee:${RELEASE_IMAGE_TAG}"
-    QA_RUN_TYPE: e2e-package-and-test
-    PIPELINE_NAME: E2E Omnibus GitLab EE
+    - follow-up:build-qa-image
+    - follow-up:trigger-omnibus
+    - manual:e2e-test-pipeline-generate
 
 e2e:post-run-e2e-message:
   extends:

.gitlab/ci/rails.gitlab-ci.yml

@@ -599,7 +599,7 @@ rspec:merge-auto-explain-logs:
 # EE: default refs (MRs, default branch, schedules) jobs #
 rspec-predictive:pipeline-generate:
   extends:
-    - .rails:rules:rspec-predictive
+    - .rails:rules:rspec-predictive:pipeline-generate
   stage: prepare
   needs: ["detect-tests", "retrieve-tests-metadata"]
   script:
@@ -632,6 +632,7 @@ rspec:predictive:trigger:
   variables:
     PARENT_PIPELINE_ID: $CI_PIPELINE_ID
     GIT_STRATEGY: $GIT_STRATEGY
+    PIPELINE_NAME: 'rspec:predictive'
   trigger:
     strategy: depend
     forward:
@@ -641,18 +642,55 @@ rspec:predictive:trigger:
       - artifact: "${RSPEC_PREDICTIVE_PIPELINE_TEMPLATE_YML}.yml"
         job: rspec-predictive:pipeline-generate
 
+rspec:predictive:trigger single-db:
+  extends:
+    - rspec:predictive:trigger
+    - .single-db-rspec
+    - .rails:rules:rspec-predictive:single-db
+  variables:
+    PIPELINE_NAME: 'rspec:predictive single-db'
+
+rspec:predictive:trigger single-db-ci-connection:
+  extends:
+    - rspec:predictive:trigger
+    - .single-db-ci-connection-rspec
+    - .rails:rules:rspec-predictive:single-db-ci-connection
+  variables:
+    PIPELINE_NAME: 'rspec:predictive single-db-ci-connection'
+
 rspec-ee:predictive:trigger:
   extends: rspec:predictive:trigger
   trigger:
     include:
       - artifact: "${RSPEC_PREDICTIVE_PIPELINE_TEMPLATE_YML}-ee.yml"
         job: rspec-predictive:pipeline-generate
+  variables:
+    PIPELINE_NAME: 'rspec-ee:predictive'
+
+rspec-ee:predictive:trigger single-db:
+  extends: rspec:predictive:trigger single-db
+  trigger:
+    include:
+      - artifact: "${RSPEC_PREDICTIVE_PIPELINE_TEMPLATE_YML}-ee.yml"
+        job: rspec-predictive:pipeline-generate
+  variables:
+    PIPELINE_NAME: 'rspec-ee:predictive single-db'
+
+rspec-ee:predictive:trigger single-db-ci-connection:
+  extends: rspec:predictive:trigger single-db-ci-connection
+  trigger:
+    include:
+      - artifact: "${RSPEC_PREDICTIVE_PIPELINE_TEMPLATE_YML}-ee.yml"
+        job: rspec-predictive:pipeline-generate
+  variables:
+    PIPELINE_NAME: 'rspec-ee:predictive single-db-ci-connection'
 
 .rspec-ee-base-gitlab-duo:
   extends:
     - .rspec-ee-base-pg14
   variables:
     REAL_AI_REQUEST: "true"
+    AI_GATEWAY_URL: http://ai-gateway:5052
 
 rspec-ee unit gitlab-duo-chat-zeroshot pg14:
   extends:
@@ -1252,44 +1290,6 @@ rspec-ee fail-fast:
   variables:
     MATCHING_TESTS_PATH: "${RSPEC_MATCHING_TESTS_EE_PATH}"
 
-rspec-foss-impact:pipeline-generate:
-  extends:
-    - .rails:rules:rspec-foss-impact
-  stage: prepare
-  needs: ["detect-tests", "retrieve-tests-metadata"]
-  script:
-    - scripts/generate_rspec_pipeline.rb -f "${RSPEC_MATCHING_TESTS_FOSS_PATH}" -t "${RSPEC_FOSS_IMPACT_PIPELINE_TEMPLATE_YML}" -k "${KNAPSACK_RSPEC_SUITE_REPORT_PATH}"
-    - cat "${RSPEC_FOSS_IMPACT_PIPELINE_TEMPLATE_YML}.yml"
-  artifacts:
-    expire_in: 1 day
-    paths:
-      - "${RSPEC_FOSS_IMPACT_PIPELINE_TEMPLATE_YML}.yml"
-
-rspec-foss-impact:trigger:
-  extends:
-    - .rails:rules:rspec-foss-impact
-  stage: test
-  needs:
-    - job: "setup-test-env"
-      artifacts: false
-    - job: "retrieve-tests-metadata"
-      artifacts: false
-    - job: "compile-test-assets as-if-foss"
-      artifacts: false
-    - job: "rspec-foss-impact:pipeline-generate"
-      artifacts: true
-  variables:
-    PARENT_PIPELINE_ID: $CI_PIPELINE_ID
-    GIT_STRATEGY: $GIT_STRATEGY
-  trigger:
-    strategy: depend
-    forward:
-      yaml_variables: true
-      pipeline_variables: true
-    include:
-      - artifact: "${RSPEC_FOSS_IMPACT_PIPELINE_TEMPLATE_YML}.yml"
-        job: rspec-foss-impact:pipeline-generate
-
 fail-pipeline-early:
   extends:
     - .rails:rules:fail-pipeline-early

