.eslintrc.yml

@@ -144,6 +144,8 @@ rules:
     - error
     - escape:
         methods: 'sanitize'
+  # This rule will be enabled later.
+  unicorn/no-array-callback-reference: off
 overrides:
   - files:
       - '{,ee/,jh/}spec/frontend*/**/*'

.gitignore

@@ -117,3 +117,6 @@ jest-snapshot-test-report.json
 # https://vitejs.dev/guide/env-and-mode.html#env-files
 *.local
 /config/vite.gdk.json
+
+# CSS compilation for cssbundling
+app/assets/builds/

.gitlab-ci.yml

@@ -29,22 +29,23 @@ default:
 
 .old-ruby-variables: &old-ruby-variables
   RUBY_VERSION: "3.0"
-  CACHE_EDITION: "GITLAB_RUBY3_0"
+  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_0"
 
 .default-ruby-variables: &default-ruby-variables
   RUBY_VERSION: "3.1"
-  CACHE_EDITION: "GITLAB_RUBY3_1"
+  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_1"
 
 .next-ruby-variables: &next-ruby-variables
   RUBY_VERSION: "3.2"
-  CACHE_EDITION: "GITLAB_RUBY3_2"
+  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_2"
 
 .default-branch-pipeline-failure-variables: &default-branch-pipeline-failure-variables
-  CREATE_RAILS_TEST_FAILURE_ISSUES: "true"
   CREATE_RAILS_SLOW_TEST_ISSUES: "true"
+  CREATE_RAILS_TEST_FAILURE_ISSUES: "true"
 
-.default-merge-request-slow-tests-variables: &default-merge-request-slow-tests-variables
+.default-merge-request-variables: &default-merge-request-variables
   ADD_SLOW_TEST_NOTE_TO_MERGE_REQUEST: "true"
+  CREATE_RAILS_FLAKY_TEST_ISSUES: "true"
 
 .if-merge-request-security-canonical-sync: &if-merge-request-security-canonical-sync
   if: '$CI_MERGE_REQUEST_SOURCE_PROJECT_PATH == "gitlab-org/security/gitlab" && $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == $CI_DEFAULT_BRANCH && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
@@ -55,7 +56,7 @@ default:
 workflow:
   name: '$PIPELINE_NAME'
   rules:
-    - if: '$CI_PROJECT_PATH == "gitlab-org/gitaly" && $CI_PIPELINE_SOURCE == "parent_pipeline" && $GITALY_TEST'
+    - if: '$CI_PIPELINE_SOURCE == "pipeline" && $GITALY_TEST'
       variables:
         <<: *default-ruby-variables
         PIPELINE_NAME: 'Gitaly Rails Test Pipeline'
@@ -104,8 +105,7 @@ workflow:
     # For (detached) merge request pipelines.
     - if: '$CI_MERGE_REQUEST_IID'
       variables:
-        <<: *default-ruby-variables
-        <<: *default-merge-request-slow-tests-variables
+        <<: [*default-ruby-variables, *default-merge-request-variables]
         PIPELINE_NAME: 'Ruby $RUBY_VERSION $CI_MERGE_REQUEST_EVENT_TYPE MR pipeline'
         NO_SOURCEMAPS: 'true'
     # For the scheduled pipelines, we set specific variables.
@@ -122,7 +122,7 @@ workflow:
       variables:
         <<: *next-ruby-variables
         PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch pipeline'
-    # This work around https://gitlab.com/gitlab-org/gitlab/-/issues/332411 whichs prevents usage of dependency proxy
+    # This work around https://gitlab.com/gitlab-org/gitlab/-/issues/332411 which prevents usage of dependency proxy
     # when pipeline is triggered by a project access token.
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $GITLAB_USER_LOGIN =~ /project_\d+_bot\d*/'
       variables:
@@ -183,9 +183,10 @@ variables:
   CI_FETCH_REPO_GIT_STRATEGY: "none"
   DEBIAN_VERSION: "bullseye"
   UBI_VERSION: "8.6"
-  CHROME_VERSION: "113"
+  CHROME_VERSION: "120"
   DOCKER_VERSION: "24.0.5"
   RUBYGEMS_VERSION: "3.4"
+  BUNDLER_VERSION: "2.5"
   GO_VERSION: "1.20"
   RUST_VERSION: "1.73"
 
@@ -217,7 +218,6 @@ variables:
   BUNDLER_CHECKSUM_VERIFICATION_OPT_IN: "1"
   CACHE_CLASSES: "true"
   CHECK_PRECOMPILED_ASSETS: "true"
-  FF_USE_FASTZIP: "true"
   RETRY_FAILED_TESTS_IN_NEW_PROCESS: "true"
   # Run with decomposed databases by default
   DECOMPOSED_DB: "true"
@@ -230,11 +230,6 @@ variables:
   REVIEW_APPS_GCP_PROJECT: "gitlab-review-apps"
   REVIEW_APPS_GCP_REGION: "us-central1"
 
-  CACHE_ASSETS_AS_PACKAGE: "true"
-  REUSE_FRONTEND_FIXTURES_ENABLED: "true"
-  BUILD_ASSETS_IMAGE: "true"  # Set it to "false" to disable assets image building, used in `build-assets-image`
-  SIMPLECOV: "true"
-
   REGISTRY_HOST: "registry.gitlab.com"
   REGISTRY_GROUP: "gitlab-org"
 
@@ -249,6 +244,15 @@ variables:
   # https://github.com/ruby/ruby/pull/7663 lands in the Ruby interpreter.
   NOKOGIRI_LIBXML_MEMORY_MANAGEMENT: default
 
