Add latest changes from gitlab-org/gitlab@master

36 files changed, 168 insertions, 80 deletions

diff --git a/.gitlab/issue_templates/Feature Flag Cleanup.md b/.gitlab/issue_templates/Feature Flag Cleanup.md
new file mode 100644
index 00000000000..eedb35a4b5f
--- /dev/null
+++ b/.gitlab/issue_templates/Feature Flag Cleanup.md
@@ -0,0 +1,52 @@
+<!-- Title suggestion: [Feature flag] Cleanup <feature-flag-name> -->
+
+## Summary
+
+This issue is to cleanup the `<feature-flag-name>` feature flag, after the feature flag has been enabled by default for an appropriate amount of time in production.
+
+<!-- Short description of what the feature is about and link to relevant other issues. -->
+
+## Owners
+
+- Team: NAME_OF_TEAM
+- Most appropriate slack channel to reach out to: `#g_TEAM_NAME`
+- Best individual to reach out to: NAME
+- PM: NAME
+
+## Stakeholders
+
+<!--
+Are there any other stages or teams involved that need to be kept in the loop?
+
+- Name of a PM
+- The Support Team
+- The Delivery Team
+-->
+
+## Expectations
+
+### What might happen if this goes wrong?
+
+<!-- Any MRs that need to be rolled back? Communication that needs to happen? What are some things you can think of that could go wrong - data loss or broken pages? -->
+
+### Cleaning up the feature flag
+
+<!-- The checklist here is to help stakeholders keep track of the feature flag status -->
+- [ ] Create a merge request to remove `<feature-flag-name>` feature flag. Ask for review and merge it.
+    - [ ] Remove all references to the feature flag from the codebase.
+    - [ ] Remove the YAML definitions for the feature from the repository.
+    - [ ] Create [a changelog entry](https://docs.gitlab.com/ee/development/feature_flags/#changelog).
+- [ ] Ensure that the cleanup MR has been deployed to both production and canary.
+      If the merge request was deployed before [the code cutoff](https://about.gitlab.com/handbook/engineering/releases/#self-managed-releases-1),
+      the feature can be officially announced in a release blog post.
+    - [ ] `/chatops run auto_deploy status <merge-commit-of-cleanup-mr>`
+- [ ] Close [the feature issue](ISSUE LINK) to indicate the feature will be released in the current milestone.
+- [ ] Clean up the feature flag from all environments by running these chatops command in `#production` channel:
+    - [ ] `/chatops run feature delete <feature-flag-name> --dev`
+    - [ ] `/chatops run feature delete <feature-flag-name> --staging`
+    - [ ] `/chatops run feature delete <feature-flag-name>`
+- [ ] Close this rollout issue.
+
+
+/label ~"feature flag" ~"type::feature" ~"feature::addition"
+/assign DRI
diff --git a/.gitlab/issue_templates/Feature Flag Roll Out.md b/.gitlab/issue_templates/Feature Flag Roll Out.md
index 86f356daf90..590e627df75 100644
--- a/.gitlab/issue_templates/Feature Flag Roll Out.md
+++ b/.gitlab/issue_templates/Feature Flag Roll Out.md
@@ -121,7 +121,7 @@ To do so, follow these steps:
     - [ ] `/chatops run auto_deploy status <merge-commit-of-default-enabling-mr>`
 - [ ] Close [the feature issue](ISSUE LINK) to indicate the feature will be released in the current milestone.
 - [ ] Set the next milestone to this rollout issue for scheduling [the flag removal](#release-the-feature).
-- [ ] (Optional) You can create a separate issue for scheduling the steps below to [Release the feature](#release-the-feature).
+- [ ] (Optional) You can [create a separate issue](https://gitlab.com/gitlab-org/gitlab/-/issues/new?issuable_template=Feature%20Flag%20Cleanup) for scheduling the steps below to [Release the feature](#release-the-feature).
     - [ ] Set the title to "[Feature flag] Cleanup `<feature-flag-name>`".
     - [ ] Execute the `/copy_metadata <this-rollout-issue-link>` quick action to copy the labels from this rollout issue.
     - [ ] Link this rollout issue as a related issue.
@@ -141,6 +141,8 @@ the [clean up](https://docs.gitlab.com/ee/development/feature_flags/controls.htm
 should be done as soon as possible to permanently enable the feature and reduce complexity in the
 codebase.
 
