Remove the REST merge request CSV export

What does this MR do and why?

The MR list "Export as CSV" now always goes through the mergeRequestsCsvExport GraphQL mutation, so exports honor list filters such as merge user and target branch. This removes the merge_requests_csv_export_graphql flag and the old REST export_csv route it replaced. This is the last MR in the series and the point where the filter fix reaches all users.

Do not merge until the flag is fully enabled on GitLab.com per #633656 and the new frontend has been live long enough that no open browser tab still posts to the old route. A merge-after date of 2026-11-16 enforces this; it moves out if the rollout is not done by then.

Merge request stack

These merge requests fix #583992 together. Merge them in this order; same-numbered MRs are independent.

Order	MR	What	Depends on
1	!262241 (merged)	Extract the merge request filter arguments into a shared concern (no schema change)	None
1	!262242 (merged)	Accept the subscribed filter as a string in IssuableFinder	None
2	!261924 (merged)	Add the mergeRequestsCsvExport GraphQL mutation	!262241 (merged), !262242 (merged)
3	!261946 (merged)	Switch the MR list export to the mutation behind merge_requests_csv_export_graphql	!261924 (merged)
4	!261956 (this MR)	Remove the REST export and the flag after the rollout in #633656 (not before 2026-11-16)	!261946 (merged)

Details

This MR targets the !261946 (merged) branch (frontend behind the flag).

Removed

• The merge_requests_csv_export_graphql flag (YAML and frontend push).
• Projects::MergeRequestsController#export_csv: the action, the POST /:project/-/merge_requests/export_csv route, and the urgency and skip_before_action entries.
• export_csv_path from project_merge_requests_list_data.
• The exportCsvPath prop and inject chain in the MR list app (modal, buttons, actions dropdown, app init), the generated JS route helper, and the Cells routing snapshot entries.

Behavior

• The export modal always calls the mutation.
• The actions dropdown shows the export when isProject is true. It used to key off export_csv_path, which only project lists set. Group MR lists still show only the RSS item; group-level export never existed.
• The REST action was a browser-session controller route, not part of the REST API (lib/api) and not documented, so removing it is not an API breaking change.
• IssuableExportCsvWorker and MergeRequests::ExportCsvService are unchanged; the mutation uses them.

Tests

• Jest specs updated (modal, buttons, list app) plus a new more_actions_dropdown_spec.js covering project vs group and signed-out visibility. 151 MR list Jest tests pass.
• spec/features/merge_requests/user_exports_as_csv_spec.rb now covers only the GraphQL path. Specs for the REST action and the flag push are removed.
• Helper spec passes (60 examples).

Validation Verified end to end in GDK on the stacked frontend change: the filtered export emailed a CSV containing only the matching MRs.

References

• Closes #583992
• Rollout issue: #633656
• Stack: see the table above.

Screenshots or screen recordings

No visual change: the export entry points look the same.

How to set up and validate locally

1. Open a project's merge request list, for example http://gdk.test:3000/<project>/-/merge_requests.
2. Apply filters such as merge user and target branch.
3. Click the actions dropdown, choose export as CSV, and confirm in the modal.
4. Check the emailed CSV contains only the filtered merge requests.
5. Open a group merge request list and confirm the actions dropdown shows only the RSS item.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code