.eslintignore

@@ -8,4 +8,6 @@
 /vendor/
 /sitespeed-result/
 /fixtures/**/*.graphql
+# Storybook build artifacts
+/storybook/public
 spec/fixtures/**/*.graphql

.eslintrc.yml

@@ -163,6 +163,7 @@ overrides:
       - '*.stories.js'
     rules:
       filenames/match-regex: off
+      '@gitlab/require-i18n-strings': off
   - files:
       - '*.graphql'
     plugins:

.gitlab-ci.yml

@@ -45,8 +45,8 @@ workflow:
         RUBY_VERSION: "3.0"
     # For (detached) merge request pipelines.
     - if: '$CI_MERGE_REQUEST_IID'
-    # For the maintenance scheduled pipelines, we set specific variables.
-    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "maintenance"'
+    # For the scheduled pipelines, we set specific variables.
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule"'
       variables:
         CRYSTALBALL: "true"
         CREATE_INCIDENT_FOR_PIPELINE_FAILURE: "true"
@@ -99,7 +99,7 @@ variables:
   GIT_SUBMODULE_STRATEGY: "none"
   GET_SOURCES_ATTEMPTS: "3"
   DEBIAN_VERSION: "bullseye"
-  CHROME_VERSION: "103"
+  CHROME_VERSION: "106"
   DOCKER_VERSION: "20.10.14"
   RUBY_VERSION: "2.7"
   GO_VERSION: "1.18"

.gitlab/ci/docs.gitlab-ci.yml

@@ -39,17 +39,6 @@ review-docs-cleanup:
   script:
     - ./scripts/trigger-build.rb docs cleanup
 
-docs-lint markdown:
-  extends:
-    - .default-retry
-    - .docs:rules:docs-lint
-  # When updating the image version here, update it in /scripts/lint-doc.sh too.
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.16-vale-2.20.1-markdownlint-0.32.2
-  stage: lint
-  needs: []
-  script:
-    - scripts/lint-doc.sh
-
 docs-lint links:
   extends:
     - .docs:rules:docs-lint
@@ -67,6 +56,35 @@ docs-lint links:
     # Check the internal links and anchors (in parallel)
     - "parallel time bundle exec nanoc check ::: internal_links internal_anchors"
 
+.docs-markdown-lint-image:
+  # When updating the image version here, update it in /scripts/lint-doc.sh too.
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.16-vale-2.20.1-markdownlint-0.32.2
+
+docs-lint markdown:
+  extends:
+    - .default-retry
+    - .docs:rules:docs-lint
+    - .docs-markdown-lint-image
+  stage: lint
+  needs: []
+  script:
+    - scripts/lint-doc.sh
+
+docs-code-quality:
+  extends:
+    - .docs:rules:docs-code-quality
+    - .docs-markdown-lint-image
+  stage: lint
+  needs: []
+  script:
+    - vale --output=doc/.vale/vale-json.tmpl --minAlertLevel warning doc > gl-code-quality-report-docs.json || exit_code=$?
+  artifacts:
+    reports:
+      codequality: gl-code-quality-report-docs.json
+    paths:
+      - gl-code-quality-report-docs.json
+    expire_in: 1 week
+
 ui-docs-links lint:
   extends:
     - .docs:rules:docs-lint

.gitlab/ci/frontend.gitlab-ci.yml

@@ -20,7 +20,12 @@
     - |
       if [[ "${CACHE_ASSETS_AS_PACKAGE}" == "true" ]]; then
         source scripts/gitlab_component_helpers.sh
-        gitlab_assets_archive_doesnt_exist || run_timed_command "download_and_extract_gitlab_assets"
+
+        if ! gitlab_assets_archive_doesnt_exist; then
+          # We remove all assets from the native cache as they could pollute the fresh assets from the package
+          rm -rf public/assets/ app/assets/javascripts/locale/**/app.js
+          run_timed_command "download_and_extract_gitlab_assets"
+        fi
       fi
     - assets_compile_script
 
@@ -84,17 +89,6 @@ update-assets-compile-test-cache:
     - echo -n "${GITLAB_ASSETS_HASH}" > "cached-assets-hash.txt"
   artifacts: {}  # This job's purpose is only to update the cache.
 
-# TODO: Remove this as it's duplicating update-assets-compile-*-cache
-update-yarn-cache:
-  extends:
-    - .default-retry
-    - .default-utils-before_script
-    - .yarn-cache-push
-    - .shared:rules:update-cache
-  stage: prepare
-  script:
-    - yarn_install_script
-
 update-storybook-yarn-cache:
   extends:
     - .default-retry

.gitlab/ci/glfm.gitlab-ci.yml

@@ -8,3 +8,9 @@ glfm-verify:
   script:
     - !reference [.base-script, script]
     - bundle exec scripts/glfm/verify-all-generated-files-are-up-to-date.rb
+  artifacts:
+    name: changed-files
+    when: on_failure
+    expire_in: 31d
+    paths:
+      - glfm_specification/

.gitlab/ci/global.gitlab-ci.yml

@@ -219,23 +219,16 @@
     - *node-modules-cache
     - *assets-tmp-cache
 
-# TODO: Remove this as it's duplicating .assets-compile-cache-push
-.yarn-cache-push:
-  cache:
-    - *node-modules-cache-push
-
 .assets-compile-cache:
   cache:
     - *ruby-gems-cache
     - *node-modules-cache
-    - *assets-cache
     - *assets-tmp-cache
 
 .assets-compile-cache-push:
   cache:
     - *ruby-gems-cache  # We don't push this cache as it's already rebuilt by `update-setup-test-env-cache`
     - *node-modules-cache-push
-    - *assets-cache-push
     - *assets-tmp-cache-push
 
 .storybook-yarn-cache:
@@ -245,7 +238,7 @@
 
 .storybook-yarn-cache-push:
   cache:
-    - *node-modules-cache  # We don't push this cache as it's already rebuilt by `update-yarn-cache`
+    - *node-modules-cache  # We don't push this cache as it's already rebuilt by `update-assets-compile-*-cache`
     - *storybook-node-modules-cache-push
 
 .use-pg11:

.gitlab/ci/package-and-test/main.gitlab-ci.yml

@@ -7,7 +7,7 @@ include:
   - local: .gitlab/ci/package-and-test/rules.gitlab-ci.yml
   - local: .gitlab/ci/package-and-test/variables.gitlab-ci.yml
   - project: gitlab-org/quality/pipeline-common
-    ref: 1.5.0
+    ref: 1.7.0
     file:
       - /ci/base.gitlab-ci.yml
       - /ci/allure-report.yml
@@ -208,7 +208,6 @@ ee:instance-parallel-ff-inverse:
     QA_KNAPSACK_REPORT_NAME: ee-instance-parallel
     GITLAB_QA_OPTS: --set-feature-flags $QA_FEATURE_FLAGS
   rules:
-    - !reference [.rules:test:feature-flags-deleted, rules] # skip job when only change is ff deletion
     - !reference [.rules:test:feature-flags-set, rules]
 
 # ------------------------------------------
@@ -226,7 +225,7 @@ ee:instance-parallel:
     - .parallel
     - ee:instance
   rules:
-    - !reference [.rules:test:feature-flags-set, rules] # always run instance-parallel to validate ff change
+    - !reference [.rules:test:feature-flags-set, rules]  # always run instance-parallel to validate ff change
     - !reference [.rules:test:qa-parallel, rules]
     - if: $QA_SUITES =~ /Test::Instance::All/
 
@@ -380,6 +379,15 @@ ee:update-major:
     - if: $QA_SUITES =~ /Test::Instance::Smoke/
     - !reference [.rules:test:manual, rules]
 
+ee:gitab-pages:
+  extends: .qa
+  variables:
+    QA_SCENARIO: Test::Integration::GitlabPages
+  rules:
+    - !reference [.rules:test:qa, rules]
+    - if: $QA_SUITES =~ /Test::Integration::GitlabPages/
+    - !reference [.rules:test:manual, rules]
+
 ee:gitaly-cluster:
   extends: .qa
   variables:
@@ -550,7 +558,7 @@ ee:elasticsearch:
   variables:
     QA_SCENARIO: "Test::Integration::Elasticsearch"
   before_script:
-    - unset ELASTIC_URL # unset url which is globally defined in .gitlab-ci.yml
+    - unset ELASTIC_URL  # unset url which is globally defined in .gitlab-ci.yml
     - !reference [.qa, before_script]
   rules:
     - !reference [.rules:test:qa, rules]
@@ -579,7 +587,7 @@ e2e-test-report:
     ALLURE_MERGE_REQUEST_IID: $CI_MERGE_REQUEST_IID
     ALLURE_JOB_NAME: e2e-package-and-test
     GIT_STRATEGY: none
-  artifacts: # save rspec results for displaying in parent pipeline
+  artifacts:  # save rspec results for displaying in parent pipeline
     expire_in: 1 day
     when: always
     paths:
@@ -594,6 +602,16 @@ upload-knapsack-report:
   stage: report
   when: always
 
+export-test-metrics:
+  extends:
+    - .qa-install
+    - .ruby-image
+    - .rules:report:process-results
+  stage: report
+  when: always
+  script:
+    - bundle exec rake "ci:export_test_metrics[$CI_PROJECT_DIR/gitlab-qa-run-*/**/test-metrics-*.json]"
+
 relate-test-failures:
   extends:
     - .qa-install
@@ -649,5 +667,5 @@ notify-slack:
     TYPE: "(package-and-test) "
   when: on_failure
   script:
-    - bundle exec gitlab-qa-report --prepare-stage-reports "$CI_PROJECT_DIR/gitlab-qa-run-*/**/rspec-*.xml" # generate summary
+    - bundle exec gitlab-qa-report --prepare-stage-reports "$CI_PROJECT_DIR/gitlab-qa-run-*/**/rspec-*.xml"  # generate summary
     - !reference [.notify-slack-qa, script]

.gitlab/ci/package-and-test/rules.gitlab-ci.yml

@@ -8,11 +8,8 @@
 
 # FF changes
 .feature-flags-set: &feature-flags-set
-  if: $QA_FEATURE_FLAGS != ""
+  if: $QA_FEATURE_FLAGS =~ /enabled|disabled/
 
-# Only deleted feature flags
-.feature-flags-deleted: &feature-flags-deleted
-  if: $QA_FEATURE_FLAGS != "" && $QA_FEATURE_FLAGS !~ /enabled|disabled/
 
 # Manually trigger job on ff changes but with default ff state instead of inverted
 .feature-flags-set-manual: &feature-flags-set-manual
@@ -20,9 +17,9 @@
   when: manual
   allow_failure: true
 
-# Run all tests when framework changes present or explicitly enabled full suite execution
+# Run all tests when framework changes present, full suite execution is explicitly enabled or a feature flag file is removed
 .qa-run-all-tests: &qa-run-all-tests
-  if: $QA_FRAMEWORK_CHANGES == "true" || $QA_RUN_ALL_TESTS == "true"
+  if: $QA_FRAMEWORK_CHANGES == "true" || $QA_RUN_ALL_TESTS == "true" || $QA_FEATURE_FLAGS =~ /deleted/
 
 # Process test results (notify failure to slack, create test session report, relate test failures)
 .process-test-results: &process-test-results
@@ -81,11 +78,6 @@
       variables:
         QA_TESTS: ""
 
-.rules:test:feature-flags-deleted:
-  rules:
-    - <<: *feature-flags-deleted
-      when: never
-
 # parallel and non parallel rules are used for jobs that require parallel execution and thus need to switch
 # between parallel and non parallel when only certain specs are executed
 .rules:test:qa-non-parallel:

.gitlab/ci/pages.gitlab-ci.yml

@@ -10,20 +10,18 @@ pages:
   environment: pages
   resource_group: pages
   needs:
-    - job: "rspec:coverage"
-    - job: "coverage-frontend"
-    - job: "compile-production-assets"
-    - job: "compile-storybook"
-    # `update-tests-metadata` only runs on GitLab.com's EE schedules pipelines
-    # while `pages` runs for all the maintenance scheduled pipelines.
-    - job: "update-tests-metadata"
-      optional: true
+    - "rspec:coverage"
+    - "coverage-frontend"
+    - "compile-production-assets"
+    - "compile-storybook"
+    - "update-tests-metadata"
+    - "generate-frontend-fixtures-mapping"
   before_script:
     - apt-get update && apt-get -y install brotli gzip
   script:
     - mv public/ .public/
     - mkdir public/
-    - mkdir -p public/$(dirname "$KNAPSACK_RSPEC_SUITE_REPORT_PATH") public/$(dirname "$FLAKY_RSPEC_SUITE_REPORT_PATH") public/$(dirname "$RSPEC_PACKED_TESTS_MAPPING_PATH")
+    - mkdir -p public/$(dirname "$KNAPSACK_RSPEC_SUITE_REPORT_PATH") public/$(dirname "$FLAKY_RSPEC_SUITE_REPORT_PATH") public/$(dirname "$RSPEC_PACKED_TESTS_MAPPING_PATH") public/$(dirname "$FRONTEND_FIXTURES_MAPPING_PATH")
     - mv coverage/ public/coverage-ruby/ || true
     - mv coverage-frontend/ public/coverage-frontend/ || true
     - mv storybook/public public/storybook || true
@@ -31,6 +29,7 @@ pages:
     - mv $KNAPSACK_RSPEC_SUITE_REPORT_PATH public/$KNAPSACK_RSPEC_SUITE_REPORT_PATH || true
     - mv $FLAKY_RSPEC_SUITE_REPORT_PATH public/$FLAKY_RSPEC_SUITE_REPORT_PATH || true
     - mv $RSPEC_PACKED_TESTS_MAPPING_PATH.gz public/$RSPEC_PACKED_TESTS_MAPPING_PATH.gz || true
+    - mv $FRONTEND_FIXTURES_MAPPING_PATH public/$FRONTEND_FIXTURES_MAPPING_PATH || true
     - *compress-public
   artifacts:
     paths:

.gitlab/ci/qa.gitlab-ci.yml

@@ -8,7 +8,6 @@
   variables:
     USE_BUNDLE_INSTALL: "false"
     SETUP_DB: "false"
-    QA_EXPORT_TEST_METRICS: "false"
   before_script:
     - !reference [.default-before_script, before_script]
     - cd qa && bundle install
@@ -78,8 +77,8 @@ e2e:package-and-test:
     SKIP_MESSAGE: Skipping package-and-test due to mr containing only quarantine changes!
     RELEASE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/build/omnibus-gitlab-mirror/gitlab-ee:${CI_COMMIT_SHA}"
     GITLAB_QA_IMAGE: "${CI_REGISTRY_IMAGE}/gitlab-ee-qa:${CI_COMMIT_SHA}"
-    RUN_WITH_BUNDLE: "true" # instructs pipeline to install and run gitlab-qa gem via bundler
-    QA_PATH: qa # sets the optional path for bundler to run from
+    RUN_WITH_BUNDLE: "true"  # instructs pipeline to install and run gitlab-qa gem via bundler
+    QA_PATH: qa  # sets the optional path for bundler to run from
   trigger:
     strategy: depend
     forward:

.gitlab/ci/reports.gitlab-ci.yml

@@ -40,22 +40,6 @@ brakeman-sast:
 semgrep-sast:
   rules: !reference [".reports:rules:semgrep-sast", rules]
 
-gosec-sast:
-  variables:
-    GOPATH: "$CI_PROJECT_DIR/vendor/go"
-    COMPILE: "false"
-    GOSEC_GO_PKG_PATH: "$CI_PROJECT_DIR"
-    SECURE_LOG_LEVEL: "debug"
-  before_script:
-    - mkdir -p $GOPATH
-    - cd workhorse
-    - go get -d ./...
-    - cd ..
-  cache:
-    paths:
-      - vendor/go
-  rules: !reference [".reports:rules:gosec-sast", rules]
-
 .secret-analyzer:
   extends: .default-retry
   stage: lint

.gitlab/ci/review-apps/main.gitlab-ci.yml

@@ -91,7 +91,7 @@ review-build-cng:
     DOMAIN: "-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}"
     GITLAB_HELM_CHART_REF: "138c146a5ba787942f66d4c7d795d224d6ba206a"
   environment:
-    name: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE} # No separator for SCHEDULE_TYPE so it's compatible as before and looks nice without it
+    name: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE}  # No separator for SCHEDULE_TYPE so it's compatible as before and looks nice without it
     url: https://gitlab-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}
     on_stop: review-stop
     auto_stop_in: 48 hours
@@ -117,7 +117,7 @@ review-deploy:
     - run_timed_command "check_kube_domain"
     - run_timed_command "download_chart"
     - run_timed_command "deploy" || (display_deployment_debug && exit 1)
-    - run_timed_command "verify_deploy" || exit 1
+    - run_timed_command "verify_deploy"|| (display_deployment_debug && exit 1)
     - run_timed_command "disable_sign_ups" || (delete_release && exit 1)
   after_script:
     # Run seed-dast-test-data.sh only when DAST_RUN is set to true. This is to pupulate review app with data for DAST scan.
@@ -172,7 +172,7 @@ review-stop:
   extends:
     - .review-stop-base
     - .review:rules:review-stop
-  resource_group: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE} # CI_ENVIRONMENT_SLUG is not available here and we want this to be the same as the environment
+  resource_group: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE}  # CI_ENVIRONMENT_SLUG is not available here and we want this to be the same as the environment
   stage: deploy
   needs: []
   script:

.gitlab/ci/review-apps/qa.gitlab-ci.yml

 include:
   - project: gitlab-org/quality/pipeline-common
-    ref: 1.5.0
+    ref: 1.7.0
     file:
       - /ci/base.gitlab-ci.yml
       - /ci/allure-report.yml
@@ -25,7 +25,7 @@ include:
     - cd qa && bundle install
 
