.browserslistrc

 #
 # This list of browsers is a conservative definition, based on
-# https://docs.gitlab.com/ee/install/requirements.html#supported-web-browsers
-# with the following reasoning:
+# https://docs.gitlab.com/ee/install/requirements.html#supported-web-browsers. We
+# also use the following reasoning to choose the target versions:
 #
-# - We should support the latest ESR of Firefox: 91, because it used quite a lot.
-# - We use Edge/Chrome >= 92 because they are about as old as the Firefox ESR
-# - Safari 14.1 because it is the current minor version of the previous major version
+# - Actual Browser usage on gitlab.com
+# - Support second latest version of Firefox ESR
+# - Support Chrome / Edge versions about the same age as the Firefox ESR version chosen
+#
+# If need be we raise versions closer to the actual supported web browsers.
 #
 # See also this epic: https://gitlab.com/groups/gitlab-org/-/epics/3957
 #
-chrome >= 92
-edge >= 92
-firefox >= 91
-safari >= 14.1
+chrome >= 103
+edge >= 103
+firefox >= 102
+safari >= 15.6
\ No newline at end of file
+

.gitlab-ci.yml

@@ -124,7 +124,7 @@ workflow:
         PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
     # This work around https://gitlab.com/gitlab-org/gitlab/-/issues/332411 which prevents usage of dependency proxy
     # when pipeline is triggered by a project access token.
-    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $GITLAB_USER_LOGIN =~ /project_\d+_bot\d*/'
+    - if: '$GITLAB_USER_LOGIN =~ /project_\d+_bot\d*/'
       variables:
         <<: [*default-ruby-variables, *default-branch-pipeline-failure-variables]
         GITLAB_DEPENDENCY_PROXY_ADDRESS: ""
@@ -163,7 +163,7 @@ workflow:
 
 variables:
   PG_VERSION: "14"
-  DEFAULT_CI_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}.patched-golang-${GO_VERSION}-rust-${RUST_VERSION}-node-18.17-postgresql-${PG_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-2.36-lfs-2.9-chrome-${CHROME_VERSION}-yarn-1.22-graphicsmagick-1.3.36"
+  DEFAULT_CI_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}.patched-golang-${GO_VERSION}-rust-${RUST_VERSION}-node-${NODE_VERSION}-postgresql-${PG_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-2.36-lfs-2.9-chrome-${CHROME_VERSION}-yarn-1.22-graphicsmagick-1.3.36"
   # We set $GITLAB_DEPENDENCY_PROXY to another variable (since it's set at the group level and has higher precedence than .gitlab-ci.yml)
   # so that we can override $GITLAB_DEPENDENCY_PROXY_ADDRESS in workflow rules.
   GITLAB_DEPENDENCY_PROXY_ADDRESS: "${GITLAB_DEPENDENCY_PROXY}"
@@ -188,7 +188,8 @@ variables:
   DOCKER_VERSION: "24.0.5"
   RUBYGEMS_VERSION: "3.4"
   BUNDLER_VERSION: "2.5"
-  GO_VERSION: "1.20"
+  GO_VERSION: "1.21"
+  NODE_VERSION: "20.12"
   RUST_VERSION: "1.73"
 
   FLAKY_RSPEC_SUITE_REPORT_PATH: rspec/flaky/report-suite.json

.gitlab/ci/as-if-foss.gitlab-ci.yml

@@ -32,7 +32,7 @@ prepare-as-if-foss-branch:
     - git add -A
     # --allow-empty accounts for the edge case where FOSS matchess EE repository
     # and a merge request only contains EE related changes.
-    - git commit -m 'Update from merge request' --allow-empty # TODO: Mark which SHA we add
+    - git commit -m 'Update from merge request' --allow-empty  # TODO: Mark which SHA we add
     - git push -f "${FOSS_REPOSITORY}" "${AS_IF_FOSS_BRANCH}"
 
 prepare-as-if-foss-env:

.gitlab/ci/frontend.gitlab-ci.yml

@@ -3,7 +3,7 @@
     - .default-retry
     - .default-before_script
     - .assets-compile-cache
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}-node-18.17:rubygems-${RUBYGEMS_VERSION}-git-2.33-lfs-2.9-yarn-1.22-graphicsmagick-1.3.36
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}-node-${NODE_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-2.33-lfs-2.9-yarn-1.22-graphicsmagick-1.3.36
   variables:
     SETUP_DB: "false"
     WEBPACK_VENDOR_DLL: "true"
@@ -73,7 +73,7 @@ compile-test-assets:
     expire_in: 7d
     paths:
       - public/assets/
-      - config/helpers/tailwind/ # Assets created during tailwind compilation
+      - config/helpers/tailwind/  # Assets created during tailwind compilation
       - "${WEBPACK_COMPILE_LOG_PATH}"
     when: always
 
@@ -174,7 +174,7 @@ retrieve-frontend-fixtures:
 rspec-all frontend_fixture:
   extends:
     - .frontend-fixtures-base
-    - .frontend:rules:default-frontend-jobs
+    - .frontend:rules:frontend_fixture
   needs:
     - !reference [.frontend-fixtures-base, needs]
     - "compile-test-assets"
@@ -251,6 +251,7 @@ graphql-schema-dump:
 .vue3:
   variables:
     VUE_VERSION: 3
+    NODE_OPTIONS: --max-old-space-size=7680
   allow_failure: true
 