+You can either [create a follow-up issue for Feature Flag Cleanup](https://gitlab.com/gitlab-org/gitlab/-/issues/new?issuable_template=Feature%20Flag%20Cleanup) or use the checklist below in this same issue.
+
 <!-- The checklist here is to help stakeholders keep track of the feature flag status -->
 - [ ] Create a merge request to remove `<feature-flag-name>` feature flag. Ask for review and merge it.
     - [ ] Remove all references to the feature flag from the codebase.
diff --git a/app/assets/javascripts/pipeline_editor/pipeline_editor_app.vue b/app/assets/javascripts/pipeline_editor/pipeline_editor_app.vue
index 90f48195c5e..a042e011550 100644
--- a/app/assets/javascripts/pipeline_editor/pipeline_editor_app.vue
+++ b/app/assets/javascripts/pipeline_editor/pipeline_editor_app.vue
@@ -358,7 +358,7 @@ export default {
       @createEmptyConfigFile="setNewEmptyCiConfigFile"
       @refetchContent="refetchContent"
     />
-    <div v-else>
+    <div v-else class="gl-pr-10">
       <pipeline-editor-messages
         :failure-type="failureType"
         :failure-reasons="failureReasons"
diff --git a/app/assets/javascripts/pipeline_editor/pipeline_editor_home.vue b/app/assets/javascripts/pipeline_editor/pipeline_editor_home.vue
index 96680080f0c..bb759477e1e 100644
--- a/app/assets/javascripts/pipeline_editor/pipeline_editor_home.vue
+++ b/app/assets/javascripts/pipeline_editor/pipeline_editor_home.vue
@@ -90,7 +90,7 @@ export default {
 </script>
 
 <template>
-  <div class="gl-pr-10 gl-transition-medium gl-w-full">
+  <div class="gl-transition-medium gl-w-full">
     <gl-modal
       v-if="showSwitchBranchModal"
       visible
diff --git a/app/models/issue.rb b/app/models/issue.rb
index 4f2773f4147..c14dcd93861 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -584,7 +584,7 @@ class Issue < ApplicationRecord
   def readable_by?(user)
     if user.can_read_all_resources?
       true
-    elsif project.owner == user
+    elsif project.personal? && project.team.owner?(user)
       true
     elsif confidential? && !assignee_or_author?(user)
       project.team.member?(user, Gitlab::Access::REPORTER)
diff --git a/app/models/project_team.rb b/app/models/project_team.rb
index 8061554006d..c3c7508df9f 100644
--- a/app/models/project_team.rb
+++ b/app/models/project_team.rb
@@ -107,6 +107,10 @@ class ProjectTeam
       end
   end
 
+  def owner?(user)
+    owners.include?(user)
+  end
+
   def import(source_project, current_user = nil)
     target_project = project
 
diff --git a/app/services/projects/create_service.rb b/app/services/projects/create_service.rb
index 1d187b140ef..153be58f8ad 100644
--- a/app/services/projects/create_service.rb
+++ b/app/services/projects/create_service.rb
@@ -89,7 +89,7 @@ module Projects
     end
 
     def after_create_actions
-      log_info("#{@project.owner.name} created a new project \"#{@project.full_name}\"")
+      log_info("#{current_user.name} created a new project \"#{@project.full_name}\"")
 
       if @project.import?
         experiment(:combined_registration, user: current_user).track(:import_project)
diff --git a/doc/administration/gitaly/configure_gitaly.md b/doc/administration/gitaly/configure_gitaly.md
index a0c959d5de9..dfc7bdc6456 100644
--- a/doc/administration/gitaly/configure_gitaly.md
+++ b/doc/administration/gitaly/configure_gitaly.md
@@ -476,7 +476,7 @@ example:
 ```ruby
 git_data_dirs({
   'default' => { 'gitaly_address' => 'tcp://gitaly1.internal:8075' },
-  # Address of the GitLab server that has Gitaly running on it
+  # Address of the GitLab server that also has Gitaly running on it
   'storage1' => { 'gitaly_address' => 'tcp://gitlab.internal:8075', 'path' => '/mnt/gitlab/git-data' },
   'storage2' => { 'gitaly_address' => 'tcp://gitaly2.internal:8075' },
 })
diff --git a/doc/development/testing_guide/flaky_tests.md b/doc/development/testing_guide/flaky_tests.md
index d2e68ea7715..333ebd8370f 100644
--- a/doc/development/testing_guide/flaky_tests.md
+++ b/doc/development/testing_guide/flaky_tests.md
@@ -14,14 +14,14 @@ eventually.
 ## Quarantined tests
 
 When a test frequently fails in `main`,
-[a ~"master:broken" issue](https://about.gitlab.com/handbook/engineering/workflow/#broken-master)
-should be created.
+create [a ~"failure::flaky-test" issue](https://about.gitlab.com/handbook/engineering/workflow/#broken-master).
+
 If the test cannot be fixed in a timely fashion, there is an impact on the
-productivity of all the developers, so it should be placed in quarantine by
-assigning the `:quarantine` metadata with the issue URL.
+productivity of all the developers, so it should be quarantined by
+assigning the `:quarantine` metadata with the issue URL, and add the `~"quarantined test"` label to the issue.
 
