Add latest changes from gitlab-org/gitlab@master

7 files changed, 66 insertions, 34 deletions

diff --git a/doc/user/application_security/api_fuzzing/index.md b/doc/user/application_security/api_fuzzing/index.md
index 30d29098bda..c0ba764e706 100644
--- a/doc/user/application_security/api_fuzzing/index.md
+++ b/doc/user/application_security/api_fuzzing/index.md
@@ -2351,9 +2351,12 @@ apifuzzer_v1:
     FUZZAPI_EXCLUDE_PATHS: /api/v1/**
   rules:
     rules:
-    - if: $API_FUZZING_DISABLED
+    - if: $API_FUZZING_DISABLED == 'true' || $API_FUZZING_DISABLED == '1'
       when: never
-    - if: $API_FUZZING_DISABLED_FOR_DEFAULT_BRANCH &&
+    - if: $API_FUZZING_DISABLED_FOR_DEFAULT_BRANCH == 'true' &&
+            $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
+      when: never
+    - if: $API_FUZZING_DISABLED_FOR_DEFAULT_BRANCH == '1' &&
             $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
       when: never
     - if: $CI_COMMIT_BRANCH &&
@@ -2367,7 +2370,7 @@ apifuzzer_v2:
     FUZZAPI_EXCLUDE_PATHS: /api/v2/**
   rules:
     rules:
-    - if: $API_FUZZING_DISABLED
+    - if: $API_FUZZING_DISABLED == 'true' || $API_FUZZING_DISABLED == '1'
       when: never
     - if: $API_FUZZING_DISABLED_FOR_DEFAULT_BRANCH &&
             $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
@@ -2402,7 +2405,7 @@ apifuzzer_branch:
     FUZZAPI_EXCLUDE_PATHS: /api/large_response_json
   rules:
     rules:
-    - if: $API_FUZZING_DISABLED
+    - if: $API_FUZZING_DISABLED == 'true' || $API_FUZZING_DISABLED == '1'
       when: never
     - if: $API_FUZZING_DISABLED_FOR_DEFAULT_BRANCH &&
             $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
@@ -2420,7 +2423,7 @@ apifuzzer_branch:
 apifuzzer_main:
   extends: apifuzzer_fuzz
     rules:
-    - if: $API_FUZZING_DISABLED
+    - if: $API_FUZZING_DISABLED == 'true' || $API_FUZZING_DISABLED == '1'
       when: never
     - if: $API_FUZZING_DISABLED_FOR_DEFAULT_BRANCH &&
             $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
diff --git a/doc/user/application_security/dast_api/index.md b/doc/user/application_security/dast_api/index.md
index 22d4c92b9e1..0daa44aec16 100644
--- a/doc/user/application_security/dast_api/index.md
+++ b/doc/user/application_security/dast_api/index.md
@@ -2252,9 +2252,12 @@ dast_api_v1:
   variables:
     DAST_API_EXCLUDE_PATHS: /api/v1/**
   rules:
-  - if: $DAST_API_DISABLED
+  - if: $DAST_API_DISABLED == 'true' || $DAST_API_DISABLED == '1'
     when: never
-  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH &&
+  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH == 'true' &&
+        $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
+    when: never
+  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH == '1' &&
         $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
     when: never
   - if: $CI_COMMIT_BRANCH &&
@@ -2267,9 +2270,12 @@ dast_api_v2:
   variables:
     DAST_API_EXCLUDE_PATHS: /api/v2/**
   rules:
-  - if: $DAST_API_DISABLED
+  - if: $DAST_API_DISABLED == 'true' || $DAST_API_DISABLED == '1'
+    when: never
+  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH == 'true' &&
+        $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
     when: never
-  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH &&
+  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH == '1' &&
         $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
     when: never
   - if: $CI_COMMIT_BRANCH &&
@@ -2301,9 +2307,12 @@ dast_api_branch:
   variables:
     DAST_API_EXCLUDE_PATHS: /api/large_response_json
   rules:
-  - if: $DAST_API_DISABLED
+  - if: $DAST_API_DISABLED == 'true' || $DAST_API_DISABLED == '1'
     when: never
-  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH &&
+  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH == 'true' &&
+        $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
+    when: never
+  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH == '1' &&
         $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
     when: never
   - if: $CI_COMMIT_BRANCH &&
@@ -2319,9 +2328,12 @@ dast_api_branch:
 dast_api_main:
   extends: dast_api
   rules:
-  - if: $DAST_API_DISABLED
+  - if: $DAST_API_DISABLED == 'true' || $DAST_API_DISABLED == '1'
+    when: never
+  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH == 'true' &&
+        $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
     when: never
-  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH &&
+  - if: $DAST_API_DISABLED_FOR_DEFAULT_BRANCH == '1' &&
         $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
     when: never
   - if: $CI_COMMIT_BRANCH &&
diff --git a/doc/user/application_security/index.md b/doc/user/application_security/index.md
index 38625a12c25..a3c512a813c 100644
--- a/doc/user/application_security/index.md
+++ b/doc/user/application_security/index.md
@@ -240,9 +240,9 @@ reports are available to download. To download a report, select
 