+  # CI jobs behavior can be changed by changing the value of these variables in the project's CI/CD variables
+  AVERAGE_KNAPSACK_REPORT: "true"
+  ENABLE_DEPSASTER: "true"
+  ENABLE_DEPSCORE: "true"
+  CACHE_ASSETS_AS_PACKAGE: "true"
+  REUSE_FRONTEND_FIXTURES_ENABLED: "true"
+  BUILD_ASSETS_IMAGE: "true"  # Set it to "false" to disable assets image building, used in `build-assets-image`
+  SIMPLECOV: "true"
+
 include:
   - local: .gitlab/ci/_skip.yml
     rules:

.gitlab/CODEOWNERS

@@ -1443,12 +1443,14 @@ ee/lib/ee/api/entities/project.rb
 /ee/lib/sidebars/
 /ee/lib/ee/sidebars/
 
-# Necessary for availablity, similar to DB migrations
+# Necessary for availability, similar to DB migrations
 [Global Search] @gitlab-org/search-team/migration-maintainers
 /ee/elastic/migrate/
-/ee/spec/elastic/migrate/
 /ee/spec/support/elastic.rb
 
+^[Global Search] @gitlab-org/search-team/migration-maintainers
+/ee/spec/elastic/migrate/
+
 ^[Create::IDE - Remote Development Backend] @gitlab-org/maintainers/remote-development/backend
 /ee/app/models/remote_development/
 /ee/app/policies/remote_development/
@@ -1493,6 +1495,10 @@ ee/lib/ee/api/entities/project.rb
 ^[DiffMatchPatch gem]
 /vendor/gems/diff_match_patch @garyh
 
+^[Gitlab Housekeeper gem] @DylanGriffith @rymai @tigerwnz
+/gems/gitlab-housekeeper/
+/keeps/
+
 # JiHu GitLab rules. See https://gitlab.com/gitlab-jh/gitlab-jh-enablement/-/issues/213#note_1024367528
 
 [JH Frontend] @jihulab/maintainers/frontend

.gitlab/ci/as-if-foss.gitlab-ci.yml

+.as-if-foss-variables:
+  variables:
+    AS_IF_FOSS_BRANCH: "as-if-foss/${CI_COMMIT_REF_NAME}"
+    FOSS_REPOSITORY: "https://dummy:${AS_IF_FOSS_TOKEN}@gitlab.com/gitlab-org/gitlab-foss.git"
+
 prepare-as-if-foss-branch:
   extends:
     - .as-if-foss:rules:start-as-if-foss
+    - .as-if-foss-variables
   stage: prepare
   needs: []
-  variables:
-    AS_IF_FOSS_BRANCH: "as-if-foss/${CI_COMMIT_REF_NAME}"
-    FOSS_REPOSITORY: "https://dummy:${AS_IF_FOSS_TOKEN}@gitlab.com/gitlab-org/gitlab-foss.git"
+  environment:
+    name: "as-if-foss/${CI_MERGE_REQUEST_IID}"
+    on_stop: delete-as-if-foss-branch
   before_script:
     - git clone --single-branch --branch master "${FOSS_REPOSITORY}" gitlab-foss
     - git -C gitlab-foss checkout -b "${AS_IF_FOSS_BRANCH}" master
@@ -29,15 +35,16 @@ prepare-as-if-foss-branch:
 prepare-as-if-foss-env:
   extends:
     - .as-if-foss:rules:start-as-if-foss
+    - .fast-no-clone-job
   stage: prepare
   needs: []
   variables:
     BUILD_ENV: build.env
-  before_script:
-    - source scripts/utils.sh
-    - install_gitlab_gem
+    FILES_TO_DOWNLOAD: >
+      scripts/setup/generate-as-if-foss-env.rb
   script:
-    - scripts/setup/generate-as-if-foss-env.rb | tee $BUILD_ENV
+    - install_gitlab_gem
+    - ruby scripts/setup/generate-as-if-foss-env.rb | tee "${BUILD_ENV}"
   artifacts:
     expire_in: 3 days
     reports:
@@ -61,10 +68,66 @@ start-as-if-foss:
     ENABLE_RSPEC_FAST_SPEC_HELPER: $ENABLE_RSPEC_FAST_SPEC_HELPER
     ENABLE_RSPEC_UNIT: $ENABLE_RSPEC_UNIT
     ENABLE_RSPEC_INTEGRATION: $ENABLE_RSPEC_INTEGRATION
+    ENABLE_RSPEC_SYSTEM: $ENABLE_RSPEC_SYSTEM
     ENABLE_RSPEC_MIGRATION: $ENABLE_RSPEC_MIGRATION
     ENABLE_RSPEC_BACKGROUND_MIGRATION: $ENABLE_RSPEC_BACKGROUND_MIGRATION
-    ENABLE_RSPEC_SYSTEM: $ENABLE_RSPEC_SYSTEM
+    ENABLE_RSPEC_FRONTEND_FIXTURE: $ENABLE_RSPEC_FRONTEND_FIXTURE
+    ENABLE_BUILD_ASSETS_IMAGE: $ENABLE_BUILD_ASSETS_IMAGE
+    ENABLE_BUILD_QA_IMAGE: $ENABLE_BUILD_QA_IMAGE
+    ENABLE_COMPILE_PRODUCTION_ASSETS: $ENABLE_COMPILE_PRODUCTION_ASSETS
+    ENABLE_COMPILE_STORYBOOK: $ENABLE_COMPILE_STORYBOOK
+    ENABLE_COMPILE_TEST_ASSETS: $ENABLE_COMPILE_TEST_ASSETS
+    ENABLE_ESLINT: $ENABLE_ESLINT
+    ENABLE_GENERATE_APOLLO_GRAPHQL_SCHEMA: $ENABLE_GENERATE_APOLLO_GRAPHQL_SCHEMA
+    ENABLE_GRAPHQL_SCHEMA_DUMP: $ENABLE_GRAPHQL_SCHEMA_DUMP
+    ENABLE_JEST: $ENABLE_JEST
+    ENABLE_JEST_INTEGRATION: $ENABLE_JEST_INTEGRATION
+    ENABLE_QA_INTERNAL: $ENABLE_QA_INTERNAL
+    ENABLE_QA_SELECTORS: $ENABLE_QA_SELECTORS
+    ENABLE_STATIC_ANALYSIS: $ENABLE_STATIC_ANALYSIS
   trigger:
     project: gitlab-org/gitlab-foss
     branch: as-if-foss/${CI_COMMIT_REF_NAME}
     strategy: depend
+
+delete-as-if-foss-branch:
+  extends:
+    - .as-if-foss:rules:start-as-if-foss:allow-failure:manual
+    - .as-if-foss-variables
+  image:
+    name: alpine/git
+    entrypoint: [""]
+  stage: prepare
+  needs:
+    - prepare-as-if-foss-branch
+  environment:
+    name: "as-if-foss/${CI_MERGE_REQUEST_IID}"
+    action: stop
+  variables:
+    GIT_STRATEGY: "none"
+  script:
+    - |
+      git init
+      git push -d "${FOSS_REPOSITORY}" "${AS_IF_FOSS_BRANCH}"
+
+# We can only delete the environment after it's stopped, therefore
+# we need to use another job to delete the environment, not in the
+# job where it's stopping the environment. See:
+# https://docs.gitlab.com/ee/ci/environments/#delete-an-environment
+delete-as-if-foss-environment:
+  extends:
+    - .as-if-foss:rules:start-as-if-foss:allow-failure
+  image: alpine:latest
+  stage: prepare
+  needs:
+    - delete-as-if-foss-branch
+  variables:
+    GIT_STRATEGY: "none"
+    ESCAPED_ENVIRONMENT_NAME: "as-if-foss%2f${CI_MERGE_REQUEST_IID}"
+    ENVIRONMENT_API_URL: "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/environments"
+  before_script:
+    - apk add jq curl
+  script:
+    - |
+      ENV_ID=$(curl --silent --fail --request GET --header "Private-Token: ${PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE}" "${ENVIRONMENT_API_URL}?name=${ESCAPED_ENVIRONMENT_NAME}" | jq '.[0].id')
+      curl --silent --request DELETE --header "Private-Token: $PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE" "${ENVIRONMENT_API_URL}/${ENV_ID}"