 ```ruby
-it 'should succeed', quarantine: 'https://gitlab.com/gitlab-org/gitlab/-/issues/12345' do
+it 'succeeds', quarantine: 'https://gitlab.com/gitlab-org/gitlab/-/issues/12345' do
   expect(response).to have_gitlab_http_status(:ok)
 end
 ```
@@ -32,23 +32,13 @@ This means it is skipped unless run with `--tag quarantine`:
 bin/rspec --tag quarantine
 ```
 
-**Before putting a test in quarantine, you should make sure that a
-~"master:broken" issue exists for it so it doesn't stay in quarantine forever.**
-
 Once a test is in quarantine, there are 3 choices:
 
-- Should the test be fixed (that is, get rid of its flakiness)?
-- Should the test be moved to a lower level of testing?
-- Should the test be removed entirely (for example, because there's already a
+- Fix the test (that is, get rid of its flakiness).
+- Move the test to a lower level of testing.
+- Remove the test entirely (for example, because there's already a
   lower-level test, or it's duplicating another same-level test, or it's testing
-  too much etc.)?
-
-### Quarantine tests on the CI
-
-Quarantined tests are run on the CI in dedicated jobs that are allowed to fail:
-
-- `rspec-pg-quarantine` (CE & EE)
-- `rspec-pg-quarantine-ee` (EE only)
+  too much etc.).
 
 ## Automatic retries and flaky tests detection
 
diff --git a/doc/update/index.md b/doc/update/index.md
index 3a17d3c01d7..877ad587b25 100644
--- a/doc/update/index.md
+++ b/doc/update/index.md
@@ -269,9 +269,9 @@ Additional steps between the mentioned versions are possible. We list the minima
 
 | Target version | Your version | Supported upgrade path                                                                               | Note                                                                                                                              |
 | -------------- | ------------ | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| `14.2.6`       | `13.10.2`    | `13.10.2` -> `13.12.12` -> `14.0.11` -> `14.1.8` -> `14.2.6`                                         | Three intermediate versions are required: `13.12`, `14.0`, and `14.1`, then `14.2.6`.                                             |
-| `14.1.8`       | `13.9.2`     | `13.9.2` -> `13.12.12` -> `14.0.11` -> `14.1.8`                                                      | Two intermediate versions are required: `13.12` and `14.0`, then `14.1.8`.                                                        |
-| `13.12.10`     | `12.9.2`     | `12.9.2` -> `12.10.14` -> `13.0.14`  -> `13.1.11` -> `13.8.8` -> `13.12.10`                          | Four intermediate versions are required: `12.10`, `13.0`, `13.1` and `13.8.8`, then `13.12.10`.                                   |
+| `14.2.6`       | `13.10.2`    | `13.10.2` -> `13.12.15` -> `14.0.11` -> `14.1.8` -> `14.2.6`                                         | Three intermediate versions are required: `13.12`, `14.0`, and `14.1`, then `14.2.6`.                                             |
+| `14.1.8`       | `13.9.2`     | `13.9.2` -> `13.12.15` -> `14.0.11` -> `14.1.8`                                                      | Two intermediate versions are required: `13.12` and `14.0`, then `14.1.8`.                                                        |
+| `13.12.15`     | `12.9.2`     | `12.9.2` -> `12.10.14` -> `13.0.14`  -> `13.1.11` -> `13.8.8` -> `13.12.15`                          | Four intermediate versions are required: `12.10`, `13.0`, `13.1` and `13.8.8`, then `13.12.15`.                                   |
 | `13.2.10`      | `11.5.0`     | `11.5.0` -> `11.11.8` -> `12.0.12` -> `12.1.17` -> `12.10.14` -> `13.0.14` -> `13.1.11` -> `13.2.10` | Six intermediate versions are required: `11.11`, `12.0`, `12.1`, `12.10`, `13.0` and `13.1`, then `13.2.10`.                      |
 | `12.10.14`     | `11.3.4`     | `11.3.4` -> `11.11.8` -> `12.0.12` -> `12.1.17` -> `12.10.14`                                        | Three intermediate versions are required: `11.11`, `12.0` and `12.1`, then `12.10.14`.                                            |
 | `12.9.5`       | `10.4.5`     | `10.4.5` -> `10.8.7` -> `11.11.8` -> `12.0.12` -> `12.1.17` -> `12.9.5`                              | Four intermediate versions are required: `10.8`, `11.11`, `12.0` and `12.1`, then `12.9.5`.                                       |
diff --git a/doc/user/group/contribution_analytics/index.md b/doc/user/group/contribution_analytics/index.md
index 76a8eb77e72..3b866c4a1b0 100644
--- a/doc/user/group/contribution_analytics/index.md
+++ b/doc/user/group/contribution_analytics/index.md
@@ -11,8 +11,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 With Contribution Analytics, you can get an overview of the [contribution events](../../index.md#user-contribution-events) in your
 group.
 