 .jest-base:
@@ -294,7 +295,7 @@ jest predictive:
 jest predictive as-if-foss:
   extends:
     - .jest-base
-    - .frontend:rules:jest:predictive:as-if-foss
+    - .frontend:rules:jest:predictive-as-if-foss
     - .as-if-foss
   needs:
     - "rspec-all frontend_fixture as-if-foss"
@@ -305,7 +306,7 @@ jest predictive as-if-foss:
 jest-integration:
   extends:
     - .frontend-test-base
-    - .frontend:rules:default-frontend-jobs
+    - .frontend:rules:jest-integration
   script:
     - run_timed_command "yarn jest:integration --ci"
   needs: ["rspec-all frontend_fixture", "graphql-schema-dump"]
@@ -313,7 +314,7 @@ jest-integration:
 jest-snapshot-vue3:
   extends:
     - .jest-base
-    - .frontend:rules:jest-snapshot
+    - .frontend:rules:jest-snapshot-vue3
   needs: ["rspec-all frontend_fixture"]
   variables:
     VUE_VERSION: 3
@@ -428,7 +429,7 @@ bundle-size-review:
 compile-storybook:
   extends:
     - .compile-storybook-base
-    - .frontend:rules:default-frontend-jobs
+    - .frontend:rules:compile-storybook
   needs:
     - !reference [.compile-storybook-base, needs]
     - job: "rspec-all frontend_fixture"

.gitlab/ci/global.gitlab-ci.yml

@@ -197,6 +197,7 @@
     BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES: "true"
     BUNDLE_SILENCE_ROOT_WARNING: "true"
     BUNDLE_PATH: vendor
+    BUNDLE_WITHOUT: development
 
 .qa-cache:
   <<: *qa-bundler-variables
@@ -305,6 +306,22 @@
     - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.8
       alias: zoekt-ci-image
 
+.ai-gateway-variables:
+  variables:
+    AIGW_AUTH__BYPASS_EXTERNAL: true
+    AIGW_VERTEX_TEXT_MODEL__PROJECT: $VERTEX_AI_PROJECT
+    AIGW_VERTEX_TEXT_MODEL__JSON_KEY: $VERTEX_AI_CREDENTIALS
+    AIGW_FASTAPI__DOCS_URL: "/docs"
+    AIGW_FASTAPI__OPENAPI_URL: "/openapi.json"
+    AIGW_FASTAPI__API_PORT: 5052
+    ANTHROPIC_API_KEY: $ANTHROPIC_API_KEY_FOR_SERVICE
+    # CI_DEBUG_SERVICES: "true" # Enable this variable when you debug ai-gateway boot failure.
+
+.ai-gateway-services:
+  services:
+    - name: registry.gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/model-gateway:latest
+      alias: ai-gateway
+
 .use-pg13:
   extends:
     - .pg-base-variables
@@ -359,9 +376,11 @@
   extends:
     - .use-pg14
     - .zoekt-variables
+    - .ai-gateway-variables
   services:
     - !reference [.db-services-with-auto-explain, services]
     - !reference [.es7-services, services]
+    - !reference [.ai-gateway-services, services]
 
 .use-pg15-es7-ee:
   extends:

.gitlab/ci/includes/gitlab-com/danger-review.gitlab-ci.yml

 include:
   - project: gitlab-org/quality/pipeline-common
-    ref: 8.5.1
+    ref: 8.6.1
     file:
       - /ci/danger-review.yml
 

.gitlab/ci/qa-common/main.gitlab-ci.yml

@@ -5,7 +5,7 @@ workflow:
   name: $PIPELINE_NAME
 
 include:
-  - component: "gitlab.com/gitlab-org/quality/pipeline-common/allure-report@8.5.1"
+  - component: "gitlab.com/gitlab-org/quality/pipeline-common/allure-report@8.9.0"
     inputs:
       job_name: "e2e-test-report"
       job_stage: "report"
@@ -15,7 +15,7 @@ include:
       gitlab_auth_token_variable_name: "PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE"
       allure_job_name: "${QA_RUN_TYPE}"
   - project: gitlab-org/quality/pipeline-common
-    ref: 8.5.1
+    ref: 8.9.0
     file:
       - /ci/base.gitlab-ci.yml
       - /ci/knapsack-report.yml
@@ -42,6 +42,7 @@ stages:
   variables:
     BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES: "true"
     BUNDLE_SILENCE_ROOT_WARNING: "true"
+    BUNDLE_WITHOUT: development
 
 .qa-install:
   extends:
@@ -59,7 +60,6 @@ stages:
   extends:
     - .bundler-variables
     - .qa-base
-    - .gitlab-qa-report
   stage: test
   tags:
     - e2e

.gitlab/ci/qa-common/variables.gitlab-ci.yml

@@ -14,3 +14,5 @@ variables:
   # Used by gitlab-qa to set up a volume for `${CI_PROJECT_DIR}/qa/rspec:/home/gitlab/qa/rspec/`
   QA_RSPEC_REPORT_PATH: "${CI_PROJECT_DIR}/qa/rspec"
   QA_OMNIBUS_MR_TESTS: "only-smoke-reliable"
+  # Retry failed specs in separate process
+  QA_RETRY_FAILED_SPECS: "true"

.gitlab/ci/rails.gitlab-ci.yml

@@ -653,6 +653,7 @@ rspec-ee:predictive:trigger:
     - .rspec-ee-base-pg14
   variables:
     REAL_AI_REQUEST: "true"
+    AI_GATEWAY_URL: http://ai-gateway:5052
 
 rspec-ee unit gitlab-duo-chat-zeroshot pg14:
   extends:

.gitlab/ci/rails/shared.gitlab-ci.yml

@@ -92,7 +92,7 @@ include:
     - source scripts/utils.sh
     - bundle exec gem list gitlab_quality-test_tooling
     - |
-      section_start "relate-failure-issue" "Report test failures"
+      section_start "failed-test-issues" "Report test failures"
       if [ "$CREATE_RAILS_TEST_FAILURE_ISSUES" == "true" ]; then
         input_file="rspec/rspec-${CI_JOB_ID}.json"
 
@@ -101,15 +101,14 @@ include:
           input_file="rspec/rspec-retry-${CI_JOB_ID}.json"
         fi
 
-        bundle exec relate-failure-issue \
+        bundle exec failed-test-issues \
           --token "${TEST_FAILURES_PROJECT_TOKEN}" \
           --project "gitlab-org/gitlab" \
           --input-files "${input_file}" \
-          --exclude-labels-for-search "QA,rspec:slow test,knapsack_report" \
-          --system-log-files "log" \
+          --exclude-labels-for-search "QA,knapsack_report" \
           --related-issues-file "rspec/${CI_JOB_ID}-failed-test-issues.json";
       fi
-      section_end "relate-failure-issue"
+      section_end "failed-test-issues"
     - |
       section_start "flaky-test-issues" "Report test flakiness"
       if [ "$CREATE_RAILS_FLAKY_TEST_ISSUES" == "true" ] && [ -f "rspec/rspec-retry-${CI_JOB_ID}.json" ]; then

.gitlab/ci/reports.gitlab-ci.yml

@@ -10,6 +10,8 @@ code_quality:
     - .use-docker-in-docker
     - .code-quality-cache-push
   stage: lint
+  # P95 duration for this job has been 14min from 2023-04-01 until 2024-04-01
+  timeout: 15m
   artifacts:
     paths:
       - gl-code-quality-report.json  # GitLab-specific

.gitlab/ci/rules.gitlab-ci.yml

@@ -283,17 +283,6 @@
   - "fixtures/emojis/**/*"
   - "vendor/assets/**/*"
 
-.frontend-patterns-for-as-if-foss: &frontend-patterns-for-as-if-foss
-  - "{package.json,yarn.lock}"
-  - ".browserslistrc"
-  - "babel.config.js"
-  - "jest.config.{base,integration,unit}.js"
-  - ".stylelintrc"
-  - "Dockerfile.assets"
-  - "config/**/*.js"
-  - "vendor/assets/**/*"
-  - "{app/assets,app/components,app/helpers,app/presenters,app/views,locale,public,spec/frontend,storybook,symbol}/**/*"
-
 .initializers-patterns: &initializers-patterns
   - "{,ee/,jh/}config/initializers/**/*"
 
@@ -412,6 +401,14 @@
   - "{,jh/}qa/**/*"
   - ".gitlab/ci/{package-and-test,qa-common,test-on-cng,test-on-gdk}/*"
 
+# See https://gitlab.com/gitlab-org/quality/engineering-productivity/team/-/issues/470
+# for the reasons why we only match those patterns.
+.frontend-predictive-patterns: &frontend-predictive-patterns
+  - "{,ee/,jh/}{app/assets/javascripts,spec/frontend}/**/*"
+
+.frontend-predictive-patterns-as-if-foss: &frontend-predictive-patterns-as-if-foss
+  - "{app/assets/javascripts,spec/frontend}/**/*"
+
 # Frontend view patterns + .qa-patterns
 .frontend-qa-patterns: &frontend-qa-patterns
   - "{,ee/,jh/}{app/assets,app/components,app/helpers,app/presenters,app/views}/**/*"
@@ -427,6 +424,7 @@
   - "{,jh/}Gemfile{,.lock}"
   - "{package.json,yarn.lock}"
   - "*_VERSION"
+  - "lib/gitlab/redis/*"
   - "babel.config.js"
   - "config.ru"
   - "Dockerfile.assets"
@@ -955,18 +953,26 @@
     - <<: *if-default-branch-schedule-nightly  # already executed in the 2-hourly schedule
       when: never
     - <<: *if-default-branch-refs
+    - <<: *if-merge-request-labels-run-all-e2e
+    - <<: *if-merge-request-labels-run-cs-evaluation
+    - <<: *if-force-ci
+      when: manual
+    # The rest is included to be consistent with .qa:rules:e2e:test-on-gdk
+    # Run tests automatically for MRs that touch QA files
     - <<: *if-merge-request
-      changes: *gdk-component-patterns
-    # The rest are included to be consistent with .qa:rules:e2e:test-on-gdk
+      changes: *qa-patterns
+    # Otherwise, only run tests after the MR is approved
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-merge-request-targeting-stable-branch
       changes: *setup-test-env-patterns
     - <<: *if-ruby-branch
     # We include the job under the matching conditions below, but unlike in .qa:rules:e2e:test-on-gdk we don't need to
     # set OMNIBUS_GITLAB_BUILD_ON_ALL_OS when testing against GDK
+    - <<: *if-merge-request
+      changes: *gdk-component-patterns
     - <<: *if-merge-request
       changes: *dependency-patterns
-    - <<: *if-merge-request-labels-run-all-e2e
-    - <<: *if-merge-request-labels-run-cs-evaluation
     - <<: *if-merge-request
       changes: *feature-flag-development-config-patterns
     - <<: *if-merge-request
@@ -975,12 +981,8 @@
       changes: *nodejs-patterns
     - <<: *if-merge-request
       changes: *ci-qa-patterns
-    - <<: *if-security-merge-request
-      changes: *code-patterns
     - <<: *if-merge-request
       changes: *code-qa-patterns
-    - <<: *if-force-ci
-      when: manual
 