.gitlab/ci/cng/main.gitlab-ci.yml

@@ -54,8 +54,6 @@ include:
     GITLAB_WORKHORSE_VERSION: "${GITLAB_WORKHORSE_VERSION}"
     GITALY_SERVER_VERSION: "${GITALY_SERVER_VERSION}"
     RUBY_VERSION: "${FULL_RUBY_VERSION}"
-    NEXT_RUBY_CACHE_KEY: "${RUBY_VERSION}"
-    NEXT_RUBY_VERSION: "${FULL_RUBY_VERSION}"
   trigger:
     project: ${CI_PROJECT_NAMESPACE}/build/CNG-mirror
     branch: $TRIGGER_BRANCH

.gitlab/ci/database.gitlab-ci.yml

@@ -36,7 +36,7 @@ db:rollback:
     - .db-job-base
     - .rails:rules:db-rollback
   script:
-    - bundle exec rake db:migrate VERSION=20221111123146  # 15.7
+    - bundle exec rake db:migrate VERSION=20230216060333  # 16.0 First migration
     - bundle exec rake db:migrate
 
 db:rollback single-db:

.gitlab/ci/gitlab-com/danger-review.gitlab-ci.yml

 include:
   - project: gitlab-org/quality/pipeline-common
-    ref: 8.2.0
+    ref: 8.4.0
     file:
       - /ci/danger-review.yml
 

.gitlab/ci/global.gitlab-ci.yml

@@ -286,7 +286,7 @@
 
 .zoekt-services:
   services:
-    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.5
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.6
       alias: zoekt-ci-image
 
 .use-pg13:

.gitlab/ci/observability-backend.gitlab-ci.yml

+# Triggers downstream e2e tests in gitlab-org/opstrace/opstrace
+# These e2e tests live in gitlab-org/opstrace/opstrace as a result
+# of opstrace being brought in through an acquisition.
+.e2e-observability-backend-base:
+  stage: test
+  needs: []
+  extends:
+    - .observability-backend:rules
+  inherit:
+    variables: false
+  variables:
+    TEST_GITLAB_COMMIT: $CI_COMMIT_SHA
+  trigger:
+    project: gitlab-org/opstrace/opstrace
+    strategy: depend
+
+# e2e:observability-backend uses $CI_COMMIT_REF_NAME to
+# checkout a branch in gitlab-org/opstrace/opstrace with
+# the same name as the branch in this repo. Because opstrace
+# is a different codebase, we match branch names without
+# commit SHA.
+e2e:observability-backend:
+  extends: .e2e-observability-backend-base
+  trigger:
+    project: gitlab-org/opstrace/opstrace
+    branch: $CI_COMMIT_REF_NAME
+
+# e2e:observability-backend-main-branch will trigger
+# an e2e test pipeline that checks out GitLab to
+# $CI_COMMIT_SHA and Opstrace to the latest commit
+# on main branch. Devs run this manually on local
+# installs today periodically during development
+# and this manual job increases dev velocity
+# and testing reliablity.
+e2e:observability-backend-main-branch:
+  extends: .e2e-observability-backend-base
+  trigger:
+    project: gitlab-org/opstrace/opstrace
+    branch: main

