.gitlab-ci.yml

@@ -44,6 +44,7 @@ workflow:
     # For the 2-hourly scheduled pipelines, we set specific variables.
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $FREQUENCY == "2-hourly"'
       variables:
+        RUBY_VERSION: "2.7"
         CRYSTALBALL: "true"
     # For `$CI_DEFAULT_BRANCH` branch, create a pipeline (this includes on schedules, pushes, merges, etc.).
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
@@ -59,7 +60,7 @@ workflow:
 
 variables:
   PG_VERSION: "12"
-  DEFAULT_CI_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-${DEBIAN_VERSION}-ruby-2.7.patched-golang-1.17-node-16.14-postgresql-${PG_VERSION}:git-2.36-lfs-2.9-chrome-${CHROME_VERSION}-yarn-1.22-graphicsmagick-1.3.36"
+  DEFAULT_CI_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}.patched-golang-1.17-node-16.14-postgresql-${PG_VERSION}:git-2.36-lfs-2.9-chrome-${CHROME_VERSION}-yarn-1.22-graphicsmagick-1.3.36"
   RAILS_ENV: "test"
   NODE_ENV: "test"
   BUNDLE_WITHOUT: "production:development"
@@ -75,6 +76,7 @@ variables:
   DEBIAN_VERSION: "bullseye"
   CHROME_VERSION: "101"
   DOCKER_VERSION: "20.10.14"
+  RUBY_VERSION: "2.7"
 
   TMP_TEST_FOLDER: "${CI_PROJECT_DIR}/tmp/tests"
   GITLAB_WORKHORSE_FOLDER: "gitlab-workhorse"

.gitlab/ci/docs.gitlab-ci.yml

@@ -2,7 +2,7 @@
   extends:
     - .default-retry
     - .docs:rules:review-docs
-  image: ${GITLAB_DEPENDENCY_PROXY}ruby:2.7-alpine
+  image: ${GITLAB_DEPENDENCY_PROXY}ruby:${RUBY_VERSION}-alpine
   stage: review
   needs: []
   variables:
@@ -44,7 +44,7 @@ docs-lint markdown:
     - .default-retry
     - .docs:rules:docs-lint
   # When updating the image version here, update it in /scripts/lint-doc.sh too.
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.15-vale-2.16.1-markdownlint-0.31.1
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.16-vale-2.17.0-markdownlint-0.31.1
   stage: lint
   needs: []
   script:
@@ -53,7 +53,7 @@ docs-lint markdown:
 docs-lint links:
   extends:
     - .docs:rules:docs-lint
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-html:alpine-3.15-ruby-2.7.5-e6a8a48a
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-html:alpine-3.16-ruby-2.7.6-0bc327a4
   stage: lint
   needs: []
   script:

.gitlab/ci/frontend.gitlab-ci.yml

@@ -11,7 +11,7 @@
     - .default-retry
     - .default-before_script
     - .assets-compile-cache
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:debian-${DEBIAN_VERSION}-ruby-2.7-git-2.33-lfs-2.9-node-16.14-yarn-1.22-graphicsmagick-1.3.36
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}-git-2.33-lfs-2.9-node-16.14-yarn-1.22-graphicsmagick-1.3.36
   variables:
     SETUP_DB: "false"
     WEBPACK_VENDOR_DLL: "true"

.gitlab/ci/global.gitlab-ci.yml

@@ -18,7 +18,7 @@
     - source scripts/prepare_build.sh
 
 .ruby-gems-cache: &ruby-gems-cache
-  key: "ruby-gems-${DEBIAN_VERSION}"
+  key: "ruby-gems-debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}"
   paths:
     - vendor/ruby/
   policy: pull
@@ -28,7 +28,7 @@
   policy: push  # We want to rebuild the cache from scratch to ensure stale dependencies are cleaned up.
 
 .gitaly-ruby-gems-cache: &gitaly-ruby-gems-cache
-  key: "gitaly-ruby-gems-${DEBIAN_VERSION}"
+  key: "gitaly-ruby-gems-debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}"
   paths:
     - vendor/gitaly-ruby/
   policy: pull
@@ -42,7 +42,7 @@
     files:
       - GITALY_SERVER_VERSION
       - lib/gitlab/setup_helper.rb
-    prefix: "gitaly-binaries-${DEBIAN-VERSION}"
+    prefix: "gitaly-binaries-debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}"
   paths:
     - ${TMP_TEST_FOLDER}/gitaly/_build/bin/
     - ${TMP_TEST_FOLDER}/gitaly/_build/deps/git/install/
@@ -79,7 +79,7 @@
   policy: push  # We want to rebuild the cache from scratch to ensure stale dependencies are cleaned up.
 