 .build-images:rules:build-assets-image:
   rules:
@@ -1273,26 +1275,70 @@
     - <<: *if-default-refs
       changes: *code-backstage-patterns
 
-.frontend:rules:default-frontend-jobs-as-if-foss:
+# .frontend:rules:default-frontend-jobs, with a additional rules when MR is not approved
+.frontend:rules:frontend_fixture:
   rules:
-    - !reference [".strict-ee-only-rules", rules]
+    # From .frontend:rules:default-frontend-jobs
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
-    - <<: *if-security-merge-request
+    - <<: *if-fork-merge-request
       changes: *code-backstage-patterns
-    - <<: *if-merge-request-labels-as-if-foss
+    - if: '$ENABLE_RSPEC_FRONTEND_FIXTURE == "true"'
     - <<: *if-merge-request-labels-run-all-rspec
+    # From .frontend:rules:jest
+    - <<: *if-automated-merge-request
+      changes: *code-backstage-patterns
+    - <<: *if-security-merge-request
+      changes: *code-backstage-patterns
+    - <<: *if-merge-request-labels-run-all-jest
+    - <<: *if-merge-request-labels-frontend-and-feature-flag
     - <<: *if-merge-request
-      changes: *frontend-patterns-for-as-if-foss
+      changes: *frontend-dependency-patterns
+    - <<: *if-merge-request
+      changes: [".gitlab/ci/frontend.gitlab-ci.yml"]
+    # From .frontend:rules:jest-snapshot-vue3
+    - <<: *if-merge-request
+      changes: [".gitlab/ci/rules.gitlab-ci.yml", ".gitlab/ci/frontend.gitlab-ci.yml"]
+    # Rules for `jest predictive` jobs
+    - <<: *if-merge-request-not-approved
+      changes: *frontend-predictive-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    # From .frontend:rules:default-frontend-jobs
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+
+# .frontend:rules:default-frontend-jobs, with a additional rules when MR is not approved
+.frontend:rules:compile-storybook:
+  rules:
+    # From .frontend:rules:default-frontend-jobs
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - if: '$ENABLE_COMPILE_STORYBOOK == "true"'
+    - <<: *if-merge-request-labels-run-all-rspec
+    - <<: *if-merge-request-labels-frontend-and-feature-flag
+    # If the MR isn't approved, only run when jest predictive jobs would
+    - <<: *if-merge-request-not-approved
+      changes: *frontend-predictive-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    # From .frontend:rules:default-frontend-jobs
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
 
 .frontend:rules:frontend_fixture-as-if-foss:
   rules:
     - !reference [".strict-ee-only-rules", rules]
-    - !reference [".frontend:rules:default-frontend-jobs-as-if-foss", rules]
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-merge-request-labels-as-if-foss
+    - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-merge-request-labels-run-all-jest
     - <<: *if-merge-request-labels-frontend-and-feature-flag
+    - <<: *if-security-merge-request
+      changes: *code-backstage-patterns
     - <<: *if-merge-request
-      changes: *frontend-patterns-for-as-if-foss
+      changes: *frontend-predictive-patterns-as-if-foss
 
 .frontend:rules:upload-frontend-fixtures:
   rules:
@@ -1305,6 +1351,8 @@
       when: never
     - <<: *if-dot-com-gitlab-org-default-branch
       changes: *code-backstage-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-dot-com-gitlab-org-merge-request
       changes:
         - ".gitlab/ci/frontend.gitlab-ci.yml"
@@ -1345,12 +1393,30 @@
       changes: *frontend-dependency-patterns
       when: never
     - <<: *if-merge-request
-      changes: [".gitlab/ci/frontend.gitlab-ci.yml"] # When this file is modified, we run full Jest jobs
+      changes: [".gitlab/ci/frontend.gitlab-ci.yml"]  # When this file is modified, we run full Jest jobs
       when: never
     - <<: *if-merge-request
+      changes: *frontend-predictive-patterns
+
+# .frontend:rules:default-frontend-jobs, with a additional rules when MR is not approved
+.frontend:rules:jest-integration:
+  rules:
+    # From .frontend:rules:default-frontend-jobs
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - if: '$ENABLE_JEST_INTEGRATION == "true"'
+    - <<: *if-merge-request-labels-run-all-rspec
+    - <<: *if-merge-request-labels-frontend-and-feature-flag
+    # If the MR isn't approved, only run when jest predictive jobs would
+    - <<: *if-merge-request-not-approved
+      changes: *frontend-predictive-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    # From .frontend:rules:default-frontend-jobs
+    - <<: *if-default-refs
       changes: *code-backstage-patterns
 
-.frontend:rules:jest:predictive:as-if-foss:
+.frontend:rules:jest:predictive-as-if-foss:
   rules:
     - !reference [".strict-ee-only-rules", rules]
     - !reference [".frontend:rules:predictive-default-rules", rules]
@@ -1362,7 +1428,7 @@
     - <<: *if-fork-merge-request
       when: never
     - <<: *if-merge-request
-      changes: *frontend-patterns-for-as-if-foss
+      changes: *frontend-predictive-patterns-as-if-foss
 
 .frontend:rules:coverage-frontend:
   rules:
@@ -1388,7 +1454,7 @@
       changes: *frontend-build-patterns
       allow_failure: true
 
