Add latest changes from gitlab-org/gitlab@master

27 files changed, 428 insertions, 139 deletions

diff --git a/app/assets/javascripts/api/integrations_api.js b/app/assets/javascripts/api/integrations_api.js
deleted file mode 100644
index 692aae21a4f..00000000000
--- a/app/assets/javascripts/api/integrations_api.js
+++ /dev/null
@@ -1,21 +0,0 @@
-import axios from '../lib/utils/axios_utils';
-import { buildApiUrl } from './api_utils';
-
-const JIRA_CONNECT_SUBSCRIPTIONS_PATH = '/api/:version/integrations/jira_connect/subscriptions';
-
-export function addJiraConnectSubscription(namespacePath, { jwt, accessToken }) {
-  const url = buildApiUrl(JIRA_CONNECT_SUBSCRIPTIONS_PATH);
-
-  return axios.post(
-    url,
-    {
-      jwt,
-      namespace_path: namespacePath,
-    },
-    {
-      headers: {
-        Authorization: `Bearer ${accessToken}`, // eslint-disable-line @gitlab/require-i18n-strings
-      },
-    },
-  );
-}
diff --git a/app/assets/javascripts/api/user_api.js b/app/assets/javascripts/api/user_api.js
index c362253f52e..c743b18d572 100644
--- a/app/assets/javascripts/api/user_api.js
+++ b/app/assets/javascripts/api/user_api.js
@@ -12,7 +12,6 @@ const USER_PROJECTS_PATH = '/api/:version/users/:id/projects';
 const USER_POST_STATUS_PATH = '/api/:version/user/status';
 const USER_FOLLOW_PATH = '/api/:version/users/:id/follow';
 const USER_UNFOLLOW_PATH = '/api/:version/users/:id/unfollow';
-const CURRENT_USER_PATH = '/api/:version/user';
 
 export function getUsers(query, options) {
   const url = buildApiUrl(USERS_PATH);
@@ -82,8 +81,3 @@ export function unfollowUser(userId) {
   const url = buildApiUrl(USER_UNFOLLOW_PATH).replace(':id', encodeURIComponent(userId));
   return axios.post(url);
 }
-
-export function getCurrentUser(options) {
-  const url = buildApiUrl(CURRENT_USER_PATH);
-  return axios.get(url, { ...options });
-}
diff --git a/app/assets/javascripts/jira_connect/subscriptions/api.js b/app/assets/javascripts/jira_connect/subscriptions/api.js
index de67703356f..ffe5642fc62 100644
--- a/app/assets/javascripts/jira_connect/subscriptions/api.js
+++ b/app/assets/javascripts/jira_connect/subscriptions/api.js
@@ -1,10 +1,17 @@
 import axios from 'axios';
+import { buildApiUrl } from '~/api/api_utils';
+
 import { getJwt } from './utils';
 
+const CURRENT_USER_PATH = '/api/:version/user';
+const JIRA_CONNECT_SUBSCRIPTIONS_PATH = '/api/:version/integrations/jira_connect/subscriptions';
+
+export const axiosInstance = axios.create();
+
 export const addSubscription = async (addPath, namespace) => {
   const jwt = await getJwt();
 
-  return axios.post(addPath, {
+  return axiosInstance.post(addPath, {
     jwt,
     namespace_path: namespace,
   });
@@ -13,7 +20,7 @@ export const addSubscription = async (addPath, namespace) => {
 export const removeSubscription = async (removePath) => {
   const jwt = await getJwt();
 
-  return axios.delete(removePath, {
+  return axiosInstance.delete(removePath, {
     params: {
       jwt,
     },
@@ -21,7 +28,7 @@ export const removeSubscription = async (removePath) => {
 };
 
 export const fetchGroups = async (groupsPath, { page, perPage, search }) => {
-  return axios.get(groupsPath, {
+  return axiosInstance.get(groupsPath, {
     params: {
       page,
       per_page: perPage,
@@ -33,9 +40,31 @@ export const fetchGroups = async (groupsPath, { page, perPage, search }) => {
 export const fetchSubscriptions = async (subscriptionsPath) => {
   const jwt = await getJwt();
 