 .assets-cache: &assets-cache
-  key: "assets-${DEBIAN_VERSION}-${NODE_ENV}"
+  key: "assets-debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}-node-${NODE_ENV}"
   paths:
     - assets-hash.txt
     - public/assets/webpack/
@@ -103,7 +103,7 @@
   policy: push  # We want to rebuild the cache from scratch to ensure stale dependencies are cleaned up.
 
 .rubocop-cache: &rubocop-cache
-  key: "rubocop-${DEBIAN_VERSION}"
+  key: "rubocop-debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}"
   paths:
     - tmp/rubocop_cache/
   policy: pull
@@ -116,6 +116,7 @@
 
 .qa-ruby-gems-cache: &qa-ruby-gems-cache
   key:
+    prefix: "qa-ruby-gems-debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}"
     files:
       - qa/Gemfile.lock
   paths:

.gitlab/ci/qa.gitlab-ci.yml

@@ -92,7 +92,7 @@ populate-qa-tests-var:
     - detect-tests
 
 .package-and-qa-base:
-  image: ${GITLAB_DEPENDENCY_PROXY}ruby:2.7-alpine
+  image: ${GITLAB_DEPENDENCY_PROXY}ruby:${RUBY_VERSION}-alpine
   stage: qa
   retry: 0
   before_script:

.gitlab/ci/rails.gitlab-ci.yml

@@ -395,15 +395,15 @@ db:migrate-from-previous-major-version:
     USE_BUNDLE_INSTALL: "false"
     SETUP_DB: "false"
     PROJECT_TO_CHECKOUT: "gitlab-foss"
-    TAG_TO_CHECKOUT: "v13.12.9"
+    TAG_TO_CHECKOUT: "v14.10.2"
   before_script:
     - !reference [.default-before_script, before_script]
     - '[[ -d "ee/" ]] || export PROJECT_TO_CHECKOUT="gitlab"'
     - '[[ -d "ee/" ]] || export TAG_TO_CHECKOUT="${TAG_TO_CHECKOUT}-ee"'
     - retry 'git fetch https://gitlab.com/gitlab-org/$PROJECT_TO_CHECKOUT.git $TAG_TO_CHECKOUT'
     - git checkout -f FETCH_HEAD
-    - SETUP_DB=false USE_BUNDLE_INSTALL=true bash scripts/prepare_build.sh
-    - run_timed_command "bundle exec rake db:drop db:create db:structure:load db:migrate db:seed_fu"
+    - SETUP_DB=false USE_BUNDLE_INSTALL=true ENABLE_BOOTSNAP=false bash scripts/prepare_build.sh
+    - run_timed_command "ENABLE_BOOTSNAP=false bundle exec rake db:drop db:create db:structure:load db:migrate db:seed_fu"
     - git checkout -f $CI_COMMIT_SHA
     - SETUP_DB=false USE_BUNDLE_INSTALL=true bash scripts/prepare_build.sh
   script:
@@ -419,7 +419,7 @@ db:migrate-from-previous-major-version-single-db:
   extends:
     - .rails:rules:ee-mr-and-default-branch-only
   variables:
-    TAG_TO_CHECKOUT: "v14.4.0"
+    TAG_TO_CHECKOUT: "v14.7.0"  # this version updated grpc to 1.42.0, which supports Ruby 2 & 3
   script:
     - run_timed_command "scripts/db_tasks db:migrate"
     - scripts/schema_changed.sh
@@ -460,7 +460,7 @@ db:migrate-non-superuser:
 db:gitlabcom-database-testing:
   extends: .rails:rules:db:gitlabcom-database-testing
   stage: test
-  image: ruby:2.7-alpine
+  image: ruby:${RUBY_VERSION}-alpine
   needs: []
   allow_failure: true
   script:
@@ -976,7 +976,6 @@ rspec system pg13:
     - .rspec-base-pg13
     - .rails:rules:default-branch-schedule-nightly--code-backstage
     - .rspec-system-parallel
-
 # EE/FOSS: default branch nightly scheduled jobs #
 ##########################################
 