 .review-qa-base:
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-bullseye-ruby-${RUBY_VERSION}:bundler-2.3-git-2.33-lfs-2.9-chrome-${CHROME_VERSION}-docker-${DOCKER_VERSION}-gcloud-383-kubectl-1.23
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/debian-bullseye-ruby-${RUBY_VERSION}:bundler-2.3-git-2.36-lfs-2.9-chrome-${CHROME_VERSION}-docker-${DOCKER_VERSION}-gcloud-383-kubectl-1.23
   extends:
     - .use-docker-in-docker
     - .bundle-base
@@ -146,7 +146,7 @@ e2e-test-report:
     GIT_STRATEGY: none
   allow_failure: true
   when: always
-  artifacts: # re-save rspec results for displaying in parent pipeline
+  artifacts:  # re-save rspec results for displaying in parent pipeline
     expire_in: 1 day
     when: always
     paths:
@@ -178,7 +178,7 @@ notify-slack:
   extends:
     - .notify-slack-qa
     - .qa-cache
-    - .rules:notify-slack
+    - .rules:main-run
   stage: post-qa
   variables:
     RUN_WITH_BUNDLE: "true"
@@ -188,6 +188,16 @@ notify-slack:
     STATUS_SYM: ☠️
     STATUS: failed
     TYPE: "(review-app) "
+  when: on_failure
   script:
-    - bundle exec gitlab-qa-report --prepare-stage-reports "$CI_PROJECT_DIR/qa/tmp/rspec-*.xml" # generate summary
+    - bundle exec gitlab-qa-report --prepare-stage-reports "$CI_PROJECT_DIR/qa/tmp/rspec-*.xml"  # generate summary
     - !reference [.notify-slack-qa, script]
+
+export-test-metrics:
+  extends:
+    - .bundle-base
+    - .rules:main-run
+  stage: post-qa
+  when: always
+  script:
+    - bundle exec rake "ci:export_test_metrics[tmp/test-metrics-*.json]"

.gitlab/ci/review-apps/rules.gitlab-ci.yml

@@ -61,7 +61,7 @@
     # always trigger smoke suite if review pipeline got triggered by specific changes in application code
     - <<: *app-changes
       variables:
-        QA_TESTS: "" # unset QA_TESTS even if specific tests were inferred from stage label
+        QA_TESTS: ""  # unset QA_TESTS even if specific tests were inferred from stage label
     - *qa-run-all-tests
     - if: $QA_SUITES =~ /Test::Instance::Smoke/
     - *qa-manual
@@ -77,7 +77,7 @@
     # always trigger blocking suite if review pipeline got triggered by specific changes in application code
     - <<: *app-changes
       variables:
-        QA_TESTS: "" # unset QA_TESTS even if specific tests were inferred from stage label
+        QA_TESTS: ""  # unset QA_TESTS even if specific tests were inferred from stage label
     - !reference [.never-when-specific-specs-always-when-qa-run-all-tests]
     - if: $QA_SUITES =~ /Test::Instance::ReviewBlocking/
 
@@ -88,7 +88,7 @@
 .rules:qa-non-blocking-parallel:
   rules:
     - !reference [.never-when-specific-specs-always-when-qa-run-all-tests]
-    - *all-specs-mr # set full suite to manual when no specific specs passed in mr
+    - *all-specs-mr  # set full suite to manual when no specific specs passed in mr
     - if: $QA_SUITES =~ /Test::Instance::ReviewNonBlocking/
 
 # ------------------------------------------
@@ -98,7 +98,6 @@
   rules:
     - when: always
 
-.rules:notify-slack:
+.rules:main-run:
   rules:
-    - <<: *default-branch
-      when: on_failure
+    - *default-branch

.gitlab/ci/review.gitlab-ci.yml

@@ -3,27 +3,23 @@ review-cleanup:
     - .default-retry
     - .review:rules:review-cleanup
   image: ${REVIEW_APPS_IMAGE}
-  resource_group: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE} # CI_ENVIRONMENT_SLUG is not available here and we want this to be the same as the environment
   stage: prepare
   environment:
-    name: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE} # No separator for SCHEDULE_TYPE so it's compatible as before and looks nice without it
+    name: review/regular-cleanup
     action: stop
   before_script:
     - source scripts/utils.sh
-    - source scripts/review_apps/review-apps.sh
     - source scripts/review_apps/gcp_cleanup.sh
     - install_gitlab_gem
     - setup_gcp_dependencies
   script:
-    - delete_release
-    - delete_namespace
     - scripts/review_apps/automated_cleanup.rb
     - gcp_cleanup
 
 start-review-app-pipeline:
   extends:
     - .review:rules:start-review-app-pipeline
-  resource_group: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE} # CI_ENVIRONMENT_SLUG is not available here and we want this to be the same as the environment
+  resource_group: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE}  # CI_ENVIRONMENT_SLUG is not available here and we want this to be the same as the environment
   stage: review
   needs:
     - job: e2e-test-pipeline-generate

.gitlab/ci/rules.gitlab-ci.yml

@@ -21,7 +21,7 @@
   if: '$FORCE_GITLAB_CI'
 
 .if-default-refs: &if-default-refs
-  if: '$CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH || $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable(-ee)?$/ || $CI_COMMIT_REF_NAME =~ /^\d+-\d+-auto-deploy-\d+$/ || $CI_COMMIT_REF_NAME =~ /^security\// || $CI_MERGE_REQUEST_IID || $CI_COMMIT_TAG || $FORCE_GITLAB_CI'
+  if: '$CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH || $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable(-ee)?$/ || $CI_COMMIT_REF_NAME =~ /^\d+-\d+-auto-deploy-\d+$/ || $CI_COMMIT_REF_NAME =~ /^security\// || $CI_COMMIT_REF_NAME == "ruby3" || $CI_MERGE_REQUEST_IID || $CI_COMMIT_TAG || $FORCE_GITLAB_CI'
 
 .if-default-branch-refs: &if-default-branch-refs
   if: '$CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH && $CI_MERGE_REQUEST_IID == null'
@@ -83,8 +83,8 @@
 .if-merge-request-labels-group-global-search: &if-merge-request-labels-group-global-search
   if: '$CI_MERGE_REQUEST_LABELS =~ /group::global search/'
 
-.if-merge-request-labels-pipeline-revert: &if-merge-request-labels-pipeline-revert
-  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:revert/'
+.if-merge-request-labels-pipeline-expedite-master-fixing: &if-merge-request-labels-pipeline-expedite-master-fixing
+  if: '$CI_MERGE_REQUEST_LABELS =~ /master:(foss-)?broken/ && $CI_MERGE_REQUEST_LABELS =~ /pipeline:expedite-master-fixing/'
 