-.frontend:rules:jest-snapshot:
+.frontend:rules:jest-snapshot-vue3:
   rules:
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
@@ -1667,6 +1733,8 @@
     - <<: *if-fork-merge-request
       when: never
     - <<: *if-merge-request-labels-run-cs-evaluation
+    - <<: *if-merge-request-not-approved
+      when: never
 
 .qa:rules:code-suggestions-eval:
   rules:
@@ -1753,7 +1821,7 @@
 # These provide a manual way to trigger follow-up:e2e:package-and-test-ee
 # It is fine if they're overlapping with the automatic ones.
 # It'll not hurt and it can simplify the rules, decoupling them.
-# If any changes are made to this rule, `.qa:rules:manual-e2e` should also be updated.
+# If any changes are made to this rule, `.qa:rules:follow-up-e2e` should also be updated.
 .qa:rules:manual-e2e:
   rules:
     - !reference [".qa:rules:package-and-test-never-run", rules]
@@ -1761,7 +1829,8 @@
       when: never
     - !reference [".qa:rules:code-merge-request-manual", rules]
 
-# These are based on `.qa:rules:manual-e2e` but with manual jobs changed to automatic
+# These are based on `.qa:rules:manual-e2e` but with manual jobs changed to automatic.
+# If any changes are made to this rule, `.qa:rules:manual-e2e` should also be updated.
 .qa:rules:follow-up-e2e:
   rules:
     - !reference [".qa:rules:package-and-test-never-run", rules]
@@ -2786,7 +2855,7 @@
 
 .setup:rules:set-pipeline-name:
   rules:
-    - <<: *if-not-merge-request # This is only designed to run in a merge request
+    - <<: *if-not-merge-request  # This is only designed to run in a merge request
       when: never
     - if: '$PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE == null'
       when: never
@@ -2873,6 +2942,8 @@
       changes:
         - ".gitlab/ci/test-metadata.gitlab-ci.yml"
         - "scripts/rspec_helpers.sh"
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-merge-request
       changes:
         - "scripts/flaky_examples/prune-old-flaky-examples"
@@ -2913,7 +2984,6 @@
 # .build-images:rules:build-qa-image-merge-requests
 # .build-images:rules:build-assets-image
 # .frontend:rules:compile-production-assets
-# .frontend:rules:default-frontend-jobs-as-if-foss
 # .rails:rules:single-db
 # .rails:rules:single-db-ci-connection
 # .rails:rules:single-redis
@@ -3198,7 +3268,7 @@
       when: never
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
-    - !reference [".releases:rules:canonical-dot-com-gitlab-stable-branch-only-setup-test-env", rules]
+    - !reference [".releases:rules:canonical-dot-com-gitlab-stable-branch-only", rules]
 
 ###################
 # Benchmark rules #

.gitlab/ci/templates/gem.gitlab-ci.yml

@@ -18,11 +18,11 @@ spec:
         - ".gitlab/ci/gitlab-gems.gitlab-ci.yml"
         - ".gitlab/ci/vendored-gems.gitlab-ci.yml"
         - ".gitlab/ci/templates/gem.gitlab-ci.yml"
-          # Ensure dependency updates don't fail child pipelines: https://gitlab.com/gitlab-org/gitlab/-/issues/417428
+        # Ensure dependency updates don't fail child pipelines: https://gitlab.com/gitlab-org/gitlab/-/issues/417428
         - "Gemfile.lock"
         - "gems/gem.gitlab-ci.yml"
         - "gems/gem-pg.gitlab-ci.yml"
-          # Ensure new cop in the monolith don't break internal gems Rubocop checks: https://gitlab.com/gitlab-org/gitlab/-/issues/419915
+        # Ensure new cop in the monolith don't break internal gems Rubocop checks: https://gitlab.com/gitlab-org/gitlab/-/issues/419915
         - ".rubocop.yml"
         - "rubocop/**/*"
         - ".rubocop_todo/**/*"

.gitlab/ci/test-on-cng/main.gitlab-ci.yml

@@ -37,6 +37,7 @@ workflow:
     GITLAB_ADMIN_PASSWORD: 5iveL!fe
     GITLAB_QA_ADMIN_ACCESS_TOKEN: $QA_ADMIN_ACCESS_TOKEN
     KNAPSACK_TEST_FILE_PATTERN: ""
+    RSPEC_LAST_RUN_RESULTS_FILE: "$CI_PROJECT_DIR/qa/tmp/examples.txt"
     QA_DOCKER_NETWORK: host
     QA_GENERATE_ALLURE_REPORT: "true"
     QA_CAN_TEST_PRAEFECT: "false"
@@ -48,21 +49,19 @@ workflow:
     - export GITLAB_DOMAIN="$(getent hosts docker | awk '{ print $1 }' | head -n1).nip.io"
     - export QA_GITLAB_URL="http://gitlab.${GITLAB_DOMAIN}"
     - source scripts/utils.sh
+    - source scripts/rspec_helpers.sh
     - source scripts/qa/cng_deploy/cng-kind.sh
     - run_timed_command "setup_cluster scripts/qa/cng_deploy/config/kind-config.yml"
     - run_timed_command "deploy ${GITLAB_DOMAIN}"
     - cd qa && bundle install
   script:
-    - export QA_COMMAND="bundle exec bin/qa ${QA_SCENARIO:=Test::Instance::All} $QA_GITLAB_URL -- --force-color --order random --format documentation --format RspecJunitFormatter --out tmp/rspec-${CI_JOB_ID}-${QA_RSPEC_RETRIED:-false}.xml"
+    - export QA_COMMAND="bundle exec bin/qa ${QA_SCENARIO:=Test::Instance::All} $QA_GITLAB_URL -- --force-color --order random --format documentation"
     - echo "Running - '$QA_COMMAND'"
     - |
-      if eval "$QA_COMMAND"; then
+      if eval "$QA_COMMAND --format RspecJunitFormatter --out tmp/rspec-${CI_JOB_ID}.xml"; then
         echo "Test run finished successfully"
       else
-        export QA_RSPEC_RETRIED=true
-        export NO_KNAPSACK=true
-        echo "Initial test run failed, triggering retry of failed rspec tests"
-        eval "$QA_COMMAND --only-failures"
+        retry_failed_e2e_rspec_examples
       fi
   after_script:
     - source scripts/qa/cng_deploy/cng-kind.sh

