.gitlab-ci.yml

@@ -36,7 +36,7 @@ default:
 
 .next-ruby-variables: &next-ruby-variables
   RUBY_VERSION: "${RUBY_VERSION_NEXT}"
-  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_2"
+  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_3"
 
 .default-branch-pipeline-failure-variables: &default-branch-pipeline-failure-variables
   CREATE_RAILS_FLAKY_TEST_ISSUES: "true"
@@ -61,6 +61,9 @@ default:
 workflow:
   name: '$PIPELINE_NAME'
   rules:
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/514740
+    - if: '$GITLAB_USER_LOGIN == "gitlab-crowdin-bot" && $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_APPROVED != "true"'
+      when: never
     - if: '$CI_PIPELINE_SOURCE == "pipeline" && $GITALY_TEST'
       variables:
         <<: *default-ruby-variables
@@ -81,7 +84,7 @@ workflow:
     # they serve no purpose and will run anyway when the changes are merged.
     - if: '$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME =~ /^release-tools\/\d+\.\d+\.\d+-rc\d+$/ && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee)?$/ && $CI_PROJECT_PATH == "gitlab-org/gitlab"'
       when: never
-    - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby3_1/ || $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee)?$/'
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby3_2/ || $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee)?$/'
       variables:
         <<: [*default-ruby-variables, *default-merge-request-variables]
         PIPELINE_NAME: 'Ruby $RUBY_VERSION MR'
@@ -112,7 +115,7 @@ workflow:
     # This variable can be specified in manual or scheduled pipelines to run CI with the next Rails version.
     # Specifying BUNDLE_GEMFILE: Gemfile.next wouldn't work because QA jobs require
     # BUNDLE_GEMFILE to be Gemfile even with the next Rails version pipelines.
-    - if: '$RUN_WITH_NEXT_RAILS_VERSION'
+    - if: '$CI_COMMIT_BRANCH == "rails-next" && $CI_PIPELINE_SOURCE == "schedule"'
       variables:
         <<: *next-ruby-variables
         BUNDLE_GEMFILE: Gemfile.next
@@ -132,7 +135,7 @@ workflow:
         <<: [*default-ruby-variables, *default-branch-pipeline-failure-variables]
         CRYSTALBALL: "true"
         PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
-    - if: '$CI_COMMIT_BRANCH == "ruby3_2" && $CI_PIPELINE_SOURCE == "schedule"'
+    - if: '$CI_COMMIT_BRANCH == "ruby-next" && $CI_PIPELINE_SOURCE == "schedule"'
       variables:
         <<: *next-ruby-variables
         PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
@@ -226,6 +229,7 @@ variables:
   RSPEC_TESTS_MAPPING_ALT_PATH: crystalball/mapping-alt.json
   RSPEC_VIEWS_INCLUDING_PARTIALS_PATH: rspec/views_including_partials.txt
   RSPEC_AUTO_EXPLAIN_LOG_PATH: auto_explain/auto_explain.ndjson.gz
+  RUBYOPT: "--yjit"
   TMP_TEST_FOLDER: "${CI_PROJECT_DIR}/tmp/tests"
   TMP_TEST_GITLAB_WORKHORSE_PATH: "${TMP_TEST_FOLDER}/${GITLAB_WORKHORSE_FOLDER}"
 

.gitlab/ci/build-images.gitlab-ci.yml

@@ -51,6 +51,7 @@ build-gdk-image:
     - docker
   stage: build-images
   needs:
+    - job: gdk:compile-test-assets
     - job: retag-gdk-image
       optional: true
   script:

.gitlab/ci/database.gitlab-ci.yml

@@ -66,7 +66,7 @@ db:rollback:
     - .db-job-base
     - .rails:rules:db-rollback
   script:
-    - bundle exec rake db:migrate VERSION=20230721095222 # First 16-5-stable-ee migration
+    - bundle exec rake db:migrate VERSION=20231220225325 # First 16-9-stable-ee migration
     - bundle exec rake db:migrate
 
 db:rollback single-db:
@@ -114,6 +114,7 @@ db:check-schema:
     - .rails:rules:db:check-schema
   script:
     - run_timed_command "bundle exec rake db:drop db:create db:migrate"
+    - run_timed_command "scripts/validate_migration_timestamps"
 
 db:check-schema-single-db:
   extends:

.gitlab/ci/docs.gitlab-ci.yml

@@ -48,7 +48,7 @@ review-docs-cleanup:
   needs: []
   variables:
     GIT_DEPTH: 1
-    # By default, deploy the Review App using the `main` branch of the `gitlab-org/technical-writing-group/gitlab-docs-hugo` project
+    # By default, deploy the Review App using the `main` branch of the `gitlab-org/technical-writing/docs-gitlab-com` project
     DOCS_BRANCH: main
   environment:
     name: review-docs/mr-${CI_MERGE_REQUEST_IID}-hugo
@@ -59,13 +59,13 @@ review-docs-cleanup:
     - source ./scripts/utils.sh
     - install_gitlab_gem
 