 .if-merge-request-labels-frontend-and-feature-flag: &if-merge-request-labels-frontend-and-feature-flag
   if: '$CI_MERGE_REQUEST_LABELS =~ /frontend/ && $CI_MERGE_REQUEST_LABELS =~ /feature flag/'
@@ -213,6 +213,9 @@
   - "scripts/lint-doc.sh"
   - ".gitlab/ci/docs.gitlab-ci.yml"
 
+.docs-code-quality-patterns: &docs-code-quality-patterns
+  - "doc/**/*.md"
+
 .docs-deprecations-and-removals-patterns: &docs-deprecations-and-removals-patterns
   - "doc/update/deprecations.md"
   - "doc/update/removals.md"
@@ -664,7 +667,8 @@
 .shared:rules:update-gitaly-binaries-cache:
   rules:
     - <<: *if-merge-request-labels-update-caches
-    - changes: *gitaly-patterns
+    - <<: *if-default-refs
+      changes: *gitaly-patterns
 
 ######################
 # Build images rules #
@@ -693,8 +697,10 @@
     - <<: *if-merge-request-labels-run-review-app
     - <<: *if-auto-deploy-branches
     - <<: *if-ruby3-branch
-    - changes: *ci-build-images-patterns
-    - changes: *code-qa-patterns
+    - <<: *if-default-refs
+      changes: *ci-build-images-patterns
+    - <<: *if-default-refs
+      changes: *code-qa-patterns
 
 #################
 # Caching rules #
@@ -788,6 +794,12 @@
       when: manual
       allow_failure: true
 
+.docs:rules:docs-code-quality:
+  rules:
+    - <<: *if-default-branch-refs
+    - <<: *if-default-refs
+      changes: *docs-code-quality-patterns
+
 .docs:rules:docs-lint:
   rules:
     - <<: *if-default-refs
@@ -844,6 +856,8 @@
 
 .frontend:rules:minimal-default-rules:
   rules:
+    - <<: *if-merge-request-approved
+      when: never
     - <<: *if-automated-merge-request
       when: never
     - <<: *if-security-merge-request
@@ -856,15 +870,21 @@
     - <<: *if-merge-request-targeting-stable-branch
     - <<: *if-merge-request-labels-run-review-app
     - <<: *if-auto-deploy-branches
-    - changes: *ci-build-images-patterns
-    - changes: *code-qa-patterns
-    - changes: *workhorse-patterns
+    - <<: *if-ruby3-branch
+    - <<: *if-default-refs
+      changes: *ci-build-images-patterns
+    - <<: *if-default-refs
+      changes: *code-qa-patterns
+    - <<: *if-default-refs
+      changes: *workhorse-patterns
 
 .frontend:rules:compile-test-assets:
   rules:
     - <<: *if-merge-request-labels-run-all-rspec
-    - changes: *code-backstage-qa-patterns
-    - changes: *workhorse-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
+    - <<: *if-default-refs
+      changes: *workhorse-patterns
 
 .frontend:rules:compile-test-assets-as-if-foss:
   rules:
@@ -872,14 +892,18 @@
       when: never
     - <<: *if-merge-request-labels-as-if-foss
     - <<: *if-merge-request-labels-run-all-rspec
-    - changes: *code-backstage-qa-patterns
-    - changes: *startup-css-patterns
-    - changes: *workhorse-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
+    - <<: *if-default-refs
+      changes: *startup-css-patterns
+    - <<: *if-default-refs
+      changes: *workhorse-patterns
 
 .frontend:rules:default-frontend-jobs:
   rules:
     - <<: *if-merge-request-labels-run-all-rspec
-    - changes: *code-backstage-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
 
 .frontend:rules:default-frontend-jobs-as-if-foss:
   rules:
@@ -897,6 +921,7 @@
   rules:
     - !reference [".strict-ee-only-rules", rules]
     - !reference [".frontend:rules:default-frontend-jobs-as-if-foss", rules]
+    - <<: *if-merge-request-labels-run-all-jest
     - <<: *if-merge-request
       changes: *frontend-patterns-for-as-if-foss
 
@@ -907,14 +932,16 @@
     - <<: *if-merge-request-labels-run-all-jest
     - <<: *if-merge-request-labels-frontend-and-feature-flag
     - <<: *if-merge-request
-      changes: ["{package.json,yarn.lock}"]
+      changes: *frontend-dependency-patterns
     - <<: *if-merge-request
       changes: [".gitlab/ci/rules.gitlab-ci.yml", ".gitlab/ci/frontend.gitlab-ci.yml"]
     - <<: *if-automated-merge-request
       changes: *code-backstage-patterns
     - <<: *if-security-merge-request
       changes: *code-backstage-patterns
-    - <<: *if-default-branch-refs
+    - <<: *if-merge-request-not-approved
+      when: never
+    - <<: *if-default-refs
       changes: *code-backstage-patterns
 
 .frontend:rules:jest:minimal:
@@ -927,7 +954,7 @@
     - <<: *if-merge-request-labels-frontend-and-feature-flag
       when: never
     - <<: *if-merge-request
-      changes: ["{package.json,yarn.lock}"]
+      changes: *frontend-dependency-patterns
       when: never
     - <<: *if-merge-request
       changes: [".gitlab/ci/rules.gitlab-ci.yml", ".gitlab/ci/frontend.gitlab-ci.yml"]
@@ -941,18 +968,24 @@
     - <<: *if-merge-request-labels-as-if-foss
     - <<: *if-merge-request-labels-run-all-jest
     - <<: *if-merge-request
-      changes: ["{package.json,yarn.lock}"]
+      changes: *frontend-dependency-patterns
     - <<: *if-security-merge-request
       changes: *code-backstage-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    - <<: *if-merge-request
+      changes: *frontend-patterns-for-as-if-foss
 