.gitlab/ci/test-on-gdk/main.gitlab-ci.yml

@@ -8,10 +8,6 @@ include:
 .code-pattern-changes: &code-pattern-changes
   if: $MR_CODE_PATTERNS == "true"
 
-# Run all tests when QA framework changes present, full suite execution is explicitly enabled or a feature flag file is removed
-.qa-run-all-tests: &qa-run-all-tests
-  if: $QA_FRAMEWORK_CHANGES == "true" || $QA_RUN_ALL_TESTS == "true" || $QA_RUN_ALL_E2E_LABEL == "true" || $QA_FEATURE_FLAGS =~ /deleted/
-
 .rules:gdk:qa-selective:
   rules:
     - <<: *code-pattern-changes
@@ -31,18 +27,6 @@ include:
     - if: $QA_SUITES =~ /Test::Instance::Blocking/
     - !reference [.rules:test:manual, rules]
 
-.rules:gdk:qa-smoke:
-  rules:
-    - <<: *code-pattern-changes
-      variables:
-        QA_TESTS: ""
-        KNAPSACK_TEST_FILE_PATTERN: ""
-    - <<: *qa-run-all-tests
-      variables:
-        QA_TESTS: ""
-    - if: $QA_SUITES =~ /Test::Instance::Smoke/
-    - !reference [.rules:test:manual, rules]
-
 .rules:test:gdk-load-balancer-changes:
   rules:
     - when: manual
@@ -51,6 +35,9 @@ include:
         - ".gitlab/ci/test-on-gdk/**"
         - "lib/gitlab/database/load_balancing/**/*"
 
+.with-parallel:
+  parallel: 15
+
 .with-gdk-log:
   after_script:
     - mv $CI_BUILDS_DIR/*.log $CI_PROJECT_DIR/
@@ -82,23 +69,22 @@ include:
     GITLAB_QA_ADMIN_ACCESS_TOKEN: $QA_ADMIN_ACCESS_TOKEN
     GDK_URL: http://gdk.test:3000
     FF_NETWORK_PER_BUILD: "true"
+    RSPEC_LAST_RUN_RESULTS_FILE: "$CI_PROJECT_DIR/qa/tmp/examples.txt"
   before_script:
     - echo "SUITE_RAN=true" > "$QA_SUITE_STATUS_ENV_FILE"
     - echo -e "\e[0Ksection_start:`date +%s`:install_gems[collapsed=true]\r\e[0KInstall gems"
     - source scripts/utils.sh
-    - cd qa && bundle config set --local without 'development' && bundle install
+    - source scripts/rspec_helpers.sh
+    - cd qa && bundle install
     - echo -e "\e[0Ksection_end:`date +%s`:install_gems\r\e[0K"
   script:
-    - export QA_COMMAND="bundle exec bin/qa ${QA_SCENARIO:=Test::Instance::All} $GDK_URL $GITLAB_QA_OPTS -- $QA_TESTS --order random --force-color --format documentation --format RspecJunitFormatter --out tmp/rspec-${CI_JOB_ID}-${QA_RSPEC_RETRIED:-false}.xml --format QA::Support::JsonFormatter --out tmp/rspec-${CI_JOB_ID}-${QA_RSPEC_RETRIED:-false}.json"
+    - export QA_COMMAND="bundle exec bin/qa ${QA_SCENARIO:=Test::Instance::All} $GDK_URL $GITLAB_QA_OPTS -- $QA_TESTS --order random --force-color --format documentation --format QA::Support::JsonFormatter --out tmp/rspec-${CI_JOB_ID}-\${QA_RSPEC_RETRIED:-false}.json"
     - echo "Running - '$QA_COMMAND'"
     - |
-      if eval "$QA_COMMAND"; then
+      if eval "$QA_COMMAND --format RspecJunitFormatter --out tmp/rspec-${CI_JOB_ID}.xml"; then
         echo "Test run finished successfully"
       else
-        export QA_RSPEC_RETRIED=true
-        export NO_KNAPSACK=true
-        echo "Initial test run failed, triggering retry of failed rspec tests"
-        eval "$QA_COMMAND --only-failures"
+        retry_failed_e2e_rspec_examples
       fi
   after_script:
     - !reference [.with-gdk-log, after_script]
@@ -144,22 +130,14 @@ download-knapsack-report:
 # ------------------------------------------
 # Blocking tests
 # ------------------------------------------
-gdk-qa-smoke:
-  extends:
-    - .gdk-qa-base
-    - .rules:gdk:qa-smoke
-  variables:
-    QA_SCENARIO: Test::Instance::Smoke
-    QA_RUN_TYPE: gdk-qa-smoke
-
 gdk-qa-blocking:
   extends:
     - .gdk-qa-base
+    - .with-parallel
     - .rules:gdk:qa-parallel
   variables:
     QA_SCENARIO: Test::Instance::Blocking
     QA_RUN_TYPE: gdk-qa-blocking
-  parallel: 10
 