.gitlab/ci/package-and-test/main.gitlab-ci.yml

@@ -357,7 +357,7 @@ oauth:
     QA_GITLAB_HOSTNAME: "gitlab"
     QA_GITLAB_USE_TLS: "true"
     QA_RSPEC_TAGS: --tag oauth
-    GITLAB_QA_OPTS: --omnibus-config facebook_oauth --omnibus-config github_oauth
+    GITLAB_QA_OPTS: --omnibus-config github_oauth
   rules:
     - !reference [.rules:test:qa-default-branch, rules]
     - if: $QA_SUITES =~ /Test::Instance::All/
@@ -567,7 +567,7 @@ importers:
     - if: $QA_SUITES =~ /Test::Integration::Import/
     - !reference [.rules:test:manual, rules]
 
-ai-gateway-sync-seat-link:
+ai-gateway:
   extends:
     - .qa
     - .failure-videos
@@ -578,11 +578,6 @@ ai-gateway-sync-seat-link:
     - if: $QA_SUITES =~ /Test::Integration::AiGateway/
     - !reference [.rules:test:manual, rules]
 
-ai-gateway-sync-service-token:
-  extends: ai-gateway-sync-seat-link
-  variables:
-    QA_USE_SYNC_SERVICE_TOKEN_WORKER: "true"
-
 # ------------------------------------------
 # Update jobs
 # ------------------------------------------

.gitlab/ci/preflight.gitlab-ci.yml

@@ -5,7 +5,7 @@
   needs: []
 
 .qa-preflight-job:
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-bullseye-ruby-${RUBY_VERSION}:bundler-2.3-chrome-${CHROME_VERSION}-docker-${DOCKER_VERSION}
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-bullseye-ruby-${RUBY_VERSION}:bundler-${BUNDLER_VERSION}-chrome-${CHROME_VERSION}-docker-${DOCKER_VERSION}
   extends:
     - .preflight-job-base
     - .qa-cache
@@ -53,6 +53,18 @@ rails-production-server-boot-puma-cng:
     - retry_times_sleep 10 5 "curl http://127.0.0.1:8080"
     - kill $(jobs -p)
 
+ruby_syntax:
+  extends:
+    - .preflight-job-base
+  before_script:
+    - source scripts/utils.sh
+  image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}
+  parallel:
+    matrix:
+      - RUBY_VERSION: ["3.0", "3.1", "3.2"]
+  script:
+    - run_timed_command "fail_on_warnings scripts/lint/check_ruby_syntax.rb"
+
 no-ee-check:
   extends:
     - .preflight-job-base
@@ -70,7 +82,7 @@ no-jh-check:
 qa:selectors:
   extends:
     - .qa-preflight-job
-    - .qa:rules:ee-and-foss
+    - .qa:rules:selectors
   script:
     - bundle exec bin/qa Test::Sanity::Selectors
 

.gitlab/ci/qa-common/main.gitlab-ci.yml

@@ -5,7 +5,7 @@ workflow:
   name: $PIPELINE_NAME
 
 include:
-  - component: "gitlab.com/gitlab-org/quality/pipeline-common/allure-report@8.2.0"
+  - component: "gitlab.com/gitlab-org/quality/pipeline-common/allure-report@8.3.0"
     inputs:
       job_name: "e2e-test-report"
       job_stage: "report"
@@ -15,7 +15,7 @@ include:
       gitlab_auth_token_variable_name: "PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE"
       allure_job_name: "${QA_RUN_TYPE}"
   - project: gitlab-org/quality/pipeline-common
-    ref: 8.2.0
+    ref: 8.4.0
     file:
       - /ci/base.gitlab-ci.yml
       - /ci/knapsack-report.yml
@@ -36,7 +36,7 @@ stages:
 .ruby-image:
   # Because this pipeline template can be included directly in other projects,
   # image path and registry needs to be defined explicitly
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}:bundler-2.3
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}:bundler-${BUNDLER_VERSION}
 
 .bundler-variables:
   variables:

.gitlab/ci/qa-common/rules.gitlab-ci.yml

@@ -152,12 +152,6 @@ include:
     - <<: *if-schedule-pipeline
       when: never
 
-.rules:test:gdk-load-balancer-changes:
-  rules:
-    - changes:
-        - ".gitlab/ci/test-on-gdk/**"
-        - "lib/gitlab/database/load_balancing/**/*"
-
 .rules:test:qa-default-branch:
   rules:
     - *qa-run-all-e2e-label