.gitlab/ci/rails/rspec-foss-impact.gitlab-ci.yml.erb

-# RSpec FOSS impact pipeline loaded dynamically by script: scripts/generate_rspec_pipeline.rb
-
-include:
-  - local: .gitlab/ci/rails/shared.gitlab-ci.yml
-
-default:
-  image: $DEFAULT_CI_IMAGE
-  tags:
-    - gitlab-org
-  # Default job timeout set to 90m https://gitlab.com/gitlab-com/gl-infra/infrastructure/-/issues/10520
-  timeout: 90m
-  interruptible: true
-
-stages:
-  - test
-
-dont-interrupt-me:
-  extends: .rules:dont-interrupt
-  stage: .pre
-  interruptible: false
-  script:
-    - echo "This jobs makes sure this pipeline won't be interrupted! See https://docs.gitlab.com/ee/ci/yaml/#interruptible."
-
-.base-rspec-foss-impact:
-  extends: .rspec-base-pg14-as-if-foss
-  needs:
-  <% if repo_from_artifacts %>
-    - pipeline: $PARENT_PIPELINE_ID
-      job: clone-gitlab-repo
-  <% end %>
-    - pipeline: $PARENT_PIPELINE_ID
-      job: detect-tests
-    - pipeline: $PARENT_PIPELINE_ID
-      job: setup-test-env
-    - pipeline: $PARENT_PIPELINE_ID
-      job: retrieve-tests-metadata
-    - pipeline: $PARENT_PIPELINE_ID
-      job: compile-test-assets as-if-foss
-  rules:
-    - when: always
-  variables:
-    RSPEC_TESTS_FILTER_FILE: "${RSPEC_MATCHING_TESTS_FOSS_PATH}"
-    RSPEC_TESTS_MAPPING_ENABLED: "true"
-  script:
-    - !reference [.base-script, script]
-    - rspec_parallelized_job "--fail-fast=${RSPEC_FAIL_FAST_THRESHOLD} --tag ~quarantine --tag ~level:background_migration --tag ~zoekt --tag ~click_house"
-
-<% if rspec_files_per_test_level[:migration][:files].size > 0 %>
-rspec migration foss-impact:
-  extends: .base-rspec-foss-impact
-<% if rspec_files_per_test_level[:migration][:parallelization] > 1 %>
-  parallel: <%= rspec_files_per_test_level[:migration][:parallelization] %>
-<% end %>
-  script:
-    - !reference [.base-script, script]
-    - rspec_parallelized_job "--fail-fast=${RSPEC_FAIL_FAST_THRESHOLD} --tag ~quarantine --tag ~zoekt --tag ~click_house"
-<% end %>
-
-<% if rspec_files_per_test_level[:background_migration][:files].size > 0 %>
-rspec background_migration foss-impact:
-  extends: .base-rspec-foss-impact
-<% if rspec_files_per_test_level[:background_migration][:parallelization] > 1 %>
-  parallel: <%= rspec_files_per_test_level[:background_migration][:parallelization] %>
-<% end %>
-<% end %>
-
-<% if rspec_files_per_test_level[:unit][:files].size > 0 %>
-rspec unit foss-impact:
-  extends: .base-rspec-foss-impact
-<% if rspec_files_per_test_level[:unit][:parallelization] > 1 %>
-  parallel: <%= rspec_files_per_test_level[:unit][:parallelization] %>
-<% end %>
-<% end %>
-
-<% if rspec_files_per_test_level[:integration][:files].size > 0 %>
-rspec integration foss-impact:
-  extends: .base-rspec-foss-impact
-<% if rspec_files_per_test_level[:integration][:parallelization] > 1 %>
-  parallel: <%= rspec_files_per_test_level[:integration][:parallelization] %>
-<% end %>
-<% end %>
-
-<% if rspec_files_per_test_level[:system][:files].size > 0 %>
-rspec system foss-impact:
-  extends: .base-rspec-foss-impact
-<% if rspec_files_per_test_level[:system][:parallelization] > 1 %>
-  parallel: <%= rspec_files_per_test_level[:system][:parallelization] %>
-<% end %>
-<% end %>