 gdk-qa-blocking-ff-inverse:
   extends: gdk-qa-blocking
@@ -167,7 +145,6 @@ gdk-qa-blocking-ff-inverse:
     QA_FEATURE_FLAGS: $FEATURE_FLAGS
   rules:
     - !reference [.rules:test:feature-flags-set, rules]
-  parallel: 10
 
 gdk-qa-blocking-selective:
   extends:
@@ -180,32 +157,15 @@ gdk-qa-blocking-selective:
 # ------------------------------------------
 # Non Blocking tests
 # ------------------------------------------
-gdk-qa-smoke-with-load-balancer:
-  extends:
-    - .gdk-qa-base
-    - .gdk-with-load-balancer-setup
-    - .with-gdk-log
-  variables:
-    QA_SCENARIO: Test::Instance::Smoke
-    QA_RUN_TYPE: gdk-qa-smoke
-  artifacts:
-    paths:
-      - gdk.log
-    reports:
-      dotenv: ""
-  rules:
-    - !reference [".rules:test:never-schedule-pipeline", rules]
-    - !reference [".rules:test:gdk-load-balancer-changes", rules]
-
 gdk-qa-blocking-with-load-balancer:
   extends:
     - .gdk-qa-base
     - .gdk-with-load-balancer-setup
     - .with-gdk-log
+    - .with-parallel
   variables:
     QA_SCENARIO: Test::Instance::Blocking
     QA_RUN_TYPE: gdk-qa-blocking
-  parallel: 5
   artifacts:
     paths:
       - log

.nvmrc

-18.17.0
+20.12.2
\ No newline at end of file

.rubocop_todo/factory_bot/create_list.yml

----
-# Cop supports --autocorrect.
-FactoryBot/CreateList:
-  Exclude:
-    - 'ee/spec/controllers/ee/search_controller_spec.rb'
-    - 'ee/spec/controllers/projects/licenses_controller_spec.rb'
-    - 'ee/spec/factories/geo_nodes.rb'
-    - 'ee/spec/features/projects/environments/environments_spec.rb'
-    - 'ee/spec/features/projects/licenses/maintainer_views_policies_spec.rb'
-    - 'ee/spec/finders/security/findings_finder_spec.rb'
-    - 'ee/spec/finders/security/pipeline_vulnerabilities_finder_spec.rb'
-    - 'ee/spec/frontend/fixtures/dast_profiles.rb'
-    - 'ee/spec/frontend/fixtures/merge_requests.rb'
-    - 'ee/spec/graphql/types/pipeline_security_report_finding_type_spec.rb'
-    - 'ee/spec/helpers/ee/branches_helper_spec.rb'
-    - 'ee/spec/lib/ee/gitlab/background_migration/migrate_approver_to_approval_rules_spec.rb'
-    - 'ee/spec/lib/ee/gitlab/usage_data_spec.rb'
-    - 'ee/spec/lib/gitlab/ci/reports/security/vulnerability_reports_comparer_spec.rb'
-    - 'ee/spec/lib/gitlab/license_scanning/sbom_scanner_spec.rb'
-    - 'ee/spec/models/approval_project_rule_spec.rb'
-    - 'ee/spec/models/ci/build_spec.rb'
-    - 'ee/spec/models/ee/project_spec.rb'
-    - 'ee/spec/models/geo_node_spec.rb'
-    - 'ee/spec/models/label_note_spec.rb'
-    - 'ee/spec/models/merge_request_spec.rb'
-    - 'ee/spec/models/merge_requests/external_status_check_spec.rb'
-    - 'ee/spec/models/preloaders/environments/protected_environment_preloader_spec.rb'
-    - 'ee/spec/models/protected_environment_spec.rb'
-    - 'ee/spec/models/sca/license_compliance_spec.rb'
-    - 'ee/spec/models/visible_approvable_spec.rb'
-    - 'ee/spec/models/vulnerabilities/finding_spec.rb'
-    - 'ee/spec/presenters/merge_request_presenter_spec.rb'
-    - 'ee/spec/requests/api/search_spec.rb'
-    - 'ee/spec/requests/api/status_checks_spec.rb'
-    - 'ee/spec/requests/projects/pipelines_controller_spec.rb'
-    - 'ee/spec/serializers/license_compliance/collapsed_comparer_entity_spec.rb'
-    - 'ee/spec/serializers/license_compliance/comparer_entity_spec.rb'
-    - 'ee/spec/services/approval_rules/params_filtering_service_spec.rb'
-    - 'ee/spec/services/ci/compare_license_scanning_reports_service_spec.rb'
-    - 'ee/spec/services/ci/sync_reports_to_approval_rules_service_spec.rb'
-    - 'ee/spec/services/ee/issuable/bulk_update_service_spec.rb'
-    - 'ee/spec/services/epics/epic_links/create_service_spec.rb'
-    - 'ee/spec/services/geo/node_update_service_spec.rb'
-    - 'ee/spec/services/iterations/roll_over_issues_service_spec.rb'
-    - 'ee/spec/services/members/activate_service_spec.rb'
-    - 'ee/spec/services/sbom/ingestion/tasks/ingest_components_spec.rb'
-    - 'ee/spec/services/sbom/ingestion/tasks/ingest_sources_spec.rb'
-    - 'ee/spec/services/security/findings/dismiss_service_spec.rb'
-    - 'ee/spec/services/security/ingestion/ingest_report_slice_service_spec.rb'
-    - 'ee/spec/services/security/ingestion/mark_as_resolved_service_spec.rb'
-    - 'ee/spec/services/vulnerabilities/find_or_create_from_security_finding_service_spec.rb'
-    - 'ee/spec/support/shared_examples/requests/api/graphql/issue_list_shared_examples.rb'
-    - 'spec/controllers/groups/children_controller_spec.rb'
-    - 'spec/features/groups/milestone_spec.rb'
-    - 'spec/features/projects/environments/environments_spec.rb'
-    - 'spec/finders/clusters/agent_tokens_finder_spec.rb'
-    - 'spec/graphql/resolvers/design_management/design_resolver_spec.rb'
-    - 'spec/helpers/branches_helper_spec.rb'
-    - 'spec/helpers/groups/group_members_helper_spec.rb'
-    - 'spec/lib/atlassian/jira_connect/serializers/repository_entity_spec.rb'
-    - 'spec/lib/gitlab/ci/reports/security/report_spec.rb'
-    - 'spec/lib/gitlab/usage_data_spec.rb'
-    - 'spec/mailers/repository_check_mailer_spec.rb'
-    - 'spec/models/ci/group_spec.rb'
-    - 'spec/models/concerns/issuable_spec.rb'
-    - 'spec/models/deploy_key_spec.rb'
-    - 'spec/models/group_spec.rb'
-    - 'spec/models/label_note_spec.rb'
-    - 'spec/models/note_spec.rb'
-    - 'spec/models/work_items/widgets/assignees_spec.rb'
-    - 'spec/models/work_items/widgets/labels_spec.rb'
-    - 'spec/requests/api/graphql/project/pipeline_spec.rb'
-    - 'spec/requests/api/protected_branches_spec.rb'
-    - 'spec/requests/api/protected_tags_spec.rb'
-    - 'spec/services/clusters/management/validate_management_project_permissions_service_spec.rb'
-    - 'spec/services/issuable/bulk_update_service_spec.rb'
-    - 'spec/services/issues/resolve_discussions_spec.rb'
-    - 'spec/services/merge_requests/assign_issues_service_spec.rb'
-    - 'spec/services/projects/fork_service_spec.rb'
-    - 'spec/support/shared_examples/models/concerns/bulk_users_by_email_load_shared_examples.rb'
-    - 'spec/support/shared_examples/requests/api/graphql/issue_list_shared_examples.rb'