.gitlab/ci/qa.gitlab-ci.yml

 .qa-job-base:
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}:bundler-2.3-chrome-${CHROME_VERSION}-docker-${DOCKER_VERSION}
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-${DEBIAN_VERSION}-ruby-${RUBY_VERSION}:bundler-${BUNDLER_VERSION}-chrome-${CHROME_VERSION}-docker-${DOCKER_VERSION}
   extends:
     - .default-retry
     - .qa-cache
@@ -27,6 +27,7 @@
     variables:
       - CHROME_VERSION
       - RUBY_VERSION
+      - BUNDLER_VERSION
       - DOCKER_VERSION
       - DEBIAN_VERSION
       - REGISTRY_GROUP
@@ -90,8 +91,9 @@ trigger-omnibus:
     TOP_UPSTREAM_SOURCE_PROJECT: $CI_PROJECT_PATH
     SECURITY_SOURCES: $SECURITY_SOURCES
     CACHE_UPDATE: $OMNIBUS_GITLAB_CACHE_UPDATE
-    CACHE_EDITION: $CACHE_EDITION
-    NEXT_RUBY_VERSION: $FULL_RUBY_VERSION
+    CACHE_EDITION: $OMNIBUS_GITLAB_CACHE_EDITION
+    USE_SPECIFIED_RUBY_VERSION: "true"
+    RUBY_VERSION: $FULL_RUBY_VERSION
     BUILD_ON_ALL_OS: $OMNIBUS_GITLAB_BUILD_ON_ALL_OS
     SKIP_QA_TEST: "true"
     ee: $EE
@@ -210,3 +212,73 @@ e2e:test-on-gdk:
     DYNAMIC_PIPELINE_YML: test-on-gdk-pipeline.yml
     SKIP_MESSAGE: Skipping test-on-gdk due to mr containing only quarantine changes!
     GDK_IMAGE: "${CI_REGISTRY_IMAGE}/gitlab-qa-gdk:${CI_COMMIT_SHA}"
+
+e2e:code-suggestions-eval:
+  extends:
+    - .qa:rules:code-suggestions-eval
+  stage: qa
+  needs: ["build-gdk-image"]
+  variables:
+    CS_EVAL_DOWNSTREAM_BRANCH: main
+    GITLAB_SHA: $CI_COMMIT_SHA
+  trigger:
+    strategy: depend
+    forward:
+      yaml_variables: true
+      pipeline_variables: true
+    project: gitlab-com/create-stage/code-creation/code-suggestion-scenarios
+    branch: $CS_EVAL_DOWNSTREAM_BRANCH
+
+e2e:code-suggestions-eval-results:
+  extends:
+    - .default-retry
+    - .qa:rules:code-suggestions-eval-results
+  stage: post-qa
+  needs:
+    - e2e:code-suggestions-eval
+  variables:
+    TRIGGER_JOB_NAME: "e2e:code-suggestions-eval"
+    DOWNSTREAM_PROJECT: gitlab-com/create-stage/code-creation/code-suggestion-scenarios
+    DOWNSTREAM_JOB_NAME: run_scenarios
+    DOWNSTREAM_JOB_ARTIFACT_PATH: scores-DOWNSTREAM_JOB_ID.csv
+    OUTPUT_ARTIFACT_PATH: scores.csv
+  before_script:
+    - source scripts/utils.sh
+    - install_gitlab_gem
+  script:
+    - scripts/download-downstream-artifact.rb
+  artifacts:
+    expose_as: 'Code Suggestions evaluation results'
+    paths:
+      - scores.csv
+
+e2e:fulfillment-quarantine-report:
+  extends:
+    - .qa:rules:fulfillment-e2e-quarantine-report
+  stage: qa
+  before_script:
+    - cd qa && bundle install
+    - apt-get update && apt-get install -y jq
+  variables:
+    RSPEC_JSON: "tmp/rspec-fulfillment-quarantined.json"
+    NOTES_API: "https://gitlab.com/api/v4/projects/$CI_MERGE_REQUEST_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/notes"
+    USER_API: "https://gitlab.com/api/v4/user"
+    FULFILLMENT_SPECS_PATH: "qa/specs/features/ee/browser_ui/11_fulfillment"
+  script:
+    - bundle exec rspec $FULFILLMENT_SPECS_PATH --tag quarantine --format json --out $RSPEC_JSON --dry-run
+    - |
+      if [[ -f $RSPEC_JSON && $(cat $RSPEC_JSON | jq ".examples[]") ]]
+      then # quarantined tests found
+        bot_user_id=$(curl $USER_API -H "PRIVATE-TOKEN: $PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE" | jq ".id")
+        existing_comment=$(curl $NOTES_API -H "PRIVATE-TOKEN: $PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE" | jq ".[] | select((.author | .id | contains($bot_user_id)) and (.body | contains(\"# Quarantined Fulfillment QA E2E Tests\")))")
+        if [[ ! -z $existing_comment ]]
+        then
+          echo 'MR comment already exists, doing nothing'
+        else
+          COMMENT_HEADER=$'# Quarantined Fulfillment QA E2E Tests\nThe following Fulfillment QA E2E tests are in quarantine. If your changes would be covered by these tests, please be sure to perform manual testing.\n'
+          COMMENT_TABLE=$(cat $RSPEC_JSON | jq --raw-output '"|Description|Location|\n|---|---|\n" + ([.examples[] | "| \(.full_description) | \(.id) |\n"] | join(""))')
+          curl --request POST $NOTES_API -H "PRIVATE-TOKEN: $PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE" --data-urlencode "body=$COMMENT_HEADER $COMMENT_TABLE"
+        fi
+      else
+        echo 'No quarantined tests found'
+      fi

.gitlab/ci/rails.gitlab-ci.yml

@@ -85,7 +85,7 @@ rspec migration pg14:
   extends:
     - .rspec-base-pg14
     - .rspec-base-migration
-    - .rspec-migration-parallel-pg14
+    - .rspec-migration-parallel
     - .rails:rules:ee-and-foss-migration
 
 rspec background_migration pg14:
@@ -154,8 +154,8 @@ rspec background_migration pg14 clusterwide-db:
 rspec unit pg14:
   extends:
     - .rspec-base-pg14
+    - .rspec-unit-parallel
     - .rails:rules:ee-and-foss-unit
-    - .rspec-unit-pg14-parallel
 
 rspec unit pg14 single-redis:
   extends:
@@ -195,7 +195,7 @@ rspec unit pg14 praefect:
 rspec integration pg14:
   extends:
     - .rspec-base-pg14
-    - .rspec-integration-parallel-pg14
+    - .rspec-integration-parallel
     - .rails:rules:ee-and-foss-integration
 
 rspec integration pg14 single-redis:
@@ -236,8 +236,8 @@ rspec integration pg14 praefect:
 rspec system pg14:
   extends:
     - .rspec-base-pg14
+    - .rspec-system-parallel
     - .rails:rules:ee-and-foss-system
-    - .rspec-system-parallel-pg14
   variables:
     DEBUG_GITLAB_TRANSACTION_STACK: "true"
 