 ### Ultimate
 
-A merge request contains a security widget which displays a summary of the new results. New results are determined by comparing the findings of the merge request against the findings of the most recent completed pipeline (`success`, `failed`, `canceled` or `skipped`) for the latest commit in the target branch.
+A merge request contains a security widget which displays a summary of the _new_ results. New results are determined by comparing the findings of the merge request against the findings of the most recent completed pipeline (`success`, `failed`, `canceled` or `skipped`) for the commit when the feature branch was created from the target branch.
 
-If security scans have not run for the most recent completed pipeline in the target branch there is no base for comparison. The vulnerabilities from the merge request findings are listed as new in the merge request security widget. We recommend you run a scan of the `default` (target) branch before enabling feature branch scans for your developers.
+If security scans have not run for the completed pipeline in the target branch when the feature branch was created, there is no base for comparison. The vulnerabilities from the merge request findings are listed as new in the merge request security widget. We recommend you run a scan of the `default` (target) branch before enabling feature branch scans for your developers.
 
 The merge request security widget displays only a subset of the vulnerabilities in the generated JSON artifact because it contains both new and existing findings.
 
diff --git a/doc/user/application_security/policies/scan-execution-policies.md b/doc/user/application_security/policies/scan-execution-policies.md
index 55a4994e168..61671efab63 100644
--- a/doc/user/application_security/policies/scan-execution-policies.md
+++ b/doc/user/application_security/policies/scan-execution-policies.md
@@ -257,5 +257,5 @@ developer may want to try running a SAST scan with different variables than the
 this case, two SAST jobs run in the pipeline, one with the developer's variables and one with the security and compliance team's variables.
 
 If you want to avoid running duplicate scans, you can either remove the scans from the project's `.gitlab-ci.yml` file or disable your
-local jobs by setting `SAST_DISABLED: true`. Disabling jobs this way does not prevent the security jobs defined by scan execution
+local jobs by setting `SAST_DISABLED: "true"`. Disabling jobs this way does not prevent the security jobs defined by scan execution
 policies from running.
diff --git a/doc/user/application_security/policies/scan-result-policies.md b/doc/user/application_security/policies/scan-result-policies.md
index 66ddee262d6..d0a736d0277 100644
--- a/doc/user/application_security/policies/scan-result-policies.md
+++ b/doc/user/application_security/policies/scan-result-policies.md
@@ -76,14 +76,14 @@ the following sections and tables provide an alternative.
 
 This rule enforces the defined actions based on security scan findings.
 