-# Deploy documentation review app by using GitLab Docs Hugo project (gitlab-org/technical-writing-group/gitlab-docs-hugo)
+# Deploy documentation review app by using GitLab Docs Hugo project (gitlab-org/technical-writing/docs-gitlab-com)
 review-docs-hugo-deploy:
   extends: .review-docs-hugo
   script:
     - ./scripts/trigger-build.rb docs-hugo deploy
 
-# Cleanup remote environment of gitlab-org/technical-writing-group/gitlab-docs-hugo
+# Cleanup remote environment of gitlab-org/technical-writing/docs-gitlab-com
 review-docs-hugo-cleanup:
   extends: .review-docs-hugo
   environment:
@@ -76,7 +76,7 @@ review-docs-hugo-cleanup:
 
 .docs-markdown-lint-image:
   # When updating the image version here, update it in /scripts/lint-doc.sh too.
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.20-vale-3.7.1-markdownlint2-0.14.0-lychee-0.15.1
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.20-vale-3.9.3-markdownlint2-0.17.1-lychee-0.18.0
 
 docs-lint markdown:
   extends:

.gitlab/ci/frontend.gitlab-ci.yml

@@ -80,6 +80,11 @@ compile-test-assets:
       - "${WEBPACK_COMPILE_LOG_PATH}"
     when: always
 
+gdk:compile-test-assets:
+  extends:
+    - compile-test-assets
+    - .build-images:rules:build-gdk-image
+
 update-assets-compile-production-cache:
   extends:
     - compile-production-assets
@@ -311,8 +316,7 @@ jest:
       junit: junit_jest.xml
   parallel: 11
   script:
-    - if [[ -z "${CI_MERGE_REQUEST_IID}" ]] && ! [[ "$CI_COMMIT_BRANCH" =~ ^as-if-foss/ ]]; then export JEST_COVERAGE="--coverage"; fi
-    - run_timed_command "scripts/frontend/jest_ci.js $JEST_COVERAGE"
+    - run_timed_command scripts/frontend/jest_ci.js
 
 jest-with-fixtures:
   extends:
@@ -326,8 +330,7 @@ jest-with-fixtures:
     - !reference [.with-fixtures-needs, needs]
   parallel: 2
   script:
-    - if [[ -z "${CI_MERGE_REQUEST_IID}" ]] && ! [[ "$CI_COMMIT_BRANCH" =~ ^as-if-foss/ ]]; then export JEST_COVERAGE="--coverage"; fi
-    - run_timed_command "scripts/frontend/jest_ci.js --fixtures $JEST_COVERAGE"
+    - run_timed_command "scripts/frontend/jest_ci.js --fixtures"
 
 jest vue3:
   extends:

.gitlab/ci/gitlab-gems.gitlab-ci.yml

@@ -44,9 +44,6 @@ include:
   - local: .gitlab/ci/templates/gem.gitlab-ci.yml
     inputs:
       gem_name: "gitlab-housekeeper"
-  - local: .gitlab/ci/templates/gem.gitlab-ci.yml
-    inputs:
-      gem_name: "openbao_client"
   - local: .gitlab/ci/templates/gem.gitlab-ci.yml
     inputs:
       gem_name: "gitlab-active-context"

.gitlab/ci/global.gitlab-ci.yml

@@ -313,7 +313,7 @@
 
 .zoekt-services:
   services:
-    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.8
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.9
       alias: zoekt-ci-image
 
 .ai-gateway-variables:
@@ -532,8 +532,7 @@
     - name: clickhouse/clickhouse-server:23.11.3.23-alpine
       alias: clickhouse
   variables:
-    CLICKHOUSE_USER: clickhouse
-    CLICKHOUSE_PASSWORD: clickhouse
+    CLICKHOUSE_USER: default
     CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
     CLICKHOUSE_DB: gitlab_clickhouse_test
 

.gitlab/ci/qa-common/main.gitlab-ci.yml

@@ -6,7 +6,7 @@ workflow:
 
 include:
   - local: .gitlab/ci/version.yml
-  - component: "gitlab.com/gitlab-org/quality/pipeline-common/allure-report@9.10.0"
+  - component: "gitlab.com/gitlab-org/quality/pipeline-common/allure-report@9.11.1"
     inputs:
       job_name: "e2e-test-report"
       job_stage: "report"
@@ -16,7 +16,7 @@ include:
       gitlab_auth_token_variable_name: "PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE"
       allure_job_name: "${QA_RUN_TYPE}"
   - project: gitlab-org/quality/pipeline-common
-    ref: 9.10.0
+    ref: 9.11.1
     file:
       - /ci/base.gitlab-ci.yml
       - /ci/knapsack-report.yml
@@ -37,8 +37,6 @@ stages:
 