@@ -303,7 +303,7 @@ rspec unit clickhouse:
 rspec-ee unit clickhouse:
   extends:
     - .rspec-base-pg14-clickhouse23
-    - .rails:rules:clickhouse-changes
+    - .rails:rules:ee-only-clickhouse-changes
 
 gitlab:clickhouse:rollback:main:
   extends:
@@ -354,7 +354,7 @@ rspec:artifact-collector unit:
     - .artifact-collector
     - .rails:rules:ee-and-foss-unit
   needs:
-    - rspec unit pg14  # 24 jobs
+    - rspec unit pg14  # 32 jobs
     - job: rspec unit clickhouse  # 1 job
       optional: true
 
@@ -363,17 +363,17 @@ rspec:artifact-collector system:
     - .artifact-collector
     - .rails:rules:ee-and-foss-system
   needs:
-    - rspec system pg14  # 26 jobs
+    - rspec system pg14  # 32 jobs
 
 rspec:artifact-collector remainder:
   extends:
     - .artifact-collector
   needs:
-    - job: rspec integration pg14  # 13 jobs
+    - job: rspec integration pg14  # 16 jobs
       optional: true
-    - job: rspec migration pg14  # 12 jobs
+    - job: rspec migration pg14  # 15 jobs
       optional: true
-    - job: rspec background_migration pg14  # 4 jobs
+    - job: rspec background_migration pg14  # 5 jobs
       optional: true
   rules:
     - !reference ['.rails:rules:ee-and-foss-integration', rules]
@@ -385,58 +385,73 @@ rspec:artifact-collector as-if-foss unit:
     - .artifact-collector
     - .rails:rules:as-if-foss-unit
   needs:
-    - rspec unit pg14-as-if-foss  # 28 jobs
+    - rspec unit pg14-as-if-foss  # 32 jobs
 
 rspec:artifact-collector as-if-foss system:
   extends:
     - .artifact-collector
     - .rails:rules:as-if-foss-system
   needs:
-    - rspec system pg14-as-if-foss  # 28 jobs
+    - rspec system pg14-as-if-foss  # 32 jobs
 
 rspec:artifact-collector as-if-foss remainder:
   extends:
     - .artifact-collector
   needs:
-    - job: rspec integration pg14-as-if-foss  # 12 jobs
+    - job: rspec integration pg14-as-if-foss  # 16 jobs
       optional: true
-    - job: rspec migration pg14-as-if-foss  # 8 jobs
+    - job: rspec migration pg14-as-if-foss  # 15 jobs
       optional: true
-    - job: rspec background_migration pg14-as-if-foss  # 4 jobs
+    - job: rspec background_migration pg14-as-if-foss  # 5 jobs
       optional: true
   rules:
     - !reference ['.rails:rules:as-if-foss-integration', rules]
     - !reference ['.rails:rules:as-if-foss-migration', rules]
     - !reference ['.rails:rules:as-if-foss-background-migration', rules]
 
-rspec:artifact-collector single-redis:
+rspec:artifact-collector unit single-redis:
   extends:
     - .artifact-collector
     - .rails:rules:single-redis
   needs:
-    - rspec unit pg14 single-redis  # 28 jobs
-    - rspec integration pg14 single-redis  # 12 jobs
+    - rspec unit pg14 single-redis  # 32 jobs
 
 rspec:artifact-collector system single-redis:
   extends:
     - .artifact-collector
     - .rails:rules:single-redis
   needs:
-    - rspec system pg14 single-redis  # 28 jobs
+    - rspec system pg14 single-redis  # 32 jobs
+
+rspec:artifact-collector remainder single-redis:
+  extends:
+    - .artifact-collector
+    - .rails:rules:single-redis
+  needs:
+    - rspec integration pg14 single-redis  # 16 jobs
 
 rspec:artifact-collector ee single-redis:
   extends:
     - .artifact-collector
     - .rails:rules:single-redis
   needs:
-    - job: rspec-ee unit pg14 single-redis  # 18 jobs
+    - job: rspec-ee unit pg14 single-redis  # 28 jobs
       optional: true
-    - job: rspec-ee integration pg14 single-redis  # 6 jobs
+    - job: rspec-ee integration pg14 single-redis  # 7 jobs
       optional: true
-    - job: rspec-ee system pg14 single-redis  # 10 jobs
+    - job: rspec-ee system pg14 single-redis  # 14 jobs
       optional: true
 
-rspec:artifact-collector ee:
+rspec:artifact-collector ee unit:
+  extends:
+    - .artifact-collector
+  needs:
+    - job: rspec-ee unit pg14  # 28 jobs
+      optional: true
+  rules:
+    - !reference ['.rails:rules:ee-only-unit', rules]
+
+rspec:artifact-collector ee remainder:
   extends:
     - .artifact-collector
   needs:
@@ -444,18 +459,15 @@ rspec:artifact-collector ee:
       optional: true
     - job: rspec-ee background_migration pg14  # 2 jobs
       optional: true
-    - job: rspec-ee unit pg14  # 22 jobs
-      optional: true
     - job: rspec-ee unit clickhouse  # 1 job
       optional: true
-    - job: rspec-ee integration pg14  # 5 jobs
+    - job: rspec-ee integration pg14  # 7 jobs
       optional: true
-    - job: rspec-ee system pg14  # 12 jobs
+    - job: rspec-ee system pg14  # 14 jobs
       optional: true
   rules:
     - !reference ['.rails:rules:ee-only-migration', rules]
     - !reference ['.rails:rules:ee-only-background-migration', rules]
-    - !reference ['.rails:rules:ee-only-unit', rules]
     - !reference ['.rails:rules:ee-only-integration', rules]
     - !reference ['.rails:rules:ee-only-system', rules]
 