 .frontend:rules:jest:minimal:as-if-foss:
   rules:
     - !reference [".strict-ee-only-rules", rules]
     - !reference [".frontend:rules:minimal-default-rules", rules]
+    - <<: *if-merge-request-labels-as-if-foss
+      when: never
     - <<: *if-merge-request-labels-run-all-jest
       when: never
     - <<: *if-merge-request
-      changes: ["{package.json,yarn.lock}"]
+      changes: *frontend-dependency-patterns
       when: never
     - <<: *if-fork-merge-request
       when: never
@@ -970,7 +1003,7 @@
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-labels-pipeline-revert
+    - <<: *if-merge-request-labels-pipeline-expedite-master-fixing
       when: never
     - <<: *if-merge-request
       changes: *code-backstage-patterns
@@ -1079,7 +1112,7 @@
       when: never
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-labels-pipeline-revert
+    - <<: *if-merge-request-labels-pipeline-expedite-master-fixing
       when: never
     - <<: *if-merge-request-targeting-stable-branch
       allow_failure: true
@@ -1114,6 +1147,8 @@
         SKIP_REPORT_IN_ISSUES: "false"
         PROCESS_TEST_RESULTS: "true"
         KNAPSACK_GENERATE_REPORT: "true"
+        QA_SAVE_TEST_METRICS: "true"
+        QA_EXPORT_TEST_METRICS: "false" # on main runs, metrics are exported to separate bucket via rake task for better consistency
     - <<: *if-force-ci
       when: manual
       allow_failure: true
@@ -1123,7 +1158,8 @@
 ###############
 .rails:rules:setup-test-env:
   rules:
-    - changes: *setup-test-env-patterns
+    - <<: *if-default-refs
+      changes: *setup-test-env-patterns
     - <<: *if-merge-request-labels-run-all-rspec
 
 .rails:rules:single-db:
@@ -1155,7 +1191,8 @@
       changes: *db-patterns
     - <<: *if-merge-request-not-approved
       when: never
-    - changes: *db-patterns
+    - <<: *if-default-refs
+      changes: *db-patterns
 
 .rails:rules:ee-and-foss-migration:minimal:
   rules:
@@ -1188,7 +1225,8 @@
     - <<: *if-fork-merge-request
       when: never
     - !reference [".rails:rules:ee-and-foss-default-rules", rules]
-    - changes: *backend-patterns
+    - <<: *if-default-refs
+      changes: *backend-patterns
 
 .rails:rules:ee-and-foss-unit:minimal:
   rules:
@@ -1204,7 +1242,8 @@
     - <<: *if-fork-merge-request
       when: never
     - !reference [".rails:rules:ee-and-foss-default-rules", rules]
-    - changes: *backend-patterns
+    - <<: *if-default-refs
+      changes: *backend-patterns
 
 .rails:rules:ee-and-foss-integration:minimal:
   rules:
@@ -1220,7 +1259,8 @@
     - <<: *if-fork-merge-request
       when: never
     - !reference [".rails:rules:system-default-rules", rules]
-    - changes: *code-backstage-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
 
 .rails:rules:ee-and-foss-system:minimal:
   rules:
@@ -1234,11 +1274,13 @@
     - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-merge-request
       changes: *backend-patterns
-    - changes: *core-backend-patterns
+    - <<: *if-default-refs
+      changes: *core-backend-patterns
 
 .rails:rules:code-backstage-qa:
   rules:
-    - changes: *code-backstage-qa-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
     - <<: *if-merge-request-labels-run-all-rspec
 
 .rails:rules:ee-only-migration:
@@ -1258,7 +1300,8 @@
       changes: *db-patterns
     - <<: *if-merge-request-not-approved
       when: never
-    - changes: *db-patterns
+    - <<: *if-default-refs
+      changes: *db-patterns
 
 .rails:rules:ee-only-migration:minimal:
   rules:
@@ -1279,7 +1322,8 @@
     - <<: *if-fork-merge-request
       when: never
     - !reference [".rails:rules:ee-and-foss-default-rules", rules]
-    - changes: *backend-patterns
+    - <<: *if-default-refs
+      changes: *backend-patterns
 
 .rails:rules:ee-only-unit:minimal:
   rules:
@@ -1299,7 +1343,8 @@
     - <<: *if-fork-merge-request
       when: never
     - !reference [".rails:rules:ee-and-foss-default-rules", rules]
-    - changes: *backend-patterns
+    - <<: *if-default-refs
+      changes: *backend-patterns
 
 .rails:rules:ee-only-integration:minimal:
   rules:
@@ -1319,7 +1364,8 @@
     - <<: *if-fork-merge-request
       when: never
     - !reference [".rails:rules:system-default-rules", rules]
-    - changes: *code-backstage-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
 
 .rails:rules:ee-only-system:minimal:
   rules:
@@ -1433,7 +1479,8 @@
 
 .rails:rules:ee-and-foss-db-library-code:
   rules:
-    - changes: *db-library-patterns
+    - <<: *if-default-refs
+      changes: *db-library-patterns
     - <<: *if-merge-request-labels-run-all-rspec
 
 .rails:rules:ee-mr-and-default-branch-only:
@@ -1449,8 +1496,10 @@
 .rails:rules:detect-tests:
   rules:
     - <<: *if-merge-request-labels-run-all-rspec
-    - changes: *code-backstage-qa-patterns
-    - changes: *workhorse-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
+    - <<: *if-default-refs
+      changes: *workhorse-patterns
 
 .rails:rules:detect-previous-failed-tests:
   rules:
@@ -1502,7 +1551,7 @@
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-labels-pipeline-revert
+    - <<: *if-merge-request-labels-pipeline-expedite-master-fixing
       when: never
     - <<: *if-merge-request
       changes: *code-backstage-patterns
@@ -1513,7 +1562,7 @@
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-labels-pipeline-revert
+    - <<: *if-merge-request-labels-pipeline-expedite-master-fixing
       when: never
     - <<: *if-merge-request-labels-skip-undercoverage
       when: never
@@ -1541,13 +1590,14 @@
   rules:
     - <<: *if-not-ee
       when: never
-    - changes: *code-backstage-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
 
 .rails:rules:flaky-tests-report:
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-labels-pipeline-revert
+    - <<: *if-merge-request-labels-pipeline-expedite-master-fixing
       when: never
     - if: '$SKIP_FLAKY_TESTS_AUTOMATICALLY == "true" || $RETRY_FAILED_TESTS_IN_NEW_PROCESS == "true"'
       changes: *code-backstage-patterns
@@ -1559,38 +1609,51 @@
 
 .static-analysis:rules:static-analysis:
   rules:
-    - changes: *code-backstage-qa-patterns
-    - changes: *static-analysis-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
+    - <<: *if-default-refs
+      changes: *static-analysis-patterns
 
 .static-analysis:rules:static-verification-with-database:
   rules:
-    - changes: *code-backstage-qa-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
 
 .static-analysis:rules:rubocop:
   rules:
-    - changes: *rubocop-patterns
+    - <<: *if-default-refs
+      changes: *rubocop-patterns
       variables:
         RUN_ALL_RUBOCOP: "true"
-    - changes: *code-backstage-qa-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
 
 .static-analysis:rules:qa:metadata-lint:
   rules:
-    - changes: *qa-patterns
-    - changes: [".gitlab/ci/static-analysis.gitlab-ci.yml"]
+    - <<: *if-default-refs
+      changes: *qa-patterns
+    - <<: *if-default-refs
+      changes: [".gitlab/ci/static-analysis.gitlab-ci.yml"]
 
 .static-analysis:rules:haml-lint:
   rules:
-    - changes: *rubocop-patterns
-    - changes: *static-analysis-patterns
-    - changes: *code-backstage-qa-patterns
+    - <<: *if-default-refs
+      changes: *rubocop-patterns
+    - <<: *if-default-refs
+      changes: *static-analysis-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
 
 .static-analysis:rules:haml-lint-ee:
   rules:
     - <<: *if-not-ee
       when: never
-    - changes: *rubocop-patterns
-    - changes: *static-analysis-patterns
-    - changes: *code-backstage-qa-patterns
+    - <<: *if-default-refs
+      changes: *rubocop-patterns
+    - <<: *if-default-refs
+      changes: *static-analysis-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
 
 .static-analysis:rules:static-analysis-as-if-foss:
   rules:
@@ -1708,26 +1771,19 @@
       when: never
     - if: $SAST_EXCLUDED_ANALYZERS =~ /brakeman/
       when: never
-    - changes:
+    - <<: *if-default-refs
+      changes:
         - '**/*.rb'
         - '**/Gemfile'
 
-.reports:rules:gosec-sast:
-  rules:
-    - if: $SAST_DISABLED
-      when: never
-    - if: $SAST_EXCLUDED_ANALYZERS =~ /gosec/
-      when: never
-    - changes:
-        - '**/*.go'
-
 .reports:rules:semgrep-sast:
   rules:
     - if: $SAST_DISABLED
       when: never
     - if: $SAST_EXCLUDED_ANALYZERS =~ /semgrep/
       when: never
-    - changes:
+    - <<: *if-default-refs
+      changes:
         - '**/*.py'
         - '**/*.js'
         - '**/*.jsx'
@@ -1743,7 +1799,8 @@
       when: never
     # Scan each commit on master to feed the Vulnerability Reports with detected secrets
     - <<: *if-default-branch-refs
-    - changes: *code-backstage-qa-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-qa-patterns
 
 .reports:rules:gemnasium-dependency_scanning:
   rules:
@@ -1751,7 +1808,8 @@
       when: never
     # Run Dependency Scanning on master until https://gitlab.com/gitlab-org/gitlab/-/issues/361657 is resolved
     - <<: *if-default-branch-refs
-    - changes: *dependency-patterns
+    - <<: *if-default-refs
+      changes: *dependency-patterns
 
 .reports:rules:gemnasium-python-dependency_scanning:
   rules:
@@ -1759,7 +1817,8 @@
       when: never
     # Run Dependency Scanning on master until https://gitlab.com/gitlab-org/gitlab/-/issues/361657 is resolved
     - <<: *if-default-branch-refs
-    - changes: *python-patterns
+    - <<: *if-default-refs
+      changes: *python-patterns
 
 .reports:rules:yarn-audit-dependency_scanning:
   rules:
@@ -1767,7 +1826,8 @@
       when: never
     # Run Dependency Scanning on master until https://gitlab.com/gitlab-org/gitlab/-/issues/361657 is resolved
     - <<: *if-default-branch-refs
-    - changes: *nodejs-patterns
+    - <<: *if-default-refs
+      changes: *nodejs-patterns
 
 .reports:rules:schedule-dast:
   rules:
@@ -1801,7 +1861,8 @@
   rules:
     - if: '$LICENSE_MANAGEMENT_DISABLED || $GITLAB_FEATURES !~ /\blicense_scanning\b/'
       when: never
-    - changes: *dependency-patterns
+    - <<: *if-default-refs
+      changes: *dependency-patterns
 
 ################
 # Review rules #
@@ -1817,33 +1878,42 @@
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-labels-pipeline-revert
+    - <<: *if-merge-request-labels-pipeline-expedite-master-fixing
       when: never
     - <<: *if-merge-request-labels-run-review-app
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *ci-review-patterns
+      when: never
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *frontend-build-patterns
       variables: *review-change-pattern
+      when: never
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *controllers-patterns
       variables: *review-change-pattern
+      when: never
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *models-patterns
       variables: *review-change-pattern
+      when: never
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *lib-gitlab-patterns
       variables: *review-change-pattern
+      when: never
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *qa-patterns
+      when: never
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *code-patterns
       when: manual
       allow_failure: true
     - <<: *if-dot-com-gitlab-org-schedule
+      when: never
       allow_failure: true
       variables:
         KNAPSACK_GENERATE_REPORT: "true"
+        QA_SAVE_TEST_METRICS: "true"
+        QA_EXPORT_TEST_METRICS: "false" # on main runs, metrics are exported to separate bucket via rake task for better consistency
 
 .review:rules:review-build-cng:
   rules:
@@ -1874,7 +1944,7 @@
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-labels-pipeline-revert
+    - <<: *if-merge-request-labels-pipeline-expedite-master-fixing
       when: never
     - <<: *if-merge-request-labels-run-review-app
       when: manual
@@ -1988,7 +2058,8 @@
     - <<: *if-not-ee
       when: never
     - <<: *if-dot-com-ee-schedule-maintenance
-    - changes:
+    - <<: *if-default-refs
+      changes:
         - ".gitlab/ci/setup.gitlab-ci.yml"
         - ".gitlab/ci/test-metadata.gitlab-ci.yml"
         - "scripts/rspec_helpers.sh"
@@ -1998,8 +2069,10 @@
 #######################
 .test-metadata:rules:retrieve-tests-metadata:
   rules:
-    - changes: *code-backstage-patterns
-    - changes: *workhorse-patterns
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+    - <<: *if-default-refs
+      changes: *workhorse-patterns
     - <<: *if-merge-request-labels-run-all-rspec
 
 .test-metadata:rules:update-tests-metadata:
@@ -2007,7 +2080,8 @@
     - <<: *if-not-ee
       when: never
     - <<: *if-dot-com-ee-schedule-maintenance
-    - changes:
+    - <<: *if-default-refs
+      changes:
         - ".gitlab/ci/test-metadata.gitlab-ci.yml"
         - "scripts/rspec_helpers.sh"
 
@@ -2016,7 +2090,8 @@
 ###################
 .workhorse:rules:workhorse:
   rules:
-    - changes: *workhorse-patterns
+    - <<: *if-default-refs
+      changes: *workhorse-patterns
 
 ###################
 # yaml-lint rules #

.gitlab/ci/workhorse.gitlab-ci.yml

@@ -27,7 +27,7 @@ workhorse:test go:
   extends: .workhorse:test
   parallel:
     matrix:
-      - GO_VERSION: ["1.17", "1.18", "1.19"]
+      - GO_VERSION: ["1.18", "1.19"]
   script:
     - make -C workhorse test-coverage
   coverage: '/\d+.\d+%/'

.gitlab/issue_templates/Feature Flag Roll Out.md

 <!-- Title suggestion: [Feature flag] Enable description of feature -->
 
+<!--
+Set the main issue link: The main issue is the one that describes the problem to solve,
+the one this feature flag is being added for. For example:
+
+[main-issue]: https://gitlab.com/gitlab-org/gitlab/-/issues/123456
+-->
+
+[main-issue]: MAIN-ISSUE-LINK
+
 ## Summary
 
-This issue is to rollout [the feature](ISSUE LINK) on production,
+This issue is to rollout [the feature][main-issue] on production,
 that is currently behind the `<feature-flag-name>` feature flag.
 
 <!-- Short description of what the feature is about and link to relevant other issues. -->
@@ -89,7 +98,7 @@ _Consider adding links to check for Sentry errors, Production logs for 5xx, 302s
 - [ ] Ensure that you or a representative in development can be available for at least 2 hours after feature flag updates in production.
   If a different developer will be covering, or an exception is needed, please inform the oncall SRE by using the `@sre-oncall` Slack alias.
 - [ ] Ensure that documentation has been updated ([More info](https://docs.gitlab.com/ee/development/documentation/feature_flags.html#features-that-became-enabled-by-default)).
-- [ ] Announce on [the feature issue](ISSUE LINK) an estimated time this will be enabled on GitLab.com. 
+- [ ] Leave a comment on [the feature issue][main-issue] announcing estimated time when this feature flag will be enabled on GitLab.com. 
 - [ ] Ensure that any breaking changes have been announced following the [release post process](https://about.gitlab.com/handbook/marketing/blog/release-posts/#deprecations-removals-and-breaking-changes) to ensure GitLab customers are aware.
 - [ ] Notify `#support_gitlab-com` and your team channel ([more guidance when this is necessary in the dev docs](https://docs.gitlab.com/ee/development/feature_flags/controls.html#communicate-the-change)).
 
@@ -104,7 +113,7 @@ For visibility, all `/chatops` commands that target production should be execute
     - [ ] `/chatops run feature set <feature-flag-name> <rollout-percentage> --random`
   - Enable the feature globally on production environment.
     - [ ] `/chatops run feature set <feature-flag-name> true`
-- [ ] Announce on [the feature issue](ISSUE LINK) that the feature has been globally enabled.
+- [ ] Leave a comment on [the feature issue][main-issue] announcing that the feature has been globally enabled.
 - [ ] Wait for [at least one day for the verification term](https://about.gitlab.com/handbook/product-development-flow/feature-flag-lifecycle/#including-a-feature-behind-feature-flag-in-the-final-release).
 
 ### (Optional) Release the feature with the feature flag
@@ -122,7 +131,7 @@ To do so, follow these steps:
     - [ ] `/chatops run release check <merge-request-url> <milestone>`
 - [ ] Consider cleaning up the feature flag from all environments by running these chatops command in `#production` channel. Otherwise these settings may override the default enabled.
     - [ ] `/chatops run feature delete <feature-flag-name> --dev --staging --staging-ref --production`
-- [ ] Close [the feature issue](ISSUE LINK) to indicate the feature will be released in the current milestone.
+- [ ] Close [the feature issue][main-issue] to indicate the feature will be released in the current milestone.
 - [ ] Set the next milestone to this rollout issue for scheduling [the flag removal](#release-the-feature).
 - [ ] (Optional) You can [create a separate issue](https://gitlab.com/gitlab-org/gitlab/-/issues/new?issuable_template=Feature%20Flag%20Cleanup) for scheduling the steps below to [Release the feature](#release-the-feature).
     - [ ] Set the title to "[Feature flag] Cleanup `<feature-flag-name>`".
@@ -155,7 +164,7 @@ You can either [create a follow-up issue for Feature Flag Cleanup](https://gitla
       If the merge request was deployed before [the monthly release was tagged](https://about.gitlab.com/handbook/engineering/releases/#self-managed-releases-1),
       the feature can be officially announced in a release blog post.
     - [ ] `/chatops run release check <merge-request-url> <milestone>`
-- [ ] Close [the feature issue](ISSUE LINK) to indicate the feature will be released in the current milestone.
+- [ ] Close [the feature issue][main-issue] to indicate the feature will be released in the current milestone.
 - [ ] If not already done, clean up the feature flag from all environments by running these chatops command in `#production` channel:
     - [ ] `/chatops run feature delete <feature-flag-name> --dev --staging --staging-ref --production`
 - [ ] Close this rollout issue.