.rubocop_todo/gitlab/namespaced_class.yml

@@ -770,7 +770,6 @@ Gitlab/NamespacedClass:
     - 'app/workers/pages_domain_verification_cron_worker.rb'
     - 'app/workers/pages_domain_verification_worker.rb'
     - 'app/workers/pages_worker.rb'
-    - 'app/workers/partition_creation_worker.rb'
     - 'app/workers/pipeline_hooks_worker.rb'
     - 'app/workers/pipeline_metrics_worker.rb'
     - 'app/workers/pipeline_notification_worker.rb'
@@ -1223,7 +1222,6 @@ Gitlab/NamespacedClass:
     - 'lib/gitlab/workhorse.rb'
     - 'lib/gitlab/zoom_link_extractor.rb'
     - 'lib/tasks/gitlab/seed/group_seed.rake'
-    - 'lib/tasks/import.rake'
     - 'lib/tasks/tokens.rake'
     - 'lib/uploaded_file.rb'
     - 'lib/version_check.rb'

.rubocop_todo/layout/line_length.yml

@@ -776,7 +776,6 @@ Layout/LineLength:
     - 'ee/app/graphql/types/security_report_summary_section_type.rb'
     - 'ee/app/graphql/types/vulnerabilities_count_by_day_type.rb'
     - 'ee/app/graphql/types/vulnerability/external_issue_link_external_tracker_enum.rb'
-    - 'ee/app/graphql/types/vulnerability_confidence_enum.rb'
     - 'ee/app/graphql/types/vulnerability_detail_type.rb'
     - 'ee/app/graphql/types/vulnerability_type.rb'
     - 'ee/app/helpers/admin/emails_helper.rb'
@@ -2703,7 +2702,6 @@ Layout/LineLength:
     - 'lib/tasks/gitlab/usage_data.rake'
     - 'lib/tasks/gitlab/user_management.rake'
     - 'lib/tasks/gitlab/workhorse.rake'
-    - 'lib/tasks/import.rake'
     - 'lib/tasks/migrate/schema_check.rake'
     - 'lib/tasks/tanuki_emoji.rake'
     - 'lib/tasks/test.rake'

.rubocop_todo/rake/require.yml

+---
+Rake/Require:
+  Details: grace period
+  Exclude:
+    - 'ee/lib/tasks/contracts/merge_requests.rake'
+    - 'lib/tasks/contracts/merge_requests.rake'
+    - 'lib/tasks/contracts/pipeline_schedules.rake'
+    - 'lib/tasks/contracts/pipelines.rake'
+    - 'lib/tasks/gitlab/artifacts/migrate.rake'
+    - 'lib/tasks/gitlab/backup.rake'
+    - 'lib/tasks/gitlab/cleanup.rake'
+    - 'lib/tasks/gitlab/docs/redirect.rake'
+    - 'lib/tasks/gitlab/graphql.rake'
+    - 'lib/tasks/gitlab/lfs/migrate.rake'
+    - 'lib/tasks/gitlab/openapi.rake'
+    - 'lib/tasks/import.rake'
+    - 'lib/tasks/tokens.rake'
+    - 'qa/tasks/ci.rake'