@@ -475,10 +487,12 @@ rspec:coverage:
       optional: true
     - job: rspec:artifact-collector remainder
       optional: true
-    - job: rspec:artifact-collector single-redis
+    - job: rspec:artifact-collector unit single-redis
       optional: true
     - job: rspec:artifact-collector system single-redis
       optional: true
+    - job: rspec:artifact-collector remainder single-redis
+      optional: true
     # as-if-foss jobs
     - job: rspec:artifact-collector as-if-foss unit
       optional: true
@@ -489,7 +503,9 @@ rspec:coverage:
     # EE jobs
     - job: rspec:artifact-collector ee single-redis
       optional: true
-    - job: rspec:artifact-collector ee
+    - job: rspec:artifact-collector ee unit
+      optional: true
+    - job: rspec:artifact-collector ee remainder
       optional: true
     # Memory jobs
     - job: memory-on-boot
@@ -518,6 +534,13 @@ rspec:undercoverage:
   stage: post-test
   needs: ["rspec:coverage"]
   script:
+    - apt install -y jq
+    - if [[ $(curl "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}" | jq ".labels" | grep "pipeline:skip-undercoverage") ]]; then
+        echo "The 'pipeline:skip-undercoverage' label is set on the MR, exiting early.";
+        exit 0;
+      else
+        echo "The 'pipeline:skip-undercoverage' label is not set on the MR, proceeding.";
+      fi
     - if [ -n "$CI_MERGE_REQUEST_TARGET_BRANCH_SHA" ]; then
         echo "HEAD is $(git rev-parse HEAD). \$CI_MERGE_REQUEST_TARGET_BRANCH_SHA is ${CI_MERGE_REQUEST_TARGET_BRANCH_SHA}";
       else
@@ -637,7 +660,7 @@ rspec migration pg14-as-if-foss:
   extends:
     - .rspec-base-pg14-as-if-foss
     - .rspec-base-migration
-    - .rspec-migration-parallel-pg14-as-if-foss
+    - .rspec-migration-parallel
     - .rails:rules:as-if-foss-migration
 
 rspec background_migration pg14-as-if-foss:
@@ -874,8 +897,8 @@ rspec-ee background_migration pg14 praefect:
 rspec-ee unit pg14:
   extends:
     - .rspec-ee-base-pg14
+    - .rspec-ee-unit-parallel
     - .rails:rules:ee-only-unit
-    - .rspec-ee-unit-pg14-parallel
 
 rspec-ee unit pg14 es8:
   extends:
@@ -913,8 +936,8 @@ rspec-ee unit pg14 clusterwide-db:
 rspec-ee integration pg14:
   extends:
     - .rspec-ee-base-pg14
+    - .rspec-ee-integration-parallel
     - .rails:rules:ee-only-integration
-    - .rspec-ee-integration-parallel-pg14
 
 rspec-ee integration pg14 es8:
   extends:
@@ -952,8 +975,8 @@ rspec-ee integration pg14 clusterwide-db:
 rspec-ee system pg14:
   extends:
     - .rspec-ee-base-pg14
+    - .rspec-ee-system-parallel
     - .rails:rules:ee-only-system
-    - .rspec-ee-system-parallel-pg14
 
 rspec-ee system pg14 es8:
   extends:

.gitlab/ci/rails/shared.gitlab-ci.yml

@@ -115,6 +115,13 @@ include:
           --input-files "rspec/rspec-*.json" \
           --merge_request_iid "$CI_MERGE_REQUEST_IID";
       fi
+      if [ "$ALLOW_KNAPSACK_REPORT_CREATE_ISSUES" == "true" ]; then
+        bundle exec knapsack-report-issues \
+          --token "${KNAPSACK_REPORT_ISSUES_PROJECT_TOKEN}" \
+          --project "gitlab-org/gitlab" \
+          --input-file knapsack/rspec_*_report.json \
+          --expected-report node_specs_expected_duration.json;
+      fi
     - echo -e "\e[0Ksection_end:`date +%s`:report_results_section\r\e[0K"
     - tooling/bin/push_job_metrics || true
 
@@ -265,10 +272,10 @@ include:
 # rspec:artifact-collector jobs in .gitlab/ci/rails.gitlab-ci.yml
 # Please double-check and adjust accordingly
 .rspec-migration-parallel:
-  parallel: 8
+  parallel: 15
 
 .rspec-background-migration-parallel:
-  parallel: 4
+  parallel: 5
 
 .rspec-ee-migration-parallel:
   parallel: 2
@@ -277,58 +284,19 @@ include:
   parallel: 2
 