-| Field      | Type | Possible values | Description |
-|------------|------|-----------------|-------------|
-| `type`     | `string` | `scan_finding` | The rule's type. |
-| `branches` | `array` of `string` | `[]` or the branch's name | Applicable only to protected target branches. An empty array, `[]`, applies the rule to all protected target branches. |
-| `scanners`  | `array` of `string` | `sast`, `secret_detection`, `dependency_scanning`, `container_scanning`, `dast`, `coverage_fuzzing`, `api_fuzzing` | The security scanners for this rule to consider. `sast` includes results from both SAST and SAST IaC scanners. |
-| `vulnerabilities_allowed`  | `integer` | Greater than or equal to zero | Number of vulnerabilities allowed before this rule is considered. |
-| `severity_levels`  | `array` of `string` | `info`, `unknown`, `low`, `medium`, `high`, `critical`| The severity levels for this rule to consider. |
-| `vulnerability_states`  | `array` of `string` | `newly_detected`, `detected`, `confirmed`, `resolved`, `dismissed` | All vulnerabilities fall into two categories:<br><br>**Newly Detected Vulnerabilities** - the `newly_detected` policy option covers vulnerabilities identified in the merge request branch itself but that do not currently exist on the default branch. This policy option requires a pipeline to complete before the rule is evaluated so that it knows whether vulnerabilities are newly detected or not. Merge requests are blocked until the pipeline and necessary security scans are complete. The `newly_detected` option considers both of the following statuses:<br><br> • Detected<br> • Dismissed<br><br>**Pre-Existing Vulnerabilities** - these policy options are evaluated immediately and do not require a pipeline complete as they consider only vulnerabilities previously detected in the default branch.<br><br> • `Detected` - the policy looks for vulnerabilities in the detected state.<br> • `Confirmed` - the policy looks for vulnerabilities in the confirmed state.<br> • `Dismissed` - the policy looks for vulnerabilities in the dismissed state.<br> • `Resolved` - the policy looks for vulnerabilities in the resolved state. |
+| Field      | Type | Possible values                                                                                                    | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+|------------|------|--------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `type`     | `string` | `scan_finding`                                                                                                     | The rule's type.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `branches` | `array` of `string` | `[]` or the branch's name                                                                                          | Applicable only to protected target branches. An empty array, `[]`, applies the rule to all protected target branches.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `scanners`  | `array` of `string` | `sast`, `secret_detection`, `dependency_scanning`, `container_scanning`, `dast`, `coverage_fuzzing`, `api_fuzzing` | The security scanners for this rule to consider. `sast` includes results from both SAST and SAST IaC scanners.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `vulnerabilities_allowed`  | `integer` | Greater than or equal to zero                                                                                      | Number of vulnerabilities allowed before this rule is considered.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `severity_levels`  | `array` of `string` | `info`, `unknown`, `low`, `medium`, `high`, `critical`                                                             | The severity levels for this rule to consider.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `vulnerability_states`  | `array` of `string` | `newly_detected`, `detected`, `confirmed`, `resolved`, `dismissed`, `new_needs_triage`, `new_dismissed`                           | All vulnerabilities fall into two categories:<br><br>**Newly Detected Vulnerabilities** - the `newly_detected` policy option covers vulnerabilities identified in the merge request branch itself but that do not currently exist on the default branch. This policy option requires a pipeline to complete before the rule is evaluated so that it knows whether vulnerabilities are newly detected or not. Merge requests are blocked until the pipeline and necessary security scans are complete. The `newly_detected` option considers both of the following statuses:<br><br> • Detected<br> • Dismissed<br><br> The `new_needs_triage` option considers the status<br><br> • Detected<br><br> The `new_dismissed` option considers the status<br><br> • Dismissed<br><br>**Pre-Existing Vulnerabilities** - these policy options are evaluated immediately and do not require a pipeline complete as they consider only vulnerabilities previously detected in the default branch.<br><br> • `Detected` - the policy looks for vulnerabilities in the detected state.<br> • `Confirmed` - the policy looks for vulnerabilities in the confirmed state.<br> • `Dismissed` - the policy looks for vulnerabilities in the dismissed state.<br> • `Resolved` - the policy looks for vulnerabilities in the resolved state. |
 