 .parallel:
   parallel: 5
-  variables:
-    QA_KNAPSACK_REPORT_PATH: $CI_PROJECT_DIR/qa/knapsack
 
 .ruby-image:
   # Because this pipeline template can be included directly in other projects,
@@ -108,7 +106,7 @@ stages:
     - .qa-install
     - .ruby-image
   stage: report
-  when: always
+  when: on_success
   variables:
     QA_JSON_REPORT_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/rspec-*.json
   script:

.gitlab/ci/qa-common/variables.gitlab-ci.yml

 # Default variables for e2e test pipelines
 
 variables:
+  GIT_DEPTH: "20"
+  GIT_STRATEGY: "clone" # 'GIT_STRATEGY: clone' optimizes the pack-objects cache hit ratio
+  GIT_SUBMODULE_STRATEGY: "none"
   FF_TIMESTAMPS: "true"
   REGISTRY_HOST: "registry.gitlab.com"
   REGISTRY_GROUP: "gitlab-org"
   ALLURE_JOB_NAME: $CI_PROJECT_NAME
   COLORIZED_LOGS: "true"
-  FEATURE_FLAGS: ""
   QA_LOG_LEVEL: "info"
-  QA_TESTS: ""
   # run all tests by default when test-on-omnibus is included natively in other projects
   # this will be overridden when selective test execution is used in gitlab canonical project
   QA_RUN_ALL_TESTS: "true"
@@ -18,4 +19,4 @@ variables:
   # Retry failed specs in separate process
   QA_RETRY_FAILED_SPECS: "true"
   # helm chart ref used by test-on-cng pipeline
-  GITLAB_HELM_CHART_REF: "56110ba29f58e91a94b119dd8911d241edb89d9a"
+  GITLAB_HELM_CHART_REF: "3f89420cf319778195403711af12c57b4aab6511"

.gitlab/ci/qa.gitlab-ci.yml

@@ -42,7 +42,7 @@
     RELEASE_IMAGE_TAG: "${CI_COMMIT_SHA}-ruby${RUBY_VERSION}"  # This contains a RUBY_VERSION suffix because Omnibus build is depending on the RUBY_VERSION
     RUN_WITH_BUNDLE: "true"  # instructs pipeline to install and run gitlab-qa gem via bundler
     QA_PATH: qa  # sets the optional path for bundler to run from
-    DYNAMIC_PIPELINE_YML: test-on-omnibus-pipeline.yml  # yml files are generated by scripts/generate-e2e-pipeline script
+    DYNAMIC_PIPELINE_YML: "${CI_PROJECT_DIR}/qa/tmp/test-on-omnibus-pipeline.yml"  # yml files are generated by generate_e2e_pipelines task in qa/tasks/ci.rake
     QA_EXPORT_TEST_METRICS: "true"  # Export test metrics directly to influxdb by default
   inherit:
     variables:
@@ -185,7 +185,7 @@ e2e:test-on-omnibus-ee-nightly:
     GITLAB_SEMVER_VERSION: $GITLAB_SEMVER_VERSION
     QA_RUN_TYPE: nightly
     PIPELINE_NAME: E2E Omnibus GitLab Nightly
-    DYNAMIC_PIPELINE_YML: test-on-omnibus-nightly-pipeline.yml
+    DYNAMIC_PIPELINE_YML: ${CI_PROJECT_DIR}/qa/tmp/test-on-omnibus-nightly-pipeline.yml
 
 e2e:test-on-gdk:
   extends:
@@ -198,7 +198,7 @@ e2e:test-on-gdk:
   variables:
     QA_RUN_TYPE: e2e-test-on-gdk
     PIPELINE_NAME: E2E GDK
-    DYNAMIC_PIPELINE_YML: test-on-gdk-pipeline.yml
+    DYNAMIC_PIPELINE_YML: ${CI_PROJECT_DIR}/qa/tmp/test-on-gdk-pipeline.yml
     SKIP_MESSAGE: Skipping test-on-gdk due to mr containing only quarantine changes!
     GDK_IMAGE: "${CI_REGISTRY_IMAGE}/gitlab-qa-gdk:${CI_COMMIT_SHA}"
 
@@ -230,7 +230,7 @@ e2e:test-on-cng:
   variables:
     QA_RUN_TYPE: e2e-test-on-cng
     PIPELINE_NAME: E2E CNG
-    DYNAMIC_PIPELINE_YML: test-on-cng-pipeline.yml
+    DYNAMIC_PIPELINE_YML: ${CI_PROJECT_DIR}/qa/tmp/test-on-cng-pipeline.yml
     SKIP_MESSAGE: Skipping test-on-cng due to mr containing only quarantine changes!
 