 .rspec-unit-parallel:
-  parallel: 28
+  parallel: 32
 
 .rspec-ee-unit-parallel:
-  parallel: 18
+  parallel: 28
 
 .rspec-integration-parallel:
-  parallel: 12
+  parallel: 16
 
 .rspec-ee-integration-parallel:
-  parallel: 6
+  parallel: 7
 
 .rspec-system-parallel:
-  parallel: 28
+  parallel: 32
 
 .rspec-ee-system-parallel:
-  parallel: 10
-
-# Optimizations to distribute CI time more evenly across the CI/CD pipeline
-#
-# See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/133976 for more info
-
-# Giving 4 jobs to `rspec-ee unit pg14`
-.rspec-unit-pg14-parallel:
-  parallel: 24
-
-# Receiving 4 jobs from `rspec unit pg14`
-.rspec-ee-unit-pg14-parallel:
-  parallel: 22
-
-# Giving 2 jobs to `rspec-ee system pg14`
-.rspec-system-parallel-pg14:
-  parallel: 26
-
-# Receiving 2 jobs from `rspec system pg14`
-.rspec-ee-system-parallel-pg14:
-  parallel: 12
-
-# Adding 4 jobs, as those needs to be a bit faster.
-.rspec-migration-parallel-pg14:
-  parallel: 12
-
-# Adding 2 jobs, as those needs to be a bit faster.
-.rspec-migration-parallel-pg14-as-if-foss:
-  parallel: 10
-
-# Giving 1 job to `rspec integration pg14`
-.rspec-ee-integration-parallel-pg14:
-  parallel: 5
-
-# Receiving 1 job from `rspec-ee integration pg14`
-.rspec-integration-parallel-pg14:
-  parallel: 13
-
-# rspec job parallel configs
-############################
+  parallel: 14

.gitlab/ci/release-environments/main.gitlab-ci.yml

 ---
 include:
   - local: .gitlab/ci/cng/main.gitlab-ci.yml
+  - project: 'gitlab-org/quality/pipeline-common'
+    ref: master
+    file: ci/base.gitlab-ci.yml
+
+stages:
+  - prepare
+  - deploy
+  - qa
 
 release-environments-build-cng-env:
   extends: .build-cng-env
@@ -42,3 +50,15 @@ release-environments-deploy:
     project: gitlab-com/gl-infra/release-environments
     branch: main
     strategy: depend
+
+release-environments-qa:
+  stage: qa
+  extends:
+    - .qa-base
+  timeout: 3h
+  variables:
+    QA_SCENARIO: "Test::Instance::Smoke"
+    RELEASE: "${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab-ee-qa:${CI_COMMIT_SHA}"
+    GITLAB_QA_OPTS: --address "https://gitlab.${ENVIRONMENT}.release.gke.gitlab.net"
+    GITLAB_INITIAL_ROOT_PASSWORD: "${RELEASE_ENVIRONMENTS_ROOT_PASSWORD}"
+    SIGNUP_DISABLED: "true"

.gitlab/ci/reports.gitlab-ci.yml

@@ -80,7 +80,7 @@ gemnasium-python-dependency_scanning:
   extends: .default-retry
   stage: test
   image:
-    name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/security-products/package-hunter-cli:v3.0.0@sha256:e281525b3be870d6618b6bad2685733dcb9908e4eb21f0e5b4fe4bb6f6083f91
+    name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/security-products/package-hunter-cli:v3.0.1@sha256:ffa4af2810fed6922ba9d19badc4636043f54f70db19aebb8253e83142e5da16
     entrypoint: [""]
   variables:
     HTR_user: '$PACKAGE_HUNTER_USER'
@@ -118,3 +118,50 @@ package_hunter-bundler:
     - .reports:rules:package_hunter-bundler
   variables:
     PACKAGE_MANAGER: bundler
+
+xray_scan:
+  extends:
+    - .default-retry
+    - .reports:rules:x-ray
+  stage: lint
+  needs: []
+  image: registry.gitlab.com/gitlab-org/code-creation/repository-x-ray:rc
+  variables:
+    OUTPUT_DIR: reports
+  allow_failure: true
+  script:
+    - x-ray-scan -p "$CI_PROJECT_DIR" -o "$OUTPUT_DIR"
+  artifacts:
+    # this line uses xray_scan job output as source for GitLab Rails code gen feature
+    reports:
+      repository_xray: "$OUTPUT_DIR/*/*.json"
+    # this line saves xray_scan job output in raw form for inspection for testing purposes
+    paths:
+      - "$OUTPUT_DIR/*/*.json"
+
+pajamas_adoption:
+  extends:
+    - .default-retry
+    - .reports:rules:pajamas_adoption
+  allow_failure:
+    # The scanner exits with status:
+    # - 0 when no errors occur, and no blocking findings are found;
+    # - 1 when unexpected errors occur;
+    # - 2 when blocking findings are found.
+    # We only want to block the merge request in this last case.
+    exit_codes: 1
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/frontend/pajamas-adoption-scanner:latest
+  stage: lint
+  needs: []
+  variables:
+    FF_USE_NEW_BASH_EVAL_STRATEGY: 'true'
+  script:
+    - scan_gitlab_code_quality {,ee/}app/
+  artifacts:
+    name: pajamas-adoption
+    when: always
+    paths:
+      - gl-code-quality-report.json
+      - pas-findings.json
+    reports:
+      codequality: gl-code-quality-report.json

.gitlab/ci/review-apps/main.gitlab-ci.yml

@@ -67,7 +67,7 @@ review-build-cng:
     GITLAB_IMAGE_REPOSITORY: "registry.gitlab.com/gitlab-org/build/cng-mirror"
     GITLAB_IMAGE_SUFFIX: "ee"
     GITLAB_REVIEW_APP_BASE_CONFIG_FILE: "scripts/review_apps/base-config.yaml"
-    GITLAB_HELM_CHART_REF: "eace227d3465e17e37b1a2e3764dd244c8e2d716"  # 7.6.1: https://gitlab.com/gitlab-org/charts/gitlab/-/commit/eace227d3465e17e37b1a2e3764dd244c8e2d716
+    GITLAB_HELM_CHART_REF: "c91feed6983b24a1b0dbacaf5050ca5c59af3d46"  # 7.8.0: https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c91feed6983b24a1b0dbacaf5050ca5c59af3d46
   environment:
     name: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE}  # No separator for SCHEDULE_TYPE so it's compatible as before and looks nice without it
     url: https://gitlab-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}