app/models/concerns/ci/has_runner_status.rb

@@ -32,7 +32,7 @@ def stale_deadline
 
     def status
       return :stale if stale?
-      return :never_contacted unless contacted_at
+      return :never_contacted unless finished_creation_state?
 
       online? ? :online : :offline
     end

app/models/integrations/beyond_identity.rb

@@ -17,6 +17,23 @@ class BeyondIdentity < Integration
       },
       required: true
 
+    field :exclude_service_accounts,
+      type: :checkbox,
+      title: 'Exclude service accounts',
+      help: -> {
+        docs_link = ActionController::Base.helpers.link_to(
+          _('service accounts'),
+          Rails.application.routes.url_helpers.help_page_url('user/profile/service_accounts'),
+          target: '_blank', rel: 'noopener noreferrer')
+
+        format(s_(
+          'BeyondIdentityService|If enabled, Beyond Identity will not check commits from %{docs_link}.'
+        ).html_safe, docs_link: docs_link.html_safe) # rubocop:disable Rails/OutputSafety -- It is fine to call html_safe here
+      },
+      description: -> {
+        s_('BeyondIdentityService|If enabled, Beyond Identity will not check commits from service accounts.')
+      }
+
     def self.title
       'Beyond Identity'
     end

app/models/merge_request_diff.rb

@@ -454,7 +454,7 @@ def diffs_in_batch(batch_page, batch_size, diff_options:)
           )
         end
 
-        diff_options[:generated_files] = comparison.generated_files if diff_options[:collapse_generated]
+        diff_options[:generated_files] = comparison.generated_files
 
         Gitlab::Metrics.measure(:diffs_comparison) do
           comparison.diffs(diff_options)
@@ -469,25 +469,19 @@ def paginated_diffs(page, per_page)
     fetching_repository_diffs({}) do |comparison|
       reorder_diff_files!
 
-      collapse_generated = Feature.enabled?(:collapse_generated_diff_files, project)
-      diff_options = { collapse_generated: collapse_generated }
-
       collection = Gitlab::Diff::FileCollection::PaginatedMergeRequestDiff.new(
         self,
         page,
-        per_page,
-        diff_options
+        per_page
       )
 
       if comparison
-        diff_options[:generated_files] = comparison.generated_files if collapse_generated
-
         comparison.diffs(
-          diff_options.merge(
-            paths: collection.diff_paths,
-            page: collection.current_page,
-            per_page: collection.limit_value,
-            count: collection.total_count)
+          generated_files: comparison.generated_files,
+          paths: collection.diff_paths,
+          page: collection.current_page,
+          per_page: collection.limit_value,
+          count: collection.total_count
         )
       else
         collection
@@ -832,7 +826,7 @@ def save_diffs
       new_attributes[:state] = :empty
     else
       options = Commit.max_diff_options
-      options[:generated_files] = compare.generated_files if Feature.enabled?(:collapse_generated_diff_files, project)
+      options[:generated_files] = compare.generated_files
 
       diff_collection = compare.diffs(options)
       new_attributes[:real_size] = diff_collection.real_size

app/models/organizations/organization_user.rb

@@ -19,6 +19,7 @@ class OrganizationUser < ApplicationRecord
 
     scope :owners, -> { where(access_level: Gitlab::Access::OWNER) }
     scope :in_organization, ->(organization) { where(organization: organization) }
+    scope :with_active_users, -> { joins(:user).merge(User.active) }
 
     def self.create_default_organization_record_for(user_id, user_is_admin:)
       upsert(
@@ -69,6 +70,16 @@ def self.create_organization_record_for(user_id, organization_id)
         )
     end
 
+    def last_owner?
+      return false unless owner?
+
+      other_owners = organization.organization_users.owners.id_not_in(id)
+      # Try to keep the last active user as owner
+      return other_owners.with_active_users.empty? if user.active?
+
+      other_owners.empty?
+    end
+
     private
 
     def ensure_user_has_an_organization

app/policies/achievements/achievement_policy.rb

@@ -3,5 +3,13 @@
 module Achievements
   class AchievementPolicy < ::BasePolicy
     delegate { @subject.namespace }
+
+    condition(:achievement_recipient, scope: :subject) do
+      @user && @user.user_achievements.any? { |user_achievement| user_achievement.achievement_id == @subject.id }
+    end
+
+    rule { achievement_recipient }.policy do
+      enable :read_achievement
+    end
   end
 end

app/policies/achievements/user_achievement_policy.rb

@@ -2,14 +2,15 @@
 
 module Achievements
   class UserAchievementPolicy < ::BasePolicy
+    delegate { @subject.achievement }
     delegate { @subject.achievement.namespace }
     delegate { @subject.user }
 