 e2e:code-suggestions-eval:

.gitlab/ci/rails/shared.gitlab-ci.yml

@@ -184,6 +184,7 @@ include:
       fi
       section_end "knapsack-report-issues"
     - tooling/bin/push_job_metrics || true
+    - scripts/compress-simplecov.rb
 
 .base-artifacts:
   artifacts:

.gitlab/ci/release-environments.gitlab-ci.yml

 ---
 start-release-environments-security-pipeline:
-  allow_failure: true
+  allow_failure: false
   extends:
     - .release-environments:rules:start-release-environments-security-pipeline
   stage: release-environments

.gitlab/ci/release-environments/security.gitlab-ci.yml

@@ -6,7 +6,7 @@ include:
     inputs:
       cng_path: 'charts/components/images'
   - project: 'gitlab-org/quality/pipeline-common'
-    ref: '9.9.0'
+    ref: '9.11.1'
     file: ci/base.gitlab-ci.yml
 
 stages:

.gitlab/ci/rules.gitlab-ci.yml

@@ -30,7 +30,8 @@
           || $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable(-ee)?$/
           || $CI_COMMIT_REF_NAME =~ /^\d+-\d+-auto-deploy-\d+$/
           || $CI_COMMIT_REF_NAME =~ /^security\//
-          || $CI_COMMIT_REF_NAME =~ /^ruby\d+(_\d)*$/
+          || $CI_COMMIT_REF_NAME =~ /^ruby-next$/
+          || $CI_COMMIT_REF_NAME =~ /^rails-next$/
         )
       )
       ||
@@ -181,7 +182,7 @@
   if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "nightly"'
 
 .if-ruby-branch-schedule-nightly: &if-ruby-branch-schedule-nightly
-  if: '$CI_COMMIT_BRANCH =~ /^ruby\d+(_\d)*$/ && $CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "nightly"'
+  if: '$CI_COMMIT_BRANCH == "ruby-next" && $CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "nightly"'
 
 .if-security-schedule: &if-security-schedule
   if: '$CI_PROJECT_NAMESPACE == "gitlab-org/security" && $CI_PIPELINE_SOURCE == "schedule"'
@@ -214,7 +215,10 @@
   if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_EVENT_TYPE == "merge_train" && $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE =~ /^gitlab-org/'
 
 .if-ruby-branch: &if-ruby-branch
-  if: '$CI_COMMIT_BRANCH =~ /^ruby\d+(_\d)*$/ || (($CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_EVENT_TYPE != "merge_train") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby\d+(_\d)*/)'
+  if: '$CI_COMMIT_BRANCH == "ruby-next" || (($CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_EVENT_TYPE != "merge_train") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby\d+(_\d)*/)'
+
+.if-rails-next-branch: &if-rails-next-branch
+  if: '$CI_COMMIT_BRANCH == "rails-next"'
 
 .if-observability-skip-e2e-jobs: &if-observability-skip-e2e-jobs
   if: '$SKIP_GITLAB_OBSERVABILITY_BACKEND_TRIGGER || $GITLAB_OBSERVABILITY_BACKEND_PIPELINE_TRIGGER_TOKEN == null || $GITLAB_OBSERVABILITY_BACKEND_TOKEN_FOR_CI_SCRIPTS == null'
@@ -397,6 +401,7 @@
   # Mapped patterns (see tests.yml)
   - "data/whats_new/*.yml"
   - "doc/index.md"
+  - "doc/api/settings.md"
 
 .search-backend-patterns: &search-backend-patterns
   - "{,jh/}Gemfile.lock"
@@ -503,6 +508,7 @@
   # Mapped patterns (see tests.yml)
   - "data/whats_new/*.yml"
   - "doc/index.md"
+  - "doc/api/settings.md"
 
 # .code-patterns + .backstage-patterns
 .code-backstage-patterns: &code-backstage-patterns
@@ -531,6 +537,7 @@
   # Mapped patterns (see tests.yml)
   - "data/whats_new/*.yml"
   - "doc/index.md"
+  - "doc/api/settings.md"
   # Backstage changes
   - "Dangerfile"
   - "danger/**/*"
@@ -567,6 +574,7 @@
   # Mapped patterns (see tests.yml)
   - "data/whats_new/*.yml"
   - "doc/index.md"
+  - "doc/api/settings.md"
   # QA changes
   - ".dockerignore"
   - "{,jh/}qa/**/*"
@@ -609,6 +617,7 @@
   # Mapped patterns (see tests.yml)
   - "data/whats_new/*.yml"
   - "doc/index.md"
+  - "doc/api/settings.md"
 