-- Analyze your team's contributions over a period of time, and offer a bonus for the top
-  contributors.
+- Analyze your team's contributions over a period of time.
 - Identify opportunities for improvement with group members who may benefit from additional
   support.
 
diff --git a/lib/gitlab/ci/templates/Jobs/Secret-Detection.gitlab-ci.yml b/lib/gitlab/ci/templates/Jobs/Secret-Detection.gitlab-ci.yml
index 42487cc0c67..4e4f96bc7c7 100644
--- a/lib/gitlab/ci/templates/Jobs/Secret-Detection.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Jobs/Secret-Detection.gitlab-ci.yml
@@ -32,15 +32,22 @@ secret_detection:
     - if [ -n "$CI_COMMIT_TAG" ]; then echo "Skipping Secret Detection for tags. No code changes have occurred."; exit 0; fi
     - if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then echo "Running Secret Detection on default branch."; /analyzer run; exit 0; fi
     - |
-      git fetch origin $CI_DEFAULT_BRANCH $CI_COMMIT_REF_NAME
-      git log --left-right --cherry-pick --pretty=format:"%H" refs/remotes/origin/${CI_DEFAULT_BRANCH}..refs/remotes/origin/${CI_COMMIT_REF_NAME} >${CI_COMMIT_SHA}_commit_list.txt
-      if [[ $(wc -l <${CI_COMMIT_SHA}_commit_list.txt) -eq "0" ]]; then
-        # if git log produces 0 or 1 commits we should scan $CI_COMMIT_SHA only
-        export SECRET_DETECTION_COMMITS=$CI_COMMIT_SHA
-      else
-        # +1 because busybox wc only counts \n and there is no trailing \n
-        echo "scanning $(($(wc -l <${CI_COMMIT_SHA}_commit_list.txt) + 1)) commits"
-        export SECRET_DETECTION_COMMITS_FILE=${CI_COMMIT_SHA}_commit_list.txt
-      fi
+      # we don't need the whole history when excluding in the next `git fetch` line,
+      # so git depth=1
+      git fetch origin --depth=1 $CI_DEFAULT_BRANCH
+      # shallow clone $CI_COMMIT_REF_NAME to get commits associated with MR or push
+      git fetch --shallow-exclude=${CI_DEFAULT_BRANCH} origin $CI_COMMIT_REF_NAME
+      # determine what commits we need to scan using "git log A..B"
+      git log --no-merges --pretty=format:"%H" refs/remotes/origin/${CI_DEFAULT_BRANCH}..refs/remotes/origin/${CI_COMMIT_REF_NAME} >${CI_COMMIT_SHA}_commit_list.txt
+
+      # we need to extend the git fetch depth to the number of commits + 2 for the following reasons:
+      # because busybox wc only counts \n and there is no trailing \n (+1)
+      # include the parent commit of the base commit in this MR/Push event. This is needed because
+      # `git diff -p` needs something to compare changes in that commit against (+1)
+      git fetch --depth=$(($(wc -l <${CI_COMMIT_SHA}_commit_list.txt) + 2)) origin $CI_COMMIT_REF_NAME
+
+      # +1 because busybox wc only counts \n and there is no trailing \n
+      echo "scanning $(($(wc -l <${CI_COMMIT_SHA}_commit_list.txt) + 1)) commits"
+      export SECRET_DETECTION_COMMITS_FILE=${CI_COMMIT_SHA}_commit_list.txt
     - /analyzer run
     - rm "$CI_COMMIT_SHA"_commit_list.txt
diff --git a/qa/qa/resource/project_access_token.rb b/qa/qa/resource/project_access_token.rb
index f5cd8798f19..cf6b4b51f88 100644
--- a/qa/qa/resource/project_access_token.rb
+++ b/qa/qa/resource/project_access_token.rb
@@ -9,7 +9,9 @@ module QA
 
       attribute :id
       attribute :project do
-        Project.fabricate!
+        Project.fabricate! do |project|
+          project.initialize_with_readme = true
+        end
       end
       attribute :token do
         Page::Project::Settings::AccessTokens.perform(&:created_access_token)
diff --git a/qa/qa/specs/features/api/1_manage/project_access_token_spec.rb b/qa/qa/specs/features/api/1_manage/project_access_token_spec.rb
index 13a795ca976..b95e388b449 100644
--- a/qa/qa/specs/features/api/1_manage/project_access_token_spec.rb
+++ b/qa/qa/specs/features/api/1_manage/project_access_token_spec.rb
@@ -4,9 +4,7 @@ module QA
   RSpec.describe 'Manage' do
     describe 'Project access token' do
       before(:all) do
-        @project_access_token = QA::Resource::ProjectAccessToken.fabricate_via_api! do |pat|
-          pat.project = Resource::ReusableProject.fabricate_via_api!
-        end
+        @project_access_token = QA::Resource::ProjectAccessToken.fabricate_via_api!
 
         @user_api_client = Runtime::API::Client.new(:gitlab, personal_access_token: @project_access_token.token)
       end
diff --git a/qa/qa/specs/features/api/3_create/merge_request/push_options_labels_spec.rb b/qa/qa/specs/features/api/3_create/merge_request/push_options_labels_spec.rb
index ab9af872753..50b084748e8 100644
--- a/qa/qa/specs/features/api/3_create/merge_request/push_options_labels_spec.rb
+++ b/qa/qa/specs/features/api/3_create/merge_request/push_options_labels_spec.rb
@@ -11,7 +11,12 @@ module QA
       let(:title) { "MR push options test #{SecureRandom.hex(8)}" }
       let(:commit_message) { 'Add README.md' }
 