.gitlab/ci/reports.gitlab-ci.yml

@@ -91,7 +91,7 @@ gemnasium-python-dependency_scanning:
 
 yarn-audit-dependency_scanning:
   extends: .ds-analyzer
-  image: "${REGISTRY_HOST}/${REGISTRY_GROUP}/security-products/analyzers/npm-audit:1.4.1"
+  image: "${REGISTRY_HOST}/${REGISTRY_GROUP}/security-products/analyzers/npm-audit:1"
   variables:
     TOOL: yarn
   rules: !reference [".reports:rules:yarn-audit-dependency_scanning", rules]

.gitlab/ci/review-apps/main.gitlab-ci.yml

@@ -20,7 +20,7 @@ review-build-cng-env:
   extends:
     - .default-retry
     - .review:rules:review-build-cng
-  image: ${GITLAB_DEPENDENCY_PROXY}ruby:2.7-alpine3.13
+  image: ${GITLAB_DEPENDENCY_PROXY}ruby:${RUBY_VERSION}-alpine3.13
   stage: prepare
   needs: []
   before_script:

.gitlab/ci/review-apps/qa.gitlab-ci.yml

@@ -52,6 +52,7 @@ include:
         --tag ~skip_signup_disabled \
         --tag ~requires_git_protocol_v2 \
         --tag ~requires_praefect \
+        --tag ~sanity_feature_flags \
         --force-color \
         --order random \
         --format documentation \
@@ -99,6 +100,29 @@ download-knapsack-report:
       - qa/knapsack/review-qa-*.json
     expire_in: 1 day
 
+review-qa-sanity:
+  extends:
+    - .review-qa-base
+    - .review:rules:review-qa-sanity
+  retry: 1
+  variables:
+    QA_RUN_TYPE: review-qa-sanity
+  script:
+    - qa_run_status=0
+    - |
+      bundle exec rake "knapsack:rspec[\
+        --tag sanity_feature_flags \
+        --force-color \
+        --order random \
+        --format documentation \
+        --format RspecJunitFormatter --out tmp/rspec.xml \
+      ]" || qa_run_status=$?
+    - if [ ${qa_run_status} -ne 0 ]; then
+        release_sha=$(echo "${CI_MERGE_REQUEST_SOURCE_BRANCH_SHA:-${CI_COMMIT_SHA}}" | cut -c1-11);
+        echo "Errors can be found at https://sentry.gitlab.net/gitlab/gitlab-review-apps/releases/${release_sha}/all-events/.";
+      fi
+    - exit ${qa_run_status}
+
 review-qa-smoke:
   extends:
     - .review-qa-base

.gitlab/ci/review.gitlab-ci.yml

@@ -5,7 +5,7 @@ review-cleanup:
   extends:
     - .default-retry
     - .review:rules:review-cleanup
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:gitlab-helm3-kubectl1.14
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:gitlab-helm3.5-kubectl1.17
   stage: prepare
   environment:
     name: review/${CI_COMMIT_REF_SLUG}${FREQUENCY}

.gitlab/ci/rules.gitlab-ci.yml

@@ -82,6 +82,9 @@
 .if-merge-request-labels-group-global-search: &if-merge-request-labels-group-global-search
   if: '$CI_MERGE_REQUEST_LABELS =~ /group::global search/'
 
+.if-merge-request-labels-pipeline-revert: &if-merge-request-labels-pipeline-revert
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:revert/'
+
 .if-security-merge-request: &if-security-merge-request
   if: '$CI_PROJECT_NAMESPACE == "gitlab-org/security" && $CI_MERGE_REQUEST_IID'
 
@@ -181,6 +184,17 @@
   - "*.yml"
   - "**/*.yml"
 