 # .code-backstage-qa-patterns + .workhorse-patterns
 # NOTE: `setup-test-env-patterns` intentionally does not include docs files, because this would
@@ -640,6 +649,7 @@
   # Mapped patterns (see tests.yml)
   - "data/whats_new/*.yml"
   - "doc/index.md"
+  - "doc/api/settings.md"
   # Backstage changes
   - "Dangerfile"
   - "danger/**/*"
@@ -725,6 +735,12 @@
   - "tooling/custom_roles/docs/templates/custom_abilities.md.erb"
   - "ee/{lib/,spec/}tasks/gitlab/custom_roles/*"
 
+.ci-job-token-policies-patterns: &ci-job-token-policies-patterns
+  - "{,ee/}lib/api/*.rb"
+  - "app/validators/json_schemas/ci_job_token_policies.json"
+  - "doc/ci/jobs/fine_grained_permissions.md"
+  - "tooling/ci/job_tokens/docs/templates/fine_grained_permissions.md.erb"
+
 .cng-orchestrator-patterns: &cng-orchestrator-patterns
   - "qa/gems/gitlab-cng/**/*.rb"
   - "qa/gems/gitlab-cng/{Gemfile,Gemfile.lock}"
@@ -1016,6 +1032,7 @@
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
     - <<: *if-ruby-branch
+    - <<: *if-rails-next-branch
     - <<: *if-force-ci
     - <<: *if-auto-deploy-branches
       variables:
@@ -1076,6 +1093,7 @@
     - <<: *if-merge-request-targeting-stable-branch
       changes: *setup-test-env-patterns
     - <<: *if-ruby-branch
+    - <<: *if-rails-next-branch
     # We include the job under the matching conditions below, but unlike in .qa:rules:e2e:test-on-gdk we don't need to
     # set OMNIBUS_GITLAB_BUILD_ON_ALL_OS when testing against GDK
     - <<: *if-merge-request
@@ -1262,6 +1280,16 @@
     - <<: *if-default-refs
       changes: *custom-roles-patterns
 
+#############################
+# CI job token policy rules #
+#############################
+.ci-job-token-policies:rules:ci-job-token-policies-verify:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-default-refs
+      changes: *ci-job-token-policies-patterns
+
 ##################
 # Frontend rules #
 ##################
@@ -1282,6 +1310,7 @@
   rules:
     - <<: *if-auto-deploy-branches
     - <<: *if-ruby-branch
+    - <<: *if-rails-next-branch
     - <<: *if-force-ci
     - <<: *if-merge-request-labels-run-all-e2e
     - <<: *if-merge-request-labels-run-review-app
@@ -1650,6 +1679,7 @@
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
     - *if-ruby-branch
+    - *if-rails-next-branch
     - *if-merge-request-labels-run-all-e2e
     - <<: *if-merge-request-targeting-stable-branch
       changes: *setup-test-env-patterns
@@ -1703,6 +1733,7 @@
     - <<: *if-merge-request-targeting-stable-branch
       changes: *setup-test-env-patterns
     - <<: *if-ruby-branch
+    - <<: *if-rails-next-branch
     - <<: *if-force-ci
       when: manual
     - <<: *if-merge-request
@@ -2001,7 +2032,7 @@
       when: never
     - <<: *if-merge-request-targeting-stable-branch
       when: never
-    - <<: *if-default-refs
+    - <<: *if-not-merge-request
       when: never
     - !reference [".rails:rules:ee-and-foss-migration", rules]
 

.gitlab/ci/setup.gitlab-ci.yml

@@ -200,16 +200,14 @@ e2e-test-pipeline-generate:
     - .qa:rules:determine-e2e-tests
   stage: prepare
   variables:
-    ENV_FILE: $CI_PROJECT_DIR/qa_tests_vars.env
     COLORIZED_LOGS: "true"
+    GENERATED_PIPELINE_PATH: "${CI_PROJECT_DIR}/qa/tmp"
   script:
-    - bundle exec rake "ci:detect_changes[$ENV_FILE]"
-    - cd $CI_PROJECT_DIR && scripts/generate-e2e-pipeline
+    - bundle exec rake "ci:generate_e2e_pipelines[$GENERATED_PIPELINE_PATH]"
   artifacts:
     expire_in: 1 day
     paths:
-      - '*-pipeline.yml'
-      - "${CI_PROJECT_DIR}/qa_tests_vars.env"
+      - "${GENERATED_PIPELINE_PATH}/*-pipeline.yml"
 