-      let(:project) { Resource::ReusableProject.fabricate_via_api! }
+      let(:project) do
+        Resource::Project.fabricate_via_api! do |project|
+          project.name = 'merge-request-push-options'
+          project.initialize_with_readme = true
+        end
+      end
 
       def create_new_mr_via_push
         Resource::Repository::ProjectPush.fabricate! do |push|
diff --git a/spec/controllers/autocomplete_controller_spec.rb b/spec/controllers/autocomplete_controller_spec.rb
index 6ccba866ebb..533d3896ee6 100644
--- a/spec/controllers/autocomplete_controller_spec.rb
+++ b/spec/controllers/autocomplete_controller_spec.rb
@@ -4,7 +4,7 @@ require 'spec_helper'
 
 RSpec.describe AutocompleteController do
   let(:project) { create(:project) }
-  let(:user) { project.owner }
+  let(:user) { project.first_owner }
 
   context 'GET users' do
     let!(:user2) { create(:user) }
diff --git a/spec/controllers/projects/artifacts_controller_spec.rb b/spec/controllers/projects/artifacts_controller_spec.rb
index 754b0ddfb94..f410c16b30b 100644
--- a/spec/controllers/projects/artifacts_controller_spec.rb
+++ b/spec/controllers/projects/artifacts_controller_spec.rb
@@ -5,7 +5,7 @@ require 'spec_helper'
 RSpec.describe Projects::ArtifactsController do
   include RepoHelpers
 
-  let(:user) { project.owner }
+  let(:user) { project.first_owner }
   let_it_be(:project) { create(:project, :repository, :public) }
 
   let_it_be(:pipeline, reload: true) do
diff --git a/spec/controllers/projects/avatars_controller_spec.rb b/spec/controllers/projects/avatars_controller_spec.rb
index 35878fe4c2d..39a373ed6b6 100644
--- a/spec/controllers/projects/avatars_controller_spec.rb
+++ b/spec/controllers/projects/avatars_controller_spec.rb
@@ -38,7 +38,7 @@ RSpec.describe Projects::AvatarsController do
         end
 
         it 'sets appropriate caching headers' do
-          sign_in(project.owner)
+          sign_in(project.first_owner)
           subject
 
           expect(response.cache_control[:public]).to eq(true)
@@ -63,7 +63,7 @@ RSpec.describe Projects::AvatarsController do
     let(:project) { create(:project, :repository, avatar: fixture_file_upload("spec/fixtures/dk.png", "image/png")) }
 
     before do
-      sign_in(project.owner)
+      sign_in(project.first_owner)
     end
 
     it 'removes avatar from DB by calling destroy' do
diff --git a/spec/controllers/projects/hooks_controller_spec.rb b/spec/controllers/projects/hooks_controller_spec.rb
index 2ab18ccddbf..ebcf35a7ecd 100644
--- a/spec/controllers/projects/hooks_controller_spec.rb
+++ b/spec/controllers/projects/hooks_controller_spec.rb
@@ -5,7 +5,7 @@ require 'spec_helper'
 RSpec.describe Projects::HooksController do
   let_it_be(:project) { create(:project) }
 
-  let(:user) { project.owner }
+  let(:user) { project.first_owner }
 
   before do
     sign_in(user)
diff --git a/spec/controllers/projects/merge_requests/conflicts_controller_spec.rb b/spec/controllers/projects/merge_requests/conflicts_controller_spec.rb
index e07b7e4586a..366a1e587ab 100644
--- a/spec/controllers/projects/merge_requests/conflicts_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests/conflicts_controller_spec.rb
@@ -4,7 +4,7 @@ require 'spec_helper'
 
 RSpec.describe Projects::MergeRequests::ConflictsController do
   let(:project) { create(:project, :repository) }
-  let(:user)    { project.owner }
+  let(:user)    { project.first_owner }
   let(:merge_request) { create(:merge_request_with_diffs, target_project: project, source_project: project) }
   let(:merge_request_with_conflicts) do
     create(:merge_request, source_branch: 'conflict-resolvable', target_branch: 'conflict-start', source_project: project, merge_status: :unchecked) do |mr|
diff --git a/spec/controllers/projects/merge_requests/creations_controller_spec.rb b/spec/controllers/projects/merge_requests/creations_controller_spec.rb
index df2023b7356..3c650988b4f 100644
--- a/spec/controllers/projects/merge_requests/creations_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests/creations_controller_spec.rb
@@ -4,7 +4,7 @@ require 'spec_helper'
 