-  return axios.get(subscriptionsPath, {
+  return axiosInstance.get(subscriptionsPath, {
     params: {
       jwt,
     },
   });
 };
+
+export const getCurrentUser = (options) => {
+  const url = buildApiUrl(CURRENT_USER_PATH);
+  return axiosInstance.get(url, { ...options });
+};
+
+export const addJiraConnectSubscription = (namespacePath, { jwt, accessToken }) => {
+  const url = buildApiUrl(JIRA_CONNECT_SUBSCRIPTIONS_PATH);
+
+  return axiosInstance.post(
+    url,
+    {
+      jwt,
+      namespace_path: namespacePath,
+    },
+    {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+      },
+    },
+  );
+};
diff --git a/app/assets/javascripts/jira_connect/subscriptions/store/actions.js b/app/assets/javascripts/jira_connect/subscriptions/store/actions.js
index 4a83ee8671d..fff34e1d75d 100644
--- a/app/assets/javascripts/jira_connect/subscriptions/store/actions.js
+++ b/app/assets/javascripts/jira_connect/subscriptions/store/actions.js
@@ -1,6 +1,8 @@
-import { fetchSubscriptions as fetchSubscriptionsREST } from '~/jira_connect/subscriptions/api';
-import { getCurrentUser } from '~/rest_api';
-import { addJiraConnectSubscription } from '~/api/integrations_api';
+import {
+  fetchSubscriptions as fetchSubscriptionsREST,
+  getCurrentUser,
+  addJiraConnectSubscription,
+} from '~/jira_connect/subscriptions/api';
 import {
   I18N_ADD_SUBSCRIPTION_SUCCESS_ALERT_TITLE,
   I18N_ADD_SUBSCRIPTION_SUCCESS_ALERT_MESSAGE,
diff --git a/db/migrate/20220901035722_add_temp_project_member_index.rb b/db/migrate/20220901035722_add_temp_project_member_index.rb
new file mode 100644
index 00000000000..0765ef09b5c
--- /dev/null
+++ b/db/migrate/20220901035722_add_temp_project_member_index.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class AddTempProjectMemberIndex < Gitlab::Database::Migration[2.0]
+  disable_ddl_transaction!
+
+  TABLE_NAME = :members
+  INDEX_NAME = 'index_project_members_on_id_temp'
+
+  def up
+    add_concurrent_index TABLE_NAME, :id, name: INDEX_NAME, where: "source_type = 'Project'"
+  end
+
+  def down
+    remove_concurrent_index TABLE_NAME, :id, name: INDEX_NAME
+  end
+end
diff --git a/db/migrate/20220901035725_schedule_destroy_invalid_project_members.rb b/db/migrate/20220901035725_schedule_destroy_invalid_project_members.rb
new file mode 100644
index 00000000000..bc90232f855
--- /dev/null
+++ b/db/migrate/20220901035725_schedule_destroy_invalid_project_members.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+class ScheduleDestroyInvalidProjectMembers < Gitlab::Database::Migration[2.0]
+  MIGRATION = 'DestroyInvalidProjectMembers'
+  DELAY_INTERVAL = 2.minutes
+  BATCH_SIZE = 50_000
+  MAX_BATCH_SIZE = 100_000
+  SUB_BATCH_SIZE = 200
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  def up
+    queue_batched_background_migration(
+      MIGRATION,
+      :members,
+      :id,
+      job_interval: DELAY_INTERVAL,
+      batch_size: BATCH_SIZE,
+      max_batch_size: MAX_BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE,
+      gitlab_schema: :gitlab_main
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :members, :id, [])
+  end
+end
diff --git a/db/schema_migrations/20220901035722 b/db/schema_migrations/20220901035722
new file mode 100644
index 00000000000..aa9ea1cdf21
--- /dev/null
+++ b/db/schema_migrations/20220901035722
@@ -0,0 +1 @@
+afcbf032220e9e40ab6ae25d6ac8ea9df7f46649bf70219be9b206af6d9d0c7c
\ No newline at end of file
diff --git a/db/schema_migrations/20220901035725 b/db/schema_migrations/20220901035725
new file mode 100644
index 00000000000..3c60c0188a2
--- /dev/null
+++ b/db/schema_migrations/20220901035725
@@ -0,0 +1 @@
+877ff6aab260278dfa3e886f093f34ee8004bbdaec2aabc12cebee37a879fd8d
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index a8ac768d587..ae1b0ca9990 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -29698,6 +29698,8 @@ CREATE INDEX index_project_group_links_on_project_id ON project_group_links USIN
 
 CREATE INDEX index_project_import_data_on_project_id ON project_import_data USING btree (project_id);
 
+CREATE INDEX index_project_members_on_id_temp ON members USING btree (id) WHERE ((source_type)::text = 'Project'::text);
+
 CREATE INDEX index_project_mirror_data_on_last_successful_update_at ON project_mirror_data USING btree (last_successful_update_at);
 
 CREATE INDEX index_project_mirror_data_on_last_update_at_and_retry_count ON project_mirror_data USING btree (last_update_at, retry_count);
diff --git a/doc/ci/cloud_deployment/index.md b/doc/ci/cloud_deployment/index.md
index d07796fef8b..82d914f0a6a 100644
--- a/doc/ci/cloud_deployment/index.md
+++ b/doc/ci/cloud_deployment/index.md
@@ -50,6 +50,7 @@ deploy:
   script:
    - aws s3 ...
    - aws create-deployment ...
+  environment: production
 ```
 
 GitLab provides a Docker image that includes the AWS CLI:
diff --git a/doc/ci/resource_groups/index.md b/doc/ci/resource_groups/index.md
index e76c4621a0c..c215ef412a1 100644
--- a/doc/ci/resource_groups/index.md
+++ b/doc/ci/resource_groups/index.md
@@ -171,6 +171,7 @@ deploy:
     include: deploy.gitlab-ci.yml
     strategy: depend
   resource_group: AWS-production
+  environment: production
 ```
 
 ```yaml
@@ -187,6 +188,7 @@ provision:
 deployment:
   stage: deploy
   script: echo "Deploying..."
+  environment: production
 ```
 