 # This is the start of the chain of E2E jobs for CE
 # After playing this, it'll follow up with:

.gitlab/ci/static-analysis.gitlab-ci.yml

@@ -11,7 +11,6 @@
     # https://github.com/browserslist/browserslist/blob/a287ec6/node.js#L367-L384
     BROWSERSLIST_IGNORE_OLD_DATA: "true"
     GRAPHQL_SCHEMA_APOLLO_FILE: "tmp/tests/graphql/gitlab_schema_apollo.graphql"
-    RUBYOPT: "--yjit"
 
 update-static-analysis-cache:
   extends:
@@ -243,6 +242,19 @@ custom-roles-verify:
   script:
     - bundle exec rake gitlab:custom_roles:check_docs
 
+ci-job-token-policies-verify:
+  variables:
+    SETUP_DB: "false"
+  extends:
+    - .default-retry
+    - .ruby-cache
+    - .default-before_script
+    - .ci-job-token-policies:rules:ci-job-token-policies-verify
+  stage: lint
+  needs: []
+  script:
+    - bundle exec rake ci:job_tokens:check_policies
+
 templates-shellcheck:
   extends:
     - .ci-templates:rules:shellcheck

.gitlab/ci/test-on-cng/main.gitlab-ci.yml

@@ -14,48 +14,7 @@ workflow:
   if: $MR_CODE_PATTERNS == "true"
 
 .default-branch: &default-branch
-  if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
-
-# list of specific tests is used when it is small enough to run without knapsack parallelization
-.tests-set: &tests-set
-  if: $QA_TESTS != ""
-
-# pattern is used in case when specific tests are selected but the amount of tests requires multiple jobs
-.parallel-pattern-set: &parallel-pattern-set
-  if: $KNAPSACK_TEST_FILE_PATTERN != ""
-
-.rules:selective:
-  rules:
-    # Skip selective jobs if mr contains app code patterns
-    - <<: *mr-code-patterns
-      when: never
-    - <<: *parallel-pattern-set
-      when: never
-    - <<: *tests-set
-
-.rules:selective-parallel:
-  rules:
-    # Skip selective jobs if mr contains app code patterns
-    - <<: *mr-code-patterns
-      when: never
-    - <<: *tests-set
-      when: never
-    - <<: *parallel-pattern-set
-
-.rules:full:
-  rules:
-    # Run full test suite for application code changes
-    # TODO: Remove once proper dynamic code mapping is in place - https://gitlab.com/groups/gitlab-org/quality/quality-engineering/-/epics/47
-    - if: $MR_CODE_PATTERNS == "true"
-      variables:
-        QA_TESTS: ""
-        KNAPSACK_TEST_FILE_PATTERN: ""
-    # Run full suite when both selective execution variables are unpopulated
-    - if: $QA_TESTS == "" && $KNAPSACK_TEST_FILE_PATTERN == ""
-    - <<: *tests-set
-      when: never
-    - <<: *parallel-pattern-set
-      when: never
+  if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
 
 .cng-deploy-cmd:
   script:
@@ -92,6 +51,7 @@ workflow:
     BUNDLE_WITHOUT: development
     RSPEC_LAST_RUN_RESULTS_FILE: "$CI_PROJECT_DIR/qa/tmp/examples.txt"
     CNG_FORCE_COLOR: "true"
+    DEPLOYMENT_TYPE: kind
     QA_DOCKER_NETWORK: host
     QA_GENERATE_ALLURE_REPORT: "true"
     QA_CAN_TEST_PRAEFECT: "false"
@@ -132,8 +92,9 @@ workflow:
   extends: .cng-test
   parallel: 10
 
-.cng-test-no-parallel:
-  extends: .cng-test
+.with-coverband-arg:
+  variables:
+    EXTRA_DEPLOY_VALUES: --env COVERBAND_ENABLED=${COVERBAND_ENABLED}
 
 # ==========================================
 # Pre stage
@@ -168,48 +129,23 @@ cng-helm-cache:
         - qa/gems/gitlab-cng/lib/gitlab/cng/lib/kind/cluster.rb
 
 cng-instance:
-  extends: .cng-test-parallel
-  variables:
-    DEPLOYMENT_TYPE: kind
-    EXTRA_DEPLOY_VALUES: --env COVERBAND_ENABLED=${COVERBAND_ENABLED}
-  rules:
-    - if: $QA_SUITES !~ /Test::Instance::All/
-      when: never
-    - !reference [.rules:full, rules]
+  extends:
+    - .cng-test-parallel
+    - .with-coverband-arg
 
 cng-registry:
-  extends: .cng-test-no-parallel
+  extends:
+    - .cng-test
+    - .with-coverband-arg
   variables:
-    DEPLOYMENT_TYPE: kind
-    EXTRA_DEPLOY_VALUES: --env COVERBAND_ENABLED=${COVERBAND_ENABLED}
     QA_SCENARIO: Test::Integration::Registry
-
-cng-instance-selective-parallel:
-  extends: .cng-test-parallel
-  variables:
-    DEPLOYMENT_TYPE: kind
-  parallel: 2
-  rules:
-    - if: $QA_SUITES !~ /Test::Instance::All/
-      when: never
-    - !reference [.rules:selective-parallel, rules]
-
-cng-instance-selective:
-  extends: .cng-test
-  variables:
-    DEPLOYMENT_TYPE: kind
-  rules:
-    - if: $QA_SUITES !~ /Test::Instance::All/
-      when: never
-    - !reference [.rules:selective, rules]
+    QA_RUN_IN_PARALLEL: "false"
 