+.lint-pipeline-yaml-patterns: &lint-pipeline-yaml-patterns
+  - ".gitlab-ci.yml"
+  - ".gitlab/ci/**/*.yml"
+  - "lib/gitlab/ci/templates/**/*.yml"
+  - "data/deprecations/**/*.yml"
+  - "data/removals/**/*.yml"
+  - "data/whats_new/**/*.yml"
+
+.lint-metrics-yaml-patterns: &lint-metrics-yaml-patterns
+  - "config/metrics/**/*.yml"
+
 .docs-patterns: &docs-patterns
   - ".gitlab/route-map.yml"
   - "doc/**/*"
@@ -916,6 +930,8 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-pipeline-revert
+      when: never
     - <<: *if-merge-request-targeting-stable-branch
       allow_failure: true
     - <<: *if-dot-com-gitlab-org-and-security-merge-request
@@ -941,6 +957,8 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-pipeline-revert
+      when: never
     - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-qa
       changes: *feature-flag-development-config-patterns
       when: manual
@@ -1368,6 +1386,8 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-pipeline-revert
+      when: never
     - <<: *if-merge-request-labels-skip-undercoverage
       when: never
     - <<: *if-merge-request-labels-run-all-rspec
@@ -1572,6 +1592,8 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-pipeline-revert
+      when: never
     - <<: *if-merge-request-labels-run-review-app
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *ci-review-patterns
@@ -1615,6 +1637,10 @@
   rules:
     - when: on_success
 
+.review:rules:review-qa-sanity:
+  rules:
+    - when: on_success
+
 .review:rules:review-qa-smoke:
   rules:
     - when: on_success
@@ -1790,3 +1816,13 @@
   rules:
     - <<: *if-default-refs
       changes: *yaml-lint-patterns
+
+.lint-pipeline-yaml:rules:
+  rules:
+    - <<: *if-default-refs
+      changes: *lint-pipeline-yaml-patterns
+
+.lint-metrics-yaml:rules:
+  rules:
+    - <<: *if-default-refs
+      changes: *lint-metrics-yaml-patterns

.gitlab/ci/setup.gitlab-ci.yml

@@ -60,7 +60,7 @@ no-jh-check:
 verify-tests-yml:
   extends:
     - .setup:rules:verify-tests-yml
-  image: ${GITLAB_DEPENDENCY_PROXY}ruby:2.7-alpine3.13
+  image: ${GITLAB_DEPENDENCY_PROXY}ruby:${RUBY_VERSION}-alpine3.13
   stage: test
   needs: []
   script:
@@ -96,7 +96,7 @@ generate-frontend-fixtures-mapping:
       - ${FRONTEND_FIXTURES_MAPPING_PATH}
 
 .detect-test-base:
-  image: ${GITLAB_DEPENDENCY_PROXY}ruby:2.7
+  image: ${GITLAB_DEPENDENCY_PROXY}ruby:${RUBY_VERSION}
   needs: []
   stage: prepare
   script:
@@ -160,7 +160,7 @@ detect-previous-failed-tests:
 
 add-jh-folder:
   extends: .setup:rules:add-jh-folder
-  image: ${GITLAB_DEPENDENCY_PROXY}ruby:2.7
+  image: ${GITLAB_DEPENDENCY_PROXY}ruby:${RUBY_VERSION}
   stage: prepare
   before_script:
     - source ./scripts/utils.sh

.gitlab/ci/test-metadata.gitlab-ci.yml

 .tests-metadata-state:
-  image: ${GITLAB_DEPENDENCY_PROXY}ruby:2.7
+  image: ${GITLAB_DEPENDENCY_PROXY}ruby:${RUBY_VERSION}
   before_script:
     - source scripts/utils.sh
   artifacts:

.gitlab/ci/workhorse.gitlab-ci.yml

@@ -22,4 +22,4 @@ workhorse:verify:
 
 workhorse:test using go 1.17:
   extends: .workhorse:test
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:debian-${DEBIAN_VERSION}-ruby-2.7-golang-1.17-git-2.31
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}-golang-1.17-git-2.31

.gitlab/ci/yaml.gitlab-ci.yml

@@ -18,7 +18,7 @@ lint-yaml:
 lint-pipeline-yaml:
   extends:
     - .default-retry
-    - .yaml-lint:rules
+    - .lint-pipeline-yaml:rules
   image: pipelinecomponents/yamllint:latest
   stage: lint
   needs: []
@@ -30,7 +30,7 @@ lint-pipeline-yaml:
 lint-metrics-yaml:
   extends:
     - .default-retry
-    - .yaml-lint:rules
+    - .lint-metrics-yaml:rules
   image: pipelinecomponents/yamllint:latest
   stage: lint
   needs: []

.gitlab/issue_templates/Service Ping reporting and monitoring.md

@@ -18,7 +18,7 @@ Broken metrics issues are marked with the ~"broken metric" label.
 
 ## Prerequisites
 
-1. Make sure the SSH key is added to the local SSH agent: `ssh-add`.
+1. Add your SSH key to the local SSH agent: `ssh-add`. Your SSH key is required to connect to a Rails console from the bastion host.
 
 ## Triggering
 
@@ -97,6 +97,13 @@ Trigger some events from the User Interface.
 Gitlab::UsageDataCounters::HLLRedisCounter.unique_events(event_names: 'event_name', start_date: 28.days.ago, end_date: Date.current)
 ```
 
+# Troubleshooting
+
+## Connecting to a Rails console host fails with `Permission denied (publickey).`.
+
+Make sure you add the SSH key to the local SSH agent with: `ssh-add`. If you don't add your SSH key, your key won't be forwarded
+when you run `ssh -A`, and you will not be able to connect to a Rails console host.
+
 # What to do if you get mentioned
 
 In this issue, we keep the track of new metrics added to the Service Ping, and the metrics that are timing out.

.rubocop.yml

@@ -287,6 +287,11 @@ Rails/HelperInstanceVariable:
     - app/helpers/**/*.rb
     - ee/app/helpers/**/*.rb
 
+Rails/MailerName:
+  Exclude:
+    # See for the context on why it's excluded https://gitlab.com/gitlab-org/gitlab/-/issues/239356#note_956419227
+    - 'app/mailers/notify.rb'
+
 # GitLab ###################################################################
 
 Gitlab/ModuleWithInstanceVariables:

.rubocop_todo/cop/static_translation_definition.yml

@@ -6,13 +6,6 @@ Cop/StaticTranslationDefinition:
     - 'app/models/diff_viewer/rich.rb'
     - 'app/models/diff_viewer/simple.rb'
     - 'app/models/group_group_link.rb'
-    - 'app/models/integrations/bamboo.rb'
-    - 'app/models/integrations/buildkite.rb'
-    - 'app/models/integrations/drone_ci.rb'
-    - 'app/models/integrations/jenkins.rb'
-    - 'app/models/integrations/jira.rb'
-    - 'app/models/integrations/mock_ci.rb'
-    - 'app/models/integrations/teamcity.rb'
     - 'app/models/jira_import_state.rb'
     - 'app/models/member.rb'
     - 'app/models/project.rb'
@@ -25,13 +18,3 @@ Cop/StaticTranslationDefinition:
     - 'ee/app/models/incident_management/escalation_policy.rb'
     - 'ee/app/models/incident_management/escalation_rule.rb'
     - 'ee/app/models/vulnerabilities/read.rb'
-    - 'ee/lib/ee/gitlab/quick_actions/epic_actions.rb'
-    - 'ee/lib/ee/gitlab/quick_actions/issue_actions.rb'
-    - 'ee/lib/ee/gitlab/quick_actions/issue_and_merge_request_actions.rb'
-    - 'ee/lib/ee/gitlab/quick_actions/merge_request_actions.rb'
-    - 'lib/gitlab/quick_actions/commit_actions.rb'
-    - 'lib/gitlab/quick_actions/issuable_actions.rb'
-    - 'lib/gitlab/quick_actions/issue_actions.rb'
-    - 'lib/gitlab/quick_actions/issue_and_merge_request_actions.rb'
-    - 'lib/gitlab/quick_actions/merge_request_actions.rb'
-    - 'lib/gitlab/quick_actions/relate_actions.rb'

.rubocop_todo/cop/user_admin.yml

@@ -26,7 +26,6 @@ Cop/UserAdmin:
   - app/models/protected_branch.rb
   - app/models/user.rb
   - app/policies/note_policy.rb
-  - app/serializers/deploy_key_entity.rb
   - app/services/auth/container_registry_authentication_service.rb
   - app/services/emails/create_service.rb
   - app/services/projects/enable_deploy_key_service.rb

.rubocop_todo/gitlab/delegate_predicate_methods.yml

@@ -2,6 +2,5 @@
 Gitlab/DelegatePredicateMethods:
   Exclude:
   - app/models/clusters/cluster.rb
-  - app/models/concerns/integrations/base_data_fields.rb
   - app/models/project.rb
   - ee/app/models/concerns/ee/ci/metadatable.rb