-    condition(:user_is_owner) { @subject.user == @user }
+    condition(:user_is_recipient) { @subject.user == @user }
 
     rule { can?(:read_user_profile) | can?(:admin_achievement) }.enable :read_user_achievement
 
-    rule { user_is_owner }.enable :update_owned_user_achievement
+    rule { user_is_recipient }.enable :update_owned_user_achievement
 
     rule { can?(:update_owned_user_achievement) }.enable :update_user_achievement
 

app/policies/group_policy.rb

@@ -165,16 +165,23 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
     enable :read_namespace
   end
 
-  rule { achievements_enabled }.policy do
+  rule { ~achievements_enabled }.policy do
+    prevent :read_achievement
+    prevent :admin_achievement
+    prevent :award_achievement
+    prevent :destroy_user_achievement
+  end
+
+  rule { can?(:read_group) }.policy do
     enable :read_achievement
   end
 
-  rule { can?(:maintainer_access) & achievements_enabled }.policy do
+  rule { can?(:maintainer_access) }.policy do
     enable :admin_achievement
     enable :award_achievement
   end
 
-  rule { can?(:owner_access) & achievements_enabled }.policy do
+  rule { can?(:owner_access) }.policy do
     enable :destroy_user_achievement
   end
 

app/policies/organizations/organization_user_policy.rb

@@ -3,5 +3,9 @@
 module Organizations
   class OrganizationUserPolicy < BasePolicy
     delegate :organization
+
+    condition(:last_owner?) { @subject.last_owner? }
+
+    rule { ~last_owner? }.enable :remove_user
   end
 end

app/serializers/merge_request_sidebar_basic_entity.rb

@@ -11,3 +11,5 @@ class MergeRequestSidebarBasicEntity < IssuableSidebarBasicEntity
     end
   end
 end
+
+MergeRequestSidebarBasicEntity.prepend_mod_with('MergeRequestSidebarBasicEntity')

app/services/concerns/integrations/project_test_data.rb

@@ -23,7 +23,7 @@ def note_events_data
 
       no_data_error(s_('TestHooks|Ensure the project has notes.')) unless note.present?
 
-      Gitlab::DataBuilder::Note.build(note, current_user)
+      Gitlab::DataBuilder::Note.build(note, current_user, :create)
     end
 
     def issues_events_data

app/services/notes/post_process_service.rb

@@ -29,7 +29,7 @@ def create_design_discussion_system_note?
     end
 
     def hook_data
-      Gitlab::DataBuilder::Note.build(note, note.author)
+      Gitlab::DataBuilder::Note.build(note, note.author, :create)
     end
 
     def execute_note_hooks

app/services/notes/update_service.rb

@@ -102,7 +102,7 @@ def track_note_edit_usage_for_issues(note)
     def execute_note_webhook(note)
       return unless note.project && note.previous_changes.include?('note')
 
-      note_data = Gitlab::DataBuilder::Note.build(note, note.author)
+      note_data = Gitlab::DataBuilder::Note.build(note, note.author, :update)
       is_confidential = note.confidential?(include_noteable: true)
       hooks_scope = is_confidential ? :confidential_note_hooks : :note_hooks
 

app/services/projects/update_remote_mirror_service.rb

@@ -39,7 +39,7 @@ def execute(remote_mirror, tries)
     private
 
     def normalized_url(url)
-      strong_memoize(:normalized_url) do
+      strong_memoize_with(:normalized_url, url) do
         CGI.unescape(Gitlab::UrlSanitizer.sanitize(url))
       end
     end