 # == minimal supported redis version ==
 cng-qa-min-redis-version:
   extends: .cng-test
   variables:
-    DEPLOYMENT_TYPE: kind
-    QA_RSPEC_TAGS: --tag health_check
-    QA_TESTS: ""
+    QA_SCENARIO: Test::Instance::HealthCheck
   before_script:
     - |
       redis_version=$(awk -F "=" "/MIN_REDIS_VERSION =/ {print \$2}" $CI_PROJECT_DIR/lib/system_check/app/redis_version_check.rb | sed "s/['\" ]//g")
@@ -217,6 +153,7 @@ cng-qa-min-redis-version:
     - !reference [.cng-test, before_script]
   rules:
     - *mr-code-patterns  # run validation for minimal supported redis version only on application code changes
+    - *default-branch
 
 # ==========================================
 # Post test stage

.gitlab/ci/test-on-gdk/main.gitlab-ci.yml

@@ -4,41 +4,9 @@ include:
   - local: .gitlab/ci/qa-common/rules.gitlab-ci.yml
   - local: .gitlab/ci/qa-common/variables.gitlab-ci.yml
 
-# code pattern changes
-.code-pattern-changes-with-selective-disabled: &code-pattern-changes-with-selective-disabled
-  if: $MR_CODE_PATTERNS == "true" && $SELECTIVE_EXECUTION_IMPROVED != "true"
-
-# code pattern changes with selective execution enabled
-.code-pattern-with-selective-enabled-knapsack-set: &code-pattern-with-selective-enabled-knapsack-set
-  if: $MR_CODE_PATTERNS == "true" && $KNAPSACK_TEST_FILE_PATTERN != "" && $SELECTIVE_EXECUTION_IMPROVED == "true"
-
-.code-pattern-with-selective-enabled-knapsack-unset: &code-pattern-with-selective-enabled-knapsack-unset
-  if: $MR_CODE_PATTERNS == "true" && $QA_TESTS != "" && $KNAPSACK_TEST_FILE_PATTERN == "" && $SELECTIVE_EXECUTION_IMPROVED == "true"
-
-.rules:gdk:qa-selective:
-  rules:
-    - <<: *code-pattern-changes-with-selective-disabled
-      when: never
-    - <<: *code-pattern-with-selective-enabled-knapsack-set
-      when: never
-    - <<: *code-pattern-with-selective-enabled-knapsack-unset
-    - !reference [.rules:test:qa-selective, rules]
-    - if: $QA_SUITES =~ /Test::Instance::All/
-
-.rules:gdk:qa-parallel:
+workflow:
   rules:
-    # To account for cases where a group label is set which may trigger selective execution
-    # But we want to execute full suite on gdk in case of code-pattern-changes
-    - <<: *code-pattern-changes-with-selective-disabled
-      variables:
-        QA_TESTS: ""
-        KNAPSACK_TEST_FILE_PATTERN: ""
-    - <<: *code-pattern-with-selective-enabled-knapsack-unset
-      when: never
-    - <<: *code-pattern-with-selective-enabled-knapsack-set
-    - !reference [.rules:test:qa-parallel, rules]
-    - if: $QA_SUITES =~ /Test::Instance::All/
-    - !reference [.rules:test:manual, rules]
+    - when: always
 
 .rules:test:gdk-load-balancer-changes:
   rules:
@@ -88,6 +56,7 @@ include:
     QA_DOCKER_NETWORK: host
     QA_DISABLE_RSPEC_RETRY: "true"
     QA_GITLAB_URL: http://gdk.test:3000
+    GITLAB_DEVELOPMENT_USE_PRECOMPILED_ASSETS: "true"
     GITLAB_QA_ADMIN_ACCESS_TOKEN: $QA_ADMIN_ACCESS_TOKEN
     FF_NETWORK_PER_BUILD: "true"
     RSPEC_LAST_RUN_RESULTS_FILE: "$CI_PROJECT_DIR/qa/tmp/examples.txt"
@@ -110,13 +79,6 @@ include:
     expire_in: 7 days
     when: always
 