 RSpec.describe Projects::MergeRequests::CreationsController do
   let(:project) { create(:project, :repository) }
-  let(:user)    { project.owner }
+  let(:user)    { project.first_owner }
   let(:fork_project) { create(:forked_project_with_submodules) }
   let(:get_diff_params) do
     {
diff --git a/spec/controllers/projects/merge_requests/drafts_controller_spec.rb b/spec/controllers/projects/merge_requests/drafts_controller_spec.rb
index 580211893dc..222bb977beb 100644
--- a/spec/controllers/projects/merge_requests/drafts_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests/drafts_controller_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe Projects::MergeRequests::DraftsController do
 
   let(:project)       { create(:project, :repository) }
   let(:merge_request) { create(:merge_request_with_diffs, target_project: project, source_project: project) }
-  let(:user)          { project.owner }
+  let(:user)          { project.first_owner }
   let(:user2)         { create(:user) }
 
   let(:params) do
diff --git a/spec/controllers/projects/merge_requests_controller_spec.rb b/spec/controllers/projects/merge_requests_controller_spec.rb
index 36b6df59ef5..d20bb2b16e5 100644
--- a/spec/controllers/projects/merge_requests_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests_controller_spec.rb
@@ -9,7 +9,7 @@ RSpec.describe Projects::MergeRequestsController do
   let_it_be_with_refind(:project) { create(:project, :repository) }
   let_it_be_with_reload(:project_public_with_private_builds) { create(:project, :repository, :public, :builds_private) }
 
-  let(:user) { project.owner }
+  let(:user) { project.first_owner }
   let(:merge_request) { create(:merge_request_with_diffs, target_project: project, source_project: merge_request_source_project, allow_collaboration: false) }
   let(:merge_request_source_project) { project }
 
diff --git a/spec/controllers/projects/mirrors_controller_spec.rb b/spec/controllers/projects/mirrors_controller_spec.rb
index 7c5d14d3a22..7bc86d7c583 100644
--- a/spec/controllers/projects/mirrors_controller_spec.rb
+++ b/spec/controllers/projects/mirrors_controller_spec.rb
@@ -7,7 +7,7 @@ RSpec.describe Projects::MirrorsController do
 
   shared_examples 'only admin is allowed when mirroring is disabled' do
     let(:subject_action) { raise 'subject_action is required' }
-    let(:user) { project.owner }
+    let(:user) { project.first_owner }
     let(:project_settings_path) { project_settings_repository_path(project, anchor: 'js-push-remote-settings') }
 
     context 'when project mirroring is enabled' do
@@ -88,7 +88,7 @@ RSpec.describe Projects::MirrorsController do
 
     context 'when the current project is not a mirror' do
       it 'allows to create a remote mirror' do
-        sign_in(project.owner)
+        sign_in(project.first_owner)
 
         expect do
           do_put(project, remote_mirrors_attributes: { '0' => { 'enabled' => 1, 'url' => 'http://foo.com' } })
@@ -106,7 +106,7 @@ RSpec.describe Projects::MirrorsController do
       end
 
       it 'processes a successful update' do
-        sign_in(project.owner)
+        sign_in(project.first_owner)
         do_put(project, remote_mirrors_attributes: { '0' => ssh_mirror_attributes })
 
         expect(response).to redirect_to(project_settings_repository_path(project, anchor: 'js-push-remote-settings'))
@@ -126,7 +126,7 @@ RSpec.describe Projects::MirrorsController do
     let(:project) { create(:project, :repository, :remote_mirror) }
 
     before do
-      sign_in(project.owner)
+      sign_in(project.first_owner)
     end
 
     context 'With valid URL for a push' do
@@ -169,7 +169,7 @@ RSpec.describe Projects::MirrorsController do
     let(:cache) { SshHostKey.new(project: project, url: "ssh://example.com:22") }
 
     before do
-      sign_in(project.owner)
+      sign_in(project.first_owner)
     end
 
     context 'invalid URLs' do
diff --git a/spec/controllers/projects/pipelines_controller_spec.rb b/spec/controllers/projects/pipelines_controller_spec.rb
index 3fe709a0d44..4a51e2ed5a0 100644
--- a/spec/controllers/projects/pipelines_controller_spec.rb
+++ b/spec/controllers/projects/pipelines_controller_spec.rb
@@ -1169,7 +1169,7 @@ RSpec.describe Projects::PipelinesController do
 
     context 'when user has ability to delete pipeline' do
       before do
-        sign_in(project.owner)
+        sign_in(project.first_owner)
       end
 
       it 'deletes pipeline and redirects' do
diff --git a/spec/controllers/projects/service_ping_controller_spec.rb b/spec/controllers/projects/service_ping_controller_spec.rb
index e6afaadc75f..729488cc86e 100644
--- a/spec/controllers/projects/service_ping_controller_spec.rb
+++ b/spec/controllers/projects/service_ping_controller_spec.rb
@@ -32,7 +32,7 @@ RSpec.describe Projects::ServicePingController do
 
   shared_examples 'counter is increased' do |counter|
     context 'when the authenticated user has access to the project' do
-      let(:user) { project.owner }
+      let(:user) { project.first_owner }
 
       it 'increments the usage counter' do
         expect do
@@ -55,7 +55,7 @@ RSpec.describe Projects::ServicePingController do
     end
 
     context 'when web ide clientside preview is not enabled' do
-      let(:user) { project.owner }
+      let(:user) { project.first_owner }
 