app/validators/json_schemas/scan_result_policy_violation_data.json

@@ -27,6 +27,19 @@
               ]
             }
           }
+        },
+        "license_scanning": {
+          "type": "object",
+          "minProperties": 1,
+          "patternProperties": {
+            "^.+$": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          "additionalProperties": false
         }
       }
     },

app/views/groups/registry/repositories/index.html.haml

@@ -19,4 +19,5 @@
     invalid_path_error: (!!@invalid_path_error).to_s,
     user_callouts_path: callouts_path,
     user_callout_id: Users::CalloutsHelper::UNFINISHED_TAG_CLEANUP_CALLOUT,
+    is_metadata_database_enabled: ContainerRegistry::GitlabApiClient.supports_gitlab_api?.to_s,
     show_unfinished_tag_cleanup_callout: show_unfinished_tag_cleanup_callout?.to_s } }

app/views/projects/compare/show.html.haml

@@ -4,7 +4,7 @@
 -# Only show commit list in the first page
 - hide_commit_list = params[:page].present? && params[:page] != '1'
 
-.sub-header-block.gl-border-b-0.gl-mb-0.gl-pt-4
+.gl-border-b-0.gl-mb-0.gl-pt-4
   .js-signature-container{ data: { 'signatures-path' => signatures_namespace_project_compare_index_path } }
     #js-compare-selector{ data: project_compare_selector_data(@project, @merge_request, params) }
 

app/views/projects/merge_requests/_approvals_count.html.haml

@@ -5,9 +5,9 @@
 - if total > 0
   - final_text = n_("%d approver", "%d approvers", total) % total
   - final_self_text = n_("%d approver (you've approved)", "%d approvers (you've approved)", total) % total
+  - approval_tooltip = self_approved ? final_self_text : final_text
+  - approval_icon = 'check'
+  - badge_variant = :success
+  - badge_label = _("Approved")
 
-  - approval_icon = sprite_icon((self_approved ? 'approval-solid' : 'approval'), css_class: 'align-middle')
-
-  %li.gl-display-none.gl-sm-display-inline-block.has-tooltip.text-success{ title: self_approved ? final_self_text : final_text }
-    = approval_icon
-    = _("Approved")
+  %li.gl-display-flex= render Pajamas::BadgeComponent.new(badge_label, size: 'sm', variant: badge_variant, icon: approval_icon, title: approval_tooltip, class: 'has-tooltip', data: { 'testid': 'mr-appovals' })

app/views/projects/registry/repositories/index.html.haml

@@ -24,4 +24,5 @@
     invalid_path_error: (!!@invalid_path_error).to_s,
     user_callouts_path: callouts_path,
     user_callout_id: Users::CalloutsHelper::UNFINISHED_TAG_CLEANUP_CALLOUT,
+    is_metadata_database_enabled: ContainerRegistry::GitlabApiClient.supports_gitlab_api?.to_s,
     show_unfinished_tag_cleanup_callout: show_unfinished_tag_cleanup_callout?.to_s, } }

app/views/projects/settings/packages_and_registries/cleanup_tags.html.haml

@@ -2,4 +2,4 @@
 - breadcrumb_title s_('ContainerRegistry|Cleanup policies')
 - page_title s_('ContainerRegistry|Cleanup policies'), _('Packages and registries settings')
 
-#js-registry-settings-cleanup-image-tags{ data: cleanup_settings_data }
+#js-registry-settings-cleanup-image-tags{ data: cleanup_settings_data(@project) }

app/views/shared/web_hooks/_form.html.haml

@@ -26,11 +26,11 @@
     %li.gl-pb-3
       = form.gitlab_ui_checkbox_component :note_events,
           integration_webhook_event_human_name(:note_events),
-          help_text: s_('Webhooks|A comment is added to an issue or merge request.')
+          help_text: s_('Webhooks|A comment is made or edited on an issue or merge request.')
     %li.gl-pb-3
       = form.gitlab_ui_checkbox_component :confidential_note_events,
           integration_webhook_event_human_name(:confidential_note_events),
-          help_text: s_('Webhooks|A comment is added to a confidential issue.')
+          help_text: s_('Webhooks|A comment is made or edited on a confidential issue.')
     %li.gl-pb-3
       = form.gitlab_ui_checkbox_component :issues_events,
           integration_webhook_event_human_name(:issues_events),