 ## `license_finding` rule type
 
diff --git a/doc/user/compliance/compliance_report/index.md b/doc/user/compliance/compliance_report/index.md
index c6684ba4083..d04aeec066f 100644
--- a/doc/user/compliance/compliance_report/index.md
+++ b/doc/user/compliance/compliance_report/index.md
@@ -195,40 +195,57 @@ To view the compliance frameworks report:
 
 ### Apply a compliance framework to projects in a group
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/383209) in GitLab 15.11.
+> - Adding compliance frameworks using bulk actions [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/383209) in GitLab 15.11.
+> - Adding compliance frameworks without using bulk actions [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/394795) in GitLab 16.0.
 
-You can apply a compliance framework to selected projects in a group.
+You can apply a compliance framework to projects in a group.
 
 Prerequisites:
 
 - You must have the Owner role for the group.
 
-To apply a compliance framework to projects in a group:
+To apply a compliance framework to one project in a group:
 
 1. On the top bar, select **Main menu > Groups** and find your group.
 1. On the left sidebar, select **Security and Compliance > Compliance report**.
 1. On the page, select the **Frameworks** tab.
-1. Select one or more projects.
+1. Next to the project you want to add the compliance framework to, select **{plus}** **Add framework**.
+1. Select an existing compliance framework or create a new one.
+
+To apply a compliance framework to multiple projects in a group:
+
+1. On the top bar, select **Main menu > Groups** and find your group.
+1. On the left sidebar, select **Security and Compliance > Compliance report**.
+1. On the page, select the **Frameworks** tab.
+1. Select multiple projects.
 1. From the **Choose one bulk action** dropdown list, select **Apply framework to selected projects**.
 1. Select framework to apply.
 1. Select **Apply**.
 
 ### Remove a compliance framework from projects in a group
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/383209) in GitLab 15.11.
+> - Removing compliance frameworks using bulk actions [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/383209) in GitLab 15.11.
+> - Removing compliance frameworks without using bulk actions [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/394795) in GitLab 16.0.
 
-You can remove a compliance framework from selected projects in a group.
+You can remove a compliance framework from projects in a group.
 
 Prerequisites:
 
 - You must have the Owner role for the group.
 
-To remove a compliance framework from projects in a group:
+To remove a compliance framework from one project in a group:
+
+1. On the top bar, select **Main menu > Groups** and find your group.
+1. On the left sidebar, select **Security and Compliance > Compliance report**.
+1. On the page, select the **Frameworks** tab.
+1. Next to the compliance framework to remove from the project, select **{close}** on the framework label.
+
+To remove a compliance framework from multiple projects in a group:
 
 1. On the top bar, select **Main menu > Groups** and find your group.
 1. On the left sidebar, select **Security and Compliance > Compliance report**.
 1. On the page, select the **Frameworks** tab.
-1. Select one or more projects.
+1. Select multiple projects.
 1. From the **Choose one bulk action** dropdown list, select **Remove framework from selected projects**.
 1. Select **Remove**.
 
diff --git a/doc/user/group/manage.md b/doc/user/group/manage.md
index ea150436e5b..5b88315f497 100644
--- a/doc/user/group/manage.md
+++ b/doc/user/group/manage.md
@@ -699,7 +699,7 @@ To enable Code Suggestions for a group:
 1. Find the **Code Suggestions** settings.
 1. Select **Save changes**.
 
-## Group Experiment features setting **(ULTIMATE)**
+## Group Experiment features setting **(ULTIMATE SAAS)**
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/404856) in GitLab 16.0.
 
@@ -721,7 +721,7 @@ To enable Experiment features for a group:
 1. Find the **Experiment features** settings.
 1. Select **Save changes**.
 
-## Group third-party AI features setting **(ULTIMATE)**
+## Group third-party AI features setting **(ULTIMATE SAAS)**
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/404856) in GitLab 16.0.