       before do
         stub_application_setting(web_ide_clientside_preview_enabled: false)
diff --git a/spec/controllers/repositories/git_http_controller_spec.rb b/spec/controllers/repositories/git_http_controller_spec.rb
index 4a6e745cd63..fb2637238ec 100644
--- a/spec/controllers/repositories/git_http_controller_spec.rb
+++ b/spec/controllers/repositories/git_http_controller_spec.rb
@@ -29,7 +29,7 @@ RSpec.describe Repositories::GitHttpController do
   context 'when repository container is a project' do
     it_behaves_like Repositories::GitHttpController do
       let(:container) { project }
-      let(:user) { project.owner }
+      let(:user) { project.first_owner }
       let(:access_checker_class) { Gitlab::GitAccess }
 
       it_behaves_like 'handles unavailable Gitaly'
@@ -103,7 +103,7 @@ RSpec.describe Repositories::GitHttpController do
   context 'when repository container is a project wiki' do
     it_behaves_like Repositories::GitHttpController do
       let(:container) { create(:project_wiki, :empty_repo, project: project) }
-      let(:user) { project.owner }
+      let(:user) { project.first_owner }
       let(:access_checker_class) { Gitlab::GitAccessWiki }
     end
   end
diff --git a/spec/graphql/features/authorization_spec.rb b/spec/graphql/features/authorization_spec.rb
index faf19104731..514f63a6f5a 100644
--- a/spec/graphql/features/authorization_spec.rb
+++ b/spec/graphql/features/authorization_spec.rb
@@ -326,7 +326,7 @@ RSpec.describe 'DeclarativePolicy authorization in GraphQL ' do
     let!(:other_project) { create(:project, :private) }
     let!(:visible_issues) { create_list(:issue, 2, project: visible_project) }
     let!(:other_issues) { create_list(:issue, 2, project: other_project) }
-    let!(:user) { visible_project.owner }
+    let!(:user) { visible_project.first_owner }
 
     let(:issue_type) do
       type_factory do |type|
diff --git a/spec/graphql/mutations/alert_management/alerts/todo/create_spec.rb b/spec/graphql/mutations/alert_management/alerts/todo/create_spec.rb
index 8ec99070c91..ea5e21ec4b8 100644
--- a/spec/graphql/mutations/alert_management/alerts/todo/create_spec.rb
+++ b/spec/graphql/mutations/alert_management/alerts/todo/create_spec.rb
@@ -8,7 +8,7 @@ RSpec.describe Mutations::AlertManagement::Alerts::Todo::Create do
   let_it_be(:alert) { create(:alert_management_alert) }
   let_it_be(:project) { alert.project }
 
-  let(:current_user) { project.owner }
+  let(:current_user) { project.first_owner }
 
   let(:args) { { project_path: project.full_path, iid: alert.iid } }
 
diff --git a/spec/graphql/mutations/issues/create_spec.rb b/spec/graphql/mutations/issues/create_spec.rb
index 825d04ff827..e3094e84703 100644
--- a/spec/graphql/mutations/issues/create_spec.rb
+++ b/spec/graphql/mutations/issues/create_spec.rb
@@ -121,7 +121,7 @@ RSpec.describe Mutations::Issues::Create do
       end
 
       context 'when creating an issue as owner' do
-        let_it_be(:user) { project.owner }
+        let_it_be(:user) { project.first_owner }
 
         before do
           mutation_params.merge!(special_params)
diff --git a/spec/graphql/resolvers/package_details_resolver_spec.rb b/spec/graphql/resolvers/package_details_resolver_spec.rb
index d6acb31d4e3..c8ee489a034 100644
--- a/spec/graphql/resolvers/package_details_resolver_spec.rb
+++ b/spec/graphql/resolvers/package_details_resolver_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe Resolvers::PackageDetailsResolver do
   include GraphqlHelpers
 
   let_it_be_with_reload(:project) { create(:project) }
-  let_it_be(:user) { project.owner }
+  let_it_be(:user) { project.first_owner }
   let_it_be(:package) { create(:composer_package, project: project) }
 
   describe '#resolve' do
diff --git a/spec/graphql/resolvers/package_pipelines_resolver_spec.rb b/spec/graphql/resolvers/package_pipelines_resolver_spec.rb
index d48d4d8ae01..024f96e7158 100644
--- a/spec/graphql/resolvers/package_pipelines_resolver_spec.rb
+++ b/spec/graphql/resolvers/package_pipelines_resolver_spec.rb
@@ -8,7 +8,7 @@ RSpec.describe Resolvers::PackagePipelinesResolver do
   let_it_be_with_reload(:package) { create(:package) }
   let_it_be(:pipelines) { create_list(:ci_pipeline, 3, project: package.project) }
 
-  let(:user) { package.project.owner }
+  let(:user) { package.project.first_owner }
   let(:args) { {} }
 
   describe '#resolve' do
diff --git a/spec/graphql/types/global_id_type_spec.rb b/spec/graphql/types/global_id_type_spec.rb
index 4efa3018dad..e7e69cfad9e 100644
--- a/spec/graphql/types/global_id_type_spec.rb
+++ b/spec/graphql/types/global_id_type_spec.rb
@@ -191,7 +191,7 @@ RSpec.describe Types::GlobalIDType do
 
       describe 'executing against the schema' do
         let(:query_result) do
-          context = { current_user: issue.project.owner }
+          context = { current_user: issue.project.first_owner }
           variables = { 'id' => gid }
 
           run_with_clean_state(query, context: context, variables: variables).to_h
diff --git a/spec/lib/gitlab/database/no_cross_db_foreign_keys_spec.rb b/spec/lib/gitlab/database/no_cross_db_foreign_keys_spec.rb
index e5a8143fcc3..5d3922a3ac9 100644
--- a/spec/lib/gitlab/database/no_cross_db_foreign_keys_spec.rb
+++ b/spec/lib/gitlab/database/no_cross_db_foreign_keys_spec.rb
@@ -44,14 +44,10 @@ RSpec.describe 'cross-database foreign keys' do
       ci_unit_tests.project_id
       ci_variables.project_id
       dast_profiles_pipelines.ci_pipeline_id
-      dast_scanner_profiles_builds.ci_build_id
-      dast_site_profiles_builds.ci_build_id
       dast_site_profiles_pipelines.ci_pipeline_id
       external_pull_requests.project_id
       merge_requests.head_pipeline_id
       merge_trains.pipeline_id
-      requirements_management_test_reports.build_id
-      security_scans.build_id
       vulnerability_feedback.pipeline_id
       vulnerability_occurrence_pipelines.pipeline_id
       vulnerability_statistics.latest_pipeline_id
diff --git a/spec/models/project_team_spec.rb b/spec/models/project_team_spec.rb
index c0bad96effc..d5af2d80906 100644
--- a/spec/models/project_team_spec.rb
+++ b/spec/models/project_team_spec.rb
@@ -77,6 +77,32 @@ RSpec.describe ProjectTeam do
     end
   end
 
+  describe 'owner methods' do
+    context 'personal project' do
+      let(:project) { create(:project) }
+      let(:owner) { project.owner }
+
+      specify { expect(project.team.owners).to contain_exactly(owner) }
+      specify { expect(project.team.owner?(owner)).to be_truthy }
+    end
+
+    context 'group project' do
+      let(:group) { create(:group) }
+      let(:project) { create(:project, group: group) }
+      let(:user1) { create(:user) }
+      let(:user2) { create(:user) }
+
+      before do
+        group.add_owner(user1)
+        group.add_owner(user2)
+      end
+
+      specify { expect(project.team.owners).to contain_exactly(user1, user2) }
+      specify { expect(project.team.owner?(user1)).to be_truthy }
+      specify { expect(project.team.owner?(user2)).to be_truthy }
+    end
+  end
+
   describe '#fetch_members' do
     context 'personal project' do
       let(:project) { create(:project) }
diff --git a/spec/services/projects/create_service_spec.rb b/spec/services/projects/create_service_spec.rb
index d5fbf96ce74..1f4ba4fd779 100644
--- a/spec/services/projects/create_service_spec.rb
+++ b/spec/services/projects/create_service_spec.rb
@@ -7,9 +7,10 @@ RSpec.describe Projects::CreateService, '#execute' do
   include GitHelpers
 
   let(:user) { create :user }
+  let(:project_name) { 'GitLab' }
   let(:opts) do
     {
-      name: 'GitLab',
+      name: project_name,
       namespace_id: user.namespace.id
     }
   end
@@ -144,6 +145,12 @@ RSpec.describe Projects::CreateService, '#execute' do
 
       subject { create_project(user, opts) }
     end
+
+    it 'logs creation' do
+      expect(Gitlab::AppLogger).to receive(:info).with(/#{user.name} created a new project/)
+
+      create_project(user, opts)
+    end
   end
 
   context "admin creates project with other user's namespace_id" do
@@ -202,7 +209,7 @@ RSpec.describe Projects::CreateService, '#execute' do
 
     let(:opts) do
       {
-        name: 'GitLab',
+        name: project_name,
         namespace_id: shared_group.id
       }
     end
@@ -237,7 +244,7 @@ RSpec.describe Projects::CreateService, '#execute' do
     let(:share_max_access_level) { Gitlab::Access::MAINTAINER }
     let(:opts) do
       {
-        name: 'GitLab',
+        name: project_name,
         namespace_id: subgroup_for_projects.id
       }
     end
@@ -676,7 +683,7 @@ RSpec.describe Projects::CreateService, '#execute' do
 
         let(:opts) do
           {
-            name: 'GitLab',
+            name: project_name,
             namespace_id: group.id
           }
         end
@@ -697,7 +704,7 @@ RSpec.describe Projects::CreateService, '#execute' do
 
           let(:opts) do
             {
-              name: 'GitLab',
+              name: project_name,
               namespace_id: subgroup.id
             }
           end
@@ -808,7 +815,7 @@ RSpec.describe Projects::CreateService, '#execute' do
 
     let(:opts) do
       {
-        name: 'GitLab',
+        name: project_name,
         namespace_id: group.id
       }
     end