 You must define [`strategy: depend`](../yaml/index.md#triggerstrategy)
@@ -224,6 +226,7 @@ deploy:
   stage: deploy
   script: echo
   resource_group: production
+  environment: production
 ```
 
 In a parent pipeline, it runs the `test` job that subsequently runs a child pipeline,
@@ -250,4 +253,5 @@ deploy:
   stage: deploy
   script: echo
   resource_group: production
+  environment: production
 ```
diff --git a/doc/ci/triggers/index.md b/doc/ci/triggers/index.md
index 7df5c91ce38..e83756ad343 100644
--- a/doc/ci/triggers/index.md
+++ b/doc/ci/triggers/index.md
@@ -88,6 +88,7 @@ trigger_pipeline:
     - 'curl --fail --request POST --form token=$MY_TRIGGER_TOKEN --form ref=main "https://gitlab.example.com/api/v4/projects/123456/trigger/pipeline"'
   rules:
     - if: $CI_COMMIT_TAG
+  environment: production
 ```
 
 In this example:
diff --git a/doc/development/documentation/redirects.md b/doc/development/documentation/redirects.md
index 4c748924c67..1bc697f2878 100644
--- a/doc/development/documentation/redirects.md
+++ b/doc/development/documentation/redirects.md
@@ -16,12 +16,7 @@ description: Learn how to contribute to GitLab Documentation.
 # Redirects in GitLab documentation
 
 When you move, rename, or delete a page, you must add a redirect. Redirects reduce
-how often users get 404s when visiting the documentation site from out-of-date links, like:
-
-- Bookmarks
-- Links from external sites
-- Links from old blog posts
-- Links in the documentation site global navigation
+how often users get 404s when they visit the documentation site from out-of-date links.
 
 Add a redirect to ensure:
 
@@ -36,9 +31,11 @@ Add a redirect to ensure:
 Be sure to assign a technical writer to any merge request that moves, renames, or deletes a page.
 Technical Writers can help with any questions and can review your change.
 
+## Types of redirects
+
 There are two types of redirects:
 
-- [Redirect added into the documentation files themselves](#add-a-redirect), for users who
+- [Redirects added into the documentation files themselves](#redirect-to-a-page-that-already-exists), for users who
   view the docs in `/help` on self-managed instances. For example,
   [`/help` on GitLab.com](https://gitlab.com/help). These must be added in the same
   MR that renames or moves a doc. Redirects to internal pages expire after three months
@@ -52,96 +49,109 @@ Expired redirect files are removed from the documentation projects by the
 [`clean_redirects` Rake task](https://gitlab.com/gitlab-org/gitlab-docs/-/blob/main/doc/raketasks.md#clean-up-redirects),
 as part of the Technical Writing team's [monthly tasks](https://gitlab.com/gitlab-org/technical-writing/-/blob/main/.gitlab/issue_templates/tw-monthly-tasks.md).
 
-## Add a redirect
+## Redirect to a page that already exists
+
+To redirect a page to another page in the same repository:
+
+1. In the Markdown file that you want to direct to a new location:
+
+   - Delete all of the content.
+   - Add this content:
+
+     ```markdown
+     ---
+     redirect_to: '../newpath/to/file/index.md'
+     remove_date: 'YYYY-MM-DD'
+     ---
+
+     This document was moved to [another location](../path/to/file/index.md).
+
+     <!-- This redirect file can be deleted after <YYYY-MM-DD>. -->
+     <!-- Redirects that point to other docs in the same project expire in three months. -->
+     <!-- Redirects that point to docs in a different project or site (for example, link is not relative and starts with `https:`) expire in one year. -->
+     <!-- Before deletion, see: https://docs.gitlab.com/ee/development/documentation/redirects.html -->
+     ```
+
+   - Replace both instances of `../newpath/to/file/index.md` with the new file path.
+   - Replace both instances of `YYYY-MM-DD` with the expiration date, as explained in the template.
+
+1. If the page has Disqus comments, follow [the steps for pages with Disqus comments](#redirections-for-pages-with-disqus-comments).
+1. If the page had images that aren't used on any other pages, delete them.
 
-NOTE:
-If the renamed page is new, you can sometimes skip the following steps and ask a
-Technical Writer to manually add the redirect to [`redirects.yaml`](https://gitlab.com/gitlab-org/gitlab-docs/-/blob/main/content/_data/redirects.yaml).
-For example, if you add a new page and then rename it before it's added to a release
-on the 18th. The old page is not in any version's `/help` section, so a technical writer
-can jump straight to the [Pages redirect](https://gitlab.com/gitlab-org/gitlab-docs/-/blob/main/doc/maintenance.md#pages-redirects).
+After your changes are committed, search for and update all links that point to the old file:
 
-To add a redirect:
+- In <https://gitlab.com/gitlab-com/www-gitlab-com>, search for full URLs:
 
-1. In the repository (`gitlab`, `gitlab-runner`, `omnibus-gitlab`, or `charts`),
-   create a new documentation file. Don't delete the old one. The easiest
-   way is to copy it. For example:
+  ```shell
+  grep -r "docs.gitlab.com/ee/path/to/file.html" .
+  ```
 
-   ```shell
-   cp doc/user/search/old_file.md doc/api/new_file.md
+- In <https://gitlab.com/gitlab-org/gitlab-docs/-/tree/master/content/_data>,
+  search the navigation bar configuration files for the path with `.html`:
+
+  ```shell
+  grep -r "path/to/file.html" .
    ```
 
-1. Add the redirect code to the old documentation file by running the
-   following Rake task. The first argument is the path of the old file,
-   and the second argument is the path of the new file:
+- In any of the four internal projects, search for links in the docs
+  and codebase. Search for all variations, including full URL and just the path.
+  For example, go to the root directory of the `gitlab` project and run:
 
-   - To redirect to a page in the same project, use relative paths and
-     the `.md` extension. Both old and new paths start from the same location.
-     In the following example, both paths are relative to `doc/`:
+  ```shell
+  grep -r "docs.gitlab.com/ee/path/to/file.html" .
+  grep -r "path/to/file.html" .
+  grep -r "path/to/file.md" .
+  grep -r "path/to/file" .
+  ```
 
-     ```shell
-     bundle exec rake "gitlab:docs:redirect[doc/user/search/old_file.md, doc/api/new_file.md]"
-     ```
+  You might need to try variations of relative links, such as `../path/to/file` or
+  `../file` to find every case.
 
-   - To redirect to a page in a different project or site, use the full URL (with `https://`) :
+### Move a file's location
 
-     ```shell
-     bundle exec rake "gitlab:docs:redirect[doc/user/search/old_file.md, https://example.com]"
-     ```
+If you want to move a file from one location to another, you do not move it.
+Instead, you duplicate the file, and add the redirect code to the old file.
 
-   - Alternatively, you can omit the arguments and be prompted to enter the values:
+1. Create the new file.
+1. Copy the contents of the old file to the new one.
+1. In the old file, delete all the content.
+1. In the old file, add the redirect code and follow the rest of the steps in
+   the [Redirect to a page that already exists](#redirect-to-a-page-that-already-exists) topic.
 
-     ```shell
-     bundle exec rake gitlab:docs:redirect
-     ```
+## Use code to add a redirect
 
-   If you don't want to use the Rake task, you can use the following template:
+If you prefer to use a script to create the redirect:
 
-   ```markdown
-   ---
-   redirect_to: '../newpath/to/file/index.md'
-   remove_date: 'YYYY-MM-DD'
-   ---
+Add the redirect code to the old documentation file by running the
+following Rake task. The first argument is the path of the old file,
+and the second argument is the path of the new file:
 
-   This document was moved to [another location](../path/to/file/index.md).
+- To redirect to a page in the same project, use relative paths and
+  the `.md` extension. Both old and new paths start from the same location.
+  In the following example, both paths are relative to `doc/`:
 
-   <!-- This redirect file can be deleted after <YYYY-MM-DD>. -->
-   <!-- Redirects that point to other docs in the same project expire in three months. -->
-   <!-- Redirects that point to docs in a different project or site (for example, link is not relative and starts with `https:`) expire in one year. -->
-   <!-- Before deletion, see: https://docs.gitlab.com/ee/development/documentation/redirects.html -->
-   ```
+  ```shell
+  bundle exec rake "gitlab:docs:redirect[doc/user/search/old_file.md, doc/api/new_file.md]"
+  ```
 
-   - Replace both instances of `../newpath/to/file/index.md` with the new file path.
-   - Replace `YYYY-MM-DD` with the expiry date, as explained in the template.
-
-1. If the documentation page being moved has any Disqus comments, follow the steps
-   described in [Redirections for pages with Disqus comments](#redirections-for-pages-with-disqus-comments).
-1. Open a merge request with your changes. If a documentation page
-   you're removing includes images that aren't used
-   with any other documentation pages, be sure to use your merge request to delete
-   those images from the repository.
-1. Assign the merge request to a technical writer for review and merge.
-1. Search for links to the old documentation file. You must find and update all
-   links that point to the old documentation file:
-
-   - In <https://gitlab.com/gitlab-com/www-gitlab-com>, search for full URLs:
-     `grep -r "docs.gitlab.com/ee/path/to/file.html" .`
-   - In <https://gitlab.com/gitlab-org/gitlab-docs/-/tree/master/content/_data>,
-     search the navigation bar configuration files for the path with `.html`:
-     `grep -r "path/to/file.html" .`
-   - In any of the four internal projects, search for links in the docs
-     and codebase. Search for all variations, including full URL and just the path.
-     For example, go to the root directory of the `gitlab` project and run:
-
-     ```shell
-     grep -r "docs.gitlab.com/ee/path/to/file.html" .
-     grep -r "path/to/file.html" .
-     grep -r "path/to/file.md" .
-     grep -r "path/to/file" .
-     ```
+- To redirect to a page in a different project or site, use the full URL (with `https://`) :
+
+  ```shell
+  bundle exec rake "gitlab:docs:redirect[doc/user/search/old_file.md, https://example.com]"
+  ```
+
+- Alternatively, you can omit the arguments and be prompted to enter the values:
+
+  ```shell
+  bundle exec rake gitlab:docs:redirect
+  ```
+
+## Redirecting a page created before the release
+
+If you create a new page and then rename it before it's added to a release on the 18th:
 
-     You may need to try variations of relative links, such as `../path/to/file` or
-     `../file` to find every case.
+Instead of following that procedure, ask a Technical Writer to manually add the redirect
+to [`redirects.yaml`](https://gitlab.com/gitlab-org/gitlab-docs/-/blob/main/content/_data/redirects.yaml).
 
 ## Redirections for pages with Disqus comments
 
diff --git a/doc/update/plan_your_upgrade.md b/doc/update/plan_your_upgrade.md
index 0947bab855f..9dfdb7c530b 100644
--- a/doc/update/plan_your_upgrade.md
+++ b/doc/update/plan_your_upgrade.md
@@ -172,6 +172,9 @@ If you have Kubernetes clusters connected with GitLab, [upgrade your GitLab agen
 
 #### Elasticsearch
 
+Before updating GitLab, confirm Advanced Search migrations are complete by
+[checking for pending advanced search migrations](index.md#checking-for-pending-advanced-search-migrations).
+
 After updating GitLab, you may have to upgrade
 [Elasticsearch if the new version breaks compatibility](../integration/advanced_search/elasticsearch.md#version-requirements).
 Updating Elasticsearch is **out of scope for GitLab Support**.
diff --git a/doc/user/group/saml_sso/scim_setup.md b/doc/user/group/saml_sso/scim_setup.md
index c68022f4e3c..c5db06eefe1 100644
--- a/doc/user/group/saml_sso/scim_setup.md
+++ b/doc/user/group/saml_sso/scim_setup.md
@@ -27,6 +27,9 @@ The following identity providers are supported:
 - Azure
 - Okta
 
+NOTE:
+Other providers can work with GitLab but they have not been tested and are not supported.
+
 ## Requirements
 
 - [Group Single Sign-On](index.md) must be configured.
diff --git a/doc/user/packages/composer_repository/index.md b/doc/user/packages/composer_repository/index.md
index 4fc55d18253..2aa9cd32bab 100644
--- a/doc/user/packages/composer_repository/index.md
+++ b/doc/user/packages/composer_repository/index.md
@@ -145,6 +145,7 @@ You can publish a Composer package to the Package Registry as part of your CI/CD
      script:
        - apk add curl
        - 'curl --header "Job-Token: $CI_JOB_TOKEN" --data tag=<tag> "${CI_API_V4_URL}/projects/$CI_PROJECT_ID/packages/composer"'
+     environment: production
    ```
 
 1. Run the pipeline.
diff --git a/doc/user/packages/conan_repository/index.md b/doc/user/packages/conan_repository/index.md
index 7260dbb616c..14a2d75ed46 100644
--- a/doc/user/packages/conan_repository/index.md
+++ b/doc/user/packages/conan_repository/index.md
@@ -310,6 +310,7 @@ create_package:
     - conan new <package-name>/0.1 -t
     - conan create . <group-name>+<project-name>/stable
     - CONAN_LOGIN_USERNAME=ci_user CONAN_PASSWORD=${CI_JOB_TOKEN} conan upload <package-name>/0.1@<group-name>+<project-name>/stable --all --remote=gitlab
+  environment: production
 ```
 
 Additional Conan images to use as the basis of your CI file are available in the
diff --git a/doc/user/packages/container_registry/index.md b/doc/user/packages/container_registry/index.md
index a203de2ed2c..38b4e733c82 100644
--- a/doc/user/packages/container_registry/index.md
+++ b/doc/user/packages/container_registry/index.md
@@ -301,6 +301,7 @@ deploy:
     - ./deploy.sh
   only:
     - main
+  environment: production
 ```
 
 NOTE:
diff --git a/doc/user/project/pages/getting_started/pages_from_scratch.md b/doc/user/project/pages/getting_started/pages_from_scratch.md
index 79cd841117a..1c3d5d722cb 100644
--- a/doc/user/project/pages/getting_started/pages_from_scratch.md
+++ b/doc/user/project/pages/getting_started/pages_from_scratch.md
@@ -266,6 +266,7 @@ pages:
       - public
   rules:
     - if: $CI_COMMIT_BRANCH == "main"
+  environment: production
 ```
 
 Now add another job to the CI file, telling it to
@@ -289,6 +290,7 @@ pages:
       - public
   rules:
     - if: $CI_COMMIT_BRANCH == "main"
+  environment: production
 
 test:
   stage: test
@@ -342,6 +344,7 @@ pages:
       - public
   rules:
     - if: $CI_COMMIT_BRANCH == "main"
+  environment: production
 
 test:
   stage: test
@@ -386,6 +389,7 @@ pages:
       - public
   rules:
     - if: $CI_COMMIT_BRANCH == "main"
+  environment: production
 
 test:
   stage: test
diff --git a/doc/user/project/pages/introduction.md b/doc/user/project/pages/introduction.md
index 3bd16a17f23..da024881ed6 100644
--- a/doc/user/project/pages/introduction.md
+++ b/doc/user/project/pages/introduction.md
@@ -314,6 +314,7 @@ pages:
   artifacts:
     paths:
       - public
+  environment: production
 ```
 
 The `FF_USE_FASTZIP` variable enables the [feature flag](https://docs.gitlab.com/runner/configuration/feature-flags.html#available-feature-flags) which is needed for [`ARTIFACT_COMPRESSION_LEVEL`](../../../ci/runners/configure_runners.md#artifact-and-cache-settings).
diff --git a/doc/user/project/releases/index.md b/doc/user/project/releases/index.md
index bace776c294..bf4575c9492 100644
--- a/doc/user/project/releases/index.md
+++ b/doc/user/project/releases/index.md
@@ -313,6 +313,7 @@ deploy_to_production:
   script: deploy_to_prod.sh
   rules:
     - if: $CI_DEPLOY_FREEZE == null
+  environment: production
 ```
 
 To set a deploy freeze window in the UI, complete these steps:
diff --git a/lib/gitlab/background_migration/destroy_invalid_project_members.rb b/lib/gitlab/background_migration/destroy_invalid_project_members.rb
new file mode 100644
index 00000000000..3c60f765c29
--- /dev/null
+++ b/lib/gitlab/background_migration/destroy_invalid_project_members.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class DestroyInvalidProjectMembers < Gitlab::BackgroundMigration::BatchedMigrationJob # rubocop:disable Style/Documentation
+      scope_to ->(relation) { relation.where(source_type: 'Project') }
+
+      def perform
+        each_sub_batch(operation_name: :delete_all) do |sub_batch|
+          invalid_project_members = sub_batch
+                                      .joins('LEFT OUTER JOIN projects ON members.source_id = projects.id')
+                                      .where(projects: { id: nil })
+          invalid_ids = invalid_project_members.pluck(:id)
+
+          # the actual delete
+          deleted_count = invalid_project_members.delete_all
+
+          Gitlab::AppLogger.info({ message: 'Removing invalid project member records',
+                                   deleted_count: deleted_count,
+                                   ids: invalid_ids })
+        end
+      end
+    end
+  end
+end
diff --git a/spec/frontend/jira_connect/subscriptions/api_spec.js b/spec/frontend/jira_connect/subscriptions/api_spec.js
index 57b11bdbc27..76a0b8fa82c 100644
--- a/spec/frontend/jira_connect/subscriptions/api_spec.js
+++ b/spec/frontend/jira_connect/subscriptions/api_spec.js
@@ -1,7 +1,13 @@
 import MockAdapter from 'axios-mock-adapter';
-import { addSubscription, removeSubscription, fetchGroups } from '~/jira_connect/subscriptions/api';
+import {
+  axiosInstance,
+  addSubscription,
+  removeSubscription,
+  fetchGroups,
+  getCurrentUser,
+  addJiraConnectSubscription,
+} from '~/jira_connect/subscriptions/api';
 import { getJwt } from '~/jira_connect/subscriptions/utils';
-import axios from '~/lib/utils/axios_utils';
 import httpStatus from '~/lib/utils/http_status';
 
 jest.mock('~/jira_connect/subscriptions/utils', () => ({
@@ -9,21 +15,26 @@ jest.mock('~/jira_connect/subscriptions/utils', () => ({
 }));
 
 describe('JiraConnect API', () => {
-  let mock;
+  let axiosMock;
+  let originalGon;
   let response;
 
   const mockAddPath = 'addPath';
   const mockRemovePath = 'removePath';
   const mockNamespace = 'namespace';
   const mockJwt = 'jwt';
+  const mockAccessToken = 'accessToken';
   const mockResponse = { success: true };
 
   beforeEach(() => {
-    mock = new MockAdapter(axios);
+    axiosMock = new MockAdapter(axiosInstance);
+    originalGon = window.gon;
+    window.gon = { api_version: 'v4' };
   });
 
   afterEach(() => {
-    mock.restore();
+    axiosMock.restore();
+    window.gon = originalGon;
     response = null;
   });
 
@@ -31,8 +42,8 @@ describe('JiraConnect API', () => {
     const makeRequest = () => addSubscription(mockAddPath, mockNamespace);
 
     it('returns success response', async () => {
-      jest.spyOn(axios, 'post');
-      mock
+      jest.spyOn(axiosInstance, 'post');
+      axiosMock
         .onPost(mockAddPath, {
           jwt: mockJwt,
           namespace_path: mockNamespace,
@@ -42,7 +53,7 @@ describe('JiraConnect API', () => {
       response = await makeRequest();
 
       expect(getJwt).toHaveBeenCalled();
-      expect(axios.post).toHaveBeenCalledWith(mockAddPath, {
+      expect(axiosInstance.post).toHaveBeenCalledWith(mockAddPath, {
         jwt: mockJwt,
         namespace_path: mockNamespace,
       });
@@ -54,13 +65,13 @@ describe('JiraConnect API', () => {
     const makeRequest = () => removeSubscription(mockRemovePath);
 
     it('returns success response', async () => {
-      jest.spyOn(axios, 'delete');
-      mock.onDelete(mockRemovePath).replyOnce(httpStatus.OK, mockResponse);
+      jest.spyOn(axiosInstance, 'delete');
+      axiosMock.onDelete(mockRemovePath).replyOnce(httpStatus.OK, mockResponse);
 
       response = await makeRequest();
 
       expect(getJwt).toHaveBeenCalled();
-      expect(axios.delete).toHaveBeenCalledWith(mockRemovePath, {
+      expect(axiosInstance.delete).toHaveBeenCalledWith(mockRemovePath, {
         params: {
           jwt: mockJwt,
         },
@@ -81,8 +92,8 @@ describe('JiraConnect API', () => {
       });
 
     it('returns success response', async () => {
-      jest.spyOn(axios, 'get');
-      mock
+      jest.spyOn(axiosInstance, 'get');
+      axiosMock
         .onGet(mockGroupsPath, {
           page: mockPage,
           per_page: mockPerPage,
@@ -91,7 +102,7 @@ describe('JiraConnect API', () => {
 
       response = await makeRequest();
 
-      expect(axios.get).toHaveBeenCalledWith(mockGroupsPath, {
+      expect(axiosInstance.get).toHaveBeenCalledWith(mockGroupsPath, {
         params: {
           page: mockPage,
           per_page: mockPerPage,
@@ -100,4 +111,46 @@ describe('JiraConnect API', () => {
       expect(response.data).toEqual(mockResponse);
     });
   });
+
+  describe('getCurrentUser', () => {
+    const makeRequest = () => getCurrentUser();
+
+    it('returns success response', async () => {
+      const expectedUrl = '/api/v4/user';
+
+      jest.spyOn(axiosInstance, 'get');
+
+      axiosMock.onGet(expectedUrl).replyOnce(httpStatus.OK, mockResponse);
+
+      response = await makeRequest();
+
+      expect(axiosInstance.get).toHaveBeenCalledWith(expectedUrl, {});
+      expect(response.data).toEqual(mockResponse);
+    });
+  });
+
+  describe('addJiraConnectSubscription', () => {
+    const makeRequest = () =>
+      addJiraConnectSubscription(mockNamespace, { jwt: mockJwt, accessToken: mockAccessToken });
+
+    it('returns success response', async () => {
+      const expectedUrl = '/api/v4/integrations/jira_connect/subscriptions';
+
+      jest.spyOn(axiosInstance, 'post');
+
+      axiosMock.onPost(expectedUrl).replyOnce(httpStatus.OK, mockResponse);
+
+      response = await makeRequest();
+
+      expect(axiosInstance.post).toHaveBeenCalledWith(
+        expectedUrl,
+        {
+          jwt: mockJwt,
+          namespace_path: mockNamespace,
+        },
+        { headers: { Authorization: `Bearer ${mockAccessToken}` } },
+      );
+      expect(response.data).toEqual(mockResponse);
+    });
+  });
 });
diff --git a/spec/frontend/jira_connect/subscriptions/components/sign_in_oauth_button_spec.js b/spec/frontend/jira_connect/subscriptions/components/sign_in_oauth_button_spec.js
index ed0abaaf576..383ed2225cd 100644
--- a/spec/frontend/jira_connect/subscriptions/components/sign_in_oauth_button_spec.js
+++ b/spec/frontend/jira_connect/subscriptions/components/sign_in_oauth_button_spec.js
@@ -11,14 +11,13 @@ import axios from '~/lib/utils/axios_utils';
 import waitForPromises from 'helpers/wait_for_promises';
 import httpStatus from '~/lib/utils/http_status';
 import AccessorUtilities from '~/lib/utils/accessor';
-import { getCurrentUser } from '~/rest_api';
+import { getCurrentUser } from '~/jira_connect/subscriptions/api';
 import createStore from '~/jira_connect/subscriptions/store';
 import { SET_ACCESS_TOKEN } from '~/jira_connect/subscriptions/store/mutation_types';
 
 jest.mock('~/lib/utils/accessor');
 jest.mock('~/jira_connect/subscriptions/utils');
 jest.mock('~/jira_connect/subscriptions/api');
-jest.mock('~/rest_api');
 jest.mock('~/jira_connect/subscriptions/pkce', () => ({
   createCodeVerifier: jest.fn().mockReturnValue('mock-verifier'),
   createCodeChallenge: jest.fn().mockResolvedValue('mock-challenge'),
diff --git a/spec/frontend/jira_connect/subscriptions/store/actions_spec.js b/spec/frontend/jira_connect/subscriptions/store/actions_spec.js
index 53b5d8e70af..5e3c30269b5 100644
--- a/spec/frontend/jira_connect/subscriptions/store/actions_spec.js
+++ b/spec/frontend/jira_connect/subscriptions/store/actions_spec.js
@@ -8,8 +8,6 @@ import {
 } from '~/jira_connect/subscriptions/store/actions';
 import state from '~/jira_connect/subscriptions/store/state';
 import * as api from '~/jira_connect/subscriptions/api';
-import * as userApi from '~/api/user_api';
-import * as integrationsApi from '~/api/integrations_api';
 import {
   I18N_DEFAULT_SUBSCRIPTIONS_ERROR_MESSAGE,
   I18N_ADD_SUBSCRIPTION_SUCCESS_ALERT_TITLE,
@@ -79,7 +77,7 @@ describe('JiraConnect actions', () => {
     describe('when API request succeeds', () => {
       it('commits the SET_ACCESS_TOKEN and SET_CURRENT_USER mutations', async () => {
         const mockUser = { name: 'root' };
-        jest.spyOn(userApi, 'getCurrentUser').mockResolvedValue({ data: mockUser });
+        jest.spyOn(api, 'getCurrentUser').mockResolvedValue({ data: mockUser });
 
         await testAction(
           loadCurrentUser,
@@ -89,7 +87,7 @@ describe('JiraConnect actions', () => {
           [],
         );
 
-        expect(userApi.getCurrentUser).toHaveBeenCalledWith({
+        expect(api.getCurrentUser).toHaveBeenCalledWith({
           headers: { Authorization: `Bearer ${mockAccessToken}` },
         });
       });
@@ -97,7 +95,7 @@ describe('JiraConnect actions', () => {
 
     describe('when API request fails', () => {
       it('commits the SET_CURRENT_USER_ERROR mutation', async () => {
-        jest.spyOn(userApi, 'getCurrentUser').mockRejectedValue();
+        jest.spyOn(api, 'getCurrentUser').mockRejectedValue();
 
         await testAction(
           loadCurrentUser,
@@ -120,9 +118,7 @@ describe('JiraConnect actions', () => {
 
     describe('when API request succeeds', () => {
       it('commits the SET_ACCESS_TOKEN and SET_CURRENT_USER mutations', async () => {
-        jest
-          .spyOn(integrationsApi, 'addJiraConnectSubscription')
-          .mockResolvedValue({ success: true });
+        jest.spyOn(api, 'addJiraConnectSubscription').mockResolvedValue({ success: true });
 
         await testAction(
           addSubscription,
@@ -144,7 +140,7 @@ describe('JiraConnect actions', () => {
           [{ type: 'fetchSubscriptions', payload: mockSubscriptionsPath }],
         );
 
-        expect(integrationsApi.addJiraConnectSubscription).toHaveBeenCalledWith(mockNamespace, {
+        expect(api.addJiraConnectSubscription).toHaveBeenCalledWith(mockNamespace, {
           accessToken: null,
           jwt: '1234',
         });
@@ -153,7 +149,7 @@ describe('JiraConnect actions', () => {
 
     describe('when API request fails', () => {
       it('commits the SET_CURRENT_USER_ERROR mutation', async () => {
-        jest.spyOn(integrationsApi, 'addJiraConnectSubscription').mockRejectedValue();
+        jest.spyOn(api, 'addJiraConnectSubscription').mockRejectedValue();
 
         await testAction(
           addSubscription,
diff --git a/spec/lib/gitlab/background_migration/destroy_invalid_project_members_spec.rb b/spec/lib/gitlab/background_migration/destroy_invalid_project_members_spec.rb
new file mode 100644
index 00000000000..029a6adf831
--- /dev/null
+++ b/spec/lib/gitlab/background_migration/destroy_invalid_project_members_spec.rb
@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::BackgroundMigration::DestroyInvalidProjectMembers, :migration, schema: 20220901035725 do
+  # rubocop: disable Layout/LineLength
+  # rubocop: disable RSpec/ScatteredLet
+  let!(:migration_attrs) do
+    {
+      start_id: 1,
+      end_id: 1000,
+      batch_table: :members,
+      batch_column: :id,
+      sub_batch_size: 100,
+      pause_ms: 0,
+      connection: ApplicationRecord.connection
+    }
+  end
+
+  let!(:migration) { described_class.new(**migration_attrs) }
+
+  subject(:perform_migration) { migration.perform }
+
+  let(:users_table) { table(:users) }
+  let(:namespaces_table) { table(:namespaces) }
+  let(:members_table) { table(:members) }
+  let(:projects_table) { table(:projects) }
+
+  let(:user1) { users_table.create!(name: 'user1', email: 'user1@example.com', projects_limit: 5) }
+  let(:user2) { users_table.create!(name: 'user2', email: 'user2@example.com', projects_limit: 5) }
+  let(:user3) { users_table.create!(name: 'user3', email: 'user3@example.com', projects_limit: 5) }
+  let(:user4) { users_table.create!(name: 'user4', email: 'user4@example.com', projects_limit: 5) }
+  let(:user5) { users_table.create!(name: 'user5', email: 'user5@example.com', projects_limit: 5) }
+  let(:user6) { users_table.create!(name: 'user6', email: 'user6@example.com', projects_limit: 5) }
+
+  let!(:group1) { namespaces_table.create!(name: 'marvellous group 1', path: 'group-path-1', type: 'Group') }
+
+  let!(:project_namespace1) do
+    namespaces_table.create!(name: 'fabulous project', path: 'project-path-1', type: 'ProjectNamespace',
+                             parent_id: group1.id)
+  end
+
+  let!(:project1) do
+    projects_table.create!(name: 'fabulous project', path: 'project-path-1', project_namespace_id: project_namespace1.id,
+                           namespace_id: group1.id)
+  end
+
+  let!(:project_namespace2) do
+    namespaces_table.create!(name: 'splendiferous project', path: 'project-path-2', type: 'ProjectNamespace',
+                             parent_id: group1.id)
+  end
+
+  let!(:project2) do
+    projects_table.create!(name: 'splendiferous project', path: 'project-path-2', project_namespace_id: project_namespace2.id,
+                           namespace_id: group1.id)
+  end
+
+  # create project member records, a mix of both valid and invalid
+  # group members will have already been filtered out.
+  let!(:project_member1) { create_invalid_project_member(id: 1, user_id: user1.id) }
+  let!(:project_member2) { create_valid_project_member(id: 4, user_id: user2.id, project: project1) }
+  let!(:project_member3) { create_valid_project_member(id: 5, user_id: user3.id, project: project2) }
+  let!(:project_member4) { create_invalid_project_member(id: 6, user_id: user4.id) }
+  let!(:project_member5) { create_valid_project_member(id: 7, user_id: user5.id, project: project2) }
+  let!(:project_member6) { create_invalid_project_member(id: 8, user_id: user6.id) }
+
+  it 'removes invalid memberships but keeps valid ones', :aggregate_failures do
+    expect(members_table.where(type: 'ProjectMember').count).to eq 6
+
+    queries = ActiveRecord::QueryRecorder.new do
+      perform_migration
+    end
+
+    expect(queries.count).to eq(4)
+    expect(members_table.where(type: 'ProjectMember')).to match_array([project_member2, project_member3, project_member5])
+  end
+
+  it 'tracks timings of queries' do
+    expect(migration.batch_metrics.timings).to be_empty
+
+    expect { perform_migration }.to change { migration.batch_metrics.timings }
+  end
+
+  it 'logs IDs of deleted records' do
+    expect(Gitlab::AppLogger).to receive(:info).with({ message: 'Removing invalid project member records',
+                                                       deleted_count: 3, ids: [project_member1, project_member4, project_member6].map(&:id) })
+
+    perform_migration
+  end
+
+  def create_invalid_project_member(id:, user_id:)
+    members_table.create!(id: id, user_id: user_id, source_id: non_existing_record_id, access_level: Gitlab::Access::MAINTAINER,
+                          type: "ProjectMember", source_type: "Project", notification_level: 3, member_namespace_id: nil)
+  end
+
+  def create_valid_project_member(id:, user_id:, project:)
+    members_table.create!(id: id, user_id: user_id, source_id: project.id, access_level: Gitlab::Access::MAINTAINER,
+                          type: "ProjectMember", source_type: "Project", member_namespace_id: project.project_namespace_id, notification_level: 3)
+  end
+  # rubocop: enable Layout/LineLength
+  # rubocop: enable RSpec/ScatteredLet
+end
diff --git a/spec/migrations/20220901035725_schedule_destroy_invalid_project_members_spec.rb b/spec/migrations/20220901035725_schedule_destroy_invalid_project_members_spec.rb
new file mode 100644
index 00000000000..ed9f7e3cd44
--- /dev/null
+++ b/spec/migrations/20220901035725_schedule_destroy_invalid_project_members_spec.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe ScheduleDestroyInvalidProjectMembers, :migration do
+  let_it_be(:migration) { described_class::MIGRATION }
+
+  describe '#up' do
+    it 'schedules background jobs for each batch of members' do
+      migrate!
+
+      expect(migration).to have_scheduled_batched_migration(
+        table_name: :members,
+        column_name: :id,
+        interval: described_class::DELAY_INTERVAL,
+        batch_size: described_class::BATCH_SIZE,
+        max_batch_size: described_class::MAX_BATCH_SIZE
+      )
+    end
+  end
+
+  describe '#down' do
+    it 'deletes all batched migration records' do
+      migrate!
+      schema_migrate_down!
+
+      expect(migration).not_to have_scheduled_batched_migration
+    end
+  end
+end