-# Take the existing GDK docker image and reconfigure it with Postgres load
-# balancing. Adding 5s lag to 1 of the replicas to validate robustness of
-# the load balancer.
-.gdk-with-load-balancer-setup:
-  variables:
-    WITH_LOAD_BALANCER: "true"
-
 # ==========================================
 # Test stage
 # ==========================================
@@ -125,10 +87,8 @@ gdk-instance:
   extends:
     - .gdk-qa-base
     - .with-parallel
-    - .rules:gdk:qa-parallel
   variables:
     QA_SCENARIO: Test::Instance::All
-    QA_RUN_TYPE: gdk-instance
 
 gdk-instance-ff-inverse:
   extends: gdk-instance
@@ -137,14 +97,6 @@ gdk-instance-ff-inverse:
   rules:
     - !reference [.rules:test:feature-flags-set, rules]
 
-gdk-instance-selective:
-  extends:
-    - .gdk-qa-base
-    - .rules:gdk:qa-selective
-  variables:
-    QA_SCENARIO: Test::Instance::All
-    QA_RUN_TYPE: gdk-instance
-
 gdk-instance-gitaly-transactions:
   extends: gdk-instance
   variables:
@@ -153,19 +105,17 @@ gdk-instance-gitaly-transactions:
     - !reference [.rules:test:never-schedule-pipeline, rules]
     - !reference [.rules:test:gdk-gitaly-version-change, rules]
 
+# Take the existing GDK docker image and reconfigure it with Postgres load
+# balancing. Adding 5s lag to 1 of the replicas to validate robustness of
+# the load balancer.
 gdk-instance-with-load-balancer:
-  extends:
-    - .gdk-qa-base
-    - .gdk-with-load-balancer-setup
-    - .with-parallel
+  extends: gdk-instance
   variables:
-    QA_SCENARIO: Test::Instance::All
-    QA_RUN_TYPE: gdk-instance
+    WITH_LOAD_BALANCER: "true"
   rules:
     - !reference [".rules:test:never-schedule-pipeline", rules]
     - !reference [".rules:test:gdk-load-balancer-changes", rules]
 
-
 # ==========================================
 # Post test stage
 # ==========================================
@@ -178,13 +128,13 @@ upload-test-runtime-data:
   extends:
     - .upload-test-runtime-data
     - .rules:report:upload-test-runtime-data
-  variables:
-    QA_KNAPSACK_REPORT_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/knapsack/*/*.json
 
 export-test-metrics:
   extends:
     - .export-test-metrics
     - .rules:report:process-results
+  variables:
+    QA_METRICS_REPORT_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/test-metrics-*.json
 
 export-code-paths-mapping:
   extends:

.gitlab/ci/test-on-omnibus-nightly/main.gitlab-ci.yml

@@ -6,7 +6,7 @@ include:
 
 workflow:
   rules:
-    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $SCHEDULE_TYPE == "nightly"'
+    - when: always
 
 # ==========================================
 # Prepare stage
@@ -103,7 +103,6 @@ relative-url:
 # ------------------------------------------
 # Registry with CDN
 # ------------------------------------------
-
 registry-with-cdn:
   extends:
     - .qa
@@ -118,7 +117,6 @@ registry-with-cdn:
 # ------------------------------------------
 # Object Storage with MiniO
 # ------------------------------------------
-
 object-storage:
   extends:
     - .qa
@@ -130,7 +128,6 @@ object-storage:
 # ------------------------------------------
 # Object Storage with AWS
 # ------------------------------------------
-
 object-storage-aws:
   extends:
     - object-storage
@@ -144,7 +141,6 @@ object-storage-aws:
 # ------------------------------------------
 # Object Storage with GCS
 # ------------------------------------------
-
 object-storage-gcs:
   extends:
     - object-storage
@@ -182,14 +178,9 @@ gitlab-pages:
     - .qa
   variables:
     QA_SCENARIO: Test::Integration::GitlabPages
-  rules:
-    - !reference [.rules:test:qa, rules]
-    - if: $QA_SUITES =~ /Test::Instance::GitlabPages/
-    - !reference [.rules:test:manual, rules]
 
 # ========== git sha256 enabled ===========
 git-sha256-repositories:
-  when: manual
   extends:
     - .parallel
     - .qa
@@ -198,9 +189,6 @@ git-sha256-repositories:
     QA_SCENARIO: Test::Instance::Image
     QA_USE_SHA256_REPOSITORY_OBJECT_STORAGE: true
     GITLAB_QA_OPTS: "--enable-feature support_sha256_repositories"
-  rules:
-    - !reference [.rules:test:qa-parallel, rules]
-    - if: $QA_SUITES =~ /Test::Instance::All/
 
 # ========== Update From Previous with AI components ===========
 update-minor-ee-ai-components: