From d00d60a66deeacb19ccbd39501946ed646db64b6 Mon Sep 17 00:00:00 2001
From: Ash McKenzie <ash@the-rebellion.net>
Date: Tue, 16 Jul 2019 14:20:52 +1000
Subject: Allow UsageData.count to use count_by:

---
 lib/gitlab/usage_data.rb           | 4 ++--
 spec/lib/gitlab/usage_data_spec.rb | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/gitlab/usage_data.rb b/lib/gitlab/usage_data.rb
index 7572c0bdbfd..f02d9f7d7e7 100644
--- a/lib/gitlab/usage_data.rb
+++ b/lib/gitlab/usage_data.rb
@@ -176,8 +176,8 @@ module Gitlab
         {} # augmented in EE
       end
 
-      def count(relation, fallback: -1)
-        relation.count
+      def count(relation, count_by: nil, fallback: -1)
+        count_by ? relation.count(count_by) : relation.count
       rescue ActiveRecord::StatementInvalid
         fallback
       end
diff --git a/spec/lib/gitlab/usage_data_spec.rb b/spec/lib/gitlab/usage_data_spec.rb
index 90a534de202..7fe60fd214c 100644
--- a/spec/lib/gitlab/usage_data_spec.rb
+++ b/spec/lib/gitlab/usage_data_spec.rb
@@ -234,6 +234,12 @@ describe Gitlab::UsageData do
       expect(described_class.count(relation)).to eq(1)
     end
 
+    it 'returns the count for count_by when provided' do
+      allow(relation).to receive(:count).with(:creator_id).and_return(2)
+
+      expect(described_class.count(relation, count_by: :creator_id)).to eq(2)
+    end
+
     it 'returns the fallback value when counting fails' do
       allow(relation).to receive(:count).and_raise(ActiveRecord::StatementInvalid.new(''))
 
-- 
cgit v1.2.1


From f53112de5931144ac74819f87c227f06e115ba58 Mon Sep 17 00:00:00 2001
From: Ash McKenzie <ash@the-rebellion.net>
Date: Thu, 18 Jul 2019 12:09:30 +1000
Subject: New GroupMember.of_ldap_type scope

---
 app/models/members/group_member.rb       |  2 +-
 spec/factories/group_members.rb          |  4 ++++
 spec/models/members/group_member_spec.rb | 36 ++++++++++++++++++++------------
 3 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/app/models/members/group_member.rb b/app/models/members/group_member.rb
index 4cba69069bb..341d2fe2149 100644
--- a/app/models/members/group_member.rb
+++ b/app/models/members/group_member.rb
@@ -13,8 +13,8 @@ class GroupMember < Member
   default_scope { where(source_type: SOURCE_TYPE) }
 
   scope :of_groups, ->(groups) { where(source_id: groups.select(:id)) }
-
   scope :count_users_by_group_id, -> { joins(:user).group(:source_id).count }
+  scope :of_ldap_type, -> { where(ldap: true) }
 
   after_create :update_two_factor_requirement, unless: :invite?
   after_destroy :update_two_factor_requirement, unless: :invite?
diff --git a/spec/factories/group_members.rb b/spec/factories/group_members.rb
index 077c6ddc5ae..0cf99a31d20 100644
--- a/spec/factories/group_members.rb
+++ b/spec/factories/group_members.rb
@@ -16,5 +16,9 @@ FactoryBot.define do
       invite_token 'xxx'
       invite_email 'email@email.com'
     end
+
+    trait(:ldap) do
+      ldap true
+    end
   end
 end
diff --git a/spec/models/members/group_member_spec.rb b/spec/models/members/group_member_spec.rb
index f227abd3dae..a6928ec31f4 100644
--- a/spec/models/members/group_member_spec.rb
+++ b/spec/models/members/group_member_spec.rb
@@ -3,19 +3,29 @@
 require 'spec_helper'
 
 describe GroupMember do
-  describe '.count_users_by_group_id' do
-    it 'counts users by group ID' do
-      user_1 = create(:user)
-      user_2 = create(:user)
-      group_1 = create(:group)
-      group_2 = create(:group)
-
-      group_1.add_owner(user_1)
-      group_1.add_owner(user_2)
-      group_2.add_owner(user_1)
-
-      expect(described_class.count_users_by_group_id).to eq(group_1.id => 2,
-                                                            group_2.id => 1)
+  context 'scopes' do
+    describe '.count_users_by_group_id' do
+      it 'counts users by group ID' do
+        user_1 = create(:user)
+        user_2 = create(:user)
+        group_1 = create(:group)
+        group_2 = create(:group)
+
+        group_1.add_owner(user_1)
+        group_1.add_owner(user_2)
+        group_2.add_owner(user_1)
+
+        expect(described_class.count_users_by_group_id).to eq(group_1.id => 2,
+                                                              group_2.id => 1)
+      end
+    end
+
+    describe '.of_ldap_type' do
+      it 'returns ldap type users' do
+        group_member = create(:group_member, :ldap)
+
+        expect(described_class.of_ldap_type).to eq([group_member])
+      end
     end
   end
 
-- 
cgit v1.2.1


From dfcf4cf5f1e87a29f0d9fcc5ff2bba47258893bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ma=C5=82gorzata=20Ksionek?= <mksionek@gitlab.com>
Date: Thu, 18 Jul 2019 10:27:02 +0200
Subject: Add captcha if there are multiple failed login attempts

Add method to store session ids by ip

Add new specs for storing session ids

Add cleaning up records after login

Add retrieving anonymous sessions

Add login recaptcha setting

Add new setting to sessions controller

Add conditions for showing captcha

Add sessions controller specs

Add admin settings specs for login protection

Add new settings to api

Add stub to devise spec

Add new translation key

Add cr remarks

Rename class call

Add cr remarks

Change if-clause for consistency

Add cr remarks

Add code review remarks

Refactor AnonymousSession class

Add changelog entry

Move AnonymousSession class to lib

Move store unauthenticated sessions to sessions controller

Move link to recaptcha info

Regenerate text file

Improve copy on the spam page

Change action filter for storing anonymous sessions

Fix rubocop offences

Add code review remarks
---
 app/controllers/sessions_controller.rb             |  44 ++++++++-
 app/helpers/application_settings_helper.rb         |   1 +
 app/models/application_setting.rb                  |   8 +-
 app/models/application_setting_implementation.rb   |   1 +
 .../admin/application_settings/_spam.html.haml     |  13 ++-
 .../admin/application_settings/reporting.html.haml |   4 +-
 app/views/devise/sessions/_new_base.html.haml      |   2 +-
 ...security-59549-add-capcha-for-failed-logins.yml |   5 +
 config/initializers/warden.rb                      |   1 +
 ...a_protection_enabled_to_application_settings.rb |  12 +++
 db/schema.rb                                       |   1 +
 lib/api/settings.rb                                |   5 +
 lib/gitlab/anonymous_session.rb                    |  39 ++++++++
 lib/gitlab/recaptcha.rb                            |   6 +-
 lib/gitlab/redis/shared_state.rb                   |   1 +
 locale/gitlab.pot                                  |   7 +-
 spec/controllers/sessions_controller_spec.rb       | 108 +++++++++++++++++----
 spec/features/admin/admin_settings_spec.rb         |   2 +
 spec/lib/gitlab/anonymous_session_spec.rb          |  78 +++++++++++++++
 .../devise/shared/_signin_box.html.haml_spec.rb    |   1 +
 20 files changed, 307 insertions(+), 32 deletions(-)
 create mode 100644 changelogs/unreleased/security-59549-add-capcha-for-failed-logins.yml
 create mode 100644 db/migrate/20190719122333_add_login_recaptcha_protection_enabled_to_application_settings.rb
 create mode 100644 lib/gitlab/anonymous_session.rb
 create mode 100644 spec/lib/gitlab/anonymous_session_spec.rb

diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 1880bead3ee..7b682cc0cc5 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -21,10 +21,13 @@ class SessionsController < Devise::SessionsController
   prepend_before_action :ensure_password_authentication_enabled!, if: -> { action_name == 'create' && password_based_login? }
 
   before_action :auto_sign_in_with_provider, only: [:new]
+  before_action :store_unauthenticated_sessions, only: [:new]
+  before_action :save_failed_login, if: :action_new_and_failed_login?
   before_action :load_recaptcha
 
-  after_action :log_failed_login, if: -> { action_name == 'new' && failed_login? }
-  helper_method :captcha_enabled?
+  after_action :log_failed_login, if: :action_new_and_failed_login?
+
+  helper_method :captcha_enabled?, :captcha_on_login_required?
 
   # protect_from_forgery is already prepended in ApplicationController but
   # authenticate_with_two_factor which signs in the user is prepended before
@@ -38,6 +41,7 @@ class SessionsController < Devise::SessionsController
   protect_from_forgery with: :exception, prepend: true
 
   CAPTCHA_HEADER = 'X-GitLab-Show-Login-Captcha'.freeze
+  MAX_FAILED_LOGIN_ATTEMPTS = 5
 
   def new
     set_minimum_password_length
@@ -81,10 +85,14 @@ class SessionsController < Devise::SessionsController
     request.headers[CAPTCHA_HEADER] && Gitlab::Recaptcha.enabled?
   end
 
+  def captcha_on_login_required?
+    Gitlab::Recaptcha.enabled_on_login? && unverified_anonymous_user?
+  end
+
   # From https://github.com/plataformatec/devise/wiki/How-To:-Use-Recaptcha-with-Devise#devisepasswordscontroller
   def check_captcha
     return unless user_params[:password].present?
-    return unless captcha_enabled?
+    return unless captcha_enabled? || captcha_on_login_required?
     return unless Gitlab::Recaptcha.load_configurations!
 
     if verify_recaptcha
@@ -126,10 +134,28 @@ class SessionsController < Devise::SessionsController
     Gitlab::AppLogger.info("Failed Login: username=#{user_params[:login]} ip=#{request.remote_ip}")
   end
 
+  def action_new_and_failed_login?
+    action_name == 'new' && failed_login?
+  end
+
+  def save_failed_login
+    session[:failed_login_attempts] ||= 0
+    session[:failed_login_attempts] += 1
+  end
+
   def failed_login?
     (options = request.env["warden.options"]) && options[:action] == "unauthenticated"
   end
 
+  # storing sessions per IP lets us check if there are associated multiple
+  # anonymous sessions with one IP and prevent situations when there are
+  # multiple attempts of logging in
+  def store_unauthenticated_sessions
+    return if current_user
+
+    Gitlab::AnonymousSession.new(request.remote_ip, session_id: request.session.id).store_session_id_per_ip
+  end
+
   # Handle an "initial setup" state, where there's only one user, it's an admin,
   # and they require a password change.
   # rubocop: disable CodeReuse/ActiveRecord
@@ -240,6 +266,18 @@ class SessionsController < Devise::SessionsController
     @ldap_servers ||= Gitlab::Auth::LDAP::Config.available_servers
   end
 
+  def unverified_anonymous_user?
+    exceeded_failed_login_attempts? || exceeded_anonymous_sessions?
+  end
+
+  def exceeded_failed_login_attempts?
+    session.fetch(:failed_login_attempts, 0) > MAX_FAILED_LOGIN_ATTEMPTS
+  end
+
+  def exceeded_anonymous_sessions?
+    Gitlab::AnonymousSession.new(request.remote_ip).stored_sessions >= MAX_FAILED_LOGIN_ATTEMPTS
+  end
+
   def authentication_method
     if user_params[:otp_attempt]
       "two-factor"
diff --git a/app/helpers/application_settings_helper.rb b/app/helpers/application_settings_helper.rb
index 3847a35fbab..f13d69d1c37 100644
--- a/app/helpers/application_settings_helper.rb
+++ b/app/helpers/application_settings_helper.rb
@@ -229,6 +229,7 @@ module ApplicationSettingsHelper
       :recaptcha_enabled,
       :recaptcha_private_key,
       :recaptcha_site_key,
+      :login_recaptcha_protection_enabled,
       :receive_max_input_size,
       :repository_checks_enabled,
       :repository_storages,
diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb
index a769a8f07fd..16e35c1be67 100644
--- a/app/models/application_setting.rb
+++ b/app/models/application_setting.rb
@@ -73,11 +73,11 @@ class ApplicationSetting < ApplicationRecord
 
   validates :recaptcha_site_key,
             presence: true,
-            if: :recaptcha_enabled
+            if: :recaptcha_or_login_protection_enabled
 
   validates :recaptcha_private_key,
             presence: true,
-            if: :recaptcha_enabled
+            if: :recaptcha_or_login_protection_enabled
 
   validates :akismet_api_key,
             presence: true,
@@ -285,4 +285,8 @@ class ApplicationSetting < ApplicationRecord
   def self.cache_backend
     Gitlab::ThreadMemoryCache.cache_backend
   end
+
+  def recaptcha_or_login_protection_enabled
+    recaptcha_enabled || login_recaptcha_protection_enabled
+  end
 end
diff --git a/app/models/application_setting_implementation.rb b/app/models/application_setting_implementation.rb
index 1e612bd0e78..b8e6156d231 100644
--- a/app/models/application_setting_implementation.rb
+++ b/app/models/application_setting_implementation.rb
@@ -63,6 +63,7 @@ module ApplicationSettingImplementation
         polling_interval_multiplier: 1,
         project_export_enabled: true,
         recaptcha_enabled: false,
+        login_recaptcha_protection_enabled: false,
         repository_checks_enabled: true,
         repository_storages: ['default'],
         require_two_factor_authentication: false,
diff --git a/app/views/admin/application_settings/_spam.html.haml b/app/views/admin/application_settings/_spam.html.haml
index d24e46b2815..f0a19075115 100644
--- a/app/views/admin/application_settings/_spam.html.haml
+++ b/app/views/admin/application_settings/_spam.html.haml
@@ -7,11 +7,15 @@
         = f.check_box :recaptcha_enabled, class: 'form-check-input'
         = f.label :recaptcha_enabled, class: 'form-check-label' do
           Enable reCAPTCHA
-        - recaptcha_v2_link_url = 'https://developers.google.com/recaptcha/docs/versions'
-        - recaptcha_v2_link_start = '<a href="%{url}" target="_blank" rel="noopener noreferrer">'.html_safe % { url: recaptcha_v2_link_url }
         %span.form-text.text-muted#recaptcha_help_block
-          = _('Helps prevent bots from creating accounts. We currently only support %{recaptcha_v2_link_start}reCAPTCHA v2%{recaptcha_v2_link_end}').html_safe % { recaptcha_v2_link_start: recaptcha_v2_link_start, recaptcha_v2_link_end: '</a>'.html_safe }
-
+          = _('Helps prevent bots from creating accounts.')
+    .form-group
+      .form-check
+        = f.check_box :login_recaptcha_protection_enabled, class: 'form-check-input'
+        = f.label :login_recaptcha_protection_enabled, class: 'form-check-label' do
+          Enable reCAPTCHA for login
+        %span.form-text.text-muted#recaptcha_help_block
+          = _('Helps prevent bots from brute-force attacks.')
     .form-group
       = f.label :recaptcha_site_key, 'reCAPTCHA Site Key', class: 'label-bold'
       = f.text_field :recaptcha_site_key, class: 'form-control'
@@ -21,6 +25,7 @@
 
     .form-group
       = f.label :recaptcha_private_key, 'reCAPTCHA Private Key', class: 'label-bold'
+    .form-group
       = f.text_field :recaptcha_private_key, class: 'form-control'
 
     .form-group
diff --git a/app/views/admin/application_settings/reporting.html.haml b/app/views/admin/application_settings/reporting.html.haml
index 46e3d1c4570..c60e44b3864 100644
--- a/app/views/admin/application_settings/reporting.html.haml
+++ b/app/views/admin/application_settings/reporting.html.haml
@@ -9,7 +9,9 @@
     %button.btn.btn-default.js-settings-toggle{ type: 'button' }
       = expanded_by_default? ? _('Collapse') : _('Expand')
     %p
-      = _('Enable reCAPTCHA or Akismet and set IP limits.')
+      - recaptcha_v2_link_url = 'https://developers.google.com/recaptcha/docs/versions'
+      - recaptcha_v2_link_start = '<a href="%{url}" target="_blank" rel="noopener noreferrer">'.html_safe % { url: recaptcha_v2_link_url }
+      = _('Enable reCAPTCHA or Akismet and set IP limits. For reCAPTCHA, we currently only support %{recaptcha_v2_link_start}v2%{recaptcha_v2_link_end}').html_safe % { recaptcha_v2_link_start: recaptcha_v2_link_start, recaptcha_v2_link_end: '</a>'.html_safe }
   .settings-content
     = render 'spam'
 
diff --git a/app/views/devise/sessions/_new_base.html.haml b/app/views/devise/sessions/_new_base.html.haml
index 2f10f08c839..6382849de9c 100644
--- a/app/views/devise/sessions/_new_base.html.haml
+++ b/app/views/devise/sessions/_new_base.html.haml
@@ -13,7 +13,7 @@
       .float-right.forgot-password
         = link_to "Forgot your password?", new_password_path(:user)
     %div
-    - if captcha_enabled?
+    - if captcha_enabled? || captcha_on_login_required?
       = recaptcha_tags
 
   .submit-container.move-submit-down
diff --git a/changelogs/unreleased/security-59549-add-capcha-for-failed-logins.yml b/changelogs/unreleased/security-59549-add-capcha-for-failed-logins.yml
new file mode 100644
index 00000000000..55f9e36c39c
--- /dev/null
+++ b/changelogs/unreleased/security-59549-add-capcha-for-failed-logins.yml
@@ -0,0 +1,5 @@
+---
+title: Add :login_recaptcha_protection_enabled setting to prevent bots from brute-force attacks.
+merge_request:
+author:
+type: security
diff --git a/config/initializers/warden.rb b/config/initializers/warden.rb
index 1d2bb2bce0a..d8a4da8cdf9 100644
--- a/config/initializers/warden.rb
+++ b/config/initializers/warden.rb
@@ -19,6 +19,7 @@ Rails.application.configure do |config|
 
   Warden::Manager.after_authentication(scope: :user) do |user, auth, opts|
     ActiveSession.cleanup(user)
+    Gitlab::AnonymousSession.new(auth.request.remote_ip, session_id: auth.request.session.id).cleanup_session_per_ip_entries
   end
 
   Warden::Manager.after_set_user(scope: :user, only: :fetch) do |user, auth, opts|
diff --git a/db/migrate/20190719122333_add_login_recaptcha_protection_enabled_to_application_settings.rb b/db/migrate/20190719122333_add_login_recaptcha_protection_enabled_to_application_settings.rb
new file mode 100644
index 00000000000..4561e1e8aa9
--- /dev/null
+++ b/db/migrate/20190719122333_add_login_recaptcha_protection_enabled_to_application_settings.rb
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class AddLoginRecaptchaProtectionEnabledToApplicationSettings < ActiveRecord::Migration[5.1]
+  DOWNTIME = false
+
+  def change
+    add_column :application_settings, :login_recaptcha_protection_enabled, :boolean, default: false, null: false
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 6f5fc6c65eb..8acc81c26ab 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -228,6 +228,7 @@ ActiveRecord::Schema.define(version: 2019_07_29_090456) do
     t.boolean "lock_memberships_to_ldap", default: false, null: false
     t.boolean "time_tracking_limit_to_hours", default: false, null: false
     t.string "grafana_url", default: "/-/grafana", null: false
+    t.boolean "login_recaptcha_protection_enabled", default: false, null: false
     t.string "outbound_local_requests_whitelist", limit: 255, default: [], null: false, array: true
     t.integer "raw_blob_request_limit", default: 300, null: false
     t.index ["custom_project_templates_group_id"], name: "index_application_settings_on_custom_project_templates_group_id"
diff --git a/lib/api/settings.rb b/lib/api/settings.rb
index aa9e879160d..5ac6f5bf61a 100644
--- a/lib/api/settings.rb
+++ b/lib/api/settings.rb
@@ -104,6 +104,11 @@ module API
         requires :recaptcha_site_key, type: String, desc: 'Generate site key at http://www.google.com/recaptcha'
         requires :recaptcha_private_key, type: String, desc: 'Generate private key at http://www.google.com/recaptcha'
       end
+      optional :login_recaptcha_protection_enabled, type: Boolean, desc: 'Helps prevent brute-force attacks'
+      given login_recaptcha_protection_enabled: ->(val) { val } do
+        requires :recaptcha_site_key, type: String, desc: 'Generate site key at http://www.google.com/recaptcha'
+        requires :recaptcha_private_key, type: String, desc: 'Generate private key at http://www.google.com/recaptcha'
+      end
       optional :repository_checks_enabled, type: Boolean, desc: "GitLab will periodically run 'git fsck' in all project and wiki repositories to look for silent disk corruption issues."
       optional :repository_storages, type: Array[String], desc: 'Storage paths for new projects'
       optional :require_two_factor_authentication, type: Boolean, desc: 'Require all users to set up Two-factor authentication'
diff --git a/lib/gitlab/anonymous_session.rb b/lib/gitlab/anonymous_session.rb
new file mode 100644
index 00000000000..148b6d3310d
--- /dev/null
+++ b/lib/gitlab/anonymous_session.rb
@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Gitlab
+  class AnonymousSession
+    def initialize(remote_ip, session_id: nil)
+      @remote_ip = remote_ip
+      @session_id = session_id
+    end
+
+    def store_session_id_per_ip
+      Gitlab::Redis::SharedState.with do |redis|
+        redis.pipelined do
+          redis.sadd(session_lookup_name, session_id)
+          redis.expire(session_lookup_name, 24.hours)
+        end
+      end
+    end
+
+    def stored_sessions
+      Gitlab::Redis::SharedState.with do |redis|
+        redis.scard(session_lookup_name)
+      end
+    end
+
+    def cleanup_session_per_ip_entries
+      Gitlab::Redis::SharedState.with do |redis|
+        redis.srem(session_lookup_name, session_id)
+      end
+    end
+
+    private
+
+    attr_reader :remote_ip, :session_id
+
+    def session_lookup_name
+      @session_lookup_name ||= "#{Gitlab::Redis::SharedState::IP_SESSIONS_LOOKUP_NAMESPACE}:#{remote_ip}"
+    end
+  end
+end
diff --git a/lib/gitlab/recaptcha.rb b/lib/gitlab/recaptcha.rb
index 772d743c9b0..f3cbe1db901 100644
--- a/lib/gitlab/recaptcha.rb
+++ b/lib/gitlab/recaptcha.rb
@@ -3,7 +3,7 @@
 module Gitlab
   module Recaptcha
     def self.load_configurations!
-      if Gitlab::CurrentSettings.recaptcha_enabled
+      if Gitlab::CurrentSettings.recaptcha_enabled || enabled_on_login?
         ::Recaptcha.configure do |config|
           config.site_key = Gitlab::CurrentSettings.recaptcha_site_key
           config.secret_key = Gitlab::CurrentSettings.recaptcha_private_key
@@ -16,5 +16,9 @@ module Gitlab
     def self.enabled?
       Gitlab::CurrentSettings.recaptcha_enabled
     end
+
+    def self.enabled_on_login?
+      Gitlab::CurrentSettings.login_recaptcha_protection_enabled
+    end
   end
 end
diff --git a/lib/gitlab/redis/shared_state.rb b/lib/gitlab/redis/shared_state.rb
index 9066606ca21..270a19e780c 100644
--- a/lib/gitlab/redis/shared_state.rb
+++ b/lib/gitlab/redis/shared_state.rb
@@ -9,6 +9,7 @@ module Gitlab
       SESSION_NAMESPACE = 'session:gitlab'.freeze
       USER_SESSIONS_NAMESPACE = 'session:user:gitlab'.freeze
       USER_SESSIONS_LOOKUP_NAMESPACE = 'session:lookup:user:gitlab'.freeze
+      IP_SESSIONS_LOOKUP_NAMESPACE = 'session:lookup:ip:gitlab'.freeze
       DEFAULT_REDIS_SHARED_STATE_URL = 'redis://localhost:6382'.freeze
       REDIS_SHARED_STATE_CONFIG_ENV_VAR_NAME = 'GITLAB_REDIS_SHARED_STATE_CONFIG_FILE'.freeze
 
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index feae99fb95a..e6fc76bd28d 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -4175,7 +4175,7 @@ msgstr ""
 msgid "Enable or disable version check and usage ping."
 msgstr ""
 
-msgid "Enable reCAPTCHA or Akismet and set IP limits."
+msgid "Enable reCAPTCHA or Akismet and set IP limits. For reCAPTCHA, we currently only support %{recaptcha_v2_link_start}v2%{recaptcha_v2_link_end}"
 msgstr ""
 
 msgid "Enable shared Runners"
@@ -5416,7 +5416,10 @@ msgstr ""
 msgid "Help page text and support page url."
 msgstr ""
 
-msgid "Helps prevent bots from creating accounts. We currently only support %{recaptcha_v2_link_start}reCAPTCHA v2%{recaptcha_v2_link_end}"
+msgid "Helps prevent bots from brute-force attacks."
+msgstr ""
+
+msgid "Helps prevent bots from creating accounts."
 msgstr ""
 
 msgid "Hide archived projects"
diff --git a/spec/controllers/sessions_controller_spec.rb b/spec/controllers/sessions_controller_spec.rb
index 9c4ddce5409..68b7bf61231 100644
--- a/spec/controllers/sessions_controller_spec.rb
+++ b/spec/controllers/sessions_controller_spec.rb
@@ -100,16 +100,8 @@ describe SessionsController do
         end
       end
 
-      context 'when reCAPTCHA is enabled' do
-        let(:user) { create(:user) }
-        let(:user_params) { { login: user.username, password: user.password } }
-
-        before do
-          stub_application_setting(recaptcha_enabled: true)
-          request.headers[described_class::CAPTCHA_HEADER] = 1
-        end
-
-        it 'displays an error when the reCAPTCHA is not solved' do
+      context 'with reCAPTCHA' do
+        def unsuccesful_login(user_params, sesion_params: {})
           # Without this, `verify_recaptcha` arbitrarily returns true in test env
           Recaptcha.configuration.skip_verify_env.delete('test')
           counter = double(:counter)
@@ -119,14 +111,10 @@ describe SessionsController do
                                       .with(:failed_login_captcha_total, anything)
                                       .and_return(counter)
 
-          post(:create, params: { user: user_params })
-
-          expect(response).to render_template(:new)
-          expect(flash[:alert]).to include 'There was an error with the reCAPTCHA. Please solve the reCAPTCHA again.'
-          expect(subject.current_user).to be_nil
+          post(:create, params: { user: user_params }, session: sesion_params)
         end
 
-        it 'successfully logs in a user when reCAPTCHA is solved' do
+        def succesful_login(user_params, sesion_params: {})
           # Avoid test ordering issue and ensure `verify_recaptcha` returns true
           Recaptcha.configuration.skip_verify_env << 'test'
           counter = double(:counter)
@@ -137,9 +125,80 @@ describe SessionsController do
                                       .and_return(counter)
           expect(Gitlab::Metrics).to receive(:counter).and_call_original
 
-          post(:create, params: { user: user_params })
+          post(:create, params: { user: user_params }, session: sesion_params)
+        end
 
-          expect(subject.current_user).to eq user
+        context 'when reCAPTCHA is enabled' do
+          let(:user) { create(:user) }
+          let(:user_params) { { login: user.username, password: user.password } }
+
+          before do
+            stub_application_setting(recaptcha_enabled: true)
+            request.headers[described_class::CAPTCHA_HEADER] = 1
+          end
+
+          it 'displays an error when the reCAPTCHA is not solved' do
+            # Without this, `verify_recaptcha` arbitrarily returns true in test env
+
+            unsuccesful_login(user_params)
+
+            expect(response).to render_template(:new)
+            expect(flash[:alert]).to include 'There was an error with the reCAPTCHA. Please solve the reCAPTCHA again.'
+            expect(subject.current_user).to be_nil
+          end
+
+          it 'successfully logs in a user when reCAPTCHA is solved' do
+            succesful_login(user_params)
+
+            expect(subject.current_user).to eq user
+          end
+        end
+
+        context 'when reCAPTCHA login protection is enabled' do
+          let(:user) { create(:user) }
+          let(:user_params) { { login: user.username, password: user.password } }
+
+          before do
+            stub_application_setting(login_recaptcha_protection_enabled: true)
+          end
+
+          context 'when user tried to login 5 times' do
+            it 'displays an error when the reCAPTCHA is not solved' do
+              unsuccesful_login(user_params, sesion_params: { failed_login_attempts: 6 })
+
+              expect(response).to render_template(:new)
+              expect(flash[:alert]).to include 'There was an error with the reCAPTCHA. Please solve the reCAPTCHA again.'
+              expect(subject.current_user).to be_nil
+            end
+
+            it 'successfully logs in a user when reCAPTCHA is solved' do
+              succesful_login(user_params, sesion_params: { failed_login_attempts: 6 })
+
+              expect(subject.current_user).to eq user
+            end
+          end
+
+          context 'when there are more than 5 anonymous session with the same IP' do
+            before do
+              allow(Gitlab::AnonymousSession).to receive_message_chain(:new, :stored_sessions).and_return(6)
+            end
+
+            it 'displays an error when the reCAPTCHA is not solved' do
+              unsuccesful_login(user_params)
+
+              expect(response).to render_template(:new)
+              expect(flash[:alert]).to include 'There was an error with the reCAPTCHA. Please solve the reCAPTCHA again.'
+              expect(subject.current_user).to be_nil
+            end
+
+            it 'successfully logs in a user when reCAPTCHA is solved' do
+              expect(Gitlab::AnonymousSession).to receive_message_chain(:new, :cleanup_session_per_ip_entries)
+
+              succesful_login(user_params)
+
+              expect(subject.current_user).to eq user
+            end
+          end
         end
       end
     end
@@ -348,4 +407,17 @@ describe SessionsController do
       expect(controller.stored_location_for(:redirect)).to eq(search_path)
     end
   end
+
+  context 'when login fails' do
+    before do
+      set_devise_mapping(context: @request)
+      @request.env["warden.options"] = { action:  'unauthenticated' }
+    end
+
+    it 'does increment failed login counts for session' do
+      get(:new, params: { user: { login: 'failed' } })
+
+      expect(session[:failed_login_attempts]).to eq(1)
+    end
+  end
 end
diff --git a/spec/features/admin/admin_settings_spec.rb b/spec/features/admin/admin_settings_spec.rb
index c77605f3869..4d3cf052744 100644
--- a/spec/features/admin/admin_settings_spec.rb
+++ b/spec/features/admin/admin_settings_spec.rb
@@ -263,6 +263,7 @@ describe 'Admin updates settings' do
 
       page.within('.as-spam') do
         check 'Enable reCAPTCHA'
+        check 'Enable reCAPTCHA for login'
         fill_in 'reCAPTCHA Site Key', with: 'key'
         fill_in 'reCAPTCHA Private Key', with: 'key'
         fill_in 'IPs per user', with: 15
@@ -271,6 +272,7 @@ describe 'Admin updates settings' do
 
       expect(page).to have_content "Application settings saved successfully"
       expect(current_settings.recaptcha_enabled).to be true
+      expect(current_settings.login_recaptcha_protection_enabled).to be true
       expect(current_settings.unique_ips_limit_per_user).to eq(15)
     end
   end
diff --git a/spec/lib/gitlab/anonymous_session_spec.rb b/spec/lib/gitlab/anonymous_session_spec.rb
new file mode 100644
index 00000000000..628aae81ada
--- /dev/null
+++ b/spec/lib/gitlab/anonymous_session_spec.rb
@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Gitlab::AnonymousSession, :clean_gitlab_redis_shared_state do
+  let(:default_session_id) { '6919a6f1bb119dd7396fadc38fd18d0d' }
+  let(:additional_session_id) { '7919a6f1bb119dd7396fadc38fd18d0d' }
+
+  subject { new_anonymous_session }
+
+  def new_anonymous_session(session_id = default_session_id)
+    described_class.new('127.0.0.1', session_id: session_id)
+  end
+
+  describe '#store_session_id_per_ip' do
+    it 'adds session id to proper key' do
+      subject.store_session_id_per_ip
+
+      Gitlab::Redis::SharedState.with do |redis|
+        expect(redis.smembers("session:lookup:ip:gitlab:127.0.0.1")).to eq [default_session_id]
+      end
+    end
+
+    it 'adds expiration time to key' do
+      Timecop.freeze do
+        subject.store_session_id_per_ip
+
+        Gitlab::Redis::SharedState.with do |redis|
+          expect(redis.ttl("session:lookup:ip:gitlab:127.0.0.1")).to eq(24.hours.to_i)
+        end
+      end
+    end
+
+    it 'adds id only once' do
+      subject.store_session_id_per_ip
+      subject.store_session_id_per_ip
+
+      Gitlab::Redis::SharedState.with do |redis|
+        expect(redis.smembers("session:lookup:ip:gitlab:127.0.0.1")).to eq [default_session_id]
+      end
+    end
+
+    context 'when there is already one session' do
+      it 'adds session id to proper key' do
+        subject.store_session_id_per_ip
+        new_anonymous_session(additional_session_id).store_session_id_per_ip
+
+        Gitlab::Redis::SharedState.with do |redis|
+          expect(redis.smembers("session:lookup:ip:gitlab:127.0.0.1")).to contain_exactly(default_session_id, additional_session_id)
+        end
+      end
+    end
+  end
+
+  describe '#stored_sessions' do
+    it 'returns all anonymous sessions per ip' do
+      Gitlab::Redis::SharedState.with do |redis|
+        redis.sadd("session:lookup:ip:gitlab:127.0.0.1", default_session_id)
+        redis.sadd("session:lookup:ip:gitlab:127.0.0.1", additional_session_id)
+      end
+
+      expect(subject.stored_sessions).to eq(2)
+    end
+  end
+
+  it 'removes obsolete lookup through ip entries' do
+    Gitlab::Redis::SharedState.with do |redis|
+      redis.sadd("session:lookup:ip:gitlab:127.0.0.1", default_session_id)
+      redis.sadd("session:lookup:ip:gitlab:127.0.0.1", additional_session_id)
+    end
+
+    subject.cleanup_session_per_ip_entries
+
+    Gitlab::Redis::SharedState.with do |redis|
+      expect(redis.smembers("session:lookup:ip:gitlab:127.0.0.1")).to eq [additional_session_id]
+    end
+  end
+end
diff --git a/spec/views/devise/shared/_signin_box.html.haml_spec.rb b/spec/views/devise/shared/_signin_box.html.haml_spec.rb
index 66c064e3fba..5d521d18c70 100644
--- a/spec/views/devise/shared/_signin_box.html.haml_spec.rb
+++ b/spec/views/devise/shared/_signin_box.html.haml_spec.rb
@@ -7,6 +7,7 @@ describe 'devise/shared/_signin_box' do
       assign(:ldap_servers, [])
       allow(view).to receive(:current_application_settings).and_return(Gitlab::CurrentSettings.current_application_settings)
       allow(view).to receive(:captcha_enabled?).and_return(false)
+      allow(view).to receive(:captcha_on_login_required?).and_return(false)
     end
 
     it 'is shown when Crowd is enabled' do
-- 
cgit v1.2.1


From 6391eeec3078f97fac6f6ef92ca0d8c8f0068667 Mon Sep 17 00:00:00 2001
From: "David H. Wilkins" <dwilkins@conecuh.com>
Date: Fri, 2 Aug 2019 18:18:09 -0500
Subject: git-user-related local test failures

Some of the tests fail locally due to the git user being different
than it is on the test runners.   I'd really like to be able to run
all of the tests locally.
---
 spec/helpers/projects_helper_spec.rb  | 2 +-
 spec/lib/gitlab/middleware/go_spec.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/spec/helpers/projects_helper_spec.rb b/spec/helpers/projects_helper_spec.rb
index 3716879c458..d4cf15ad5f8 100644
--- a/spec/helpers/projects_helper_spec.rb
+++ b/spec/helpers/projects_helper_spec.rb
@@ -478,7 +478,7 @@ describe ProjectsHelper do
     it 'returns the command to push to create project over SSH' do
       allow(Gitlab::CurrentSettings.current_application_settings).to receive(:enabled_git_access_protocol) { 'ssh' }
 
-      expect(helper.push_to_create_project_command(user)).to eq('git push --set-upstream git@localhost:john/$(git rev-parse --show-toplevel | xargs basename).git $(git rev-parse --abbrev-ref HEAD)')
+      expect(helper.push_to_create_project_command(user)).to eq("git push --set-upstream #{Gitlab.config.gitlab.user}@localhost:john/$(git rev-parse --show-toplevel | xargs basename).git $(git rev-parse --abbrev-ref HEAD)")
     end
   end
 
diff --git a/spec/lib/gitlab/middleware/go_spec.rb b/spec/lib/gitlab/middleware/go_spec.rb
index f52095bf633..16595102375 100644
--- a/spec/lib/gitlab/middleware/go_spec.rb
+++ b/spec/lib/gitlab/middleware/go_spec.rb
@@ -202,7 +202,7 @@ describe Gitlab::Middleware::Go do
     def expect_response_with_path(response, protocol, path)
       repository_url = case protocol
                        when :ssh
-                         "ssh://git@#{Gitlab.config.gitlab.host}/#{path}.git"
+                         "ssh://#{Gitlab.config.gitlab.user}@#{Gitlab.config.gitlab.host}/#{path}.git"
                        when :http, nil
                          "http://#{Gitlab.config.gitlab.host}/#{path}.git"
                        end
-- 
cgit v1.2.1


From 927f608f2c4905e430d2df1c455cec793ef41aa9 Mon Sep 17 00:00:00 2001
From: Patrick Derichs <pderichs@gitlab.com>
Date: Mon, 15 Jul 2019 13:29:56 +0200
Subject: Fix HTML injection for label description

Add changelog entry

Add spec
---
 app/helpers/labels_helper.rb                                   |  2 +-
 app/models/label.rb                                            |  8 ++++++--
 ...rity-fix-html-injection-for-label-description-ce-master.yml |  5 +++++
 spec/helpers/labels_helper_spec.rb                             | 10 ++++++++++
 spec/models/label_spec.rb                                      |  7 +++++++
 5 files changed, 29 insertions(+), 3 deletions(-)
 create mode 100644 changelogs/unreleased/security-fix-html-injection-for-label-description-ce-master.yml

diff --git a/app/helpers/labels_helper.rb b/app/helpers/labels_helper.rb
index 2ed016beea4..c5a3507637e 100644
--- a/app/helpers/labels_helper.rb
+++ b/app/helpers/labels_helper.rb
@@ -71,7 +71,7 @@ module LabelsHelper
   end
 
   def label_tooltip_title(label)
-    label.description
+    Sanitize.clean(label.description)
   end
 
   def suggested_colors
diff --git a/app/models/label.rb b/app/models/label.rb
index 25de26b8384..19f684c32af 100644
--- a/app/models/label.rb
+++ b/app/models/label.rb
@@ -197,7 +197,11 @@ class Label < ApplicationRecord
   end
 
   def title=(value)
-    write_attribute(:title, sanitize_title(value)) if value.present?
+    write_attribute(:title, sanitize_value(value)) if value.present?
+  end
+
+  def description=(value)
+    write_attribute(:description, sanitize_value(value)) if value.present?
   end
 
   ##
@@ -258,7 +262,7 @@ class Label < ApplicationRecord
     end
   end
 
-  def sanitize_title(value)
+  def sanitize_value(value)
     CGI.unescapeHTML(Sanitize.clean(value.to_s))
   end
 
diff --git a/changelogs/unreleased/security-fix-html-injection-for-label-description-ce-master.yml b/changelogs/unreleased/security-fix-html-injection-for-label-description-ce-master.yml
new file mode 100644
index 00000000000..07124ac399b
--- /dev/null
+++ b/changelogs/unreleased/security-fix-html-injection-for-label-description-ce-master.yml
@@ -0,0 +1,5 @@
+---
+title: Fix HTML injection for label description
+merge_request:
+author:
+type: security
diff --git a/spec/helpers/labels_helper_spec.rb b/spec/helpers/labels_helper_spec.rb
index 4f1cab38f34..1d57aaa0da5 100644
--- a/spec/helpers/labels_helper_spec.rb
+++ b/spec/helpers/labels_helper_spec.rb
@@ -278,4 +278,14 @@ describe LabelsHelper do
       it { is_expected.to eq('Subscribe at group level') }
     end
   end
+
+  describe '#label_tooltip_title' do
+    let(:html) { '<img src="example.png">This is an image</img>' }
+    let(:label_with_html_content) { create(:label, title: 'test', description: html) }
+
+    it 'removes HTML' do
+      tooltip = label_tooltip_title(label_with_html_content)
+      expect(tooltip).to eq('This is an image')
+    end
+  end
 end
diff --git a/spec/models/label_spec.rb b/spec/models/label_spec.rb
index c2e2298823e..baf2cfeab0c 100644
--- a/spec/models/label_spec.rb
+++ b/spec/models/label_spec.rb
@@ -84,6 +84,13 @@ describe Label do
     end
   end
 
+  describe '#description' do
+    it 'sanitizes description' do
+      label = described_class.new(description: '<b>foo & bar?</b>')
+      expect(label.description).to eq('foo & bar?')
+    end
+  end
+
   describe 'priorization' do
     subject(:label) { create(:label) }
 
-- 
cgit v1.2.1


From 20e8c92410d93c39f4a800941d0c633f949e7790 Mon Sep 17 00:00:00 2001
From: Martin Hanzel <arthanzel@gmail.com>
Date: Wed, 24 Jul 2019 14:19:25 +0200
Subject: Enforce max chars and max render time in markdown math

KaTeX math will now render progressivly and asynchronously. There
are upper limits on the character count of each formula, and on
cumulative render time.
---
 .../javascripts/behaviors/markdown/render_math.js  | 146 ++++++++++++++++++---
 .../unreleased/security-katex-dos-master.yml       |   5 +
 locale/gitlab.pot                                  |   9 +-
 spec/features/markdown/math_spec.rb                |   6 +-
 4 files changed, 143 insertions(+), 23 deletions(-)
 create mode 100644 changelogs/unreleased/security-katex-dos-master.yml

diff --git a/app/assets/javascripts/behaviors/markdown/render_math.js b/app/assets/javascripts/behaviors/markdown/render_math.js
index a68936d79e2..53867b3096b 100644
--- a/app/assets/javascripts/behaviors/markdown/render_math.js
+++ b/app/assets/javascripts/behaviors/markdown/render_math.js
@@ -1,6 +1,5 @@
-import $ from 'jquery';
-import { __ } from '~/locale';
 import flash from '~/flash';
+import { s__, sprintf } from '~/locale';
 
 // Renders math using KaTeX in any element with the
 // `js-render-math` class
@@ -10,21 +9,131 @@ import flash from '~/flash';
 //   <code class="js-render-math"></div>
 //
 
-// Loop over all math elements and render math
-function renderWithKaTeX(elements, katex) {
-  elements.each(function katexElementsLoop() {
-    const mathNode = $('<span></span>');
-    const $this = $(this);
-
-    const display = $this.attr('data-math-style') === 'display';
-    try {
-      katex.render($this.text(), mathNode.get(0), { displayMode: display, throwOnError: false });
-      mathNode.insertAfter($this);
-      $this.remove();
-    } catch (err) {
-      throw err;
+const MAX_MATH_CHARS = 1000;
+const MAX_RENDER_TIME_MS = 2000;
+
+// These messages might be used with inline errors in the future. Keep them around. For now, we will
+// display a single error message using flash().
+
+// const CHAR_LIMIT_EXCEEDED_MSG = sprintf(
+//   s__(
+//     'math|The following math is too long. For performance reasons, math blocks are limited to %{maxChars} characters. Try splitting up this block, or include an image instead.',
+//   ),
+//   { maxChars: MAX_MATH_CHARS },
+// );
+// const RENDER_TIME_EXCEEDED_MSG = s__(
+//   "math|The math in this entry is taking too long to render. Any math below this point won't be shown. Consider splitting it among multiple entries.",
+// );
+
+const RENDER_FLASH_MSG = sprintf(
+  s__(
+    'math|The math in this entry is taking too long to render and may not be displayed as expected. For performance reasons, math blocks are also limited to %{maxChars} characters. Consider splitting up large formulae, splitting math blocks among multiple entries, or using an image instead.',
+  ),
+  { maxChars: MAX_MATH_CHARS },
+);
+
+// Wait for the browser to reflow the layout. Reflowing SVG takes time.
+// This has to wrap the inner function, otherwise IE/Edge throw "invalid calling object".
+const waitForReflow = fn => {
+  window.requestAnimationFrame(fn);
+};
+
+/**
+ * Renders math blocks sequentially while protecting against DoS attacks. Math blocks have a maximum character limit of MAX_MATH_CHARS. If rendering math takes longer than MAX_RENDER_TIME_MS, all subsequent math blocks are skipped and an error message is shown.
+ */
+class SafeMathRenderer {
+  /*
+  How this works:
+
+  The performance bottleneck in rendering math is in the browser trying to reflow the generated SVG.
+  During this time, the JS is blocked and the page becomes unresponsive.
+  We want to render math blocks one by one until a certain time is exceeded, after which we stop
+  rendering subsequent math blocks, to protect against DoS. However, browsers do reflowing in an
+  asynchronous task, so we can't time it synchronously.
+
+  SafeMathRenderer essentially does the following:
+  1. Replaces all math blocks with placeholders so that they're not mistakenly rendered twice.
+  2. Places each placeholder element in a queue.
+  3. Renders the element at the head of the queue and waits for reflow.
+  4. After reflow, gets the elapsed time since step 3 and repeats step 3 until the queue is empty.
+   */
+  queue = [];
+  totalMS = 0;
+
+  constructor(elements, katex) {
+    this.elements = elements;
+    this.katex = katex;
+
+    this.renderElement = this.renderElement.bind(this);
+    this.render = this.render.bind(this);
+  }
+
+  renderElement() {
+    if (!this.queue.length) {
+      return;
     }
-  });
+
+    const el = this.queue.shift();
+    const text = el.textContent;
+
+    el.removeAttribute('style');
+
+    if (this.totalMS >= MAX_RENDER_TIME_MS || text.length > MAX_MATH_CHARS) {
+      if (!this.flashShown) {
+        flash(RENDER_FLASH_MSG);
+        this.flashShown = true;
+      }
+
+      // Show unrendered math code
+      const codeElement = document.createElement('pre');
+      codeElement.className = 'code';
+      codeElement.textContent = el.textContent;
+      el.parentNode.replaceChild(codeElement, el);
+
+      // Render the next math
+      this.renderElement();
+    } else {
+      this.startTime = Date.now();
+
+      try {
+        el.innerHTML = this.katex.renderToString(text, {
+          displayMode: el.getAttribute('data-math-style') === 'display',
+          throwOnError: true,
+          maxSize: 20,
+          maxExpand: 20,
+        });
+      } catch {
+        // Don't show a flash for now because it would override an existing flash message
+        el.textContent = s__('math|There was an error rendering this math block');
+        // el.style.color = '#d00';
+        el.className = 'katex-error';
+      }
+
+      // Give the browser time to reflow the svg
+      waitForReflow(() => {
+        const deltaTime = Date.now() - this.startTime;
+        this.totalMS += deltaTime;
+
+        this.renderElement();
+      });
+    }
+  }
+
+  render() {
+    // Replace math blocks with a placeholder so they aren't rendered twice
+    this.elements.forEach(el => {
+      const placeholder = document.createElement('span');
+      placeholder.style.display = 'none';
+      placeholder.setAttribute('data-math-style', el.getAttribute('data-math-style'));
+      placeholder.textContent = el.textContent;
+      el.parentNode.replaceChild(placeholder, el);
+      this.queue.push(placeholder);
+    });
+
+    // If we wait for the browser thread to settle down a bit, math rendering becomes 5-10x faster
+    // and less prone to timeouts.
+    setTimeout(this.renderElement, 400);
+  }
 }
 
 export default function renderMath($els) {
@@ -34,7 +143,8 @@ export default function renderMath($els) {
     import(/* webpackChunkName: 'katex' */ 'katex/dist/katex.min.css'),
   ])
     .then(([katex]) => {
-      renderWithKaTeX($els, katex);
+      const renderer = new SafeMathRenderer($els.get(), katex);
+      renderer.render();
     })
-    .catch(() => flash(__('An error occurred while rendering KaTeX')));
+    .catch(() => {});
 }
diff --git a/changelogs/unreleased/security-katex-dos-master.yml b/changelogs/unreleased/security-katex-dos-master.yml
new file mode 100644
index 00000000000..df803a5eafd
--- /dev/null
+++ b/changelogs/unreleased/security-katex-dos-master.yml
@@ -0,0 +1,5 @@
+---
+title: Enforce max chars and max render time in markdown math
+merge_request:
+author:
+type: security
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 8cf70014256..8ecd7ccd045 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -1083,9 +1083,6 @@ msgstr ""
 msgid "An error occurred while parsing recent searches"
 msgstr ""
 
-msgid "An error occurred while rendering KaTeX"
-msgstr ""
-
 msgid "An error occurred while rendering preview broadcast message"
 msgstr ""
 
@@ -13272,6 +13269,12 @@ msgstr ""
 msgid "manual"
 msgstr ""
 
+msgid "math|The math in this entry is taking too long to render and may not be displayed as expected. For performance reasons, math blocks are also limited to %{maxChars} characters. Consider splitting up large formulae, splitting math blocks among multiple entries, or using an image instead."
+msgstr ""
+
+msgid "math|There was an error rendering this math block"
+msgstr ""
+
 msgid "merge request"
 msgid_plural "merge requests"
 msgstr[0] ""
diff --git a/spec/features/markdown/math_spec.rb b/spec/features/markdown/math_spec.rb
index 68d99b4241a..76eef66c517 100644
--- a/spec/features/markdown/math_spec.rb
+++ b/spec/features/markdown/math_spec.rb
@@ -34,7 +34,9 @@ describe 'Math rendering', :js do
 
     visit project_issue_path(project, issue)
 
-    expect(page).to have_selector('.katex-error', text: "\href{javascript:alert('xss');}{xss}")
-    expect(page).to have_selector('.katex-html a', text: 'Gitlab')
+    page.within '.description > .md' do
+      expect(page).to have_selector('.katex-error')
+      expect(page).to have_selector('.katex-html a', text: 'Gitlab')
+    end
   end
 end
-- 
cgit v1.2.1


From d30a90a354f3dc015093d80f9de9dc15b38ff2a0 Mon Sep 17 00:00:00 2001
From: Alex Kalderimis <alex.kalderimis@gmail.com>
Date: Tue, 4 Jun 2019 23:30:54 -0400
Subject: Prevent unauthorised comments on merge requests

* Prevent creating notes on inaccessible MRs

This applies the notes rules at the MR scope. Rather than adding extra
rules to the Project level policy, preventing :create_note here is
better since it only prevents creating notes on MRs.

* Prevent creating notes in inaccessible Issues

without this policy, non-team-members are allowed to comment on issues
even when the project has the private-issues policy set. This means that
without this change, users are allowed to comment on issues that they
cannot read.

* Add CHANGELOG entry
---
 app/policies/issue_policy.rb                       |   9 +-
 app/policies/merge_request_policy.rb               |   6 +
 .../ce-60465-prevent-comments-on-private-mrs.yml   |   3 +
 spec/controllers/projects/notes_controller_spec.rb | 311 ++++++++++++++++-----
 spec/policies/issue_policy_spec.rb                 |  28 ++
 spec/policies/merge_request_policy_spec.rb         |  89 ++++++
 6 files changed, 371 insertions(+), 75 deletions(-)
 create mode 100644 changelogs/unreleased/ce-60465-prevent-comments-on-private-mrs.yml

diff --git a/app/policies/issue_policy.rb b/app/policies/issue_policy.rb
index dd8c5d49cf4..fa252af55e4 100644
--- a/app/policies/issue_policy.rb
+++ b/app/policies/issue_policy.rb
@@ -5,6 +5,8 @@ class IssuePolicy < IssuablePolicy
   # Make sure to sync this class checks with issue.rb to avoid security problems.
   # Check commit 002ad215818450d2cbbc5fa065850a953dc7ada8 for more information.
 
+  extend ProjectPolicy::ClassMethods
+
   desc "User can read confidential issues"
   condition(:can_read_confidential) do
     @user && IssueCollection.new([@subject]).visible_to(@user).any?
@@ -14,13 +16,12 @@ class IssuePolicy < IssuablePolicy
   condition(:confidential, scope: :subject) { @subject.confidential? }
 
   rule { confidential & ~can_read_confidential }.policy do
-    prevent :read_issue
+    prevent(*create_read_update_admin_destroy(:issue))
     prevent :read_issue_iid
-    prevent :update_issue
-    prevent :admin_issue
-    prevent :create_note
   end
 
+  rule { ~can?(:read_issue) }.prevent :create_note
+
   rule { locked }.policy do
     prevent :reopen_issue
   end
diff --git a/app/policies/merge_request_policy.rb b/app/policies/merge_request_policy.rb
index a3692857ff4..5ad7bdabdff 100644
--- a/app/policies/merge_request_policy.rb
+++ b/app/policies/merge_request_policy.rb
@@ -4,4 +4,10 @@ class MergeRequestPolicy < IssuablePolicy
   rule { locked }.policy do
     prevent :reopen_merge_request
   end
+
+  # Only users who can read the merge request can comment.
+  # Although :read_merge_request is computed in the policy context,
+  # it would not be safe to prevent :create_note there, since
+  # note permissions are shared, and this would apply too broadly.
+  rule { ~can?(:read_merge_request) }.prevent :create_note
 end
diff --git a/changelogs/unreleased/ce-60465-prevent-comments-on-private-mrs.yml b/changelogs/unreleased/ce-60465-prevent-comments-on-private-mrs.yml
new file mode 100644
index 00000000000..ba970162447
--- /dev/null
+++ b/changelogs/unreleased/ce-60465-prevent-comments-on-private-mrs.yml
@@ -0,0 +1,3 @@
+---
+title: Ensure only authorised users can create notes on Merge Requests and Issues
+type: security
diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb
index 9ab565dc2e8..99808dce016 100644
--- a/spec/controllers/projects/notes_controller_spec.rb
+++ b/spec/controllers/projects/notes_controller_spec.rb
@@ -212,40 +212,232 @@ describe Projects::NotesController do
   describe 'POST create' do
     let(:merge_request) { create(:merge_request) }
     let(:project) { merge_request.source_project }
+    let(:note_text) { 'some note' }
     let(:request_params) do
       {
-        note: { note: 'some note', noteable_id: merge_request.id, noteable_type: 'MergeRequest' },
+        note: { note: note_text, noteable_id: merge_request.id, noteable_type: 'MergeRequest' },
         namespace_id: project.namespace,
         project_id: project,
         merge_request_diff_head_sha: 'sha',
         target_type: 'merge_request',
         target_id: merge_request.id
-      }
+      }.merge(extra_request_params)
+    end
+    let(:extra_request_params) { {} }
+
+    let(:project_visibility) { Gitlab::VisibilityLevel::PUBLIC }
+    let(:merge_requests_access_level) { ProjectFeature::ENABLED }
+
+    def create!
+      post :create, params: request_params
     end
 
     before do
+      project.update_attribute(:visibility_level, project_visibility)
+      project.project_feature.update(merge_requests_access_level: merge_requests_access_level)
       sign_in(user)
-      project.add_developer(user)
     end
 
-    it "returns status 302 for html" do
-      post :create, params: request_params
+    describe 'making the creation request' do
+      before do
+        create!
+      end
+
+      context 'the project is publically available' do
+        context 'for HTML' do
+          it "returns status 302" do
+            expect(response).to have_gitlab_http_status(302)
+          end
+        end
+
+        context 'for JSON' do
+          let(:extra_request_params) { { format: :json } }
+
+          it "returns status 200 for json" do
+            expect(response).to have_gitlab_http_status(200)
+          end
+        end
+      end
 
-      expect(response).to have_gitlab_http_status(302)
+      context 'the project is a private project' do
+        let(:project_visibility) { Gitlab::VisibilityLevel::PRIVATE }
+
+        [{}, { format: :json }].each do |extra|
+          context "format is #{extra[:format]}" do
+            let(:extra_request_params) { extra }
+
+            it "returns status 404" do
+              expect(response).to have_gitlab_http_status(404)
+            end
+          end
+        end
+      end
     end
 
-    it "returns status 200 for json" do
-      post :create, params: request_params.merge(format: :json)
+    context 'the user is a developer on a private project' do
+      let(:project_visibility) { Gitlab::VisibilityLevel::PRIVATE }
 
-      expect(response).to have_gitlab_http_status(200)
+      before do
+        project.add_developer(user)
+      end
+
+      context 'HTML requests' do
+        it "returns status 302 (redirect)" do
+          create!
+
+          expect(response).to have_gitlab_http_status(302)
+        end
+      end
+
+      context 'JSON requests' do
+        let(:extra_request_params) { { format: :json } }
+
+        it "returns status 200" do
+          create!
+
+          expect(response).to have_gitlab_http_status(200)
+        end
+      end
+
+      context 'the return_discussion param is set' do
+        let(:extra_request_params) { { format: :json, return_discussion: 'true' } }
+
+        it 'returns discussion JSON when the return_discussion param is set' do
+          create!
+
+          expect(response).to have_gitlab_http_status(200)
+          expect(json_response).to have_key 'discussion'
+          expect(json_response.dig('discussion', 'notes', 0, 'note')).to eq(request_params[:note][:note])
+        end
+      end
+
+      context 'when creating a note with quick actions' do
+        context 'with commands that return changes' do
+          let(:note_text) { "/award :thumbsup:\n/estimate 1d\n/spend 3h" }
+          let(:extra_request_params) { { format: :json } }
+
+          it 'includes changes in commands_changes ' do
+            create!
+
+            expect(response).to have_gitlab_http_status(200)
+            expect(json_response['commands_changes']).to include('emoji_award', 'time_estimate', 'spend_time')
+            expect(json_response['commands_changes']).not_to include('target_project', 'title')
+          end
+        end
+
+        context 'with commands that do not return changes' do
+          let(:issue) { create(:issue, project: project) }
+          let(:other_project) { create(:project) }
+          let(:note_text) { "/move #{other_project.full_path}\n/title AAA" }
+          let(:extra_request_params) { { format: :json, target_id: issue.id, target_type: 'issue' } }
+
+          before do
+            other_project.add_developer(user)
+          end
+
+          it 'does not include changes in commands_changes' do
+            create!
+
+            expect(response).to have_gitlab_http_status(200)
+            expect(json_response['commands_changes']).not_to include('target_project', 'title')
+          end
+        end
+      end
     end
 
-    it 'returns discussion JSON when the return_discussion param is set' do
-      post :create, params: request_params.merge(format: :json, return_discussion: 'true')
+    context 'when the internal project prohibits non-members from accessing merge requests' do
+      let(:project_visibility) { Gitlab::VisibilityLevel::INTERNAL }
+      let(:merge_requests_access_level) { ProjectFeature::PRIVATE }
 
-      expect(response).to have_gitlab_http_status(200)
-      expect(json_response).to have_key 'discussion'
-      expect(json_response['discussion']['notes'][0]['note']).to eq(request_params[:note][:note])
+      it "prevents a non-member user from creating a note on one of the project's merge requests" do
+        create!
+
+        expect(response).to have_gitlab_http_status(404)
+      end
+
+      context 'when the user is a team member' do
+        before do
+          project.add_developer(user)
+        end
+
+        it 'can add comments' do
+          expect { create! }.to change { project.notes.count }.by(1)
+        end
+      end
+
+      # Illustration of the attack vector for posting comments to discussions that should
+      # be inaccessible.
+      #
+      # This relies on posting a note to a commit that is not necessarily even in the
+      # merge request, with a value of :in_reply_to_discussion_id that points to a
+      # discussion on a merge_request that should not be accessible.
+      context 'when the request includes a :in_reply_to_discussion_id designed to fool us' do
+        let(:commit) { create(:commit, project: project) }
+
+        let(:existing_comment) do
+          create(:note_on_commit,
+                 note: 'first',
+                 project: project,
+                 commit_id: merge_request.commit_shas.first)
+        end
+
+        let(:discussion) { existing_comment.discussion }
+
+        # see !60465 for details of the structure of this request
+        let(:request_params) do
+          { "utf8" => "✓",
+            "authenticity_token" => "1",
+            "view" => "inline",
+            "line_type" => "",
+            "merge_request_diff_head_sha" => "",
+            "in_reply_to_discussion_id" => discussion.id,
+            "note_project_id" => project.id,
+            "project_id" => project.id,
+            "namespace_id" => project.namespace,
+            "target_type" => "commit",
+            "target_id" => commit.id,
+            "note" => {
+              "noteable_type" => "",
+              "noteable_id" => "",
+              "commit_id" => "",
+              "type" => "",
+              "line_code" => "",
+              "position" => "",
+              "note" => "ThisReplyWillGoToMergeRequest"
+            } }
+        end
+
+        it 'prevents the request from adding notes to the spoofed discussion' do
+          expect { create! }.not_to change { discussion.notes.count }
+        end
+
+        it 'returns an error to the user' do
+          create!
+          expect(response).to have_gitlab_http_status(404)
+        end
+      end
+    end
+
+    context 'when the public project prohibits non-members from accessing merge requests' do
+      let(:project_visibility) { Gitlab::VisibilityLevel::PUBLIC }
+      let(:merge_requests_access_level) { ProjectFeature::PRIVATE }
+
+      it "prevents a non-member user from creating a note on one of the project's merge requests" do
+        create!
+
+        expect(response).to have_gitlab_http_status(404)
+      end
+
+      context 'when the user is a team member' do
+        before do
+          project.add_developer(user)
+          create!
+        end
+
+        it 'can add comments' do
+          expect(response).to be_redirect
+        end
+      end
     end
 
     context 'when merge_request_diff_head_sha present' do
@@ -262,7 +454,7 @@ describe Projects::NotesController do
       end
 
       it "returns status 302 for html" do
-        post :create, params: request_params
+        create!
 
         expect(response).to have_gitlab_http_status(302)
       end
@@ -285,7 +477,7 @@ describe Projects::NotesController do
     end
 
     context 'when creating a commit comment from an MR fork' do
-      let(:project) { create(:project, :repository) }
+      let(:project) { create(:project, :repository, :public) }
 
       let(:forked_project) do
         fork_project(project, nil, repository: true)
@@ -299,45 +491,59 @@ describe Projects::NotesController do
         create(:note_on_commit, note: 'a note', project: forked_project, commit_id: merge_request.commit_shas.first)
       end
 
-      def post_create(extra_params = {})
-        post :create, params: {
+      let(:note_project_id) do
+        forked_project.id
+      end
+
+      let(:request_params) do
+        {
           note: { note: 'some other note', noteable_id: merge_request.id },
           namespace_id: project.namespace,
           project_id: project,
           target_type: 'merge_request',
           target_id: merge_request.id,
-          note_project_id: forked_project.id,
+          note_project_id: note_project_id,
           in_reply_to_discussion_id: existing_comment.discussion_id
-        }.merge(extra_params)
+        }
+      end
+
+      let(:fork_visibility) { Gitlab::VisibilityLevel::PUBLIC }
+
+      before do
+        forked_project.update_attribute(:visibility_level, fork_visibility)
       end
 
       context 'when the note_project_id is not correct' do
-        it 'returns a 404' do
-          post_create(note_project_id: Project.maximum(:id).succ)
+        let(:note_project_id) do
+          project.id && Project.maximum(:id).succ
+        end
 
+        it 'returns a 404' do
+          create!
           expect(response).to have_gitlab_http_status(404)
         end
       end
 
       context 'when the user has no access to the fork' do
-        it 'returns a 404' do
-          post_create
+        let(:fork_visibility) { Gitlab::VisibilityLevel::PRIVATE }
 
+        it 'returns a 404' do
+          create!
           expect(response).to have_gitlab_http_status(404)
         end
       end
 
       context 'when the user has access to the fork' do
-        let(:discussion) { forked_project.notes.find_discussion(existing_comment.discussion_id) }
+        let!(:discussion) { forked_project.notes.find_discussion(existing_comment.discussion_id) }
+        let(:fork_visibility) { Gitlab::VisibilityLevel::PUBLIC }
 
-        before do
-          forked_project.add_developer(user)
-
-          existing_comment
+        it 'is successful' do
+          create!
+          expect(response).to have_gitlab_http_status(302)
         end
 
         it 'creates the note' do
-          expect { post_create }.to change { forked_project.notes.count }.by(1)
+          expect { create! }.to change { forked_project.notes.count }.by(1)
         end
       end
     end
@@ -346,11 +552,6 @@ describe Projects::NotesController do
       let(:locked_issue) { create(:issue, :locked, project: project) }
       let(:issue) {create(:issue, project: project)}
 
-      before do
-        project.update_attribute(:visibility_level, Gitlab::VisibilityLevel::PUBLIC)
-        project.project_member(user).destroy
-      end
-
       it 'uses target_id and ignores noteable_id' do
         request_params = {
           note: { note: 'some note', noteable_type: 'Issue', noteable_id: locked_issue.id },
@@ -368,7 +569,6 @@ describe Projects::NotesController do
 
     context 'when the merge request discussion is locked' do
       before do
-        project.update_attribute(:visibility_level, Gitlab::VisibilityLevel::PUBLIC)
         merge_request.update_attribute(:discussion_locked, true)
       end
 
@@ -382,6 +582,10 @@ describe Projects::NotesController do
       end
 
       context 'when a user is a team member' do
+        before do
+          project.add_developer(user)
+        end
+
         it 'returns 302 status for html' do
           post :create, params: request_params
 
@@ -400,10 +604,6 @@ describe Projects::NotesController do
       end
 
       context 'when a user is not a team member' do
-        before do
-          project.project_member(user).destroy
-        end
-
         it 'returns 404 status' do
           post :create, params: request_params
 
@@ -415,37 +615,6 @@ describe Projects::NotesController do
         end
       end
     end
-
-    context 'when creating a note with quick actions' do
-      context 'with commands that return changes' do
-        let(:note_text) { "/award :thumbsup:\n/estimate 1d\n/spend 3h" }
-
-        it 'includes changes in commands_changes ' do
-          post :create, params: request_params.merge(note: { note: note_text }, format: :json)
-
-          expect(response).to have_gitlab_http_status(200)
-          expect(json_response['commands_changes']).to include('emoji_award', 'time_estimate', 'spend_time')
-          expect(json_response['commands_changes']).not_to include('target_project', 'title')
-        end
-      end
-
-      context 'with commands that do not return changes' do
-        let(:issue) { create(:issue, project: project) }
-        let(:other_project) { create(:project) }
-        let(:note_text) { "/move #{other_project.full_path}\n/title AAA" }
-
-        before do
-          other_project.add_developer(user)
-        end
-
-        it 'does not include changes in commands_changes' do
-          post :create, params: request_params.merge(note: { note: note_text }, target_type: 'issue', target_id: issue.id, format: :json)
-
-          expect(response).to have_gitlab_http_status(200)
-          expect(json_response['commands_changes']).not_to include('target_project', 'title')
-        end
-      end
-    end
   end
 
   describe 'PUT update' do
diff --git a/spec/policies/issue_policy_spec.rb b/spec/policies/issue_policy_spec.rb
index b149dbcf871..25267d36ab8 100644
--- a/spec/policies/issue_policy_spec.rb
+++ b/spec/policies/issue_policy_spec.rb
@@ -172,6 +172,34 @@ describe IssuePolicy do
       expect(permissions(assignee, issue_locked)).to be_disallowed(:admin_issue, :reopen_issue)
     end
 
+    context 'when issues are private' do
+      before do
+        project.project_feature.update(issues_access_level: ProjectFeature::PRIVATE)
+      end
+      let(:issue) { create(:issue, project: project, author: author) }
+      let(:visitor) { create(:user) }
+      let(:admin) { create(:user, :admin) }
+
+      it 'forbids visitors from viewing issues' do
+        expect(permissions(visitor, issue)).to be_disallowed(:read_issue)
+      end
+      it 'forbids visitors from commenting' do
+        expect(permissions(visitor, issue)).to be_disallowed(:create_note)
+      end
+      it 'allows guests to view' do
+        expect(permissions(guest, issue)).to be_allowed(:read_issue)
+      end
+      it 'allows guests to comment' do
+        expect(permissions(guest, issue)).to be_allowed(:create_note)
+      end
+      it 'allows admins to view' do
+        expect(permissions(admin, issue)).to be_allowed(:read_issue)
+      end
+      it 'allows admins to comment' do
+        expect(permissions(admin, issue)).to be_allowed(:create_note)
+      end
+    end
+
     context 'with confidential issues' do
       let(:confidential_issue) { create(:issue, :confidential, project: project, assignees: [assignee], author: author) }
       let(:confidential_issue_no_assignee) { create(:issue, :confidential, project: project) }
diff --git a/spec/policies/merge_request_policy_spec.rb b/spec/policies/merge_request_policy_spec.rb
index 81279225d61..87205f56589 100644
--- a/spec/policies/merge_request_policy_spec.rb
+++ b/spec/policies/merge_request_policy_spec.rb
@@ -6,6 +6,7 @@ describe MergeRequestPolicy do
   let(:guest) { create(:user) }
   let(:author) { create(:user) }
   let(:developer) { create(:user) }
+  let(:non_team_member) { create(:user) }
   let(:project) { create(:project, :public) }
 
   def permissions(user, merge_request)
@@ -18,6 +19,78 @@ describe MergeRequestPolicy do
     project.add_developer(developer)
   end
 
+  MR_PERMS = %i[create_merge_request_in
+                create_merge_request_from
+                read_merge_request
+                create_note].freeze
+
+  shared_examples_for 'a denied user' do
+    let(:perms) { permissions(subject, merge_request) }
+
+    MR_PERMS.each do |thing|
+      it "cannot #{thing}" do
+        expect(perms).to be_disallowed(thing)
+      end
+    end
+  end
+
+  shared_examples_for 'a user with access' do
+    let(:perms) { permissions(subject, merge_request) }
+
+    MR_PERMS.each do |thing|
+      it "can #{thing}" do
+        expect(perms).to be_allowed(thing)
+      end
+    end
+  end
+
+  context 'when merge requests have been disabled' do
+    let!(:merge_request) { create(:merge_request, source_project: project, target_project: project, author: author) }
+
+    before do
+      project.project_feature.update(merge_requests_access_level: ProjectFeature::DISABLED)
+    end
+
+    describe 'the author' do
+      subject { author }
+      it_behaves_like 'a denied user'
+    end
+
+    describe 'a guest' do
+      subject { guest }
+      it_behaves_like 'a denied user'
+    end
+
+    describe 'a developer' do
+      subject { developer }
+      it_behaves_like 'a denied user'
+    end
+
+    describe 'any other user' do
+      subject { non_team_member }
+      it_behaves_like 'a denied user'
+    end
+  end
+
+  context 'when merge requests are private' do
+    let!(:merge_request) { create(:merge_request, source_project: project, target_project: project, author: author) }
+
+    before do
+      project.update(visibility_level: Gitlab::VisibilityLevel::PUBLIC)
+      project.project_feature.update(merge_requests_access_level: ProjectFeature::PRIVATE)
+    end
+
+    describe 'a non-team-member' do
+      subject { non_team_member }
+      it_behaves_like 'a denied user'
+    end
+
+    describe 'a developer' do
+      subject { developer }
+      it_behaves_like 'a user with access'
+    end
+  end
+
   context 'when merge request is unlocked' do
     let(:merge_request) { create(:merge_request, :closed, source_project: project, target_project: project, author: author) }
 
@@ -48,6 +121,22 @@ describe MergeRequestPolicy do
     it 'prevents guests from reopening merge request' do
       expect(permissions(guest, merge_request_locked)).to be_disallowed(:reopen_merge_request)
     end
+
+    context 'when the user is not a project member' do
+      let(:user) { create(:user) }
+
+      it 'cannot create a note' do
+        expect(permissions(user, merge_request_locked)).to be_disallowed(:create_note)
+      end
+    end
+
+    context 'when the user is project member, with at least guest access' do
+      let(:user) { guest }
+
+      it 'can create a note' do
+        expect(permissions(user, merge_request_locked)).to be_allowed(:create_note)
+      end
+    end
   end
 
   context 'with external authorization enabled' do
-- 
cgit v1.2.1


From 7dd545b130cb0cc2196ac15d7968736f679e8072 Mon Sep 17 00:00:00 2001
From: Elliot Rushton <erushton@gitlab.com>
Date: Thu, 8 Aug 2019 01:00:23 +0000
Subject: Fix required runner permissions

---
 doc/ci/runners/README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/ci/runners/README.md b/doc/ci/runners/README.md
index 03a219e03ca..f5f8e04755e 100644
--- a/doc/ci/runners/README.md
+++ b/doc/ci/runners/README.md
@@ -88,7 +88,7 @@ visit the project you want to make the Runner work for in GitLab:
 
 ## Registering a group Runner
 
-Creating a group Runner requires Maintainer permissions for the group. To create a
+Creating a group Runner requires Owner permissions for the group. To create a
 group Runner visit the group you want to make the Runner work for in GitLab:
 
 1. Go to **Settings > CI/CD** to obtain the token
@@ -124,9 +124,9 @@ To lock/unlock a Runner:
 
 ## Assigning a Runner to another project
 
-If you are Maintainer on a project where a specific Runner is assigned to, and the
+If you are an Owner on a project where a specific Runner is assigned to, and the
 Runner is not [locked only to that project](#locking-a-specific-runner-from-being-enabled-for-other-projects),
-you can enable the Runner also on any other project where you have Maintainer permissions.
+you can enable the Runner also on any other project where you have Owner permissions.
 
 To enable/disable a Runner in your project:
 
@@ -250,7 +250,7 @@ When you [register a Runner][register], its default behavior is to **only pick**
 [tagged jobs](../yaml/README.md#tags).
 
 NOTE: **Note:**
-Maintainer [permissions](../../user/permissions.md) are required to change the
+Owner [permissions](../../user/permissions.md) are required to change the
 Runner settings.
 
 To make a Runner pick untagged jobs:
-- 
cgit v1.2.1


From ae1f0aea0c11c5a64d4c7cb8d5f12a54346bc385 Mon Sep 17 00:00:00 2001
From: Nourdin el Bacha <nelbacha@gitlab.com>
Date: Thu, 8 Aug 2019 10:45:47 +0000
Subject: improve grammar in Gitaly configuration

---
 doc/install/installation.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/install/installation.md b/doc/install/installation.md
index 72a3514e2d5..c11f803b819 100644
--- a/doc/install/installation.md
+++ b/doc/install/installation.md
@@ -611,7 +611,7 @@ You can specify a different Git repository by providing it as an extra parameter
 sudo -u git -H bundle exec rake "gitlab:gitaly:install[/home/git/gitaly,/home/git/repositories,https://example.com/gitaly.git]" RAILS_ENV=production
 ```
 
-Next, make sure gitaly configured:
+Next, make sure that Gitaly is configured:
 
 ```sh
 # Restrict Gitaly socket access
-- 
cgit v1.2.1


From 492a7e753d0ef06458163aecc5ca43892a5acc73 Mon Sep 17 00:00:00 2001
From: Felipe Artur <felipefac@gmail.com>
Date: Tue, 16 Jul 2019 16:49:47 -0300
Subject: Fix DNS rebind vulnerability for JIRA integration

Uses Gitlab::HTTP for JIRA requests instead of Net::Http.
Gitlab::Http comes with some built in SSRF protections.
---
 app/models/project_services/jira_service.rb        |  7 ++-
 .../security-fix_jira_ssrf_vulnerability.yml       |  5 ++
 lib/gitlab/jira/http_client.rb                     | 66 ++++++++++++++++++++++
 .../projects/services_controller_spec.rb           |  5 ++
 4 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/security-fix_jira_ssrf_vulnerability.yml
 create mode 100644 lib/gitlab/jira/http_client.rb

diff --git a/app/models/project_services/jira_service.rb b/app/models/project_services/jira_service.rb
index d08fcd8954d..0728c83005e 100644
--- a/app/models/project_services/jira_service.rb
+++ b/app/models/project_services/jira_service.rb
@@ -64,7 +64,12 @@ class JiraService < IssueTrackerService
   end
 
   def client
-    @client ||= JIRA::Client.new(options)
+    @client ||= begin
+      JIRA::Client.new(options).tap do |client|
+        # Replaces JIRA default http client with our implementation
+        client.request_client = Gitlab::Jira::HttpClient.new(client.options)
+      end
+    end
   end
 
   def help
diff --git a/changelogs/unreleased/security-fix_jira_ssrf_vulnerability.yml b/changelogs/unreleased/security-fix_jira_ssrf_vulnerability.yml
new file mode 100644
index 00000000000..25518dd2d05
--- /dev/null
+++ b/changelogs/unreleased/security-fix_jira_ssrf_vulnerability.yml
@@ -0,0 +1,5 @@
+---
+title: Prevent DNS rebind on JIRA service integration
+merge_request:
+author:
+type: security
diff --git a/lib/gitlab/jira/http_client.rb b/lib/gitlab/jira/http_client.rb
new file mode 100644
index 00000000000..11a33a7b358
--- /dev/null
+++ b/lib/gitlab/jira/http_client.rb
@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Jira
+    # Gitlab JIRA HTTP client to be used with jira-ruby gem, this subclasses JIRA::HTTPClient.
+    # Uses Gitlab::HTTP to make requests to JIRA REST API.
+    # The parent class implementation can be found at: https://github.com/sumoheavy/jira-ruby/blob/v1.4.0/lib/jira/http_client.rb
+    class HttpClient < JIRA::HttpClient
+      extend ::Gitlab::Utils::Override
+
+      override :request
+      def request(*args)
+        result = make_request(*args)
+
+        raise JIRA::HTTPError.new(result) unless result.response.is_a?(Net::HTTPSuccess)
+
+        result
+      end
+
+      override :make_cookie_auth_request
+      def make_cookie_auth_request
+        body = {
+          username: @options.delete(:username),
+          password: @options.delete(:password)
+        }.to_json
+
+        make_request(:post, @options[:context_path] + '/rest/auth/1/session', body, { 'Content-Type' => 'application/json' })
+      end
+
+      override :make_request
+      def make_request(http_method, path, body = '', headers = {})
+        request_params = { headers: headers }
+        request_params[:body] = body if body.present?
+        request_params[:headers][:Cookie] = get_cookies if options[:use_cookies]
+        request_params[:timeout] = options[:read_timeout] if options[:read_timeout]
+        request_params[:base_uri] = uri.to_s
+        request_params.merge!(auth_params)
+
+        result = Gitlab::HTTP.public_send(http_method, path, **request_params) # rubocop:disable GitlabSecurity/PublicSend
+        @authenticated = result.response.is_a?(Net::HTTPOK)
+        store_cookies(result) if options[:use_cookies]
+
+        result
+      end
+
+      def auth_params
+        return {} unless @options[:username] && @options[:password]
+
+        {
+          basic_auth: {
+            username: @options[:username],
+            password: @options[:password]
+          }
+        }
+      end
+
+      private
+
+      def get_cookies
+        cookie_array = @cookies.values.map { |cookie| "#{cookie.name}=#{cookie.value[0]}" }
+        cookie_array += Array(@options[:additional_cookies]) if @options.key?(:additional_cookies)
+        cookie_array.join('; ') if cookie_array.any?
+      end
+    end
+  end
+end
diff --git a/spec/controllers/projects/services_controller_spec.rb b/spec/controllers/projects/services_controller_spec.rb
index 68eabce8513..22ae65ea2fb 100644
--- a/spec/controllers/projects/services_controller_spec.rb
+++ b/spec/controllers/projects/services_controller_spec.rb
@@ -11,6 +11,7 @@ describe Projects::ServicesController do
   before do
     sign_in(user)
     project.add_maintainer(user)
+    allow(Gitlab::UrlBlocker).to receive(:validate!).and_return([URI.parse('http://example.com'), nil])
   end
 
   describe '#test' do
@@ -56,6 +57,8 @@ describe Projects::ServicesController do
           stub_request(:get, 'http://example.com/rest/api/2/serverInfo')
             .to_return(status: 200, body: '{}')
 
+          expect(Gitlab::HTTP).to receive(:get).with("/rest/api/2/serverInfo", any_args).and_call_original
+
           put :test, params: { namespace_id: project.namespace, project_id: project, id: service.to_param, service: service_params }
 
           expect(response.status).to eq(200)
@@ -66,6 +69,8 @@ describe Projects::ServicesController do
         stub_request(:get, 'http://example.com/rest/api/2/serverInfo')
           .to_return(status: 200, body: '{}')
 
+        expect(Gitlab::HTTP).to receive(:get).with("/rest/api/2/serverInfo", any_args).and_call_original
+
         put :test, params: { namespace_id: project.namespace, project_id: project, id: service.to_param, service: service_params }
 
         expect(response.status).to eq(200)
-- 
cgit v1.2.1


From 1a7280220503a4bdcbed6e0b641a22be2368a626 Mon Sep 17 00:00:00 2001
From: Alexander Oleynikov <oleynikov@posteo.li>
Date: Thu, 8 Aug 2019 18:14:21 +0000
Subject: Remove inoperative >/dev/null

---
 doc/ci/ssh_keys/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/ci/ssh_keys/README.md b/doc/ci/ssh_keys/README.md
index d9f022a7125..b6aebd3bd78 100644
--- a/doc/ci/ssh_keys/README.md
+++ b/doc/ci/ssh_keys/README.md
@@ -76,7 +76,7 @@ to access it. This is where an SSH key pair comes in handy.
      ## without extra base64 encoding.
      ## https://gitlab.com/gitlab-examples/ssh-private-key/issues/1#note_48526556
      ##
-     - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add - > /dev/null
+     - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
 
      ##
      ## Create the SSH directory and give it the right permissions
-- 
cgit v1.2.1


From 4882303760c9f22112985f78746f2416b701a47b Mon Sep 17 00:00:00 2001
From: Denys Mishunov <dmishunov@gitlab.com>
Date: Mon, 12 Aug 2019 18:13:12 +0200
Subject: Fixed deletion of directories in Web IDE

---
 app/assets/javascripts/ide/stores/utils.js         |  2 +-
 .../unreleased/64677-delete-directory-webide.yml   |  5 ++++
 spec/javascripts/ide/stores/utils_spec.js          | 35 ++++++++++++++++++++++
 3 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/64677-delete-directory-webide.yml

diff --git a/app/assets/javascripts/ide/stores/utils.js b/app/assets/javascripts/ide/stores/utils.js
index 04e86afb268..52200ce7847 100644
--- a/app/assets/javascripts/ide/stores/utils.js
+++ b/app/assets/javascripts/ide/stores/utils.js
@@ -129,7 +129,7 @@ export const commitActionForFile = file => {
 
 export const getCommitFiles = stagedFiles =>
   stagedFiles.reduce((acc, file) => {
-    if (file.moved) return acc;
+    if (file.moved || file.type === 'tree') return acc;
 
     return acc.concat({
       ...file,
diff --git a/changelogs/unreleased/64677-delete-directory-webide.yml b/changelogs/unreleased/64677-delete-directory-webide.yml
new file mode 100644
index 00000000000..27d596b6b19
--- /dev/null
+++ b/changelogs/unreleased/64677-delete-directory-webide.yml
@@ -0,0 +1,5 @@
+---
+title: Fixed removing directories in Web IDE
+merge_request: 31727
+author:
+type: fixed
diff --git a/spec/javascripts/ide/stores/utils_spec.js b/spec/javascripts/ide/stores/utils_spec.js
index bceb3a8db91..0fc9519a6bf 100644
--- a/spec/javascripts/ide/stores/utils_spec.js
+++ b/spec/javascripts/ide/stores/utils_spec.js
@@ -261,6 +261,41 @@ describe('Multi-file store utils', () => {
         },
       ]);
     });
+
+    it('filters out folders from the list', () => {
+      const files = [
+        {
+          path: 'a',
+          type: 'blob',
+          deleted: true,
+        },
+        {
+          path: 'c',
+          type: 'tree',
+          deleted: true,
+        },
+        {
+          path: 'c/d',
+          type: 'blob',
+          deleted: true,
+        },
+      ];
+
+      const flattendFiles = utils.getCommitFiles(files);
+
+      expect(flattendFiles).toEqual([
+        {
+          path: 'a',
+          type: 'blob',
+          deleted: true,
+        },
+        {
+          path: 'c/d',
+          type: 'blob',
+          deleted: true,
+        },
+      ]);
+    });
   });
 
   describe('mergeTrees', () => {
-- 
cgit v1.2.1


From 1c7c91806d4b9866f512f50f36c9c74b48cb8229 Mon Sep 17 00:00:00 2001
From: drew cimino <dcimino@gitlab.com>
Date: Mon, 22 Jul 2019 14:16:15 -0400
Subject: Permission fix for MergeRequestsController#pipeline_status

- Use set_pipeline_variables to filter for visible pipelines
- Mimic response of nonexistent pipeline if not found
- Provide set_pipeline_variables as a before_filter for other actions
---
 .../projects/merge_requests_controller.rb          |  9 ++++++-
 .../unreleased/security-mr-head-pipeline-leak.yml  |  5 ++++
 .../projects/merge_requests_controller_spec.rb     | 30 +++++++++++++++++++---
 3 files changed, 39 insertions(+), 5 deletions(-)
 create mode 100644 changelogs/unreleased/security-mr-head-pipeline-leak.yml

diff --git a/app/controllers/projects/merge_requests_controller.rb b/app/controllers/projects/merge_requests_controller.rb
index f4d381244d9..ee755d68cf1 100644
--- a/app/controllers/projects/merge_requests_controller.rb
+++ b/app/controllers/projects/merge_requests_controller.rb
@@ -188,7 +188,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
   def pipeline_status
     render json: PipelineSerializer
       .new(project: @project, current_user: @current_user)
-      .represent_status(@merge_request.head_pipeline)
+      .represent_status(head_pipeline)
   end
 
   def ci_environments_status
@@ -238,6 +238,13 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
 
   private
 
+  def head_pipeline
+    strong_memoize(:head_pipeline) do
+      pipeline = @merge_request.head_pipeline
+      pipeline if can?(current_user, :read_pipeline, pipeline)
+    end
+  end
+
   def ci_environments_status_on_merge_result?
     params[:environment_target] == 'merge_commit'
   end
diff --git a/changelogs/unreleased/security-mr-head-pipeline-leak.yml b/changelogs/unreleased/security-mr-head-pipeline-leak.yml
new file mode 100644
index 00000000000..b15b353ff41
--- /dev/null
+++ b/changelogs/unreleased/security-mr-head-pipeline-leak.yml
@@ -0,0 +1,5 @@
+---
+title: Check permissions before responding in MergeController#pipeline_status
+merge_request:
+author:
+type: security
diff --git a/spec/controllers/projects/merge_requests_controller_spec.rb b/spec/controllers/projects/merge_requests_controller_spec.rb
index b1dc6a65dd4..8a5fdbc98f4 100644
--- a/spec/controllers/projects/merge_requests_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests_controller_spec.rb
@@ -1052,17 +1052,39 @@ describe Projects::MergeRequestsController do
 
       let(:status) { pipeline.detailed_status(double('user')) }
 
-      before do
+      it 'returns a detailed head_pipeline status in json' do
         get_pipeline_status
-      end
 
-      it 'return a detailed head_pipeline status in json' do
         expect(response).to have_gitlab_http_status(:ok)
         expect(json_response['text']).to eq status.text
         expect(json_response['label']).to eq status.label
         expect(json_response['icon']).to eq status.icon
         expect(json_response['favicon']).to match_asset_path "/assets/ci_favicons/#{status.favicon}.png"
       end
+
+      context 'with project member visibility on a public project' do
+        let(:user)    { create(:user) }
+        let(:project) { create(:project, :repository, :public, :builds_private) }
+
+        it 'returns pipeline data to project members' do
+          project.add_developer(user)
+
+          get_pipeline_status
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response['text']).to eq status.text
+          expect(json_response['label']).to eq status.label
+          expect(json_response['icon']).to eq status.icon
+          expect(json_response['favicon']).to match_asset_path "/assets/ci_favicons/#{status.favicon}.png"
+        end
+
+        it 'returns blank OK response to non-project-members' do
+          get_pipeline_status
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response).to be_empty
+        end
+      end
     end
 
     context 'when head_pipeline does not exist' do
@@ -1070,7 +1092,7 @@ describe Projects::MergeRequestsController do
         get_pipeline_status
       end
 
-      it 'return empty' do
+      it 'returns blank OK response' do
         expect(response).to have_gitlab_http_status(:ok)
         expect(json_response).to be_empty
       end
-- 
cgit v1.2.1


From 139df74253214fbab6aa703ed8ce381d0871aa46 Mon Sep 17 00:00:00 2001
From: Igor Drozdov <idrozdov@gitlab.com>
Date: Mon, 12 Aug 2019 15:07:15 +0300
Subject: Add merge note type as cross reference

---
 app/models/system_note_metadata.rb                                   | 2 +-
 .../unreleased/security-id-filter-timeline-activities-for-guests.yml | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/security-id-filter-timeline-activities-for-guests.yml

diff --git a/app/models/system_note_metadata.rb b/app/models/system_note_metadata.rb
index 9a2640db9ca..a19755d286a 100644
--- a/app/models/system_note_metadata.rb
+++ b/app/models/system_note_metadata.rb
@@ -9,7 +9,7 @@ class SystemNoteMetadata < ApplicationRecord
   TYPES_WITH_CROSS_REFERENCES = %w[
     commit cross_reference
     close duplicate
-    moved
+    moved merge
   ].freeze
 
   ICON_TYPES = %w[
diff --git a/changelogs/unreleased/security-id-filter-timeline-activities-for-guests.yml b/changelogs/unreleased/security-id-filter-timeline-activities-for-guests.yml
new file mode 100644
index 00000000000..0fa5f89e2c0
--- /dev/null
+++ b/changelogs/unreleased/security-id-filter-timeline-activities-for-guests.yml
@@ -0,0 +1,5 @@
+---
+title: Show cross-referenced MR-id in issues' activities only to authorized users
+merge_request:
+author:
+type: security
-- 
cgit v1.2.1


From 8c2c4e4d75ec60182e37ddaf637bc25095bdd57f Mon Sep 17 00:00:00 2001
From: Takuya Noguchi <takninnovationresearch@gmail.com>
Date: Wed, 14 Aug 2019 17:48:00 +0100
Subject: Upgrade babel to 7.5.5

Signed-off-by: Takuya Noguchi <takninnovationresearch@gmail.com>
---
 changelogs/unreleased/update-babel-to-7-5-5.yml |  5 ++++
 package.json                                    |  8 +++---
 yarn.lock                                       | 36 ++++++++++++-------------
 3 files changed, 27 insertions(+), 22 deletions(-)
 create mode 100644 changelogs/unreleased/update-babel-to-7-5-5.yml

diff --git a/changelogs/unreleased/update-babel-to-7-5-5.yml b/changelogs/unreleased/update-babel-to-7-5-5.yml
new file mode 100644
index 00000000000..c498e2adfe8
--- /dev/null
+++ b/changelogs/unreleased/update-babel-to-7-5-5.yml
@@ -0,0 +1,5 @@
+---
+title: Upgrade babel to 7.5.5
+merge_request: 31819
+author: Takuya Noguchi
+type: other
diff --git a/package.json b/package.json
index 803aebcb5fd..9c9a7687fc2 100644
--- a/package.json
+++ b/package.json
@@ -30,13 +30,13 @@
     "webpack-vrt": "NODE_OPTIONS=\"--max-old-space-size=3584\" NODE_ENV=production webpack --config config/webpack.config.review_toolbar.js"
   },
   "dependencies": {
-    "@babel/core": "^7.4.4",
-    "@babel/plugin-proposal-class-properties": "^7.4.4",
+    "@babel/core": "^7.5.5",
+    "@babel/plugin-proposal-class-properties": "^7.5.5",
     "@babel/plugin-proposal-json-strings": "^7.2.0",
     "@babel/plugin-proposal-private-methods": "^7.4.4",
     "@babel/plugin-syntax-dynamic-import": "^7.2.0",
     "@babel/plugin-syntax-import-meta": "^7.2.0",
-    "@babel/preset-env": "^7.4.4",
+    "@babel/preset-env": "^7.5.5",
     "@gitlab/csslab": "^1.9.0",
     "@gitlab/svgs": "^1.67.0",
     "@gitlab/ui": "5.15.0",
@@ -145,7 +145,7 @@
     "xterm": "^3.5.0"
   },
   "devDependencies": {
-    "@babel/plugin-transform-modules-commonjs": "^7.2.0",
+    "@babel/plugin-transform-modules-commonjs": "^7.5.0",
     "@gitlab/eslint-config": "^1.6.0",
     "@gitlab/eslint-plugin-i18n": "^1.1.0",
     "@gitlab/eslint-plugin-vue-i18n": "^1.2.0",
diff --git a/yarn.lock b/yarn.lock
index ed1f06523c0..5a59f149e8a 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9,7 +9,7 @@
   dependencies:
     "@babel/highlight" "^7.0.0"
 
-"@babel/core@>=7.2.2", "@babel/core@^7.1.0", "@babel/core@^7.1.2", "@babel/core@^7.4.4":
+"@babel/core@>=7.2.2", "@babel/core@^7.1.0", "@babel/core@^7.1.2", "@babel/core@^7.5.5":
   version "7.5.5"
   resolved "https://registry.yarnpkg.com/@babel/core/-/core-7.5.5.tgz#17b2686ef0d6bc58f963dddd68ab669755582c30"
   integrity sha512-i4qoSr2KTtce0DmkuuQBV4AuQgGPUcPXMr9L5MyYAtk06z068lQ10a4O009fe5OB/DfNV+h+qqT7ddNV8UnRjg==
@@ -139,16 +139,16 @@
     "@babel/types" "^7.0.0"
 
 "@babel/helper-module-transforms@^7.1.0", "@babel/helper-module-transforms@^7.4.4":
-  version "7.4.4"
-  resolved "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.4.4.tgz#96115ea42a2f139e619e98ed46df6019b94414b8"
-  integrity sha512-3Z1yp8TVQf+B4ynN7WoHPKS8EkdTbgAEy0nU0rs/1Kw4pDgmvYH3rz3aI11KgxKCba2cn7N+tqzV1mY2HMN96w==
+  version "7.5.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.5.5.tgz#f84ff8a09038dcbca1fd4355661a500937165b4a"
+  integrity sha512-jBeCvETKuJqeiaCdyaheF40aXnnU1+wkSiUs/IQg3tB85up1LyL8x77ClY8qJpuRJUcXQo+ZtdNESmZl4j56Pw==
   dependencies:
     "@babel/helper-module-imports" "^7.0.0"
     "@babel/helper-simple-access" "^7.1.0"
     "@babel/helper-split-export-declaration" "^7.4.4"
     "@babel/template" "^7.4.4"
-    "@babel/types" "^7.4.4"
-    lodash "^4.17.11"
+    "@babel/types" "^7.5.5"
+    lodash "^4.17.13"
 
 "@babel/helper-optimise-call-expression@^7.0.0":
   version "7.0.0"
@@ -163,11 +163,11 @@
   integrity sha512-CYAOUCARwExnEixLdB6sDm2dIJ/YgEAKDM1MOeMeZu9Ld/bDgVo8aiWrXwcY7OBh+1Ea2uUcVRcxKk0GJvW7QA==
 
 "@babel/helper-regex@^7.0.0", "@babel/helper-regex@^7.4.4":
-  version "7.4.4"
-  resolved "https://registry.yarnpkg.com/@babel/helper-regex/-/helper-regex-7.4.4.tgz#a47e02bc91fb259d2e6727c2a30013e3ac13c4a2"
-  integrity sha512-Y5nuB/kESmR3tKjU8Nkn1wMGEx1tjJX076HBMeL3XLQCu6vA/YRzuTW0bbb+qRnXvQGn+d6Rx953yffl8vEy7Q==
+  version "7.5.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-regex/-/helper-regex-7.5.5.tgz#0aa6824f7100a2e0e89c1527c23936c152cab351"
+  integrity sha512-CkCYQLkfkiugbRDO8eZn6lRuR8kzZoGXCg3149iTk5se7g6qykSpy3+hELSwquhu+TgHn8nkLiBwHvNX8Hofcw==
   dependencies:
-    lodash "^4.17.11"
+    lodash "^4.17.13"
 
 "@babel/helper-remap-async-to-generator@^7.1.0":
   version "7.1.0"
@@ -225,9 +225,9 @@
     "@babel/types" "^7.5.5"
 
 "@babel/highlight@^7.0.0":
-  version "7.0.0"
-  resolved "https://registry.yarnpkg.com/@babel/highlight/-/highlight-7.0.0.tgz#f710c38c8d458e6dd9a201afb637fcb781ce99e4"
-  integrity sha512-UFMC4ZeFC48Tpvj7C8UgLvtkaUuovQX+5xNWrsIoMG8o2z+XFKjKaN9iVmS84dPwVN00W4wPmqvYoZF3EGAsfw==
+  version "7.5.0"
+  resolved "https://registry.yarnpkg.com/@babel/highlight/-/highlight-7.5.0.tgz#56d11312bd9248fa619591d02472be6e8cb32540"
+  integrity sha512-7dV4eu9gBxoM0dAnj/BCFDW9LFU0zvTrkq0ugM7pnHEgguOEeOz1so2ZghEdzviYzQEED0r4EAgpsBChKy1TRQ==
   dependencies:
     chalk "^2.0.0"
     esutils "^2.0.2"
@@ -252,7 +252,7 @@
     "@babel/helper-remap-async-to-generator" "^7.1.0"
     "@babel/plugin-syntax-async-generators" "^7.2.0"
 
-"@babel/plugin-proposal-class-properties@^7.1.0", "@babel/plugin-proposal-class-properties@^7.4.4":
+"@babel/plugin-proposal-class-properties@^7.1.0", "@babel/plugin-proposal-class-properties@^7.5.5":
   version "7.5.5"
   resolved "https://registry.yarnpkg.com/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.5.5.tgz#a974cfae1e37c3110e71f3c6a2e48b8e71958cd4"
   integrity sha512-AF79FsnWFxjlaosgdi421vmYG6/jg79bVD0dpD44QdgobzHKuLZ6S3vl8la9qIeSwGi8i1fS0O1mfuDAAdo1/A==
@@ -833,7 +833,7 @@
     "@babel/helper-regex" "^7.4.4"
     regexpu-core "^4.5.4"
 
-"@babel/preset-env@^7.1.0", "@babel/preset-env@^7.4.4":
+"@babel/preset-env@^7.1.0", "@babel/preset-env@^7.5.5":
   version "7.5.5"
   resolved "https://registry.yarnpkg.com/@babel/preset-env/-/preset-env-7.5.5.tgz#bc470b53acaa48df4b8db24a570d6da1fef53c9a"
   integrity sha512-GMZQka/+INwsMz1A5UEql8tG015h5j/qjptpKY2gJ7giy8ohzU710YciJB5rcKsWGWHiW3RUnHib0E5/m3Tp3A==
@@ -914,9 +914,9 @@
   integrity sha512-FBMd0IiARPtH5aaOFUVki6evHiJQiY0pFy7fizyRF7dtwc+el3nwpzvhb9qBNzceG1OIJModG1xpE0DDFjPXwA==
 
 "@babel/standalone@^7.0.0":
-  version "7.3.4"
-  resolved "https://registry.yarnpkg.com/@babel/standalone/-/standalone-7.3.4.tgz#b622c1e522acef91b2a14f22bdcdd4f935a1a474"
-  integrity sha512-4L9c5i4WlGqbrjOVX0Yp8TIR5cEiw1/tPYYZENW/iuO2uI6viY38U7zALidzNfGdZIwNc+A/AWqMEWKeScWkBg==
+  version "7.5.5"
+  resolved "https://registry.yarnpkg.com/@babel/standalone/-/standalone-7.5.5.tgz#9d3143f6078ff408db694a4254bd6f03c5c33962"
+  integrity sha512-YIp5taErC4uvp4d5urJtWMui3cpvZt83x57l4oVJNvFtDzumf3pMgRmoTSpGuEzh1yzo7jHhg3mbQmMhmKPbjA==
 
 "@babel/template@^7.1.0", "@babel/template@^7.4.0", "@babel/template@^7.4.4":
   version "7.4.4"
-- 
cgit v1.2.1


From 50956e5c85e29d0d1a7634068b782ffce73be479 Mon Sep 17 00:00:00 2001
From: Luke Duncalfe <lduncalfe@eml.cc>
Date: Mon, 12 Aug 2019 10:17:32 +1200
Subject: Link more issues in Design Management Limitations

---
 doc/user/project/issues/design_management.md | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/doc/user/project/issues/design_management.md b/doc/user/project/issues/design_management.md
index bffbcb544e3..1324a90e00b 100644
--- a/doc/user/project/issues/design_management.md
+++ b/doc/user/project/issues/design_management.md
@@ -35,9 +35,19 @@ to be enabled:
 
 ## Limitations
 
-- Files uploaded must have a file extension of either `png`, `jpg`, `jpeg`, `gif`, `bmp`, `tiff` or `ico`. The [`svg` extension is not yet supported](https://gitlab.com/gitlab-org/gitlab-ee/issues/12771).
+- Files uploaded must have a file extension of either `png`, `jpg`, `jpeg`, `gif`, `bmp`, `tiff` or `ico`.
+  The [`svg` extension is not yet supported](https://gitlab.com/gitlab-org/gitlab-ee/issues/12771).
+- Design uploads are limited to 10 files at a time.
 - [Designs cannot yet be deleted](https://gitlab.com/gitlab-org/gitlab-ee/issues/11089).
-- Design Management is [not yet supported in the project export](https://gitlab.com/gitlab-org/gitlab-ee/issues/11090).
+- Design Management is
+  [not yet supported in the project export](https://gitlab.com/gitlab-org/gitlab-ee/issues/11090).
+- Design Management data
+  [isn't deleted when a project is destroyed](https://gitlab.com/gitlab-org/gitlab-ee/issues/13429) yet.
+- Design Management data [won't be moved](https://gitlab.com/gitlab-org/gitlab-ee/issues/13426)
+  when an issue is moved, nor [deleted](https://gitlab.com/gitlab-org/gitlab-ee/issues/13427)
+  when an issue is deleted.
+- Design Management
+  [isn't supported by Geo](https://gitlab.com/groups/gitlab-org/-/epics/1633) yet.
 
 ## The Design Management page
 
-- 
cgit v1.2.1


From 06eddc3edfa739c0c685d461a58621b43c4ecd5d Mon Sep 17 00:00:00 2001
From: George Koltsov <gkoltsov@gitlab.com>
Date: Tue, 6 Aug 2019 14:05:18 +0100
Subject: Fix project import restricted visibility bypass

Add Gitlab::VisibilityLevelChecker that verifies
selected project visibility level (or overridden param)
is not restricted when creating or importing a project
---
 app/services/projects/create_service.rb            | 27 ++++---
 .../unreleased/security-project-import-bypass.yml  |  5 ++
 lib/gitlab/visibility_level_checker.rb             | 88 ++++++++++++++++++++++
 spec/lib/gitlab/visibility_level_checker_spec.rb   | 82 ++++++++++++++++++++
 spec/services/projects/create_service_spec.rb      | 68 +++++++++++++----
 5 files changed, 244 insertions(+), 26 deletions(-)
 create mode 100644 changelogs/unreleased/security-project-import-bypass.yml
 create mode 100644 lib/gitlab/visibility_level_checker.rb
 create mode 100644 spec/lib/gitlab/visibility_level_checker_spec.rb

diff --git a/app/services/projects/create_service.rb b/app/services/projects/create_service.rb
index 89dc4375c63..942a45286b2 100644
--- a/app/services/projects/create_service.rb
+++ b/app/services/projects/create_service.rb
@@ -5,9 +5,11 @@ module Projects
     include ValidatesClassificationLabel
 
     def initialize(user, params)
-      @current_user, @params = user, params.dup
-      @skip_wiki = @params.delete(:skip_wiki)
+      @current_user, @params  = user, params.dup
+      @skip_wiki              = @params.delete(:skip_wiki)
       @initialize_with_readme = Gitlab::Utils.to_boolean(@params.delete(:initialize_with_readme))
+      @import_data            = @params.delete(:import_data)
+      @relations_block        = @params.delete(:relations_block)
     end
 
     def execute
@@ -15,14 +17,11 @@ module Projects
         return ::Projects::CreateFromTemplateService.new(current_user, params).execute
       end
 
-      import_data = params.delete(:import_data)
-      relations_block = params.delete(:relations_block)
-
       @project = Project.new(params)
 
       # Make sure that the user is allowed to use the specified visibility level
-      unless Gitlab::VisibilityLevel.allowed_for?(current_user, @project.visibility_level)
-        deny_visibility_level(@project)
+      if project_visibility.restricted?
+        deny_visibility_level(@project, project_visibility.visibility_level)
         return @project
       end
 
@@ -44,7 +43,7 @@ module Projects
         @project.namespace_id = current_user.namespace_id
       end
 
-      relations_block&.call(@project)
+      @relations_block&.call(@project)
       yield(@project) if block_given?
 
       validate_classification_label(@project, :external_authorization_classification_label)
@@ -54,7 +53,7 @@ module Projects
 
       @project.creator = current_user
 
-      save_project_and_import_data(import_data)
+      save_project_and_import_data
 
       after_create_actions if @project.persisted?
 
@@ -129,9 +128,9 @@ module Projects
       !@project.feature_available?(:wiki, current_user) || @skip_wiki
     end
 
-    def save_project_and_import_data(import_data)
+    def save_project_and_import_data
       Project.transaction do
-        @project.create_or_update_import_data(data: import_data[:data], credentials: import_data[:credentials]) if import_data
+        @project.create_or_update_import_data(data: @import_data[:data], credentials: @import_data[:credentials]) if @import_data
 
         if @project.save
           unless @project.gitlab_project_import?
@@ -192,5 +191,11 @@ module Projects
         fail(error: @project.errors.full_messages.join(', '))
       end
     end
+
+    def project_visibility
+      @project_visibility ||= Gitlab::VisibilityLevelChecker
+        .new(current_user, @project, project_params: { import_data: @import_data })
+        .level_restricted?
+    end
   end
 end
diff --git a/changelogs/unreleased/security-project-import-bypass.yml b/changelogs/unreleased/security-project-import-bypass.yml
new file mode 100644
index 00000000000..fc7b823509c
--- /dev/null
+++ b/changelogs/unreleased/security-project-import-bypass.yml
@@ -0,0 +1,5 @@
+---
+title: Fix project import restricted visibility bypass via API
+merge_request:
+author:
+type: security
diff --git a/lib/gitlab/visibility_level_checker.rb b/lib/gitlab/visibility_level_checker.rb
new file mode 100644
index 00000000000..f15f1486a4e
--- /dev/null
+++ b/lib/gitlab/visibility_level_checker.rb
@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+# Gitlab::VisibilityLevelChecker verifies that:
+#   - Current @project.visibility_level is not restricted
+#   - Override visibility param is not restricted
+#     - @see https://docs.gitlab.com/ce/api/project_import_export.html#import-a-file
+#
+# @param current_user [User] Current user object to verify visibility level against
+# @param project [Project] Current project that is being created/imported
+# @param project_params [Hash] Supplementary project params (e.g. import
+# params containing visibility override)
+#
+# @example
+#   user = User.find(2)
+#   project = Project.last
+#   project_params = {:import_data=>{:data=>{:override_params=>{"visibility"=>"public"}}}}
+#   level_checker = Gitlab::VisibilityLevelChecker.new(user, project, project_params: project_params)
+#
+#   project_visibility = level_checker.level_restricted?
+#   => #<Gitlab::VisibilityEvaluationResult:0x00007fbe16ee33c0 @restricted=true, @visibility_level=20>
+#
+#   if project_visibility.restricted?
+#     deny_visibility_level(project, project_visibility.visibility_level)
+#   end
+#
+# @return [VisibilityEvaluationResult] Visibility evaluation result. Responds to:
+# #restricted - boolean indicating if level is restricted
+# #visibility_level - integer of restricted visibility level
+#
+module Gitlab
+  class VisibilityLevelChecker
+    def initialize(current_user, project, project_params: {})
+      @current_user   = current_user
+      @project        = project
+      @project_params = project_params
+    end
+
+    def level_restricted?
+      return VisibilityEvaluationResult.new(true, override_visibility_level_value) if override_visibility_restricted?
+      return VisibilityEvaluationResult.new(true, project.visibility_level) if project_visibility_restricted?
+
+      VisibilityEvaluationResult.new(false, nil)
+    end
+
+    private
+
+    attr_reader :current_user, :project, :project_params
+
+    def override_visibility_restricted?
+      return unless import_data
+      return unless override_visibility_level
+      return if Gitlab::VisibilityLevel.allowed_for?(current_user, override_visibility_level_value)
+
+      true
+    end
+
+    def project_visibility_restricted?
+      return if Gitlab::VisibilityLevel.allowed_for?(current_user, project.visibility_level)
+
+      true
+    end
+
+    def import_data
+      @import_data ||= project_params[:import_data]
+    end
+
+    def override_visibility_level
+      @override_visibility_level ||= import_data.deep_symbolize_keys.dig(:data, :override_params, :visibility)
+    end
+
+    def override_visibility_level_value
+      @override_visibility_level_value ||= Gitlab::VisibilityLevel.level_value(override_visibility_level)
+    end
+  end
+
+  class VisibilityEvaluationResult
+    attr_reader :visibility_level
+
+    def initialize(restricted, visibility_level)
+      @restricted = restricted
+      @visibility_level = visibility_level
+    end
+
+    def restricted?
+      @restricted
+    end
+  end
+end
diff --git a/spec/lib/gitlab/visibility_level_checker_spec.rb b/spec/lib/gitlab/visibility_level_checker_spec.rb
new file mode 100644
index 00000000000..325ac3c6f31
--- /dev/null
+++ b/spec/lib/gitlab/visibility_level_checker_spec.rb
@@ -0,0 +1,82 @@
+require 'spec_helper'
+
+describe Gitlab::VisibilityLevelChecker do
+  let(:user) { create(:user) }
+  let(:project) { create(:project) }
+  let(:visibility_level_checker) { }
+  let(:override_params) { {} }
+
+  subject { described_class.new(user, project, project_params: override_params) }
+
+  describe '#level_restricted?' do
+    context 'when visibility level is allowed' do
+      it 'returns false with nil for visibility level' do
+        result = subject.level_restricted?
+
+        expect(result.restricted?).to eq(false)
+        expect(result.visibility_level).to be_nil
+      end
+    end
+
+    context 'when visibility level is restricted' do
+      before do
+        stub_application_setting(restricted_visibility_levels: [Gitlab::VisibilityLevel::PUBLIC])
+      end
+
+      it 'returns true and visibility name' do
+        project.update!(visibility_level: Gitlab::VisibilityLevel::PUBLIC)
+        result = subject.level_restricted?
+
+        expect(result.restricted?).to eq(true)
+        expect(result.visibility_level).to eq(Gitlab::VisibilityLevel::PUBLIC)
+      end
+
+      context 'overridden visibility' do
+        let(:override_params) do
+          {
+            import_data: {
+              data: {
+                override_params: {
+                  visibility: override_visibility
+                }
+              }
+            }
+          }
+        end
+
+        context 'when restricted' do
+          let(:override_visibility) { 'public' }
+
+          it 'returns true and visibility name' do
+            result = subject.level_restricted?
+
+            expect(result.restricted?).to eq(true)
+            expect(result.visibility_level).to eq(Gitlab::VisibilityLevel::PUBLIC)
+          end
+        end
+
+        context 'when misspelled' do
+          let(:override_visibility) { 'publik' }
+
+          it 'returns false with nil for visibility level' do
+            result = subject.level_restricted?
+
+            expect(result.restricted?).to eq(false)
+            expect(result.visibility_level).to be_nil
+          end
+        end
+
+        context 'when import_data is missing' do
+          let(:override_params) { {} }
+
+          it 'returns false with nil for visibility level' do
+            result = subject.level_restricted?
+
+            expect(result.restricted?).to eq(false)
+            expect(result.visibility_level).to be_nil
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/spec/services/projects/create_service_spec.rb b/spec/services/projects/create_service_spec.rb
index b0b74407812..a87ae7bfd37 100644
--- a/spec/services/projects/create_service_spec.rb
+++ b/spec/services/projects/create_service_spec.rb
@@ -182,27 +182,65 @@ describe Projects::CreateService, '#execute' do
   context 'restricted visibility level' do
     before do
       stub_application_setting(restricted_visibility_levels: [Gitlab::VisibilityLevel::PUBLIC])
+    end
 
-      opts.merge!(
-        visibility_level: Gitlab::VisibilityLevel::PUBLIC
-      )
+    shared_examples 'restricted visibility' do
+      it 'does not allow a restricted visibility level for non-admins' do
+        project = create_project(user, opts)
+
+        expect(project).to respond_to(:errors)
+        expect(project.errors.messages).to have_key(:visibility_level)
+        expect(project.errors.messages[:visibility_level].first).to(
+          match('restricted by your GitLab administrator')
+        )
+      end
+
+      it 'allows a restricted visibility level for admins' do
+        admin = create(:admin)
+        project = create_project(admin, opts)
+
+        expect(project.errors.any?).to be(false)
+        expect(project.saved?).to be(true)
+      end
     end
 
-    it 'does not allow a restricted visibility level for non-admins' do
-      project = create_project(user, opts)
-      expect(project).to respond_to(:errors)
-      expect(project.errors.messages).to have_key(:visibility_level)
-      expect(project.errors.messages[:visibility_level].first).to(
-        match('restricted by your GitLab administrator')
-      )
+    context 'when visibility is project based' do
+      before do
+        opts.merge!(
+          visibility_level: Gitlab::VisibilityLevel::PUBLIC
+        )
+      end
+
+      include_examples 'restricted visibility'
     end
 
-    it 'allows a restricted visibility level for admins' do
-      admin = create(:admin)
-      project = create_project(admin, opts)
+    context 'when visibility is overridden' do
+      let(:visibility) { 'public' }
 
-      expect(project.errors.any?).to be(false)
-      expect(project.saved?).to be(true)
+      before do
+        opts.merge!(
+          import_data: {
+            data: {
+              override_params: {
+                visibility: visibility
+              }
+            }
+          }
+        )
+      end
+
+      include_examples 'restricted visibility'
+
+      context 'when visibility is misspelled' do
+        let(:visibility) { 'publik' }
+
+        it 'does not restrict project creation' do
+          project = create_project(user, opts)
+
+          expect(project.errors.any?).to be(false)
+          expect(project.saved?).to be(true)
+        end
+      end
     end
   end
 
-- 
cgit v1.2.1


From b179b752e8024679e6ce6fbd2a5fe1da17fef3f6 Mon Sep 17 00:00:00 2001
From: Arun Kumar Mohan <arunmohandm@gmail.com>
Date: Tue, 13 Aug 2019 01:04:10 -0500
Subject: Refactor nextUnresolvedDiscussionId and
 previousUnresolvedDiscussionId getters

---
 app/assets/javascripts/notes/stores/getters.js |  39 +++++---
 spec/javascripts/notes/stores/getters_spec.js  | 130 +++++++++++++++++--------
 2 files changed, 112 insertions(+), 57 deletions(-)

diff --git a/app/assets/javascripts/notes/stores/getters.js b/app/assets/javascripts/notes/stores/getters.js
index 52410f18d4a..3d0ec8cd3a7 100644
--- a/app/assets/javascripts/notes/stores/getters.js
+++ b/app/assets/javascripts/notes/stores/getters.js
@@ -171,26 +171,33 @@ export const isLastUnresolvedDiscussion = (state, getters) => (discussionId, dif
   return lastDiscussionId === discussionId;
 };
 
-// Gets the ID of the discussion following the one provided, respecting order (diff or date)
-// @param {Boolean} discussionId - id of the current discussion
-// @param {Boolean} diffOrder - is ordered by diff?
-export const nextUnresolvedDiscussionId = (state, getters) => (discussionId, diffOrder) => {
-  const idsOrdered = getters.unresolvedDiscussionsIdsOrdered(diffOrder);
-  const currentIndex = idsOrdered.indexOf(discussionId);
-  const slicedIds = idsOrdered.slice(currentIndex + 1, currentIndex + 2);
+export const findUnresolvedDiscussionIdNeighbor = (state, getters) => ({
+  discussionId,
+  diffOrder,
+  step,
+}) => {
+  const ids = getters.unresolvedDiscussionsIdsOrdered(diffOrder);
+  const index = ids.indexOf(discussionId) + step;
+
+  if (index < 0 && step < 0) {
+    return ids[ids.length - 1];
+  }
+
+  if (index === ids.length && step > 0) {
+    return ids[0];
+  }
 
-  // Get the first ID if there is none after the currentIndex
-  return slicedIds.length ? idsOrdered.slice(currentIndex + 1, currentIndex + 2)[0] : idsOrdered[0];
+  return ids[index];
 };
 
-export const previousUnresolvedDiscussionId = (state, getters) => (discussionId, diffOrder) => {
-  const idsOrdered = getters.unresolvedDiscussionsIdsOrdered(diffOrder);
-  const currentIndex = idsOrdered.indexOf(discussionId);
-  const slicedIds = idsOrdered.slice(currentIndex - 1, currentIndex);
+// Gets the ID of the discussion following the one provided, respecting order (diff or date)
+// @param {Boolean} discussionId - id of the current discussion
+// @param {Boolean} diffOrder - is ordered by diff?
+export const nextUnresolvedDiscussionId = (state, getters) => (discussionId, diffOrder) =>
+  getters.findUnresolvedDiscussionIdNeighbor({ discussionId, diffOrder, step: 1 });
 
-  // Get the last ID if there is none after the currentIndex
-  return slicedIds.length ? slicedIds[0] : idsOrdered[idsOrdered.length - 1];
-};
+export const previousUnresolvedDiscussionId = (state, getters) => (discussionId, diffOrder) =>
+  getters.findUnresolvedDiscussionIdNeighbor({ discussionId, diffOrder, step: -1 });
 
 // @param {Boolean} diffOrder - is ordered by diff?
 export const firstUnresolvedDiscussionId = (state, getters) => diffOrder => {
diff --git a/spec/javascripts/notes/stores/getters_spec.js b/spec/javascripts/notes/stores/getters_spec.js
index 71dcba114a9..d69f469c7c7 100644
--- a/spec/javascripts/notes/stores/getters_spec.js
+++ b/spec/javascripts/notes/stores/getters_spec.js
@@ -14,6 +14,13 @@ import {
 
 const discussionWithTwoUnresolvedNotes = 'merge_requests/resolved_diff_discussion.json';
 
+// Helper function to ensure that we're using the same schema across tests.
+const createDiscussionNeighborParams = (discussionId, diffOrder, step) => ({
+  discussionId,
+  diffOrder,
+  step,
+});
+
 describe('Getters Notes Store', () => {
   let state;
 
@@ -25,7 +32,6 @@ describe('Getters Notes Store', () => {
       targetNoteHash: 'hash',
       lastFetchedAt: 'timestamp',
       isNotesFetched: false,
-
       notesData: notesDataMock,
       userData: userDataMock,
       noteableData: noteableDataMock,
@@ -244,62 +250,104 @@ describe('Getters Notes Store', () => {
     });
   });
 
-  describe('nextUnresolvedDiscussionId', () => {
-    const localGetters = {
-      unresolvedDiscussionsIdsOrdered: () => ['123', '456', '789'],
-    };
+  describe('findUnresolvedDiscussionIdNeighbor', () => {
+    let localGetters;
+    beforeEach(() => {
+      localGetters = {
+        unresolvedDiscussionsIdsOrdered: () => ['123', '456', '789'],
+      };
+    });
 
-    it('should return the ID of the discussion after the ID provided', () => {
-      expect(getters.nextUnresolvedDiscussionId(state, localGetters)('123')).toBe('456');
-      expect(getters.nextUnresolvedDiscussionId(state, localGetters)('456')).toBe('789');
-      expect(getters.nextUnresolvedDiscussionId(state, localGetters)('789')).toBe('123');
+    [
+      { step: 1, id: '123', expected: '456' },
+      { step: 1, id: '456', expected: '789' },
+      { step: 1, id: '789', expected: '123' },
+      { step: -1, id: '123', expected: '789' },
+      { step: -1, id: '456', expected: '123' },
+      { step: -1, id: '789', expected: '456' },
+    ].forEach(({ step, id, expected }) => {
+      it(`with step ${step} and id ${id}, returns next value`, () => {
+        const params = createDiscussionNeighborParams(id, true, step);
+
+        expect(getters.findUnresolvedDiscussionIdNeighbor(state, localGetters)(params)).toBe(
+          expected,
+        );
+      });
     });
-  });
 
-  describe('previousUnresolvedDiscussionId', () => {
-    describe('with unresolved discussions', () => {
-      const localGetters = {
-        unresolvedDiscussionsIdsOrdered: () => ['123', '456', '789'],
-      };
+    describe('with 1 unresolved discussion', () => {
+      beforeEach(() => {
+        localGetters = {
+          unresolvedDiscussionsIdsOrdered: () => ['123'],
+        };
+      });
+
+      [{ step: 1, id: '123', expected: '123' }, { step: -1, id: '123', expected: '123' }].forEach(
+        ({ step, id, expected }) => {
+          it(`with step ${step} and match, returns only value`, () => {
+            const params = createDiscussionNeighborParams(id, true, step);
 
-      it('with bogus returns falsey', () => {
-        expect(getters.previousUnresolvedDiscussionId(state, localGetters)('bogus')).toBe('456');
+            expect(getters.findUnresolvedDiscussionIdNeighbor(state, localGetters)(params)).toBe(
+              expected,
+            );
+          });
+        },
+      );
+
+      it('with no match, returns only value', () => {
+        const params = createDiscussionNeighborParams('bogus', true, 1);
+
+        expect(getters.findUnresolvedDiscussionIdNeighbor(state, localGetters)(params)).toBe('123');
       });
+    });
 
-      [
-        { id: '123', expected: '789' },
-        { id: '456', expected: '123' },
-        { id: '789', expected: '456' },
-      ].forEach(({ id, expected }) => {
-        it(`with ${id}, returns previous value`, () => {
-          expect(getters.previousUnresolvedDiscussionId(state, localGetters)(id)).toBe(expected);
+    describe('with 0 unresolved discussions', () => {
+      beforeEach(() => {
+        localGetters = {
+          unresolvedDiscussionsIdsOrdered: () => [],
+        };
+      });
+
+      [{ step: 1 }, { step: -1 }].forEach(({ step }) => {
+        it(`with step ${step}, returns undefined`, () => {
+          const params = createDiscussionNeighborParams('bogus', true, step);
+
+          expect(
+            getters.findUnresolvedDiscussionIdNeighbor(state, localGetters)(params),
+          ).toBeUndefined();
         });
       });
     });
+  });
 
-    describe('with 1 unresolved discussion', () => {
-      const localGetters = {
-        unresolvedDiscussionsIdsOrdered: () => ['123'],
-      };
+  describe('findUnresolvedDiscussionIdNeighbor aliases', () => {
+    let neighbor;
+    let findUnresolvedDiscussionIdNeighbor;
+    let localGetters;
 
-      it('with bogus returns id', () => {
-        expect(getters.previousUnresolvedDiscussionId(state, localGetters)('bogus')).toBe('123');
-      });
+    beforeEach(() => {
+      neighbor = {};
+      findUnresolvedDiscussionIdNeighbor = jasmine.createSpy().and.returnValue(neighbor);
+      localGetters = { findUnresolvedDiscussionIdNeighbor };
+    });
 
-      it('with match, returns value', () => {
-        expect(getters.previousUnresolvedDiscussionId(state, localGetters)('123')).toEqual('123');
+    describe('nextUnresolvedDiscussionId', () => {
+      it('should return result of find neighbor', () => {
+        const expectedParams = createDiscussionNeighborParams('123', true, 1);
+        const result = getters.nextUnresolvedDiscussionId(state, localGetters)('123', true);
+
+        expect(findUnresolvedDiscussionIdNeighbor).toHaveBeenCalledWith(expectedParams);
+        expect(result).toBe(neighbor);
       });
     });
 
-    describe('with 0 unresolved discussions', () => {
-      const localGetters = {
-        unresolvedDiscussionsIdsOrdered: () => [],
-      };
+    describe('previosuUnresolvedDiscussionId', () => {
+      it('should return result of find neighbor', () => {
+        const expectedParams = createDiscussionNeighborParams('123', true, -1);
+        const result = getters.previousUnresolvedDiscussionId(state, localGetters)('123', true);
 
-      it('returns undefined', () => {
-        expect(
-          getters.previousUnresolvedDiscussionId(state, localGetters)('bogus'),
-        ).toBeUndefined();
+        expect(findUnresolvedDiscussionIdNeighbor).toHaveBeenCalledWith(expectedParams);
+        expect(result).toBe(neighbor);
       });
     });
   });
-- 
cgit v1.2.1


From 790a1cd911d6394eeb3865ec51fcb944fcd26b21 Mon Sep 17 00:00:00 2001
From: ddavison <ddavison@gitlab.com>
Date: Thu, 15 Aug 2019 13:36:38 -0700
Subject: Ensure autodevops is enabled before running Smoke test

Extract #enable_autodevops to new page object
Change Smoke test naming to only running pipeline
Generate AutoDevOps project with SecureRandom suffix
---
 qa/qa.rb                                            |  1 +
 qa/qa/page/project/settings/auto_devops.rb          | 21 +++++++++++++++++++++
 qa/qa/page/project/settings/ci_cd.rb                | 10 ++--------
 .../create_project_with_auto_devops_spec.rb         | 16 ++++++++++++----
 4 files changed, 36 insertions(+), 12 deletions(-)
 create mode 100644 qa/qa/page/project/settings/auto_devops.rb

diff --git a/qa/qa.rb b/qa/qa.rb
index 18fb4509dce..b6fc7f5071e 100644
--- a/qa/qa.rb
+++ b/qa/qa.rb
@@ -204,6 +204,7 @@ module QA
         autoload :Main, 'qa/page/project/settings/main'
         autoload :Repository, 'qa/page/project/settings/repository'
         autoload :CICD, 'qa/page/project/settings/ci_cd'
+        autoload :AutoDevops, 'qa/page/project/settings/auto_devops'
         autoload :DeployKeys, 'qa/page/project/settings/deploy_keys'
         autoload :DeployTokens, 'qa/page/project/settings/deploy_tokens'
         autoload :ProtectedBranches, 'qa/page/project/settings/protected_branches'
diff --git a/qa/qa/page/project/settings/auto_devops.rb b/qa/qa/page/project/settings/auto_devops.rb
new file mode 100644
index 00000000000..827d5b072c3
--- /dev/null
+++ b/qa/qa/page/project/settings/auto_devops.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module QA
+  module Page
+    module Project
+      module Settings
+        class AutoDevops < Page::Base
+          view 'app/views/projects/settings/ci_cd/_autodevops_form.html.haml' do
+            element :enable_autodevops_checkbox
+            element :save_changes_button
+          end
+
+          def enable_autodevops
+            check_element :enable_autodevops_checkbox
+            click_element :save_changes_button
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/page/project/settings/ci_cd.rb b/qa/qa/page/project/settings/ci_cd.rb
index ae826fb3a32..45040cf4660 100644
--- a/qa/qa/page/project/settings/ci_cd.rb
+++ b/qa/qa/page/project/settings/ci_cd.rb
@@ -13,11 +13,6 @@ module QA
             element :variables_settings_content
           end
 
-          view 'app/views/projects/settings/ci_cd/_autodevops_form.html.haml' do
-            element :enable_autodevops_checkbox
-            element :save_changes_button
-          end
-
           def expand_runners_settings(&block)
             expand_section(:runners_settings_content) do
               Settings::Runners.perform(&block)
@@ -30,10 +25,9 @@ module QA
             end
           end
 
-          def enable_auto_devops
+          def expand_auto_devops(&block)
             expand_section(:autodevops_settings_content) do
-              check_element :enable_autodevops_checkbox
-              click_element :save_changes_button
+              Settings::AutoDevops.perform(&block)
             end
           end
         end
diff --git a/qa/qa/specs/features/browser_ui/7_configure/auto_devops/create_project_with_auto_devops_spec.rb b/qa/qa/specs/features/browser_ui/7_configure/auto_devops/create_project_with_auto_devops_spec.rb
index 60c1e105ae6..3f99ae644c7 100644
--- a/qa/qa/specs/features/browser_ui/7_configure/auto_devops/create_project_with_auto_devops_spec.rb
+++ b/qa/qa/specs/features/browser_ui/7_configure/auto_devops/create_project_with_auto_devops_spec.rb
@@ -147,23 +147,31 @@ module QA
     end
 
     describe 'Auto DevOps', :smoke do
-      it 'enables AutoDevOps by default' do
+      before do
         login
 
-        project = Resource::Project.fabricate! do |p|
-          p.name = Runtime::Env.auto_devops_project_name || 'project-with-autodevops'
+        @project = Resource::Project.fabricate_via_browser_ui! do |p|
+          p.name = "project-with-autodevops-#{SecureRandom.hex(8)}"
           p.description = 'Project with AutoDevOps'
         end
 
+        Page::Project::Menu.perform(&:go_to_ci_cd_settings)
+        Page::Project::Settings::CICD.perform(&:expand_auto_devops)
+        Page::Project::Settings::AutoDevops.perform(&:enable_autodevops)
+
+        @project.visit!
+
         # Create AutoDevOps repo
         Resource::Repository::ProjectPush.fabricate! do |push|
-          push.project = project
+          push.project = @project
           push.directory = Pathname
             .new(__dir__)
             .join('../../../../../fixtures/auto_devops_rack')
           push.commit_message = 'Create AutoDevOps compatible Project'
         end
+      end
 
+      it 'runs an AutoDevOps pipeline' do
         Page::Project::Menu.perform(&:click_ci_cd_pipelines)
         Page::Project::Pipeline::Index.perform(&:click_on_latest_pipeline)
 
-- 
cgit v1.2.1


From a5a316baf3146916a1eb3b90b5b9906318d22ddb Mon Sep 17 00:00:00 2001
From: Zeff Morgan <zmorgan@gitlab.com>
Date: Thu, 15 Aug 2019 23:10:37 +0000
Subject: Correct case of GitLab in section header

---
 doc/user/project/integrations/prometheus.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/user/project/integrations/prometheus.md b/doc/user/project/integrations/prometheus.md
index aa7db97c413..787ac3fce5c 100644
--- a/doc/user/project/integrations/prometheus.md
+++ b/doc/user/project/integrations/prometheus.md
@@ -354,7 +354,7 @@ Prometheus server.
 
 ![Merge Request with Performance Impact](img/merge_request_performance.png)
 
-## Embedding metric charts within Gitlab Flavored Markdown
+## Embedding metric charts within GitLab Flavored Markdown
 
 > [Introduced][ce-29691] in GitLab 12.2.
 > Requires [Kubernetes](prometheus_library/kubernetes.md) metrics.
-- 
cgit v1.2.1


From 880c9a25a8738a4f4be26b147655b4cb6ac89d4e Mon Sep 17 00:00:00 2001
From: Steve Azzopardi <sazzopardi@gitlab.com>
Date: Thu, 25 Jul 2019 14:14:31 +0200
Subject: Update srmX configuration

---
 doc/user/gitlab_com/index.md | 83 ++++++++++----------------------------------
 1 file changed, 19 insertions(+), 64 deletions(-)

diff --git a/doc/user/gitlab_com/index.md b/doc/user/gitlab_com/index.md
index c9fbd7effa0..d21a325d401 100644
--- a/doc/user/gitlab_com/index.md
+++ b/doc/user/gitlab_com/index.md
@@ -112,57 +112,6 @@ Below are the shared Runners settings.
 
 The full contents of our `config.toml` are:
 
-**DigitalOcean**
-
-```toml
-concurrent = X
-check_interval = 1
-metrics_server = "X"
-sentry_dsn = "X"
-
-[[runners]]
-  name = "docker-auto-scale"
-  request_concurrency = X
-  url = "https://gitlab.com/"
-  token = "SHARED_RUNNER_TOKEN"
-  executor = "docker+machine"
-  environment = [
-    "DOCKER_DRIVER=overlay2"
-  ]
-  limit = X
-  [runners.docker]
-    image = "ruby:2.5"
-    privileged = true
-  [runners.machine]
-    IdleCount = 20
-    IdleTime = 1800
-    OffPeakPeriods = ["* * * * * sat,sun *"]
-    OffPeakTimezone = "UTC"
-    OffPeakIdleCount = 5
-    OffPeakIdleTime = 1800
-    MaxBuilds = 1
-    MachineName = "srm-%s"
-    MachineDriver = "digitalocean"
-    MachineOptions = [
-      "digitalocean-image=X",
-      "digitalocean-ssh-user=core",
-      "digitalocean-region=nyc1",
-      "digitalocean-size=s-2vcpu-2gb",
-      "digitalocean-private-networking",
-      "digitalocean-tags=shared_runners,gitlab_com",
-      "engine-registry-mirror=http://INTERNAL_IP_OF_OUR_REGISTRY_MIRROR",
-      "digitalocean-access-token=DIGITAL_OCEAN_ACCESS_TOKEN",
-    ]
-  [runners.cache]
-    Type = "s3"
-    BucketName = "runner"
-    Insecure = true
-    Shared = true
-    ServerAddress = "INTERNAL_IP_OF_OUR_CACHE_SERVER"
-    AccessKey = "ACCESS_KEY"
-    SecretKey = "ACCESS_SECRET_KEY"
-```
-
 **Google Cloud Platform**
 
 ```toml
@@ -178,20 +127,25 @@ sentry_dsn = "X"
   token = "SHARED_RUNNER_TOKEN"
   executor = "docker+machine"
   environment = [
-    "DOCKER_DRIVER=overlay2"
+    "DOCKER_DRIVER=overlay2",
+    "DOCKER_TLS_CERTDIR="
   ]
   limit = X
   [runners.docker]
     image = "ruby:2.5"
     privileged = true
+    volumes = [
+      "/certs/client",
+      "/dummy-sys-class-dmi-id:/sys/class/dmi/id:ro" # Make kaniko builds work on GCP.
+    ]
   [runners.machine]
-    IdleCount = 20
-    IdleTime = 1800
+    IdleCount = 50
+    IdleTime = 3600
     OffPeakPeriods = ["* * * * * sat,sun *"]
     OffPeakTimezone = "UTC"
-    OffPeakIdleCount = 5
-    OffPeakIdleTime = 1800
-    MaxBuilds = 1
+    OffPeakIdleCount = 15
+    OffPeakIdleTime = 3600
+    MaxBuilds = 1 # For security reasons we delete the VM after job has finished so it's not reused.
     MachineName = "srm-%s"
     MachineDriver = "google"
     MachineOptions = [
@@ -202,17 +156,18 @@ sentry_dsn = "X"
       "google-tags=gitlab-com,srm",
       "google-use-internal-ip",
       "google-zone=us-east1-d",
+      "engine-opt=mtu=1460", # Set MTU for container interface, for more information check https://gitlab.com/gitlab-org/gitlab-runner/issues/3214#note_82892928
       "google-machine-image=PROJECT/global/images/IMAGE",
-      "engine-registry-mirror=http://INTERNAL_IP_OF_OUR_REGISTRY_MIRROR"
+      "engine-opt=ipv6", # This will create IPv6 interfaces in the containers.
+      "engine-opt=fixed-cidr-v6=fc00::/7",
+      "google-operation-backoff-initial-interval=2" # Custom flag from forked docker-machine, for more information check https://github.com/docker/machine/pull/4600
     ]
   [runners.cache]
-    Type = "s3"
-    BucketName = "runner"
-    Insecure = true
+    Type = "gcs"
     Shared = true
-    ServerAddress = "INTERNAL_IP_OF_OUR_CACHE_SERVER"
-    AccessKey = "ACCESS_KEY"
-    SecretKey = "ACCESS_SECRET_KEY"
+    [runners.cache.gcs]
+      CredentialsFile = "/path/to/file"
+      BucketName = "bucket-name"
 ```
 
 ## Sidekiq
-- 
cgit v1.2.1


From 5a574883f95373e13f663568eb4710c9d69d00d6 Mon Sep 17 00:00:00 2001
From: Nick Thomas <nick@gitlab.com>
Date: Mon, 12 Aug 2019 11:29:10 +0100
Subject: Remove MySQL references from development docs

I noticed the doc/development/testing_guide/best_practices.md still
referenced the `[run mysql]` tags, etc. They no longer work, so I
removed them, then realised I had better clean up the rest of
doc/development !
---
 doc/development/architecture.md                    | 22 ++++++++--------
 doc/development/hash_indexes.md                    |  2 +-
 doc/development/rake_tasks.md                      |  2 +-
 doc/development/sha1_as_binary.md                  |  2 +-
 doc/development/sql.md                             | 30 +++++++---------------
 doc/development/testing_guide/best_practices.md    | 10 --------
 doc/development/testing_guide/ci.md                |  1 -
 doc/development/testing_guide/flaky_tests.md       |  4 +--
 doc/development/verifying_database_capabilities.md |  8 +++---
 doc/development/what_requires_downtime.md          | 25 ++++--------------
 10 files changed, 34 insertions(+), 72 deletions(-)

diff --git a/doc/development/architecture.md b/doc/development/architecture.md
index 87405bc2fec..5cb2ddf6e52 100644
--- a/doc/development/architecture.md
+++ b/doc/development/architecture.md
@@ -20,7 +20,7 @@ A typical install of GitLab will be on GNU/Linux. It uses Nginx or Apache as a w
 
 We also support deploying GitLab on Kubernetes using our [gitlab Helm chart](https://docs.gitlab.com/charts/).
 
-The GitLab web app uses MySQL or PostgreSQL for persistent database information (e.g. users, permissions, issues, other meta data). GitLab stores the bare git repositories it serves in `/home/git/repositories` by default. It also keeps default branch and hook information with the bare repository.
+The GitLab web app uses PostgreSQL for persistent database information (e.g. users, permissions, issues, other meta data). GitLab stores the bare git repositories it serves in `/home/git/repositories` by default. It also keeps default branch and hook information with the bare repository.
 
 When serving repositories over HTTP/HTTPS GitLab utilizes the GitLab API to resolve authorization and access as well as serving git objects.
 
@@ -511,7 +511,15 @@ To summarize here's the [directory structure of the `git` user home directory](.
 ps aux | grep '^git'
 ```
 
-GitLab has several components to operate. As a system user (i.e. any user that is not the `git` user) it requires a persistent database (MySQL/PostreSQL) and redis database. It also uses Apache httpd or Nginx to proxypass Unicorn. As the `git` user it starts Sidekiq and Unicorn (a simple ruby HTTP server running on port `8080` by default). Under the GitLab user there are normally 4 processes: `unicorn_rails master` (1 process), `unicorn_rails worker` (2 processes), `sidekiq` (1 process).
+GitLab has several components to operate. It requires a persistent database
+(PostgreSQL) and redis database, and uses Apache httpd or Nginx to proxypass
+Unicorn. All these components should run as different system users to GitLab
+(e.g., `postgres`, `redis` and `www-data`, instead of `git`).
+
+As the `git` user it starts Sidekiq and Unicorn (a simple ruby HTTP server
+running on port `8080` by default). Under the GitLab user there are normally 4
+processes: `unicorn_rails master` (1 process), `unicorn_rails worker`
+(2 processes), `sidekiq` (1 process).
 
 ### Repository access
 
@@ -554,12 +562,9 @@ $ /etc/init.d/nginx
 Usage: nginx {start|stop|restart|reload|force-reload|status|configtest}
 ```
 
-Persistent database (one of the following)
+Persistent database
 
 ```
-/etc/init.d/mysqld
-Usage: /etc/init.d/mysqld {start|stop|status|restart|condrestart|try-restart|reload|force-reload}
-
 $ /etc/init.d/postgresql
 Usage: /etc/init.d/postgresql {start|stop|restart|reload|force-reload|status} [version ..]
 ```
@@ -597,11 +602,6 @@ PostgreSQL
 
 - `/var/log/postgresql/*`
 
-MySQL
-
-- `/var/log/mysql/*`
-- `/var/log/mysql.*`
-
 ### GitLab specific config files
 
 GitLab has configuration files located in `/home/git/gitlab/config/*`. Commonly referenced config files include:
diff --git a/doc/development/hash_indexes.md b/doc/development/hash_indexes.md
index e6c1b3590b1..417ea18e22f 100644
--- a/doc/development/hash_indexes.md
+++ b/doc/development/hash_indexes.md
@@ -1,6 +1,6 @@
 # Hash Indexes
 
-Both PostgreSQL and MySQL support hash indexes besides the regular btree
+PostgreSQL supports hash indexes besides the regular btree
 indexes. Hash indexes however are to be avoided at all costs. While they may
 _sometimes_ provide better performance the cost of rehashing can be very high.
 More importantly: at least until PostgreSQL 10.0 hash indexes are not
diff --git a/doc/development/rake_tasks.md b/doc/development/rake_tasks.md
index c97e179910b..e9d6cfe00b2 100644
--- a/doc/development/rake_tasks.md
+++ b/doc/development/rake_tasks.md
@@ -9,7 +9,7 @@ bundle exec rake setup
 ```
 
 The `setup` task is an alias for `gitlab:setup`.
-This tasks calls `db:reset` to create the database, calls `add_limits_mysql` that adds limits to the database schema in case of a MySQL database and finally it calls `db:seed_fu` to seed the database.
+This tasks calls `db:reset` to create the database, and calls `db:seed_fu` to seed the database.
 Note: `db:setup` calls `db:seed` but this does nothing.
 
 ### Seeding issues for all or a given project
diff --git a/doc/development/sha1_as_binary.md b/doc/development/sha1_as_binary.md
index 3151cc29bbc..6c4252ec634 100644
--- a/doc/development/sha1_as_binary.md
+++ b/doc/development/sha1_as_binary.md
@@ -2,7 +2,7 @@
 
 Storing SHA1 hashes as strings is not very space efficient. A SHA1 as a string
 requires at least 40 bytes, an additional byte to store the encoding, and
-perhaps more space depending on the internals of PostgreSQL and MySQL.
+perhaps more space depending on the internals of PostgreSQL.
 
 On the other hand, if one were to store a SHA1 as binary one would only need 20
 bytes for the actual SHA1, and 1 or 4 bytes of additional space (again depending
diff --git a/doc/development/sql.md b/doc/development/sql.md
index a256fd46c09..2584dcfb4ca 100644
--- a/doc/development/sql.md
+++ b/doc/development/sql.md
@@ -15,14 +15,11 @@ FROM issues
 WHERE title LIKE 'WIP:%';
 ```
 
-On PostgreSQL the `LIKE` statement is case-sensitive. On MySQL this depends on
-the case-sensitivity of the collation, which is usually case-insensitive. To
-perform a case-insensitive `LIKE` on PostgreSQL you have to use `ILIKE` instead.
-This statement in turn isn't supported on MySQL.
+On PostgreSQL the `LIKE` statement is case-sensitive. To perform a case-insensitive
+`LIKE` you have to use `ILIKE` instead.
 
-To work around this problem you should write `LIKE` queries using Arel instead
-of raw SQL fragments as Arel automatically uses `ILIKE` on PostgreSQL and `LIKE`
-on MySQL. This means that instead of this:
+To handle this automatically you should use `LIKE` queries using Arel instead
+of raw SQL fragments, as Arel automatically uses `ILIKE` on PostgreSQL.
 
 ```ruby
 Issue.where('title LIKE ?', 'WIP:%')
@@ -45,7 +42,7 @@ table = Issue.arel_table
 Issue.where(table[:title].matches('WIP:%').or(table[:foo].matches('WIP:%')))
 ```
 
-For PostgreSQL this produces:
+On PostgreSQL, this produces:
 
 ```sql
 SELECT *
@@ -53,18 +50,10 @@ FROM issues
 WHERE (title ILIKE 'WIP:%' OR foo ILIKE 'WIP:%')
 ```
 
-In turn for MySQL this produces:
-
-```sql
-SELECT *
-FROM issues
-WHERE (title LIKE 'WIP:%' OR foo LIKE 'WIP:%')
-```
-
 ## LIKE & Indexes
 
-Neither PostgreSQL nor MySQL use any indexes when using `LIKE` / `ILIKE` with a
-wildcard at the start. For example, this will not use any indexes:
+PostgreSQL won't use any indexes when using `LIKE` / `ILIKE` with a wildcard at
+the start. For example, this will not use any indexes:
 
 ```sql
 SELECT *
@@ -75,9 +64,8 @@ WHERE title ILIKE '%WIP:%';
 Because the value for `ILIKE` starts with a wildcard the database is not able to
 use an index as it doesn't know where to start scanning the indexes.
 
-MySQL provides no known solution to this problem. Luckily PostgreSQL _does_
-provide a solution: trigram GIN indexes. These indexes can be created as
-follows:
+Luckily, PostgreSQL _does_ provide a solution: trigram GIN indexes. These
+indexes can be created as follows:
 
 ```sql
 CREATE INDEX [CONCURRENTLY] index_name_here
diff --git a/doc/development/testing_guide/best_practices.md b/doc/development/testing_guide/best_practices.md
index 448d9fd01c4..a505d3c79a2 100644
--- a/doc/development/testing_guide/best_practices.md
+++ b/doc/development/testing_guide/best_practices.md
@@ -15,16 +15,6 @@ manifest themselves within our code. When designing our tests, take time to revi
 our test design. We can find some helpful heuristics documented in the Handbook in the
 [Test Design](https://about.gitlab.com/handbook/engineering/quality/guidelines/test-engineering/test-design/) section.
 
-## Run tests against MySQL
-
-By default, tests are only run against PostgreSQL, but you can run them on
-demand against MySQL by following one of the following conventions:
-
-| Convention           | Valid example                |
-|:----------------------|:-----------------------------|
-| Include `mysql` in your branch name | `enhance-mysql-support` |
-| Include `[run mysql]` in your commit message   | `Fix MySQL support<br><br>[run mysql]` |
-
 ## Test speed
 
 GitLab has a massive test suite that, without [parallelization], can take hours
diff --git a/doc/development/testing_guide/ci.md b/doc/development/testing_guide/ci.md
index 87d48726268..d9f66a827de 100644
--- a/doc/development/testing_guide/ci.md
+++ b/doc/development/testing_guide/ci.md
@@ -39,7 +39,6 @@ slowest test files and try to improve them.
 
 ## CI setup
 
-- On CE and EE, the test suite runs both PostgreSQL and MySQL.
 - Rails logging to `log/test.log` is disabled by default in CI [for
   performance reasons][logging]. To override this setting, provide the
   `RAILS_ENABLE_TEST_LOG` environment variable.
diff --git a/doc/development/testing_guide/flaky_tests.md b/doc/development/testing_guide/flaky_tests.md
index 931cbc51cae..eb0bf6fc563 100644
--- a/doc/development/testing_guide/flaky_tests.md
+++ b/doc/development/testing_guide/flaky_tests.md
@@ -35,8 +35,8 @@ Once a test is in quarantine, there are 3 choices:
 
 Quarantined tests are run on the CI in dedicated jobs that are allowed to fail:
 
-- `rspec-pg-quarantine` and `rspec-mysql-quarantine` (CE & EE)
-- `rspec-pg-quarantine-ee` and `rspec-mysql-quarantine-ee` (EE only)
+- `rspec-pg-quarantine` (CE & EE)
+- `rspec-pg-quarantine-ee` (EE only)
 
 ## Automatic retries and flaky tests detection
 
diff --git a/doc/development/verifying_database_capabilities.md b/doc/development/verifying_database_capabilities.md
index ccec6f7d719..6b4995aebe2 100644
--- a/doc/development/verifying_database_capabilities.md
+++ b/doc/development/verifying_database_capabilities.md
@@ -1,15 +1,15 @@
 # Verifying Database Capabilities
 
-Sometimes certain bits of code may only work on a certain database and/or
+Sometimes certain bits of code may only work on a certain database
 version. While we try to avoid such code as much as possible sometimes it is
 necessary to add database (version) specific behaviour.
 
 To facilitate this we have the following methods that you can use:
 
-- `Gitlab::Database.postgresql?`: returns `true` if PostgreSQL is being used
-- `Gitlab::Database.mysql?`: returns `true` if MySQL is being used
+- `Gitlab::Database.postgresql?`: returns `true` if PostgreSQL is being used.
+  You can normally just assume this is the case.
 - `Gitlab::Database.version`: returns the PostgreSQL version number as a string
-  in the format `X.Y.Z`. This method does not work for MySQL
+  in the format `X.Y.Z`.
 
 This allows you to write code such as:
 
diff --git a/doc/development/what_requires_downtime.md b/doc/development/what_requires_downtime.md
index f0da1cc2ddc..944bf5900c5 100644
--- a/doc/development/what_requires_downtime.md
+++ b/doc/development/what_requires_downtime.md
@@ -7,9 +7,8 @@ downtime.
 
 ## Adding Columns
 
-On PostgreSQL you can safely add a new column to an existing table as long as it
-does **not** have a default value. For example, this query would not require
-downtime:
+You can safely add a new column to an existing table as long as it does **not**
+have a default value. For example, this query would not require downtime:
 
 ```sql
 ALTER TABLE projects ADD COLUMN random_value int;
@@ -27,11 +26,6 @@ This requires updating every single row in the `projects` table so that
 indexes in a table. This in turn acquires enough locks on the table for it to
 effectively block any other queries.
 
-As of MySQL 5.6 adding a column to a table is still quite an expensive
-operation, even when using `ALGORITHM=INPLACE` and `LOCK=NONE`. This means
-downtime _may_ be required when modifying large tables as otherwise the
-operation could potentially take hours to complete.
-
 Adding a column with a default value _can_ be done without requiring downtime
 when using the migration helper method
 `Gitlab::Database::MigrationHelpers#add_column_with_default`. This method works
@@ -311,8 +305,7 @@ migrations](background_migrations.md#cleaning-up).
 ## Adding Indexes
 
 Adding indexes is an expensive process that blocks INSERT and UPDATE queries for
-the duration. When using PostgreSQL one can work around this by using the
-`CONCURRENTLY` option:
+the duration. You can work around this by using the `CONCURRENTLY` option:
 
 ```sql
 CREATE INDEX CONCURRENTLY index_name ON projects (column_name);
@@ -336,17 +329,9 @@ end
 Note that `add_concurrent_index` can not be reversed automatically, thus you
 need to manually define `up` and `down`.
 
-When running this on PostgreSQL the `CONCURRENTLY` option mentioned above is
-used. On MySQL this method produces a regular `CREATE INDEX` query.
-
-MySQL doesn't really have a workaround for this. Supposedly it _can_ create
-indexes without the need for downtime but only for variable width columns. The
-details on this are a bit sketchy. Since it's better to be safe than sorry one
-should assume that adding indexes requires downtime on MySQL.
-
 ## Dropping Indexes
 
-Dropping an index does not require downtime on both PostgreSQL and MySQL.
+Dropping an index does not require downtime.
 
 ## Adding Tables
 
@@ -370,7 +355,7 @@ transaction this means this approach would require downtime.
 
 GitLab allows you to work around this by using
 `Gitlab::Database::MigrationHelpers#add_concurrent_foreign_key`. This method
-ensures that when PostgreSQL is used no downtime is needed.
+ensures that no downtime is needed.
 
 ## Removing Foreign Keys
 
-- 
cgit v1.2.1


From 3488da59363a5edfbf431a37ba59247b836bc50a Mon Sep 17 00:00:00 2001
From: Jarek Ostrowski <jarek.j.ostrowski@gmail.com>
Date: Fri, 16 Aug 2019 10:27:11 -0400
Subject: Add expand up and expand down icons

Add changelog
Add MR to changelog
Remove stray file
---
 app/assets/javascripts/diffs/components/diff_expansion_cell.vue | 6 ++----
 changelogs/unreleased/66161-replace-expand-icons.yml            | 5 +++++
 2 files changed, 7 insertions(+), 4 deletions(-)
 create mode 100644 changelogs/unreleased/66161-replace-expand-icons.yml

diff --git a/app/assets/javascripts/diffs/components/diff_expansion_cell.vue b/app/assets/javascripts/diffs/components/diff_expansion_cell.vue
index 925385fa98a..43edc116ed1 100644
--- a/app/assets/javascripts/diffs/components/diff_expansion_cell.vue
+++ b/app/assets/javascripts/diffs/components/diff_expansion_cell.vue
@@ -223,8 +223,7 @@ export default {
         :title="__('Expand up')"
         @click="handleExpandLines(EXPAND_UP)"
       >
-        <!-- TODO: remove style & replace with correct icon, waiting for MR https://gitlab.com/gitlab-org/gitlab-design/issues/499 -->
-        <icon :size="12" name="expand-left" aria-hidden="true" style="transform: rotate(270deg);" />
+        <icon :size="12" name="expand-up" aria-hidden="true" />
       </a>
       <a class="mx-2 cursor-pointer js-unfold-all" @click="handleExpandLines()">
         <span>{{ s__('Diffs|Show all lines') }}</span>
@@ -238,8 +237,7 @@ export default {
         :title="__('Expand down')"
         @click="handleExpandLines(EXPAND_DOWN)"
       >
-        <!-- TODO: remove style & replace with correct icon, waiting for MR https://gitlab.com/gitlab-org/gitlab-design/issues/499 -->
-        <icon :size="12" name="expand-left" aria-hidden="true" style="transform: rotate(90deg);" />
+        <icon :size="12" name="expand-down" aria-hidden="true" />
       </a>
     </div>
   </td>
diff --git a/changelogs/unreleased/66161-replace-expand-icons.yml b/changelogs/unreleased/66161-replace-expand-icons.yml
new file mode 100644
index 00000000000..e28e01108a8
--- /dev/null
+++ b/changelogs/unreleased/66161-replace-expand-icons.yml
@@ -0,0 +1,5 @@
+---
+title: Replaced expand diff icons
+merge_request: 31907
+author:
+type: changed
-- 
cgit v1.2.1


From 0eff75fa2b6691b6fba31fcc2842f51debd249a9 Mon Sep 17 00:00:00 2001
From: Nick Thomas <nick@gitlab.com>
Date: Mon, 8 Jul 2019 17:11:59 +0100
Subject: Cache branch and tag names as Redis sets

This allows us to check inclusion for the *_exists? methods without
downloading the full list of branch names, which is over 100KiB in size
for gitlab-ce at the moment.
---
 app/models/repository.rb                           | 12 ++--
 .../unreleased/64251-branch-name-set-cache.yml     |  5 ++
 lib/gitlab/repository_cache_adapter.rb             | 53 ++++++++++++++++
 lib/gitlab/repository_set_cache.rb                 | 67 ++++++++++++++++++++
 spec/lib/gitlab/repository_cache_adapter_spec.rb   |  7 ++-
 spec/lib/gitlab/repository_set_cache_spec.rb       | 73 ++++++++++++++++++++++
 spec/models/repository_spec.rb                     | 52 +++++++++++----
 7 files changed, 252 insertions(+), 17 deletions(-)
 create mode 100644 changelogs/unreleased/64251-branch-name-set-cache.yml
 create mode 100644 lib/gitlab/repository_set_cache.rb
 create mode 100644 spec/lib/gitlab/repository_set_cache_spec.rb

diff --git a/app/models/repository.rb b/app/models/repository.rb
index 9d45a12fa6e..561c6579086 100644
--- a/app/models/repository.rb
+++ b/app/models/repository.rb
@@ -239,13 +239,13 @@ class Repository
   def branch_exists?(branch_name)
     return false unless raw_repository
 
-    branch_names.include?(branch_name)
+    branch_names_include?(branch_name)
   end
 
   def tag_exists?(tag_name)
     return false unless raw_repository
 
-    tag_names.include?(tag_name)
+    tag_names_include?(tag_name)
   end
 
   def ref_exists?(ref)
@@ -561,10 +561,10 @@ class Repository
   end
 
   delegate :branch_names, to: :raw_repository
-  cache_method :branch_names, fallback: []
+  cache_method_as_redis_set :branch_names, fallback: []
 
   delegate :tag_names, to: :raw_repository
-  cache_method :tag_names, fallback: []
+  cache_method_as_redis_set :tag_names, fallback: []
 
   delegate :branch_count, :tag_count, :has_visible_content?, to: :raw_repository
   cache_method :branch_count, fallback: 0
@@ -1126,6 +1126,10 @@ class Repository
     @cache ||= Gitlab::RepositoryCache.new(self)
   end
 
+  def redis_set_cache
+    @redis_set_cache ||= Gitlab::RepositorySetCache.new(self)
+  end
+
   def request_store_cache
     @request_store_cache ||= Gitlab::RepositoryCache.new(self, backend: Gitlab::SafeRequestStore)
   end
diff --git a/changelogs/unreleased/64251-branch-name-set-cache.yml b/changelogs/unreleased/64251-branch-name-set-cache.yml
new file mode 100644
index 00000000000..6ce4bdf5e43
--- /dev/null
+++ b/changelogs/unreleased/64251-branch-name-set-cache.yml
@@ -0,0 +1,5 @@
+---
+title: Cache branch and tag names as Redis sets
+merge_request: 30476
+author:
+type: performance
diff --git a/lib/gitlab/repository_cache_adapter.rb b/lib/gitlab/repository_cache_adapter.rb
index e40c366ed02..75503ee1789 100644
--- a/lib/gitlab/repository_cache_adapter.rb
+++ b/lib/gitlab/repository_cache_adapter.rb
@@ -23,6 +23,37 @@ module Gitlab
         end
       end
 
+      # Caches and strongly memoizes the method as a Redis Set.
+      #
+      # This only works for methods that do not take any arguments. The method
+      # should return an Array of Strings to be cached.
+      #
+      # In addition to overriding the named method, a "name_include?" method is
+      # defined. This uses the "SISMEMBER" query to efficiently check membership
+      # without needing to load the entire set into memory.
+      #
+      # name     - The name of the method to be cached.
+      # fallback - A value to fall back to if the repository does not exist, or
+      #            in case of a Git error. Defaults to nil.
+      def cache_method_as_redis_set(name, fallback: nil)
+        uncached_name = alias_uncached_method(name)
+
+        define_method(name) do
+          cache_method_output_as_redis_set(name, fallback: fallback) do
+            __send__(uncached_name) # rubocop:disable GitlabSecurity/PublicSend
+          end
+        end
+
+        define_method("#{name}_include?") do |value|
+          # If the cache isn't populated, we can't rely on it
+          return redis_set_cache.include?(name, value) if redis_set_cache.exist?(name)
+
+          # Since we have to pull all branch names to populate the cache, use
+          # the data we already have to answer the query just this once
+          __send__(name).include?(value) # rubocop:disable GitlabSecurity/PublicSend
+        end
+      end
+
       # Caches truthy values from the method. All values are strongly memoized,
       # and cached in RequestStore.
       #
@@ -84,6 +115,11 @@ module Gitlab
       raise NotImplementedError
     end
 
+    # RepositorySetCache to be used. Should be overridden by the including class
+    def redis_set_cache
+      raise NotImplementedError
+    end
+
     # List of cached methods. Should be overridden by the including class
     def cached_methods
       raise NotImplementedError
@@ -100,6 +136,18 @@ module Gitlab
       end
     end
 
+    # Caches and strongly memoizes the supplied block as a Redis Set. The result
+    # will be provided as a sorted array.
+    #
+    # name     - The name of the method to be cached.
+    # fallback - A value to fall back to if the repository does not exist, or
+    #            in case of a Git error. Defaults to nil.
+    def cache_method_output_as_redis_set(name, fallback: nil, &block)
+      memoize_method_output(name, fallback: fallback) do
+        redis_set_cache.fetch(name, &block).sort
+      end
+    end
+
     # Caches truthy values from the supplied block. All values are strongly
     # memoized, and cached in RequestStore.
     #
@@ -154,6 +202,7 @@ module Gitlab
         clear_memoization(memoizable_name(name))
       end
 
+      expire_redis_set_method_caches(methods)
       expire_request_store_method_caches(methods)
     end
 
@@ -169,6 +218,10 @@ module Gitlab
       end
     end
 
+    def expire_redis_set_method_caches(methods)
+      methods.each { |name| redis_set_cache.expire(name) }
+    end
+
     # All cached repository methods depend on the existence of a Git repository,
     # so if the repository doesn't exist, we already know not to call it.
     def fallback_early?(method_name)
diff --git a/lib/gitlab/repository_set_cache.rb b/lib/gitlab/repository_set_cache.rb
new file mode 100644
index 00000000000..fb634328a95
--- /dev/null
+++ b/lib/gitlab/repository_set_cache.rb
@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+# Interface to the Redis-backed cache store for keys that use a Redis set
+module Gitlab
+  class RepositorySetCache
+    attr_reader :repository, :namespace, :expires_in
+
+    def initialize(repository, extra_namespace: nil, expires_in: 2.weeks)
+      @repository = repository
+      @namespace = "#{repository.full_path}:#{repository.project.id}"
+      @namespace = "#{@namespace}:#{extra_namespace}" if extra_namespace
+      @expires_in = expires_in
+    end
+
+    def cache_key(type)
+      [type, namespace, 'set'].join(':')
+    end
+
+    def expire(key)
+      with { |redis| redis.del(cache_key(key)) }
+    end
+
+    def exist?(key)
+      with { |redis| redis.exists(cache_key(key)) }
+    end
+
+    def read(key)
+      with { |redis| redis.smembers(cache_key(key)) }
+    end
+
+    def write(key, value)
+      full_key = cache_key(key)
+
+      with do |redis|
+        redis.multi do
+          redis.del(full_key)
+
+          # Splitting into groups of 1000 prevents us from creating a too-long
+          # Redis command
+          value.in_groups_of(1000, false) { |subset| redis.sadd(full_key, subset) }
+
+          redis.expire(full_key, expires_in)
+        end
+      end
+
+      value
+    end
+
+    def fetch(key, &block)
+      if exist?(key)
+        read(key)
+      else
+        write(key, yield)
+      end
+    end
+
+    def include?(key, value)
+      with { |redis| redis.sismember(cache_key(key), value) }
+    end
+
+    private
+
+    def with(&blk)
+      Gitlab::Redis::Cache.with(&blk) # rubocop:disable CodeReuse/ActiveRecord
+    end
+  end
+end
diff --git a/spec/lib/gitlab/repository_cache_adapter_spec.rb b/spec/lib/gitlab/repository_cache_adapter_spec.rb
index 0295138fc3a..04fc24b6205 100644
--- a/spec/lib/gitlab/repository_cache_adapter_spec.rb
+++ b/spec/lib/gitlab/repository_cache_adapter_spec.rb
@@ -4,6 +4,7 @@ describe Gitlab::RepositoryCacheAdapter do
   let(:project) { create(:project, :repository) }
   let(:repository) { project.repository }
   let(:cache) { repository.send(:cache) }
+  let(:redis_set_cache) { repository.send(:redis_set_cache) }
 
   describe '#cache_method_output', :use_clean_rails_memory_store_caching do
     let(:fallback) { 10 }
@@ -206,9 +207,11 @@ describe Gitlab::RepositoryCacheAdapter do
   describe '#expire_method_caches' do
     it 'expires the caches of the given methods' do
       expect(cache).to receive(:expire).with(:rendered_readme)
-      expect(cache).to receive(:expire).with(:gitignore)
+      expect(cache).to receive(:expire).with(:branch_names)
+      expect(redis_set_cache).to receive(:expire).with(:rendered_readme)
+      expect(redis_set_cache).to receive(:expire).with(:branch_names)
 
-      repository.expire_method_caches(%i(rendered_readme gitignore))
+      repository.expire_method_caches(%i(rendered_readme branch_names))
     end
 
     it 'does not expire caches for non-existent methods' do
diff --git a/spec/lib/gitlab/repository_set_cache_spec.rb b/spec/lib/gitlab/repository_set_cache_spec.rb
new file mode 100644
index 00000000000..9695e13d842
--- /dev/null
+++ b/spec/lib/gitlab/repository_set_cache_spec.rb
@@ -0,0 +1,73 @@
+require 'spec_helper'
+
+describe Gitlab::RepositorySetCache, :clean_gitlab_redis_cache do
+  let(:project) { create(:project) }
+  let(:repository) { project.repository }
+  let(:namespace) { "#{repository.full_path}:#{project.id}" }
+  let(:cache) { described_class.new(repository) }
+
+  describe '#cache_key' do
+    subject { cache.cache_key(:foo) }
+
+    it 'includes the namespace' do
+      is_expected.to eq("foo:#{namespace}:set")
+    end
+
+    context 'with a given namespace' do
+      let(:extra_namespace) { 'my:data' }
+      let(:cache) { described_class.new(repository, extra_namespace: extra_namespace) }
+
+      it 'includes the full namespace' do
+        is_expected.to eq("foo:#{namespace}:#{extra_namespace}:set")
+      end
+    end
+  end
+
+  describe '#expire' do
+    it 'expires the given key from the cache' do
+      cache.write(:foo, ['value'])
+
+      expect(cache.read(:foo)).to contain_exactly('value')
+      expect(cache.expire(:foo)).to eq(1)
+      expect(cache.read(:foo)).to be_empty
+    end
+  end
+
+  describe '#exist?' do
+    it 'checks whether the key exists' do
+      expect(cache.exist?(:foo)).to be(false)
+
+      cache.write(:foo, ['value'])
+
+      expect(cache.exist?(:foo)).to be(true)
+    end
+  end
+
+  describe '#fetch' do
+    let(:blk) { -> { ['block value'] } }
+
+    subject { cache.fetch(:foo, &blk) }
+
+    it 'fetches the key from the cache when filled' do
+      cache.write(:foo, ['value'])
+
+      is_expected.to contain_exactly('value')
+    end
+
+    it 'writes the value of the provided block when empty' do
+      cache.expire(:foo)
+
+      is_expected.to contain_exactly('block value')
+      expect(cache.read(:foo)).to contain_exactly('block value')
+    end
+  end
+
+  describe '#include?' do
+    it 'checks inclusion in the Redis set' do
+      cache.write(:foo, ['value'])
+
+      expect(cache.include?(:foo, 'value')).to be(true)
+      expect(cache.include?(:foo, 'bar')).to be(false)
+    end
+  end
+end
diff --git a/spec/models/repository_spec.rb b/spec/models/repository_spec.rb
index e68de2e73a8..423334c66f2 100644
--- a/spec/models/repository_spec.rb
+++ b/spec/models/repository_spec.rb
@@ -1223,36 +1223,66 @@ describe Repository do
   end
 
   describe '#branch_exists?' do
-    it 'uses branch_names' do
-      allow(repository).to receive(:branch_names).and_return(['foobar'])
+    let(:branch) { repository.root_ref }
 
-      expect(repository.branch_exists?('foobar')).to eq(true)
-      expect(repository.branch_exists?('master')).to eq(false)
+    subject { repository.branch_exists?(branch) }
+
+    it 'delegates to branch_names when the cache is empty' do
+      repository.expire_branches_cache
+
+      expect(repository).to receive(:branch_names).and_call_original
+      is_expected.to eq(true)
+    end
+
+    it 'uses redis set caching when the cache is filled' do
+      repository.branch_names # ensure the branch name cache is filled
+
+      expect(repository)
+        .to receive(:branch_names_include?)
+        .with(branch)
+        .and_call_original
+
+      is_expected.to eq(true)
     end
   end
 
   describe '#tag_exists?' do
-    it 'uses tag_names' do
-      allow(repository).to receive(:tag_names).and_return(['foobar'])
+    let(:tag) { repository.tags.first.name }
+
+    subject { repository.tag_exists?(tag) }
+
+    it 'delegates to tag_names when the cache is empty' do
+      repository.expire_tags_cache
+
+      expect(repository).to receive(:tag_names).and_call_original
+      is_expected.to eq(true)
+    end
+
+    it 'uses redis set caching when the cache is filled' do
+      repository.tag_names # ensure the tag name cache is filled
+
+      expect(repository)
+        .to receive(:tag_names_include?)
+        .with(tag)
+        .and_call_original
 
-      expect(repository.tag_exists?('foobar')).to eq(true)
-      expect(repository.tag_exists?('master')).to eq(false)
+      is_expected.to eq(true)
     end
   end
 
-  describe '#branch_names', :use_clean_rails_memory_store_caching do
+  describe '#branch_names', :clean_gitlab_redis_cache do
     let(:fake_branch_names) { ['foobar'] }
 
     it 'gets cached across Repository instances' do
       allow(repository.raw_repository).to receive(:branch_names).once.and_return(fake_branch_names)
 
-      expect(repository.branch_names).to eq(fake_branch_names)
+      expect(repository.branch_names).to match_array(fake_branch_names)
 
       fresh_repository = Project.find(project.id).repository
       expect(fresh_repository.object_id).not_to eq(repository.object_id)
 
       expect(fresh_repository.raw_repository).not_to receive(:branch_names)
-      expect(fresh_repository.branch_names).to eq(fake_branch_names)
+      expect(fresh_repository.branch_names).to match_array(fake_branch_names)
     end
   end
 
-- 
cgit v1.2.1


From 71691d935e849196cb93e0be101ecbd3e9c245ef Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Fri, 16 Aug 2019 17:56:33 +0200
Subject: Count comments on notes and merge requests

This extends our existing `Gitlab::UsageDataCounters::NoteCounter` to
also count notes on commits and merge requests
---
 .../unreleased/bvl-mr-commit-note-counter.yml      |  5 +++++
 lib/gitlab/usage_data_counters/note_counter.rb     |  8 ++++----
 .../usage_data_counters/note_counter_spec.rb       | 24 +++++++++++++++-------
 spec/lib/gitlab/usage_data_spec.rb                 | 10 ++++++---
 4 files changed, 33 insertions(+), 14 deletions(-)
 create mode 100644 changelogs/unreleased/bvl-mr-commit-note-counter.yml

diff --git a/changelogs/unreleased/bvl-mr-commit-note-counter.yml b/changelogs/unreleased/bvl-mr-commit-note-counter.yml
new file mode 100644
index 00000000000..0e9becbd31e
--- /dev/null
+++ b/changelogs/unreleased/bvl-mr-commit-note-counter.yml
@@ -0,0 +1,5 @@
+---
+title: Count comments on commits and merge requests
+merge_request: 31912
+author:
+type: other
diff --git a/lib/gitlab/usage_data_counters/note_counter.rb b/lib/gitlab/usage_data_counters/note_counter.rb
index e93a0bcfa27..672450ec82b 100644
--- a/lib/gitlab/usage_data_counters/note_counter.rb
+++ b/lib/gitlab/usage_data_counters/note_counter.rb
@@ -4,7 +4,7 @@ module Gitlab::UsageDataCounters
   class NoteCounter < BaseCounter
     KNOWN_EVENTS = %w[create].freeze
     PREFIX = 'note'
-    COUNTABLE_TYPES = %w[Snippet].freeze
+    COUNTABLE_TYPES = %w[Snippet Commit MergeRequest].freeze
 
     class << self
       def redis_key(event, noteable_type)
@@ -24,9 +24,9 @@ module Gitlab::UsageDataCounters
       end
 
       def totals
-        {
-          snippet_comment: read(:create, 'Snippet')
-        }
+        COUNTABLE_TYPES.map do |countable_type|
+          [:"#{countable_type.underscore}_comment", read(:create, countable_type)]
+        end.to_h
       end
 
       private
diff --git a/spec/lib/gitlab/usage_data_counters/note_counter_spec.rb b/spec/lib/gitlab/usage_data_counters/note_counter_spec.rb
index 1669a22879f..b385d1b07c7 100644
--- a/spec/lib/gitlab/usage_data_counters/note_counter_spec.rb
+++ b/spec/lib/gitlab/usage_data_counters/note_counter_spec.rb
@@ -26,16 +26,22 @@ describe Gitlab::UsageDataCounters::NoteCounter, :clean_gitlab_redis_shared_stat
   end
 
   it_behaves_like 'a note usage counter', :create, 'Snippet'
+  it_behaves_like 'a note usage counter', :create, 'MergeRequest'
+  it_behaves_like 'a note usage counter', :create, 'Commit'
 
   describe '.totals' do
     let(:combinations) do
       [
-        [:create, 'Snippet', 3]
+        [:create, 'Snippet', 3],
+        [:create, 'MergeRequest', 4],
+        [:create, 'Commit', 5]
       ]
     end
 
     let(:expected_totals) do
-      { snippet_comment: 3 }
+      { snippet_comment: 3,
+        merge_request_comment: 4,
+        commit_comment:  5 }
     end
 
     before do
@@ -57,14 +63,18 @@ describe Gitlab::UsageDataCounters::NoteCounter, :clean_gitlab_redis_shared_stat
     let(:unknown_event_error) { Gitlab::UsageDataCounters::BaseCounter::UnknownEvent }
 
     where(:event, :noteable_type, :expected_count, :should_raise) do
-      :create | 'Snippet' | 1 | false
-      :wibble | 'Snippet' | 0 | true
-      :create | 'Issue'   | 0 | false
-      :wibble | 'Issue'   | 0 | false
+      :create | 'Snippet'      | 1 | false
+      :wibble | 'Snippet'      | 0 | true
+      :create | 'MergeRequest' | 1 | false
+      :wibble | 'MergeRequest' | 0 | true
+      :create | 'Commit'       | 1 | false
+      :wibble | 'Commit'       | 0 | true
+      :create | 'Issue'        | 0 | false
+      :wibble | 'Issue'        | 0 | false
     end
 
     with_them do
-      it "handles event" do
+      it 'handles event' do
         if should_raise
           expect { described_class.count(event, noteable_type) }.to raise_error(unknown_event_error)
         else
diff --git a/spec/lib/gitlab/usage_data_spec.rb b/spec/lib/gitlab/usage_data_spec.rb
index 588c68d1fb0..30b35f9cccd 100644
--- a/spec/lib/gitlab/usage_data_spec.rb
+++ b/spec/lib/gitlab/usage_data_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::UsageData do
@@ -34,7 +36,7 @@ describe Gitlab::UsageData do
 
     subject { described_class.data }
 
-    it "gathers usage data" do
+    it 'gathers usage data' do
       expect(subject.keys).to include(*%i(
         active_user_count
         counts
@@ -66,6 +68,8 @@ describe Gitlab::UsageData do
         snippet_create: a_kind_of(Integer),
         snippet_update: a_kind_of(Integer),
         snippet_comment: a_kind_of(Integer),
+        merge_request_comment: a_kind_of(Integer),
+        commit_comment: a_kind_of(Integer),
         wiki_pages_create: a_kind_of(Integer),
         wiki_pages_update: a_kind_of(Integer),
         wiki_pages_delete: a_kind_of(Integer),
@@ -78,7 +82,7 @@ describe Gitlab::UsageData do
       )
     end
 
-    it "gathers usage counts" do
+    it 'gathers usage counts' do
       expected_keys = %i(
         assignee_lists
         boards
@@ -253,7 +257,7 @@ describe Gitlab::UsageData do
   describe '#license_usage_data' do
     subject { described_class.license_usage_data }
 
-    it "gathers license data" do
+    it 'gathers license data' do
       expect(subject[:uuid]).to eq(Gitlab::CurrentSettings.uuid)
       expect(subject[:version]).to eq(Gitlab::VERSION)
       expect(subject[:installation_type]).to eq('gitlab-development-kit')
-- 
cgit v1.2.1


From c0769b308a9df0de6374c480310c41c990bc7cc1 Mon Sep 17 00:00:00 2001
From: Thomas Randolph <trandolph@gitlab.com>
Date: Mon, 12 Aug 2019 19:20:15 -0600
Subject: Make all of the discussion toggle clickable

---
 app/assets/javascripts/diffs/components/app.vue                      | 2 +-
 app/assets/stylesheets/pages/diff.scss                               | 3 +--
 ...scussion-expand-collapse-button-is-only-clickable-on-one-side.yml | 5 +++++
 3 files changed, 7 insertions(+), 3 deletions(-)
 create mode 100644 changelogs/unreleased/63905-discussion-expand-collapse-button-is-only-clickable-on-one-side.yml

diff --git a/app/assets/javascripts/diffs/components/app.vue b/app/assets/javascripts/diffs/components/app.vue
index 81da0754752..19b85710710 100644
--- a/app/assets/javascripts/diffs/components/app.vue
+++ b/app/assets/javascripts/diffs/components/app.vue
@@ -305,7 +305,7 @@ export default {
         <div
           v-show="showTreeList"
           :style="{ width: `${treeWidth}px` }"
-          class="diff-tree-list js-diff-tree-list"
+          class="diff-tree-list js-diff-tree-list mr-3"
         >
           <panel-resizer
             :size.sync="treeWidth"
diff --git a/app/assets/stylesheets/pages/diff.scss b/app/assets/stylesheets/pages/diff.scss
index ffb27e54f34..77a2fd6b876 100644
--- a/app/assets/stylesheets/pages/diff.scss
+++ b/app/assets/stylesheets/pages/diff.scss
@@ -1032,7 +1032,6 @@ table.code {
   $top-pos: $header-height + $mr-tabs-height + $mr-version-controls-height + 10px;
   top: $header-height + $mr-tabs-height + $mr-version-controls-height + 10px;
   max-height: calc(100vh - #{$top-pos});
-  padding-right: $gl-padding;
   z-index: 202;
 
   .with-performance-bar & {
@@ -1043,7 +1042,7 @@ table.code {
 
   .drag-handle {
     bottom: 16px;
-    transform: translateX(-6px);
+    transform: translateX(10px);
   }
 }
 
diff --git a/changelogs/unreleased/63905-discussion-expand-collapse-button-is-only-clickable-on-one-side.yml b/changelogs/unreleased/63905-discussion-expand-collapse-button-is-only-clickable-on-one-side.yml
new file mode 100644
index 00000000000..61cd69e88bf
--- /dev/null
+++ b/changelogs/unreleased/63905-discussion-expand-collapse-button-is-only-clickable-on-one-side.yml
@@ -0,0 +1,5 @@
+---
+title: All of discussion expand/collapse button is clickable
+merge_request: 31730
+author:
+type: fixed
-- 
cgit v1.2.1

-- 
cgit v1.2.1


From b29853ed3794b70a1b24389e712f7170d2cbd36e Mon Sep 17 00:00:00 2001
From: Alex Harford <alex.harford@saucelabs.com>
Date: Fri, 16 Aug 2019 23:03:13 +0000
Subject: Update README.md

---
 doc/ci/yaml/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md
index 2be93433b36..76b73729d0b 100644
--- a/doc/ci/yaml/README.md
+++ b/doc/ci/yaml/README.md
@@ -1721,7 +1721,7 @@ This example creates three paths of execution:
 1. If `needs:` is set to point to a job that is not instantiated
    because of `only/except` rules or otherwise does not exist, the
    job will fail.
-1. Note that one day one of the launch, we are temporarily limiting the 
+1. Note that on day one of the launch, we are temporarily limiting the 
    maximum number of jobs that a single job can need in the `needs:` array. Track
    our [infrastructure issue](https://gitlab.com/gitlab-com/gl-infra/infrastructure/issues/7541)
    for details on the current limit.
-- 
cgit v1.2.1


From 1d5624f0e30a1975e3b2c89f5666e5a939630012 Mon Sep 17 00:00:00 2001
From: Donald Cook <dcook@gitlab.com>
Date: Sat, 17 Aug 2019 08:22:43 -0500
Subject: Backport: Fixed sidebar assignees scrolling bug

---
 app/assets/stylesheets/pages/issuable.scss | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/assets/stylesheets/pages/issuable.scss b/app/assets/stylesheets/pages/issuable.scss
index 66b4f3bad2b..fa52ce6402d 100644
--- a/app/assets/stylesheets/pages/issuable.scss
+++ b/app/assets/stylesheets/pages/issuable.scss
@@ -522,6 +522,7 @@
     }
 
     .multiple-users {
+      position: relative;
       height: 24px;
       margin-bottom: 17px;
       margin-top: 4px;
-- 
cgit v1.2.1


From b46b9d5e89d54cf1e374a014f0d523735c82ab8c Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Sat, 17 Aug 2019 00:42:23 -0700
Subject: Fix pipelines not always being created after a push

https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/31741 introduced
a regression where not all the right parameters would be passed into
`Ci::CreatePipelineService`. We fix this by breaking out the pipeline
parameters and reusing a method from `Gitlab::DataBuilder::Push`.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66196
---
 app/services/git/base_hooks_service.rb                | 19 ++++++++++++-------
 .../unreleased/sh-fix-pipelines-not-being-created.yml |  5 +++++
 lib/gitlab/data_builder/push.rb                       |  2 --
 spec/services/git/branch_push_service_spec.rb         | 16 ++++++++++++++++
 4 files changed, 33 insertions(+), 9 deletions(-)
 create mode 100644 changelogs/unreleased/sh-fix-pipelines-not-being-created.yml

diff --git a/app/services/git/base_hooks_service.rb b/app/services/git/base_hooks_service.rb
index 3fd38444196..47c308c8280 100644
--- a/app/services/git/base_hooks_service.rb
+++ b/app/services/git/base_hooks_service.rb
@@ -56,7 +56,7 @@ module Git
       return unless params.fetch(:create_pipelines, true)
 
       Ci::CreatePipelineService
-        .new(project, current_user, base_params)
+        .new(project, current_user, pipeline_params)
         .execute(:push, pipeline_options)
     end
 
@@ -75,24 +75,29 @@ module Git
       ProjectCacheWorker.perform_async(project.id, file_types, [], false)
     end
 
-    def base_params
+    def pipeline_params
       {
-        oldrev: params[:oldrev],
-        newrev: params[:newrev],
+        before: params[:oldrev],
+        after: params[:newrev],
         ref: params[:ref],
-        push_options: params[:push_options] || {}
+        push_options: params[:push_options] || {},
+        checkout_sha: Gitlab::DataBuilder::Push.checkout_sha(
+          project.repository, params[:newrev], params[:ref])
       }
     end
 
     def push_data_params(commits:, with_changed_files: true)
-      base_params.merge(
+      {
+        oldrev: params[:oldrev],
+        newrev: params[:newrev],
+        ref: params[:ref],
         project: project,
         user: current_user,
         commits: commits,
         message: event_message,
         commits_count: commits_count,
         with_changed_files: with_changed_files
-      )
+      }
     end
 
     def event_push_data
diff --git a/changelogs/unreleased/sh-fix-pipelines-not-being-created.yml b/changelogs/unreleased/sh-fix-pipelines-not-being-created.yml
new file mode 100644
index 00000000000..a6937eae588
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-pipelines-not-being-created.yml
@@ -0,0 +1,5 @@
+---
+title: Fix pipelines not always being created after a push
+merge_request: 31927
+author:
+type: fixed
diff --git a/lib/gitlab/data_builder/push.rb b/lib/gitlab/data_builder/push.rb
index 37fadb47736..75d9a2d55b9 100644
--- a/lib/gitlab/data_builder/push.rb
+++ b/lib/gitlab/data_builder/push.rb
@@ -129,8 +129,6 @@ module Gitlab
         SAMPLE_DATA
       end
 
-      private
-
       def checkout_sha(repository, newrev, ref)
         # Checkout sha is nil when we remove branch or tag
         return if Gitlab::Git.blank_ref?(newrev)
diff --git a/spec/services/git/branch_push_service_spec.rb b/spec/services/git/branch_push_service_spec.rb
index ad5d296f5c1..d9e607cd251 100644
--- a/spec/services/git/branch_push_service_spec.rb
+++ b/spec/services/git/branch_push_service_spec.rb
@@ -76,6 +76,22 @@ describe Git::BranchPushService, services: true do
       stub_ci_pipeline_to_return_yaml_file
     end
 
+    it 'creates a pipeline with the right parameters' do
+      expect(Ci::CreatePipelineService)
+        .to receive(:new)
+        .with(project,
+              user,
+              {
+                before: oldrev,
+                after: newrev,
+                ref: ref,
+                checkout_sha: SeedRepo::Commit::ID,
+                push_options: {}
+              }).and_call_original
+
+      subject
+    end
+
     it "creates a new pipeline" do
       expect { subject }.to change { Ci::Pipeline.count }
 
-- 
cgit v1.2.1


From 8463b21982e82ccb8903c8470bd5986d9804c335 Mon Sep 17 00:00:00 2001
From: Jacopo <beschi.jacopo@gmail.com>
Date: Fri, 2 Aug 2019 12:23:52 +0200
Subject: Improve system notes for Zoom links

changes: @user a Zoom call was added to this issue
into: @user added a Zoom call to this issue

Same concept appleis for "removed"
---
 app/services/system_note_service.rb                          |  4 ++--
 .../unreleased/65427-improve-system-notes-for-zoom-links.yml |  5 +++++
 locale/gitlab.pot                                            | 12 ++++++------
 spec/services/issues/update_service_spec.rb                  |  4 ++--
 spec/services/system_note_service_spec.rb                    |  4 ++--
 5 files changed, 17 insertions(+), 12 deletions(-)
 create mode 100644 changelogs/unreleased/65427-improve-system-notes-for-zoom-links.yml

diff --git a/app/services/system_note_service.rb b/app/services/system_note_service.rb
index e30debbbe75..ee7223d6349 100644
--- a/app/services/system_note_service.rb
+++ b/app/services/system_note_service.rb
@@ -598,11 +598,11 @@ module SystemNoteService
   end
 
   def zoom_link_added(issue, project, author)
-    create_note(NoteSummary.new(issue, project, author, _('a Zoom call was added to this issue'), action: 'pinned_embed'))
+    create_note(NoteSummary.new(issue, project, author, _('added a Zoom call to this issue'), action: 'pinned_embed'))
   end
 
   def zoom_link_removed(issue, project, author)
-    create_note(NoteSummary.new(issue, project, author, _('a Zoom call was removed from this issue'), action: 'pinned_embed'))
+    create_note(NoteSummary.new(issue, project, author, _('removed a Zoom call from this issue'), action: 'pinned_embed'))
   end
 
   private
diff --git a/changelogs/unreleased/65427-improve-system-notes-for-zoom-links.yml b/changelogs/unreleased/65427-improve-system-notes-for-zoom-links.yml
new file mode 100644
index 00000000000..d081620c710
--- /dev/null
+++ b/changelogs/unreleased/65427-improve-system-notes-for-zoom-links.yml
@@ -0,0 +1,5 @@
+---
+title: Improve system notes for Zoom links
+merge_request: 31410
+author: Jacopo Beschi @jacopo-beschi
+type: changed
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index dd69fa1f8f6..ec0feee06f2 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -13348,18 +13348,15 @@ msgstr ""
 msgid "Your request for access has been queued for review."
 msgstr ""
 
-msgid "a Zoom call was added to this issue"
-msgstr ""
-
-msgid "a Zoom call was removed from this issue"
-msgstr ""
-
 msgid "a deleted user"
 msgstr ""
 
 msgid "added %{created_at_timeago}"
 msgstr ""
 
+msgid "added a Zoom call to this issue"
+msgstr ""
+
 msgid "ago"
 msgstr ""
 
@@ -13896,6 +13893,9 @@ msgstr ""
 msgid "remove due date"
 msgstr ""
 
+msgid "removed a Zoom call from this issue"
+msgstr ""
+
 msgid "rendered diff"
 msgstr ""
 
diff --git a/spec/services/issues/update_service_spec.rb b/spec/services/issues/update_service_spec.rb
index d9f35afee06..fd9a63b79cc 100644
--- a/spec/services/issues/update_service_spec.rb
+++ b/spec/services/issues/update_service_spec.rb
@@ -229,10 +229,10 @@ describe Issues::UpdateService, :mailer do
     it 'creates zoom_link_added system note when a zoom link is added to the description' do
       update_issue(description: 'Changed description https://zoom.us/j/5873603787')
 
-      note = find_note('a Zoom call was added')
+      note = find_note('added a Zoom call')
 
       expect(note).not_to be_nil
-      expect(note.note).to eq('a Zoom call was added to this issue')
+      expect(note.note).to eq('added a Zoom call to this issue')
     end
 
     context 'when issue turns confidential' do
diff --git a/spec/services/system_note_service_spec.rb b/spec/services/system_note_service_spec.rb
index 486d0ca0c56..f46f9633c1c 100644
--- a/spec/services/system_note_service_spec.rb
+++ b/spec/services/system_note_service_spec.rb
@@ -521,7 +521,7 @@ describe SystemNoteService do
     end
 
     it 'sets the zoom link added note text' do
-      expect(subject.note).to eq('a Zoom call was added to this issue')
+      expect(subject.note).to eq('added a Zoom call to this issue')
     end
   end
 
@@ -533,7 +533,7 @@ describe SystemNoteService do
     end
 
     it 'sets the zoom link removed note text' do
-      expect(subject.note).to eq('a Zoom call was removed from this issue')
+      expect(subject.note).to eq('removed a Zoom call from this issue')
     end
   end
 
-- 
cgit v1.2.1


From 90170ab1a7fefd3d2ce81d81ed9df7bab7eb93c3 Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Sat, 17 Aug 2019 21:53:46 +0000
Subject: Remove reference to old lib/api/ci dir

This directory no longer exists (since 2017)
---
 doc/development/testing_guide/testing_levels.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/development/testing_guide/testing_levels.md b/doc/development/testing_guide/testing_levels.md
index e1ce4d3b7d1..6c3a3171d39 100644
--- a/doc/development/testing_guide/testing_levels.md
+++ b/doc/development/testing_guide/testing_levels.md
@@ -66,7 +66,6 @@ They're useful to test permissions, redirections, what view is rendered etc.
 | `app/controllers/` | `spec/controllers/` | RSpec | |
 | `app/mailers/` | `spec/mailers/` | RSpec | |
 | `lib/api/` | `spec/requests/api/` | RSpec | |
-| `lib/ci/api/` | `spec/requests/ci/api/` | RSpec | |
 | `app/assets/javascripts/` | `spec/javascripts/`, `spec/frontend/` | Karma & Jest | More details in the [Frontend Testing guide](frontend_testing.md) section. |
 
 ### About controller tests
-- 
cgit v1.2.1


From ba7c501fef5976ea7a1cc4212e84742246fed781 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Sat, 17 Aug 2019 15:39:39 -0700
Subject: Fix Gitaly N+1 calls with listing issues/MRs via API

In GitLab 9.0,
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/9661 removed the
`subscribed` flag from the API when the user requested a list of issues
or merge requests since calculating this value triggers extensive
Markdown processing.

In GitLab 12.0 via a4fbf39e, we accidentally reintroduced this
performance regression by changing `IssueBasic` to `Issue` in
`entities.rb`. This showed up as a Gitaly N+1 issue since the Markdown
processing would attempt to extract a commit if it detected a regex that
matched a commit.

We restore the prior behavior by once again removing the `subscribed`
flag for the bulk list of issues and merge requests and add a test to
ensure they aren't reintroduced.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66202
---
 changelogs/unreleased/sh-fix-issues-api-gitaly-nplusone.yml | 5 +++++
 doc/api/issues.md                                           | 2 --
 lib/api/entities.rb                                         | 5 ++++-
 lib/api/issues.rb                                           | 6 ++++--
 spec/requests/api/issues/get_group_issues_spec.rb           | 8 ++++++++
 spec/requests/api/issues/get_project_issues_spec.rb         | 1 +
 spec/requests/api/issues/issues_spec.rb                     | 4 ++++
 7 files changed, 26 insertions(+), 5 deletions(-)
 create mode 100644 changelogs/unreleased/sh-fix-issues-api-gitaly-nplusone.yml

diff --git a/changelogs/unreleased/sh-fix-issues-api-gitaly-nplusone.yml b/changelogs/unreleased/sh-fix-issues-api-gitaly-nplusone.yml
new file mode 100644
index 00000000000..3177cb8d18c
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-issues-api-gitaly-nplusone.yml
@@ -0,0 +1,5 @@
+---
+title: Fix Gitaly N+1 calls with listing issues/MRs via API
+merge_request: 31938
+author:
+type: performance
diff --git a/doc/api/issues.md b/doc/api/issues.md
index 96a547551f1..11c18ef94ba 100644
--- a/doc/api/issues.md
+++ b/doc/api/issues.md
@@ -136,7 +136,6 @@ Example response:
          "award_emoji":"http://example.com/api/v4/projects/1/issues/76/award_emoji",
          "project":"http://example.com/api/v4/projects/1"
       },
-      "subscribed": false,
       "task_completion_status":{
          "count":0,
          "completed_count":0
@@ -441,7 +440,6 @@ Example response:
          "award_emoji":"http://example.com/api/v4/projects/4/issues/41/award_emoji",
          "project":"http://example.com/api/v4/projects/4"
       },
-      "subscribed": false,
       "task_completion_status":{
          "count":0,
          "completed_count":0
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 09253ab6b0e..5e66b4e76a5 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -645,7 +645,10 @@ module API
         end
       end
 
-      expose :subscribed do |issue, options|
+      # Calculating the value of subscribed field triggers Markdown
+      # processing. We can't do that for multiple issues / merge
+      # requests in a single API request.
+      expose :subscribed, if: -> (_, options) { options.fetch(:include_subscribed, true) } do |issue, options|
         issue.subscribed?(options[:current_user], options[:project] || issue.project)
       end
     end
diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index d687acf3423..7819c2de515 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -96,7 +96,8 @@ module API
           with: Entities::Issue,
           with_labels_details: declared_params[:with_labels_details],
           current_user: current_user,
-          issuable_metadata: issuable_meta_data(issues, 'Issue', current_user)
+          issuable_metadata: issuable_meta_data(issues, 'Issue', current_user),
+          include_subscribed: false
         }
 
         present issues, options
@@ -122,7 +123,8 @@ module API
           with: Entities::Issue,
           with_labels_details: declared_params[:with_labels_details],
           current_user: current_user,
-          issuable_metadata: issuable_meta_data(issues, 'Issue', current_user)
+          issuable_metadata: issuable_meta_data(issues, 'Issue', current_user),
+          include_subscribed: false
         }
 
         present issues, options
diff --git a/spec/requests/api/issues/get_group_issues_spec.rb b/spec/requests/api/issues/get_group_issues_spec.rb
index 5916bb11516..c487471e4a1 100644
--- a/spec/requests/api/issues/get_group_issues_spec.rb
+++ b/spec/requests/api/issues/get_group_issues_spec.rb
@@ -342,6 +342,14 @@ describe API::Issues do
         group_project.add_reporter(user)
       end
 
+      it 'exposes known attributes' do
+        get api(base_url, admin)
+
+        expect(response).to have_gitlab_http_status(200)
+        expect(json_response.last.keys).to include(*%w(id iid project_id title description))
+        expect(json_response.last).not_to have_key('subscribed')
+      end
+
       it 'returns all group issues (including opened and closed)' do
         get api(base_url, admin)
 
diff --git a/spec/requests/api/issues/get_project_issues_spec.rb b/spec/requests/api/issues/get_project_issues_spec.rb
index f7ca6fd1e0a..521d6b88734 100644
--- a/spec/requests/api/issues/get_project_issues_spec.rb
+++ b/spec/requests/api/issues/get_project_issues_spec.rb
@@ -575,6 +575,7 @@ describe API::Issues do
       expect(json_response['assignee']).to be_a Hash
       expect(json_response['author']).to be_a Hash
       expect(json_response['confidential']).to be_falsy
+      expect(json_response['subscribed']).to be_truthy
     end
 
     it 'exposes the closed_at attribute' do
diff --git a/spec/requests/api/issues/issues_spec.rb b/spec/requests/api/issues/issues_spec.rb
index d195f54be11..27cf66629fe 100644
--- a/spec/requests/api/issues/issues_spec.rb
+++ b/spec/requests/api/issues/issues_spec.rb
@@ -216,6 +216,10 @@ describe API::Issues do
         expect_paginated_array_response([issue.id, closed_issue.id])
         expect(json_response.first['title']).to eq(issue.title)
         expect(json_response.last).to have_key('web_url')
+        # Calculating the value of subscribed field triggers Markdown
+        # processing. We can't do that for multiple issues / merge
+        # requests in a single API request.
+        expect(json_response.last).not_to have_key('subscribed')
       end
 
       it 'returns an array of closed issues' do
-- 
cgit v1.2.1


From c2c86e35149b20b4dc3af083cc16ac42d50b3e58 Mon Sep 17 00:00:00 2001
From: Luke Duncalfe <lduncalfe@eml.cc>
Date: Thu, 15 Aug 2019 16:56:04 +1200
Subject: Add `be_like_time` matcher to Testing Styleguide

---
 doc/development/testing_guide/best_practices.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/doc/development/testing_guide/best_practices.md b/doc/development/testing_guide/best_practices.md
index 448d9fd01c4..c7e58f58c61 100644
--- a/doc/development/testing_guide/best_practices.md
+++ b/doc/development/testing_guide/best_practices.md
@@ -454,6 +454,19 @@ complexity of RSpec expectations.They should be placed under
 a certain type of specs only (e.g. features, requests etc.) but shouldn't be if
 they apply to multiple type of specs.
 
+#### `be_like_time`
+
+Time returned from a database can differ in precision from time objects
+in Ruby, so we need flexible tolerances when comparing in specs. We can
+use `be_like_time` to compare that times are within one second of each
+other.
+
+Example:
+
+```ruby
+expect(metrics.merged_at).to be_like_time(time)
+```
+
 #### `have_gitlab_http_status`
 
 Prefer `have_gitlab_http_status` over `have_http_status` because the former
-- 
cgit v1.2.1


From 56dcd45a766107b7b3069edd4a3993badf8bb2e0 Mon Sep 17 00:00:00 2001
From: Mark Lapierre <mlapierre@gitlab.com>
Date: Mon, 19 Aug 2019 08:07:39 +1000
Subject: Quarantine failing test

---
 .../features/browser_ui/3_create/repository/add_file_template_spec.rb  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/qa/qa/specs/features/browser_ui/3_create/repository/add_file_template_spec.rb b/qa/qa/specs/features/browser_ui/3_create/repository/add_file_template_spec.rb
index 567c6a83ddf..458072b1507 100644
--- a/qa/qa/specs/features/browser_ui/3_create/repository/add_file_template_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/repository/add_file_template_spec.rb
@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
 module QA
-  context 'Create' do
+  # Failure issue: https://gitlab.com/gitlab-org/quality/nightly/issues/127
+  context 'Create', :quarantine do
     describe 'File templates' do
       include Runtime::Fixtures
 
-- 
cgit v1.2.1


From 5ba8716dda99a8c60af906f6e0a4540bec27395c Mon Sep 17 00:00:00 2001
From: Ben Bodenmiller <bbodenmiller@hotmail.com>
Date: Sun, 18 Aug 2019 23:15:22 +0000
Subject: add GitLab CI job token API authentication section

---
 doc/api/README.md | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/doc/api/README.md b/doc/api/README.md
index b7ee710b87a..9156d719e11 100644
--- a/doc/api/README.md
+++ b/doc/api/README.md
@@ -77,11 +77,12 @@ authentication is not provided. For
 those cases where it is not required, this will be mentioned in the documentation
 for each individual endpoint. For example, the [`/projects/:id` endpoint](projects.md).
 
-There are three ways to authenticate with the GitLab API:
+There are four ways to authenticate with the GitLab API:
 
 1. [OAuth2 tokens](#oauth2-tokens)
 1. [Personal access tokens](#personal-access-tokens)
 1. [Session cookie](#session-cookie)
+1. [GitLab CI job token](#gitlab-ci-job-token-premium) **(PREMIUM)**
 
 For admins who want to authenticate with the API as a specific user, or who want to build applications or scripts that do so, two options are available:
 
@@ -151,6 +152,14 @@ The primary user of this authentication method is the web frontend of GitLab its
 which can use the API as the authenticated user to get a list of their projects,
 for example, without needing to explicitly pass an access token.
 
+### GitLab CI job token **(PREMIUM)**
+
+With a few API endpoints you can use a [GitLab CI job token](../user/project/new_ci_build_permissions_model.md#job-token)
+to authenticate with the API:
+
+* [Get job artifacts](jobs.md#get-job-artifacts)
+* [Pipeline triggers](pipeline_triggers.md)
+
 ### Impersonation tokens
 
 > [Introduced][ce-9099] in GitLab 9.0. Needs admin permissions.
-- 
cgit v1.2.1


From b57e99295a2758174eca2c204faa52d4f8da99f7 Mon Sep 17 00:00:00 2001
From: Mayra Cabrera <mcabrera@gitlab.com>
Date: Sun, 18 Aug 2019 23:56:50 +0000
Subject: Mentions related log on Rate limit docs

Requests over the rate limit are logged into `auth.log`
---
 doc/administration/logs.md                                   | 8 ++++++--
 doc/user/admin_area/settings/rate_limits_on_raw_endpoints.md | 4 +++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/doc/administration/logs.md b/doc/administration/logs.md
index 306d611f6bf..a57ef8ddc7d 100644
--- a/doc/administration/logs.md
+++ b/doc/administration/logs.md
@@ -284,13 +284,16 @@ Introduced in GitLab 11.3. This file lives in `/var/log/gitlab/gitlab-rails/impo
 Omnibus GitLab packages or in `/home/git/gitlab/log/importer.log` for
 installations from source.
 
-## `auth.log`
+## `auth.log`
 
 Introduced in GitLab 12.0. This file lives in `/var/log/gitlab/gitlab-rails/auth.log` for
 Omnibus GitLab packages or in `/home/git/gitlab/log/auth.log` for
 installations from source.
 
-It logs information whenever [Rack Attack] registers an abusive request.
+This log records:
+
+- Information whenever [Rack Attack] registers an abusive request.
+- Requests over the [Rate Limit] on raw endpoints.
 
 NOTE: **Note:**
 From [%12.1](https://gitlab.com/gitlab-org/gitlab-ce/issues/62756), user id and username are available on this log.
@@ -334,3 +337,4 @@ installations from source.
 
 [repocheck]: repository_checks.md
 [Rack Attack]: ../security/rack_attack.md
+[Rate Limit]: ../user/admin_area/settings/rate_limits_on_raw_endpoints.md
diff --git a/doc/user/admin_area/settings/rate_limits_on_raw_endpoints.md b/doc/user/admin_area/settings/rate_limits_on_raw_endpoints.md
index b2d56be154b..8e53a6995fb 100644
--- a/doc/user/admin_area/settings/rate_limits_on_raw_endpoints.md
+++ b/doc/user/admin_area/settings/rate_limits_on_raw_endpoints.md
@@ -9,7 +9,7 @@ type: reference
 This setting allows you to rate limit the requests to raw endpoints, defaults to `300` requests per minute. 
 It can be modified in **Admin Area > Network > Performance Optimization**.
 
-For example, requests over `300` per minute to `https://gitlab.com/gitlab-org/gitlab-ce/raw/master/app/controllers/application_controller.rb` will be blocked.
+For example, requests over `300` per minute to `https://gitlab.com/gitlab-org/gitlab-ce/raw/master/app/controllers/application_controller.rb` will be blocked. Access to the raw file will be released after 1 minute.
 
 ![Rate limits on raw endpoints](img/rate_limits_on_raw_endpoints.png)
 
@@ -18,3 +18,5 @@ This limit is:
 - Applied independently per project, per commit and per file path.
 - Not applied per IP address.
 - Active by default. To disable, set the option to `0`.
+
+Requests over the rate limit are logged into `auth.log`.
-- 
cgit v1.2.1


From 1e0cd1b389fe017941756abaa4544f1859211e11 Mon Sep 17 00:00:00 2001
From: Tristan Williams <2390023-tristan@users.noreply.gitlab.com>
Date: Mon, 19 Aug 2019 00:26:04 +0000
Subject: Docs: Refresh CI quick start screenshots

---
 doc/ci/quick_start/img/build_log.png         | Bin 35256 -> 138388 bytes
 doc/ci/quick_start/img/builds_status.png     | Bin 19107 -> 47887 bytes
 doc/ci/quick_start/img/pipelines_status.png  | Bin 22872 -> 64605 bytes
 doc/ci/quick_start/img/runners_activated.png | Bin 18215 -> 104545 bytes
 4 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/doc/ci/quick_start/img/build_log.png b/doc/ci/quick_start/img/build_log.png
index 2bf0992c50e..16698629edc 100644
Binary files a/doc/ci/quick_start/img/build_log.png and b/doc/ci/quick_start/img/build_log.png differ
diff --git a/doc/ci/quick_start/img/builds_status.png b/doc/ci/quick_start/img/builds_status.png
index 58978e23978..b4aeeb988d2 100644
Binary files a/doc/ci/quick_start/img/builds_status.png and b/doc/ci/quick_start/img/builds_status.png differ
diff --git a/doc/ci/quick_start/img/pipelines_status.png b/doc/ci/quick_start/img/pipelines_status.png
index 06d1559f5d2..39a77a26b25 100644
Binary files a/doc/ci/quick_start/img/pipelines_status.png and b/doc/ci/quick_start/img/pipelines_status.png differ
diff --git a/doc/ci/quick_start/img/runners_activated.png b/doc/ci/quick_start/img/runners_activated.png
index cd83c1a7e4c..ac09e1d0137 100644
Binary files a/doc/ci/quick_start/img/runners_activated.png and b/doc/ci/quick_start/img/runners_activated.png differ
-- 
cgit v1.2.1


From 6eec567310237865bbe461fd9642addc004522f2 Mon Sep 17 00:00:00 2001
From: Nick Thomas <nick@gitlab.com>
Date: Mon, 19 Aug 2019 00:39:11 +0000
Subject: Improve docs for cross-project MR dependencies

Addressing a documentation review by Marcia!
---
 ...ross-project-dependencies-edit-inaccessible.png | Bin 19461 -> 0 bytes
 .../img/cross-project-dependencies-edit.png        | Bin 19302 -> 0 bytes
 .../img/cross-project-dependencies-view.png        | Bin 37528 -> 0 bytes
 ...roject_dependencies_edit_inaccessible_v12_2.png | Bin 0 -> 19461 bytes
 .../img/cross_project_dependencies_edit_v12_2.png  | Bin 0 -> 19302 bytes
 .../img/cross_project_dependencies_view_v12_2.png  | Bin 0 -> 37528 bytes
 .../merge_requests/merge_request_dependencies.md   |  30 ++++++++++-----------
 7 files changed, 15 insertions(+), 15 deletions(-)
 delete mode 100644 doc/user/project/merge_requests/img/cross-project-dependencies-edit-inaccessible.png
 delete mode 100644 doc/user/project/merge_requests/img/cross-project-dependencies-edit.png
 delete mode 100644 doc/user/project/merge_requests/img/cross-project-dependencies-view.png
 create mode 100644 doc/user/project/merge_requests/img/cross_project_dependencies_edit_inaccessible_v12_2.png
 create mode 100644 doc/user/project/merge_requests/img/cross_project_dependencies_edit_v12_2.png
 create mode 100644 doc/user/project/merge_requests/img/cross_project_dependencies_view_v12_2.png

diff --git a/doc/user/project/merge_requests/img/cross-project-dependencies-edit-inaccessible.png b/doc/user/project/merge_requests/img/cross-project-dependencies-edit-inaccessible.png
deleted file mode 100644
index 2dc02634fd8..00000000000
Binary files a/doc/user/project/merge_requests/img/cross-project-dependencies-edit-inaccessible.png and /dev/null differ
diff --git a/doc/user/project/merge_requests/img/cross-project-dependencies-edit.png b/doc/user/project/merge_requests/img/cross-project-dependencies-edit.png
deleted file mode 100644
index 362e7e0ead2..00000000000
Binary files a/doc/user/project/merge_requests/img/cross-project-dependencies-edit.png and /dev/null differ
diff --git a/doc/user/project/merge_requests/img/cross-project-dependencies-view.png b/doc/user/project/merge_requests/img/cross-project-dependencies-view.png
deleted file mode 100644
index e00231c839b..00000000000
Binary files a/doc/user/project/merge_requests/img/cross-project-dependencies-view.png and /dev/null differ
diff --git a/doc/user/project/merge_requests/img/cross_project_dependencies_edit_inaccessible_v12_2.png b/doc/user/project/merge_requests/img/cross_project_dependencies_edit_inaccessible_v12_2.png
new file mode 100644
index 00000000000..2dc02634fd8
Binary files /dev/null and b/doc/user/project/merge_requests/img/cross_project_dependencies_edit_inaccessible_v12_2.png differ
diff --git a/doc/user/project/merge_requests/img/cross_project_dependencies_edit_v12_2.png b/doc/user/project/merge_requests/img/cross_project_dependencies_edit_v12_2.png
new file mode 100644
index 00000000000..362e7e0ead2
Binary files /dev/null and b/doc/user/project/merge_requests/img/cross_project_dependencies_edit_v12_2.png differ
diff --git a/doc/user/project/merge_requests/img/cross_project_dependencies_view_v12_2.png b/doc/user/project/merge_requests/img/cross_project_dependencies_view_v12_2.png
new file mode 100644
index 00000000000..e00231c839b
Binary files /dev/null and b/doc/user/project/merge_requests/img/cross_project_dependencies_view_v12_2.png differ
diff --git a/doc/user/project/merge_requests/merge_request_dependencies.md b/doc/user/project/merge_requests/merge_request_dependencies.md
index e046b3466c4..b30e24b2386 100644
--- a/doc/user/project/merge_requests/merge_request_dependencies.md
+++ b/doc/user/project/merge_requests/merge_request_dependencies.md
@@ -2,9 +2,9 @@
 type: reference, concepts
 ---
 
-# Cross-project merge request dependencies **(PREMIUM)**
+# Cross-project Merge Request dependencies **(PREMIUM)**
 
-> Introduced in GitLab Premium 12.2
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/9688) in [GitLab Premium](https://about.gitlab.com/pricing/) 12.2.
 
 Cross-project merge request dependencies allows a required order of merging
 between merge requests in different projects to be expressed. If a
@@ -24,11 +24,11 @@ merge requests in the same project cannot depend on each other.
 ## Use cases
 
 - Ensure changes to a library are merged before changes to a project that
-  imports the library
+  imports the library.
 - Prevent a documentation-only merge request from being merged before the merge request
-  implementing the feature to be documented
+  implementing the feature to be documented.
 - Require an merge request updating a permissions matrix to be merged before merging an
-  merge request from someone who hasn't yet been granted permissions
+  merge request from someone who hasn't yet been granted permissions.
 
 It is common for a single logical change to span several merge requests, spread
 out across multiple projects, and the order in which they are merged can be
@@ -60,33 +60,33 @@ new merge request in `awesome-project` (or by editing it, if it already exists).
 The dependency needs to be configured on the **dependent** merge
 request. There is a "Cross-project dependencies" section in the form:
 
-![Cross-project dependencies form control](img/cross-project-dependencies-edit.png)
+![Cross-project dependencies form control](img/cross_project_dependencies_edit_v12_2.png)
 
 Anyone who can edit a merge request can change the list of dependencies.
 
 New dependencies can be added by reference, or by URL. To remove a dependency,
-press the "X" by its reference.
+press the **X** by its reference.
 
 As dependencies are specified across projects, it's possible that someone else
 has added a dependency for a merge request in a project you don't have access to.
 These are shown as a simple count:
 
-![Cross-project dependencies form control with inaccessible merge requests](img/cross-project-dependencies-edit-inaccessible.png)
+![Cross-project dependencies form control with inaccessible merge requests](img/cross_project_dependencies_edit_inaccessible_v12_2.png)
 
-If necessary, you can remove all the dependencies like this by pressing the "X",
-just as you would for a single, visible dependency.
+If necessary, you can remove all the dependencies like this by pressing the
+**X**, just as you would for a single, visible dependency.
 
-Once you're finished, press the "Save changes" button to submit the request, or
-"Cancel" to return without making any changes.
+Once you're finished, press the **Save changes** button to submit the request,
+or **Cancel** to return without making any changes.
 
 The list of configured dependencies, and the status of each one, is shown in the
 merge request widget:
 
-![Cross-project dependencies in merge request widget](img/cross-project-dependencies-view.png)
+![Cross-project dependencies in merge request widget](img/cross_project_dependencies_view_v12_2.png)
 
-Until all dependencies have, themselves, been merged, the "Merge"
+Until all dependencies have, themselves, been merged, the **Merge**
 button will be disabled for the dependent merge request. In
-particular, note that **closed** merge request still prevent their
+particular, note that **closed merge requests** still prevent their
 dependents from being merged - it is impossible to automatically
 determine whether the dependency expressed by a closed merge request
 has been satisfied in some other way or not.
-- 
cgit v1.2.1


From c4625ba6cf76eeb7f066675f4a106c197fbbfe42 Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Mon, 19 Aug 2019 00:54:17 +0000
Subject: Link to GitLab Performance Monitoring

---
 doc/development/instrumentation.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/development/instrumentation.md b/doc/development/instrumentation.md
index 5f95cf3707c..777d372ec60 100644
--- a/doc/development/instrumentation.md
+++ b/doc/development/instrumentation.md
@@ -1,6 +1,6 @@
 # Instrumenting Ruby Code
 
-GitLab Performance Monitoring allows instrumenting of both methods and custom
+[GitLab Performance Monitoring](../administration/monitoring/performance/index.md) allows instrumenting of both methods and custom
 blocks of Ruby code. Method instrumentation is the primary form of
 instrumentation with block-based instrumentation only being used when we want to
 drill down to specific regions of code within a method.
-- 
cgit v1.2.1


From 365cc7f638eb870860bc6a9d2038a1c852c1566f Mon Sep 17 00:00:00 2001
From: Tristan Williams <2390023-tristan@users.noreply.gitlab.com>
Date: Mon, 19 Aug 2019 01:05:11 +0000
Subject: Docs: Improve clarity of SCIM workflow

---
 doc/user/group/saml_sso/scim_setup.md | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/doc/user/group/saml_sso/scim_setup.md b/doc/user/group/saml_sso/scim_setup.md
index f8bef8b8a6a..5d136ad62da 100644
--- a/doc/user/group/saml_sso/scim_setup.md
+++ b/doc/user/group/saml_sso/scim_setup.md
@@ -59,15 +59,14 @@ Once [Single sign-on](index.md) has been configured, we can:
 
 ### Azure
 
-First, double check the [Single sign-on](index.md) configuration for your group and ensure that **Name identifier value** (NameID) points to `user.objectid` or another unique identifier. This will match the `extern_uid` used on GitLab.
+The SAML application that was created during [Single sign-on](index.md) setup now needs to be set up for SCIM.
 
-![Name identifier value mapping](img/scim_name_identifier_mapping.png)
+1. Check the configuration for your GitLab SAML app and ensure that **Name identifier value** (NameID) points to `user.objectid` or another unique identifier. This will match the `extern_uid` used on GitLab.
 
-#### Set up admin credentials
+   ![Name identifier value mapping](img/scim_name_identifier_mapping.png)
 
-Next, configure your GitLab application in Azure by following the
-[Provisioning users and groups to applications that support SCIM](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/use-scim-to-provision-users-and-groups#provisioning-users-and-groups-to-applications-that-support-scim) 
-section in Azure's SCIM setup documentation.
+1. Set up automatic provisioning and administrative credentials by following the
+   [Provisioning users and groups to applications that support SCIM](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/use-scim-to-provision-users-and-groups#provisioning-users-and-groups-to-applications-that-support-scim) section in Azure's SCIM setup documentation.
 
 During this configuration, note the following:
 
@@ -97,6 +96,7 @@ You can then test the connection by clicking on **Test Connection**. If the conn
    NOTE: **Note:** If you used a unique identifier **other than** `objectId`, be sure to map it instead to both `id` and `externalId`.
 
 1. Below the mapping list click on **Show advanced options > Edit attribute list for AppName**.
+
 1. Leave the `id` as the primary and only required field.
 
    NOTE: **Note:**
@@ -129,8 +129,7 @@ When testing the connection, you may encounter an error: **You appear to have en
 When checking the Audit Logs for the Provisioning, you can sometimes see the
 error `Namespace can't be blank, Name can't be blank, and User can't be blank.`
 
-This is likely caused because not all required fields (such as first name and 
-last name) are present for all users being mapped.
+This is likely caused because not all required fields (such as first name and last name) are present for all users being mapped.
 
 As a workaround, try an alternate mapping:
 
-- 
cgit v1.2.1


From 84f753bc10cccbf6b32cfd0228c41a5842cb2d2d Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Mon, 19 Aug 2019 01:34:23 +0000
Subject: Update screenshot to fix bad html

---
 doc/user/discussions/img/make_suggestion.png | Bin 28447 -> 115084 bytes
 doc/user/discussions/img/suggestion.png      | Bin 39775 -> 149758 bytes
 2 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/doc/user/discussions/img/make_suggestion.png b/doc/user/discussions/img/make_suggestion.png
index 20acc1417da..a24e29770aa 100644
Binary files a/doc/user/discussions/img/make_suggestion.png and b/doc/user/discussions/img/make_suggestion.png differ
diff --git a/doc/user/discussions/img/suggestion.png b/doc/user/discussions/img/suggestion.png
index 68a67e6ae5e..f7962305a15 100644
Binary files a/doc/user/discussions/img/suggestion.png and b/doc/user/discussions/img/suggestion.png differ
-- 
cgit v1.2.1


From 5088e316d25fc2a7d61a253e467d551e4888628e Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Thu, 15 Aug 2019 14:27:55 +0800
Subject: Replace inline scripts in links to prevent default

Use buttons instead of links with javascript:void(0)
---
 app/assets/javascripts/members.js                    |  2 ++
 app/views/projects/commit/_ajax_signature.html.haml  |  2 +-
 app/views/projects/commit/_signature_badge.html.haml |  2 +-
 app/views/shared/members/_group.html.haml            |  2 +-
 app/views/shared/members/_member.html.haml           |  2 +-
 spec/features/signed_commits_spec.rb                 | 18 +++++++++---------
 6 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/app/assets/javascripts/members.js b/app/assets/javascripts/members.js
index af2697444f2..d719fd8748d 100644
--- a/app/assets/javascripts/members.js
+++ b/app/assets/javascripts/members.js
@@ -17,6 +17,8 @@ export default class Members {
   }
 
   dropdownClicked(options) {
+    options.e.preventDefault();
+
     this.formSubmit(null, options.$el);
   }
 
diff --git a/app/views/projects/commit/_ajax_signature.html.haml b/app/views/projects/commit/_ajax_signature.html.haml
index ae9aef5a9b0..e1bf0940f59 100644
--- a/app/views/projects/commit/_ajax_signature.html.haml
+++ b/app/views/projects/commit/_ajax_signature.html.haml
@@ -1,2 +1,2 @@
 - if commit.has_signature?
-  %a{ href: 'javascript:void(0)', tabindex: 0, class: commit_signature_badge_classes('js-loading-gpg-badge'), data: { toggle: 'tooltip', placement: 'top', title: _('GPG signature (loading...)'), 'commit-sha' => commit.sha } }
+  %button{ tabindex: 0, class: commit_signature_badge_classes('js-loading-gpg-badge'), data: { toggle: 'tooltip', placement: 'top', title: _('GPG signature (loading...)'), 'commit-sha' => commit.sha } }
diff --git a/app/views/projects/commit/_signature_badge.html.haml b/app/views/projects/commit/_signature_badge.html.haml
index 1331fa179fc..cbd998c60ef 100644
--- a/app/views/projects/commit/_signature_badge.html.haml
+++ b/app/views/projects/commit/_signature_badge.html.haml
@@ -24,5 +24,5 @@
 
   = link_to(_('Learn more about signing commits'), help_page_path('user/project/repository/gpg_signed_commits/index.md'), class: 'gpg-popover-help-link')
 
-%a{ href: 'javascript:void(0)', tabindex: 0, class: css_classes, data: { toggle: 'popover', html: 'true', placement: 'top', title: title, content: content } }
+%button{ tabindex: 0, class: css_classes, data: { toggle: 'popover', html: 'true', placement: 'top', title: title, content: content } }
   = label
diff --git a/app/views/shared/members/_group.html.haml b/app/views/shared/members/_group.html.haml
index e83ca5eaab8..42a823e3a8d 100644
--- a/app/views/shared/members/_group.html.haml
+++ b/app/views/shared/members/_group.html.haml
@@ -32,7 +32,7 @@
             %ul
               - Gitlab::Access.options.each do |role, role_id|
                 %li
-                  = link_to role, "javascript:void(0)",
+                  = link_to role, '#',
                     class: ("is-active" if group_link.group_access == role_id),
                     data: { id: role_id, el_id: dom_id }
       .clearable-input.member-form-control.d-sm-inline-block
diff --git a/app/views/shared/members/_member.html.haml b/app/views/shared/members/_member.html.haml
index 331283f7eec..6762f211a80 100644
--- a/app/views/shared/members/_member.html.haml
+++ b/app/views/shared/members/_member.html.haml
@@ -82,7 +82,7 @@
                   %ul
                     - member.valid_level_roles.each do |role, role_id|
                       %li
-                        = link_to role, "javascript:void(0)",
+                        = link_to role, '#',
                           class: ("is-active" if member.access_level == role_id),
                           data: { id: role_id, el_id: dom_id(member) }
                     = render_if_exists 'shared/members/ee/revert_ldap_group_sync_option',
diff --git a/spec/features/signed_commits_spec.rb b/spec/features/signed_commits_spec.rb
index e2b3444272e..70e6978a7b6 100644
--- a/spec/features/signed_commits_spec.rb
+++ b/spec/features/signed_commits_spec.rb
@@ -15,8 +15,8 @@ describe 'GPG signed commits' do
 
     visit project_commit_path(project, ref)
 
-    expect(page).to have_link 'Unverified'
-    expect(page).not_to have_link 'Verified'
+    expect(page).to have_button 'Unverified'
+    expect(page).not_to have_button 'Verified'
 
     # user changes his email which makes the gpg key verified
     perform_enqueued_jobs do
@@ -26,8 +26,8 @@ describe 'GPG signed commits' do
 
     visit project_commit_path(project, ref)
 
-    expect(page).not_to have_link 'Unverified'
-    expect(page).to have_link 'Verified'
+    expect(page).not_to have_button 'Unverified'
+    expect(page).to have_button 'Verified'
   end
 
   it 'changes from unverified to verified when the user adds the missing gpg key' do
@@ -36,8 +36,8 @@ describe 'GPG signed commits' do
 
     visit project_commit_path(project, ref)
 
-    expect(page).to have_link 'Unverified'
-    expect(page).not_to have_link 'Verified'
+    expect(page).to have_button 'Unverified'
+    expect(page).not_to have_button 'Verified'
 
     # user adds the gpg key which makes the signature valid
     perform_enqueued_jobs do
@@ -46,8 +46,8 @@ describe 'GPG signed commits' do
 
     visit project_commit_path(project, ref)
 
-    expect(page).not_to have_link 'Unverified'
-    expect(page).to have_link 'Verified'
+    expect(page).not_to have_button 'Unverified'
+    expect(page).to have_button 'Verified'
   end
 
   context 'shows popover badges', :js do
@@ -136,7 +136,7 @@ describe 'GPG signed commits' do
       visit project_commit_path(project, GpgHelpers::SIGNED_AND_AUTHORED_SHA)
 
       # wait for the signature to get generated
-      expect(page).to have_link 'Verified'
+      expect(page).to have_button 'Verified'
 
       user_1.destroy!
 
-- 
cgit v1.2.1


From 24e13c86535796b01a7569bd4149d9a65754f0e5 Mon Sep 17 00:00:00 2001
From: Jonathan Love <4422532-jondlove@users.noreply.gitlab.com>
Date: Mon, 19 Aug 2019 02:56:45 +0000
Subject: Escape vertical bars inside code blocks in quick_actions.md -
 Markdown parsing in previews and Gitlab.com appear to parse these as table
 delimiters even when inside a code block.

---
 doc/user/project/quick_actions.md | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/doc/user/project/quick_actions.md b/doc/user/project/quick_actions.md
index 6758adf2b43..647250bd02a 100644
--- a/doc/user/project/quick_actions.md
+++ b/doc/user/project/quick_actions.md
@@ -40,18 +40,20 @@ discussions, and descriptions:
 | `/label ~label1 ~label2`   | Add label(s). Label names can also start without ~ but mixed syntax is not supported.                   | ✓     | ✓             |
 | `/unlabel ~label1 ~label2` | Remove all or specific label(s)| ✓     | ✓             |
 | `/relabel ~label1 ~label2` | Replace existing label(s) with those specified | ✓     | ✓             |
-| `/copy_metadata <#issue | !merge_request>` | Copy labels and milestone from other issue or merge request in the project | ✓     | ✓             |
+| `/copy_metadata <#issue>` | Copy labels and milestone from another issue in the project | ✓     | ✓             |
+| `/copy_metadata <!merge_request>` | Copy labels and milestone from another merge request in the project | ✓     | ✓             |
 | `/estimate <1w 3d 2h 14m>` | Set time estimate | ✓     | ✓             |
 | `/remove_estimate`       | Remove time estimate             | ✓     | ✓             |
-| `/spend <time(1h 30m | -1h 5m)> <date(YYYY-MM-DD)>` | Add or subtract spent time; optionally, specify the date that time was spent on | ✓     | ✓             |
+| `/spend <time(1h 30m)> <date(YYYY-MM-DD)>` | Add spent time; optionally, specify the date that time was spent on | ✓     | ✓             |
+| `/spend <time(-1h 5m)> <date(YYYY-MM-DD)>` | Subtract spent time; optionally, specify the date that time was spent on | ✓     | ✓             |
 | `/remove_time_spent`       | Remove time spent              | ✓     | ✓             |
 | `/lock`                    | Lock the thread                | ✓     | ✓             |
 | `/unlock`                  | Unlock the thread              | ✓     | ✓             |
-| `/due <in 2 days | this Friday | December 31st>`| Set due date | ✓ | |
+| `/due <date>` | Set due date. Examples of valid `<date>` include `in 2 days`, `this Friday` and `December 31st`. | ✓ | |
 | `/remove_due_date`         | Remove due date                | ✓     |               |
-| `/weight <0 | 1 | 2 | ...>` | Set weight **(STARTER)**       | ✓     |               |
+| `/weight <value>` | Set weight. Valid options for `<value>` include `0`, `1`, `2`, etc. **(STARTER)**       | ✓     |               |
 | `/clear_weight`            | Clears weight **(STARTER)**    | ✓     |               |
-| `/epic <&epic | group&epic | Epic URL>` | Add to epic **(ULTIMATE)** | ✓ |             |
+| `/epic <epic>` | Add to epic `<epic>`. The `<epic>` value should be in the format of `&epic`, `group&epic` or `epic-URL`. **(ULTIMATE)** | ✓ |             |
 | `/remove_epic`             | Removes from epic **(ULTIMATE)** | ✓   |               |
 | `/promote`                 | Promote issue to epic **(ULTIMATE)** | ✓   |               |
 | `/confidential`            | Make confidential              | ✓     |               |
@@ -110,9 +112,9 @@ The following quick actions are applicable for epics threads and description:
 | `/label ~label1 ~label2`   | Add label(s)                            |
 | `/unlabel ~label1 ~label2` | Remove all or specific label(s)         |
 | `/relabel ~label1 ~label2` | Replace existing label(s) with those specified |
-| `/child_epic <&epic |  group&epic | Epic URL>` | Adds child epic to epic ([introduced in GitLab 12.0](https://gitlab.com/gitlab-org/gitlab-ee/issues/7330)) |
-| `/remove_child_epic <&epic | group&epic | Epic URL>` | Removes child epic from epic ([introduced in GitLab 12.0](https://gitlab.com/gitlab-org/gitlab-ee/issues/7330)) |
-| `/parent_epic <&epic |  group&epic | Epic URL>` | Sets parent epic to epic ([introduced in GitLab 12.1](https://gitlab.com/gitlab-org/gitlab-ee/issues/10556)) |
+| `/child_epic <epic>` | Adds child epic to `<epic>`. The `<epic>` value should be in the format of `&epic`, `group&epic` or `epic-URL`. ([Introduced in GitLab 12.0](https://gitlab.com/gitlab-org/gitlab-ee/issues/7330)) **(ULTIMATE)**|
+| `/remove_child_epic <epic>` | Removes child epic from `<epic>`. The `<epic>` value should be in the format of `&epic`, `group&epic` or `epic-URL`. ([Introduced in GitLab 12.0](https://gitlab.com/gitlab-org/gitlab-ee/issues/7330)) **(ULTIMATE)** |
+| `/parent_epic <epic>` | Sets parent epic to `<epic>`. The `<epic>` value should be in the format of `&epic`, `group&epic` or `epic-URL`. ([introduced in GitLab 12.1](https://gitlab.com/gitlab-org/gitlab-ee/issues/10556)) **(ULTIMATE)** |
 | `/remove_parent_epic` | Removes parent epic from epic ([introduced in GitLab 12.1](https://gitlab.com/gitlab-org/gitlab-ee/issues/10556)) |
 
 <!-- ## Troubleshooting
-- 
cgit v1.2.1


From 4aa1e83b6312cdc8de6cf09069d4bd7aa67923e8 Mon Sep 17 00:00:00 2001
From: Kemais Ehlers <kemais_ehlers@byu.edu>
Date: Mon, 19 Aug 2019 03:00:18 +0000
Subject: Update doc/user/project/integrations/jira.md,
 doc/user/project/integrations/img/jira_service_page_v12_2.png files Deleted
 doc/user/project/integrations/img/jira_service_page.png

---
 doc/user/project/integrations/img/jira_service_page.png | Bin 22464 -> 0 bytes
 .../integrations/img/jira_service_page_v12_2.png        | Bin 0 -> 57327 bytes
 doc/user/project/integrations/jira.md                   |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)
 delete mode 100644 doc/user/project/integrations/img/jira_service_page.png
 create mode 100644 doc/user/project/integrations/img/jira_service_page_v12_2.png

diff --git a/doc/user/project/integrations/img/jira_service_page.png b/doc/user/project/integrations/img/jira_service_page.png
deleted file mode 100644
index 76fd5f4641c..00000000000
Binary files a/doc/user/project/integrations/img/jira_service_page.png and /dev/null differ
diff --git a/doc/user/project/integrations/img/jira_service_page_v12_2.png b/doc/user/project/integrations/img/jira_service_page_v12_2.png
new file mode 100644
index 00000000000..ba7dad9b438
Binary files /dev/null and b/doc/user/project/integrations/img/jira_service_page_v12_2.png differ
diff --git a/doc/user/project/integrations/jira.md b/doc/user/project/integrations/jira.md
index ca990ee6c32..61f6f6c9412 100644
--- a/doc/user/project/integrations/jira.md
+++ b/doc/user/project/integrations/jira.md
@@ -93,7 +93,7 @@ even if the status you are changing to is the same.
 After saving the configuration, your GitLab project will be able to interact
 with all Jira projects in your Jira instance and you'll see the Jira link on the GitLab project pages that takes you to the appropriate Jira project.
 
-![Jira service page](img/jira_service_page.png)
+![Jira service page](img/jira_service_page_v12_2.png)
 
 ## Jira issues
 
-- 
cgit v1.2.1


From f3184b226872b008158fbe3ad832c14e34dc67bc Mon Sep 17 00:00:00 2001
From: Arun Kumar Mohan <arunmohandm@gmail.com>
Date: Mon, 19 Aug 2019 00:02:10 -0500
Subject: Fix minor typo: CE -> EE

---
 doc/development/automatic_ce_ee_merge.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/development/automatic_ce_ee_merge.md b/doc/development/automatic_ce_ee_merge.md
index 98b8a48abf4..001a92790e1 100644
--- a/doc/development/automatic_ce_ee_merge.md
+++ b/doc/development/automatic_ce_ee_merge.md
@@ -200,7 +200,7 @@ code.
 ### Why merge automatically?
 
 As we work towards continuous deployments and a single repository for both CE
-and EE, we need to first make sure that all CE changes make their way into CE as
+and EE, we need to first make sure that all CE changes make their way into EE as
 fast as possible. Past experiences and data have shown that periodic CE to EE
 merge requests do not scale, and often take a very long time to complete. For
 example, [in this
-- 
cgit v1.2.1


From 7b6888d302ec7549563d844aa270ddfbb5e767b0 Mon Sep 17 00:00:00 2001
From: Evan Read <eread@gitlab.com>
Date: Mon, 19 Aug 2019 05:12:44 +0000
Subject: Migrate cycle analytics topic to new section

Also fixes links to new section and refactors some existing content
for the GitLab 12.2 changes.
---
 doc/user/analytics/cycle_analytics.md              | 182 +++++++++++++++++++++
 doc/user/analytics/index.md                        |  22 +++
 doc/user/permissions.md                            |  19 ++-
 doc/user/project/cycle_analytics.md                | 182 +--------------------
 .../project/img/cycle_analytics_landing_page.png   | Bin 64872 -> 0 bytes
 5 files changed, 218 insertions(+), 187 deletions(-)
 create mode 100644 doc/user/analytics/cycle_analytics.md
 create mode 100644 doc/user/analytics/index.md
 delete mode 100644 doc/user/project/img/cycle_analytics_landing_page.png

diff --git a/doc/user/analytics/cycle_analytics.md b/doc/user/analytics/cycle_analytics.md
new file mode 100644
index 00000000000..b7389c8689d
--- /dev/null
+++ b/doc/user/analytics/cycle_analytics.md
@@ -0,0 +1,182 @@
+# Cycle Analytics
+
+> - Introduced prior to GitLab 12.2 at the project level.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/12077) in [GitLab Premium](https://about.gitlab.com/pricing/) 12.2 at the group level (enabled by feature flag `analytics`).
+
+Cycle Analytics measures the time spent to go from an [idea to production] - also known
+as cycle time - for each of your projects. Cycle Analytics displays the median time for an idea to
+reach production, along with the time typically spent in each DevOps stage along the way.
+
+Cycle Analytics is useful in order to quickly determine the velocity of a given
+project. It points to bottlenecks in the development process, enabling management
+to uncover, triage, and identify the root cause of slowdowns in the software development life cycle.
+
+Cycle Analytics is tightly coupled with the [GitLab flow] and
+calculates a separate median for each stage.
+
+## Overview
+
+Cycle Analytics is available:
+
+- From GitLab 12.2, at the group level in the analytics workspace at
+  **Analytics > Cycle Analytics**. **(PREMIUM)**
+
+  In the future, multiple groups will be selectable which will effectively make this an
+  instance-level feature.
+
+  NOTE: **Note:**
+  Requires the [analytics workspace](index.md) to be enabled.
+
+- At the project level via **Project > Cycle Analytics**.
+
+There are seven stages that are tracked as part of the Cycle Analytics calculations.
+
+- **Issue** (Tracker)
+  - Time to schedule an issue (by milestone or by adding it to an issue board)
+- **Plan** (Board)
+  - Time to first commit
+- **Code** (IDE)
+  - Time to create a merge request
+- **Test** (CI)
+  - Time it takes GitLab CI/CD to test your code
+- **Review** (Merge Request/MR)
+  - Time spent on code review
+- **Staging** (Continuous Deployment)
+  - Time between merging and deploying to production
+- **Production** (Total)
+  - Total lifecycle time; i.e. the velocity of the project or team
+
+## How the data is measured
+
+Cycle Analytics records cycle time and data based on the project issues with the
+exception of the staging and production stages, where only data deployed to
+production are measured.
+
+Specifically, if your CI is not set up and you have not defined a `production`
+or `production/*` [environment], then you will not have any data for those stages.
+
+Each stage of Cycle Analytics is further described in the table below.
+
+| **Stage** | **Description** |
+| --------- | --------------- |
+| Issue     | Measures the median time between creating an issue and taking action to solve it, by either labeling it or adding it to a milestone, whatever comes first. The label will be tracked only if it already has an [Issue Board list](../project/issue_board.md#creating-a-new-list) created for it. |
+| Plan      | Measures the median time between the action you took for the previous stage, and pushing the first commit to the branch. The very first commit of the branch is the one that triggers the separation between **Plan** and **Code**, and at least one of the commits in the branch needs to contain the related issue number (e.g., `#42`). If none of the commits in the branch mention the related issue number, it is not considered to the measurement time of the stage. |
+| Code      | Measures the median time between pushing a first commit (previous stage) and creating a merge request (MR) related to that commit. The key to keep the process tracked is to include the [issue closing pattern](../project/issues/managing_issues.md#closing-issues-automatically) to the description of the merge request (for example, `Closes #xxx`, where `xxx` is the number of the issue related to this merge request). If the issue closing pattern is not present in the merge request description, the MR is not considered to the measurement time of the stage. |
+| Test      | Measures the median time to run the entire pipeline for that project. It's related to the time GitLab CI takes to run every job for the commits pushed to that merge request defined in the previous stage. It is basically the start->finish time for all pipelines. |
+| Review    | Measures the median time taken to review the merge request that has closing issue pattern, between its creation and until it's merged. |
+| Staging   | Measures the median time between merging the merge request with closing issue pattern until the very first deployment to production. It's tracked by the [environment] set to `production` or matching `production/*` (case-sensitive, `Production` won't work) in your GitLab CI configuration. If there isn't a production environment, this is not tracked. |
+| Production| The sum of all time (medians) taken to run the entire process, from issue creation to deploying the code to production. |
+
+---
+
+How this works, behind the scenes:
+
+1. Issues and merge requests are grouped together in pairs, such that for each
+   `<issue, merge request>` pair, the merge request has the [issue closing pattern](../project/issues/managing_issues.md#closing-issues-automatically)
+   for the corresponding issue. All other issues and merge requests are **not**
+   considered.
+1. Then the `<issue, merge request>` pairs are filtered out by last XX days (specified
+   by the UI - default is 90 days). So it prohibits these pairs from being considered.
+1. For the remaining `<issue, merge request>` pairs, we check the information that
+   we need for the stages, like issue creation date, merge request merge time,
+   etc.
+
+To sum up, anything that doesn't follow [GitLab flow] will not be tracked and the
+Cycle Analytics dashboard will not present any data for:
+
+- merge requests that do not close an issue.
+- issues not labeled with a label present in the Issue Board or for issues not assigned a milestone.
+- staging and production stages, if the project has no `production` or `production/*`
+  environment.
+
+## Example workflow
+
+Below is a simple fictional workflow of a single cycle that happens in a
+single day passing through all seven stages. Note that if a stage does not have
+a start and a stop mark, it is not measured and hence not calculated in the median
+time. It is assumed that milestones are created and CI for testing and setting
+environments is configured.
+
+1. Issue is created at 09:00 (start of **Issue** stage).
+1. Issue is added to a milestone at 11:00 (stop of **Issue** stage / start of
+   **Plan** stage).
+1. Start working on the issue, create a branch locally and make one commit at
+   12:00.
+1. Make a second commit to the branch which mentions the issue number at 12.30
+   (stop of **Plan** stage / start of **Code** stage).
+1. Push branch and create a merge request that contains the [issue closing pattern](../project/issues/managing_issues.md#closing-issues-automatically)
+   in its description at 14:00 (stop of **Code** stage / start of **Test** and
+   **Review** stages).
+1. The CI starts running your scripts defined in [`.gitlab-ci.yml`][yml] and
+   takes 5min (stop of **Test** stage).
+1. Review merge request, ensure that everything is OK and merge the merge
+   request at 19:00. (stop of **Review** stage / start of **Staging** stage).
+1. Now that the merge request is merged, a deployment to the `production`
+   environment starts and finishes at 19:30 (stop of **Staging** stage).
+1. The cycle completes and the sum of the median times of the previous stages
+   is recorded to the **Production** stage. That is the time between creating an
+   issue and deploying its relevant merge request to production.
+
+From the above example you can conclude the time it took each stage to complete
+as long as their total time:
+
+- **Issue**:  2h (11:00 - 09:00)
+- **Plan**:   1h (12:00 - 11:00)
+- **Code**:   2h (14:00 - 12:00)
+- **Test**:   5min
+- **Review**: 5h (19:00 - 14:00)
+- **Staging**:  30min (19:30 - 19:00)
+- **Production**: Since this stage measures the sum of median time off all
+  previous stages, we cannot calculate it if we don't know the status of the
+  stages before. In case this is the very first cycle that is run in the project,
+  then the **Production** time is 10h 30min (19:30 - 09:00)
+
+A few notes:
+
+- In the above example we demonstrated that it doesn't matter if your first
+  commit doesn't mention the issue number, you can do this later in any commit
+  of the branch you are working on.
+- You can see that the **Test** stage is not calculated to the overall time of
+  the cycle since it is included in the **Review** process (every MR should be
+  tested).
+- The example above was just **one cycle** of the seven stages. Add multiple
+  cycles, calculate their median time and the result is what the dashboard of
+  Cycle Analytics is showing.
+
+## Permissions
+
+The current permissions on the Project Cycle Analytics dashboard are:
+
+- Public projects - anyone can access
+- Internal projects - any authenticated user can access
+- Private projects - any member Guest and above can access
+
+You can [read more about permissions][permissions] in general.
+
+NOTE: **Note:**
+As of GitLab 12.2, the project-level page is deprecated. You should access
+project-level Cycle Analytics from **Analytics > Cycle Analytics** in the top
+navigation bar. We will ensure that the same project-level functionality is available
+to CE users in the new analytics space.
+
+For Cycle Analytics functionality introduced in GitLab 12.2 and later:
+
+- Users must have Reporter access or above.
+- Features are available only on
+  [Premium or Silver tiers](https://about.gitlab.com/pricing/) and above.
+
+## More resources
+
+Learn more about Cycle Analytics in the following resources:
+
+- [Cycle Analytics feature page](https://about.gitlab.com/features/cycle-analytics/)
+- [Cycle Analytics feature preview](https://about.gitlab.com/2016/09/16/feature-preview-introducing-cycle-analytics/)
+- [Cycle Analytics feature highlight](https://about.gitlab.com/2016/09/21/cycle-analytics-feature-highlight/)
+
+[ce-5986]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5986
+[ce-20975]: https://gitlab.com/gitlab-org/gitlab-ce/issues/20975
+[environment]: ../../ci/yaml/README.md#environment
+[GitLab flow]: ../../workflow/gitlab_flow.md
+[idea to production]: https://about.gitlab.com/2016/08/05/continuous-integration-delivery-and-deployment-with-gitlab/#from-idea-to-production-with-gitlab
+[permissions]: ../permissions.md
+[yml]: ../../ci/yaml/README.md
diff --git a/doc/user/analytics/index.md b/doc/user/analytics/index.md
new file mode 100644
index 00000000000..ec719c0b4a1
--- /dev/null
+++ b/doc/user/analytics/index.md
@@ -0,0 +1,22 @@
+# Analytics workspace
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/12077) in GitLab 12.2 (enabled using `analytics` feature flag).
+
+The Analytics workspace will make it possible to aggregate analytics across
+GitLab, so that users can view information across multiple projects and groups
+in one place.
+
+To access the centralized analytics workspace:
+
+1. Ensure it's enabled. Requires a GitLab administrator to enable it with the `analytics` feature
+   flag.
+1. Once enabled, click on **Analytics** from the top navigation bar.
+
+## Available analytics
+
+From the centralized analytics workspace, the following analytics are available:
+
+- [Cycle Analytics](cycle_analytics.md).
+
+NOTE: **Note:**
+Project-level Cycle Analytics are still available at a project's **Project > Cycle Analytics**.
diff --git a/doc/user/permissions.md b/doc/user/permissions.md
index 4fd7c5abf78..9ecc8a80b3a 100644
--- a/doc/user/permissions.md
+++ b/doc/user/permissions.md
@@ -162,7 +162,7 @@ to learn more.
 ### Cycle Analytics permissions
 
 Find the current permissions on the Cycle Analytics dashboard on
-the [documentation on Cycle Analytics permissions](project/cycle_analytics.md#permissions).
+the [documentation on Cycle Analytics permissions](analytics/cycle_analytics.md#permissions).
 
 ### Issue Board permissions
 
@@ -237,13 +237,16 @@ To learn more, read through the documentation on
 
 ## Guest User
 
-Create a user and assign to a project with a role as `Guest` user, this user 
-will be considered as guest user by GitLab and will not take up the license. 
-There is no specific `Guest` role for newly created users. If this user will 
-be assigned a higher role to any of the projects and groups then this user will 
-take a license seat. If a user creates a project this user becomes a maintainer, 
-therefore, takes up a license seat as well, in order to prevent this you have 
-to go and edit user profile and mark the user as External.
+When a user is given `Guest` permissions on a project and/or group, and holds no
+higher permission level on any other project or group on the instance, the user
+is considered a guest user by GitLab and will not consume a license seat.
+There is no other specific "guest" designation for newly created users.
+
+If the user is assigned a higher role on any projects or groups, the user will
+take a license seat. If a user creates a project, the user becomes a `Maintainer`
+on the project, resulting in the use of a license seat. To prevent a guest user
+from creating projects, you can edit the user profile to mark the user as
+[External](#external-users-permissions).
 
 ## External users permissions
 
diff --git a/doc/user/project/cycle_analytics.md b/doc/user/project/cycle_analytics.md
index 424bee6e9f1..87577c9ec88 100644
--- a/doc/user/project/cycle_analytics.md
+++ b/doc/user/project/cycle_analytics.md
@@ -1,181 +1,5 @@
-# Cycle Analytics
-
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/12077) at a group level in [GitLab Premium and Silver](https://about.gitlab.com/pricing/) 12.2 (enabled by feature flag `analytics`).
-
-Cycle Analytics measures the time spent to go from an [idea to production] - also known
-as cycle time - for each of your projects. Cycle Analytics displays the median time for an idea to
-reach production, along with the time typically spent in each DevOps stage along the way.
-
-Cycle Analytics is useful in order to quickly determine the velocity of a given
-project. It points to bottlenecks in the development process, enabling management
-to uncover, triage, and root-cause slowdowns in the software development life cycle.
-
-Cycle Analytics is tightly coupled with the [GitLab flow] and
-calculates a separate median for each stage.
-
-## Overview
-
-Cycle Analytics are available at a:
-
-- Group level from the top navigation bar **Analytics > Cycle Analytics**. **(PREMIUM)**
-
-  In the future, multiple groups will be selectable which will effectively make this an
-  instance-level feature.
-
-- Project level from a project's **Project > Cycle Analytics**.
-
-  ![Cycle Analytics landing page](img/cycle_analytics_landing_page.png)
-
-There are seven stages that are tracked as part of the Cycle Analytics calculations.
-
-- **Issue** (Tracker)
-  - Time to schedule an issue (by milestone or by adding it to an issue board)
-- **Plan** (Board)
-  - Time to first commit
-- **Code** (IDE)
-  - Time to create a merge request
-- **Test** (CI)
-  - Time it takes GitLab CI/CD to test your code
-- **Review** (Merge Request/MR)
-  - Time spent on code review
-- **Staging** (Continuous Deployment)
-  - Time between merging and deploying to production
-- **Production** (Total)
-  - Total lifecycle time; i.e. the velocity of the project or team
-
-## How the data is measured
-
-Cycle Analytics records cycle time and data based on the project issues with the
-exception of the staging and production stages, where only data deployed to
-production are measured.
-
-Specifically, if your CI is not set up and you have not defined a `production`
-or `production/*` [environment], then you will not have any data for those stages.
-
-Below you can see in more detail what the various stages of Cycle Analytics mean.
-
-| **Stage** | **Description** |
-| --------- | --------------- |
-| Issue     | Measures the median time between creating an issue and taking action to solve it, by either labeling it or adding it to a milestone, whatever comes first. The label will be tracked only if it already has an [Issue Board list][board] created for it. |
-| Plan      | Measures the median time between the action you took for the previous stage, and pushing the first commit to the branch. The very first commit of the branch is the one that triggers the separation between **Plan** and **Code**, and at least one of the commits in the branch needs to contain the related issue number (e.g., `#42`). If none of the commits in the branch mention the related issue number, it is not considered to the measurement time of the stage. |
-| Code      | Measures the median time between pushing a first commit (previous stage) and creating a merge request (MR) related to that commit. The key to keep the process tracked is to include the [issue closing pattern] to the description of the merge request (for example, `Closes #xxx`, where `xxx` is the number of the issue related to this merge request). If the issue closing pattern is not present in the merge request description, the MR is not considered to the measurement time of the stage. |
-| Test      | Measures the median time to run the entire pipeline for that project. It's related to the time GitLab CI takes to run every job for the commits pushed to that merge request defined in the previous stage. It is basically the start->finish time for all pipelines. |
-| Review    | Measures the median time taken to review the merge request that has closing issue pattern, between its creation and until it's merged. |
-| Staging   | Measures the median time between merging the merge request with closing issue pattern until the very first deployment to production. It's tracked by the [environment] set to `production` or matching `production/*` (case-sensitive, `Production` won't work) in your GitLab CI configuration. If there isn't a production environment, this is not tracked. |
-| Production| The sum of all time (medians) taken to run the entire process, from issue creation to deploying the code to production. |
-
+---
+redirect_to: '../analytics/cycle_analytics.md'
 ---
 
-Here's a little explanation of how this works behind the scenes:
-
-1. Issues and merge requests are grouped together in pairs, such that for each
-   `<issue, merge request>` pair, the merge request has the [issue closing pattern]
-   for the corresponding issue. All other issues and merge requests are **not**
-   considered.
-1. Then the `<issue, merge request>` pairs are filtered out by last XX days (specified
-   by the UI - default is 90 days). So it prohibits these pairs from being considered.
-1. For the remaining `<issue, merge request>` pairs, we check the information that
-   we need for the stages, like issue creation date, merge request merge time,
-   etc.
-
-To sum up, anything that doesn't follow the [GitLab flow] won't be tracked at all.
-So, the Cycle Analytics dashboard won't present any data:
-
-- For merge requests that do not close an issue.
-- For issues not labeled with a label present in the Issue Board or for issues not assigned a milestone.
-- For staging and production stages, if the project has no `production` or `production/*`
-  environment.
-
-## Example workflow
-
-Below is a simple fictional workflow of a single cycle that happens in a
-single day passing through all seven stages. Note that if a stage does not have
-a start and a stop mark, it is not measured and hence not calculated in the median
-time. It is assumed that milestones are created and CI for testing and setting
-environments is configured.
-
-1. Issue is created at 09:00 (start of **Issue** stage).
-1. Issue is added to a milestone at 11:00 (stop of **Issue** stage / start of
-   **Plan** stage).
-1. Start working on the issue, create a branch locally and make one commit at
-   12:00.
-1. Make a second commit to the branch which mentions the issue number at 12.30
-   (stop of **Plan** stage / start of **Code** stage).
-1. Push branch and create a merge request that contains the [issue closing pattern]
-   in its description at 14:00 (stop of **Code** stage / start of **Test** and
-   **Review** stages).
-1. The CI starts running your scripts defined in [`.gitlab-ci.yml`][yml] and
-   takes 5min (stop of **Test** stage).
-1. Review merge request, ensure that everything is OK and merge the merge
-   request at 19:00. (stop of **Review** stage / start of **Staging** stage).
-1. Now that the merge request is merged, a deployment to the `production`
-   environment starts and finishes at 19:30 (stop of **Staging** stage).
-1. The cycle completes and the sum of the median times of the previous stages
-   is recorded to the **Production** stage. That is the time between creating an
-   issue and deploying its relevant merge request to production.
-
-From the above example you can conclude the time it took each stage to complete
-as long as their total time:
-
-- **Issue**:  2h (11:00 - 09:00)
-- **Plan**:   1h (12:00 - 11:00)
-- **Code**:   2h (14:00 - 12:00)
-- **Test**:   5min
-- **Review**: 5h (19:00 - 14:00)
-- **Staging**:  30min (19:30 - 19:00)
-- **Production**: Since this stage measures the sum of median time off all
-  previous stages, we cannot calculate it if we don't know the status of the
-  stages before. In case this is the very first cycle that is run in the project,
-  then the **Production** time is 10h 30min (19:30 - 09:00)
-
-A few notes:
-
-- In the above example we demonstrated that it doesn't matter if your first
-  commit doesn't mention the issue number, you can do this later in any commit
-  of the branch you are working on.
-- You can see that the **Test** stage is not calculated to the overall time of
-  the cycle since it is included in the **Review** process (every MR should be
-  tested).
-- The example above was just **one cycle** of the seven stages. Add multiple
-  cycles, calculate their median time and the result is what the dashboard of
-  Cycle Analytics is showing.
-
-## Permissions
-
-The current permissions on the Project Cycle Analytics dashboard are:
-
-- Public projects - anyone can access
-- Internal projects - any authenticated user can access
-- Private projects - any member Guest and above can access
-
-You can [read more about permissions][permissions] in general.
-
-NOTE: **Note:**
-As of GitLab 12.2, the project-level page is deprecated. You should access
-project-level Cycle Analytics from **Analytics > Cycle Analytics** in the top
-navigation bar. We will ensure that the same project-level functionality is available
-to CE users in the new analytics space.
-
-For Cycle Analytics functionality introduced in GitLab 12.2 and later:
-
-- Users must have Reporter access or above.
-- Features are available only on
-  [Premium or Silver tiers](https://about.gitlab.com/pricing/) and above.
-
-## More resources
-
-Learn more about Cycle Analytics in the following resources:
-
-- [Cycle Analytics feature page](https://about.gitlab.com/features/cycle-analytics/)
-- [Cycle Analytics feature preview](https://about.gitlab.com/2016/09/16/feature-preview-introducing-cycle-analytics/)
-- [Cycle Analytics feature highlight](https://about.gitlab.com/2016/09/21/cycle-analytics-feature-highlight/)
-
-[board]: issue_board.md#creating-a-new-list
-[ce-5986]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5986
-[ce-20975]: https://gitlab.com/gitlab-org/gitlab-ce/issues/20975
-[environment]: ../../ci/yaml/README.md#environment
-[GitLab flow]: ../../workflow/gitlab_flow.md
-[idea to production]: https://about.gitlab.com/2016/08/05/continuous-integration-delivery-and-deployment-with-gitlab/#from-idea-to-production-with-gitlab
-[issue closing pattern]: issues/managing_issues.md#closing-issues-automatically
-[permissions]: ../permissions.md
-[yml]: ../../ci/yaml/README.md
+This document was moved to [another location](../analytics/cycle_analytics.md)
diff --git a/doc/user/project/img/cycle_analytics_landing_page.png b/doc/user/project/img/cycle_analytics_landing_page.png
deleted file mode 100644
index c0c07e84a82..00000000000
Binary files a/doc/user/project/img/cycle_analytics_landing_page.png and /dev/null differ
-- 
cgit v1.2.1


From f45eacf0070fdbf743034ce4c70e87221dbb7955 Mon Sep 17 00:00:00 2001
From: Jason Goodman <jgoodman@gitlab.com>
Date: Mon, 19 Aug 2019 05:52:59 +0000
Subject: Add documentation for feature flag Target Users

Add screenshot
---
 doc/user/project/operations/feature_flags.md           |  15 ++++++++++++++-
 doc/user/project/operations/img/target_users_v12_2.png | Bin 0 -> 42768 bytes
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 doc/user/project/operations/img/target_users_v12_2.png

diff --git a/doc/user/project/operations/feature_flags.md b/doc/user/project/operations/feature_flags.md
index 19ccde6e16a..75b0623e6b0 100644
--- a/doc/user/project/operations/feature_flags.md
+++ b/doc/user/project/operations/feature_flags.md
@@ -112,6 +112,19 @@ If this strategy is selected, then the Unleash client **must** be given a user i
 
 **Percent rollout (logged in users)** is implemented using the Unleash [gradualRolloutUserId](https://unleash.github.io/docs/activation_strategy#gradualrolloutuserid) activation strategy.
 
+## Target Users
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/8240) in GitLab 12.2.
+
+A feature flag may be enabled for a list of target users.
+
+![Feature flag target users](img/target_users_v12_2.png)
+
+CAUTION: **Caution:**
+The Unleash client **must** be given a user id for the feature to be enabled for target users. See the [Ruby example](#ruby-application-example) below.
+
+**Target users** is implemented using the Unleash [userWithId](https://unleash.github.io/docs/activation_strategy#userwithid) activation strategy.
+
 ## Integrating with your application
 
 In order to use Feature Flags, you need to first
@@ -207,7 +220,7 @@ func main() {
 
 Here's an example of how to integrate the feature flags in a Ruby application.
 
-The Unleash client is given a user id for use with a **Percent rollout (logged in users)** rollout strategy.
+The Unleash client is given a user id for use with a **Percent rollout (logged in users)** rollout strategy or a list of **Target Users**.
 
 ```ruby
 #!/usr/bin/env ruby
diff --git a/doc/user/project/operations/img/target_users_v12_2.png b/doc/user/project/operations/img/target_users_v12_2.png
new file mode 100644
index 00000000000..c88d2b7be97
Binary files /dev/null and b/doc/user/project/operations/img/target_users_v12_2.png differ
-- 
cgit v1.2.1


From 45d69889c5b3473b97d280e874658457d20b05e6 Mon Sep 17 00:00:00 2001
From: Ben Bodenmiller <bbodenmiller@hotmail.com>
Date: Mon, 19 Aug 2019 06:40:49 +0000
Subject: Improve new CI job permissions model docs

---
 doc/user/project/new_ci_build_permissions_model.md | 29 +++++++++++++---------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/doc/user/project/new_ci_build_permissions_model.md b/doc/user/project/new_ci_build_permissions_model.md
index 03ae24242e3..8606d92f20c 100644
--- a/doc/user/project/new_ci_build_permissions_model.md
+++ b/doc/user/project/new_ci_build_permissions_model.md
@@ -28,13 +28,13 @@ The reasons to do it like that are:
 With the new behavior, any job that is triggered by the user, is also marked
 with their read permissions. When a user does a `git push` or changes files through
 the web UI, a new pipeline will be usually created. This pipeline will be marked
-as created be the pusher (local push or via the UI) and any job created in this
+as created by the pusher (local push or via the UI) and any job created in this
 pipeline will have the read permissions of the pusher but not write permissions.
 
 This allows us to make it really easy to evaluate the access for all projects
 that have [Git submodules][gitsub] or are using container images that the pusher
-would have access too. **The permission is granted only for time that job is
-running. The access is revoked after the job is finished.**
+would have access too. **The permission is granted only for the time that the job
+is running. The access is revoked after the job is finished.**
 
 ## Types of users
 
@@ -74,7 +74,7 @@ We try to make sure that this token doesn't leak by:
 
 1. Securing all API endpoints to not expose the job token.
 1. Masking the job token from job logs.
-1. Allowing to use the job token **only** when job is running.
+1. Granting permissions to the job token **only** when the job is running.
 
 However, this brings a question about the Runners security. To make sure that
 this token doesn't leak, you should also make sure that you configure
@@ -86,12 +86,6 @@ your Runners in the most possible secure way, by avoiding the following:
 By using an insecure GitLab Runner configuration, you allow the rogue developers
 to steal the tokens of other jobs.
 
-## Pipeline triggers
-
-Since 9.0 [pipeline triggers][triggers] do support the new permission model.
-The new triggers do impersonate their associated user including their access
-to projects and their project permissions. 
-
 ## Before GitLab 8.12
 
 In versions before GitLab 8.12, all CI jobs would use the CI Runner's token
@@ -203,7 +197,7 @@ Container Registries for private projects.
 > **Notes:**
 >
 > - GitLab Runner versions prior to 1.8 don't incorporate the introduced changes
->   for permissions. This makes the `image:` directive to not work with private
+>   for permissions. This makes the `image:` directive not work with private
 >   projects automatically and it needs to be configured manually on Runner's host
 >   with a predefined account (for example administrator's personal account with
 >   access token created explicitly for this purpose). This issue is resolved with
@@ -227,11 +221,22 @@ test:
     - docker run $CI_REGISTRY/group/other-project:latest
 ```
 
+### Pipeline triggers
+
+Since 9.0 [pipeline triggers][triggers] do support the new permission model.
+The new triggers do impersonate their associated user including their access
+to projects and their project permissions.
+
+### API
+
+GitLab API cannot be used via `CI_JOB_TOKEN` but there is a [proposal](https://gitlab.com/gitlab-org/gitlab-ce/issues/29566)
+to support it.
+
 [job permissions]: ../permissions.md#job-permissions
 [comment]: https://gitlab.com/gitlab-org/gitlab-ce/issues/22484#note_16648302
 [gitsub]: ../../ci/git_submodules.md
 [https]: ../admin_area/settings/visibility_and_access_controls.md#enabled-git-access-protocols
-[triggers]: ../../ci/triggers/README.md
+[triggers]: ../../ci/triggers/README.md#ci-job-token
 [update-docs]: https://gitlab.com/gitlab-org/gitlab-ce/tree/master/doc/update
 [workhorse]: https://gitlab.com/gitlab-org/gitlab-workhorse
 [jobenv]: ../../ci/variables/README.md#predefined-environment-variables
-- 
cgit v1.2.1


From 5e8f16bd00e7ed67f92ee3ea86381758ecc23585 Mon Sep 17 00:00:00 2001
From: Ezekiel Kigbo <ekigbo@gitlab.com>
Date: Mon, 19 Aug 2019 06:51:06 +0000
Subject: Move cycle analytics stages templates to vue

The existing stage list items are rendered
in haml, migrating them to vuejs for future
work.

Fix alignment of median value

Test for stage_nav_item.vue
---
 .../components/stage_card_list_item.vue            |  41 +++++
 .../cycle_analytics/components/stage_nav_item.vue  |  88 ++++++++++
 .../cycle_analytics/cycle_analytics_bundle.js      |   2 +
 app/assets/stylesheets/pages/cycle_analytics.scss  |  50 ++----
 app/views/projects/cycle_analytics/show.html.haml  |  29 ++--
 locale/gitlab.pot                                  |   9 ++
 .../cycle_analytics/stage_nav_item_spec.js         | 177 +++++++++++++++++++++
 7 files changed, 336 insertions(+), 60 deletions(-)
 create mode 100644 app/assets/javascripts/cycle_analytics/components/stage_card_list_item.vue
 create mode 100644 app/assets/javascripts/cycle_analytics/components/stage_nav_item.vue
 create mode 100644 spec/frontend/cycle_analytics/stage_nav_item_spec.js

diff --git a/app/assets/javascripts/cycle_analytics/components/stage_card_list_item.vue b/app/assets/javascripts/cycle_analytics/components/stage_card_list_item.vue
new file mode 100644
index 00000000000..d946594a069
--- /dev/null
+++ b/app/assets/javascripts/cycle_analytics/components/stage_card_list_item.vue
@@ -0,0 +1,41 @@
+<script>
+import Icon from '~/vue_shared/components/icon.vue';
+import { GlButton } from '@gitlab/ui';
+
+export default {
+  name: 'StageCardListItem',
+  components: {
+    Icon,
+    GlButton,
+  },
+  props: {
+    isActive: {
+      type: Boolean,
+      required: true,
+    },
+    canEdit: {
+      type: Boolean,
+      default: false,
+      required: false,
+    },
+  },
+};
+</script>
+
+<template>
+  <div :class="{ active: isActive }" class="stage-nav-item d-flex pl-4 pr-4 m-0 mb-1 ml-2 rounded">
+    <slot></slot>
+    <div v-if="canEdit" class="dropdown">
+      <gl-button
+        :title="__('More actions')"
+        class="more-actions-toggle btn btn-transparent p-0"
+        data-toggle="dropdown"
+      >
+        <icon css-classes="icon" name="ellipsis_v" />
+      </gl-button>
+      <ul class="more-actions-dropdown dropdown-menu dropdown-open-left">
+        <slot name="dropdown-options"></slot>
+      </ul>
+    </div>
+  </div>
+</template>
diff --git a/app/assets/javascripts/cycle_analytics/components/stage_nav_item.vue b/app/assets/javascripts/cycle_analytics/components/stage_nav_item.vue
new file mode 100644
index 00000000000..004d335f572
--- /dev/null
+++ b/app/assets/javascripts/cycle_analytics/components/stage_nav_item.vue
@@ -0,0 +1,88 @@
+<script>
+import StageCardListItem from './stage_card_list_item.vue';
+
+export default {
+  name: 'StageNavItem',
+  components: {
+    StageCardListItem,
+  },
+  props: {
+    isDefaultStage: {
+      type: Boolean,
+      default: false,
+      required: false,
+    },
+    isActive: {
+      type: Boolean,
+      default: false,
+      required: false,
+    },
+    isUserAllowed: {
+      type: Boolean,
+      required: true,
+    },
+    title: {
+      type: String,
+      required: true,
+    },
+    value: {
+      type: String,
+      default: '',
+      required: false,
+    },
+    canEdit: {
+      type: Boolean,
+      default: false,
+      required: false,
+    },
+  },
+  computed: {
+    hasValue() {
+      return this.value && this.value.length > 0;
+    },
+    editable() {
+      return this.isUserAllowed && this.canEdit;
+    },
+  },
+};
+</script>
+
+<template>
+  <li @click="$emit('select')">
+    <stage-card-list-item :is-active="isActive" :can-edit="editable">
+      <div class="stage-nav-item-cell stage-name p-0" :class="{ 'font-weight-bold': isActive }">
+        {{ title }}
+      </div>
+      <div class="stage-nav-item-cell stage-median mr-4">
+        <template v-if="isUserAllowed">
+          <span v-if="hasValue">{{ value }}</span>
+          <span v-else class="stage-empty">{{ __('Not enough data') }}</span>
+        </template>
+        <template v-else>
+          <span class="not-available">{{ __('Not available') }}</span>
+        </template>
+      </div>
+      <template v-slot:dropdown-options>
+        <template v-if="isDefaultStage">
+          <li>
+            <button type="button" class="btn-default btn-transparent">
+              {{ __('Hide stage') }}
+            </button>
+          </li>
+        </template>
+        <template v-else>
+          <li>
+            <button type="button" class="btn-default btn-transparent">
+              {{ __('Edit stage') }}
+            </button>
+          </li>
+          <li>
+            <button type="button" class="btn-danger danger">
+              {{ __('Remove stage') }}
+            </button>
+          </li>
+        </template>
+      </template>
+    </stage-card-list-item>
+  </li>
+</template>
diff --git a/app/assets/javascripts/cycle_analytics/cycle_analytics_bundle.js b/app/assets/javascripts/cycle_analytics/cycle_analytics_bundle.js
index 671405602cc..b3ae47af750 100644
--- a/app/assets/javascripts/cycle_analytics/cycle_analytics_bundle.js
+++ b/app/assets/javascripts/cycle_analytics/cycle_analytics_bundle.js
@@ -12,6 +12,7 @@ import stageComponent from './components/stage_component.vue';
 import stageReviewComponent from './components/stage_review_component.vue';
 import stageStagingComponent from './components/stage_staging_component.vue';
 import stageTestComponent from './components/stage_test_component.vue';
+import stageNavItem from './components/stage_nav_item.vue';
 import CycleAnalyticsService from './cycle_analytics_service';
 import CycleAnalyticsStore from './cycle_analytics_store';
 
@@ -41,6 +42,7 @@ export default () => {
         import('ee_component/analytics/shared/components/projects_dropdown_filter.vue'),
       DateRangeDropdown: () =>
         import('ee_component/analytics/shared/components/date_range_dropdown.vue'),
+      'stage-nav-item': stageNavItem,
     },
     mixins: [filterMixins],
     data() {
diff --git a/app/assets/stylesheets/pages/cycle_analytics.scss b/app/assets/stylesheets/pages/cycle_analytics.scss
index 2b932d164a5..d80155a416d 100644
--- a/app/assets/stylesheets/pages/cycle_analytics.scss
+++ b/app/assets/stylesheets/pages/cycle_analytics.scss
@@ -51,27 +51,19 @@
     }
 
     .stage-header {
-      width: 26%;
-      padding-left: $gl-padding;
+      width: 18.5%;
     }
 
     .median-header {
-      width: 14%;
+      width: 21.5%;
     }
 
     .event-header {
       width: 45%;
-      padding-left: $gl-padding;
     }
 
     .total-time-header {
       width: 15%;
-      text-align: right;
-      padding-right: $gl-padding;
-    }
-
-    .stage-name {
-      font-weight: $gl-font-weight-bold;
     }
   }
 
@@ -153,23 +145,13 @@
     }
 
     .stage-nav-item {
-      display: flex;
       line-height: 65px;
-      border-top: 1px solid transparent;
-      border-bottom: 1px solid transparent;
-      border-right: 1px solid $border-color;
-      background-color: $gray-light;
+      border: 1px solid $border-color;
 
       &.active {
-        background-color: transparent;
-        border-right-color: transparent;
-        border-top-color: $border-color;
-        border-bottom-color: $border-color;
-        box-shadow: inset 2px 0 0 0 $blue-500;
-
-        .stage-name {
-          font-weight: $gl-font-weight-bold;
-        }
+        background: $blue-50;
+        border-color: $blue-300;
+        box-shadow: inset 4px 0 0 0 $blue-500;
       }
 
       &:hover:not(.active) {
@@ -178,24 +160,12 @@
         cursor: pointer;
       }
 
-      &:first-child {
-        border-top: 0;
-      }
-
-      &:last-child {
-        border-bottom: 0;
-      }
-
-      .stage-nav-item-cell {
-        &.stage-median {
-          margin-left: auto;
-          margin-right: $gl-padding;
-          min-width: calc(35% - #{$gl-padding});
-        }
+      .stage-nav-item-cell.stage-name {
+        width: 44.5%;
       }
 
-      .stage-name {
-        padding-left: 16px;
+      .stage-nav-item-cell.stage-median {
+        min-width: 43%;
       }
 
       .stage-empty,
diff --git a/app/views/projects/cycle_analytics/show.html.haml b/app/views/projects/cycle_analytics/show.html.haml
index 59f0afd59e6..2b594c125f4 100644
--- a/app/views/projects/cycle_analytics/show.html.haml
+++ b/app/views/projects/cycle_analytics/show.html.haml
@@ -34,40 +34,29 @@
                       {{ n__('Last %d day', 'Last %d days', 90) }}
     .stage-panel-container
       .card.stage-panel
-        .card-header
+        .card-header.border-bottom-0
           %nav.col-headers
             %ul
-              %li.stage-header
-                %span.stage-name
+              %li.stage-header.pl-5
+                %span.stage-name.font-weight-bold
                   {{ s__('ProjectLifecycle|Stage') }}
                 %i.has-tooltip.fa.fa-question-circle{ "data-placement" => "top", title: _("The phase of the development lifecycle."), "aria-hidden" => "true" }
               %li.median-header
-                %span.stage-name
+                %span.stage-name.font-weight-bold
                   {{ __('Median') }}
                 %i.has-tooltip.fa.fa-question-circle{ "data-placement" => "top", title: _("The value lying at the midpoint of a series of observed values. E.g., between 3, 5, 9, the median is 5. Between 3, 5, 7, 8, the median is (5+7)/2 = 6."), "aria-hidden" => "true" }
-              %li.event-header
-                %span.stage-name
+              %li.event-header.pl-3
+                %span.stage-name.font-weight-bold
                   {{ currentStage ? __(currentStage.legend) : __('Related Issues') }}
                 %i.has-tooltip.fa.fa-question-circle{ "data-placement" => "top", title: _("The collection of events added to the data gathered for that stage."), "aria-hidden" => "true" }
-              %li.total-time-header
-                %span.stage-name
+              %li.total-time-header.pr-5.text-right
+                %span.stage-name.font-weight-bold
                   {{ __('Total Time') }}
                 %i.has-tooltip.fa.fa-question-circle{ "data-placement" => "top", title: _("The time taken by each data entry gathered by that stage."), "aria-hidden" => "true" }
         .stage-panel-body
           %nav.stage-nav
             %ul
-              %li.stage-nav-item{ ':class' => '{ active: stage.active }', '@click' => 'selectStage(stage)', "v-for" => "stage in state.stages" }
-                .stage-nav-item-cell.stage-name
-                  {{ stage.title }}
-                .stage-nav-item-cell.stage-median
-                  %template{ "v-if" => "stage.isUserAllowed" }
-                    %span{ "v-if" => "stage.value" }
-                      {{ stage.value }}
-                    %span.stage-empty{ "v-else" => true }
-                      {{ __('Not enough data') }}
-                  %template{ "v-else" => true }
-                    %span.not-available
-                      {{ __('Not available') }}
+              %stage-nav-item{ "v-for" => "stage in state.stages", ":key" => '`ca-stage-title-${stage.title}`', '@select' => 'selectStage(stage)', ":title" => "stage.title", ":is-user-allowed" => "stage.isUserAllowed", ":value" => "stage.value", ":is-active" => "stage.active" }
           .section.stage-events
             %template{ "v-if" => "isLoadingStage" }
               = icon("spinner spin")
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index e8d27360395..14cd8769e7e 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -4144,6 +4144,9 @@ msgstr ""
 msgid "Edit public deploy key"
 msgstr ""
 
+msgid "Edit stage"
+msgstr ""
+
 msgid "Edit wiki page"
 msgstr ""
 
@@ -5658,6 +5661,9 @@ msgstr ""
 msgid "Hide shared projects"
 msgstr ""
 
+msgid "Hide stage"
+msgstr ""
+
 msgid "Hide value"
 msgid_plural "Hide values"
 msgstr[0] ""
@@ -9357,6 +9363,9 @@ msgstr ""
 msgid "Remove spent time"
 msgstr ""
 
+msgid "Remove stage"
+msgstr ""
+
 msgid "Remove time estimate"
 msgstr ""
 
diff --git a/spec/frontend/cycle_analytics/stage_nav_item_spec.js b/spec/frontend/cycle_analytics/stage_nav_item_spec.js
new file mode 100644
index 00000000000..ff079082ca7
--- /dev/null
+++ b/spec/frontend/cycle_analytics/stage_nav_item_spec.js
@@ -0,0 +1,177 @@
+import { mount, shallowMount } from '@vue/test-utils';
+import StageNavItem from '~/cycle_analytics/components/stage_nav_item.vue';
+
+describe('StageNavItem', () => {
+  let wrapper = null;
+  const title = 'Cool stage';
+  const value = '1 day';
+
+  function createComponent(props, shallow = true) {
+    const func = shallow ? shallowMount : mount;
+    return func(StageNavItem, {
+      propsData: {
+        canEdit: false,
+        isActive: false,
+        isUserAllowed: false,
+        isDefaultStage: true,
+        title,
+        value,
+        ...props,
+      },
+    });
+  }
+
+  function hasStageName() {
+    const stageName = wrapper.find('.stage-name');
+    expect(stageName.exists()).toBe(true);
+    expect(stageName.text()).toEqual(title);
+  }
+
+  it('renders stage name', () => {
+    wrapper = createComponent({ isUserAllowed: true });
+    hasStageName();
+    wrapper.destroy();
+  });
+
+  describe('User has access', () => {
+    describe('with a value', () => {
+      beforeEach(() => {
+        wrapper = createComponent({ isUserAllowed: true });
+      });
+
+      afterEach(() => {
+        wrapper.destroy();
+      });
+      it('renders the value for median value', () => {
+        expect(wrapper.find('.stage-empty').exists()).toBe(false);
+        expect(wrapper.find('.not-available').exists()).toBe(false);
+        expect(wrapper.find('.stage-median').text()).toEqual(value);
+      });
+    });
+
+    describe('without a value', () => {
+      beforeEach(() => {
+        wrapper = createComponent({ isUserAllowed: true, value: null });
+      });
+
+      afterEach(() => {
+        wrapper.destroy();
+      });
+
+      it('has the stage-empty class', () => {
+        expect(wrapper.find('.stage-empty').exists()).toBe(true);
+      });
+
+      it('renders Not enough data for the median value', () => {
+        expect(wrapper.find('.stage-median').text()).toEqual('Not enough data');
+      });
+    });
+  });
+
+  describe('is active', () => {
+    beforeEach(() => {
+      wrapper = createComponent({ isActive: true }, false);
+    });
+
+    afterEach(() => {
+      wrapper.destroy();
+    });
+    it('has the active class', () => {
+      expect(wrapper.find('.stage-nav-item').classes('active')).toBe(true);
+    });
+  });
+
+  describe('is not active', () => {
+    beforeEach(() => {
+      wrapper = createComponent();
+    });
+
+    afterEach(() => {
+      wrapper.destroy();
+    });
+    it('emits the `select` event when clicked', () => {
+      expect(wrapper.emitted().select).toBeUndefined();
+      wrapper.trigger('click');
+      expect(wrapper.emitted().select.length).toBe(1);
+    });
+  });
+
+  describe('User does not have access', () => {
+    beforeEach(() => {
+      wrapper = createComponent({ isUserAllowed: false }, false);
+    });
+
+    afterEach(() => {
+      wrapper.destroy();
+    });
+    it('renders stage name', () => {
+      hasStageName();
+    });
+
+    it('has class not-available', () => {
+      expect(wrapper.find('.stage-empty').exists()).toBe(false);
+      expect(wrapper.find('.not-available').exists()).toBe(true);
+    });
+
+    it('renders Not available for the median value', () => {
+      expect(wrapper.find('.stage-median').text()).toBe('Not available');
+    });
+    it('does not render options menu', () => {
+      expect(wrapper.find('.more-actions-toggle').exists()).toBe(false);
+    });
+  });
+
+  describe('User can edit stages', () => {
+    beforeEach(() => {
+      wrapper = createComponent({ canEdit: true, isUserAllowed: true }, false);
+    });
+
+    afterEach(() => {
+      wrapper.destroy();
+    });
+    it('renders stage name', () => {
+      hasStageName();
+    });
+
+    it('renders options menu', () => {
+      expect(wrapper.find('.more-actions-toggle').exists()).toBe(true);
+    });
+
+    describe('Default stages', () => {
+      beforeEach(() => {
+        wrapper = createComponent(
+          { canEdit: true, isUserAllowed: true, isDefaultStage: true },
+          false,
+        );
+      });
+      it('can hide the stage', () => {
+        expect(wrapper.text()).toContain('Hide stage');
+      });
+      it('can not edit the stage', () => {
+        expect(wrapper.text()).not.toContain('Edit stage');
+      });
+      it('can not remove the stage', () => {
+        expect(wrapper.text()).not.toContain('Remove stage');
+      });
+    });
+
+    describe('Custom stages', () => {
+      beforeEach(() => {
+        wrapper = createComponent(
+          { canEdit: true, isUserAllowed: true, isDefaultStage: false },
+          false,
+        );
+      });
+      it('can edit the stage', () => {
+        expect(wrapper.text()).toContain('Edit stage');
+      });
+      it('can remove the stage', () => {
+        expect(wrapper.text()).toContain('Remove stage');
+      });
+
+      it('can not hide the stage', () => {
+        expect(wrapper.text()).not.toContain('Hide stage');
+      });
+    });
+  });
+});
-- 
cgit v1.2.1


From 74488865768e3e7a6ba0ac2359feab1aa1ba117e Mon Sep 17 00:00:00 2001
From: manojmj <mmj@gitlab.com>
Date: Mon, 19 Aug 2019 12:30:13 +0530
Subject: CE: Support restricting group access by multiple IP subnets

This change adds support for adding multiple
IP subnets for restricting access to groups
---
 doc/user/group/index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/user/group/index.md b/doc/user/group/index.md
index d1d4f3740b0..864f1a397d5 100644
--- a/doc/user/group/index.md
+++ b/doc/user/group/index.md
@@ -342,7 +342,7 @@ underlying projects, issues, etc, by IP address. This can help ensure that
 particular content doesn't leave the premises, while not blocking off access to
 the entire instance.
 
-Add whitelisted IP subnet using CIDR notation to the group settings and anyone
+Add one or more whitelisted IP subnets using CIDR notation in comma separated format to the group settings and anyone
 coming from a different IP address won't be able to access the restricted
 content.
 
-- 
cgit v1.2.1


From 6aa215aaea146f21eb5a88a511f7bbe84ad31ef5 Mon Sep 17 00:00:00 2001
From: Yorick Peterse <yorickpeterse@gmail.com>
Date: Thu, 1 Aug 2019 14:41:37 +0200
Subject: Support X_if_ee methods for QA tests

For the QA tests to use the new injection methods, we must require the
initializer and ensure that the "constantize" method is available.
---
 config/initializers/0_inject_enterprise_edition_module.rb | 2 ++
 qa/qa.rb                                                  | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/config/initializers/0_inject_enterprise_edition_module.rb b/config/initializers/0_inject_enterprise_edition_module.rb
index 4b21732e179..39595e23abe 100644
--- a/config/initializers/0_inject_enterprise_edition_module.rb
+++ b/config/initializers/0_inject_enterprise_edition_module.rb
@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'active_support/inflector'
+
 module InjectEnterpriseEditionModule
   def prepend_if_ee(constant)
     prepend(constant.constantize) if Gitlab.ee?
diff --git a/qa/qa.rb b/qa/qa.rb
index 18fb4509dce..8be2a289422 100644
--- a/qa/qa.rb
+++ b/qa/qa.rb
@@ -4,6 +4,9 @@ $: << File.expand_path(File.dirname(__FILE__))
 
 Encoding.default_external = 'UTF-8'
 
+require_relative '../lib/gitlab'
+require_relative '../config/initializers/0_inject_enterprise_edition_module'
+
 module QA
   ##
   # GitLab QA runtime classes, mostly singletons.
-- 
cgit v1.2.1


From b601cfcfa707235d7f5eed43bfbe0d3956adff40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Tue, 6 Aug 2019 14:50:52 +0200
Subject: Update qa/Dockerfile to be built from the project root context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 .dockerignore   | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 qa/Dockerfile   | 12 ++++++----
 qa/Gemfile      |  1 +
 qa/Gemfile.lock | 13 ++++++-----
 qa/README.md    |  5 ++--
 5 files changed, 91 insertions(+), 12 deletions(-)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000000..b8e239e4049
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,72 @@
+# `build_from_dir` can't find Dockerfile when `.dockerignore` is "*"
+# See https://github.com/swipely/docker-api/issues/484
+# Ignore all folders except qa/, config/initializers and the root of lib/ since
+# the files we need to build the QA image are in these folders.
+# Following are the files we need:
+# - ./config/initializers/0_inject_enterprise_edition_module.rb
+# - ./lib/gitlab.rb
+# - ./qa/
+# - ./INSTALLATION_TYPE
+# - ./VERSION
+
+/app/
+/bin/
+/builds/
+/changelogs/
+/config/environments/
+/config/helpers/
+/config/knative/
+/config/locales/
+/config/prometheus/
+/config/routes/
+/danger/
+/db/
+/doc/
+/docker/
+/ee/
+/fixtures/
+/templates/
+/lint/
+/lib/api/
+/lib/assets/
+/lib/backup/
+/lib/banzai/
+/lib/bitbucket/
+/lib/server/
+/lib/constraints/
+/lib/registry/
+/lib/policy/
+/lib/feature/
+/lib/flowdock/
+/lib/generators/
+/lib/gitaly/
+/lib/gitlab/
+/lib/api/
+/lib/token/
+/lib/mattermost/
+/lib/teams/
+/lib/storage/
+/lib/auth/
+/lib/peek/
+/lib/prometheus/
+/lib/quality/
+/lib/rouge/
+/lib/flaky/
+/lib/zip/
+/lib/sentry/
+/lib/serializers/
+/lib/support/
+/lib/check/
+/lib/tasks/
+/locale/
+/log/
+/modules/
+/plugins/
+/public/
+/rubocop/
+/scripts/
+/shared/
+/spec/
+/symbol/
+/tmp/
+/vendor/
diff --git a/qa/Dockerfile b/qa/Dockerfile
index 74be373b8e8..3309f5b6ce3 100644
--- a/qa/Dockerfile
+++ b/qa/Dockerfile
@@ -47,9 +47,13 @@ RUN export CLOUD_SDK_REPO="cloud-sdk-$(lsb_release -c -s)" && \
     curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add - && \
     apt-get update -y && apt-get install google-cloud-sdk kubectl -y
 
-WORKDIR /home/qa
-COPY ./Gemfile* ./
-RUN bundle install
-COPY ./ ./
+WORKDIR /home/gitlab/qa
+COPY ./qa/Gemfile* /home/gitlab/qa/
+COPY ./config/initializers/0_inject_enterprise_edition_module.rb /home/gitlab/config/initializers/
+COPY ./lib/gitlab.rb /home/gitlab/lib/
+COPY ./INSTALLATION_TYPE /home/gitlab/
+COPY ./VERSION /home/gitlab/
+RUN cd /home/gitlab/qa/ && bundle install
+COPY ./qa /home/gitlab/qa
 
 ENTRYPOINT ["bin/test"]
diff --git a/qa/Gemfile b/qa/Gemfile
index 6abc0d622ad..f04ecb13879 100644
--- a/qa/Gemfile
+++ b/qa/Gemfile
@@ -1,6 +1,7 @@
 source 'https://rubygems.org'
 
 gem 'gitlab-qa'
+gem 'activesupport', '5.2.3' # This should stay in sync with the root's Gemfile
 gem 'pry-byebug', '~> 3.5.1', platform: :mri
 gem 'capybara', '~> 2.16.1'
 gem 'capybara-screenshot', '~> 1.0.18'
diff --git a/qa/Gemfile.lock b/qa/Gemfile.lock
index bf051a115b5..d582d77c5cd 100644
--- a/qa/Gemfile.lock
+++ b/qa/Gemfile.lock
@@ -1,9 +1,9 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (5.1.4)
+    activesupport (5.2.3)
       concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (~> 0.7)
+      i18n (>= 0.7, < 2)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
     addressable (2.5.2)
@@ -28,7 +28,7 @@ GEM
     childprocess (0.9.0)
       ffi (~> 1.0, >= 1.0.11)
     coderay (1.1.2)
-    concurrent-ruby (1.0.5)
+    concurrent-ruby (1.1.5)
     diff-lcs (1.3)
     domain_name (0.5.20170404)
       unf (>= 0.0.5, < 1.0.0)
@@ -38,7 +38,7 @@ GEM
     gitlab-qa (4.0.0)
     http-cookie (1.0.3)
       domain_name (~> 0.5)
-    i18n (0.9.1)
+    i18n (1.6.0)
       concurrent-ruby (~> 1.0)
     knapsack (1.17.1)
       rake
@@ -50,7 +50,7 @@ GEM
     mime-types-data (3.2016.0521)
     mini_mime (1.0.0)
     mini_portile2 (2.4.0)
-    minitest (5.11.1)
+    minitest (5.11.3)
     netrc (0.11.0)
     nokogiri (1.10.4)
       mini_portile2 (~> 2.4.0)
@@ -94,7 +94,7 @@ GEM
       childprocess (~> 0.5)
       rubyzip (~> 1.2, >= 1.2.2)
     thread_safe (0.3.6)
-    tzinfo (1.2.4)
+    tzinfo (1.2.5)
       thread_safe (~> 0.1)
     unf (0.1.4)
       unf_ext
@@ -106,6 +106,7 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  activesupport (= 5.2.3)
   airborne (~> 0.2.13)
   capybara (~> 2.16.1)
   capybara-screenshot (~> 1.0.18)
diff --git a/qa/README.md b/qa/README.md
index bab19665dac..97555f8d0c2 100644
--- a/qa/README.md
+++ b/qa/README.md
@@ -123,10 +123,11 @@ To set multiple cookies, separate them with the `;` character, for example: `QA_
 
 Once you have made changes to the CE/EE repositories, you may want to build a
 Docker image to test locally instead of waiting for the `gitlab-ce-qa` or
-`gitlab-ee-qa` nightly builds. To do that, you can run from this directory:
+`gitlab-ee-qa` nightly builds. To do that, you can run **from the top `gitlab`
+directory** (one level up from this directory):
 
 ```sh
-docker build -t gitlab/gitlab-ce-qa:nightly .
+docker build -t gitlab/gitlab-ce-qa:nightly --file ./qa/Dockerfile ./
 ```
 
 [GDK]: https://gitlab.com/gitlab-org/gitlab-development-kit/
-- 
cgit v1.2.1


From 9a4dcd8dc898d79965fa96ae8941bfaa7333019d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Tue, 6 Aug 2019 14:52:55 +0200
Subject: Update the 'build-qa-image' job to be built from project root context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 .gitlab/ci/review.gitlab-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab/ci/review.gitlab-ci.yml b/.gitlab/ci/review.gitlab-ci.yml
index 4a9269ffd82..3cbfa32d9a5 100644
--- a/.gitlab/ci/review.gitlab-ci.yml
+++ b/.gitlab/ci/review.gitlab-ci.yml
@@ -50,7 +50,7 @@ build-qa-image:
   <<: *review-docker
   stage: test
   script:
-    - time docker build --cache-from ${LATEST_QA_IMAGE} --tag ${QA_IMAGE} ./qa/
+    - time docker build --cache-from ${LATEST_QA_IMAGE} --tag ${QA_IMAGE} --file ./qa/Dockerfile ./
     - echo "${CI_JOB_TOKEN}" | docker login --username gitlab-ci-token --password-stdin ${CI_REGISTRY}
     - time docker push ${QA_IMAGE}
 
-- 
cgit v1.2.1


From f7f91e84f71afa6bcf8a22ed181ce719bfbaf35c Mon Sep 17 00:00:00 2001
From: Nick Thomas <nick@gitlab.com>
Date: Fri, 16 Aug 2019 15:11:30 +0100
Subject: Add a skip_users filter to the project users API

This functionality is available in the /autocomplete users pseudo-API.
We're attempting to replace that with the canonical API, so it needs
support for this parameter too.
---
 doc/api/projects.md                |  1 +
 lib/api/projects.rb                |  2 ++
 spec/requests/api/projects_spec.rb | 11 +++++++++++
 3 files changed, 14 insertions(+)

diff --git a/doc/api/projects.md b/doc/api/projects.md
index 70df44ec0fd..373607f8f4b 100644
--- a/doc/api/projects.md
+++ b/doc/api/projects.md
@@ -855,6 +855,7 @@ GET /projects/:id/users
 | Attribute | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
 | `search` | string | no | Search for specific users |
+| `skip_users` | array[int] | no | Filter out users with the specified IDs |
 
 ```json
 [
diff --git a/lib/api/projects.rb b/lib/api/projects.rb
index 996205d4b7b..3073c14b341 100644
--- a/lib/api/projects.rb
+++ b/lib/api/projects.rb
@@ -489,11 +489,13 @@ module API
       end
       params do
         optional :search, type: String, desc: 'Return list of users matching the search criteria'
+        optional :skip_users, type: Array[Integer], desc: 'Filter out users with the specified IDs'
         use :pagination
       end
       get ':id/users' do
         users = DeclarativePolicy.subject_scope { user_project.team.users }
         users = users.search(params[:search]) if params[:search].present?
+        users = users.where_not_in(params[:skip_users]) if params[:skip_users].present?
 
         present paginate(users), with: Entities::UserBasic
       end
diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb
index 1d7ca85cdd2..5465fe0c366 100644
--- a/spec/requests/api/projects_spec.rb
+++ b/spec/requests/api/projects_spec.rb
@@ -1494,6 +1494,17 @@ describe API::Projects do
 
         expect(response).to have_gitlab_http_status(404)
       end
+
+      it 'filters out users listed in skip_users' do
+        other_user = create(:user)
+        project.team.add_developer(other_user)
+
+        get api("/projects/#{project.id}/users?skip_users=#{user.id}", user)
+
+        expect(response).to have_gitlab_http_status(200)
+        expect(json_response.size).to eq(1)
+        expect(json_response[0]['id']).to eq(other_user.id)
+      end
     end
   end
 
-- 
cgit v1.2.1


From cf88f9dda13d15ab7f773f57c6e844691fd1a496 Mon Sep 17 00:00:00 2001
From: Himanshu Kapoor <hkapoor@gitlab.com>
Date: Wed, 14 Aug 2019 15:25:40 +0530
Subject: Add new API method: projectUsers

The new API method projectUsers gets all the users
added to a particular project.
---
 app/assets/javascripts/api.js                      | 15 +++++++++++++++
 ...pprovers_select-vue-to-remove-approverusers.yml |  5 +++++
 spec/frontend/api_spec.js                          | 22 ++++++++++++++++++++++
 3 files changed, 42 insertions(+)
 create mode 100644 changelogs/unreleased/ee-2502-refactor-ee-app-assets-javascripts-approvals-components-approvers_select-vue-to-remove-approverusers.yml

diff --git a/app/assets/javascripts/api.js b/app/assets/javascripts/api.js
index a649c521405..136ffdf8b9d 100644
--- a/app/assets/javascripts/api.js
+++ b/app/assets/javascripts/api.js
@@ -14,6 +14,7 @@ const Api = {
   projectPath: '/api/:version/projects/:id',
   forkedProjectsPath: '/api/:version/projects/:id/forks',
   projectLabelsPath: '/:namespace_path/:project_path/-/labels',
+  projectUsersPath: '/api/:version/projects/:id/users',
   projectMergeRequestsPath: '/api/:version/projects/:id/merge_requests',
   projectMergeRequestPath: '/api/:version/projects/:id/merge_requests/:mrid',
   projectMergeRequestChangesPath: '/api/:version/projects/:id/merge_requests/:mrid/changes',
@@ -108,6 +109,20 @@ const Api = {
       });
   },
 
+  projectUsers(projectPath, query = '', options = {}) {
+    const url = Api.buildUrl(this.projectUsersPath).replace(':id', encodeURIComponent(projectPath));
+
+    return axios
+      .get(url, {
+        params: {
+          search: query,
+          per_page: 20,
+          ...options,
+        },
+      })
+      .then(({ data }) => data);
+  },
+
   // Return single project
   project(projectPath) {
     const url = Api.buildUrl(Api.projectPath).replace(':id', encodeURIComponent(projectPath));
diff --git a/changelogs/unreleased/ee-2502-refactor-ee-app-assets-javascripts-approvals-components-approvers_select-vue-to-remove-approverusers.yml b/changelogs/unreleased/ee-2502-refactor-ee-app-assets-javascripts-approvals-components-approvers_select-vue-to-remove-approverusers.yml
new file mode 100644
index 00000000000..dfa0f0cb593
--- /dev/null
+++ b/changelogs/unreleased/ee-2502-refactor-ee-app-assets-javascripts-approvals-components-approvers_select-vue-to-remove-approverusers.yml
@@ -0,0 +1,5 @@
+---
+title: 'Add new API method in Api.js: projectUsers'
+merge_request: 31801
+author:
+type: other
diff --git a/spec/frontend/api_spec.js b/spec/frontend/api_spec.js
index 7004373be0e..62ba0d36982 100644
--- a/spec/frontend/api_spec.js
+++ b/spec/frontend/api_spec.js
@@ -151,6 +151,28 @@ describe('Api', () => {
     });
   });
 
+  describe('projectUsers', () => {
+    it('fetches all users of a particular project', done => {
+      const query = 'dummy query';
+      const options = { unused: 'option' };
+      const projectPath = 'gitlab-org%2Fgitlab-ce';
+      const expectedUrl = `${dummyUrlRoot}/api/${dummyApiVersion}/projects/${projectPath}/users`;
+      mock.onGet(expectedUrl).reply(200, [
+        {
+          name: 'test',
+        },
+      ]);
+
+      Api.projectUsers('gitlab-org/gitlab-ce', query, options)
+        .then(response => {
+          expect(response.length).toBe(1);
+          expect(response[0].name).toBe('test');
+        })
+        .then(done)
+        .catch(done.fail);
+    });
+  });
+
   describe('projectMergeRequests', () => {
     const projectPath = 'abc';
     const expectedUrl = `${dummyUrlRoot}/api/${dummyApiVersion}/projects/${projectPath}/merge_requests`;
-- 
cgit v1.2.1


From 6f1985833eab65a90d885b53026af1d694aae628 Mon Sep 17 00:00:00 2001
From: Kushal Pandya <kushalspandya@gmail.com>
Date: Wed, 7 Aug 2019 20:05:46 +0530
Subject: Add `autofocus` directive for input elements

---
 .../vue_shared/directives/autofocusonshow.js       | 39 ++++++++++++++++++++++
 .../vue_shared/directives/autofocusonshow_spec.js  | 38 +++++++++++++++++++++
 2 files changed, 77 insertions(+)
 create mode 100644 app/assets/javascripts/vue_shared/directives/autofocusonshow.js
 create mode 100644 spec/javascripts/vue_shared/directives/autofocusonshow_spec.js

diff --git a/app/assets/javascripts/vue_shared/directives/autofocusonshow.js b/app/assets/javascripts/vue_shared/directives/autofocusonshow.js
new file mode 100644
index 00000000000..4659ec20ceb
--- /dev/null
+++ b/app/assets/javascripts/vue_shared/directives/autofocusonshow.js
@@ -0,0 +1,39 @@
+/**
+ * Input/Textarea Autofocus Directive for Vue
+ */
+export default {
+  /**
+   * Set focus when element is rendered, but
+   * is not visible, using IntersectionObserver
+   *
+   * @param {Element} el Target element
+   */
+  inserted(el) {
+    if ('IntersectionObserver' in window) {
+      // Element visibility is dynamic, so we attach observer
+      el.visibilityObserver = new IntersectionObserver(entries => {
+        entries.forEach(entry => {
+          // Combining `intersectionRatio > 0` and
+          // element's `offsetParent` presence will
+          // deteremine if element is truely visible
+          if (entry.intersectionRatio > 0 && entry.target.offsetParent) {
+            entry.target.focus();
+          }
+        });
+      });
+
+      // Bind the observer.
+      el.visibilityObserver.observe(el, { root: document.documentElement });
+    }
+  },
+  /**
+   * Detach observer on unbind hook.
+   *
+   * @param {Element} el Target element
+   */
+  unbind(el) {
+    if (el.visibilityObserver) {
+      el.visibilityObserver.disconnect();
+    }
+  },
+};
diff --git a/spec/javascripts/vue_shared/directives/autofocusonshow_spec.js b/spec/javascripts/vue_shared/directives/autofocusonshow_spec.js
new file mode 100644
index 00000000000..f1ca5f61496
--- /dev/null
+++ b/spec/javascripts/vue_shared/directives/autofocusonshow_spec.js
@@ -0,0 +1,38 @@
+import autofocusonshow from '~/vue_shared/directives/autofocusonshow';
+
+/**
+ * We're testing this directive's hooks as pure functions
+ * since behaviour of this directive is highly-dependent
+ * on underlying DOM methods.
+ */
+describe('AutofocusOnShow directive', () => {
+  describe('with input invisible on component render', () => {
+    let el;
+
+    beforeAll(() => {
+      setFixtures('<div id="container" style="display: none;"><input id="inputel"/></div>');
+      el = document.querySelector('#inputel');
+    });
+
+    it('should bind IntersectionObserver on input element', () => {
+      spyOn(el, 'focus');
+
+      autofocusonshow.inserted(el);
+
+      expect(el.visibilityObserver).toBeDefined();
+      expect(el.focus).not.toHaveBeenCalled();
+    });
+
+    it('should stop IntersectionObserver on input element on unbind hook', () => {
+      el.visibilityObserver = {
+        disconnect: () => {},
+      };
+      spyOn(el.visibilityObserver, 'disconnect');
+
+      autofocusonshow.unbind(el);
+
+      expect(el.visibilityObserver).toBeDefined();
+      expect(el.visibilityObserver.disconnect).toHaveBeenCalled();
+    });
+  });
+});
-- 
cgit v1.2.1


From 4ee5272939eb8fe5016bb30419e1cf3ef66a87bf Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Mon, 19 Aug 2019 17:27:04 +0800
Subject: Remove active_record_sane_schema_dumper gem

We don't need this since this is already the default
behavior of Rails since 5.1
---
 Gemfile      | 2 --
 Gemfile.lock | 3 ---
 2 files changed, 5 deletions(-)

diff --git a/Gemfile b/Gemfile
index a91399ab3ad..59aa67e642e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -375,8 +375,6 @@ group :development, :test do
   gem 'license_finder', '~> 5.4', require: false
   gem 'knapsack', '~> 1.17'
 
-  gem 'activerecord_sane_schema_dumper', '1.0'
-
   gem 'stackprof', '~> 0.2.10', require: false
 
   gem 'simple_po_parser', '~> 1.1.2', require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index fcc0fb64897..d8f7ca994da 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -41,8 +41,6 @@ GEM
     activerecord-explain-analyze (0.1.0)
       activerecord (>= 4)
       pg
-    activerecord_sane_schema_dumper (1.0)
-      rails (>= 5, < 6)
     activestorage (5.2.3)
       actionpack (= 5.2.3)
       activerecord (= 5.2.3)
@@ -1028,7 +1026,6 @@ DEPENDENCIES
   ace-rails-ap (~> 4.1.0)
   acme-client (~> 2.0.2)
   activerecord-explain-analyze (~> 0.1)
-  activerecord_sane_schema_dumper (= 1.0)
   acts-as-taggable-on (~> 6.0)
   addressable (~> 2.5.2)
   akismet (~> 2.0)
-- 
cgit v1.2.1


From bab522d48c76ab3ede544f4d628b42bb296bc06d Mon Sep 17 00:00:00 2001
From: Vladimir Shushlin <v.shushlin@gmail.com>
Date: Tue, 13 Aug 2019 20:14:13 +0300
Subject: Add warning when LE certificate can't be obtained

* Refactor some tests as well
---
 .../projects/pages_domains/_certificate.html.haml  | 18 ++++++
 app/views/projects/pages_domains/show.html.haml    |  7 +--
 ...ains-that-obtaining-deploying-ssl-certifica.yml |  6 ++
 locale/gitlab.pot                                  |  6 ++
 spec/features/projects/pages_lets_encrypt_spec.rb  |  8 +--
 .../projects/pages_domains/show.html.haml_spec.rb  | 66 ++++++++++++++++++++++
 6 files changed, 101 insertions(+), 10 deletions(-)
 create mode 100644 app/views/projects/pages_domains/_certificate.html.haml
 create mode 100644 changelogs/unreleased/64630-add-warning-to-pages-domains-that-obtaining-deploying-ssl-certifica.yml
 create mode 100644 spec/views/projects/pages_domains/show.html.haml_spec.rb

diff --git a/app/views/projects/pages_domains/_certificate.html.haml b/app/views/projects/pages_domains/_certificate.html.haml
new file mode 100644
index 00000000000..42631fca5e8
--- /dev/null
+++ b/app/views/projects/pages_domains/_certificate.html.haml
@@ -0,0 +1,18 @@
+- if @domain.auto_ssl_enabled?
+  - if @domain.enabled?
+    - if @domain.certificate_text
+      %pre
+        = @domain.certificate_text
+    - else
+      .bs-callout.bs-callout-info
+        = _("GitLab is obtaining a Let's Encrypt SSL certificate for this domain. This process can take some time. Please try again later.")
+  - else
+    .bs-callout.bs-callout-warning
+      = _("A Let's Encrypt SSL certificate can not be obtained until your domain is verified.")
+- else
+  - if @domain.certificate_text
+    %pre
+      = @domain.certificate_text
+  - else
+    .light
+      = _("missing")
diff --git a/app/views/projects/pages_domains/show.html.haml b/app/views/projects/pages_domains/show.html.haml
index e9019175219..d0b54946f7e 100644
--- a/app/views/projects/pages_domains/show.html.haml
+++ b/app/views/projects/pages_domains/show.html.haml
@@ -60,9 +60,4 @@
       %td
         = _("Certificate")
       %td
-        - if @domain.certificate_text
-          %pre
-            = @domain.certificate_text
-        - else
-          .light
-            = _("missing")
+        = render 'certificate'
diff --git a/changelogs/unreleased/64630-add-warning-to-pages-domains-that-obtaining-deploying-ssl-certifica.yml b/changelogs/unreleased/64630-add-warning-to-pages-domains-that-obtaining-deploying-ssl-certifica.yml
new file mode 100644
index 00000000000..bd2c9a3e2dc
--- /dev/null
+++ b/changelogs/unreleased/64630-add-warning-to-pages-domains-that-obtaining-deploying-ssl-certifica.yml
@@ -0,0 +1,6 @@
+---
+title: Add warning to pages domains that obtaining/deploying SSL certificates through
+  Let's Encrypt can take some time
+merge_request: 31765
+author:
+type: other
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 14cd8769e7e..d84203ee911 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -469,6 +469,9 @@ msgstr ""
 msgid "A Jekyll site that uses Netlify for CI/CD instead of GitLab, but still with all the other great GitLab features."
 msgstr ""
 
+msgid "A Let's Encrypt SSL certificate can not be obtained until your domain is verified."
+msgstr ""
+
 msgid "A Let's Encrypt account will be configured for this GitLab installation using your email address. You will receive emails to warn of expiring certificates."
 msgstr ""
 
@@ -5247,6 +5250,9 @@ msgstr ""
 msgid "GitLab User"
 msgstr ""
 
+msgid "GitLab is obtaining a Let's Encrypt SSL certificate for this domain. This process can take some time. Please try again later."
+msgstr ""
+
 msgid "GitLab member or Email address"
 msgstr ""
 
diff --git a/spec/features/projects/pages_lets_encrypt_spec.rb b/spec/features/projects/pages_lets_encrypt_spec.rb
index a5f8702302c..8b5964b2eee 100644
--- a/spec/features/projects/pages_lets_encrypt_spec.rb
+++ b/spec/features/projects/pages_lets_encrypt_spec.rb
@@ -75,12 +75,10 @@ describe "Pages with Let's Encrypt", :https_pages_enabled do
   end
 
   shared_examples 'user sees private keys only for user provided certificate' do
-    before do
-      visit edit_project_pages_domain_path(project, domain)
-    end
-
     shared_examples 'user do not see private key' do
       it 'user do not see private key' do
+        visit edit_project_pages_domain_path(project, domain)
+
         expect(find_field('Key (PEM)', visible: :all, disabled: :all).value).to be_blank
       end
     end
@@ -101,6 +99,8 @@ describe "Pages with Let's Encrypt", :https_pages_enabled do
       let(:domain) { create(:pages_domain, project: project) }
 
       it 'user sees private key' do
+        visit edit_project_pages_domain_path(project, domain)
+
         expect(find_field('Key (PEM)').value).not_to be_blank
       end
     end
diff --git a/spec/views/projects/pages_domains/show.html.haml_spec.rb b/spec/views/projects/pages_domains/show.html.haml_spec.rb
new file mode 100644
index 00000000000..da27a04bfe9
--- /dev/null
+++ b/spec/views/projects/pages_domains/show.html.haml_spec.rb
@@ -0,0 +1,66 @@
+require 'spec_helper'
+
+describe 'projects/pages_domains/show' do
+  let(:project) { create(:project, :repository) }
+
+  before do
+    assign(:project, project)
+    assign(:domain, domain)
+  end
+
+  context 'when auto_ssl is enabled' do
+    context 'when domain is disabled' do
+      let(:domain) { create(:pages_domain, :disabled, project: project, auto_ssl_enabled: true) }
+
+      it 'shows verification warning' do
+        render
+
+        expect(rendered).to have_content("A Let's Encrypt SSL certificate can not be obtained until your domain is verified.")
+      end
+    end
+
+    context 'when certificate is absent' do
+      let(:domain) { create(:pages_domain, :without_key, :without_certificate, project: project, auto_ssl_enabled: true) }
+
+      it 'shows alert about time of obtaining certificate' do
+        render
+
+        expect(rendered).to have_content("GitLab is obtaining a Let's Encrypt SSL certificate for this domain. This process can take some time. Please try again later.")
+      end
+    end
+
+    context 'when certificate is present' do
+      let(:domain) { create(:pages_domain, :letsencrypt, project: project) }
+
+      it 'shows certificate info' do
+        render
+
+        # test just a random part of cert represenations(X509v3 Subject Key Identifier:)
+        expect(rendered).to have_content("C6:5F:56:4B:10:69:AC:1D:33:D2:26:C9:B3:7A:D7:12:4D:3E:F7:90")
+      end
+    end
+  end
+
+  context 'when auto_ssl is disabled' do
+    context 'when certificate is present' do
+      let(:domain) { create(:pages_domain, project: project) }
+
+      it 'shows certificate info' do
+        render
+
+        # test just a random part of cert represenations(X509v3 Subject Key Identifier:)
+        expect(rendered).to have_content("C6:5F:56:4B:10:69:AC:1D:33:D2:26:C9:B3:7A:D7:12:4D:3E:F7:90")
+      end
+    end
+
+    context 'when certificate is absent' do
+      let(:domain) { create(:pages_domain, :without_certificate, :without_key, project: project) }
+
+      it 'shows missing certificate' do
+        render
+
+        expect(rendered).to have_content("missing")
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 37b1bfca064df3bed6ce0db093b8217b4df3c869 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Mon, 19 Aug 2019 12:13:50 +0000
Subject: Update Team labels definition in the Issue Workflow documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 doc/development/contributing/issue_workflow.md | 31 +++++---------------------
 1 file changed, 6 insertions(+), 25 deletions(-)

diff --git a/doc/development/contributing/issue_workflow.md b/doc/development/contributing/issue_workflow.md
index a38794c49af..b2e3ef7bf63 100644
--- a/doc/development/contributing/issue_workflow.md
+++ b/doc/development/contributing/issue_workflow.md
@@ -60,37 +60,18 @@ Subject labels are always all-lowercase.
 
 ## Team labels
 
-**Important**: Most of the team labels will be soon deprecated in favor of [Group labels](#group-labels).
+**Important**: Most of the historical team labels (e.g. Manage, Plan etc.) are
+now deprecated in favor of [Group labels](#group-labels) and [Stage labels](#stage-labels).
 
 Team labels specify what team is responsible for this issue.
 Assigning a team label makes sure issues get the attention of the appropriate
 people.
 
-The team labels planned for deprecation are:
-
-- ~Configure
-- ~Create
-- ~Defend
-- ~Distribution
-- ~Ecosystem
-- ~Geo
-- ~Gitaly
-- ~Growth
-- ~Manage
-- ~Memory
-- ~Monitor
-- ~Plan
-- ~Release
-- ~Secure
-- ~Verify
-
-The following team labels are **true** teams per our [organization structure](https://about.gitlab.com/company/team/structure/#organizational-structure) which will remain post deprecation.
+The current team labels are:
 
 - ~Delivery
 - ~Documentation
-
-The descriptions on the [labels page](https://gitlab.com/gitlab-org/gitlab-ce/-/labels) explain what falls under the
-responsibility of each team.
+- ~Quality
 
 Team labels are always capitalized so that they show up as the first label for
 any issue.
@@ -120,13 +101,13 @@ and thus are mutually exclusive.
 
 You can find the groups listed in the [Product Stages, Groups, and Categories][product-categories] page.
 
-We use the term group to map down product requirements from our product stages. 
+We use the term group to map down product requirements from our product stages.
 As a team needs some way to collect the work their members are planning to be assigned to, we use the `~group::` labels to do so.
 
 Normally there is a 1:1 relationship between Stage labels and Group labels. In the spirit of "Everyone can contribute",
 any issue can be picked up by any group, depending on current priorities. For example, an issue labeled ~"devops::create" may be picked up by the ~"group::access" group.
 
-We also use stage and group labels to help quantify our [throughput](https://about.gitlab.com/handbook/engineering/management/throughput). 
+We also use stage and group labels to help quantify our [throughput](https://about.gitlab.com/handbook/engineering/management/throughput).
 Please read [Stage and Group labels in Throughtput](https://about.gitlab.com/handbook/engineering/management/throughput/#stage-and-group-labels-in-throughput) for more information on how the labels are used in this context.
 
 [structure-groups]: https://about.gitlab.com/company/team/structure/#groups
-- 
cgit v1.2.1


From 6a6411938a2854bb20dd358a481bb3f067df8271 Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Mon, 19 Aug 2019 11:55:20 +0200
Subject: Change `be_success` to `be_successful` in specs

Fixes deprecation warning:

```
DEPRECATION WARNING: The success? predicate is deprecated and
will be removed in Rails 6.0.
Please use successful? as provided by Rack::Response::Helpers.
```
---
 spec/controllers/groups/group_members_controller_spec.rb     |  2 +-
 spec/controllers/groups/milestones_controller_spec.rb        |  2 +-
 spec/controllers/health_check_controller_spec.rb             | 12 ++++++------
 spec/controllers/help_controller_spec.rb                     |  2 +-
 spec/controllers/profiles/keys_controller_spec.rb            |  6 +++---
 spec/controllers/projects/ci/lints_controller_spec.rb        |  8 ++------
 spec/controllers/projects/commit_controller_spec.rb          | 10 +++++-----
 spec/controllers/projects/commits_controller_spec.rb         |  4 ++--
 spec/controllers/projects/compare_controller_spec.rb         | 10 +++++-----
 .../projects/cycle_analytics/events_controller_spec.rb       |  6 +++---
 spec/controllers/projects/cycle_analytics_controller_spec.rb |  6 +++---
 .../projects/merge_requests/creations_controller_spec.rb     |  8 ++++----
 .../projects/merge_requests/diffs_controller_spec.rb         |  2 +-
 spec/controllers/projects/merge_requests_controller_spec.rb  |  8 ++++----
 spec/controllers/projects/milestones_controller_spec.rb      |  2 +-
 spec/controllers/projects/project_members_controller_spec.rb |  2 +-
 spec/controllers/projects/refs_controller_spec.rb            |  4 ++--
 spec/controllers/projects/services_controller_spec.rb        |  2 +-
 spec/controllers/users_controller_spec.rb                    |  6 +++---
 .../external_authorization_service_shared_examples.rb        |  2 +-
 20 files changed, 50 insertions(+), 54 deletions(-)

diff --git a/spec/controllers/groups/group_members_controller_spec.rb b/spec/controllers/groups/group_members_controller_spec.rb
index 908c564e761..0c3dd971582 100644
--- a/spec/controllers/groups/group_members_controller_spec.rb
+++ b/spec/controllers/groups/group_members_controller_spec.rb
@@ -172,7 +172,7 @@ describe Groups::GroupMembersController do
         it '[JS] removes user from members' do
           delete :destroy, params: { group_id: group, id: member }, xhr: true
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(group.members).not_to include member
         end
       end
diff --git a/spec/controllers/groups/milestones_controller_spec.rb b/spec/controllers/groups/milestones_controller_spec.rb
index bf164aeed38..41927907fd1 100644
--- a/spec/controllers/groups/milestones_controller_spec.rb
+++ b/spec/controllers/groups/milestones_controller_spec.rb
@@ -186,7 +186,7 @@ describe Groups::MilestonesController do
     it "removes milestone" do
       delete :destroy, params: { group_id: group.to_param, id: milestone.iid }, format: :js
 
-      expect(response).to be_success
+      expect(response).to be_successful
       expect { Milestone.find(milestone.id) }.to raise_exception(ActiveRecord::RecordNotFound)
     end
   end
diff --git a/spec/controllers/health_check_controller_spec.rb b/spec/controllers/health_check_controller_spec.rb
index 92f005faf4a..b48b7dc86e0 100644
--- a/spec/controllers/health_check_controller_spec.rb
+++ b/spec/controllers/health_check_controller_spec.rb
@@ -33,14 +33,14 @@ describe HealthCheckController do
 
           get :index
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(response.content_type).to eq 'text/plain'
         end
 
         it 'supports passing the token in query params' do
           get :index, params: { token: token }
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(response.content_type).to eq 'text/plain'
         end
       end
@@ -54,14 +54,14 @@ describe HealthCheckController do
       it 'supports successful plaintext response' do
         get :index
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(response.content_type).to eq 'text/plain'
       end
 
       it 'supports successful json response' do
         get :index, format: :json
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(response.content_type).to eq 'application/json'
         expect(json_response['healthy']).to be true
       end
@@ -69,7 +69,7 @@ describe HealthCheckController do
       it 'supports successful xml response' do
         get :index, format: :xml
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(response.content_type).to eq 'application/xml'
         expect(xml_response['healthy']).to be true
       end
@@ -77,7 +77,7 @@ describe HealthCheckController do
       it 'supports successful responses for specific checks' do
         get :index, params: { checks: 'email' }, format: :json
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(response.content_type).to eq 'application/json'
         expect(json_response['healthy']).to be true
       end
diff --git a/spec/controllers/help_controller_spec.rb b/spec/controllers/help_controller_spec.rb
index 43c910da7a5..03b6e85b653 100644
--- a/spec/controllers/help_controller_spec.rb
+++ b/spec/controllers/help_controller_spec.rb
@@ -114,7 +114,7 @@ describe HelpController do
                 path: 'user/project/img/labels_default_v12_1'
               },
               format: :png
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(response.content_type).to eq 'image/png'
           expect(response.headers['Content-Disposition']).to match(/^inline;/)
         end
diff --git a/spec/controllers/profiles/keys_controller_spec.rb b/spec/controllers/profiles/keys_controller_spec.rb
index 753eb432c5e..3bed117deb0 100644
--- a/spec/controllers/profiles/keys_controller_spec.rb
+++ b/spec/controllers/profiles/keys_controller_spec.rb
@@ -10,7 +10,7 @@ describe Profiles::KeysController do
       it "does not generally work" do
         get :get_keys, params: { username: 'not-existent' }
 
-        expect(response).not_to be_success
+        expect(response).not_to be_successful
       end
     end
 
@@ -18,7 +18,7 @@ describe Profiles::KeysController do
       it "does generally work" do
         get :get_keys, params: { username: user.username }
 
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it "renders all keys separated with a new line" do
@@ -41,7 +41,7 @@ describe Profiles::KeysController do
       it "does generally work" do
         get :get_keys, params: { username: user.username }
 
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it "renders all non deploy keys separated with a new line" do
diff --git a/spec/controllers/projects/ci/lints_controller_spec.rb b/spec/controllers/projects/ci/lints_controller_spec.rb
index 96e82b7086c..14128fb5b0e 100644
--- a/spec/controllers/projects/ci/lints_controller_spec.rb
+++ b/spec/controllers/projects/ci/lints_controller_spec.rb
@@ -20,9 +20,7 @@ describe Projects::Ci::LintsController do
         get :show, params: { namespace_id: project.namespace, project_id: project }
       end
 
-      it 'is success' do
-        expect(response).to be_success
-      end
+      it { expect(response).to be_successful }
 
       it 'renders show page' do
         expect(response).to render_template :show
@@ -78,9 +76,7 @@ describe Projects::Ci::LintsController do
         post :create, params: { namespace_id: project.namespace, project_id: project, content: content }
       end
 
-      it 'is success' do
-        expect(response).to be_success
-      end
+      it { expect(response).to be_successful }
 
       it 'render show page' do
         expect(response).to render_template :show
diff --git a/spec/controllers/projects/commit_controller_spec.rb b/spec/controllers/projects/commit_controller_spec.rb
index 58a1d96d010..afd5cb15e0f 100644
--- a/spec/controllers/projects/commit_controller_spec.rb
+++ b/spec/controllers/projects/commit_controller_spec.rb
@@ -45,14 +45,14 @@ describe Projects::CommitController do
     it 'handles binary files' do
       go(id: TestEnv::BRANCH_SHA['binary-encoding'], format: 'html')
 
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     shared_examples "export as" do |format|
       it "does generally work" do
         go(id: commit.id, format: format)
 
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it "generates it" do
@@ -110,7 +110,7 @@ describe Projects::CommitController do
               id: commit.id
             })
 
-        expect(response).to be_success
+        expect(response).to be_successful
       end
     end
 
@@ -177,7 +177,7 @@ describe Projects::CommitController do
               id: commit.id
             })
 
-        expect(response).not_to be_success
+        expect(response).not_to be_successful
         expect(response).to have_gitlab_http_status(404)
       end
     end
@@ -234,7 +234,7 @@ describe Projects::CommitController do
               id: master_pickable_commit.id
             })
 
-        expect(response).not_to be_success
+        expect(response).not_to be_successful
         expect(response).to have_gitlab_http_status(404)
       end
     end
diff --git a/spec/controllers/projects/commits_controller_spec.rb b/spec/controllers/projects/commits_controller_spec.rb
index 9db1ac2a46c..9c4d6fdcb2a 100644
--- a/spec/controllers/projects/commits_controller_spec.rb
+++ b/spec/controllers/projects/commits_controller_spec.rb
@@ -79,7 +79,7 @@ describe Projects::CommitsController do
           end
 
           it "renders as atom" do
-            expect(response).to be_success
+            expect(response).to be_successful
             expect(response.content_type).to eq('application/atom+xml')
           end
 
@@ -104,7 +104,7 @@ describe Projects::CommitsController do
           end
 
           it "renders as HTML" do
-            expect(response).to be_success
+            expect(response).to be_successful
             expect(response.content_type).to eq('text/html')
           end
         end
diff --git a/spec/controllers/projects/compare_controller_spec.rb b/spec/controllers/projects/compare_controller_spec.rb
index 48a92a772dc..9afc46c4be9 100644
--- a/spec/controllers/projects/compare_controller_spec.rb
+++ b/spec/controllers/projects/compare_controller_spec.rb
@@ -19,7 +19,7 @@ describe Projects::CompareController do
     end
 
     it 'returns successfully' do
-      expect(response).to be_success
+      expect(response).to be_successful
     end
   end
 
@@ -49,7 +49,7 @@ describe Projects::CompareController do
         it 'shows some diffs with ignore whitespace change option' do
           show_request
 
-          expect(response).to be_success
+          expect(response).to be_successful
           diff_file = assigns(:diffs).diff_files.first
           expect(diff_file).not_to be_nil
           expect(assigns(:commits).length).to be >= 1
@@ -67,7 +67,7 @@ describe Projects::CompareController do
         it 'sets the diffs and commits ivars' do
           show_request
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(assigns(:diffs).diff_files.first).not_to be_nil
           expect(assigns(:commits).length).to be >= 1
         end
@@ -81,7 +81,7 @@ describe Projects::CompareController do
       it 'sets empty diff and commit ivars' do
         show_request
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(assigns(:diffs)).to eq([])
         expect(assigns(:commits)).to eq([])
       end
@@ -94,7 +94,7 @@ describe Projects::CompareController do
       it 'sets empty diff and commit ivars' do
         show_request
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(assigns(:diffs)).to eq([])
         expect(assigns(:commits)).to eq([])
       end
diff --git a/spec/controllers/projects/cycle_analytics/events_controller_spec.rb b/spec/controllers/projects/cycle_analytics/events_controller_spec.rb
index 8fc3ae0aa32..b828c678d0c 100644
--- a/spec/controllers/projects/cycle_analytics/events_controller_spec.rb
+++ b/spec/controllers/projects/cycle_analytics/events_controller_spec.rb
@@ -16,7 +16,7 @@ describe Projects::CycleAnalytics::EventsController do
       it 'is empty' do
         get_issue
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(JSON.parse(response.body)['events']).to be_empty
       end
     end
@@ -32,7 +32,7 @@ describe Projects::CycleAnalytics::EventsController do
       it 'is not empty' do
         get_issue
 
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it 'contains event detais' do
@@ -49,7 +49,7 @@ describe Projects::CycleAnalytics::EventsController do
         it 'is empty' do
           get_issue(additional_params: { cycle_analytics: { start_date: 7 } })
 
-          expect(response).to be_success
+          expect(response).to be_successful
 
           expect(JSON.parse(response.body)['events']).to be_empty
         end
diff --git a/spec/controllers/projects/cycle_analytics_controller_spec.rb b/spec/controllers/projects/cycle_analytics_controller_spec.rb
index 5e6ceef2517..65eee7b8ead 100644
--- a/spec/controllers/projects/cycle_analytics_controller_spec.rb
+++ b/spec/controllers/projects/cycle_analytics_controller_spec.rb
@@ -21,7 +21,7 @@ describe Projects::CycleAnalyticsController do
             project_id: project
           })
 
-      expect(response).to be_success
+      expect(response).to be_successful
     end
   end
 
@@ -34,7 +34,7 @@ describe Projects::CycleAnalyticsController do
               project_id: project
             })
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(assigns(:cycle_analytics_no_data)).to eq(true)
       end
     end
@@ -55,7 +55,7 @@ describe Projects::CycleAnalyticsController do
               project_id: project
             })
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(assigns(:cycle_analytics_no_data)).to eq(false)
       end
     end
diff --git a/spec/controllers/projects/merge_requests/creations_controller_spec.rb b/spec/controllers/projects/merge_requests/creations_controller_spec.rb
index 3816e1c7a31..ce977f26ec6 100644
--- a/spec/controllers/projects/merge_requests/creations_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests/creations_controller_spec.rb
@@ -28,7 +28,7 @@ describe Projects::MergeRequests::CreationsController do
       it 'renders new merge request widget template' do
         get :new, params: get_diff_params
 
-        expect(response).to be_success
+        expect(response).to be_successful
       end
     end
 
@@ -56,7 +56,7 @@ describe Projects::MergeRequests::CreationsController do
         it 'limits total commits' do
           get :new, params: large_diff_params
 
-          expect(response).to be_success
+          expect(response).to be_successful
 
           total = assigns(:total_commit_count)
           expect(assigns(:commits)).to be_an Array
@@ -70,7 +70,7 @@ describe Projects::MergeRequests::CreationsController do
       it 'shows total commits' do
         get :new, params: large_diff_params
 
-        expect(response).to be_success
+        expect(response).to be_successful
 
         total = assigns(:total_commit_count)
         expect(assigns(:commits)).to be_an CommitCollection
@@ -89,7 +89,7 @@ describe Projects::MergeRequests::CreationsController do
 
         get :diffs, params: get_diff_params.merge(format: 'json')
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(assigns[:diffs]).to be_nil
       end
     end
diff --git a/spec/controllers/projects/merge_requests/diffs_controller_spec.rb b/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
index d940d226176..ac3e9901123 100644
--- a/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
@@ -66,7 +66,7 @@ describe Projects::MergeRequests::DiffsController do
         end
 
         it 'renders' do
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(response.body).to have_content('Subproject commit')
         end
       end
diff --git a/spec/controllers/projects/merge_requests_controller_spec.rb b/spec/controllers/projects/merge_requests_controller_spec.rb
index b1dc6a65dd4..11b1eaf11b7 100644
--- a/spec/controllers/projects/merge_requests_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests_controller_spec.rb
@@ -57,7 +57,7 @@ describe Projects::MergeRequestsController do
 
           go(format: :html)
 
-          expect(response).to be_success
+          expect(response).to be_successful
         end
       end
 
@@ -66,7 +66,7 @@ describe Projects::MergeRequestsController do
 
         go(format: :html)
 
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       context "that is invalid" do
@@ -75,7 +75,7 @@ describe Projects::MergeRequestsController do
         it "renders merge request page" do
           go(format: :html)
 
-          expect(response).to be_success
+          expect(response).to be_successful
         end
       end
     end
@@ -124,7 +124,7 @@ describe Projects::MergeRequestsController do
         it "renders merge request page" do
           go(format: :json)
 
-          expect(response).to be_success
+          expect(response).to be_successful
         end
       end
     end
diff --git a/spec/controllers/projects/milestones_controller_spec.rb b/spec/controllers/projects/milestones_controller_spec.rb
index 9b2025b836c..cbf9d437909 100644
--- a/spec/controllers/projects/milestones_controller_spec.rb
+++ b/spec/controllers/projects/milestones_controller_spec.rb
@@ -139,7 +139,7 @@ describe Projects::MilestonesController do
       expect(issue.milestone_id).to eq(milestone.id)
 
       delete :destroy, params: { namespace_id: project.namespace.id, project_id: project.id, id: milestone.iid }, format: :js
-      expect(response).to be_success
+      expect(response).to be_successful
 
       expect(Event.recent.first.action).to eq(Event::DESTROYED)
 
diff --git a/spec/controllers/projects/project_members_controller_spec.rb b/spec/controllers/projects/project_members_controller_spec.rb
index 4141e41c7a7..5130e26c928 100644
--- a/spec/controllers/projects/project_members_controller_spec.rb
+++ b/spec/controllers/projects/project_members_controller_spec.rb
@@ -158,7 +158,7 @@ describe Projects::ProjectMembersController do
             id: member
           }, xhr: true
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(project.members).not_to include member
         end
       end
diff --git a/spec/controllers/projects/refs_controller_spec.rb b/spec/controllers/projects/refs_controller_spec.rb
index 6db98f2428b..646c7a7db7c 100644
--- a/spec/controllers/projects/refs_controller_spec.rb
+++ b/spec/controllers/projects/refs_controller_spec.rb
@@ -49,7 +49,7 @@ describe Projects::RefsController do
       expect(::Gitlab::GitalyClient).to receive(:allow_ref_name_caching).and_call_original
 
       xhr_get(:js)
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it 'renders JSON' do
@@ -57,7 +57,7 @@ describe Projects::RefsController do
 
       xhr_get(:json)
 
-      expect(response).to be_success
+      expect(response).to be_successful
       expect(json_response).to be_kind_of(Array)
     end
   end
diff --git a/spec/controllers/projects/services_controller_spec.rb b/spec/controllers/projects/services_controller_spec.rb
index 68eabce8513..563b61962cf 100644
--- a/spec/controllers/projects/services_controller_spec.rb
+++ b/spec/controllers/projects/services_controller_spec.rb
@@ -159,7 +159,7 @@ describe Projects::ServicesController do
 
     context 'with approved services' do
       it 'renders edit page' do
-        expect(response).to be_success
+        expect(response).to be_successful
       end
     end
   end
diff --git a/spec/controllers/users_controller_spec.rb b/spec/controllers/users_controller_spec.rb
index 8b8d4c57000..5566df0c216 100644
--- a/spec/controllers/users_controller_spec.rb
+++ b/spec/controllers/users_controller_spec.rb
@@ -19,7 +19,7 @@ describe UsersController do
         it 'renders the show template' do
           get :show, params: { username: user.username }
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(response).to render_template('show')
         end
       end
@@ -362,7 +362,7 @@ describe UsersController do
             it 'responds with success' do
               get :show, params: { username: user.username }
 
-              expect(response).to be_success
+              expect(response).to be_successful
             end
           end
 
@@ -418,7 +418,7 @@ describe UsersController do
             it 'responds with success' do
               get :projects, params: { username: user.username }
 
-              expect(response).to be_success
+              expect(response).to be_successful
             end
           end
 
diff --git a/spec/support/shared_examples/controllers/external_authorization_service_shared_examples.rb b/spec/support/shared_examples/controllers/external_authorization_service_shared_examples.rb
index 2faa0cf8c1c..d8a1ae83f61 100644
--- a/spec/support/shared_examples/controllers/external_authorization_service_shared_examples.rb
+++ b/spec/support/shared_examples/controllers/external_authorization_service_shared_examples.rb
@@ -8,7 +8,7 @@ shared_examples 'disabled when using an external authorization service' do
   it 'works when the feature is not enabled' do
     subject
 
-    expect(response).to be_success
+    expect(response).to be_successful
   end
 
   it 'renders a 404 with a message when the feature is enabled' do
-- 
cgit v1.2.1


From dcfaf49550866a291c316f2901e4274d587e7d37 Mon Sep 17 00:00:00 2001
From: Aleksei Lipniagov <alipniagov@gitlab.com>
Date: Mon, 19 Aug 2019 12:52:07 +0000
Subject: Clean Sidekiq metrics from multiproc dir on start

After moving the multiproc dir cleanup into `config.ru`:`warmup`, we
stopped cleaning Sidekiq metrics dir which is not correct.
This MR intended to fix that. More details:
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/31668
---
 config.ru                                          | 18 +++-----
 config/initializers/7_prometheus_metrics.rb        |  3 ++
 lib/prometheus/cleanup_multiproc_dir_service.rb    | 23 ++++++++++
 .../cleanup_multiproc_dir_service_spec.rb          | 51 ++++++++++++++++++++++
 4 files changed, 82 insertions(+), 13 deletions(-)
 create mode 100644 lib/prometheus/cleanup_multiproc_dir_service.rb
 create mode 100644 spec/lib/prometheus/cleanup_multiproc_dir_service_spec.rb

diff --git a/config.ru b/config.ru
index f6a7dca0542..750c84f7642 100644
--- a/config.ru
+++ b/config.ru
@@ -17,24 +17,16 @@ end
 
 require ::File.expand_path('../config/environment', __FILE__)
 
-# The following is necessary to ensure stale Prometheus metrics don't accumulate over time.
-# It needs to be done as early as here to ensure metrics files aren't deleted.
-# After we hit our app in `warmup`, first metrics and corresponding files already being created,
-# for example in `lib/gitlab/metrics/requests_rack_middleware.rb`.
-def cleanup_prometheus_multiproc_dir
-  if dir = ::Prometheus::Client.configuration.multiprocess_files_dir
-    old_metrics = Dir[File.join(dir, '*.db')]
-
-    FileUtils.rm_rf(old_metrics)
-  end
-end
-
 def master_process?
   Prometheus::PidProvider.worker_id.in? %w(unicorn_master puma_master)
 end
 
 warmup do |app|
-  cleanup_prometheus_multiproc_dir if master_process?
+  # The following is necessary to ensure stale Prometheus metrics don't accumulate over time.
+  # It needs to be done as early as here to ensure metrics files aren't deleted.
+  # After we hit our app in `warmup`, first metrics and corresponding files already being created,
+  # for example in `lib/gitlab/metrics/requests_rack_middleware.rb`.
+  Prometheus::CleanupMultiprocDirService.new.execute if master_process?
 
   client = Rack::MockRequest.new(app)
   client.get('/')
diff --git a/config/initializers/7_prometheus_metrics.rb b/config/initializers/7_prometheus_metrics.rb
index 70e5dcd042e..143b34b5368 100644
--- a/config/initializers/7_prometheus_metrics.rb
+++ b/config/initializers/7_prometheus_metrics.rb
@@ -32,6 +32,9 @@ end
 
 Sidekiq.configure_server do |config|
   config.on(:startup) do
+    # webserver metrics are cleaned up in config.ru: `warmup` block
+    Prometheus::CleanupMultiprocDirService.new.execute
+
     Gitlab::Metrics::SidekiqMetricsExporter.instance.start
   end
 end
diff --git a/lib/prometheus/cleanup_multiproc_dir_service.rb b/lib/prometheus/cleanup_multiproc_dir_service.rb
new file mode 100644
index 00000000000..6418b4de166
--- /dev/null
+++ b/lib/prometheus/cleanup_multiproc_dir_service.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Prometheus
+  class CleanupMultiprocDirService
+    include Gitlab::Utils::StrongMemoize
+
+    def execute
+      FileUtils.rm_rf(old_metrics) if old_metrics
+    end
+
+    private
+
+    def old_metrics
+      strong_memoize(:old_metrics) do
+        Dir[File.join(multiprocess_files_dir, '*.db')] if multiprocess_files_dir
+      end
+    end
+
+    def multiprocess_files_dir
+      ::Prometheus::Client.configuration.multiprocess_files_dir
+    end
+  end
+end
diff --git a/spec/lib/prometheus/cleanup_multiproc_dir_service_spec.rb b/spec/lib/prometheus/cleanup_multiproc_dir_service_spec.rb
new file mode 100644
index 00000000000..c7302a1a656
--- /dev/null
+++ b/spec/lib/prometheus/cleanup_multiproc_dir_service_spec.rb
@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Prometheus::CleanupMultiprocDirService do
+  describe '.call' do
+    subject { described_class.new.execute }
+
+    let(:metrics_multiproc_dir) { Dir.mktmpdir }
+    let(:metrics_file_path) { File.join(metrics_multiproc_dir, 'counter_puma_master-0.db') }
+
+    before do
+      FileUtils.touch(metrics_file_path)
+    end
+
+    after do
+      FileUtils.rm_r(metrics_multiproc_dir)
+    end
+
+    context 'when `multiprocess_files_dir` is defined' do
+      before do
+        expect(Prometheus::Client.configuration)
+              .to receive(:multiprocess_files_dir)
+              .and_return(metrics_multiproc_dir)
+              .at_least(:once)
+      end
+
+      it 'removes old metrics' do
+        expect { subject }
+          .to change { File.exist?(metrics_file_path) }
+          .from(true)
+          .to(false)
+      end
+    end
+
+    context 'when `multiprocess_files_dir` is not defined' do
+      before do
+        expect(Prometheus::Client.configuration)
+              .to receive(:multiprocess_files_dir)
+              .and_return(nil)
+              .at_least(:once)
+      end
+
+      it 'does not remove any files' do
+        expect { subject }
+          .not_to change { File.exist?(metrics_file_path) }
+          .from(true)
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From fb93142488cfb79bac45f184b7945018550bf326 Mon Sep 17 00:00:00 2001
From: Felipe Artur <felipefac@gmail.com>
Date: Thu, 8 Aug 2019 16:29:45 -0300
Subject: Prevent disclosure of merge request id via email

Do not disclosure merge request id via email for unauthorized users
when closing issues.
---
 app/helpers/emails_helper.rb                       |  4 ++
 app/mailers/emails/issues.rb                       |  2 +
 .../security-hide_merge_request_ids_on_emails.yml  |  5 ++
 spec/helpers/emails_helper_spec.rb                 | 56 +++++++++++++++++-----
 spec/services/issues/close_service_spec.rb         | 40 +++++++++++++---
 5 files changed, 89 insertions(+), 18 deletions(-)
 create mode 100644 changelogs/unreleased/security-hide_merge_request_ids_on_emails.yml

diff --git a/app/helpers/emails_helper.rb b/app/helpers/emails_helper.rb
index 36122d3a22a..23596769738 100644
--- a/app/helpers/emails_helper.rb
+++ b/app/helpers/emails_helper.rb
@@ -90,6 +90,8 @@ module EmailsHelper
     when MergeRequest
       merge_request = MergeRequest.find(closed_via[:id]).present
 
+      return "" unless Ability.allowed?(@recipient, :read_merge_request, merge_request)
+
       case format
       when :html
         merge_request_link = link_to(merge_request.to_reference, merge_request.web_url)
@@ -102,6 +104,8 @@ module EmailsHelper
       # Technically speaking this should be Commit but per
       # https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/15610#note_163812339
       # we can't deserialize Commit without custom serializer for ActiveJob
+      return "" unless Ability.allowed?(@recipient, :download_code, @project)
+
       _("via %{closed_via}") % { closed_via: closed_via }
     else
       ""
diff --git a/app/mailers/emails/issues.rb b/app/mailers/emails/issues.rb
index f3a3203f7ad..0bba2a8bf24 100644
--- a/app/mailers/emails/issues.rb
+++ b/app/mailers/emails/issues.rb
@@ -34,6 +34,8 @@ module Emails
       setup_issue_mail(issue_id, recipient_id, closed_via: closed_via)
 
       @updated_by = User.find(updated_by_user_id)
+      @recipient = User.find(recipient_id)
+
       mail_answer_thread(@issue, issue_thread_options(updated_by_user_id, recipient_id, reason))
     end
 
diff --git a/changelogs/unreleased/security-hide_merge_request_ids_on_emails.yml b/changelogs/unreleased/security-hide_merge_request_ids_on_emails.yml
new file mode 100644
index 00000000000..cd8c9590a70
--- /dev/null
+++ b/changelogs/unreleased/security-hide_merge_request_ids_on_emails.yml
@@ -0,0 +1,5 @@
+---
+title: Prevent disclosure of merge request ID via email
+merge_request:
+author:
+type: security
diff --git a/spec/helpers/emails_helper_spec.rb b/spec/helpers/emails_helper_spec.rb
index d25f0c6de4a..a14ae2cde4b 100644
--- a/spec/helpers/emails_helper_spec.rb
+++ b/spec/helpers/emails_helper_spec.rb
@@ -6,30 +6,62 @@ describe EmailsHelper do
       let(:merge_request) { create(:merge_request) }
       let(:merge_request_presenter) { merge_request.present }
 
-      context "and format is text" do
-        it "returns plain text" do
-          expect(closure_reason_text(merge_request, format: :text)).to eq("via merge request #{merge_request.to_reference} (#{merge_request_presenter.web_url})")
+      context 'when user can read merge request' do
+        let(:user) { create(:user) }
+
+        before do
+          merge_request.project.add_developer(user)
+          self.instance_variable_set(:@recipient, user)
+          self.instance_variable_set(:@project, merge_request.project)
+        end
+
+        context "and format is text" do
+          it "returns plain text" do
+            expect(helper.closure_reason_text(merge_request, format: :text)).to eq("via merge request #{merge_request.to_reference} (#{merge_request_presenter.web_url})")
+          end
         end
-      end
 
-      context "and format is HTML" do
-        it "returns HTML" do
-          expect(closure_reason_text(merge_request, format: :html)).to eq("via merge request #{link_to(merge_request.to_reference, merge_request_presenter.web_url)}")
+        context "and format is HTML" do
+          it "returns HTML" do
+            expect(helper.closure_reason_text(merge_request, format: :html)).to eq("via merge request #{link_to(merge_request.to_reference, merge_request_presenter.web_url)}")
+          end
+        end
+
+        context "and format is unknown" do
+          it "returns plain text" do
+            expect(helper.closure_reason_text(merge_request, format: :text)).to eq("via merge request #{merge_request.to_reference} (#{merge_request_presenter.web_url})")
+          end
         end
       end
 
-      context "and format is unknown" do
-        it "returns plain text" do
-          expect(closure_reason_text(merge_request, format: :text)).to eq("via merge request #{merge_request.to_reference} (#{merge_request_presenter.web_url})")
+      context 'when user cannot read merge request' do
+        it "does not have link to merge request" do
+          expect(helper.closure_reason_text(merge_request)).to be_empty
         end
       end
     end
 
     context 'when given a String' do
+      let(:user) { create(:user) }
+      let(:project) { create(:project) }
       let(:closed_via) { "5a0eb6fd7e0f133044378c662fcbbc0d0c16dbfa" }
 
-      it "returns plain text" do
-        expect(closure_reason_text(closed_via)).to eq("via #{closed_via}")
+      context 'when user can read commits' do
+        before do
+          project.add_developer(user)
+          self.instance_variable_set(:@recipient, user)
+          self.instance_variable_set(:@project, project)
+        end
+
+        it "returns plain text" do
+          expect(closure_reason_text(closed_via)).to eq("via #{closed_via}")
+        end
+      end
+
+      context 'when user cannot read commits' do
+        it "returns plain text" do
+          expect(closure_reason_text(closed_via)).to be_empty
+        end
       end
     end
 
diff --git a/spec/services/issues/close_service_spec.rb b/spec/services/issues/close_service_spec.rb
index 6874a8a0929..642a49d57d5 100644
--- a/spec/services/issues/close_service_spec.rb
+++ b/spec/services/issues/close_service_spec.rb
@@ -60,35 +60,63 @@ describe Issues::CloseService do
 
   describe '#close_issue' do
     context "closed by a merge request" do
-      before do
+      it 'mentions closure via a merge request' do
         perform_enqueued_jobs do
           described_class.new(project, user).close_issue(issue, closed_via: closing_merge_request)
         end
-      end
 
-      it 'mentions closure via a merge request' do
         email = ActionMailer::Base.deliveries.last
 
         expect(email.to.first).to eq(user2.email)
         expect(email.subject).to include(issue.title)
         expect(email.body.parts.map(&:body)).to all(include(closing_merge_request.to_reference))
       end
+
+      context 'when user cannot read merge request' do
+        it 'does not mention merge request' do
+          project.project_feature.update_attribute(:repository_access_level, ProjectFeature::DISABLED)
+          perform_enqueued_jobs do
+            described_class.new(project, user).close_issue(issue, closed_via: closing_merge_request)
+          end
+
+          email = ActionMailer::Base.deliveries.last
+          body_text = email.body.parts.map(&:body).join(" ")
+
+          expect(email.to.first).to eq(user2.email)
+          expect(email.subject).to include(issue.title)
+          expect(body_text).not_to include(closing_merge_request.to_reference)
+        end
+      end
     end
 
     context "closed by a commit" do
-      before do
+      it 'mentions closure via a commit' do
         perform_enqueued_jobs do
           described_class.new(project, user).close_issue(issue, closed_via: closing_commit)
         end
-      end
 
-      it 'mentions closure via a commit' do
         email = ActionMailer::Base.deliveries.last
 
         expect(email.to.first).to eq(user2.email)
         expect(email.subject).to include(issue.title)
         expect(email.body.parts.map(&:body)).to all(include(closing_commit.id))
       end
+
+      context 'when user cannot read the commit' do
+        it 'does not mention the commit id' do
+          project.project_feature.update_attribute(:repository_access_level, ProjectFeature::DISABLED)
+          perform_enqueued_jobs do
+            described_class.new(project, user).close_issue(issue, closed_via: closing_commit)
+          end
+
+          email = ActionMailer::Base.deliveries.last
+          body_text = email.body.parts.map(&:body).join(" ")
+
+          expect(email.to.first).to eq(user2.email)
+          expect(email.subject).to include(issue.title)
+          expect(body_text).not_to include(closing_commit.id)
+        end
+      end
     end
 
     context "valid params" do
-- 
cgit v1.2.1


From b759b4a62ed184236b9d56c3ca5cf1af534bbda0 Mon Sep 17 00:00:00 2001
From: Sanad Liaquat <sliaquat@gitlab.com>
Date: Mon, 19 Aug 2019 20:03:13 +0500
Subject: Fix add project member spec

---
 .../features/browser_ui/1_manage/project/add_project_member_spec.rb     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qa/qa/specs/features/browser_ui/1_manage/project/add_project_member_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/project/add_project_member_spec.rb
index f51c16f472c..d859ee8e96a 100644
--- a/qa/qa/specs/features/browser_ui/1_manage/project/add_project_member_spec.rb
+++ b/qa/qa/specs/features/browser_ui/1_manage/project/add_project_member_spec.rb
@@ -19,7 +19,7 @@ module QA
           page.add_member(user.username)
         end
 
-        expect(page).to have_content(/#{user.name} (. )?@#{user.username} Given access/)
+        expect(page).to have_content(/@#{user.username}\nGiven access/)
       end
     end
   end
-- 
cgit v1.2.1


From 4fdc34c10950863ad04a68dc2117371c95db7478 Mon Sep 17 00:00:00 2001
From: Paul Slaughter <pslaughter@gitlab.com>
Date: Mon, 19 Aug 2019 09:00:10 -0500
Subject: Fix mergeUrlParams handling of `+`

**What was the issue?**
If a param value had `+`, it would be encoded as a
literal `+` instead of a space.
---
 app/assets/javascripts/lib/utils/url_utility.js             | 8 +++++++-
 changelogs/unreleased/fe-fix-merge-url-params-with-plus.yml | 5 +++++
 spec/frontend/lib/utils/url_utility_spec.js                 | 6 ++++++
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/fe-fix-merge-url-params-with-plus.yml

diff --git a/app/assets/javascripts/lib/utils/url_utility.js b/app/assets/javascripts/lib/utils/url_utility.js
index 1336b6a5461..7ead9d46fbb 100644
--- a/app/assets/javascripts/lib/utils/url_utility.js
+++ b/app/assets/javascripts/lib/utils/url_utility.js
@@ -1,5 +1,11 @@
 import { join as joinPaths } from 'path';
 
+// Returns a decoded url parameter value
+// - Treats '+' as '%20'
+function decodeUrlParameter(val) {
+  return decodeURIComponent(val.replace(/\+/g, '%20'));
+}
+
 // Returns an array containing the value(s) of the
 // of the key passed as an argument
 export function getParameterValues(sParam, url = window.location) {
@@ -30,7 +36,7 @@ export function mergeUrlParams(params, url) {
       .forEach(part => {
         if (part.length) {
           const kv = part.split('=');
-          merged[decodeURIComponent(kv[0])] = decodeURIComponent(kv.slice(1).join('='));
+          merged[decodeUrlParameter(kv[0])] = decodeUrlParameter(kv.slice(1).join('='));
         }
       });
   }
diff --git a/changelogs/unreleased/fe-fix-merge-url-params-with-plus.yml b/changelogs/unreleased/fe-fix-merge-url-params-with-plus.yml
new file mode 100644
index 00000000000..7ca8ae0a8f6
--- /dev/null
+++ b/changelogs/unreleased/fe-fix-merge-url-params-with-plus.yml
@@ -0,0 +1,5 @@
+---
+title: Fix search preserving space when change branch
+merge_request: 31973
+author: minghuan lei
+type: fixed
diff --git a/spec/frontend/lib/utils/url_utility_spec.js b/spec/frontend/lib/utils/url_utility_spec.js
index a986bc49f28..b0bdd924921 100644
--- a/spec/frontend/lib/utils/url_utility_spec.js
+++ b/spec/frontend/lib/utils/url_utility_spec.js
@@ -94,6 +94,12 @@ describe('URL utility', () => {
     it('adds and updates encoded params', () => {
       expect(urlUtils.mergeUrlParams({ a: '&', q: '?' }, '?a=%23#frag')).toBe('?a=%26&q=%3F#frag');
     });
+
+    it('treats "+" as "%20"', () => {
+      expect(urlUtils.mergeUrlParams({ ref: 'bogus' }, '?a=lorem+ipsum&ref=charlie')).toBe(
+        '?a=lorem%20ipsum&ref=bogus',
+      );
+    });
   });
 
   describe('removeParams', () => {
-- 
cgit v1.2.1


From cacf128d5d5c7f6ab4f90f66f181057086ad1920 Mon Sep 17 00:00:00 2001
From: minghuan lei <leiminghuan@126.com>
Date: Mon, 19 Aug 2019 10:28:01 -0500
Subject: Add feature spec for search with space

---
 .../features/search/user_searches_for_code_spec.rb | 30 ++++++++++++++++++----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/spec/features/search/user_searches_for_code_spec.rb b/spec/features/search/user_searches_for_code_spec.rb
index 5a60991c1bf..4ca79ccaea8 100644
--- a/spec/features/search/user_searches_for_code_spec.rb
+++ b/spec/features/search/user_searches_for_code_spec.rb
@@ -39,17 +39,16 @@ describe 'User searches for code' do
     context 'when on a project page', :js do
       before do
         visit(search_path)
-      end
-
-      include_examples 'top right search form'
-
-      it 'finds code' do
         find('.js-search-project-dropdown').click
 
         page.within('.project-filter') do
           click_link(project.full_name)
         end
+      end
 
+      include_examples 'top right search form'
+
+      it 'finds code' do
         fill_in('dashboard_search', with: 'rspec')
         find('.btn-search').click
 
@@ -57,6 +56,27 @@ describe 'User searches for code' do
           expect(find(:css, '.search-results')).to have_content('Update capybara, rspec-rails, poltergeist to recent versions')
         end
       end
+
+      it 'search mutiple words with refs switching' do
+        expected_result = 'Use `snake_case` for naming files'
+        search = 'for naming files'
+
+        fill_in('dashboard_search', with: search)
+        find('.btn-search').click
+
+        page.within('.results') do
+          expect(find('.search-results')).to have_content(expected_result)
+        end
+
+        find('.js-project-refs-dropdown').click
+        find('.dropdown-page-one .dropdown-content').click_link('v1.0.0')
+
+        page.within('.results') do
+          expect(find(:css, '.search-results')).to have_content(expected_result)
+        end
+
+        expect(find_field('dashboard_search').value).to eq(search)
+      end
     end
 
     context 'search code within refs', :js do
-- 
cgit v1.2.1


From 250318cfee658ee42594fb594b997949fa9a3dbd Mon Sep 17 00:00:00 2001
From: jakeburden <jburden@gitlab.com>
Date: Fri, 16 Aug 2019 10:15:50 -0400
Subject: Update tooltip of "detached" label/state

---
 app/assets/javascripts/pipelines/components/pipeline_url.vue        | 2 +-
 app/views/projects/pipelines/_info.html.haml                        | 2 +-
 .../unreleased/66061-update-tooltip-of-detached-label-state.yml     | 5 +++++
 locale/gitlab.pot                                                   | 6 +++---
 4 files changed, 10 insertions(+), 5 deletions(-)
 create mode 100644 changelogs/unreleased/66061-update-tooltip-of-detached-label-state.yml

diff --git a/app/assets/javascripts/pipelines/components/pipeline_url.vue b/app/assets/javascripts/pipelines/components/pipeline_url.vue
index e01080b04d6..4efc1d2408a 100644
--- a/app/assets/javascripts/pipelines/components/pipeline_url.vue
+++ b/app/assets/javascripts/pipelines/components/pipeline_url.vue
@@ -104,7 +104,7 @@ export default {
         v-gl-tooltip
         :title="
           __(
-            'The code of a detached pipeline is tested against the source branch instead of merged results',
+            'Pipelines for merge requests are configured. A detached pipeline runs in the context of the merge request, and not against the merged result. Learn more on the documentation for Pipelines for Merged Results.',
           )
         "
         class="js-pipeline-url-detached badge badge-info"
diff --git a/app/views/projects/pipelines/_info.html.haml b/app/views/projects/pipelines/_info.html.haml
index 2b56ada8b73..862dc394315 100644
--- a/app/views/projects/pipelines/_info.html.haml
+++ b/app/views/projects/pipelines/_info.html.haml
@@ -43,7 +43,7 @@
       } }
         Auto DevOps
     - if @pipeline.detached_merge_request_pipeline?
-      %span.js-pipeline-url-mergerequest.badge.badge-info.has-tooltip{ title: "The code of a detached pipeline is tested against the source branch instead of merged results" }
+      %span.js-pipeline-url-mergerequest.badge.badge-info.has-tooltip{ title: "Pipelines for merge requests are configured. A detached pipeline runs in the context of the merge request, and not against the merged result. Learn more on the documentation for Pipelines for Merged Results." }
         detached
     - if @pipeline.stuck?
       %span.js-pipeline-url-stuck.badge.badge-warning
diff --git a/changelogs/unreleased/66061-update-tooltip-of-detached-label-state.yml b/changelogs/unreleased/66061-update-tooltip-of-detached-label-state.yml
new file mode 100644
index 00000000000..826d5548999
--- /dev/null
+++ b/changelogs/unreleased/66061-update-tooltip-of-detached-label-state.yml
@@ -0,0 +1,5 @@
+---
+title: Updates tooltip of 'detached' label/state
+merge_request:
+author:
+type: other
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index dd69fa1f8f6..d2ae7ce8e1a 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -7982,6 +7982,9 @@ msgstr ""
 msgid "Pipelines for last year"
 msgstr ""
 
+msgid "Pipelines for merge requests are configured. A detached pipeline runs in the context of the merge request, and not against the merged result. Learn more on the documentation for Pipelines for Merged Results."
+msgstr ""
+
 msgid "Pipelines settings for '%{project_name}' were successfully updated."
 msgstr ""
 
@@ -11113,9 +11116,6 @@ msgstr ""
 msgid "The character highlighter helps you keep the subject line to %{titleLength} characters and wrap the body at %{bodyLength} so they are readable in git."
 msgstr ""
 
-msgid "The code of a detached pipeline is tested against the source branch instead of merged results"
-msgstr ""
-
 msgid "The coding stage shows the time from the first commit to creating the merge request. The data will automatically be added here once you create your first merge request."
 msgstr ""
 
-- 
cgit v1.2.1


From 104fada7de96b1b11386221fca6dc4cab5c8af1c Mon Sep 17 00:00:00 2001
From: Mark Chao <mchao@gitlab.com>
Date: Mon, 19 Aug 2019 17:56:18 +0000
Subject: Doc: add project approval rule endpoints

---
 doc/api/merge_request_approvals.md | 294 ++++++++++++++++++++++++++++++-------
 1 file changed, 238 insertions(+), 56 deletions(-)

diff --git a/doc/api/merge_request_approvals.md b/doc/api/merge_request_approvals.md
index cc95689a65f..bf83bfd7e6a 100644
--- a/doc/api/merge_request_approvals.md
+++ b/doc/api/merge_request_approvals.md
@@ -23,36 +23,6 @@ GET /projects/:id/approvals
 
 ```json
 {
-  "approvers": [
-    {
-      "user": {
-        "id": 5,
-        "name": "John Doe6",
-        "username": "user5",
-        "state":"active","avatar_url":"https://www.gravatar.com/avatar/4aea8cf834ed91844a2da4ff7ae6b491?s=80\u0026d=identicon","web_url":"http://localhost/user5"
-      }
-    }
-  ],
-  "approver_groups": [
-    {
-      "group": {
-        "id": 1,
-        "name": "group1",
-        "path": "group1",
-        "description": "",
-        "visibility": "public",
-        "lfs_enabled": false,
-        "avatar_url": null,
-        "web_url": "http://localhost/groups/group1",
-        "request_access_enabled": false,
-        "full_name": "group1",
-        "full_path": "group1",
-        "parent_id": null,
-        "ldap_cn": null,
-        "ldap_access": null
-      }
-    }
-  ],
   "approvals_before_merge": 2,
   "reset_approvals_on_push": true,
   "disable_overriding_approvers_per_merge_request": false
@@ -75,7 +45,7 @@ POST /projects/:id/approvals
 | Attribute                                        | Type    | Required | Description                                                                                         |
 | ------------------------------------------------ | ------- | -------- | --------------------------------------------------------------------------------------------------- |
 | `id`                                             | integer | yes      | The ID of a project                                                                                 |
-| `approvals_before_merge`                         | integer | no       | How many approvals are required before an MR can be merged                                          |
+| `approvals_before_merge`                         | integer | no       | How many approvals are required before an MR can be merged. Deprecated in 12.0 in favor of Approval Rules API. |
 | `reset_approvals_on_push`                        | boolean | no       | Reset approvals on a new push                                                                       |
 | `disable_overriding_approvers_per_merge_request` | boolean | no       | Allow/Disallow overriding approvers per MR                                                          |
 | `merge_requests_author_approval`                 | boolean | no       | Allow/Disallow authors from self approving merge requests; `true` means authors cannot self approve |
@@ -83,20 +53,68 @@ POST /projects/:id/approvals
 
 ```json
 {
-  "approvers": [
-    {
-      "user": {
+  "approvals_before_merge": 2,
+  "reset_approvals_on_push": true,
+  "disable_overriding_approvers_per_merge_request": false,
+  "merge_requests_author_approval": false,
+  "merge_requests_disable_committers_approval": false
+}
+```
+
+### Get project-level rules
+
+>**Note:** This API endpoint is only available on 12.3 Starter and above.
+
+You can request information about a project's approval rules using the following endpoint:
+
+```
+GET /projects/:id/approval_rules
+```
+
+**Parameters:**
+
+| Attribute            | Type    | Required | Description                                               |
+|----------------------|---------|----------|-----------------------------------------------------------|
+| `id`                 | integer | yes      | The ID of a project                                       |
+
+```json
+[
+  {
+    "id": 1,
+    "name": "security",
+    "rule_type": "regular",
+    "eligible_approvers": [
+      {
         "id": 5,
-        "name": "John Doe6",
-        "username": "user5",
-        "state":"active","avatar_url":"https://www.gravatar.com/avatar/4aea8cf834ed91844a2da4ff7ae6b491?s=80\u0026d=identicon","web_url":"http://localhost/user5"
+        "name": "John Doe",
+        "username": "jdoe",
+        "state": "active",
+        "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+        "web_url": "http://localhost/jdoe"
+      },
+      {
+        "id": 50,
+        "name": "Group Member 1",
+        "username": "group_member_1",
+        "state": "active",
+        "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+        "web_url": "http://localhost/group_member_1"
       }
-    }
-  ],
-  "approver_groups": [
-    {
-      "group": {
-        "id": 1,
+    ],
+    "approvals_required": 3,
+    "users": [
+      {
+        "id": 5,
+        "name": "John Doe",
+        "username": "jdoe",
+        "state": "active",
+        "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+        "web_url": "http://localhost/jdoe"
+      }
+    ],
+    "groups": [
+      {
+        "id": 5,
         "name": "group1",
         "path": "group1",
         "description": "",
@@ -111,18 +129,187 @@ POST /projects/:id/approvals
         "ldap_cn": null,
         "ldap_access": null
       }
+    ],
+    "contains_hidden_groups": false
+  }
+]
+```
+
+### Create project-level rule
+
+>**Note:** This API endpoint is only available on 12.3 Starter and above.
+
+You can create project approval rules using the following endpoint:
+
+```
+POST /projects/:id/approval_rules
+```
+
+**Parameters:**
+
+| Attribute            | Type    | Required | Description                                               |
+|----------------------|---------|----------|-----------------------------------------------------------|
+| `id`                 | integer | yes      | The ID of a project                                       |
+| `name`               | string  | yes      | The name of the approval rule                             |
+| `approvals_required` | integer | yes      | The number of required approvals for this rule            |
+| `users`              | integer | no       | The ids of users as approvers                             |
+| `groups`             | integer | no       | The ids of groups as approvers                            |
+
+```json
+{
+  "id": 1,
+  "name": "security",
+  "rule_type": "regular",
+  "eligible_approvers": [
+    {
+      "id": 2,
+      "name": "John Doe",
+      "username": "jdoe",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/jdoe"
+    },
+    {
+      "id": 50,
+      "name": "Group Member 1",
+      "username": "group_member_1",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/group_member_1"
     }
   ],
-  "approvals_before_merge": 2,
-  "reset_approvals_on_push": true,
-  "disable_overriding_approvers_per_merge_request": false,
-  "merge_requests_author_approval": false,
-  "merge_requests_disable_committers_approval": false
+  "approvals_required": 1,
+  "users": [
+    {
+      "id": 2,
+      "name": "John Doe",
+      "username": "jdoe",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/jdoe"
+    }
+  ],
+  "groups": [
+    {
+      "id": 5,
+      "name": "group1",
+      "path": "group1",
+      "description": "",
+      "visibility": "public",
+      "lfs_enabled": false,
+      "avatar_url": null,
+      "web_url": "http://localhost/groups/group1",
+      "request_access_enabled": false,
+      "full_name": "group1",
+      "full_path": "group1",
+      "parent_id": null,
+      "ldap_cn": null,
+      "ldap_access": null
+    }
+  ],
+  "contains_hidden_groups": false
+}
+```
+
+### Update project-level rule
+
+>**Note:** This API endpoint is only available on 12.3 Starter and above.
+
+You can update project approval rules using the following endpoint:
+
+```
+PUT /projects/:id/approval_rules/:approval_rule_id
+```
+
+**Important:** Approvers and groups not in the `users`/`groups` param will be **removed**
+
+**Parameters:**
+
+| Attribute            | Type    | Required | Description                                               |
+|----------------------|---------|----------|-----------------------------------------------------------|
+| `id`                 | integer | yes      | The ID of a project                                       |
+| `approval_rule_id`   | integer | yes      | The ID of a approval rule                                 |
+| `name`               | string  | yes      | The name of the approval rule                             |
+| `approvals_required` | integer | yes      | The number of required approvals for this rule            |
+| `users`              | integer | no       | The ids of users as approvers                             |
+| `groups`             | integer | no       | The ids of groups as approvers                            |
+
+```json
+{
+  "id": 1,
+  "name": "security",
+  "rule_type": "regular",
+  "eligible_approvers": [
+    {
+      "id": 2,
+      "name": "John Doe",
+      "username": "jdoe",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/jdoe"
+    },
+    {
+      "id": 50,
+      "name": "Group Member 1",
+      "username": "group_member_1",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/group_member_1"
+    }
+  ],
+  "approvals_required": 1,
+  "users": [
+    {
+      "id": 2,
+      "name": "John Doe",
+      "username": "jdoe",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/jdoe"
+    }
+  ],
+  "groups": [
+    {
+      "id": 5,
+      "name": "group1",
+      "path": "group1",
+      "description": "",
+      "visibility": "public",
+      "lfs_enabled": false,
+      "avatar_url": null,
+      "web_url": "http://localhost/groups/group1",
+      "request_access_enabled": false,
+      "full_name": "group1",
+      "full_path": "group1",
+      "parent_id": null,
+      "ldap_cn": null,
+      "ldap_access": null
+    }
+  ],
+  "contains_hidden_groups": false
 }
 ```
 
+### Delete project-level rule
+
+>**Note:** This API endpoint is only available on 12.3 Starter and above.
+
+You can delete project approval rules using the following endpoint:
+
+```
+DELETE /projects/:id/approval_rules/:approval_rule_id
+```
+
+**Parameters:**
+
+| Attribute            | Type    | Required | Description                                               |
+|----------------------|---------|----------|-----------------------------------------------------------|
+| `id`                 | integer | yes      | The ID of a project                                       |
+| `approval_rule_id`   | integer | yes      | The ID of a approval rule
+
 ### Change allowed approvers
 
+>**Note:** This API endpoint has been deprecated. Please use Approval Rule API instead.
 >**Note:** This API endpoint is only available on 10.6 Starter and above.
 
 If you are allowed to, you can change approvers and approver groups using
@@ -227,8 +414,6 @@ GET /projects/:id/merge_requests/:merge_request_iid/approvals
       }
     }
   ],
-  "approvers": [],
-  "approver_groups": []
 }
 ```
 
@@ -249,7 +434,7 @@ POST /projects/:id/merge_requests/:merge_request_iid/approvals
 |----------------------|---------|----------|--------------------------------------------|
 | `id`                 | integer | yes      | The ID of a project                        |
 | `merge_request_iid`  | integer | yes      | The IID of MR                              |
-| `approvals_required` | integer | yes      | Approvals required before MR can be merged |
+| `approvals_required` | integer | yes      | Approvals required before MR can be merged. Deprecated in 12.0 in favor of Approval Rules API. |
 
 ```json
 {
@@ -264,14 +449,13 @@ POST /projects/:id/merge_requests/:merge_request_iid/approvals
   "merge_status": "cannot_be_merged",
   "approvals_required": 2,
   "approvals_left": 2,
-  "approved_by": [],
-  "approvers": [],
-  "approver_groups": []
+  "approved_by": []
 }
 ```
 
 ### Change allowed approvers for Merge Request
 
+>**Note:** This API endpoint has been deprecated. Please use Approval Rule API instead.
 >**Note:** This API endpoint is only available on 10.6 Starter and above.
 
 If you are allowed to, you can change approvers and approver groups using
@@ -401,8 +585,6 @@ does not match, the response code will be `409`.
       }
     }
   ],
-  "approvers": [],
-  "approver_groups": []
 }
 ```
 
-- 
cgit v1.2.1


From c0741eb7bb7e3b3b020a813c993f4ff71ee89d32 Mon Sep 17 00:00:00 2001
From: Lucas Charles <me@lucascharles.me>
Date: Mon, 19 Aug 2019 11:12:50 -0700
Subject: Update api_resources docs - remove incorrect group vulnerabilities
 reference

---
 doc/api/api_resources.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/api/api_resources.md b/doc/api/api_resources.md
index b32f11464ef..9af5430f1c8 100644
--- a/doc/api/api_resources.md
+++ b/doc/api/api_resources.md
@@ -67,7 +67,7 @@ The following API resources are available in the project context:
 | [Search](search.md)                                                 | `/projects/:id/search` (also available for groups and standalone)                                                                                                                                     |
 | [Services](services.md)                                             | `/projects/:id/services`                                                                                                                                                                              |
 | [Tags](tags.md)                                                     | `/projects/:id/repository/tags`                                                                                                                                                                       |
-| [Vulnerabilities](vulnerabilities.md) **(ULTIMATE)**                | `/projects/:id/vulnerabilities` (also available for groups)                                                                                                                                           |
+| [Vulnerabilities](vulnerabilities.md) **(ULTIMATE)**                | `/projects/:id/vulnerabilities`
 | [Wikis](wikis.md)                                                   | `/projects/:id/wikis`                                                                                                                                                                                 |
 
 ## Group resources
-- 
cgit v1.2.1


From 2aac2e828b6d69cd8831d9091961b04842badfdb Mon Sep 17 00:00:00 2001
From: Felipe Artur <felipefac@gmail.com>
Date: Mon, 19 Aug 2019 15:40:58 -0300
Subject: Uncomment get_commit_signatures feature flag

---
 lib/feature/gitaly.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/feature/gitaly.rb b/lib/feature/gitaly.rb
index 9ded1aed4e3..edfd2fb17f3 100644
--- a/lib/feature/gitaly.rb
+++ b/lib/feature/gitaly.rb
@@ -7,7 +7,7 @@ class Feature
     # Server feature flags should use '_' to separate words.
     SERVER_FEATURE_FLAGS =
       [
-        # 'get_commit_signatures'.freeze
+        'get_commit_signatures'.freeze
       ].freeze
 
     DEFAULT_ON_FLAGS = Set.new([]).freeze
-- 
cgit v1.2.1


From 44ca24f4f25c022904d3dc8641ddf1cf10fe8fae Mon Sep 17 00:00:00 2001
From: Markus Koller <mkoller@gitlab.com>
Date: Mon, 19 Aug 2019 20:55:56 +0200
Subject: Fix outdated references to soft deletion

We stopped using soft deletion for issues and merge requests in
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/15789,
and for boards we apparently never used it.
---
 doc/api/boards.md         | 2 +-
 doc/api/group_boards.md   | 2 +-
 doc/api/issues.md         | 2 +-
 doc/api/merge_requests.md | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/api/boards.md b/doc/api/boards.md
index 08ec1d832df..b848d7788cd 100644
--- a/doc/api/boards.md
+++ b/doc/api/boards.md
@@ -466,7 +466,7 @@ Example response:
 
 ## Delete a board list
 
-Only for admins and project owners. Soft deletes the board list in question.
+Only for admins and project owners. Deletes the board list in question.
 
 ```
 DELETE /projects/:id/boards/:board_id/lists/:list_id
diff --git a/doc/api/group_boards.md b/doc/api/group_boards.md
index 4d10f83720b..99b522a7ae9 100644
--- a/doc/api/group_boards.md
+++ b/doc/api/group_boards.md
@@ -536,7 +536,7 @@ Example response:
 
 ## Delete a group issue board list
 
-Only for admins and group owners. Soft deletes the board list in question.
+Only for admins and group owners. Deletes the board list in question.
 
 ```
 DELETE /groups/:id/boards/:board_id/lists/:list_id
diff --git a/doc/api/issues.md b/doc/api/issues.md
index 96a547551f1..ebb1ebb6815 100644
--- a/doc/api/issues.md
+++ b/doc/api/issues.md
@@ -790,7 +790,7 @@ the `weight` parameter:
 
 ## Delete an issue
 
-Only for admins and project owners. Soft deletes the issue in question.
+Only for admins and project owners. Deletes the issue in question.
 
 ```
 DELETE /projects/:id/issues/:issue_iid
diff --git a/doc/api/merge_requests.md b/doc/api/merge_requests.md
index 1ade46efb1c..49ed4968b0d 100644
--- a/doc/api/merge_requests.md
+++ b/doc/api/merge_requests.md
@@ -1127,7 +1127,7 @@ the `approvals_before_merge` parameter:
 
 ## Delete a merge request
 
-Only for admins and project owners. Soft deletes the merge request in question.
+Only for admins and project owners. Deletes the merge request in question.
 
 ```
 DELETE /projects/:id/merge_requests/:merge_request_iid
-- 
cgit v1.2.1


From ae7f5faf675848cd561687548757cee6e647ab14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matija=20=C4=8Cupi=C4=87?= <matteeyah@gmail.com>
Date: Mon, 19 Aug 2019 17:28:20 +0200
Subject: Improve nplusone spec for PipelinesController#show

---
 spec/controllers/projects/pipelines_controller_spec.rb | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/spec/controllers/projects/pipelines_controller_spec.rb b/spec/controllers/projects/pipelines_controller_spec.rb
index 9a50ea79f5e..089d06e11eb 100644
--- a/spec/controllers/projects/pipelines_controller_spec.rb
+++ b/spec/controllers/projects/pipelines_controller_spec.rb
@@ -177,18 +177,22 @@ describe Projects::PipelinesController do
       end
 
       it 'does not perform N + 1 queries' do
+        # Set up all required variables
+        get_pipeline_json
+
         control_count = ActiveRecord::QueryRecorder.new { get_pipeline_json }.count
 
-        create_build('test', 1, 'rspec 1')
-        create_build('test', 1, 'spinach 0')
-        create_build('test', 1, 'spinach 1')
-        create_build('test', 1, 'audit')
-        create_build('post deploy', 3, 'pages 1')
-        create_build('post deploy', 3, 'pages 2')
+        first_build = pipeline.builds.first
+        first_build.tag_list << [:hello, :world]
+        create(:deployment, deployable: first_build)
+
+        second_build = pipeline.builds.second
+        second_build.tag_list << [:docker, :ruby]
+        create(:deployment, deployable: second_build)
 
         new_count = ActiveRecord::QueryRecorder.new { get_pipeline_json }.count
 
-        expect(new_count).to be_within(12).of(control_count)
+        expect(new_count).to be_within(1).of(control_count)
       end
     end
 
-- 
cgit v1.2.1


From a59c9a137eb0a141bebdd0fffcb2e14fab54c4b5 Mon Sep 17 00:00:00 2001
From: jakeburden <jburden@gitlab.com>
Date: Mon, 19 Aug 2019 15:02:36 -0400
Subject: Mark detached tooltip for translation

---
 app/views/projects/pipelines/_info.html.haml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/projects/pipelines/_info.html.haml b/app/views/projects/pipelines/_info.html.haml
index 862dc394315..9614f33fe2f 100644
--- a/app/views/projects/pipelines/_info.html.haml
+++ b/app/views/projects/pipelines/_info.html.haml
@@ -43,7 +43,7 @@
       } }
         Auto DevOps
     - if @pipeline.detached_merge_request_pipeline?
-      %span.js-pipeline-url-mergerequest.badge.badge-info.has-tooltip{ title: "Pipelines for merge requests are configured. A detached pipeline runs in the context of the merge request, and not against the merged result. Learn more on the documentation for Pipelines for Merged Results." }
+      %span.js-pipeline-url-mergerequest.badge.badge-info.has-tooltip{ title: _('Pipelines for merge requests are configured. A detached pipeline runs in the context of the merge request, and not against the merged result. Learn more on the documentation for Pipelines for Merged Results.') }
         detached
     - if @pipeline.stuck?
       %span.js-pipeline-url-stuck.badge.badge-warning
-- 
cgit v1.2.1


From 6eb39e59ab433589c190838dfa31d8df6ba6a0d6 Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Mon, 19 Aug 2019 19:12:36 +0000
Subject: [CE] Add hooks to sync dev info to Jira using Connect App

---
 config/sidekiq_queues.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/sidekiq_queues.yml b/config/sidekiq_queues.yml
index c7586aa1e38..ea165508d29 100644
--- a/config/sidekiq_queues.yml
+++ b/config/sidekiq_queues.yml
@@ -113,3 +113,4 @@
   - [elastic_namespace_indexer, 1]
   - [export_csv, 1]
   - [incident_management, 2]
+  - [jira_connect, 1]
-- 
cgit v1.2.1


From bf1f3e1d2ee62b8057407215adcc157069df609f Mon Sep 17 00:00:00 2001
From: Illya Klymov <xanf@xanf.me>
Date: Fri, 16 Aug 2019 13:42:27 +0300
Subject: Remove obsolete CSS and fix icon alignment

---
 app/assets/stylesheets/pages/reports.scss    | 5 -----
 changelogs/unreleased/clean-obsolete-css.yml | 5 +++++
 2 files changed, 5 insertions(+), 5 deletions(-)
 create mode 100644 changelogs/unreleased/clean-obsolete-css.yml

diff --git a/app/assets/stylesheets/pages/reports.scss b/app/assets/stylesheets/pages/reports.scss
index 85e9f303dde..0fbf7033aa5 100644
--- a/app/assets/stylesheets/pages/reports.scss
+++ b/app/assets/stylesheets/pages/reports.scss
@@ -48,11 +48,6 @@
     padding: $gl-padding-top $gl-padding;
     border-top: 1px solid $border-color;
   }
-
-  .report-block-list-icon .loading-container {
-    position: relative;
-    left: -2px;
-  }
 }
 
 .report-block-container {
diff --git a/changelogs/unreleased/clean-obsolete-css.yml b/changelogs/unreleased/clean-obsolete-css.yml
new file mode 100644
index 00000000000..d9716d16762
--- /dev/null
+++ b/changelogs/unreleased/clean-obsolete-css.yml
@@ -0,0 +1,5 @@
+---
+title: Fix MR reports section loading icon alignment
+merge_request: 31897
+author:
+type: fixed
-- 
cgit v1.2.1


From 2067f677df69200338d8d2b78f239759fc293fee Mon Sep 17 00:00:00 2001
From: Douglas Barbosa Alexandre <dbalexandre@gmail.com>
Date: Mon, 19 Aug 2019 17:33:07 -0300
Subject: Fix N+1s queries while loading users

---
 app/controllers/projects/starrers_controller.rb       |  4 ++--
 app/models/users_star_project.rb                      |  1 +
 spec/controllers/projects/starrers_controller_spec.rb | 14 ++++++++++++++
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/app/controllers/projects/starrers_controller.rb b/app/controllers/projects/starrers_controller.rb
index e4093bed0ef..4efe956e973 100644
--- a/app/controllers/projects/starrers_controller.rb
+++ b/app/controllers/projects/starrers_controller.rb
@@ -5,11 +5,11 @@ class Projects::StarrersController < Projects::ApplicationController
 
   def index
     @starrers = UsersStarProjectsFinder.new(@project, params, current_user: @current_user).execute
+    @sort = params[:sort].presence || sort_value_name
+    @starrers = @starrers.preload_users.sort_by_attribute(@sort).page(params[:page])
     @public_count  = @project.starrers.with_public_profile.size
     @total_count   = @project.starrers.size
     @private_count = @total_count - @public_count
-    @sort = params[:sort].presence || sort_value_name
-    @starrers = @starrers.sort_by_attribute(@sort).page(params[:page])
   end
 
   private
diff --git a/app/models/users_star_project.rb b/app/models/users_star_project.rb
index 3c7a805cc5c..c633e2d8b3d 100644
--- a/app/models/users_star_project.rb
+++ b/app/models/users_star_project.rb
@@ -17,6 +17,7 @@ class UsersStarProject < ApplicationRecord
   scope :by_project, -> (project) { where(project_id: project.id) }
   scope :with_visible_profile, -> (user) { joins(:user).merge(User.with_visible_profile(user)) }
   scope :with_public_profile, -> { joins(:user).merge(User.with_public_profile) }
+  scope :preload_users, -> { preload(:user) }
 
   class << self
     def sort_by_attribute(method)
diff --git a/spec/controllers/projects/starrers_controller_spec.rb b/spec/controllers/projects/starrers_controller_spec.rb
index 7085cba08d5..5774ff7c576 100644
--- a/spec/controllers/projects/starrers_controller_spec.rb
+++ b/spec/controllers/projects/starrers_controller_spec.rb
@@ -32,6 +32,20 @@ describe Projects::StarrersController do
       end
     end
 
+    context 'N+1 queries' do
+      render_views
+
+      it 'avoids N+1s loading users', :request_store do
+        get_starrers
+
+        control_count = ActiveRecord::QueryRecorder.new { get_starrers }.count
+
+        create_list(:user, 5).each { |user| user.toggle_star(project) }
+
+        expect { get_starrers }.not_to exceed_query_limit(control_count)
+      end
+    end
+
     context 'when project is public' do
       before do
         project.update_attribute(:visibility_level, Project::PUBLIC)
-- 
cgit v1.2.1


From 99897d41fc0ba99d5be46ab2787df3279b1ce81b Mon Sep 17 00:00:00 2001
From: Illya Klymov <xanf@xanf.me>
Date: Fri, 16 Aug 2019 05:52:15 +0300
Subject: Update file row styling

---
 app/assets/javascripts/vue_shared/components/file_row.vue | 8 ++------
 changelogs/unreleased/fix-file-row-styling.yml            | 5 +++++
 2 files changed, 7 insertions(+), 6 deletions(-)
 create mode 100644 changelogs/unreleased/fix-file-row-styling.yml

diff --git a/app/assets/javascripts/vue_shared/components/file_row.vue b/app/assets/javascripts/vue_shared/components/file_row.vue
index fe5289ff371..f49e69c473b 100644
--- a/app/assets/javascripts/vue_shared/components/file_row.vue
+++ b/app/assets/javascripts/vue_shared/components/file_row.vue
@@ -146,6 +146,7 @@ export default {
         <span ref="textOutput" :style="levelIndentation" class="file-row-name str-truncated">
           <file-icon
             v-if="!showChangedIcon || file.type === 'tree'"
+            class="file-row-icon"
             :file-name="file.name"
             :loading="file.loading"
             :folder="isTree"
@@ -223,13 +224,8 @@ export default {
   white-space: nowrap;
 }
 
-.file-row-name svg {
+.file-row-name .file-row-icon {
   margin-right: 2px;
   vertical-align: middle;
 }
-
-.file-row-name .loading-container {
-  display: inline-block;
-  margin-right: 4px;
-}
 </style>
diff --git a/changelogs/unreleased/fix-file-row-styling.yml b/changelogs/unreleased/fix-file-row-styling.yml
new file mode 100644
index 00000000000..a4427fdd48f
--- /dev/null
+++ b/changelogs/unreleased/fix-file-row-styling.yml
@@ -0,0 +1,5 @@
+---
+title: Fix loading icon causing text to jump in file row of Web IDE
+merge_request: 31884
+author:
+type: fixed
-- 
cgit v1.2.1


From 2cbcab467962df8ee1bad63927c7c46b78cedd37 Mon Sep 17 00:00:00 2001
From: Alex Kalderimis <akalderimis@gitlab.com>
Date: Mon, 19 Aug 2019 23:06:21 +0000
Subject: Add support for sentry_extra_data in exceptions

This allows exceptions to advertise their support for sentry
and provide structured data.
---
 lib/gitlab/sentry.rb           | 17 ++++++++++++++++-
 spec/lib/gitlab/sentry_spec.rb | 29 +++++++++++++++++++++++++++--
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/lib/gitlab/sentry.rb b/lib/gitlab/sentry.rb
index 764db14d720..005cb3112b8 100644
--- a/lib/gitlab/sentry.rb
+++ b/lib/gitlab/sentry.rb
@@ -39,9 +39,14 @@ module Gitlab
     # development and test. If you need development and test to behave
     # just the same as production you can use this instead of
     # track_exception.
+    #
+    # If the exception implements the method `sentry_extra_data` and that method
+    # returns a Hash, then the return value of that method will be merged into
+    # `extra`. Exceptions can use this mechanism to provide structured data
+    # to sentry in addition to their message and back-trace.
     def self.track_acceptable_exception(exception, issue_url: nil, extra: {})
       if enabled?
-        extra[:issue_url] = issue_url if issue_url
+        extra = build_extra_data(exception, issue_url, extra)
         context # Make sure we've set everything we know in the context
 
         Raven.capture_exception(exception, tags: default_tags, extra: extra)
@@ -58,5 +63,15 @@ module Gitlab
         locale: I18n.locale
       }
     end
+
+    def self.build_extra_data(exception, issue_url, extra)
+      exception.try(:sentry_extra_data)&.tap do |data|
+        extra.merge!(data) if data.is_a?(Hash)
+      end
+
+      extra.merge({ issue_url: issue_url }.compact)
+    end
+
+    private_class_method :build_extra_data
   end
 end
diff --git a/spec/lib/gitlab/sentry_spec.rb b/spec/lib/gitlab/sentry_spec.rb
index af8b059b984..a48cc0d128a 100644
--- a/spec/lib/gitlab/sentry_spec.rb
+++ b/spec/lib/gitlab/sentry_spec.rb
@@ -65,6 +65,7 @@ describe Gitlab::Sentry do
 
   context '.track_acceptable_exception' do
     let(:exception) { RuntimeError.new('boom') }
+    let(:issue_url) { 'http://gitlab.com/gitlab-org/gitlab-ce/issues/1' }
 
     before do
       allow(described_class).to receive(:enabled?).and_return(true)
@@ -74,7 +75,7 @@ describe Gitlab::Sentry do
     it 'calls Raven.capture_exception' do
       expected_extras = {
         some_other_info: 'info',
-        issue_url: 'http://gitlab.com/gitlab-org/gitlab-ce/issues/1'
+        issue_url: issue_url
       }
 
       expected_tags = {
@@ -88,9 +89,33 @@ describe Gitlab::Sentry do
 
       described_class.track_acceptable_exception(
         exception,
-        issue_url: 'http://gitlab.com/gitlab-org/gitlab-ce/issues/1',
+        issue_url: issue_url,
         extra: { some_other_info: 'info' }
       )
     end
+
+    context 'the exception implements :sentry_extra_data' do
+      let(:extra_info) { { event: 'explosion', size: :massive } }
+      let(:exception) { double(message: 'bang!', sentry_extra_data: extra_info) }
+
+      it 'includes the extra data from the exception in the tracking information' do
+        expect(Raven).to receive(:capture_exception)
+          .with(exception, a_hash_including(extra: a_hash_including(extra_info)))
+
+        described_class.track_acceptable_exception(exception)
+      end
+    end
+
+    context 'the exception implements :sentry_extra_data, which returns nil' do
+      let(:exception) { double(message: 'bang!', sentry_extra_data: nil) }
+
+      it 'just includes the other extra info' do
+        extra_info = { issue_url: issue_url }
+        expect(Raven).to receive(:capture_exception)
+          .with(exception, a_hash_including(extra: a_hash_including(extra_info)))
+
+        described_class.track_acceptable_exception(exception, extra_info)
+      end
+    end
   end
 end
-- 
cgit v1.2.1


From 3bc0a1185cdaa50c9cf8b2ffb30cd89442f8b2bc Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Mon, 19 Aug 2019 23:41:23 +0000
Subject: Standardize markdown in dev and workflow

Delete trailing whitespace, fix blockquotes, fix note
boxes, with indentation, clean up tables, etc.
---
 doc/development/fe_guide/axios.md                  |   2 +-
 doc/development/fe_guide/style_guide_js.md         | 522 ++++++++++-----------
 doc/development/fe_guide/vuex.md                   |   2 +-
 doc/development/interacting_components.md          |   4 +-
 .../new_fe_guide/modules/dirty_submit.md           |   9 +-
 doc/development/new_fe_guide/style/javascript.md   |   2 +-
 doc/development/shell_scripting_guide/index.md     |   9 +-
 doc/development/testing_guide/review_apps.md       |   4 +-
 doc/workflow/lfs/lfs_administration.md             |  41 +-
 .../lfs/manage_large_binaries_with_git_lfs.md      |  27 +-
 .../lfs/migrate_from_git_annex_to_git_lfs.md       |   2 +-
 doc/workflow/repository_mirroring.md               |  31 +-
 doc/workflow/todos.md                              |   4 +-
 13 files changed, 331 insertions(+), 328 deletions(-)

diff --git a/doc/development/fe_guide/axios.md b/doc/development/fe_guide/axios.md
index 09b4a3c3d96..6e7cf523f36 100644
--- a/doc/development/fe_guide/axios.md
+++ b/doc/development/fe_guide/axios.md
@@ -38,7 +38,7 @@ Advantages over [`spyOn()`]:
 
 - no need to create response objects
 - does not allow call through (which we want to avoid)
-- simple API to test error cases 
+- simple API to test error cases
 - provides `replyOnce()` to allow for different responses
 
 We have also decided against using [axios interceptors] because they are not suitable for mocking.
diff --git a/doc/development/fe_guide/style_guide_js.md b/doc/development/fe_guide/style_guide_js.md
index d3fa350b847..125b11afcd0 100644
--- a/doc/development/fe_guide/style_guide_js.md
+++ b/doc/development/fe_guide/style_guide_js.md
@@ -21,31 +21,31 @@ See [our current .eslintrc](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/
 1. **Never Ever EVER** disable eslint globally for a file
 
    ```javascript
-     // bad
-     /* eslint-disable */
+   // bad
+   /* eslint-disable */
 
-     // better
-     /* eslint-disable some-rule, some-other-rule */
+   // better
+   /* eslint-disable some-rule, some-other-rule */
 
-     // best
-     // nothing :)
+   // best
+   // nothing :)
    ```
 
 1. If you do need to disable a rule for a single violation, try to do it as locally as possible
 
    ```javascript
-     // bad
-     /* eslint-disable no-new */
+   // bad
+   /* eslint-disable no-new */
 
-     import Foo from 'foo';
+   import Foo from 'foo';
 
-     new Foo();
+   new Foo();
 
-     // better
-     import Foo from 'foo';
+   // better
+   import Foo from 'foo';
 
-     // eslint-disable-next-line no-new
-     new Foo();
+   // eslint-disable-next-line no-new
+   new Foo();
    ```
 
 1. There are few rules that we need to disable due to technical debt. Which are:
@@ -56,16 +56,16 @@ See [our current .eslintrc](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/
    followed by any global declarations, then a blank newline prior to any imports or code.
 
    ```javascript
-     // bad
-     /* global Foo */
-     /* eslint-disable no-new */
-     import Bar from './bar';
+   // bad
+   /* global Foo */
+   /* eslint-disable no-new */
+   import Bar from './bar';
 
-     // good
-     /* eslint-disable no-new */
-     /* global Foo */
+   // good
+   /* eslint-disable no-new */
+   /* global Foo */
 
-     import Bar from './bar';
+   import Bar from './bar';
    ```
 
 1. **Never** disable the `no-undef` rule. Declare globals with `/* global Foo */` instead.
@@ -73,23 +73,23 @@ See [our current .eslintrc](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/
 1. When declaring multiple globals, always use one `/* global [name] */` line per variable.
 
    ```javascript
-     // bad
-     /* globals Flash, Cookies, jQuery */
+   // bad
+   /* globals Flash, Cookies, jQuery */
 
-     // good
-     /* global Flash */
-     /* global Cookies */
-     /* global jQuery */
+   // good
+   /* global Flash */
+   /* global Cookies */
+   /* global jQuery */
    ```
 
 1. Use up to 3 parameters for a function or class. If you need more accept an Object instead.
 
    ```javascript
-     // bad
-     fn(p1, p2, p3, p4) {}
+   // bad
+   fn(p1, p2, p3, p4) {}
 
-     // good
-     fn(options) {}
+   // good
+   fn(options) {}
    ```
 
 #### Modules, Imports, and Exports
@@ -97,32 +97,32 @@ See [our current .eslintrc](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/
 1. Use ES module syntax to import modules
 
    ```javascript
-     // bad
-     const SomeClass = require('some_class');
+   // bad
+   const SomeClass = require('some_class');
 
-     // good
-     import SomeClass from 'some_class';
+   // good
+   import SomeClass from 'some_class';
 
-     // bad
-     module.exports = SomeClass;
+   // bad
+   module.exports = SomeClass;
 
-     // good
-     export default SomeClass;
+   // good
+   export default SomeClass;
    ```
 
    Import statements are following usual naming guidelines, for example object literals use camel case:
 
    ```javascript
-     // some_object file
-     export default {
-       key: 'value',
-     };
+   // some_object file
+   export default {
+     key: 'value',
+   };
 
-     // bad
-     import ObjectLiteral from 'some_object';
+   // bad
+   import ObjectLiteral from 'some_object';
 
-     // good
-     import objectLiteral from 'some_object';
+   // good
+   import objectLiteral from 'some_object';
    ```
 
 1. Relative paths: when importing a module in the same directory, a child
@@ -171,22 +171,22 @@ See [our current .eslintrc](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/
 1. Avoid adding to the global namespace.
 
    ```javascript
-     // bad
-     window.MyClass = class { /* ... */ };
+   // bad
+   window.MyClass = class { /* ... */ };
 
-     // good
-     export default class MyClass { /* ... */ }
+   // good
+   export default class MyClass { /* ... */ }
    ```
 
 1. Side effects are forbidden in any script which contains export
 
    ```javascript
-     // bad
-     export default class MyClass { /* ... */ }
+   // bad
+   export default class MyClass { /* ... */ }
 
-     document.addEventListener("DOMContentLoaded", function(event) {
-       new MyClass();
-     }
+   document.addEventListener("DOMContentLoaded", function(event) {
+     new MyClass();
+   }
    ```
 
 #### Data Mutation and Pure functions
@@ -257,17 +257,17 @@ See [our current .eslintrc](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/
    `.reduce` or `.filter`
 
    ```javascript
-     const users = [ { name: 'Foo' }, { name: 'Bar' } ];
+   const users = [ { name: 'Foo' }, { name: 'Bar' } ];
 
-     // bad
-     users.forEach((user, index) => {
-       user.id = index;
-     });
+   // bad
+   users.forEach((user, index) => {
+     user.id = index;
+   });
 
-     // good
-     const usersWithId = users.map((user, index) => {
-       return Object.assign({}, user, { id: index });
-     });
+   // good
+   const usersWithId = users.map((user, index) => {
+     return Object.assign({}, user, { id: index });
+   });
    ```
 
 #### Parse Strings into Numbers
@@ -275,14 +275,14 @@ See [our current .eslintrc](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/
 1. `parseInt()` is preferable over `Number()` or `+`
 
    ```javascript
-     // bad
-     +'10' // 10
+   // bad
+   +'10' // 10
 
-     // good
-     Number('10') // 10
+   // good
+   Number('10') // 10
 
-     // better
-     parseInt('10', 10);
+   // better
+   parseInt('10', 10);
    ```
 
 #### CSS classes used for JavaScript
@@ -290,15 +290,15 @@ See [our current .eslintrc](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/
 1. If the class is being used in Javascript it needs to be prepend with `js-`
 
    ```html
-     // bad
-     <button class="add-user">
-       Add User
-     </button>
+   // bad
+   <button class="add-user">
+     Add User
+   </button>
 
-     // good
-     <button class="js-add-user">
-       Add User
-     </button>
+   // good
+   <button class="js-add-user">
+     Add User
+   </button>
    ```
 
 ### Vue.js
@@ -315,41 +315,41 @@ Please check this [rules][eslint-plugin-vue-rules] for more documentation.
 1. Use a function in the bundle file to instantiate the Vue component:
 
    ```javascript
-     // bad
-     class {
-       init() {
-         new Component({})
-       }
+   // bad
+   class {
+     init() {
+       new Component({})
      }
+   }
 
-     // good
-     document.addEventListener('DOMContentLoaded', () => new Vue({
-       el: '#element',
-       components: {
-         componentName
-       },
-       render: createElement => createElement('component-name'),
-     }));
+   // good
+   document.addEventListener('DOMContentLoaded', () => new Vue({
+     el: '#element',
+     components: {
+       componentName
+     },
+     render: createElement => createElement('component-name'),
+   }));
    ```
 
 1. Do not use a singleton for the service or the store
 
    ```javascript
-     // bad
-     class Store {
-       constructor() {
-         if (!this.prototype.singleton) {
-           // do something
-         }
+   // bad
+   class Store {
+     constructor() {
+       if (!this.prototype.singleton) {
+         // do something
        }
      }
+   }
 
-     // good
-     class Store {
-       constructor() {
-         // do something
-       }
+   // good
+   class Store {
+     constructor() {
+       // do something
      }
+   }
    ```
 
 1. Use `.vue` for Vue templates. Do not use `%template` in HAML.
@@ -360,36 +360,36 @@ Please check this [rules][eslint-plugin-vue-rules] for more documentation.
 1. **Reference Naming**: Use PascalCase for their instances:
 
    ```javascript
-     // bad
-     import cardBoard from 'cardBoard.vue'
+   // bad
+   import cardBoard from 'cardBoard.vue'
 
-     components: {
-       cardBoard,
-     };
+   components: {
+     cardBoard,
+   };
 
-     // good
-     import CardBoard from 'cardBoard.vue'
+   // good
+   import CardBoard from 'cardBoard.vue'
 
-     components: {
-       CardBoard,
-     };
+   components: {
+     CardBoard,
+   };
    ```
 
 1. **Props Naming:**  Avoid using DOM component prop names.
 1. **Props Naming:** Use kebab-case instead of camelCase to provide props in templates.
 
    ```javascript
-     // bad
-     <component class="btn">
+   // bad
+   <component class="btn">
 
-     // good
-     <component css-class="btn">
+   // good
+   <component css-class="btn">
 
-     // bad
-     <component myProp="prop" />
+   // bad
+   <component myProp="prop" />
 
-     // good
-     <component my-prop="prop" />
+   // good
+   <component my-prop="prop" />
    ```
 
 [#34371]: https://gitlab.com/gitlab-org/gitlab-ce/issues/34371
@@ -401,37 +401,37 @@ Please check this [rules][eslint-plugin-vue-rules] for more documentation.
    1. With more than one attribute, all attributes should be on a new line:
 
       ```javascript
-        // bad
-        <component v-if="bar"
-            param="baz" />
+      // bad
+      <component v-if="bar"
+          param="baz" />
 
-        <button class="btn">Click me</button>
+      <button class="btn">Click me</button>
 
-        // good
-        <component
-          v-if="bar"
-          param="baz"
-        />
+      // good
+      <component
+        v-if="bar"
+        param="baz"
+      />
 
-        <button class="btn">
-          Click me
-        </button>
+      <button class="btn">
+        Click me
+      </button>
       ```
 
    1. The tag can be inline if there is only one attribute:
 
       ```javascript
-        // good
-          <component bar="bar" />
+      // good
+        <component bar="bar" />
 
-        // good
-          <component
-            bar="bar"
-            />
+      // good
+        <component
+          bar="bar"
+          />
 
-        // bad
-         <component
-            bar="bar" />
+      // bad
+       <component
+          bar="bar" />
       ```
 
 #### Quotes
@@ -439,15 +439,15 @@ Please check this [rules][eslint-plugin-vue-rules] for more documentation.
 1. Always use double quotes `"` inside templates and single quotes `'` for all other JS.
 
    ```javascript
-     // bad
-     template: `
-       <button :class='style'>Button</button>
-     `
+   // bad
+   template: `
+     <button :class='style'>Button</button>
+   `
 
-     // good
-     template: `
-       <button :class="style">Button</button>
-     `
+   // good
+   template: `
+     <button :class="style">Button</button>
+   `
    ```
 
 #### Props
@@ -455,37 +455,37 @@ Please check this [rules][eslint-plugin-vue-rules] for more documentation.
 1. Props should be declared as an object
 
    ```javascript
-     // bad
-     props: ['foo']
-
-     // good
-     props: {
-       foo: {
-         type: String,
-         required: false,
-         default: 'bar'
-       }
+   // bad
+   props: ['foo']
+
+   // good
+   props: {
+     foo: {
+       type: String,
+       required: false,
+       default: 'bar'
      }
+   }
    ```
 
 1. Required key should always be provided when declaring a prop
 
    ```javascript
-     // bad
-     props: {
-       foo: {
-         type: String,
-       }
+   // bad
+   props: {
+     foo: {
+       type: String,
      }
+   }
 
-     // good
-     props: {
-       foo: {
-         type: String,
-         required: false,
-         default: 'bar'
-       }
+   // good
+   props: {
+     foo: {
+       type: String,
+       required: false,
+       default: 'bar'
      }
+   }
    ```
 
 1. Default key should be provided if the prop is not required.
@@ -493,30 +493,30 @@ Please check this [rules][eslint-plugin-vue-rules] for more documentation.
    On those a default key should not be provided.
 
    ```javascript
-     // good
-     props: {
-       foo: {
-         type: String,
-         required: false,
-       }
+   // good
+   props: {
+     foo: {
+       type: String,
+       required: false,
      }
+   }
 
-     // good
-     props: {
-       foo: {
-         type: String,
-         required: false,
-         default: 'bar'
-       }
+   // good
+   props: {
+     foo: {
+       type: String,
+       required: false,
+       default: 'bar'
      }
+   }
 
-     // good
-     props: {
-       foo: {
-         type: String,
-         required: true
-       }
+   // good
+   props: {
+     foo: {
+       type: String,
+       required: true
      }
+   }
    ```
 
 #### Data
@@ -524,17 +524,17 @@ Please check this [rules][eslint-plugin-vue-rules] for more documentation.
 1. `data` method should always be a function
 
    ```javascript
-     // bad
-     data: {
-       foo: 'foo'
-     }
+   // bad
+   data: {
+     foo: 'foo'
+   }
 
-     // good
-     data() {
-       return {
-         foo: 'foo'
-       };
-     }
+   // good
+   data() {
+     return {
+       foo: 'foo'
+     };
+   }
    ```
 
 #### Directives
@@ -542,31 +542,31 @@ Please check this [rules][eslint-plugin-vue-rules] for more documentation.
 1. Shorthand `@` is preferable over `v-on`
 
    ```javascript
-     // bad
-     <component v-on:click="eventHandler"/>
+   // bad
+   <component v-on:click="eventHandler"/>
 
-     // good
-     <component @click="eventHandler"/>
+   // good
+   <component @click="eventHandler"/>
    ```
 
 1. Shorthand `:` is preferable over `v-bind`
 
    ```javascript
-     // bad
-     <component v-bind:class="btn"/>
+   // bad
+   <component v-bind:class="btn"/>
 
-     // good
-     <component :class="btn"/>
+   // good
+   <component :class="btn"/>
    ```
 
 1. Shorthand `#` is preferable over `v-slot`
 
    ```javascript
-     // bad
-     <template v-slot:header></template>
+   // bad
+   <template v-slot:header></template>
 
-     // good
-     <template #header></template>
+   // good
+   <template #header></template>
    ```
 
 #### Closing tags
@@ -574,11 +574,11 @@ Please check this [rules][eslint-plugin-vue-rules] for more documentation.
 1. Prefer self closing component tags
 
    ```javascript
-     // bad
-     <component></component>
+   // bad
+   <component></component>
 
-     // good
-     <component />
+   // good
+   <component />
    ```
 
 #### Ordering
@@ -610,48 +610,48 @@ When using `v-for` you need to provide a *unique* `:key` attribute for each item
 1. If the elements of the array being iterated have an unique `id` it is advised to use it:
 
    ```html
-     <div
-       v-for="item in items"
-       :key="item.id"
-     >
-       <!-- content -->
-     </div>
+   <div
+     v-for="item in items"
+     :key="item.id"
+   >
+     <!-- content -->
+   </div>
    ```
 
 1. When the elements being iterated don't have a unique id, you can use the array index as the `:key` attribute
 
    ```html
-     <div
-       v-for="(item, index) in items"
-       :key="index"
-     >
-       <!-- content -->
-     </div>
+   <div
+     v-for="(item, index) in items"
+     :key="index"
+   >
+     <!-- content -->
+   </div>
    ```
 
 1. When using `v-for` with `template` and there is more than one child element, the `:key` values must be unique. It's advised to use `kebab-case` namespaces.
 
    ```html
-     <template v-for="(item, index) in items">
-       <span :key="`span-${index}`"></span>
-       <button :key="`button-${index}`"></button>
-     </template>
+   <template v-for="(item, index) in items">
+     <span :key="`span-${index}`"></span>
+     <button :key="`button-${index}`"></button>
+   </template>
    ```
 
 1. When dealing with nested `v-for` use the same guidelines as above.
 
    ```html
-     <div
-       v-for="item in items"
-       :key="item.id"
+   <div
+     v-for="item in items"
+     :key="item.id"
+   >
+     <span
+       v-for="element in array"
+       :key="element.id"
      >
-       <span
-         v-for="element in array"
-         :key="element.id"
-       >
-         <!-- content -->
-       </span>
-     </div>
+       <!-- content -->
+     </span>
+   </div>
    ```
 
 Useful links:
@@ -664,19 +664,19 @@ Useful links:
 1. Tooltips: Do not rely on `has-tooltip` class name for Vue components
 
    ```javascript
-     // bad
-     <span
-       class="has-tooltip"
-       title="Some tooltip text">
-       Text
-     </span>
+   // bad
+   <span
+     class="has-tooltip"
+     title="Some tooltip text">
+     Text
+   </span>
 
-     // good
-     <span
-       v-tooltip
-       title="Some tooltip text">
-       Text
-     </span>
+   // good
+   <span
+     v-tooltip
+     title="Some tooltip text">
+     Text
+   </span>
    ```
 
 1. Tooltips: When using a tooltip, include the tooltip directive, `./app/assets/javascripts/vue_shared/directives/tooltip.js`
@@ -684,13 +684,13 @@ Useful links:
 1. Don't change `data-original-title`.
 
    ```javascript
-     // bad
-     <span data-original-title="tooltip text">Foo</span>
+   // bad
+   <span data-original-title="tooltip text">Foo</span>
 
-     // good
-     <span title="tooltip text">Foo</span>
+   // good
+   <span title="tooltip text">Foo</span>
 
-     $('span').tooltip('_fixTitle');
+   $('span').tooltip('_fixTitle');
    ```
 
 ### The Javascript/Vue Accord
diff --git a/doc/development/fe_guide/vuex.md b/doc/development/fe_guide/vuex.md
index 9eeaee4482f..557d3132d71 100644
--- a/doc/development/fe_guide/vuex.md
+++ b/doc/development/fe_guide/vuex.md
@@ -313,7 +313,7 @@ export default {
 
 1. Do not call a mutation directly. Always use an action to commit a mutation. Doing so will keep consistency throughout the application. From Vuex docs:
 
-   >  why don't we just call store.commit('action') directly? Well, remember that mutations must be synchronous? Actions aren't. We can perform asynchronous operations inside an action.
+   > Why don't we just call store.commit('action') directly? Well, remember that mutations must be synchronous? Actions aren't. We can perform asynchronous operations inside an action.
 
    ```javascript
      // component.vue
diff --git a/doc/development/interacting_components.md b/doc/development/interacting_components.md
index 74d52d808e2..5e6dc8d460a 100644
--- a/doc/development/interacting_components.md
+++ b/doc/development/interacting_components.md
@@ -9,8 +9,8 @@ when making _backend_ changes that might involve multiple features or [component
 
 ## Uploads
 
-GitLab supports uploads to [object storage]. That means every feature and 
-change that affects uploads should also be tested against [object storage], 
+GitLab supports uploads to [object storage]. That means every feature and
+change that affects uploads should also be tested against [object storage],
 which is _not_ enabled by default in [GDK](https://gitlab.com/gitlab-org/gitlab-development-kit).
 
 When working on a related feature, make sure to enable and test it
diff --git a/doc/development/new_fe_guide/modules/dirty_submit.md b/doc/development/new_fe_guide/modules/dirty_submit.md
index 6c03958b463..217743ea395 100644
--- a/doc/development/new_fe_guide/modules/dirty_submit.md
+++ b/doc/development/new_fe_guide/modules/dirty_submit.md
@@ -1,7 +1,6 @@
 # Dirty Submit
 
-> [Introduced][ce-21115] in GitLab 11.3.  
-> [dirty_submit][dirty-submit]
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/21115) in GitLab 11.3.
 
 ## Summary
 
@@ -9,6 +8,9 @@ Prevent submitting forms with no changes.
 
 Currently handles `input`, `textarea` and `select` elements.
 
+Also, see [the code](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/assets/javascripts/dirty_submit/)
+within the GitLab project.
+
 ## Usage
 
 ```js
@@ -18,6 +20,3 @@ new DirtySubmitForm(document.querySelector('form'));
 // or
 new DirtySubmitForm(document.querySelectorAll('form'));
 ```
-
-[ce-21115]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/21115
-[dirty-submit]: https://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/assets/javascripts/dirty_submit/
\ No newline at end of file
diff --git a/doc/development/new_fe_guide/style/javascript.md b/doc/development/new_fe_guide/style/javascript.md
index 802ebd12d92..b742d567f41 100644
--- a/doc/development/new_fe_guide/style/javascript.md
+++ b/doc/development/new_fe_guide/style/javascript.md
@@ -192,4 +192,4 @@ rules only if you are invoking/instantiating existing code modules.
 - [class-method-use-this](http://eslint.org/docs/rules/class-methods-use-this)
 
 > Note: Disable these rules on a per line basis. This makes it easier to refactor
-  in the future. E.g. use `eslint-disable-next-line` or `eslint-disable-line`.
+> in the future. E.g. use `eslint-disable-next-line` or `eslint-disable-line`.
diff --git a/doc/development/shell_scripting_guide/index.md b/doc/development/shell_scripting_guide/index.md
index ae7f2154682..0809f8b1a0a 100644
--- a/doc/development/shell_scripting_guide/index.md
+++ b/doc/development/shell_scripting_guide/index.md
@@ -24,7 +24,8 @@ Having said all of the above, we recommend staying away from shell scripts
 as much as possible. A language like Ruby or Python (if required for
 consistency with codebases that we leverage) is almost always a better choice.
 The high-level interpreted languages have more readable syntax, offer much more
-mature capabilities for unit-testing, linting, and error reporting.  
+mature capabilities for unit-testing, linting, and error reporting.
+
 Use shell scripts only if there's a strong restriction on project's
 dependencies size or any other requirements that are more important
 in a particular case.
@@ -48,12 +49,12 @@ that is:
 
 This section describes the tools that should be made a mandatory part of
 a project's CI pipeline if it contains shell scripts. These tools
-automate shell code formatting, checking for errors or vulnerabilities, etc.   
+automate shell code formatting, checking for errors or vulnerabilities, etc.
 
 ### Linting
 
 We're using the [ShellCheck](https://www.shellcheck.net/) utility in its default configuration to lint our
-shell scripts. 
+shell scripts.
 
 All projects with shell scripts should use this GitLab CI/CD job:
 
@@ -98,7 +99,7 @@ NOTE: **Note:**
 This is a work in progress.
 
 It is an [ongoing effort](https://gitlab.com/gitlab-org/gitlab-ce/issues/64016) to evaluate different tools for the
-automated testing of shell scripts (like [BATS](https://github.com/sstephenson/bats)).  
+automated testing of shell scripts (like [BATS](https://github.com/sstephenson/bats)).
 
 ## Code Review
 
diff --git a/doc/development/testing_guide/review_apps.md b/doc/development/testing_guide/review_apps.md
index 7843fc4c874..11449712a04 100644
--- a/doc/development/testing_guide/review_apps.md
+++ b/doc/development/testing_guide/review_apps.md
@@ -255,8 +255,8 @@ that a machine will hit the "too many mount points" problem in the future.
 thousands of unused Docker images.**
 
   > We have to start somewhere and improve later. Also, we're using the
-  CNG-mirror project to store these Docker images so that we can just wipe out
-  the registry at some point, and use a new fresh, empty one.
+  > CNG-mirror project to store these Docker images so that we can just wipe out
+  > the registry at some point, and use a new fresh, empty one.
 
 **How do we secure this from abuse? Apps are open to the world so we need to
 find a way to limit it to only us.**
diff --git a/doc/workflow/lfs/lfs_administration.md b/doc/workflow/lfs/lfs_administration.md
index 3160b0c4deb..7e880b3009d 100644
--- a/doc/workflow/lfs/lfs_administration.md
+++ b/doc/workflow/lfs/lfs_administration.md
@@ -46,8 +46,7 @@ In `config/gitlab.yml`:
 
 ## Storing LFS objects in remote object storage
 
-> [Introduced][ee-2760] in [GitLab Premium][eep] 10.0. Brought to GitLab Core
-in 10.7.
+> [Introduced][ee-2760] in [GitLab Premium][eep] 10.0. Brought to GitLab Core in 10.7.
 
 It is possible to store LFS objects in remote object storage which allows you
 to offload local hard disk R/W operations, and free up disk space significantly.
@@ -91,7 +90,7 @@ Here is a configuration example with S3.
 | `aws_access_key_id` | AWS credentials, or compatible | `ABC123DEF456` |
 | `aws_secret_access_key` | AWS credentials, or compatible | `ABC123DEF456ABC123DEF456ABC123DEF456` |
 | `aws_signature_version` | AWS signature version to use. 2 or 4 are valid options. Digital Ocean Spaces and other providers may need 2. | 4 |
-| `enable_signature_v4_streaming` | Set to true to enable HTTP chunked transfers with AWS v4 signatures (https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html). Oracle Cloud S3 needs this to be false | true
+| `enable_signature_v4_streaming` | Set to true to enable HTTP chunked transfers with [AWS v4 signatures](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html). Oracle Cloud S3 needs this to be false | true |
 | `region` | AWS region | us-east-1 |
 | `host` | S3 compatible host for when not using AWS, e.g. `localhost` or `storage.example.com` | s3.amazonaws.com |
 | `endpoint` | Can be used when configuring an S3 compatible service such as [Minio](https://www.minio.io), by entering a URL such as `http://127.0.0.1:9000` | (optional) |
@@ -107,7 +106,9 @@ Here is a configuration example with GCS.
 | `google_client_email` | The email address of the service account | `foo@gcp-project-12345.iam.gserviceaccount.com` |
 | `google_json_key_location` | The json key path | `/path/to/gcp-project-12345-abcde.json` |
 
-_NOTE: The service account must have permission to access the bucket. [See more](https://cloud.google.com/storage/docs/authentication)_
+NOTE: **Note:**
+The service account must have permission to access the bucket.
+[See more](https://cloud.google.com/storage/docs/authentication)
 
 Here is a configuration example with Rackspace Cloud Files.
 
@@ -119,7 +120,13 @@ Here is a configuration example with Rackspace Cloud Files.
 | `rackspace_region` | The Rackspace storage region to use, a three letter code from the [list of service access endpoints](https://developer.rackspace.com/docs/cloud-files/v1/general-api-info/service-access/) | `iad` |
 | `rackspace_temp_url_key` | The private key you have set in the Rackspace API for temporary URLs. Read more [here](https://developer.rackspace.com/docs/cloud-files/v1/use-cases/public-access-to-your-cloud-files-account/#tempurl) | `ABC123DEF456ABC123DEF456ABC123DE` |
 
-_NOTES: Regardless of whether the container has public access enabled or disabled, Fog will use the TempURL method to grant access to LFS objects. If you see errors in logs referencing instantiating storage with a temp-url-key, ensure that you have set they key properly on the Rackspace API and in gitlab.rb. You can verify the value of the key Rackspace has set by sending a GET request with token header to the service access endpoint URL and comparing the output of the returned headers._
+NOTE: **Note:**
+Regardless of whether the container has public access enabled or disabled, Fog will
+use the TempURL method to grant access to LFS objects. If you see errors in logs referencing
+instantiating storage with a temp-url-key, ensure that you have set they key properly
+on the Rackspace API and in gitlab.rb. You can verify the value of the key Rackspace
+has set by sending a GET request with token header to the service access endpoint URL
+and comparing the output of the returned headers.
 
 ### Manual uploading to an object storage
 
@@ -167,13 +174,13 @@ On Omnibus installations, the settings are prefixed by `lfs_object_store_`:
 1. Save the file and [reconfigure GitLab]s for the changes to take effect.
 1. Migrate any existing local LFS objects to the object storage:
 
-    ```bash
-    gitlab-rake gitlab:lfs:migrate
-    ```
+   ```bash
+   gitlab-rake gitlab:lfs:migrate
+   ```
 
-    This will migrate existing LFS objects to object storage. New LFS objects
-    will be forwarded to object storage unless
-    `gitlab_rails['lfs_object_store_background_upload']` is set to false.
+   This will migrate existing LFS objects to object storage. New LFS objects
+   will be forwarded to object storage unless
+   `gitlab_rails['lfs_object_store_background_upload']` is set to false.
 
 ### S3 for installations from source
 
@@ -203,13 +210,13 @@ For source installations the settings are nested under `lfs:` and then
 1. Save the file and [restart GitLab][] for the changes to take effect.
 1. Migrate any existing local LFS objects to the object storage:
 
-    ```bash
-    sudo -u git -H bundle exec rake gitlab:lfs:migrate RAILS_ENV=production
-    ```
+   ```bash
+   sudo -u git -H bundle exec rake gitlab:lfs:migrate RAILS_ENV=production
+   ```
 
-    This will migrate existing LFS objects to object storage. New LFS objects
-    will be forwarded to object storage unless `background_upload` is set to
-    false.
+   This will migrate existing LFS objects to object storage. New LFS objects
+   will be forwarded to object storage unless `background_upload` is set to
+   false.
 
 ## Storage statistics
 
diff --git a/doc/workflow/lfs/manage_large_binaries_with_git_lfs.md b/doc/workflow/lfs/manage_large_binaries_with_git_lfs.md
index 264372a512d..f5593927cc2 100644
--- a/doc/workflow/lfs/manage_large_binaries_with_git_lfs.md
+++ b/doc/workflow/lfs/manage_large_binaries_with_git_lfs.md
@@ -35,9 +35,10 @@ Documentation for GitLab instance administrators is under [LFS administration do
 - Git LFS always assumes HTTPS so if you have GitLab server on HTTP you will have
   to add the URL to Git config manually (see [troubleshooting](#troubleshooting))
 
->**Note**: With 8.12 GitLab added LFS support to SSH. The Git LFS communication
- still goes over HTTP, but now the SSH client passes the correct credentials
- to the Git LFS client, so no action is required by the user.
+NOTE: **Note:**
+With 8.12 GitLab added LFS support to SSH. The Git LFS communication
+still goes over HTTP, but now the SSH client passes the correct credentials
+to the Git LFS client, so no action is required by the user.
 
 ## Using Git LFS
 
@@ -61,12 +62,13 @@ git commit -am "Added Debian iso"     # commit the file meta data
 git push origin master                # sync the git repo and large file to the GitLab server
 ```
 
-> **Note**: Make sure that `.gitattributes` is tracked by git. Otherwise Git
-> LFS will not be working properly for people cloning the project.
->
-> ```bash
-> git add .gitattributes
-> ```
+NOTE: **Note:**
+**Make sure** that `.gitattributes` is tracked by Git. Otherwise Git
+LFS will not be working properly for people cloning the project.
+
+```bash
+git add .gitattributes
+```
 
 Cloning the repository works the same as before. Git automatically detects the
 LFS-tracked files and clones them via HTTP. If you performed the git clone
@@ -216,9 +218,10 @@ git config --add lfs.url "http://gitlab.example.com/group/project.git/info/lfs"
 
 ### Credentials are always required when pushing an object
 
->**Note**: With 8.12 GitLab added LFS support to SSH. The Git LFS communication
- still goes over HTTP, but now the SSH client passes the correct credentials
- to the Git LFS client, so no action is required by the user.
+NOTE: **Note:**
+With 8.12 GitLab added LFS support to SSH. The Git LFS communication
+still goes over HTTP, but now the SSH client passes the correct credentials
+to the Git LFS client, so no action is required by the user.
 
 Given that Git LFS uses HTTP Basic Authentication to authenticate the user pushing
 the LFS object on every push for every object, user HTTPS credentials are required.
diff --git a/doc/workflow/lfs/migrate_from_git_annex_to_git_lfs.md b/doc/workflow/lfs/migrate_from_git_annex_to_git_lfs.md
index 75673d23799..5ceeb3253f1 100644
--- a/doc/workflow/lfs/migrate_from_git_annex_to_git_lfs.md
+++ b/doc/workflow/lfs/migrate_from_git_annex_to_git_lfs.md
@@ -76,7 +76,7 @@ Here you'll find a guide on
 Since Annex files are stored as objects with symlinks and cannot be directly
 modified, we need to first remove those symlinks.
 
->**Note:**
+NOTE: **Note:**
 Make sure the you read about the [`direct` mode][annex-direct] as it contains
 useful information that may fit in your use case. Note that `annex direct` is
 deprecated in Git Annex version 6, so you may need to upgrade your repository
diff --git a/doc/workflow/repository_mirroring.md b/doc/workflow/repository_mirroring.md
index 0b8e7d851b0..753518d0424 100644
--- a/doc/workflow/repository_mirroring.md
+++ b/doc/workflow/repository_mirroring.md
@@ -37,8 +37,7 @@ The following are some possible use cases for repository mirroring:
 
 ## Pushing to a remote repository **(CORE)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/249) in GitLab Enterprise
-> Edition 8.7. [Moved to GitLab Core](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/18715) in 10.8.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/249) in GitLab Enterprise Edition 8.7. [Moved to GitLab Core](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/18715) in 10.8.
 
 For an existing project, you can set up push mirroring as follows:
 
@@ -67,8 +66,7 @@ section.
 
 ### Push only protected branches **(CORE)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/3350) in
-> [GitLab Starter](https://about.gitlab.com/pricing/) 10.3. [Moved to GitLab Core](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/18715) in 10.8.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/3350) in [GitLab Starter](https://about.gitlab.com/pricing/) 10.3. [Moved to GitLab Core](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/18715) in 10.8.
 
 You can choose to only push your protected branches from GitLab to your remote repository.
 
@@ -98,8 +96,7 @@ The repository will push soon. To force a push, click the appropriate button.
 
 ## Pulling from a remote repository **(STARTER)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/51) in GitLab Enterprise Edition 8.2.
-> [Added Git LFS support](https://gitlab.com/gitlab-org/gitlab-ee/issues/10871) in [GitLab Starter](https://about.gitlab.com/pricing/) 11.11.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/51) in GitLab Enterprise Edition 8.2. [Added Git LFS support](https://gitlab.com/gitlab-org/gitlab-ee/issues/10871) in [GitLab Starter](https://about.gitlab.com/pricing/) 11.11.
 
 NOTE: **Note:** This feature [is available for free](https://gitlab.com/gitlab-org/gitlab-ee/issues/10361) to
 GitLab.com users until September 22nd, 2019.
@@ -157,8 +154,7 @@ Repository mirrors are updated as Sidekiq becomes available to process them. If
 
 ### SSH authentication
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/2551) for Pull mirroring in [GitLab Starter](https://about.gitlab.com/pricing/) 9.5.
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/22982) for Push mirroring in [GitLab Core](https://about.gitlab.com/pricing/) 11.6
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/2551) for Pull mirroring in [GitLab Starter](https://about.gitlab.com/pricing/) 9.5. [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/22982) for Push mirroring in [GitLab Core](https://about.gitlab.com/pricing/) 11.6
 
 SSH authentication is mutual:
 
@@ -245,8 +241,7 @@ key to keep the mirror running.
 
 ### Overwrite diverged branches **(STARTER)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/4559) in
-> [GitLab Starter](https://about.gitlab.com/pricing/) 10.6.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/4559) in [GitLab Starter](https://about.gitlab.com/pricing/) 10.6.
 
 You can choose to always update your local branches with remote versions, even if they have
 diverged from the remote.
@@ -258,8 +253,7 @@ To use this option, check the **Overwrite diverged branches** box when creating
 
 ### Only mirror protected branches **(STARTER)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/3326) in
-> [GitLab Starter](https://about.gitlab.com/pricing/) 10.3.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/3326) in [GitLab Starter](https://about.gitlab.com/pricing/) 10.3.
 
 You can choose to pull mirror only the protected branches from your remote repository to GitLab.
 Non-protected branches are not mirrored and can diverge.
@@ -268,8 +262,7 @@ To use this option, check the **Only mirror protected branches** box when creati
 
 ### Hard failure **(STARTER)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/3117) in
-> [GitLab Starter](https://about.gitlab.com/pricing/) 10.2.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/3117) in [GitLab Starter](https://about.gitlab.com/pricing/) 10.2.
 
 Once the mirroring process is unsuccessfully retried 14 times in a row, it will get marked as hard
 failed. This will become visible in either the:
@@ -282,8 +275,7 @@ project mirroring again by [Forcing an update](#forcing-an-update-core).
 
 ### Trigger update using API **(STARTER)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/3453) in
-[GitLab Starter](https://about.gitlab.com/pricing/) 10.3.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/3453) in [GitLab Starter](https://about.gitlab.com/pricing/) 10.3.
 
 Pull mirroring uses polling to detect new branches and commits added upstream, often minutes
 afterwards. If you notify GitLab by [API](../api/projects.md#start-the-pull-mirroring-process-for-a-project-starter),
@@ -325,9 +317,10 @@ protected branches.
 
 ### Preventing conflicts using a `pre-receive` hook
 
-> **Warning:** The solution proposed will negatively impact the performance of
-> Git push operations because they will be proxied to the upstream Git
-> repository.
+CAUTION: **Warning:**
+The solution proposed will negatively impact the performance of
+Git push operations because they will be proxied to the upstream Git
+repository.
 
 A server-side `pre-receive` hook can be used to prevent the race condition
 described above by only accepting the push after first pushing the commit to
diff --git a/doc/workflow/todos.md b/doc/workflow/todos.md
index 0432c406f31..211d242e2d3 100644
--- a/doc/workflow/todos.md
+++ b/doc/workflow/todos.md
@@ -35,8 +35,8 @@ A To Do displays on your To-Do List when:
 - You are `@mentioned` in a comment on a commit
 - A job in the CI pipeline running for your merge request failed, but this
   job is not allowed to fail
-- An open merge request becomes unmergeable due to conflict, and you are either: 
-  - The author 
+- An open merge request becomes unmergeable due to conflict, and you are either:
+  - The author
   - Have set it to automatically merge once the pipeline succeeds
 
 To-do triggers are not affected by [GitLab Notification Email settings](notifications.md).
-- 
cgit v1.2.1


From 94c6340a985abb636dd2434f7e516bec342593b3 Mon Sep 17 00:00:00 2001
From: Dylan Griffith <dyl.griffith@gmail.com>
Date: Mon, 19 Aug 2019 13:39:51 +1000
Subject: Initial docs for sidekiq worker with Auto DevOps

---
 doc/topics/autodevops/index.md | 46 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/doc/topics/autodevops/index.md b/doc/topics/autodevops/index.md
index 95220d6364c..0bbb7ed9ccc 100644
--- a/doc/topics/autodevops/index.md
+++ b/doc/topics/autodevops/index.md
@@ -584,6 +584,52 @@ Unless you have a `Dockerfile` in your repo, your image is built with
 Herokuish, and you must prefix commands run in these images with `/bin/herokuish
 procfile exec` to replicate the environment where your application will run.
 
+#### Workers
+
+Some web applications need to run extra deployments for "worker processes". For
+example it is common in a Rails application to have a separate worker process
+to run background tasks like sending emails.
+
+The [default Helm chart](https://gitlab.com/gitlab-org/charts/auto-deploy-app)
+used in Auto Deploy [has support for running worker
+processes](https://gitlab.com/gitlab-org/charts/auto-deploy-app/merge_requests/9).
+
+In order to run a worker you'll need to ensure that it is able to respond to
+the standard health checks which expect a successful HTTP response on port
+`5000`. For sidekiq you could make use of the
+[sidekiq_alive gem](https://rubygems.org/gems/sidekiq_alive) to do this. 
+
+In order to work with sidekiq you'll also need to ensure your deployments have
+access to a redis instance. Auto DevOps won't deploy this for you so you'll
+need to manage this separately and then set a CI variable
+`K8S_SECRET_REDIS_URL` which the URL of this instance to ensure it's passed
+into your deployments.
+
+Once you have configured your worker to respond to health checks you you will
+need to configure a CI variable `HELM_UPGRADE_EXTRA_ARGS` with the value
+`--values helm-values.yaml`. Then you can, for example, run a
+[sidekiq](https://github.com/mperham/sidekiq) worker for your rails application
+by adding a file named `helm-values.yaml` to your repo with the following
+content:
+
+```yml
+workers:
+  sidekiq:
+    replicaCount: 1
+    command:
+    - /bin/herokuish
+    - procfile
+    - exec
+    - sidekiq
+    preStopCommand:
+    - /bin/herokuish
+    - procfile
+    - exec
+    - sidekiqctl
+    - quiet
+    terminationGracePeriodSeconds: 60
+```
+
 ### Auto Monitoring
 
 See the [requirements](#requirements) for Auto Monitoring to enable this stage.
-- 
cgit v1.2.1


From 8a7fa21a7df1d90cfe602d573a50fbec786afa50 Mon Sep 17 00:00:00 2001
From: Samantha Ming <sming@gitlab.com>
Date: Tue, 20 Aug 2019 00:40:34 +0000
Subject: Add documentation for incrementally expand mr diffs

---
 .../incrementally_expand_merge_request_diffs_v12_2.png  | Bin 0 -> 96982 bytes
 doc/user/project/merge_requests/index.md                |   9 +++++++++
 2 files changed, 9 insertions(+)
 create mode 100644 doc/user/project/merge_requests/img/incrementally_expand_merge_request_diffs_v12_2.png

diff --git a/doc/user/project/merge_requests/img/incrementally_expand_merge_request_diffs_v12_2.png b/doc/user/project/merge_requests/img/incrementally_expand_merge_request_diffs_v12_2.png
new file mode 100644
index 00000000000..ee94dbdea5c
Binary files /dev/null and b/doc/user/project/merge_requests/img/incrementally_expand_merge_request_diffs_v12_2.png differ
diff --git a/doc/user/project/merge_requests/index.md b/doc/user/project/merge_requests/index.md
index 8a82b163481..2794cbc0f39 100644
--- a/doc/user/project/merge_requests/index.md
+++ b/doc/user/project/merge_requests/index.md
@@ -497,6 +497,15 @@ list.
 
 ![Merge request diff file navigation](img/merge_request_diff_file_navigation.png)
 
+### Incrementally expand merge request diffs
+
+By default, the diff shows only the parts of a file which are changed.
+To view more unchanged lines above or below a change click on the
+**Expand up** or **Expand down** icons. You can also click on **Show all lines**
+to expand the entire file.
+
+![Incrementally expand merge request diffs](img/incrementally_expand_merge_request_diffs_v12_2.png)
+
 ## Ignore whitespace changes in Merge Request diff view
 
 If you click the **Hide whitespace changes** button, you can see the diff
-- 
cgit v1.2.1


From 092e03f09b8205326b57bc46ac577e8d12602284 Mon Sep 17 00:00:00 2001
From: Aishwarya Subramanian <asubramanian@gitlab.com>
Date: Tue, 20 Aug 2019 01:18:00 +0000
Subject: Back porting Username suggestion API changes

---
 config/routes.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/routes.rb b/config/routes.rb
index fdef31429f3..d633228a495 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -109,6 +109,7 @@ Rails.application.routes.draw do
     Gitlab.ee do
       draw :smartcard
       draw :jira_connect
+      draw :username
     end
 
     Gitlab.ee do
-- 
cgit v1.2.1


From 49ea1a64c870fcc78ce01fd60cabfc5cc4f39349 Mon Sep 17 00:00:00 2001
From: Winnie Hellmann <winnie@gitlab.com>
Date: Tue, 20 Aug 2019 01:43:13 +0000
Subject: Combine old and new frontend testing guide (docs)

---
 .../new_fe_guide/development/testing.md            | 363 +--------------------
 doc/development/testing_guide/frontend_testing.md  | 359 ++++++++++++++++++++
 2 files changed, 363 insertions(+), 359 deletions(-)

diff --git a/doc/development/new_fe_guide/development/testing.md b/doc/development/new_fe_guide/development/testing.md
index f7ea496d935..e0d413b748b 100644
--- a/doc/development/new_fe_guide/development/testing.md
+++ b/doc/development/new_fe_guide/development/testing.md
@@ -1,361 +1,6 @@
-# Overview of Frontend Testing
+---
+redirect_to: '../../testing_guide/frontend_testing.md'
+---
 
-Tests relevant for frontend development can be found at the following places:
+This document was moved to [another location](../../testing_guide/frontend_testing.md).
 
-- `spec/javascripts/` which are run by Karma (command: `yarn karma`) and contain
-  - [frontend unit tests](#frontend-unit-tests)
-  - [frontend component tests](#frontend-component-tests)
-  - [frontend integration tests](#frontend-integration-tests)
-- `spec/frontend/` which are run by Jest (command: `yarn jest`) and contain
-  - [frontend unit tests](#frontend-unit-tests)
-  - [frontend component tests](#frontend-component-tests)
-  - [frontend integration tests](#frontend-integration-tests)
-- `spec/features/` which are run by RSpec and contain
-  - [feature tests](#feature-tests)
-
-All tests in `spec/javascripts/` will eventually be migrated to `spec/frontend/` (see also [#52483](https://gitlab.com/gitlab-org/gitlab-ce/issues/52483)).
-
-In addition there were feature tests in `features/` run by Spinach in the past.
-These have been removed from our codebase in May 2018 ([#23036](https://gitlab.com/gitlab-org/gitlab-ce/issues/23036)).
-
-See also:
-
-- [Old testing guide](../../testing_guide/frontend_testing.html).
-- [Notes on testing Vue components](../../fe_guide/vue.html#testing-vue-components).
-
-## Frontend unit tests
-
-Unit tests are on the lowest abstraction level and typically test functionality that is not directly perceivable by a user.
-
-### When to use unit tests
-
-<details>
-  <summary>exported functions and classes</summary>
-  Anything that is exported can be reused at various places in a way you have no control over.
-  Therefore it is necessary to document the expected behavior of the public interface with tests.
-</details>
-
-<details>
-  <summary>Vuex actions</summary>
-  Any Vuex action needs to work in a consistent way independent of the component it is triggered from.
-</details>
-
-<details>
-  <summary>Vuex mutations</summary>
-  For complex Vuex mutations it helps to identify the source of a problem by separating the tests from other parts of the Vuex store.
-</details>
-
-### When *not* to use unit tests
-
-<details>
-  <summary>non-exported functions or classes</summary>
-  Anything that is not exported from a module can be considered private or an implementation detail and doesn't need to be tested.
-</details>
-
-<details>
-  <summary>constants</summary>
-  Testing the value of a constant would mean to copy it.
-  This results in extra effort without additional confidence that the value is correct.
-</details>
-
-<details>
-  <summary>Vue components</summary>
-  Computed properties, methods, and lifecycle hooks can be considered an implementation detail of components and don't need to be tested.
-  They are implicitly covered by component tests.
-  The <a href="https://vue-test-utils.vuejs.org/guides/#getting-started">official Vue guidelines</a> suggest the same.
-</details>
-
-### What to mock in unit tests
-
-<details>
-  <summary>state of the class under test</summary>
-  Modifying the state of the class under test directly rather than using methods of the class avoids side-effects in test setup.
-</details>
-
-<details>
-  <summary>other exported classes</summary>
-  Every class needs to be tested in isolation to prevent test scenarios from growing exponentially.
-</details>
-
-<details>
-  <summary>single DOM elements if passed as parameters</summary>
-  For tests that only operate on single DOM elements rather than a whole page, creating these elements is cheaper than loading a whole HTML fixture.
-</details>
-
-<details>
-  <summary>all server requests</summary>
-  When running frontend unit tests, the backend may not be reachable.
-  Therefore all outgoing requests need to be mocked.
-</details>
-
-<details>
-  <summary>asynchronous background operations</summary>
-  Background operations cannot be stopped or waited on, so they will continue running in the following tests and cause side effects.
-</details>
-
-### What *not* to mock in unit tests
-
-<details>
-  <summary>non-exported functions or classes</summary>
-  Everything that is not exported can be considered private to the module and will be implicitly tested via the exported classes / functions.
-</details>
-
-<details>
-  <summary>methods of the class under test</summary>
-  By mocking methods of the class under test, the mocks will be tested and not the real methods.
-</details>
-
-<details>
-  <summary>utility functions (pure functions, or those that only modify parameters)</summary>
-  If a function has no side effects because it has no state, it is safe to not mock it in tests.
-</details>
-
-<details>
-  <summary>full HTML pages</summary>
-  Loading the HTML of a full page slows down tests, so it should be avoided in unit tests.
-</details>
-
-## Frontend component tests
-
-Component tests cover the state of a single component that is perceivable by a user depending on external signals such as user input, events fired from other components, or application state.
-
-### When to use component tests
-
-- Vue components
-
-### When *not* to use component tests
-
-<details>
-  <summary>Vue applications</summary>
-  Vue applications may contain many components.
-  Testing them on a component level requires too much effort.
-  Therefore they are tested on frontend integration level.
-</details>
-
-<details>
-  <summary>HAML templates</summary>
-  HAML templates contain only Markup and no frontend-side logic.
-  Therefore they are not complete components.
-</details>
-
-### What to mock in component tests
-
-<details>
-  <summary>DOM</summary>
-  Operating on the real DOM is significantly slower than on the virtual DOM.
-</details>
-
-<details>
-  <summary>properties and state of the component under test</summary>
-  Similarly to testing classes, modifying the properties directly (rather than relying on methods of the component) avoids side-effects.
-</details>
-
-<details>
-  <summary>Vuex store</summary>
-  To avoid side effects and keep component tests simple, Vuex stores are replaced with mocks.
-</details>
-
-<details>
-  <summary>all server requests</summary>
-  Similar to unit tests, when running component tests, the backend may not be reachable.
-  Therefore all outgoing requests need to be mocked.
-</details>
-
-<details>
-  <summary>asynchronous background operations</summary>
-  Similar to unit tests, background operations cannot be stopped or waited on, so they will continue running in the following tests and cause side effects.
-</details>
-
-<details>
-  <summary>child components</summary>
-  Every component is tested individually, so child components are mocked.
-  See also <a href="https://vue-test-utils.vuejs.org/api/#shallowmount">shallowMount()</a>
-</details>
-
-### What *not* to mock in component tests
-
-<details>
-  <summary>methods or computed properties of the component under test</summary>
-  By mocking part of the component under test, the mocks will be tested and not the real component.
-</details>
-
-<details>
-  <summary>functions and classes independent from Vue</summary>
-  All plain JavaScript code is already covered by unit tests and needs not to be mocked in component tests.
-</details>
-
-## Frontend integration tests
-
-Integration tests cover the interaction between all components on a single page.
-Their abstraction level is comparable to how a user would interact with the UI.
-
-### When to use integration tests
-
-<details>
-  <summary>page bundles (<code>index.js</code> files in <code>app/assets/javascripts/pages/</code>)</summary>
-  Testing the page bundles ensures the corresponding frontend components integrate well.
-</details>
-
-<details>
-  <summary>Vue applications outside of page bundles</summary>
-  Testing Vue applications as a whole ensures the corresponding frontend components integrate well.
-</details>
-
-### What to mock in integration tests
-
-<details>
-  <summary>HAML views (use fixtures instead)</summary>
-  Rendering HAML views requires a Rails environment including a running database which we cannot rely on in frontend tests.
-</details>
-
-<details>
-  <summary>all server requests</summary>
-  Similar to unit and component tests, when running component tests, the backend may not be reachable.
-  Therefore all outgoing requests need to be mocked.
-</details>
-
-<details>
-  <summary>asynchronous background operations that are not perceivable on the page</summary>
-  Background operations that affect the page need to be tested on this level.
-  All other background operations cannot be stopped or waited on, so they will continue running in the following tests and cause side effects.
-</details>
-
-### What *not* to mock in integration tests
-
-<details>
-  <summary>DOM</summary>
-  Testing on the real DOM ensures our components work in the environment they are meant for.
-  Part of this will be delegated to <a href="https://gitlab.com/gitlab-org/quality/team-tasks/issues/45">cross-browser testing</a>.
-</details>
-
-<details>
-  <summary>properties or state of components</summary>
-  On this level, all tests can only perform actions a user would do.
-  For example to change the state of a component, a click event would be fired.
-</details>
-
-<details>
-  <summary>Vuex stores</summary>
-  When testing the frontend code of a page as a whole, the interaction between Vue components and Vuex stores is covered as well.
-</details>
-
-## Feature tests
-
-In contrast to [frontend integration tests](#frontend-integration-tests), feature tests make requests against the real backend instead of using fixtures.
-This also implies that database queries are executed which makes this category significantly slower.
-
-See also the [RSpec testing guidelines](../../testing_guide/best_practices.md#rspec).
-
-### When to use feature tests
-
-- use cases that require a backend and cannot be tested using fixtures
-- behavior that is not part of a page bundle but defined globally
-
-### Relevant notes
-
-A `:js` flag is added to the test to make sure the full environment is loaded.
-
-```
-scenario 'successfully', :js do
-  sign_in(create(:admin))
-end
-```
-
-The steps of each test are written using capybara methods ([documentation](https://www.rubydoc.info/gems/capybara)).
-
-Bear in mind <abbr title="XMLHttpRequest">XHR</abbr> calls might require you to use `wait_for_requests` in between steps, like so:
-
-```rspec
-find('.form-control').native.send_keys(:enter)
-
-wait_for_requests
-
-expect(page).not_to have_selector('.card')
-```
-
-## Test helpers
-
-### Vuex Helper: `testAction`
-
-We have a helper available to make testing actions easier, as per [official documentation](https://vuex.vuejs.org/guide/testing.html):
-
-```
-testAction(
-  actions.actionName, // action
-  { }, // params to be passed to action
-  state, // state
-  [
-    { type: types.MUTATION},
-    { type: types.MUTATION_1, payload: {}},
-  ], // mutations committed
-  [
-    { type: 'actionName', payload: {}},
-    { type: 'actionName1', payload: {}},
-  ] // actions dispatched
-  done,
-);
-```
-
-Check an example in [spec/javascripts/ide/stores/actions_spec.jsspec/javascripts/ide/stores/actions_spec.js](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/spec/javascripts/ide/stores/actions_spec.js).
-
-### Vue Helper: `mountComponent`
-
-To make mounting a Vue component easier and more readable, we have a few helpers available in `spec/helpers/vue_mount_component_helper`.
-
-- `createComponentWithStore`
-- `mountComponentWithStore`
-
-Examples of usage:
-
-```
-beforeEach(() => {
-  vm = createComponentWithStore(Component, store);
-
-  vm.$store.state.currentBranchId = 'master';
-
-  vm.$mount();
-},
-```
-
-```
-beforeEach(() => {
-  vm = mountComponentWithStore(Component, {
-    el: '#dummy-element',
-    store,
-    props: { badge },
-  });
-},
-```
-
-Don't forget to clean up:
-
-```
-afterEach(() => {
-  vm.$destroy();
-});
-```
-
-## Testing with older browsers
-
-Some regressions only affect a specific browser version. We can install and test in particular browsers with either Firefox or Browserstack using the following steps:
-
-### Browserstack
-
-[Browserstack](https://www.browserstack.com/) allows you to test more than 1200 mobile devices and browsers.
-You can use it directly through the [live app](https://www.browserstack.com/live) or you can install the [chrome extension](https://chrome.google.com/webstore/detail/browserstack/nkihdmlheodkdfojglpcjjmioefjahjb) for easy access.
-You can find the credentials on 1Password, under `frontendteam@gitlab.com`.
-
-### Firefox
-
-#### macOS
-
-You can download any older version of Firefox from the releases FTP server, <https://ftp.mozilla.org/pub/firefox/releases/>
-
-1. From the website, select a version, in this case `50.0.1`.
-1. Go to the mac folder.
-1. Select your preferred language, you will find the dmg package inside, download it.
-1. Drag and drop the application to any other folder but the `Applications` folder.
-1. Rename the application to something like `Firefox_Old`.
-1. Move the application to the `Applications` folder.
-1. Open up a terminal and run `/Applications/Firefox_Old.app/Contents/MacOS/firefox-bin -profilemanager` to create a new profile specific to that Firefox version.
-1. Once the profile has been created, quit the app, and run it again like normal. You now have a working older Firefox version.
diff --git a/doc/development/testing_guide/frontend_testing.md b/doc/development/testing_guide/frontend_testing.md
index 2985278cc92..52ac746716c 100644
--- a/doc/development/testing_guide/frontend_testing.md
+++ b/doc/development/testing_guide/frontend_testing.md
@@ -593,6 +593,365 @@ end
 [capybara]: https://github.com/teamcapybara/capybara
 [jasmine]: https://jasmine.github.io/
 
+## Overview of Frontend Testing Levels
+
+Tests relevant for frontend development can be found at the following places:
+
+- `spec/javascripts/` which are run by Karma (command: `yarn karma`) and contain
+  - [frontend unit tests](#frontend-unit-tests)
+  - [frontend component tests](#frontend-component-tests)
+  - [frontend integration tests](#frontend-integration-tests)
+- `spec/frontend/` which are run by Jest (command: `yarn jest`) and contain
+  - [frontend unit tests](#frontend-unit-tests)
+  - [frontend component tests](#frontend-component-tests)
+  - [frontend integration tests](#frontend-integration-tests)
+- `spec/features/` which are run by RSpec and contain
+  - [feature tests](#feature-tests)
+
+All tests in `spec/javascripts/` will eventually be migrated to `spec/frontend/` (see also [#52483](https://gitlab.com/gitlab-org/gitlab-ce/issues/52483)).
+
+In addition, there used to be feature tests in `features/`, run by Spinach.
+These were removed from the codebase in May 2018 ([#23036](https://gitlab.com/gitlab-org/gitlab-ce/issues/23036)).
+
+See also [Notes on testing Vue components](../fe_guide/vue.html#testing-vue-components).
+
+### Frontend unit tests
+
+Unit tests are on the lowest abstraction level and typically test functionality that is not directly perceivable by a user.
+
+#### When to use unit tests
+
+<details>
+  <summary>exported functions and classes</summary>
+  Anything that is exported can be reused at various places in a way you have no control over.
+  Therefore it is necessary to document the expected behavior of the public interface with tests.
+</details>
+
+<details>
+  <summary>Vuex actions</summary>
+  Any Vuex action needs to work in a consistent way independent of the component it is triggered from.
+</details>
+
+<details>
+  <summary>Vuex mutations</summary>
+  For complex Vuex mutations it helps to identify the source of a problem by separating the tests from other parts of the Vuex store.
+</details>
+
+#### When *not* to use unit tests
+
+<details>
+  <summary>non-exported functions or classes</summary>
+  Anything that is not exported from a module can be considered private or an implementation detail and doesn't need to be tested.
+</details>
+
+<details>
+  <summary>constants</summary>
+  Testing the value of a constant would mean to copy it.
+  This results in extra effort without additional confidence that the value is correct.
+</details>
+
+<details>
+  <summary>Vue components</summary>
+  Computed properties, methods, and lifecycle hooks can be considered an implementation detail of components and don't need to be tested.
+  They are implicitly covered by component tests.
+  The <a href="https://vue-test-utils.vuejs.org/guides/#getting-started">official Vue guidelines</a> suggest the same.
+</details>
+
+#### What to mock in unit tests
+
+<details>
+  <summary>state of the class under test</summary>
+  Modifying the state of the class under test directly rather than using methods of the class avoids side-effects in test setup.
+</details>
+
+<details>
+  <summary>other exported classes</summary>
+  Every class needs to be tested in isolation to prevent test scenarios from growing exponentially.
+</details>
+
+<details>
+  <summary>single DOM elements if passed as parameters</summary>
+  For tests that only operate on single DOM elements rather than a whole page, creating these elements is cheaper than loading a whole HTML fixture.
+</details>
+
+<details>
+  <summary>all server requests</summary>
+  When running frontend unit tests, the backend may not be reachable.
+  Therefore all outgoing requests need to be mocked.
+</details>
+
+<details>
+  <summary>asynchronous background operations</summary>
+  Background operations cannot be stopped or waited on, so they will continue running in the following tests and cause side effects.
+</details>
+
+#### What *not* to mock in unit tests
+
+<details>
+  <summary>non-exported functions or classes</summary>
+  Everything that is not exported can be considered private to the module and will be implicitly tested via the exported classes / functions.
+</details>
+
+<details>
+  <summary>methods of the class under test</summary>
+  By mocking methods of the class under test, the mocks will be tested and not the real methods.
+</details>
+
+<details>
+  <summary>utility functions (pure functions, or those that only modify parameters)</summary>
+  If a function has no side effects because it has no state, it is safe to not mock it in tests.
+</details>
+
+<details>
+  <summary>full HTML pages</summary>
+  Loading the HTML of a full page slows down tests, so it should be avoided in unit tests.
+</details>
+
+### Frontend component tests
+
+Component tests cover the state of a single component that is perceivable by a user depending on external signals such as user input, events fired from other components, or application state.
+
+#### When to use component tests
+
+- Vue components
+
+#### When *not* to use component tests
+
+<details>
+  <summary>Vue applications</summary>
+  Vue applications may contain many components.
+  Testing them on a component level requires too much effort.
+  Therefore they are tested on frontend integration level.
+</details>
+
+<details>
+  <summary>HAML templates</summary>
+  HAML templates contain only Markup and no frontend-side logic.
+  Therefore they are not complete components.
+</details>
+
+#### What to mock in component tests
+
+<details>
+  <summary>DOM</summary>
+  Operating on the real DOM is significantly slower than on the virtual DOM.
+</details>
+
+<details>
+  <summary>properties and state of the component under test</summary>
+  Similarly to testing classes, modifying the properties directly (rather than relying on methods of the component) avoids side-effects.
+</details>
+
+<details>
+  <summary>Vuex store</summary>
+  To avoid side effects and keep component tests simple, Vuex stores are replaced with mocks.
+</details>
+
+<details>
+  <summary>all server requests</summary>
+  Similar to unit tests, when running component tests, the backend may not be reachable.
+  Therefore all outgoing requests need to be mocked.
+</details>
+
+<details>
+  <summary>asynchronous background operations</summary>
+  Similar to unit tests, background operations cannot be stopped or waited on, so they will continue running in the following tests and cause side effects.
+</details>
+
+<details>
+  <summary>child components</summary>
+  Every component is tested individually, so child components are mocked.
+  See also <a href="https://vue-test-utils.vuejs.org/api/#shallowmount">shallowMount()</a>
+</details>
+
+#### What *not* to mock in component tests
+
+<details>
+  <summary>methods or computed properties of the component under test</summary>
+  By mocking part of the component under test, the mocks will be tested and not the real component.
+</details>
+
+<details>
+  <summary>functions and classes independent from Vue</summary>
+  All plain JavaScript code is already covered by unit tests and needs not to be mocked in component tests.
+</details>
+
+### Frontend integration tests
+
+Integration tests cover the interaction between all components on a single page.
+Their abstraction level is comparable to how a user would interact with the UI.
+
+#### When to use integration tests
+
+<details>
+  <summary>page bundles (<code>index.js</code> files in <code>app/assets/javascripts/pages/</code>)</summary>
+  Testing the page bundles ensures the corresponding frontend components integrate well.
+</details>
+
+<details>
+  <summary>Vue applications outside of page bundles</summary>
+  Testing Vue applications as a whole ensures the corresponding frontend components integrate well.
+</details>
+
+#### What to mock in integration tests
+
+<details>
+  <summary>HAML views (use fixtures instead)</summary>
+  Rendering HAML views requires a Rails environment including a running database which we cannot rely on in frontend tests.
+</details>
+
+<details>
+  <summary>all server requests</summary>
+  Similar to unit and component tests, when running component tests, the backend may not be reachable.
+  Therefore all outgoing requests need to be mocked.
+</details>
+
+<details>
+  <summary>asynchronous background operations that are not perceivable on the page</summary>
+  Background operations that affect the page need to be tested on this level.
+  All other background operations cannot be stopped or waited on, so they will continue running in the following tests and cause side effects.
+</details>
+
+#### What *not* to mock in integration tests
+
+<details>
+  <summary>DOM</summary>
+  Testing on the real DOM ensures our components work in the environment they are meant for.
+  Part of this will be delegated to <a href="https://gitlab.com/gitlab-org/quality/team-tasks/issues/45">cross-browser testing</a>.
+</details>
+
+<details>
+  <summary>properties or state of components</summary>
+  On this level, all tests can only perform actions a user would do.
+  For example to change the state of a component, a click event would be fired.
+</details>
+
+<details>
+  <summary>Vuex stores</summary>
+  When testing the frontend code of a page as a whole, the interaction between Vue components and Vuex stores is covered as well.
+</details>
+
+### Feature tests
+
+In contrast to [frontend integration tests](#frontend-integration-tests), feature tests make requests against the real backend instead of using fixtures.
+This also implies that database queries are executed which makes this category significantly slower.
+
+See also the [RSpec testing guidelines](../testing_guide/best_practices.md#rspec).
+
+#### When to use feature tests
+
+- Use cases that require a backend and cannot be tested using fixtures.
+- Behavior that is not part of a page bundle but defined globally.
+
+#### Relevant notes
+
+A `:js` flag is added to the test to make sure the full environment is loaded.
+
+```js
+scenario 'successfully', :js do
+  sign_in(create(:admin))
+end
+```
+
+The steps of each test are written using capybara methods ([documentation](https://www.rubydoc.info/gems/capybara)).
+
+Bear in mind <abbr title="XMLHttpRequest">XHR</abbr> calls might require you to use `wait_for_requests` in between steps, like so:
+
+```rspec
+find('.form-control').native.send_keys(:enter)
+
+wait_for_requests
+
+expect(page).not_to have_selector('.card')
+```
+
+## Test helpers
+
+### Vuex Helper: `testAction`
+
+We have a helper available to make testing actions easier, as per [official documentation](https://vuex.vuejs.org/guide/testing.html):
+
+```js
+testAction(
+  actions.actionName, // action
+  { }, // params to be passed to action
+  state, // state
+  [
+    { type: types.MUTATION},
+    { type: types.MUTATION_1, payload: {}},
+  ], // mutations committed
+  [
+    { type: 'actionName', payload: {}},
+    { type: 'actionName1', payload: {}},
+  ] // actions dispatched
+  done,
+);
+```
+
+Check an example in [spec/javascripts/ide/stores/actions_spec.jsspec/javascripts/ide/stores/actions_spec.js](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/spec/javascripts/ide/stores/actions_spec.js).
+
+### Vue Helper: `mountComponent`
+
+To make mounting a Vue component easier and more readable, we have a few helpers available in `spec/helpers/vue_mount_component_helper`:
+
+- `createComponentWithStore`
+- `mountComponentWithStore`
+
+Examples of usage:
+
+```js
+beforeEach(() => {
+  vm = createComponentWithStore(Component, store);
+
+  vm.$store.state.currentBranchId = 'master';
+
+  vm.$mount();
+});
+```
+
+```js
+beforeEach(() => {
+  vm = mountComponentWithStore(Component, {
+    el: '#dummy-element',
+    store,
+    props: { badge },
+  });
+});
+```
+
+Don't forget to clean up:
+
+```js
+afterEach(() => {
+  vm.$destroy();
+});
+```
+
+## Testing with older browsers
+
+Some regressions only affect a specific browser version. We can install and test in particular browsers with either Firefox or Browserstack using the following steps:
+
+### Browserstack
+
+[Browserstack](https://www.browserstack.com/) allows you to test more than 1200 mobile devices and browsers.
+You can use it directly through the [live app](https://www.browserstack.com/live) or you can install the [chrome extension](https://chrome.google.com/webstore/detail/browserstack/nkihdmlheodkdfojglpcjjmioefjahjb) for easy access.
+You can find the credentials on 1Password, under `frontendteam@gitlab.com`.
+
+### Firefox
+
+#### macOS
+
+You can download any older version of Firefox from the releases FTP server, <https://ftp.mozilla.org/pub/firefox/releases/>:
+
+1. From the website, select a version, in this case `50.0.1`.
+1. Go to the mac folder.
+1. Select your preferred language, you will find the dmg package inside, download it.
+1. Drag and drop the application to any other folder but the `Applications` folder.
+1. Rename the application to something like `Firefox_Old`.
+1. Move the application to the `Applications` folder.
+1. Open up a terminal and run `/Applications/Firefox_Old.app/Contents/MacOS/firefox-bin -profilemanager` to create a new profile specific to that Firefox version.
+1. Once the profile has been created, quit the app, and run it again like normal. You now have a working older Firefox version.
+
 ---
 
 [Return to Testing documentation](index.md)
-- 
cgit v1.2.1


From 179955e8ce8c4495a5484384d37df64184971634 Mon Sep 17 00:00:00 2001
From: Sanad Liaquat <sliaquat@gitlab.com>
Date: Tue, 20 Aug 2019 07:30:27 +0500
Subject: Match space or newline after username

---
 .../features/browser_ui/1_manage/project/add_project_member_spec.rb     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qa/qa/specs/features/browser_ui/1_manage/project/add_project_member_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/project/add_project_member_spec.rb
index d859ee8e96a..1c1f552e224 100644
--- a/qa/qa/specs/features/browser_ui/1_manage/project/add_project_member_spec.rb
+++ b/qa/qa/specs/features/browser_ui/1_manage/project/add_project_member_spec.rb
@@ -19,7 +19,7 @@ module QA
           page.add_member(user.username)
         end
 
-        expect(page).to have_content(/@#{user.username}\nGiven access/)
+        expect(page).to have_content(/@#{user.username}(\n| )?Given access/)
       end
     end
   end
-- 
cgit v1.2.1


From 09d574f9d6cdf60fa40cd37edd8af5fee62b810d Mon Sep 17 00:00:00 2001
From: Cameron Swords <cswords@gitlab.com>
Date: Wed, 7 Aug 2019 11:16:52 +1000
Subject: Removed security fixtures as they are ee only

These will be moved to the EE codebase.
---
 db/fixtures/development/14_pipelines.rb            |  75 +-
 .../gl-dependency-scanning-report.json             | 422 ---------
 .../deprecated/gl-dependency-scanning-report.json  | 178 ----
 .../deprecated/gl-sast-report.json                 | 964 --------------------
 spec/fixtures/security-reports/feature-branch.zip  | Bin 7140 -> 0 bytes
 .../gl-container-scanning-report.json              |  16 -
 .../feature-branch/gl-dast-report.json             |  40 -
 .../gl-dependency-scanning-report.json             | 181 ----
 .../gl-license-management-report.json              |  42 -
 .../feature-branch/gl-sast-report.json             | 947 --------------------
 spec/fixtures/security-reports/master.zip          | Bin 9413 -> 0 bytes
 .../master/gl-container-scanning-report.json       | 105 ---
 .../security-reports/master/gl-dast-report.json    |  42 -
 .../master/gl-dependency-scanning-report.json      | 181 ----
 .../master/gl-license-management-report.json       | 817 -----------------
 .../security-reports/master/gl-sast-report.json    | 967 ---------------------
 .../gl-dependency-scanning-report.json             | 104 ---
 .../remediations/remediation.patch                 | 180 ----
 .../security-reports/remediations/yarn.lock        | 104 ---
 19 files changed, 1 insertion(+), 5364 deletions(-)
 delete mode 100644 spec/fixtures/security-reports/dependency_list/gl-dependency-scanning-report.json
 delete mode 100644 spec/fixtures/security-reports/deprecated/gl-dependency-scanning-report.json
 delete mode 100644 spec/fixtures/security-reports/deprecated/gl-sast-report.json
 delete mode 100644 spec/fixtures/security-reports/feature-branch.zip
 delete mode 100644 spec/fixtures/security-reports/feature-branch/gl-container-scanning-report.json
 delete mode 100644 spec/fixtures/security-reports/feature-branch/gl-dast-report.json
 delete mode 100644 spec/fixtures/security-reports/feature-branch/gl-dependency-scanning-report.json
 delete mode 100644 spec/fixtures/security-reports/feature-branch/gl-license-management-report.json
 delete mode 100644 spec/fixtures/security-reports/feature-branch/gl-sast-report.json
 delete mode 100644 spec/fixtures/security-reports/master.zip
 delete mode 100644 spec/fixtures/security-reports/master/gl-container-scanning-report.json
 delete mode 100644 spec/fixtures/security-reports/master/gl-dast-report.json
 delete mode 100644 spec/fixtures/security-reports/master/gl-dependency-scanning-report.json
 delete mode 100644 spec/fixtures/security-reports/master/gl-license-management-report.json
 delete mode 100644 spec/fixtures/security-reports/master/gl-sast-report.json
 delete mode 100644 spec/fixtures/security-reports/remediations/gl-dependency-scanning-report.json
 delete mode 100644 spec/fixtures/security-reports/remediations/remediation.patch
 delete mode 100644 spec/fixtures/security-reports/remediations/yarn.lock

diff --git a/db/fixtures/development/14_pipelines.rb b/db/fixtures/development/14_pipelines.rb
index 05bda7d3672..5c8b681fa92 100644
--- a/db/fixtures/development/14_pipelines.rb
+++ b/db/fixtures/development/14_pipelines.rb
@@ -1,7 +1,7 @@
 require './spec/support/sidekiq'
 
 class Gitlab::Seeder::Pipelines
-  STAGES = %w[build test security deploy notify]
+  STAGES = %w[build test deploy notify]
   BUILDS = [
     # build stage
     { name: 'build:linux', stage: 'build', status: :success,
@@ -31,16 +31,6 @@ class Gitlab::Seeder::Pipelines
     { name: 'spinach:osx', stage: 'test', status: :failed, allow_failure: true,
       queued_at: 8.hour.ago, started_at: 8.hour.ago, finished_at: 7.hour.ago },
 
-    # security stage
-    { name: 'dast', stage: 'security', status: :success,
-      queued_at: 8.hour.ago, started_at: 8.hour.ago, finished_at: 7.hour.ago },
-    { name: 'sast', stage: 'security', status: :success,
-      queued_at: 8.hour.ago, started_at: 8.hour.ago, finished_at: 7.hour.ago },
-    { name: 'dependency_scanning', stage: 'security', status: :success,
-      queued_at: 8.hour.ago, started_at: 8.hour.ago, finished_at: 7.hour.ago },
-    { name: 'container_scanning', stage: 'security', status: :success,
-      queued_at: 8.hour.ago, started_at: 8.hour.ago, finished_at: 7.hour.ago },
-
     # deploy stage
     { name: 'staging', stage: 'deploy', environment: 'staging', status_event: :success,
       options: { environment: { action: 'start', on_stop: 'stop staging' } },
@@ -127,11 +117,6 @@ class Gitlab::Seeder::Pipelines
 
       setup_artifacts(build)
       setup_test_reports(build)
-      if build.ref == build.project.default_branch
-        setup_security_reports_file(build)
-      else
-        setup_security_reports_legacy_archive(build)
-      end
       setup_build_log(build)
 
       build.project.environments.
@@ -167,55 +152,6 @@ class Gitlab::Seeder::Pipelines
     end
   end
 
-  def setup_security_reports_file(build)
-    return unless build.stage == "security"
-
-    # we have two sources: master and feature-branch
-    branch_name = build.ref == build.project.default_branch ?
-      'master' : 'feature-branch'
-
-    artifacts_cache_file(security_reports_path(branch_name, build.name)) do |file|
-      build.job_artifacts.build(
-        project: build.project,
-        file_type: build.name,
-        file_format: :raw,
-        file: file)
-    end
-  end
-
-  def setup_security_reports_legacy_archive(build)
-    return unless build.stage == "security"
-
-    # we have two sources: master and feature-branch
-    branch_name = build.ref == build.project.default_branch ?
-      'master' : 'feature-branch'
-
-    artifacts_cache_file(security_reports_archive_path(branch_name)) do |file|
-      build.job_artifacts.build(
-        project: build.project,
-        file_type: :archive,
-        file_format: :zip,
-        file: file)
-    end
-
-    # assign dummy metadata
-    artifacts_cache_file(artifacts_metadata_path) do |file|
-      build.job_artifacts.build(
-        project: build.project,
-        file_type: :metadata,
-        file_format: :gzip,
-        file: file)
-    end
-
-    build.options = {
-      artifacts: {
-        paths: [
-          Ci::JobArtifact::DEFAULT_FILE_NAMES.fetch(build.name.to_sym)
-        ]
-      }
-    }
-  end
-
   def setup_build_log(build)
     if %w(running success failed).include?(build.status)
       build.trace.set(FFaker::Lorem.paragraphs(6).join("\n\n"))
@@ -267,15 +203,6 @@ class Gitlab::Seeder::Pipelines
     Rails.root + 'spec/fixtures/junit/junit.xml.gz'
   end
 
-  def security_reports_archive_path(branch)
-    Rails.root.join('spec', 'fixtures', 'security-reports', branch + '.zip')
-  end
-
-  def security_reports_path(branch, name)
-    file_name = Ci::JobArtifact::DEFAULT_FILE_NAMES.fetch(name.to_sym)
-    Rails.root.join('spec', 'fixtures', 'security-reports', branch, file_name)
-  end
-
   def artifacts_cache_file(file_path)
     file = Tempfile.new("artifacts")
     file.close
diff --git a/spec/fixtures/security-reports/dependency_list/gl-dependency-scanning-report.json b/spec/fixtures/security-reports/dependency_list/gl-dependency-scanning-report.json
deleted file mode 100644
index 8fb66f6652b..00000000000
--- a/spec/fixtures/security-reports/dependency_list/gl-dependency-scanning-report.json
+++ /dev/null
@@ -1,422 +0,0 @@
-{
-  "version": "2.1",
-  "vulnerabilities": [
-    {
-      "category": "dependency_scanning",
-      "name": "Vulnerabilities in libxml2",
-      "message": "Vulnerabilities in libxml2 in nokogiri",
-      "description": "  The version of libxml2 packaged with Nokogiri contains several vulnerabilities.\r\n  Nokogiri has mitigated these issues by upgrading to libxml 2.9.5.\r\n\r\n  It was discovered that a type confusion error existed in libxml2. An\r\n  attacker could use this to specially construct XML data that\r\n  could cause a denial of service or possibly execute arbitrary\r\n  code. (CVE-2017-0663)\r\n\r\n  It was discovered that libxml2 did not properly validate parsed entity\r\n  references. An attacker could use this to specially construct XML\r\n  data that could expose sensitive information. (CVE-2017-7375)\r\n\r\n  It was discovered that a buffer overflow existed in libxml2 when\r\n  handling HTTP redirects. An attacker could use this to specially\r\n  construct XML data that could cause a denial of service or possibly\r\n  execute arbitrary code. (CVE-2017-7376)\r\n\r\n  Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in\r\n  libxml2 when handling elements. An attacker could use this to specially\r\n  construct XML data that could cause a denial of service or possibly\r\n  execute arbitrary code. (CVE-2017-9047)\r\n\r\n  Marcel Böhme and Van-Thuan Pham discovered a buffer overread\r\n  in libxml2 when handling elements. An attacker could use this\r\n  to specially construct XML data that could cause a denial of\r\n  service. (CVE-2017-9048)\r\n\r\n  Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads\r\n  in libxml2 when handling parameter-entity references. An attacker\r\n  could use these to specially construct XML data that could cause a\r\n  denial of service. (CVE-2017-9049, CVE-2017-9050)",
-      "cve": "rails/Gemfile.lock:nokogiri:gemnasium:06565b64-486d-4326-b906-890d9915804d",
-      "severity": "High",
-      "solution": "Upgrade to latest version.",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "rails/Gemfile.lock",
-        "dependency": {
-          "package": {
-            "name": "nokogiri"
-          },
-          "version": "1.8.0"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-06565b64-486d-4326-b906-890d9915804d",
-          "value": "06565b64-486d-4326-b906-890d9915804d",
-          "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
-        },
-        {
-          "type": "usn",
-          "name": "USN-3424-1",
-          "value": "USN-3424-1",
-          "url": "https://usn.ubuntu.com/3424-1/"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://github.com/sparklemotion/nokogiri/issues/1673"
-        }
-      ]
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "Infinite recursion in parameter entities",
-      "message": "Infinite recursion in parameter entities in nokogiri",
-      "description": "libxml2 incorrectly handles certain parameter entities. An attacker can leverage this with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service.",
-      "cve": "rails/Gemfile.lock:nokogiri:gemnasium:6a0d56f6-2441-492a-9b14-edb95ac31919",
-      "severity": "High",
-      "solution": "Upgrade to latest version.",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "rails/Gemfile.lock",
-        "dependency": {
-          "package": {
-            "name": "nokogiri"
-          },
-          "version": "1.8.0"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-6a0d56f6-2441-492a-9b14-edb95ac31919",
-          "value": "6a0d56f6-2441-492a-9b14-edb95ac31919",
-          "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
-        },
-        {
-          "type": "cve",
-          "name": "CVE-2017-16932",
-          "value": "CVE-2017-16932",
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16932"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16932"
-        },
-        {
-          "url": "https://github.com/sparklemotion/nokogiri/issues/1714"
-        },
-        {
-          "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html"
-        },
-        {
-          "url": "https://usn.ubuntu.com/usn/usn-3504-1/"
-        }
-      ]
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "Denial of Service",
-      "message": "Denial of Service in nokogiri",
-      "description": "libxml2 incorrectly handles certain files. An attacker can use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service.\r\n\r\n",
-      "cve": "rails/Gemfile.lock:nokogiri:gemnasium:78658378-bd8f-4d79-81c8-07c419302426",
-      "severity": "Unknown",
-      "solution": "Upgrade to latest version.",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "rails/Gemfile.lock",
-        "dependency": {
-          "package": {
-            "name": "nokogiri"
-          },
-          "version": "1.8.0"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-78658378-bd8f-4d79-81c8-07c419302426",
-          "value": "78658378-bd8f-4d79-81c8-07c419302426",
-          "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
-        },
-        {
-          "type": "cve",
-          "name": "CVE-2017-15412",
-          "value": "CVE-2017-15412",
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412"
-        },
-        {
-          "url": "https://github.com/sparklemotion/nokogiri/issues/1714"
-        },
-        {
-          "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html"
-        }
-      ]
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "Bypass of a protection mechanism in libxslt",
-      "message": "Bypass of a protection mechanism in libxslt in nokogiri",
-      "description": "libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded. Vendored version of libxslt has been patched to remediate this vulnerability. Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt.",
-      "cve": "rails/Gemfile.lock:nokogiri:gemnasium:1a2e2e6e-67ba-4142-bfa1-3391f5416e4c",
-      "severity": "Unknown",
-      "solution": "Upgrade to latest version if using vendored version of libxslt OR update the system library libxslt to a fixed version",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "rails/Gemfile.lock",
-        "dependency": {
-          "package": {
-            "name": "nokogiri"
-          },
-          "version": "1.8.0"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-1a2e2e6e-67ba-4142-bfa1-3391f5416e4c",
-          "value": "1a2e2e6e-67ba-4142-bfa1-3391f5416e4c",
-          "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
-        },
-        {
-          "type": "cve",
-          "name": "CVE-2019-11068",
-          "value": "CVE-2019-11068",
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068"
-        },
-        {
-          "url": "https://github.com/sparklemotion/nokogiri/issues/1892"
-        },
-        {
-          "url": "https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068"
-        },
-        {
-          "url": "https://security-tracker.debian.org/tracker/CVE-2019-11068"
-        }
-      ]
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "Regular Expression Denial of Service",
-      "message": "Regular Expression Denial of Service in debug",
-      "description": "The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.",
-      "cve": "yarn/yarn.lock:debug:gemnasium:37283ed4-0380-40d7-ada7-2d994afcc62a",
-      "severity": "Unknown",
-      "solution": "Upgrade to latest versions.",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "yarn/yarn.lock",
-        "dependency": {
-          "package": {
-            "name": "debug"
-          },
-          "version": "1.0.5"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-37283ed4-0380-40d7-ada7-2d994afcc62a",
-          "value": "37283ed4-0380-40d7-ada7-2d994afcc62a",
-          "url": "https://deps.sec.gitlab.com/packages/npm/debug/versions/1.0.5/advisories"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://github.com/visionmedia/debug/issues/501"
-        },
-        {
-          "url": "https://github.com/visionmedia/debug/pull/504"
-        },
-        {
-          "url": "https://nodesecurity.io/advisories/534"
-        }
-      ]
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "Authentication bypass via incorrect DOM traversal and canonicalization",
-      "message": "Authentication bypass via incorrect DOM traversal and canonicalization in saml2-js",
-      "description": "Some XML DOM traversal and canonicalization APIs may be inconsistent in handling of comments within XML nodes. Incorrect use of these APIs by some SAML libraries results in incorrect parsing of the inner text of XML nodes such that any inner text after the comment is lost prior to cryptographically signing the SAML message. Text after the comment therefore has no impact on the signature on the SAML message.\r\n\r\nA remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider.",
-      "cve": "yarn/yarn.lock:saml2-js:gemnasium:9952e574-7b5b-46fa-a270-aeb694198a98",
-      "severity": "Unknown",
-      "solution": "Upgrade to fixed version.\r\n",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "yarn/yarn.lock",
-        "dependency": {
-          "package": {
-            "name": "saml2-js"
-          },
-          "version": "1.5.0"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-9952e574-7b5b-46fa-a270-aeb694198a98",
-          "value": "9952e574-7b5b-46fa-a270-aeb694198a98",
-          "url": "https://deps.sec.gitlab.com/packages/npm/saml2-js/versions/1.5.0/advisories"
-        },
-        {
-          "type": "cve",
-          "name": "CVE-2017-11429",
-          "value": "CVE-2017-11429",
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11429"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://github.com/Clever/saml2/commit/3546cb61fd541f219abda364c5b919633609ef3d#diff-af730f9f738de1c9ad87596df3f6de84R279"
-        },
-        {
-          "url": "https://github.com/Clever/saml2/issues/127"
-        },
-        {
-          "url": "https://www.kb.cert.org/vuls/id/475445"
-        }
-      ]
-    }
-  ],
-  "remediations": [],
-  "dependency_files": [
-    {
-      "path": "rails/Gemfile.lock",
-      "package_manager": "bundler",
-      "dependencies": [
-        {
-          "package": {
-            "name": "mini_portile2"
-          },
-          "version": "2.2.0"
-        },
-        {
-          "package": {
-            "name": "nokogiri"
-          },
-          "version": "1.8.0"
-        }
-      ]
-    },
-    {
-      "path": "yarn/yarn.lock",
-      "package_manager": "yarn",
-      "dependencies": [
-        {
-          "package": {
-            "name": "async"
-          },
-          "version": "0.2.10"
-        },
-        {
-          "package": {
-            "name": "async"
-          },
-          "version": "1.5.2"
-        },
-        {
-          "package": {
-            "name": "debug"
-          },
-          "version": "1.0.5"
-        },
-        {
-          "package": {
-            "name": "ejs"
-          },
-          "version": "0.8.8"
-        },
-        {
-          "package": {
-            "name": "ms"
-          },
-          "version": "2.0.0"
-        },
-        {
-          "package": {
-            "name": "node-forge"
-          },
-          "version": "0.2.24"
-        },
-        {
-          "package": {
-            "name": "saml2-js"
-          },
-          "version": "1.5.0"
-        },
-        {
-          "package": {
-            "name": "sax"
-          },
-          "version": "1.2.4"
-        },
-        {
-          "package": {
-            "name": "underscore"
-          },
-          "version": "1.9.1"
-        },
-        {
-          "package": {
-            "name": "underscore"
-          },
-          "version": "1.6.0"
-        },
-        {
-          "package": {
-            "name": "xml-crypto"
-          },
-          "version": "0.8.5"
-        },
-        {
-          "package": {
-            "name": "xml-encryption"
-          },
-          "version": "0.7.4"
-        },
-        {
-          "package": {
-            "name": "xml2js"
-          },
-          "version": "0.4.19"
-        },
-        {
-          "package": {
-            "name": "xmlbuilder"
-          },
-          "version": "2.1.0"
-        },
-        {
-          "package": {
-            "name": "xmlbuilder"
-          },
-          "version": "9.0.7"
-        },
-        {
-          "package": {
-            "name": "xmldom"
-          },
-          "version": "0.1.19"
-        },
-        {
-          "package": {
-            "name": "xmldom"
-          },
-          "version": "0.1.27"
-        },
-        {
-          "package": {
-            "name": "xpath.js"
-          },
-          "version": "1.1.0"
-        },
-        {
-          "package": {
-            "name": "xpath"
-          },
-          "version": "0.0.5"
-        }
-      ]
-    }
-  ]
-}
diff --git a/spec/fixtures/security-reports/deprecated/gl-dependency-scanning-report.json b/spec/fixtures/security-reports/deprecated/gl-dependency-scanning-report.json
deleted file mode 100644
index ce66f562175..00000000000
--- a/spec/fixtures/security-reports/deprecated/gl-dependency-scanning-report.json
+++ /dev/null
@@ -1,178 +0,0 @@
-[
-  {
-    "category": "dependency_scanning",
-    "name": "io.netty/netty - CVE-2014-3488",
-    "message": "DoS by CPU exhaustion when using malicious SSL packets",
-    "cve": "app/pom.xml:io.netty/netty@3.9.1.Final:CVE-2014-3488",
-    "severity": "Unknown",
-    "solution": "Upgrade to the latest version",
-    "scanner": {
-      "id": "gemnasium",
-      "name": "Gemnasium"
-    },
-    "location": {
-      "file": "app/pom.xml",
-      "dependency": {
-        "package": {
-          "name": "io.netty/netty"
-        },
-        "version": "3.9.1.Final"
-      }
-    },
-    "identifiers": [
-      {
-        "type": "gemnasium",
-        "name": "Gemnasium-d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
-        "value": "d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
-        "url": "https://deps.sec.gitlab.com/packages/maven/io.netty/netty/versions/3.9.1.Final/advisories"
-      },
-      {
-        "type": "cve",
-        "name": "CVE-2014-3488",
-        "value": "CVE-2014-3488",
-        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3488"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://bugzilla.redhat.com/CVE-2014-3488"
-      },
-      {
-        "url": "http://netty.io/news/2014/06/11/3.html"
-      },
-      {
-        "url": "https://github.com/netty/netty/issues/2562"
-      }
-    ],
-    "priority": "Unknown",
-    "file": "app/pom.xml",
-    "url": "https://bugzilla.redhat.com/CVE-2014-3488",
-    "tool": "gemnasium"
-  },
-  {
-    "category": "dependency_scanning",
-    "name": "Django - CVE-2017-12794",
-    "message": "Possible XSS in traceback section of technical 500 debug page",
-    "cve": "app/requirements.txt:Django@1.11.3:CVE-2017-12794",
-    "severity": "Unknown",
-    "solution": "Upgrade to latest version or apply patch.",
-    "scanner": {
-      "id": "gemnasium",
-      "name": "Gemnasium"
-    },
-    "location": {
-      "file": "app/requirements.txt",
-      "dependency": {
-        "package": {
-          "name": "Django"
-        },
-        "version": "1.11.3"
-      }
-    },
-    "identifiers": [
-      {
-        "type": "gemnasium",
-        "name": "Gemnasium-6162a015-8635-4a15-8d7c-dc9321db366f",
-        "value": "6162a015-8635-4a15-8d7c-dc9321db366f",
-        "url": "https://deps.sec.gitlab.com/packages/pypi/Django/versions/1.11.3/advisories"
-      },
-      {
-        "type": "cve",
-        "name": "CVE-2017-12794",
-        "value": "CVE-2017-12794",
-        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12794"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/"
-      }
-    ],
-    "priority": "Unknown",
-    "file": "app/requirements.txt",
-    "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/",
-    "tool": "gemnasium"
-  },
-  {
-    "category": "dependency_scanning",
-    "name": "nokogiri - USN-3424-1",
-    "message": "Vulnerabilities in libxml2",
-    "cve": "rails/Gemfile.lock:nokogiri@1.8.0:USN-3424-1",
-    "severity": "Unknown",
-    "solution": "Upgrade to latest version.",
-    "scanner": {
-      "id": "gemnasium",
-      "name": "Gemnasium"
-    },
-    "location": {
-      "file": "rails/Gemfile.lock",
-      "dependency": {
-        "package": {
-          "name": "nokogiri"
-        },
-        "version": "1.8.0"
-      }
-    },
-    "identifiers": [
-      {
-        "type": "gemnasium",
-        "name": "Gemnasium-06565b64-486d-4326-b906-890d9915804d",
-        "value": "06565b64-486d-4326-b906-890d9915804d",
-        "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
-      },
-      {
-        "type": "usn",
-        "name": "USN-3424-1",
-        "value": "USN-3424-1",
-        "url": "https://usn.ubuntu.com/3424-1/"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://github.com/sparklemotion/nokogiri/issues/1673"
-      }
-    ],
-    "priority": "Unknown",
-    "file": "rails/Gemfile.lock",
-    "url": "https://github.com/sparklemotion/nokogiri/issues/1673",
-    "tool": "gemnasium"
-  },
-  {
-    "category": "dependency_scanning",
-    "name": "ffi - CVE-2018-1000201",
-    "message": "ruby-ffi DDL loading issue on Windows OS",
-    "cve": "ffi:1.9.18:CVE-2018-1000201",
-    "severity": "High",
-    "solution": "upgrade to \u003e= 1.9.24",
-    "scanner": {
-      "id": "bundler_audit",
-      "name": "bundler-audit"
-    },
-    "location": {
-      "file": "sast-sample-rails/Gemfile.lock",
-      "dependency": {
-        "package": {
-          "name": "ffi"
-        },
-        "version": "1.9.18"
-      }
-    },
-    "identifiers": [
-      {
-        "type": "cve",
-        "name": "CVE-2018-1000201",
-        "value": "CVE-2018-1000201",
-        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000201"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://github.com/ffi/ffi/releases/tag/1.9.24"
-      }
-    ],
-    "priority": "High",
-    "file": "sast-sample-rails/Gemfile.lock",
-    "url": "https://github.com/ffi/ffi/releases/tag/1.9.24",
-    "tool": "bundler_audit"
-  }
-]
diff --git a/spec/fixtures/security-reports/deprecated/gl-sast-report.json b/spec/fixtures/security-reports/deprecated/gl-sast-report.json
deleted file mode 100644
index 2f7e47281e2..00000000000
--- a/spec/fixtures/security-reports/deprecated/gl-sast-report.json
+++ /dev/null
@@ -1,964 +0,0 @@
-[
-  {
-    "category": "sast",
-    "message": "Probable insecure usage of temp file/directory.",
-    "cve": "python/hardcoded/hardcoded-tmp.py:52865813c884a507be1f152d654245af34aba8a391626d01f1ab6d3f52ec8779:B108",
-    "severity": "Medium",
-    "confidence": "Medium",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "start_line": 1,
-      "end_line": 1
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B108",
-        "value": "B108",
-        "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-      }
-    ],
-    "priority": "Medium",
-    "file": "python/hardcoded/hardcoded-tmp.py",
-    "line": 1,
-    "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "name": "Predictable pseudorandom number generator",
-    "message": "Predictable pseudorandom number generator",
-    "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:47:PREDICTABLE_RANDOM",
-    "severity": "Medium",
-    "confidence": "Medium",
-    "scanner": {
-      "id": "find_sec_bugs",
-      "name": "Find Security Bugs"
-    },
-    "location": {
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "start_line": 47,
-      "end_line": 47,
-      "class": "com.gitlab.security_products.tests.App",
-      "method": "generateSecretToken2"
-    },
-    "identifiers": [
-      {
-        "type": "find_sec_bugs_type",
-        "name": "Find Security Bugs-PREDICTABLE_RANDOM",
-        "value": "PREDICTABLE_RANDOM",
-        "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM"
-      }
-    ],
-    "priority": "Medium",
-    "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-    "line": 47,
-    "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM",
-    "tool": "find_sec_bugs"
-  },
-  {
-    "category": "sast",
-    "name": "Predictable pseudorandom number generator",
-    "message": "Predictable pseudorandom number generator",
-    "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:41:PREDICTABLE_RANDOM",
-    "severity": "Medium",
-    "confidence": "Medium",
-    "scanner": {
-      "id": "find_sec_bugs",
-      "name": "Find Security Bugs"
-    },
-    "location": {
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "start_line": 41,
-      "end_line": 41,
-      "class": "com.gitlab.security_products.tests.App",
-      "method": "generateSecretToken1"
-    },
-    "identifiers": [
-      {
-        "type": "find_sec_bugs_type",
-        "name": "Find Security Bugs-PREDICTABLE_RANDOM",
-        "value": "PREDICTABLE_RANDOM",
-        "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM"
-      }
-    ],
-    "priority": "Medium",
-    "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-    "line": 41,
-    "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM",
-    "tool": "find_sec_bugs"
-  },
-  {
-    "category": "sast",
-    "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-    "cve": "python/imports/imports-aliases.py:cb203b465dffb0cb3a8e8bd8910b84b93b0a5995a938e4b903dbb0cd6ffa1254:B303",
-    "severity": "Medium",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-aliases.py",
-      "start_line": 11,
-      "end_line": 11
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B303",
-        "value": "B303"
-      }
-    ],
-    "priority": "Medium",
-    "file": "python/imports/imports-aliases.py",
-    "line": 11,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-    "cve": "python/imports/imports-aliases.py:a7173c43ae66bd07466632d819d450e0071e02dbf782763640d1092981f9631b:B303",
-    "severity": "Medium",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-aliases.py",
-      "start_line": 12,
-      "end_line": 12
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B303",
-        "value": "B303"
-      }
-    ],
-    "priority": "Medium",
-    "file": "python/imports/imports-aliases.py",
-    "line": 12,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-    "cve": "python/imports/imports-aliases.py:017017b77deb0b8369b6065947833eeea752a92ec8a700db590fece3e934cf0d:B303",
-    "severity": "Medium",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-aliases.py",
-      "start_line": 13,
-      "end_line": 13
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B303",
-        "value": "B303"
-      }
-    ],
-    "priority": "Medium",
-    "file": "python/imports/imports-aliases.py",
-    "line": 13,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-    "cve": "python/imports/imports-aliases.py:45fc8c53aea7b84f06bc4e590cc667678d6073c4c8a1d471177ca2146fb22db2:B303",
-    "severity": "Medium",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-aliases.py",
-      "start_line": 14,
-      "end_line": 14
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B303",
-        "value": "B303"
-      }
-    ],
-    "priority": "Medium",
-    "file": "python/imports/imports-aliases.py",
-    "line": 14,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Pickle library appears to be in use, possible security issue.",
-    "cve": "python/imports/imports-aliases.py:5f200d47291e7bbd8352db23019b85453ca048dd98ea0c291260fa7d009963a4:B301",
-    "severity": "Medium",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-aliases.py",
-      "start_line": 15,
-      "end_line": 15
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B301",
-        "value": "B301"
-      }
-    ],
-    "priority": "Medium",
-    "file": "python/imports/imports-aliases.py",
-    "line": 15,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "name": "ECB mode is insecure",
-    "message": "ECB mode is insecure",
-    "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:29:ECB_MODE",
-    "severity": "Medium",
-    "confidence": "High",
-    "scanner": {
-      "id": "find_sec_bugs",
-      "name": "Find Security Bugs"
-    },
-    "location": {
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "start_line": 29,
-      "end_line": 29,
-      "class": "com.gitlab.security_products.tests.App",
-      "method": "insecureCypher"
-    },
-    "identifiers": [
-      {
-        "type": "find_sec_bugs_type",
-        "name": "Find Security Bugs-ECB_MODE",
-        "value": "ECB_MODE",
-        "url": "https://find-sec-bugs.github.io/bugs.htm#ECB_MODE"
-      }
-    ],
-    "priority": "Medium",
-    "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-    "line": 29,
-    "url": "https://find-sec-bugs.github.io/bugs.htm#ECB_MODE",
-    "tool": "find_sec_bugs"
-  },
-  {
-    "category": "sast",
-    "name": "Cipher with no integrity",
-    "message": "Cipher with no integrity",
-    "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:29:CIPHER_INTEGRITY",
-    "severity": "Medium",
-    "confidence": "High",
-    "scanner": {
-      "id": "find_sec_bugs",
-      "name": "Find Security Bugs"
-    },
-    "location": {
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "start_line": 29,
-      "end_line": 29,
-      "class": "com.gitlab.security_products.tests.App",
-      "method": "insecureCypher"
-    },
-    "identifiers": [
-      {
-        "type": "find_sec_bugs_type",
-        "name": "Find Security Bugs-CIPHER_INTEGRITY",
-        "value": "CIPHER_INTEGRITY",
-        "url": "https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY"
-      }
-    ],
-    "priority": "Medium",
-    "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-    "line": 29,
-    "url": "https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY",
-    "tool": "find_sec_bugs"
-  },
-  {
-    "category": "sast",
-    "message": "Probable insecure usage of temp file/directory.",
-    "cve": "python/hardcoded/hardcoded-tmp.py:63dd4d626855555b816985d82c4614a790462a0a3ada89dc58eb97f9c50f3077:B108",
-    "severity": "Medium",
-    "confidence": "Medium",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "start_line": 14,
-      "end_line": 14
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B108",
-        "value": "B108",
-        "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-      }
-    ],
-    "priority": "Medium",
-    "file": "python/hardcoded/hardcoded-tmp.py",
-    "line": 14,
-    "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Probable insecure usage of temp file/directory.",
-    "cve": "python/hardcoded/hardcoded-tmp.py:4ad6d4c40a8c263fc265f3384724014e0a4f8dd6200af83e51ff120420038031:B108",
-    "severity": "Medium",
-    "confidence": "Medium",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "start_line": 10,
-      "end_line": 10
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B108",
-        "value": "B108",
-        "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-      }
-    ],
-    "priority": "Medium",
-    "file": "python/hardcoded/hardcoded-tmp.py",
-    "line": 10,
-    "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Consider possible security implications associated with Popen module.",
-    "cve": "python/imports/imports-aliases.py:2c3e1fa1e54c3c6646e8bcfaee2518153c6799b77587ff8d9a7b0631f6d34785:B404",
-    "severity": "Low",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-aliases.py",
-      "start_line": 1,
-      "end_line": 1
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B404",
-        "value": "B404"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/imports/imports-aliases.py",
-    "line": 1,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Consider possible security implications associated with pickle module.",
-    "cve": "python/imports/imports.py:af58d07f6ad519ef5287fcae65bf1a6999448a1a3a8bc1ac2a11daa80d0b96bf:B403",
-    "severity": "Low",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports.py",
-      "start_line": 2,
-      "end_line": 2
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B403",
-        "value": "B403"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/imports/imports.py",
-    "line": 2,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Consider possible security implications associated with subprocess module.",
-    "cve": "python/imports/imports.py:8de9bc98029d212db530785a5f6780cfa663548746ff228ab8fa96c5bb82f089:B404",
-    "severity": "Low",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports.py",
-      "start_line": 4,
-      "end_line": 4
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B404",
-        "value": "B404"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/imports/imports.py",
-    "line": 4,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Possible hardcoded password: 'blerg'",
-    "cve": "python/hardcoded/hardcoded-passwords.py:97c30f1d76d2a88913e3ce9ae74087874d740f87de8af697a9c455f01119f633:B106",
-    "severity": "Low",
-    "confidence": "Medium",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "start_line": 22,
-      "end_line": 22
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B106",
-        "value": "B106",
-        "url": "https://docs.openstack.org/bandit/latest/plugins/b106_hardcoded_password_funcarg.html"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/hardcoded/hardcoded-passwords.py",
-    "line": 22,
-    "url": "https://docs.openstack.org/bandit/latest/plugins/b106_hardcoded_password_funcarg.html",
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Possible hardcoded password: 'root'",
-    "cve": "python/hardcoded/hardcoded-passwords.py:7431c73a0bc16d94ece2a2e75ef38f302574d42c37ac0c3c38ad0b3bf8a59f10:B105",
-    "severity": "Low",
-    "confidence": "Medium",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "start_line": 5,
-      "end_line": 5
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B105",
-        "value": "B105",
-        "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/hardcoded/hardcoded-passwords.py",
-    "line": 5,
-    "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Possible hardcoded password: ''",
-    "cve": "python/hardcoded/hardcoded-passwords.py:d2d1857c27caedd49c57bfbcdc23afcc92bd66a22701fcdc632869aab4ca73ee:B105",
-    "severity": "Low",
-    "confidence": "Medium",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "start_line": 9,
-      "end_line": 9
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B105",
-        "value": "B105",
-        "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/hardcoded/hardcoded-passwords.py",
-    "line": 9,
-    "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Possible hardcoded password: 'ajklawejrkl42348swfgkg'",
-    "cve": "python/hardcoded/hardcoded-passwords.py:fb3866215a61393a5c9c32a3b60e2058171a23219c353f722cbd3567acab21d2:B105",
-    "severity": "Low",
-    "confidence": "Medium",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "start_line": 13,
-      "end_line": 13
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B105",
-        "value": "B105",
-        "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/hardcoded/hardcoded-passwords.py",
-    "line": 13,
-    "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Possible hardcoded password: 'blerg'",
-    "cve": "python/hardcoded/hardcoded-passwords.py:63c62a8b7e1e5224439bd26b28030585ac48741e28ca64561a6071080c560a5f:B105",
-    "severity": "Low",
-    "confidence": "Medium",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "start_line": 23,
-      "end_line": 23
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B105",
-        "value": "B105",
-        "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/hardcoded/hardcoded-passwords.py",
-    "line": 23,
-    "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Possible hardcoded password: 'blerg'",
-    "cve": "python/hardcoded/hardcoded-passwords.py:4311b06d08df8fa58229b341c531da8e1a31ec4520597bdff920cd5c098d86f9:B105",
-    "severity": "Low",
-    "confidence": "Medium",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "start_line": 24,
-      "end_line": 24
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B105",
-        "value": "B105",
-        "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/hardcoded/hardcoded-passwords.py",
-    "line": 24,
-    "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Consider possible security implications associated with subprocess module.",
-    "cve": "python/imports/imports-function.py:5858400c2f39047787702de44d03361ef8d954c9d14bd54ee1c2bef9e6a7df93:B404",
-    "severity": "Low",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-function.py",
-      "start_line": 4,
-      "end_line": 4
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B404",
-        "value": "B404"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/imports/imports-function.py",
-    "line": 4,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Consider possible security implications associated with pickle module.",
-    "cve": "python/imports/imports-function.py:dbda3cf4190279d30e0aad7dd137eca11272b0b225e8af4e8bf39682da67d956:B403",
-    "severity": "Low",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-function.py",
-      "start_line": 2,
-      "end_line": 2
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B403",
-        "value": "B403"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/imports/imports-function.py",
-    "line": 2,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Consider possible security implications associated with Popen module.",
-    "cve": "python/imports/imports-from.py:eb8a0db9cd1a8c1ab39a77e6025021b1261cc2a0b026b2f4a11fca4e0636d8dd:B404",
-    "severity": "Low",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-from.py",
-      "start_line": 7,
-      "end_line": 7
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B404",
-        "value": "B404"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/imports/imports-from.py",
-    "line": 7,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell",
-    "cve": "python/imports/imports-aliases.py:f99f9721e27537fbcb6699a4cf39c6740d6234d2c6f06cfc2d9ea977313c483d:B602",
-    "severity": "Low",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-aliases.py",
-      "start_line": 9,
-      "end_line": 9
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B602",
-        "value": "B602",
-        "url": "https://docs.openstack.org/bandit/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/imports/imports-aliases.py",
-    "line": 9,
-    "url": "https://docs.openstack.org/bandit/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html",
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Consider possible security implications associated with subprocess module.",
-    "cve": "python/imports/imports-from.py:332a12ab1146698f614a905ce6a6a5401497a12281aef200e80522711c69dcf4:B404",
-    "severity": "Low",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-from.py",
-      "start_line": 6,
-      "end_line": 6
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B404",
-        "value": "B404"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/imports/imports-from.py",
-    "line": 6,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Consider possible security implications associated with Popen module.",
-    "cve": "python/imports/imports-from.py:0a48de4a3d5348853a03666cb574697e3982998355e7a095a798bd02a5947276:B404",
-    "severity": "Low",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-from.py",
-      "start_line": 1,
-      "end_line": 2
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B404",
-        "value": "B404"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/imports/imports-from.py",
-    "line": 1,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Consider possible security implications associated with pickle module.",
-    "cve": "python/imports/imports-aliases.py:51b71661dff994bde3529639a727a678c8f5c4c96f00d300913f6d5be1bbdf26:B403",
-    "severity": "Low",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-aliases.py",
-      "start_line": 7,
-      "end_line": 8
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B403",
-        "value": "B403"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/imports/imports-aliases.py",
-    "line": 7,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Consider possible security implications associated with loads module.",
-    "cve": "python/imports/imports-aliases.py:6ff02aeb3149c01ab68484d794a94f58d5d3e3bb0d58557ef4153644ea68ea54:B403",
-    "severity": "Low",
-    "confidence": "High",
-    "scanner": {
-      "id": "bandit",
-      "name": "Bandit"
-    },
-    "location": {
-      "file": "python/imports/imports-aliases.py",
-      "start_line": 6,
-      "end_line": 6
-    },
-    "identifiers": [
-      {
-        "type": "bandit_test_id",
-        "name": "Bandit Test ID B403",
-        "value": "B403"
-      }
-    ],
-    "priority": "Low",
-    "file": "python/imports/imports-aliases.py",
-    "line": 6,
-    "tool": "bandit"
-  },
-  {
-    "category": "sast",
-    "message": "Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120)",
-    "cve": "c/subdir/utils.c:b466873101951fe96e1332f6728eb7010acbbd5dfc3b65d7d53571d091a06d9e:CWE-119!/CWE-120",
-    "confidence": "Low",
-    "solution": "Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length",
-    "scanner": {
-      "id": "flawfinder",
-      "name": "Flawfinder"
-    },
-    "location": {
-      "file": "c/subdir/utils.c",
-      "start_line": 4
-    },
-    "identifiers": [
-      {
-        "type": "flawfinder_func_name",
-        "name": "Flawfinder - char",
-        "value": "char"
-      },
-      {
-        "type": "cwe",
-        "name": "CWE-119",
-        "value": "119",
-        "url": "https://cwe.mitre.org/data/definitions/119.html"
-      },
-      {
-        "type": "cwe",
-        "name": "CWE-120",
-        "value": "120",
-        "url": "https://cwe.mitre.org/data/definitions/120.html"
-      }
-    ],
-    "file": "c/subdir/utils.c",
-    "line": 4,
-    "url": "https://cwe.mitre.org/data/definitions/119.html",
-    "tool": "flawfinder"
-  },
-  {
-    "category": "sast",
-    "message": "Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362)",
-    "cve": "c/subdir/utils.c:bab681140fcc8fc3085b6bba74081b44ea145c1c98b5e70cf19ace2417d30770:CWE-362",
-    "confidence": "Low",
-    "scanner": {
-      "id": "flawfinder",
-      "name": "Flawfinder"
-    },
-    "location": {
-      "file": "c/subdir/utils.c",
-      "start_line": 8
-    },
-    "identifiers": [
-      {
-        "type": "flawfinder_func_name",
-        "name": "Flawfinder - fopen",
-        "value": "fopen"
-      },
-      {
-        "type": "cwe",
-        "name": "CWE-362",
-        "value": "362",
-        "url": "https://cwe.mitre.org/data/definitions/362.html"
-      }
-    ],
-    "file": "c/subdir/utils.c",
-    "line": 8,
-    "url": "https://cwe.mitre.org/data/definitions/362.html",
-    "tool": "flawfinder"
-  },
-  {
-    "category": "sast",
-    "message": "Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120)",
-    "cve": "cplusplus/src/hello.cpp:c8c6dd0afdae6814194cf0930b719f757ab7b379cf8f261e7f4f9f2f323a818a:CWE-119!/CWE-120",
-    "confidence": "Low",
-    "solution": "Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length",
-    "scanner": {
-      "id": "flawfinder",
-      "name": "Flawfinder"
-    },
-    "location": {
-      "file": "cplusplus/src/hello.cpp",
-      "start_line": 6
-    },
-    "identifiers": [
-      {
-        "type": "flawfinder_func_name",
-        "name": "Flawfinder - char",
-        "value": "char"
-      },
-      {
-        "type": "cwe",
-        "name": "CWE-119",
-        "value": "119",
-        "url": "https://cwe.mitre.org/data/definitions/119.html"
-      },
-      {
-        "type": "cwe",
-        "name": "CWE-120",
-        "value": "120",
-        "url": "https://cwe.mitre.org/data/definitions/120.html"
-      }
-    ],
-    "file": "cplusplus/src/hello.cpp",
-    "line": 6,
-    "url": "https://cwe.mitre.org/data/definitions/119.html",
-    "tool": "flawfinder"
-  },
-  {
-    "category": "sast",
-    "message": "Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120)",
-    "cve": "cplusplus/src/hello.cpp:331c04062c4fe0c7c486f66f59e82ad146ab33cdd76ae757ca41f392d568cbd0:CWE-120",
-    "confidence": "Low",
-    "solution": "Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)",
-    "scanner": {
-      "id": "flawfinder",
-      "name": "Flawfinder"
-    },
-    "location": {
-      "file": "cplusplus/src/hello.cpp",
-      "start_line": 7
-    },
-    "identifiers": [
-      {
-        "type": "flawfinder_func_name",
-        "name": "Flawfinder - strcpy",
-        "value": "strcpy"
-      },
-      {
-        "type": "cwe",
-        "name": "CWE-120",
-        "value": "120",
-        "url": "https://cwe.mitre.org/data/definitions/120.html"
-      }
-    ],
-    "file": "cplusplus/src/hello.cpp",
-    "line": 7,
-    "url": "https://cwe.mitre.org/data/definitions/120.html",
-    "tool": "flawfinder"
-  }
-]
diff --git a/spec/fixtures/security-reports/feature-branch.zip b/spec/fixtures/security-reports/feature-branch.zip
deleted file mode 100644
index dd49f4e9e1d..00000000000
Binary files a/spec/fixtures/security-reports/feature-branch.zip and /dev/null differ
diff --git a/spec/fixtures/security-reports/feature-branch/gl-container-scanning-report.json b/spec/fixtures/security-reports/feature-branch/gl-container-scanning-report.json
deleted file mode 100644
index 6f89d20d4bf..00000000000
--- a/spec/fixtures/security-reports/feature-branch/gl-container-scanning-report.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "image": "registry.gitlab.com/bikebilly/auto-devops-10-6/feature-branch:e7315ba964febb11bac8f5cd6ec433db8a3a1583",
-  "unapproved": ["CVE-2017-15650"],
-  "vulnerabilities": [
-    {
-      "featurename": "musl",
-      "featureversion": "1.1.14-r15",
-      "vulnerability": "CVE-2017-15650",
-      "namespace": "alpine:v3.4",
-      "description": "",
-      "link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15650",
-      "severity": "Medium",
-      "fixedby": "1.1.14-r16"
-    }
-  ]
-}
diff --git a/spec/fixtures/security-reports/feature-branch/gl-dast-report.json b/spec/fixtures/security-reports/feature-branch/gl-dast-report.json
deleted file mode 100644
index 3a308bf047e..00000000000
--- a/spec/fixtures/security-reports/feature-branch/gl-dast-report.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "site": {
-    "alerts": [
-      {
-        "sourceid": "3",
-        "wascid": "15",
-        "cweid": "16",
-        "reference": "<p>http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx</p><p>https://www.owasp.org/index.php/List_of_useful_HTTP_headers</p>",
-        "otherinfo": "<p>This issue still applies to error type pages (401, 403, 500, etc) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.</p><p>At \"High\" threshold this scanner will not alert on client or server error responses.</p>",
-        "solution": "<p>Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.</p>",
-        "count": "2",
-        "pluginid": "10021",
-        "alert": "X-Content-Type-Options Header Missing",
-        "name": "X-Content-Type-Options Header Missing",
-        "riskcode": "1",
-        "confidence": "2",
-        "riskdesc": "Low (Medium)",
-        "desc": "<p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p>",
-        "instances": [
-          {
-            "param": "X-Content-Type-Options",
-            "method": "GET",
-            "uri": "http://bikebilly-spring-auto-devops-review-feature-br-3y2gpb.35.192.176.43.xip.io"
-          },
-          {
-            "param": "X-Content-Type-Options",
-            "method": "GET",
-            "uri": "http://bikebilly-spring-auto-devops-review-feature-br-3y2gpb.35.192.176.43.xip.io/"
-          }
-        ]
-      }
-    ],
-    "@ssl": "false",
-    "@port": "80",
-    "@host": "bikebilly-spring-auto-devops-review-feature-br-3y2gpb.35.192.176.43.xip.io",
-    "@name": "http://bikebilly-spring-auto-devops-review-feature-br-3y2gpb.35.192.176.43.xip.io"
-  },
-  "@generated": "Fri, 13 Apr 2018 09:22:01",
-  "@version": "2.7.0"
-}
diff --git a/spec/fixtures/security-reports/feature-branch/gl-dependency-scanning-report.json b/spec/fixtures/security-reports/feature-branch/gl-dependency-scanning-report.json
deleted file mode 100644
index 8555be6618c..00000000000
--- a/spec/fixtures/security-reports/feature-branch/gl-dependency-scanning-report.json
+++ /dev/null
@@ -1,181 +0,0 @@
-{
-  "version": "1.3",
-  "vulnerabilities": [
-    {
-      "category": "dependency_scanning",
-      "name": "io.netty/netty - CVE-2014-3488",
-      "message": "DoS by CPU exhaustion when using malicious SSL packets",
-      "cve": "app/pom.xml:io.netty/netty@3.9.1.Final:CVE-2014-3488",
-      "severity": "Unknown",
-      "solution": "Upgrade to the latest version",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "app/pom.xml",
-        "dependency": {
-          "package": {
-            "name": "io.netty/netty"
-          },
-          "version": "3.9.1.Final"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
-          "value": "d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
-          "url": "https://deps.sec.gitlab.com/packages/maven/io.netty/netty/versions/3.9.1.Final/advisories"
-        },
-        {
-          "type": "cve",
-          "name": "CVE-2014-3488",
-          "value": "CVE-2014-3488",
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3488"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://bugzilla.redhat.com/CVE-2014-3488"
-        },
-        {
-          "url": "http://netty.io/news/2014/06/11/3.html"
-        },
-        {
-          "url": "https://github.com/netty/netty/issues/2562"
-        }
-      ],
-      "priority": "Unknown",
-      "file": "app/pom.xml",
-      "url": "https://bugzilla.redhat.com/CVE-2014-3488",
-      "tool": "gemnasium"
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "Django - CVE-2017-12794",
-      "message": "Possible XSS in traceback section of technical 500 debug page",
-      "cve": "app/requirements.txt:Django@1.11.3:CVE-2017-12794",
-      "severity": "Unknown",
-      "solution": "Upgrade to latest version or apply patch.",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "app/requirements.txt",
-        "dependency": {
-          "package": {
-            "name": "Django"
-          },
-          "version": "1.11.3"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-6162a015-8635-4a15-8d7c-dc9321db366f",
-          "value": "6162a015-8635-4a15-8d7c-dc9321db366f",
-          "url": "https://deps.sec.gitlab.com/packages/pypi/Django/versions/1.11.3/advisories"
-        },
-        {
-          "type": "cve",
-          "name": "CVE-2017-12794",
-          "value": "CVE-2017-12794",
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12794"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/"
-        }
-      ],
-      "priority": "Unknown",
-      "file": "app/requirements.txt",
-      "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/",
-      "tool": "gemnasium"
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "nokogiri - USN-3424-1",
-      "message": "Vulnerabilities in libxml2",
-      "cve": "rails/Gemfile.lock:nokogiri@1.8.0:USN-3424-1",
-      "severity": "Unknown",
-      "solution": "Upgrade to latest version.",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "rails/Gemfile.lock",
-        "dependency": {
-          "package": {
-            "name": "nokogiri"
-          },
-          "version": "1.8.0"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-06565b64-486d-4326-b906-890d9915804d",
-          "value": "06565b64-486d-4326-b906-890d9915804d",
-          "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
-        },
-        {
-          "type": "usn",
-          "name": "USN-3424-1",
-          "value": "USN-3424-1",
-          "url": "https://usn.ubuntu.com/3424-1/"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://github.com/sparklemotion/nokogiri/issues/1673"
-        }
-      ],
-      "priority": "Unknown",
-      "file": "rails/Gemfile.lock",
-      "url": "https://github.com/sparklemotion/nokogiri/issues/1673",
-      "tool": "gemnasium"
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "ffi - CVE-2018-1000201",
-      "message": "ruby-ffi DDL loading issue on Windows OS",
-      "cve": "ffi:1.9.18:CVE-2018-1000201",
-      "severity": "High",
-      "solution": "upgrade to \u003e= 1.9.24",
-      "scanner": {
-        "id": "bundler_audit",
-        "name": "bundler-audit"
-      },
-      "location": {
-        "file": "sast-sample-rails/Gemfile.lock",
-        "dependency": {
-          "package": {
-            "name": "ffi"
-          },
-          "version": "1.9.18"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "cve",
-          "name": "CVE-2018-1000201",
-          "value": "CVE-2018-1000201",
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000201"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://github.com/ffi/ffi/releases/tag/1.9.24"
-        }
-      ],
-      "priority": "High",
-      "file": "sast-sample-rails/Gemfile.lock",
-      "url": "https://github.com/ffi/ffi/releases/tag/1.9.24",
-      "tool": "bundler_audit"
-    }
-  ]
-}
diff --git a/spec/fixtures/security-reports/feature-branch/gl-license-management-report.json b/spec/fixtures/security-reports/feature-branch/gl-license-management-report.json
deleted file mode 100644
index 5fd81fd69bd..00000000000
--- a/spec/fixtures/security-reports/feature-branch/gl-license-management-report.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-    "licenses": [
-        {
-            "count": 1,
-            "name": "WTFPL"
-        },
-        {
-            "count": 1,
-            "name": "MIT"
-        }
-    ],
-    "dependencies": [
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "actioncable",
-                "url": "http://rubyonrails.org",
-                "description": "WebSocket framework for Rails.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "WTFPL",
-                "url": "http://www.wtfpl.net/"
-            },
-            "dependency": {
-                "name": "wtfpl_init",
-                "url": "https://rubygems.org/gems/wtfpl_init",
-                "description": "Download WTFPL license file and rename to LICENSE.md or something",
-                "pathes": [
-                    "."
-                ]
-            }
-        }
-    ]
-}
diff --git a/spec/fixtures/security-reports/feature-branch/gl-sast-report.json b/spec/fixtures/security-reports/feature-branch/gl-sast-report.json
deleted file mode 100644
index 4bef3d22f70..00000000000
--- a/spec/fixtures/security-reports/feature-branch/gl-sast-report.json
+++ /dev/null
@@ -1,947 +0,0 @@
-{
-  "version": "1.2",
-  "vulnerabilities": [
-    {
-      "category": "sast",
-      "message": "Probable insecure usage of temp file/directory.",
-      "cve": "python/hardcoded/hardcoded-tmp.py:52865813c884a507be1f152d654245af34aba8a391626d01f1ab6d3f52ec8779:B108",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-tmp.py",
-        "start_line": 1,
-        "end_line": 1
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B108",
-          "value": "B108",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "line": 1,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "name": "Predictable pseudorandom number generator",
-      "message": "Predictable pseudorandom number generator",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:47:PREDICTABLE_RANDOM",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 47,
-        "end_line": 47,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "generateSecretToken2"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-PREDICTABLE_RANDOM",
-          "value": "PREDICTABLE_RANDOM",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 47,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "name": "Predictable pseudorandom number generator",
-      "message": "Predictable pseudorandom number generator",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:41:PREDICTABLE_RANDOM",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 41,
-        "end_line": 41,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "generateSecretToken1"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-PREDICTABLE_RANDOM",
-          "value": "PREDICTABLE_RANDOM",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 41,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:cb203b465dffb0cb3a8e8bd8910b84b93b0a5995a938e4b903dbb0cd6ffa1254:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 11,
-        "end_line": 11
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 11,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:a7173c43ae66bd07466632d819d450e0071e02dbf782763640d1092981f9631b:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 12,
-        "end_line": 12
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 12,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:017017b77deb0b8369b6065947833eeea752a92ec8a700db590fece3e934cf0d:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 13,
-        "end_line": 13
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 13,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:45fc8c53aea7b84f06bc4e590cc667678d6073c4c8a1d471177ca2146fb22db2:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 14,
-        "end_line": 14
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 14,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Pickle library appears to be in use, possible security issue.",
-      "cve": "python/imports/imports-aliases.py:5f200d47291e7bbd8352db23019b85453ca048dd98ea0c291260fa7d009963a4:B301",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 15,
-        "end_line": 15
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B301",
-          "value": "B301"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 15,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "name": "ECB mode is insecure",
-      "message": "ECB mode is insecure",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:29:ECB_MODE",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 29,
-        "end_line": 29,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "insecureCypher"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-ECB_MODE",
-          "value": "ECB_MODE",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#ECB_MODE"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 29,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#ECB_MODE",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "name": "Cipher with no integrity",
-      "message": "Cipher with no integrity",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:29:CIPHER_INTEGRITY",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 29,
-        "end_line": 29,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "insecureCypher"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-CIPHER_INTEGRITY",
-          "value": "CIPHER_INTEGRITY",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 29,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "message": "Probable insecure usage of temp file/directory.",
-      "cve": "python/hardcoded/hardcoded-tmp.py:63dd4d626855555b816985d82c4614a790462a0a3ada89dc58eb97f9c50f3077:B108",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-tmp.py",
-        "start_line": 14,
-        "end_line": 14
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B108",
-          "value": "B108",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "line": 14,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Probable insecure usage of temp file/directory.",
-      "cve": "python/hardcoded/hardcoded-tmp.py:4ad6d4c40a8c263fc265f3384724014e0a4f8dd6200af83e51ff120420038031:B108",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-tmp.py",
-        "start_line": 10,
-        "end_line": 10
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B108",
-          "value": "B108",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "line": 10,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with Popen module.",
-      "cve": "python/imports/imports-aliases.py:2c3e1fa1e54c3c6646e8bcfaee2518153c6799b77587ff8d9a7b0631f6d34785:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 1,
-        "end_line": 1
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 1,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with pickle module.",
-      "cve": "python/imports/imports.py:af58d07f6ad519ef5287fcae65bf1a6999448a1a3a8bc1ac2a11daa80d0b96bf:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports.py",
-        "start_line": 2,
-        "end_line": 2
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports.py",
-      "line": 2,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with subprocess module.",
-      "cve": "python/imports/imports.py:8de9bc98029d212db530785a5f6780cfa663548746ff228ab8fa96c5bb82f089:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports.py",
-        "start_line": 4,
-        "end_line": 4
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports.py",
-      "line": 4,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'blerg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:97c30f1d76d2a88913e3ce9ae74087874d740f87de8af697a9c455f01119f633:B106",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 22,
-        "end_line": 22
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B106",
-          "value": "B106",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b106_hardcoded_password_funcarg.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 22,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b106_hardcoded_password_funcarg.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'root'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:7431c73a0bc16d94ece2a2e75ef38f302574d42c37ac0c3c38ad0b3bf8a59f10:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 5,
-        "end_line": 5
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 5,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: ''",
-      "cve": "python/hardcoded/hardcoded-passwords.py:d2d1857c27caedd49c57bfbcdc23afcc92bd66a22701fcdc632869aab4ca73ee:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 9,
-        "end_line": 9
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 9,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'ajklawejrkl42348swfgkg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:fb3866215a61393a5c9c32a3b60e2058171a23219c353f722cbd3567acab21d2:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 13,
-        "end_line": 13
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 13,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'blerg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:63c62a8b7e1e5224439bd26b28030585ac48741e28ca64561a6071080c560a5f:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 23,
-        "end_line": 23
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 23,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'blerg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:4311b06d08df8fa58229b341c531da8e1a31ec4520597bdff920cd5c098d86f9:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 24,
-        "end_line": 24
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 24,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with subprocess module.",
-      "cve": "python/imports/imports-function.py:5858400c2f39047787702de44d03361ef8d954c9d14bd54ee1c2bef9e6a7df93:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-function.py",
-        "start_line": 4,
-        "end_line": 4
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-function.py",
-      "line": 4,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with pickle module.",
-      "cve": "python/imports/imports-function.py:dbda3cf4190279d30e0aad7dd137eca11272b0b225e8af4e8bf39682da67d956:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-function.py",
-        "start_line": 2,
-        "end_line": 2
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-function.py",
-      "line": 2,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with Popen module.",
-      "cve": "python/imports/imports-from.py:eb8a0db9cd1a8c1ab39a77e6025021b1261cc2a0b026b2f4a11fca4e0636d8dd:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-from.py",
-        "start_line": 7,
-        "end_line": 7
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-from.py",
-      "line": 7,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell",
-      "cve": "python/imports/imports-aliases.py:f99f9721e27537fbcb6699a4cf39c6740d6234d2c6f06cfc2d9ea977313c483d:B602",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 9,
-        "end_line": 9
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B602",
-          "value": "B602",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 9,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with subprocess module.",
-      "cve": "python/imports/imports-from.py:332a12ab1146698f614a905ce6a6a5401497a12281aef200e80522711c69dcf4:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-from.py",
-        "start_line": 6,
-        "end_line": 6
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-from.py",
-      "line": 6,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with Popen module.",
-      "cve": "python/imports/imports-from.py:0a48de4a3d5348853a03666cb574697e3982998355e7a095a798bd02a5947276:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-from.py",
-        "start_line": 1,
-        "end_line": 2
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-from.py",
-      "line": 1,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with pickle module.",
-      "cve": "python/imports/imports-aliases.py:51b71661dff994bde3529639a727a678c8f5c4c96f00d300913f6d5be1bbdf26:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 7,
-        "end_line": 8
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 7,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with loads module.",
-      "cve": "python/imports/imports-aliases.py:6ff02aeb3149c01ab68484d794a94f58d5d3e3bb0d58557ef4153644ea68ea54:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 6,
-        "end_line": 6
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 6,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120)",
-      "cve": "c/subdir/utils.c:b466873101951fe96e1332f6728eb7010acbbd5dfc3b65d7d53571d091a06d9e:CWE-119!/CWE-120",
-      "confidence": "Low",
-      "solution": "Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "c/subdir/utils.c",
-        "start_line": 4
-      },
-      "identifiers": [
-        {
-          "type": "cwe",
-          "name": "CWE-119",
-          "value": "119",
-          "url": "https://cwe.mitre.org/data/definitions/119.html"
-        },
-        {
-          "type": "cwe",
-          "name": "CWE-120",
-          "value": "120",
-          "url": "https://cwe.mitre.org/data/definitions/120.html"
-        }
-      ],
-      "file": "c/subdir/utils.c",
-      "line": 4,
-      "url": "https://cwe.mitre.org/data/definitions/119.html",
-      "tool": "flawfinder"
-    },
-    {
-      "category": "sast",
-      "message": "Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362)",
-      "cve": "c/subdir/utils.c:bab681140fcc8fc3085b6bba74081b44ea145c1c98b5e70cf19ace2417d30770:CWE-362",
-      "confidence": "Low",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "c/subdir/utils.c",
-        "start_line": 8
-      },
-      "identifiers": [
-        {
-          "type": "cwe",
-          "name": "CWE-362",
-          "value": "362",
-          "url": "https://cwe.mitre.org/data/definitions/362.html"
-        }
-      ],
-      "file": "c/subdir/utils.c",
-      "line": 8,
-      "url": "https://cwe.mitre.org/data/definitions/362.html",
-      "tool": "flawfinder"
-    },
-    {
-      "category": "sast",
-      "message": "Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120)",
-      "cve": "cplusplus/src/hello.cpp:c8c6dd0afdae6814194cf0930b719f757ab7b379cf8f261e7f4f9f2f323a818a:CWE-119!/CWE-120",
-      "confidence": "Low",
-      "solution": "Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "cplusplus/src/hello.cpp",
-        "start_line": 6
-      },
-      "identifiers": [
-        {
-          "type": "cwe",
-          "name": "CWE-119",
-          "value": "119",
-          "url": "https://cwe.mitre.org/data/definitions/119.html"
-        },
-        {
-          "type": "cwe",
-          "name": "CWE-120",
-          "value": "120",
-          "url": "https://cwe.mitre.org/data/definitions/120.html"
-        }
-      ],
-      "file": "cplusplus/src/hello.cpp",
-      "line": 6,
-      "url": "https://cwe.mitre.org/data/definitions/119.html",
-      "tool": "flawfinder"
-    },
-    {
-      "category": "sast",
-      "message": "Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120)",
-      "cve": "cplusplus/src/hello.cpp:331c04062c4fe0c7c486f66f59e82ad146ab33cdd76ae757ca41f392d568cbd0:CWE-120",
-      "confidence": "Low",
-      "solution": "Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "cplusplus/src/hello.cpp",
-        "start_line": 7
-      },
-      "identifiers": [
-        {
-          "type": "cwe",
-          "name": "CWE-120",
-          "value": "120",
-          "url": "https://cwe.mitre.org/data/definitions/120.html"
-        }
-      ],
-      "file": "cplusplus/src/hello.cpp",
-      "line": 7,
-      "url": "https://cwe.mitre.org/data/definitions/120.html",
-      "tool": "flawfinder"
-    }
-  ]
-}
diff --git a/spec/fixtures/security-reports/master.zip b/spec/fixtures/security-reports/master.zip
deleted file mode 100644
index 2261b5a1674..00000000000
Binary files a/spec/fixtures/security-reports/master.zip and /dev/null differ
diff --git a/spec/fixtures/security-reports/master/gl-container-scanning-report.json b/spec/fixtures/security-reports/master/gl-container-scanning-report.json
deleted file mode 100644
index 03dfc647162..00000000000
--- a/spec/fixtures/security-reports/master/gl-container-scanning-report.json
+++ /dev/null
@@ -1,105 +0,0 @@
-{
-  "image": "registry.gitlab.com/groulot/container-scanning-test/master:5f21de6956aee99ddb68ae49498662d9872f50ff",
-  "unapproved": [
-    "CVE-2017-18269",
-    "CVE-2017-16997",
-    "CVE-2018-1000001",
-    "CVE-2016-10228",
-    "CVE-2018-18520",
-    "CVE-2010-4052",
-    "CVE-2018-16869",
-    "CVE-2018-18311"
-  ],
-  "vulnerabilities": [
-    {
-      "featurename": "glibc",
-      "featureversion": "2.24-11+deb9u3",
-      "vulnerability": "CVE-2017-18269",
-      "namespace": "debian:9",
-      "description": "SSE2-optimized memmove implementation problem.",
-      "link": "https://security-tracker.debian.org/tracker/CVE-2017-18269",
-      "severity": "Defcon1",
-      "fixedby": "2.24-11+deb9u4"
-    },
-    {
-      "featurename": "glibc",
-      "featureversion": "2.24-11+deb9u3",
-      "vulnerability": "CVE-2017-16997",
-      "namespace": "debian:9",
-      "description": "elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.",
-      "link": "https://security-tracker.debian.org/tracker/CVE-2017-16997",
-      "severity": "Critical",
-      "fixedby": ""
-    },
-    {
-      "featurename": "glibc",
-      "featureversion": "2.24-11+deb9u3",
-      "vulnerability": "CVE-2018-1000001",
-      "namespace": "debian:9",
-      "description": "In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.",
-      "link": "https://security-tracker.debian.org/tracker/CVE-2018-1000001",
-      "severity": "High",
-      "fixedby": ""
-    },
-    {
-      "featurename": "glibc",
-      "featureversion": "2.24-11+deb9u3",
-      "vulnerability": "CVE-2016-10228",
-      "namespace": "debian:9",
-      "description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
-      "link": "https://security-tracker.debian.org/tracker/CVE-2016-10228",
-      "severity": "Medium",
-      "fixedby": ""
-    },
-    {
-      "featurename": "elfutils",
-      "featureversion": "0.168-1",
-      "vulnerability": "CVE-2018-18520",
-      "namespace": "debian:9",
-      "description": "An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.",
-      "link": "https://security-tracker.debian.org/tracker/CVE-2018-18520",
-      "severity": "Low",
-      "fixedby": ""
-    },
-    {
-      "featurename": "glibc",
-      "featureversion": "2.24-11+deb9u3",
-      "vulnerability": "CVE-2010-4052",
-      "namespace": "debian:9",
-      "description": "Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.",
-      "link": "https://security-tracker.debian.org/tracker/CVE-2010-4052",
-      "severity": "Negligible",
-      "fixedby": ""
-    },
-    {
-      "featurename": "nettle",
-      "featureversion": "3.3-1",
-      "vulnerability": "CVE-2018-16869",
-      "namespace": "debian:9",
-      "description": "A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.",
-      "link": "https://security-tracker.debian.org/tracker/CVE-2018-16869",
-      "severity": "Unknown",
-      "fixedby": ""
-    },
-    {
-      "featurename": "perl",
-      "featureversion": "5.24.1-3+deb9u4",
-      "vulnerability": "CVE-2018-18311",
-      "namespace": "debian:9",
-      "description": "Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.",
-      "link": "https://security-tracker.debian.org/tracker/CVE-2018-18311",
-      "severity": "Unknown",
-      "fixedby": "5.24.1-3+deb9u5"
-    },
-    {
-      "featurename": "foo",
-      "featureversion": "1.3",
-      "vulnerability": "CVE-2018-666",
-      "namespace": "debian:9",
-      "description": "Foo has a vulnerability nobody cares about and whitelist.",
-      "link": "https://security-tracker.debian.org/tracker/CVE-2018-666",
-      "severity": "Unknown",
-      "fixedby": "1.4"
-    }
-  ]
-}
diff --git a/spec/fixtures/security-reports/master/gl-dast-report.json b/spec/fixtures/security-reports/master/gl-dast-report.json
deleted file mode 100644
index df459d9419d..00000000000
--- a/spec/fixtures/security-reports/master/gl-dast-report.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "site": [
-    {
-      "alerts": [
-        {
-          "sourceid": "3",
-          "wascid": "15",
-          "cweid": "16",
-          "reference": "<p>http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx</p><p>https://www.owasp.org/index.php/List_of_useful_HTTP_headers</p>",
-          "otherinfo": "<p>This issue still applies to error type pages (401, 403, 500, etc) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.</p><p>At \"High\" threshold this scanner will not alert on client or server error responses.</p>",
-          "solution": "<p>Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.</p>",
-          "count": "2",
-          "pluginid": "10021",
-          "alert": "X-Content-Type-Options Header Missing",
-          "name": "X-Content-Type-Options Header Missing",
-          "riskcode": "1",
-          "confidence": "2",
-          "riskdesc": "Low (Medium)",
-          "desc": "<p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p>",
-          "instances": [
-            {
-              "param": "X-Content-Type-Options",
-              "method": "GET",
-              "uri": "http://bikebilly-spring-auto-devops-review-feature-br-3y2gpb.35.192.176.43.xip.io"
-            },
-            {
-              "param": "X-Content-Type-Options",
-              "method": "GET",
-              "uri": "http://bikebilly-spring-auto-devops-review-feature-br-3y2gpb.35.192.176.43.xip.io/"
-            }
-          ]
-        }
-      ],
-      "@ssl": "false",
-      "@port": "80",
-      "@host": "bikebilly-spring-auto-devops-review-feature-br-3y2gpb.35.192.176.43.xip.io",
-      "@name": "http://bikebilly-spring-auto-devops-review-feature-br-3y2gpb.35.192.176.43.xip.io"
-    }
-  ],
-  "@generated": "Fri, 13 Apr 2018 09:22:01",
-  "@version": "2.7.0"
-}
diff --git a/spec/fixtures/security-reports/master/gl-dependency-scanning-report.json b/spec/fixtures/security-reports/master/gl-dependency-scanning-report.json
deleted file mode 100644
index 8555be6618c..00000000000
--- a/spec/fixtures/security-reports/master/gl-dependency-scanning-report.json
+++ /dev/null
@@ -1,181 +0,0 @@
-{
-  "version": "1.3",
-  "vulnerabilities": [
-    {
-      "category": "dependency_scanning",
-      "name": "io.netty/netty - CVE-2014-3488",
-      "message": "DoS by CPU exhaustion when using malicious SSL packets",
-      "cve": "app/pom.xml:io.netty/netty@3.9.1.Final:CVE-2014-3488",
-      "severity": "Unknown",
-      "solution": "Upgrade to the latest version",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "app/pom.xml",
-        "dependency": {
-          "package": {
-            "name": "io.netty/netty"
-          },
-          "version": "3.9.1.Final"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
-          "value": "d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
-          "url": "https://deps.sec.gitlab.com/packages/maven/io.netty/netty/versions/3.9.1.Final/advisories"
-        },
-        {
-          "type": "cve",
-          "name": "CVE-2014-3488",
-          "value": "CVE-2014-3488",
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3488"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://bugzilla.redhat.com/CVE-2014-3488"
-        },
-        {
-          "url": "http://netty.io/news/2014/06/11/3.html"
-        },
-        {
-          "url": "https://github.com/netty/netty/issues/2562"
-        }
-      ],
-      "priority": "Unknown",
-      "file": "app/pom.xml",
-      "url": "https://bugzilla.redhat.com/CVE-2014-3488",
-      "tool": "gemnasium"
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "Django - CVE-2017-12794",
-      "message": "Possible XSS in traceback section of technical 500 debug page",
-      "cve": "app/requirements.txt:Django@1.11.3:CVE-2017-12794",
-      "severity": "Unknown",
-      "solution": "Upgrade to latest version or apply patch.",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "app/requirements.txt",
-        "dependency": {
-          "package": {
-            "name": "Django"
-          },
-          "version": "1.11.3"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-6162a015-8635-4a15-8d7c-dc9321db366f",
-          "value": "6162a015-8635-4a15-8d7c-dc9321db366f",
-          "url": "https://deps.sec.gitlab.com/packages/pypi/Django/versions/1.11.3/advisories"
-        },
-        {
-          "type": "cve",
-          "name": "CVE-2017-12794",
-          "value": "CVE-2017-12794",
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12794"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/"
-        }
-      ],
-      "priority": "Unknown",
-      "file": "app/requirements.txt",
-      "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/",
-      "tool": "gemnasium"
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "nokogiri - USN-3424-1",
-      "message": "Vulnerabilities in libxml2",
-      "cve": "rails/Gemfile.lock:nokogiri@1.8.0:USN-3424-1",
-      "severity": "Unknown",
-      "solution": "Upgrade to latest version.",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "rails/Gemfile.lock",
-        "dependency": {
-          "package": {
-            "name": "nokogiri"
-          },
-          "version": "1.8.0"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-06565b64-486d-4326-b906-890d9915804d",
-          "value": "06565b64-486d-4326-b906-890d9915804d",
-          "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
-        },
-        {
-          "type": "usn",
-          "name": "USN-3424-1",
-          "value": "USN-3424-1",
-          "url": "https://usn.ubuntu.com/3424-1/"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://github.com/sparklemotion/nokogiri/issues/1673"
-        }
-      ],
-      "priority": "Unknown",
-      "file": "rails/Gemfile.lock",
-      "url": "https://github.com/sparklemotion/nokogiri/issues/1673",
-      "tool": "gemnasium"
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "ffi - CVE-2018-1000201",
-      "message": "ruby-ffi DDL loading issue on Windows OS",
-      "cve": "ffi:1.9.18:CVE-2018-1000201",
-      "severity": "High",
-      "solution": "upgrade to \u003e= 1.9.24",
-      "scanner": {
-        "id": "bundler_audit",
-        "name": "bundler-audit"
-      },
-      "location": {
-        "file": "sast-sample-rails/Gemfile.lock",
-        "dependency": {
-          "package": {
-            "name": "ffi"
-          },
-          "version": "1.9.18"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "cve",
-          "name": "CVE-2018-1000201",
-          "value": "CVE-2018-1000201",
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000201"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://github.com/ffi/ffi/releases/tag/1.9.24"
-        }
-      ],
-      "priority": "High",
-      "file": "sast-sample-rails/Gemfile.lock",
-      "url": "https://github.com/ffi/ffi/releases/tag/1.9.24",
-      "tool": "bundler_audit"
-    }
-  ]
-}
diff --git a/spec/fixtures/security-reports/master/gl-license-management-report.json b/spec/fixtures/security-reports/master/gl-license-management-report.json
deleted file mode 100644
index e0de6f58fdf..00000000000
--- a/spec/fixtures/security-reports/master/gl-license-management-report.json
+++ /dev/null
@@ -1,817 +0,0 @@
-{
-    "licenses": [
-        {
-            "count": 52,
-            "name": "MIT"
-        },
-        {
-            "count": 3,
-            "name": "New BSD"
-        },
-        {
-            "count": 1,
-            "name": "Apache 2.0"
-        },
-        {
-            "count": 1,
-            "name": "unknown"
-        }
-    ],
-    "dependencies": [
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "actioncable",
-                "url": "http://rubyonrails.org",
-                "description": "WebSocket framework for Rails.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "actionmailer",
-                "url": "http://rubyonrails.org",
-                "description": "Email composition, delivery, and receiving framework (part of Rails).",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "actionpack",
-                "url": "http://rubyonrails.org",
-                "description": "Web-flow and rendering framework putting the VC in MVC (part of Rails).",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "actionview",
-                "url": "http://rubyonrails.org",
-                "description": "Rendering framework putting the V in MVC (part of Rails).",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "activejob",
-                "url": "http://rubyonrails.org",
-                "description": "Job framework with pluggable queues.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "activemodel",
-                "url": "http://rubyonrails.org",
-                "description": "A toolkit for building modeling frameworks (part of Rails).",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "activerecord",
-                "url": "http://rubyonrails.org",
-                "description": "Object-relational mapper framework (part of Rails).",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "activesupport",
-                "url": "http://rubyonrails.org",
-                "description": "A toolkit of support libraries and Ruby core extensions extracted from the Rails framework.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "arel",
-                "url": "https://github.com/rails/arel",
-                "description": "Arel Really Exasperates Logicians  Arel is a SQL AST manager for Ruby",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "builder",
-                "url": "http://onestepback.org",
-                "description": "Builders for MarkUp.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "bundler",
-                "url": "http://bundler.io",
-                "description": "The best way to manage your application's dependencies",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "coffee-rails",
-                "url": "https://github.com/rails/coffee-rails",
-                "description": "CoffeeScript adapter for the Rails asset pipeline.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "coffee-script",
-                "url": "http://github.com/josh/ruby-coffee-script",
-                "description": "Ruby CoffeeScript Compiler",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "coffee-script-source",
-                "url": "http://coffeescript.org",
-                "description": "The CoffeeScript Compiler",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "concurrent-ruby",
-                "url": "http://www.concurrent-ruby.com",
-                "description": "Modern concurrency tools for Ruby. Inspired by Erlang, Clojure, Scala, Haskell, F#, C#, Java, and classic concurrency patterns.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "crass",
-                "url": "https://github.com/rgrove/crass/",
-                "description": "CSS parser based on the CSS Syntax Level 3 spec.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "erubis",
-                "url": "http://www.kuwata-lab.com/erubis/",
-                "description": "a fast and extensible eRuby implementation which supports multi-language",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "execjs",
-                "url": "https://github.com/rails/execjs",
-                "description": "Run JavaScript code from Ruby",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "New BSD",
-                "url": "http://opensource.org/licenses/BSD-3-Clause"
-            },
-            "dependency": {
-                "name": "ffi",
-                "url": "http://wiki.github.com/ffi/ffi",
-                "description": "Ruby FFI",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "globalid",
-                "url": "http://www.rubyonrails.org",
-                "description": "Refer to any model with a URI: gid://app/class/id",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "i18n",
-                "url": "http://github.com/svenfuchs/i18n",
-                "description": "New wave Internationalization support for Ruby",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "jbuilder",
-                "url": "https://github.com/rails/jbuilder",
-                "description": "Create JSON structures via a Builder-style DSL",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "loofah",
-                "description": "",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "mail",
-                "url": "https://github.com/mikel/mail",
-                "description": "Mail provides a nice Ruby DSL for making, sending and reading emails.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "method_source",
-                "url": "http://banisterfiend.wordpress.com",
-                "description": "retrieve the sourcecode for a method",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "mini_mime",
-                "url": "https://github.com/discourse/mini_mime",
-                "description": "A lightweight mime type lookup toy",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "mini_portile2",
-                "url": "http://github.com/flavorjones/mini_portile",
-                "description": "Simplistic port-like solution for developers",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "minitest",
-                "url": "https://github.com/seattlerb/minitest",
-                "description": "minitest provides a complete suite of testing facilities supporting TDD, BDD, mocking, and benchmarking",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "multi_json",
-                "url": "http://github.com/intridea/multi_json",
-                "description": "A common interface to multiple JSON libraries.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "nio4r",
-                "url": "https://github.com/celluloid/nio4r",
-                "description": "NIO provides a high performance selector API for monitoring IO objects",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "nokogiri",
-                "url": "http://nokogiri.org",
-                "description": "Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "New BSD",
-                "url": "http://opensource.org/licenses/BSD-3-Clause"
-            },
-            "dependency": {
-                "name": "puma",
-                "url": "http://puma.io",
-                "description": "Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "rack",
-                "url": "https://rack.github.io/",
-                "description": "a modular Ruby webserver interface",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "rack-test",
-                "url": "http://github.com/brynary/rack-test",
-                "description": "Simple testing API built on Rack",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "rails",
-                "url": "http://rubyonrails.org",
-                "description": "Full-stack web application framework.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "rails-dom-testing",
-                "url": "https://github.com/rails/rails-dom-testing",
-                "description": "Dom and Selector assertions for Rails applications",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "rails-html-sanitizer",
-                "url": "https://github.com/rails/rails-html-sanitizer",
-                "description": "This gem is responsible to sanitize HTML fragments in Rails applications.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "railties",
-                "url": "http://rubyonrails.org",
-                "description": "Tools for creating, working with, and running Rails applications.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "rake",
-                "url": "https://github.com/ruby/rake",
-                "description": "Rake is a Make-like program implemented in Ruby",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "rb-fsevent",
-                "url": "http://rubygems.org/gems/rb-fsevent",
-                "description": "Very simple & usable FSEvents API",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "rb-inotify",
-                "url": "https://github.com/guard/rb-inotify",
-                "description": "A Ruby wrapper for Linux inotify, using FFI",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "unknown"
-            },
-            "dependency": {
-                "name": "ruby-bundler-rails",
-                "description": "",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "sass",
-                "url": "http://sass-lang.com/",
-                "description": "A powerful but elegant CSS compiler that makes CSS fun again.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "sass-listen",
-                "url": "https://github.com/sass/listen",
-                "description": "Fork of guard/listen",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "sass-rails",
-                "url": "https://github.com/rails/sass-rails",
-                "description": "Sass adapter for the Rails asset pipeline.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "sprockets",
-                "url": "https://github.com/rails/sprockets",
-                "description": "Rack-based asset packaging system",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "sprockets-rails",
-                "url": "https://github.com/rails/sprockets-rails",
-                "description": "Sprockets Rails integration",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "New BSD",
-                "url": "http://opensource.org/licenses/BSD-3-Clause"
-            },
-            "dependency": {
-                "name": "sqlite3",
-                "url": "https://github.com/sparklemotion/sqlite3-ruby",
-                "description": "This module allows Ruby programs to interface with the SQLite3 database engine (http://www.sqlite.org)",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "thor",
-                "url": "http://whatisthor.com/",
-                "description": "Thor is a toolkit for building powerful command-line interfaces.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "Apache 2.0",
-                "url": "http://www.apache.org/licenses/LICENSE-2.0.txt"
-            },
-            "dependency": {
-                "name": "thread_safe",
-                "url": "https://github.com/ruby-concurrency/thread_safe",
-                "description": "Thread-safe collections and utilities for Ruby",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "tilt",
-                "url": "http://github.com/rtomayko/tilt/",
-                "description": "Generic interface to multiple Ruby template engines",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "turbolinks",
-                "url": "https://github.com/turbolinks/turbolinks",
-                "description": "Turbolinks makes navigating your web application faster",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "turbolinks-source",
-                "url": "https://github.com/turbolinks/turbolinks-source-gem",
-                "description": "Turbolinks JavaScript assets",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "tzinfo",
-                "url": "http://tzinfo.github.io",
-                "description": "Daylight savings aware timezone library",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "uglifier",
-                "url": "http://github.com/lautis/uglifier",
-                "description": "Ruby wrapper for UglifyJS JavaScript compressor",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "websocket-driver",
-                "url": "http://github.com/faye/websocket-driver-ruby",
-                "description": "WebSocket protocol handler with pluggable I/O",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "websocket-extensions",
-                "url": "https://github.com/faye/websocket-extensions-ruby",
-                "description": "Generic extension manager for WebSocket connections",
-                "pathes": [
-                    "."
-                ]
-            }
-        }
-    ]
-}
diff --git a/spec/fixtures/security-reports/master/gl-sast-report.json b/spec/fixtures/security-reports/master/gl-sast-report.json
deleted file mode 100644
index 345e1e9f83a..00000000000
--- a/spec/fixtures/security-reports/master/gl-sast-report.json
+++ /dev/null
@@ -1,967 +0,0 @@
-{
-  "version": "1.2",
-  "vulnerabilities": [
-    {
-      "category": "sast",
-      "message": "Probable insecure usage of temp file/directory.",
-      "cve": "python/hardcoded/hardcoded-tmp.py:52865813c884a507be1f152d654245af34aba8a391626d01f1ab6d3f52ec8779:B108",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-tmp.py",
-        "start_line": 1,
-        "end_line": 1
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B108",
-          "value": "B108",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "line": 1,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "name": "Predictable pseudorandom number generator",
-      "message": "Predictable pseudorandom number generator",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:47:PREDICTABLE_RANDOM",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 47,
-        "end_line": 47,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "generateSecretToken2"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-PREDICTABLE_RANDOM",
-          "value": "PREDICTABLE_RANDOM",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 47,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "name": "Predictable pseudorandom number generator",
-      "message": "Predictable pseudorandom number generator",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:41:PREDICTABLE_RANDOM",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 41,
-        "end_line": 41,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "generateSecretToken1"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-PREDICTABLE_RANDOM",
-          "value": "PREDICTABLE_RANDOM",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 41,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:cb203b465dffb0cb3a8e8bd8910b84b93b0a5995a938e4b903dbb0cd6ffa1254:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 11,
-        "end_line": 11
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 11,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:a7173c43ae66bd07466632d819d450e0071e02dbf782763640d1092981f9631b:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 12,
-        "end_line": 12
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 12,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:017017b77deb0b8369b6065947833eeea752a92ec8a700db590fece3e934cf0d:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 13,
-        "end_line": 13
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 13,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:45fc8c53aea7b84f06bc4e590cc667678d6073c4c8a1d471177ca2146fb22db2:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 14,
-        "end_line": 14
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 14,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Pickle library appears to be in use, possible security issue.",
-      "cve": "python/imports/imports-aliases.py:5f200d47291e7bbd8352db23019b85453ca048dd98ea0c291260fa7d009963a4:B301",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 15,
-        "end_line": 15
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B301",
-          "value": "B301"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 15,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "name": "ECB mode is insecure",
-      "message": "ECB mode is insecure",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:29:ECB_MODE",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 29,
-        "end_line": 29,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "insecureCypher"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-ECB_MODE",
-          "value": "ECB_MODE",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#ECB_MODE"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 29,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#ECB_MODE",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "name": "Cipher with no integrity",
-      "message": "Cipher with no integrity",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:29:CIPHER_INTEGRITY",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 29,
-        "end_line": 29,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "insecureCypher"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-CIPHER_INTEGRITY",
-          "value": "CIPHER_INTEGRITY",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 29,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "message": "Probable insecure usage of temp file/directory.",
-      "cve": "python/hardcoded/hardcoded-tmp.py:63dd4d626855555b816985d82c4614a790462a0a3ada89dc58eb97f9c50f3077:B108",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-tmp.py",
-        "start_line": 14,
-        "end_line": 14
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B108",
-          "value": "B108",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "line": 14,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Probable insecure usage of temp file/directory.",
-      "cve": "python/hardcoded/hardcoded-tmp.py:4ad6d4c40a8c263fc265f3384724014e0a4f8dd6200af83e51ff120420038031:B108",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-tmp.py",
-        "start_line": 10,
-        "end_line": 10
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B108",
-          "value": "B108",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "line": 10,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with Popen module.",
-      "cve": "python/imports/imports-aliases.py:2c3e1fa1e54c3c6646e8bcfaee2518153c6799b77587ff8d9a7b0631f6d34785:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 1,
-        "end_line": 1
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 1,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with pickle module.",
-      "cve": "python/imports/imports.py:af58d07f6ad519ef5287fcae65bf1a6999448a1a3a8bc1ac2a11daa80d0b96bf:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports.py",
-        "start_line": 2,
-        "end_line": 2
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports.py",
-      "line": 2,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with subprocess module.",
-      "cve": "python/imports/imports.py:8de9bc98029d212db530785a5f6780cfa663548746ff228ab8fa96c5bb82f089:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports.py",
-        "start_line": 4,
-        "end_line": 4
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports.py",
-      "line": 4,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'blerg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:97c30f1d76d2a88913e3ce9ae74087874d740f87de8af697a9c455f01119f633:B106",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 22,
-        "end_line": 22
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B106",
-          "value": "B106",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b106_hardcoded_password_funcarg.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 22,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b106_hardcoded_password_funcarg.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'root'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:7431c73a0bc16d94ece2a2e75ef38f302574d42c37ac0c3c38ad0b3bf8a59f10:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 5,
-        "end_line": 5
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 5,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: ''",
-      "cve": "python/hardcoded/hardcoded-passwords.py:d2d1857c27caedd49c57bfbcdc23afcc92bd66a22701fcdc632869aab4ca73ee:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 9,
-        "end_line": 9
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 9,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'ajklawejrkl42348swfgkg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:fb3866215a61393a5c9c32a3b60e2058171a23219c353f722cbd3567acab21d2:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 13,
-        "end_line": 13
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 13,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'blerg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:63c62a8b7e1e5224439bd26b28030585ac48741e28ca64561a6071080c560a5f:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 23,
-        "end_line": 23
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 23,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'blerg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:4311b06d08df8fa58229b341c531da8e1a31ec4520597bdff920cd5c098d86f9:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 24,
-        "end_line": 24
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 24,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with subprocess module.",
-      "cve": "python/imports/imports-function.py:5858400c2f39047787702de44d03361ef8d954c9d14bd54ee1c2bef9e6a7df93:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-function.py",
-        "start_line": 4,
-        "end_line": 4
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-function.py",
-      "line": 4,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with pickle module.",
-      "cve": "python/imports/imports-function.py:dbda3cf4190279d30e0aad7dd137eca11272b0b225e8af4e8bf39682da67d956:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-function.py",
-        "start_line": 2,
-        "end_line": 2
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-function.py",
-      "line": 2,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with Popen module.",
-      "cve": "python/imports/imports-from.py:eb8a0db9cd1a8c1ab39a77e6025021b1261cc2a0b026b2f4a11fca4e0636d8dd:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-from.py",
-        "start_line": 7,
-        "end_line": 7
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-from.py",
-      "line": 7,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell",
-      "cve": "python/imports/imports-aliases.py:f99f9721e27537fbcb6699a4cf39c6740d6234d2c6f06cfc2d9ea977313c483d:B602",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 9,
-        "end_line": 9
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B602",
-          "value": "B602",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 9,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with subprocess module.",
-      "cve": "python/imports/imports-from.py:332a12ab1146698f614a905ce6a6a5401497a12281aef200e80522711c69dcf4:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-from.py",
-        "start_line": 6,
-        "end_line": 6
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-from.py",
-      "line": 6,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with Popen module.",
-      "cve": "python/imports/imports-from.py:0a48de4a3d5348853a03666cb574697e3982998355e7a095a798bd02a5947276:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-from.py",
-        "start_line": 1,
-        "end_line": 2
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-from.py",
-      "line": 1,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with pickle module.",
-      "cve": "python/imports/imports-aliases.py:51b71661dff994bde3529639a727a678c8f5c4c96f00d300913f6d5be1bbdf26:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 7,
-        "end_line": 8
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 7,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with loads module.",
-      "cve": "python/imports/imports-aliases.py:6ff02aeb3149c01ab68484d794a94f58d5d3e3bb0d58557ef4153644ea68ea54:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 6,
-        "end_line": 6
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 6,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120)",
-      "cve": "c/subdir/utils.c:b466873101951fe96e1332f6728eb7010acbbd5dfc3b65d7d53571d091a06d9e:CWE-119!/CWE-120",
-      "confidence": "Low",
-      "solution": "Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "c/subdir/utils.c",
-        "start_line": 4
-      },
-      "identifiers": [
-        {
-          "type": "flawfinder_func_name",
-          "name": "Flawfinder - char",
-          "value": "char"
-        },
-        {
-          "type": "cwe",
-          "name": "CWE-119",
-          "value": "119",
-          "url": "https://cwe.mitre.org/data/definitions/119.html"
-        },
-        {
-          "type": "cwe",
-          "name": "CWE-120",
-          "value": "120",
-          "url": "https://cwe.mitre.org/data/definitions/120.html"
-        }
-      ],
-      "file": "c/subdir/utils.c",
-      "line": 4,
-      "url": "https://cwe.mitre.org/data/definitions/119.html",
-      "tool": "flawfinder"
-    },
-    {
-      "category": "sast",
-      "message": "Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362)",
-      "cve": "c/subdir/utils.c:bab681140fcc8fc3085b6bba74081b44ea145c1c98b5e70cf19ace2417d30770:CWE-362",
-      "confidence": "Low",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "c/subdir/utils.c",
-        "start_line": 8
-      },
-      "identifiers": [
-        {
-          "type": "flawfinder_func_name",
-          "name": "Flawfinder - fopen",
-          "value": "fopen"
-        },
-        {
-          "type": "cwe",
-          "name": "CWE-362",
-          "value": "362",
-          "url": "https://cwe.mitre.org/data/definitions/362.html"
-        }
-      ],
-      "file": "c/subdir/utils.c",
-      "line": 8,
-      "url": "https://cwe.mitre.org/data/definitions/362.html",
-      "tool": "flawfinder"
-    },
-    {
-      "category": "sast",
-      "message": "Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120)",
-      "cve": "cplusplus/src/hello.cpp:c8c6dd0afdae6814194cf0930b719f757ab7b379cf8f261e7f4f9f2f323a818a:CWE-119!/CWE-120",
-      "confidence": "Low",
-      "solution": "Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "cplusplus/src/hello.cpp",
-        "start_line": 6
-      },
-      "identifiers": [
-        {
-          "type": "flawfinder_func_name",
-          "name": "Flawfinder - char",
-          "value": "char"
-        },
-        {
-          "type": "cwe",
-          "name": "CWE-119",
-          "value": "119",
-          "url": "https://cwe.mitre.org/data/definitions/119.html"
-        },
-        {
-          "type": "cwe",
-          "name": "CWE-120",
-          "value": "120",
-          "url": "https://cwe.mitre.org/data/definitions/120.html"
-        }
-      ],
-      "file": "cplusplus/src/hello.cpp",
-      "line": 6,
-      "url": "https://cwe.mitre.org/data/definitions/119.html",
-      "tool": "flawfinder"
-    },
-    {
-      "category": "sast",
-      "message": "Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120)",
-      "cve": "cplusplus/src/hello.cpp:331c04062c4fe0c7c486f66f59e82ad146ab33cdd76ae757ca41f392d568cbd0:CWE-120",
-      "confidence": "Low",
-      "solution": "Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "cplusplus/src/hello.cpp",
-        "start_line": 7
-      },
-      "identifiers": [
-        {
-          "type": "flawfinder_func_name",
-          "name": "Flawfinder - strcpy",
-          "value": "strcpy"
-        },
-        {
-          "type": "cwe",
-          "name": "CWE-120",
-          "value": "120",
-          "url": "https://cwe.mitre.org/data/definitions/120.html"
-        }
-      ],
-      "file": "cplusplus/src/hello.cpp",
-      "line": 7,
-      "url": "https://cwe.mitre.org/data/definitions/120.html",
-      "tool": "flawfinder"
-    }
-  ]
-}
diff --git a/spec/fixtures/security-reports/remediations/gl-dependency-scanning-report.json b/spec/fixtures/security-reports/remediations/gl-dependency-scanning-report.json
deleted file mode 100644
index c96e831b027..00000000000
--- a/spec/fixtures/security-reports/remediations/gl-dependency-scanning-report.json
+++ /dev/null
@@ -1,104 +0,0 @@
-{
-  "version": "2.0",
-  "vulnerabilities": [
-    {
-      "category": "dependency_scanning",
-      "name": "Regular Expression Denial of Service",
-      "message": "Regular Expression Denial of Service in debug",
-      "description": "The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.",
-      "cve": "yarn.lock:debug:gemnasium:37283ed4-0380-40d7-ada7-2d994afcc62a",
-      "severity": "Unknown",
-      "solution": "Upgrade to latest versions.",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "yarn.lock",
-        "dependency": {
-          "package": {
-            "name": "debug"
-          },
-          "version": "1.0.5"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-37283ed4-0380-40d7-ada7-2d994afcc62a",
-          "value": "37283ed4-0380-40d7-ada7-2d994afcc62a",
-          "url": "https://deps.sec.gitlab.com/packages/npm/debug/versions/1.0.5/advisories"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://nodesecurity.io/advisories/534"
-        },
-        {
-          "url": "https://github.com/visionmedia/debug/issues/501"
-        },
-        {
-          "url": "https://github.com/visionmedia/debug/pull/504"
-        }
-      ]
-    },
-    {
-      "category": "dependency_scanning",
-      "name": "Authentication bypass via incorrect DOM traversal and canonicalization",
-      "message": "Authentication bypass via incorrect DOM traversal and canonicalization in saml2-js",
-      "description": "Some XML DOM traversal and canonicalization APIs may be inconsistent in handling of comments within XML nodes. Incorrect use of these APIs by some SAML libraries results in incorrect parsing of the inner text of XML nodes such that any inner text after the comment is lost prior to cryptographically signing the SAML message. Text after the comment therefore has no impact on the signature on the SAML message.\r\n\r\nA remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider.",
-      "cve": "yarn.lock:saml2-js:gemnasium:9952e574-7b5b-46fa-a270-aeb694198a98",
-      "severity": "Unknown",
-      "solution": "Upgrade to fixed version.\r\n",
-      "scanner": {
-        "id": "gemnasium",
-        "name": "Gemnasium"
-      },
-      "location": {
-        "file": "yarn.lock",
-        "dependency": {
-          "package": {
-            "name": "saml2-js"
-          },
-          "version": "1.5.0"
-        }
-      },
-      "identifiers": [
-        {
-          "type": "gemnasium",
-          "name": "Gemnasium-9952e574-7b5b-46fa-a270-aeb694198a98",
-          "value": "9952e574-7b5b-46fa-a270-aeb694198a98",
-          "url": "https://deps.sec.gitlab.com/packages/npm/saml2-js/versions/1.5.0/advisories"
-        },
-        {
-          "type": "cve",
-          "name": "CVE-2017-11429",
-          "value": "CVE-2017-11429",
-          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11429"
-        }
-      ],
-      "links": [
-        {
-          "url": "https://github.com/Clever/saml2/commit/3546cb61fd541f219abda364c5b919633609ef3d#diff-af730f9f738de1c9ad87596df3f6de84R279"
-        },
-        {
-          "url": "https://github.com/Clever/saml2/issues/127"
-        },
-        {
-          "url": "https://www.kb.cert.org/vuls/id/475445"
-        }
-      ]
-    }
-  ],
-  "remediations": [
-    {
-      "fixes": [
-        {
-          "cve": "yarn.lock:saml2-js:gemnasium:9952e574-7b5b-46fa-a270-aeb694198a98"
-        }
-      ],
-      "summary": "Upgrade saml2-js",
-      "diff": "ZGlmZiAtLWdpdCBhL3lhcm4ubG9jayBiL3lhcm4ubG9jawppbmRleCAwZWNjOTJmLi43ZmE0NTU0IDEwMDY0NAotLS0gYS95YXJuLmxvY2sKKysrIGIveWFybi5sb2NrCkBAIC0yLDEwMyArMiwxMjQgQEAKICMgeWFybiBsb2NrZmlsZSB2MQogCiAKLWFzeW5jQH4wLjIuNzoKLSAgdmVyc2lvbiAiMC4yLjEwIgotICByZXNvbHZlZCAiaHR0cDovL3JlZ2lzdHJ5Lm5wbWpzLm9yZy9hc3luYy8tL2FzeW5jLTAuMi4xMC50Z3ojYjZiYmUwYjA2NzRiOWQ3MTk3MDhjYTM4ZGU4YzIzN2NiNTI2YzNkMSIKLQotYXN5bmNAfjEuNS4yOgotICB2ZXJzaW9uICIxLjUuMiIKLSAgcmVzb2x2ZWQgImh0dHA6Ly9yZWdpc3RyeS5ucG1qcy5vcmcvYXN5bmMvLS9hc3luYy0xLjUuMi50Z3ojZWM2YTYxYWU1NjQ4MGMwYzNjYjI0MWM5NTYxOGUyMDg5MmY5NjcyYSIKK2FzeW5jQF4yLjEuNSwgYXN5bmNAXjIuNS4wOgorICB2ZXJzaW9uICIyLjYuMSIKKyAgcmVzb2x2ZWQgImh0dHBzOi8vcmVnaXN0cnkueWFybnBrZy5jb20vYXN5bmMvLS9hc3luYy0yLjYuMS50Z3ojYjI0NWEyM2NhNzE5MzAwNDRlYzUzZmE0NmFhMDBhM2U4N2M2YTYxMCIKKyAgaW50ZWdyaXR5IHNoYTUxMi1mTkVpTDIrQVp0NkFsQXcvMjlDcjBVRGU0c1JBSENwRUhoNTRXTXorQmI3UWZOY0Z3NGgzbG9vZnlKcExlUXM0WXg3eXVxdS8yZExnTTVoS09zNkhsUT09CisgIGRlcGVuZGVuY2llczoKKyAgICBsb2Rhc2ggIl40LjE3LjEwIgogCi1kZWJ1Z0BeMS4wLjQ6Ci0gIHZlcnNpb24gIjEuMC41IgotICByZXNvbHZlZCAiaHR0cHM6Ly9yZWdpc3RyeS55YXJucGtnLmNvbS9kZWJ1Zy8tL2RlYnVnLTEuMC41LnRneiNmNzI0MTIxNzQzMGY5OWRlYzRjMmI0NzNlYWI5MjIyOGU4NzRjMmFjIgorZGVidWdAXjIuNi4wOgorICB2ZXJzaW9uICIyLjYuOSIKKyAgcmVzb2x2ZWQgImh0dHBzOi8vcmVnaXN0cnkueWFybnBrZy5jb20vZGVidWcvLS9kZWJ1Zy0yLjYuOS50Z3ojNWQxMjg1MTVkZjEzNGZmMzI3ZTkwYTRjOTNmNGUwNzdhNTM2MzQxZiIKKyAgaW50ZWdyaXR5IHNoYTUxMi1iQzdFbHJkSmFKblBiQVArMUVvdFl2cVpzYjNlY2w1d2k2QmZpNkJKVFVjTm93cDZjdnNwZzBqWHpuUlRLRGptL0U3QWRnRkJWZUFQVk1OY0tHc0hNQT09CiAgIGRlcGVuZGVuY2llczoKICAgICBtcyAiMi4wLjAiCiAKLWVqc0B+MC44LjM6Ci0gIHZlcnNpb24gIjAuOC44IgotICByZXNvbHZlZCAiaHR0cHM6Ly9yZWdpc3RyeS55YXJucGtnLmNvbS9lanMvLS9lanMtMC44LjgudGd6I2ZmZGM1NmRjYzM1ZDAyOTI2ZGQ1MGFkMTM0MzliYmM1NDA2MWQ1OTgiCitlanNAXjIuNS42OgorICB2ZXJzaW9uICIyLjYuMSIKKyAgcmVzb2x2ZWQgImh0dHBzOi8vcmVnaXN0cnkueWFybnBrZy5jb20vZWpzLy0vZWpzLTIuNi4xLnRneiM0OThlYzBkNDk1NjU1YWJjNmYyM2NkNjE4NjhkOTI2NDY0MDcxYWEwIgorICBpbnRlZ3JpdHkgc2hhNTEyLTB4eTRBL3R3ZnJSQ25raGZrOEVyRGk1RHFkQXNBcWVHeGh0NHhrQ1Vyc3ZoaGJRTnM3RSs0alYwQ043K05LSVkwYUhFNzIrWHZxdEJJWHpEMzFaYlhRPT0KKworbG9kYXNoLW5vZGVAfjIuNC4xOgorICB2ZXJzaW9uICIyLjQuMSIKKyAgcmVzb2x2ZWQgImh0dHBzOi8vcmVnaXN0cnkueWFybnBrZy5jb20vbG9kYXNoLW5vZGUvLS9sb2Rhc2gtbm9kZS0yLjQuMS50Z3ojZWE4MmY3YjEwMGM3MzNkMWE0MmFmNzY4MDFlNTA2MTA1ZTJhODBlYyIKKyAgaW50ZWdyaXR5IHNoYTEtNm9MM3NRREhNOUdrS3Zkb0FlVUdFRjRxZ093PQorCitsb2Rhc2hAXjQuMTcuMTA6CisgIHZlcnNpb24gIjQuMTcuMTEiCisgIHJlc29sdmVkICJodHRwczovL3JlZ2lzdHJ5Lnlhcm5wa2cuY29tL2xvZGFzaC8tL2xvZGFzaC00LjE3LjExLnRneiNiMzllYTYyMjllZjYwN2VjZDg5ZTJjOGRmMTI1MzY4OTFjYWM5YjhkIgorICBpbnRlZ3JpdHkgc2hhNTEyLWNRS2g4aWdvNVFVaFo3bGczOERZV0F4TXZqU0FLRzBBOHdHU1ZpbVAwN1NJVUVLMlVPK2FyU1JLYlJaV3RlbE10TjVWMEhrd2g1cnlPdG8vU3NoWUlnPT0KIAogbXNAMi4wLjA6CiAgIHZlcnNpb24gIjIuMC4wIgogICByZXNvbHZlZCAiaHR0cHM6Ly9yZWdpc3RyeS55YXJucGtnLmNvbS9tcy8tL21zLTIuMC4wLnRneiM1NjA4YWVhZGZjMDBiZTZjMjkwMWRmNWY5ODYxNzg4ZGUwZDU5N2M4IgorICBpbnRlZ3JpdHkgc2hhMS1WZ2l1cmZ3QXZtd3BBZDlmbUdGNGplRFZsOGc9CiAKLW5vZGUtZm9yZ2VAMC4yLjI0OgotICB2ZXJzaW9uICIwLjIuMjQiCi0gIHJlc29sdmVkICJodHRwczovL3JlZ2lzdHJ5Lnlhcm5wa2cuY29tL25vZGUtZm9yZ2UvLS9ub2RlLWZvcmdlLTAuMi4yNC50Z3ojZmE2Zjg0NmY0MmZhOTNmNjNhMGEzMGM5ZmJmZjdiNGUxMzBlMDg1OCIKK25vZGUtZm9yZ2VAXjAuNy4wOgorICB2ZXJzaW9uICIwLjcuNiIKKyAgcmVzb2x2ZWQgImh0dHBzOi8vcmVnaXN0cnkueWFybnBrZy5jb20vbm9kZS1mb3JnZS8tL25vZGUtZm9yZ2UtMC43LjYudGd6I2ZkZjNiNDE4YWVlMWY5NGYwZWY2NDJjZDYzNDg2Yzc3Y2E5NzI0YWMiCisgIGludGVncml0eSBzaGE1MTItc29sMzBMVXB6MWpRRkJqT0t3Ymp4aWppRTNiNnBqZDc0WXdmRDBmSk9LUGpGK2ZPTktiMllnOHJZZ1M2K2JLNlZEbCsvd2ZyNElZcEM3akR6TFVJZnc9PQogCiBzYW1sMi1qc0BeMS41LjA6Ci0gIHZlcnNpb24gIjEuNS4wIgotICByZXNvbHZlZCAiaHR0cHM6Ly9yZWdpc3RyeS55YXJucGtnLmNvbS9zYW1sMi1qcy8tL3NhbWwyLWpzLTEuNS4wLnRneiNjMGQyMjY4YTE3OWU3MzI5ZDI5ZWIyNWFhODJkZjU1MDM3NzRiMGQ5IgorICB2ZXJzaW9uICIxLjEyLjQiCisgIHJlc29sdmVkICJodHRwczovL3JlZ2lzdHJ5Lnlhcm5wa2cuY29tL3NhbWwyLWpzLy0vc2FtbDItanMtMS4xMi40LnRneiNjMjg4ZjIwYmRhNmQyYjkxMDczYjE2Yzk0ZWE3MmYyMjM0OWFjM2IzIgorICBpbnRlZ3JpdHkgc2hhMS13b2p5QzlwdEs1RUhPeGJKVHFjdklqU2F3N009CiAgIGRlcGVuZGVuY2llczoKLSAgICBhc3luYyAifjEuNS4yIgotICAgIGRlYnVnICJeMS4wLjQiCi0gICAgdW5kZXJzY29yZSAifjEuNi4wIgotICAgIHhtbC1jcnlwdG8gIl4wLjguMSIKLSAgICB4bWwtZW5jcnlwdGlvbiAifjAuNy40IgotICAgIHhtbDJqcyAifjAuNC4xIgotICAgIHhtbGJ1aWxkZXIgIn4yLjEuMCIKLSAgICB4bWxkb20gIn4wLjEuMTkiCisgICAgYXN5bmMgIl4yLjUuMCIKKyAgICBkZWJ1ZyAiXjIuNi4wIgorICAgIHVuZGVyc2NvcmUgIl4xLjguMCIKKyAgICB4bWwtY3J5cHRvICJeMC4xMC4wIgorICAgIHhtbC1lbmNyeXB0aW9uICJeMC4xMS4wIgorICAgIHhtbDJqcyAiXjAuNC4wIgorICAgIHhtbGJ1aWxkZXIgIn4yLjIuMCIKKyAgICB4bWxkb20gIl4wLjEuMCIKIAogc2F4QD49MC42LjA6CiAgIHZlcnNpb24gIjEuMi40IgogICByZXNvbHZlZCAiaHR0cHM6Ly9yZWdpc3RyeS55YXJucGtnLmNvbS9zYXgvLS9zYXgtMS4yLjQudGd6IzI4MTYyMzRlMjM3OGJkZGM0ZTUzNTRmYWI1Y2FhODk1ZGY3MTAwZDkiCisgIGludGVncml0eSBzaGE1MTItTnFWRHY5VHBBTlVqRm0wTjh1TTVHeEwzNlVnS2k5L2F0WncreDdZRm5ROGNrd0ZHS3JsNHhYNHlXdHJleTNVSm01blAxa1VibllnTG9wcVdOU1JoV3c9PQogCi11bmRlcnNjb3JlQD49MS41Lng6Cit1bmRlcnNjb3JlQF4xLjguMDoKICAgdmVyc2lvbiAiMS45LjEiCiAgIHJlc29sdmVkICJodHRwczovL3JlZ2lzdHJ5Lnlhcm5wa2cuY29tL3VuZGVyc2NvcmUvLS91bmRlcnNjb3JlLTEuOS4xLnRneiMwNmRjZTM0YTBlNjhhN2JhYmMyOWIzNjViOGU3NGI4OTI1MjAzOTYxIgorICBpbnRlZ3JpdHkgc2hhNTEyLTUvNGV0bkNrZDljOGd3Z293aTUvb20vbVlPNWFqQ2FPZ2R6ai9vVyswZVFWOVd4S0JEWnc1K3ljbUttZWFUWGpJblMvVzBCenBHTG8yeFIyYUJ3WmRnPT0KIAotdW5kZXJzY29yZUB+MS42LjA6Ci0gIHZlcnNpb24gIjEuNi4wIgotICByZXNvbHZlZCAiaHR0cHM6Ly9yZWdpc3RyeS55YXJucGtnLmNvbS91bmRlcnNjb3JlLy0vdW5kZXJzY29yZS0xLjYuMC50Z3ojOGIzOGIxMGNhY2RlZjYzMzM3YjhiMjRlNGZmODZkNDVhZWE1MjlhOCIKLQoteG1sLWNyeXB0b0BeMC44LjE6Ci0gIHZlcnNpb24gIjAuOC41IgotICByZXNvbHZlZCAiaHR0cDovL3JlZ2lzdHJ5Lm5wbWpzLm9yZy94bWwtY3J5cHRvLy0veG1sLWNyeXB0by0wLjguNS50Z3ojMmJiY2ZiM2ViMzNmM2E4MmEyMThiODIyYmY2NzJiNmIxYzIwZTUzOCIKK3htbC1jcnlwdG9AXjAuMTAuMDoKKyAgdmVyc2lvbiAiMC4xMC4xIgorICByZXNvbHZlZCAiaHR0cHM6Ly9yZWdpc3RyeS55YXJucGtnLmNvbS94bWwtY3J5cHRvLy0veG1sLWNyeXB0by0wLjEwLjEudGd6I2Y4MzJmNzRjY2Y1NmYyNGFmY2FlMTE2M2ExZmNhYjQ0ZDk2Nzc0YTgiCisgIGludGVncml0eSBzaGExLStETDNUTTlXOGtyOHJoRmpvZnlyUk5sbmRLZz0KICAgZGVwZW5kZW5jaWVzOgogICAgIHhtbGRvbSAiPTAuMS4xOSIKICAgICB4cGF0aC5qcyAiPj0wLjAuMyIKIAoteG1sLWVuY3J5cHRpb25AfjAuNy40OgotICB2ZXJzaW9uICIwLjcuNCIKLSAgcmVzb2x2ZWQgImh0dHBzOi8vcmVnaXN0cnkueWFybnBrZy5jb20veG1sLWVuY3J5cHRpb24vLS94bWwtZW5jcnlwdGlvbi0wLjcuNC50Z3ojNDI3OTFlYzY0ZDU1NmQyNDU1ZGNiOWRhMGE1NDEyMzY2NWFjNjVjNyIKK3htbC1lbmNyeXB0aW9uQF4wLjExLjA6CisgIHZlcnNpb24gIjAuMTEuMiIKKyAgcmVzb2x2ZWQgImh0dHBzOi8vcmVnaXN0cnkueWFybnBrZy5jb20veG1sLWVuY3J5cHRpb24vLS94bWwtZW5jcnlwdGlvbi0wLjExLjIudGd6I2MyMTdmNTUwOTU0N2UzNGI1MDBiODI5ZjJjMGJjYTg1Y2NhNzNhMjEiCisgIGludGVncml0eSBzaGE1MTItalZ2RVM3aTVvdmRPN04rTmpnbmNBMzI2eFlLamhxZUFubnZJZ1JuWTdST0xDZkZxRURMd1AwU3hwLzMwU0hHMEFYUVYxMDQ4VDV5aW5PRnl2d0dGemc9PQogICBkZXBlbmRlbmNpZXM6Ci0gICAgYXN5bmMgIn4wLjIuNyIKLSAgICBlanMgIn4wLjguMyIKLSAgICBub2RlLWZvcmdlICIwLjIuMjQiCisgICAgYXN5bmMgIl4yLjEuNSIKKyAgICBlanMgIl4yLjUuNiIKKyAgICBub2RlLWZvcmdlICJeMC43LjAiCiAgICAgeG1sZG9tICJ+MC4xLjE1IgotICAgIHhwYXRoICIwLjAuNSIKKyAgICB4cGF0aCAiMC4wLjI3IgogCi14bWwyanNAfjAuNC4xOgoreG1sMmpzQF4wLjQuMDoKICAgdmVyc2lvbiAiMC40LjE5IgogICByZXNvbHZlZCAiaHR0cHM6Ly9yZWdpc3RyeS55YXJucGtnLmNvbS94bWwyanMvLS94bWwyanMtMC40LjE5LnRneiM2ODZjMjBmMjEzMjA5ZTk0YWJmMGQxYmNmMWVmYWEyOTFjNzgyN2E3IgorICBpbnRlZ3JpdHkgc2hhNTEyLWVzWm5KWkpPaUpSOXdXS015dXZTRTF5NkRxNUxDdUphbnFoeHNsSDJieE02ZHVhaE5aK0hNcENMaEJRR1prYlg2eFJmOHgxWTJlSmxndDJxM3FvNDlRPT0KICAgZGVwZW5kZW5jaWVzOgogICAgIHNheCAiPj0wLjYuMCIKICAgICB4bWxidWlsZGVyICJ+OS4wLjEiCiAKLXhtbGJ1aWxkZXJAfjIuMS4wOgotICB2ZXJzaW9uICIyLjEuMCIKLSAgcmVzb2x2ZWQgImh0dHA6Ly9yZWdpc3RyeS5ucG1qcy5vcmcveG1sYnVpbGRlci8tL3htbGJ1aWxkZXItMi4xLjAudGd6IzZkZGFlMzE2ODNiNmRmMTIxMDBiMjlmYzhhMGQ0ZjQ2MzQ5YWJiZWQiCit4bWxidWlsZGVyQH4yLjIuMDoKKyAgdmVyc2lvbiAiMi4yLjEiCisgIHJlc29sdmVkICJodHRwczovL3JlZ2lzdHJ5Lnlhcm5wa2cuY29tL3htbGJ1aWxkZXIvLS94bWxidWlsZGVyLTIuMi4xLnRneiM5MzI2NDMwZjEzMGQ4NzQzNWQ0YzQwODY2NDNhYTI5MjZlMTA1YTMyIgorICBpbnRlZ3JpdHkgc2hhMS1reVpERHhNTmgwTmRURUNHWkRxaWttNFFXakk9CiAgIGRlcGVuZGVuY2llczoKLSAgICB1bmRlcnNjb3JlICI+PTEuNS54IgorICAgIGxvZGFzaC1ub2RlICJ+Mi40LjEiCiAKIHhtbGJ1aWxkZXJAfjkuMC4xOgogICB2ZXJzaW9uICI5LjAuNyIKLSAgcmVzb2x2ZWQgImh0dHA6Ly9yZWdpc3RyeS5ucG1qcy5vcmcveG1sYnVpbGRlci8tL3htbGJ1aWxkZXItOS4wLjcudGd6IzEzMmVlNjNkMmVjNTU2NWM1NTdlMjBmNGMyMmRmOWFjYTY4NmIxMGQiCisgIHJlc29sdmVkICJodHRwczovL3JlZ2lzdHJ5Lnlhcm5wa2cuY29tL3htbGJ1aWxkZXIvLS94bWxidWlsZGVyLTkuMC43LnRneiMxMzJlZTYzZDJlYzU1NjVjNTU3ZTIwZjRjMjJkZjlhY2E2ODZiMTBkIgorICBpbnRlZ3JpdHkgc2hhMS1FeTdtUFM3RlZseFZmaUQwd2kzNXJLYUdzUTA9CiAKIHhtbGRvbUA9MC4xLjE5OgogICB2ZXJzaW9uICIwLjEuMTkiCiAgIHJlc29sdmVkICJodHRwczovL3JlZ2lzdHJ5Lnlhcm5wa2cuY29tL3htbGRvbS8tL3htbGRvbS0wLjEuMTkudGd6IzYzMWZjMDc3NzZlZmQ4NDExOGJmMjUxNzFiMzdlZDRkMDc1YTBhYmMiCisgIGludGVncml0eSBzaGExLVl4L0FkM2J2MkVFWXZ5VVhHemZ0VFFkYUNydz0KIAoteG1sZG9tQH4wLjEuMTUsIHhtbGRvbUB+MC4xLjE5OgoreG1sZG9tQF4wLjEuMCwgeG1sZG9tQH4wLjEuMTU6CiAgIHZlcnNpb24gIjAuMS4yNyIKICAgcmVzb2x2ZWQgImh0dHBzOi8vcmVnaXN0cnkueWFybnBrZy5jb20veG1sZG9tLy0veG1sZG9tLTAuMS4yNy50Z3ojZDUwMWY5N2IzYmRiNDAzYWY4ZWY5ZWNjMjA1NzMxODdhYWRhYzBlOSIKKyAgaW50ZWdyaXR5IHNoYTEtMVFINWV6dmJRRHI0NzU3TUlGY3hoNnJhd09rPQogCiB4cGF0aC5qc0A+PTAuMC4zOgogICB2ZXJzaW9uICIxLjEuMCIKICAgcmVzb2x2ZWQgImh0dHBzOi8vcmVnaXN0cnkueWFybnBrZy5jb20veHBhdGguanMvLS94cGF0aC5qcy0xLjEuMC50Z3ojMzgxNmE0NGVkNGJiMzUyMDkxMDgzZDAwMmEzODNkZDUxMDRhNWZmMSIKKyAgaW50ZWdyaXR5IHNoYTUxMi1qZytxa2ZTNEs4RTc5NjVzcWFVbDhtUm5nWGlLYjNXWkdmT05nRTE4cHIwM0ZVUWl1U1Y2RytFajR0UzU1QitySVFTRkVJdzNwaGRWQVE0cFBxTldmUT09CiAKLXhwYXRoQDAuMC41OgotICB2ZXJzaW9uICIwLjAuNSIKLSAgcmVzb2x2ZWQgImh0dHBzOi8vcmVnaXN0cnkueWFybnBrZy5jb20veHBhdGgvLS94cGF0aC0wLjAuNS50Z3ojNDU0MDM2ZjZlZjBmM2RmNWFmNWQ0YmE0YTExOWZiNzU2NzRiM2U2YyIKK3hwYXRoQDAuMC4yNzoKKyAgdmVyc2lvbiAiMC4wLjI3IgorICByZXNvbHZlZCAiaHR0cHM6Ly9yZWdpc3RyeS55YXJucGtnLmNvbS94cGF0aC8tL3hwYXRoLTAuMC4yNy50Z3ojZGQzNDIxZmJkY2M1NjQ2YWMzMmM0ODUzMWI0ZDdlOWQwYzJjZmE5MiIKKyAgaW50ZWdyaXR5IHNoYTUxMi1mZzAzV1J4dGtDVjZvaENsZVBOQUVDWXNtcEtLVHY1TDh5L1gzRG4xaFFyZWMzUE94MmpIWi8wUDJxUTZIdnNyVTFCbWVxWGNvZjNOR0d1ZUc2THh3UT09Cg=="
-    }
-  ]
-}
diff --git a/spec/fixtures/security-reports/remediations/remediation.patch b/spec/fixtures/security-reports/remediations/remediation.patch
deleted file mode 100644
index bbfb6874627..00000000000
--- a/spec/fixtures/security-reports/remediations/remediation.patch
+++ /dev/null
@@ -1,180 +0,0 @@
-diff --git a/yarn.lock b/yarn.lock
-index 0ecc92f..7fa4554 100644
---- a/yarn.lock
-+++ b/yarn.lock
-@@ -2,103 +2,124 @@
- # yarn lockfile v1
- 
- 
--async@~0.2.7:
--  version "0.2.10"
--  resolved "http://registry.npmjs.org/async/-/async-0.2.10.tgz#b6bbe0b0674b9d719708ca38de8c237cb526c3d1"
--
--async@~1.5.2:
--  version "1.5.2"
--  resolved "http://registry.npmjs.org/async/-/async-1.5.2.tgz#ec6a61ae56480c0c3cb241c95618e20892f9672a"
-+async@^2.1.5, async@^2.5.0:
-+  version "2.6.1"
-+  resolved "https://registry.yarnpkg.com/async/-/async-2.6.1.tgz#b245a23ca71930044ec53fa46aa00a3e87c6a610"
-+  integrity sha512-fNEiL2+AZt6AlAw/29Cr0UDe4sRAHCpEHh54WMz+Bb7QfNcFw4h3loofyJpLeQs4Yx7yuqu/2dLgM5hKOs6HlQ==
-+  dependencies:
-+    lodash "^4.17.10"
- 
--debug@^1.0.4:
--  version "1.0.5"
--  resolved "https://registry.yarnpkg.com/debug/-/debug-1.0.5.tgz#f7241217430f99dec4c2b473eab92228e874c2ac"
-+debug@^2.6.0:
-+  version "2.6.9"
-+  resolved "https://registry.yarnpkg.com/debug/-/debug-2.6.9.tgz#5d128515df134ff327e90a4c93f4e077a536341f"
-+  integrity sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==
-   dependencies:
-     ms "2.0.0"
- 
--ejs@~0.8.3:
--  version "0.8.8"
--  resolved "https://registry.yarnpkg.com/ejs/-/ejs-0.8.8.tgz#ffdc56dcc35d02926dd50ad13439bbc54061d598"
-+ejs@^2.5.6:
-+  version "2.6.1"
-+  resolved "https://registry.yarnpkg.com/ejs/-/ejs-2.6.1.tgz#498ec0d495655abc6f23cd61868d926464071aa0"
-+  integrity sha512-0xy4A/twfrRCnkhfk8ErDi5DqdAsAqeGxht4xkCUrsvhhbQNs7E+4jV0CN7+NKIY0aHE72+XvqtBIXzD31ZbXQ==
-+
-+lodash-node@~2.4.1:
-+  version "2.4.1"
-+  resolved "https://registry.yarnpkg.com/lodash-node/-/lodash-node-2.4.1.tgz#ea82f7b100c733d1a42af76801e506105e2a80ec"
-+  integrity sha1-6oL3sQDHM9GkKvdoAeUGEF4qgOw=
-+
-+lodash@^4.17.10:
-+  version "4.17.11"
-+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.11.tgz#b39ea6229ef607ecd89e2c8df12536891cac9b8d"
-+  integrity sha512-cQKh8igo5QUhZ7lg38DYWAxMvjSAKG0A8wGSVimP07SIUEK2UO+arSRKbRZWtelMtN5V0Hkwh5ryOto/SshYIg==
- 
- ms@2.0.0:
-   version "2.0.0"
-   resolved "https://registry.yarnpkg.com/ms/-/ms-2.0.0.tgz#5608aeadfc00be6c2901df5f9861788de0d597c8"
-+  integrity sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=
- 
--node-forge@0.2.24:
--  version "0.2.24"
--  resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-0.2.24.tgz#fa6f846f42fa93f63a0a30c9fbff7b4e130e0858"
-+node-forge@^0.7.0:
-+  version "0.7.6"
-+  resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-0.7.6.tgz#fdf3b418aee1f94f0ef642cd63486c77ca9724ac"
-+  integrity sha512-sol30LUpz1jQFBjOKwbjxijiE3b6pjd74YwfD0fJOKPjF+fONKb2Yg8rYgS6+bK6VDl+/wfr4IYpC7jDzLUIfw==
- 
- saml2-js@^1.5.0:
--  version "1.5.0"
--  resolved "https://registry.yarnpkg.com/saml2-js/-/saml2-js-1.5.0.tgz#c0d2268a179e7329d29eb25aa82df5503774b0d9"
-+  version "1.12.4"
-+  resolved "https://registry.yarnpkg.com/saml2-js/-/saml2-js-1.12.4.tgz#c288f20bda6d2b91073b16c94ea72f22349ac3b3"
-+  integrity sha1-wojyC9ptK5EHOxbJTqcvIjSaw7M=
-   dependencies:
--    async "~1.5.2"
--    debug "^1.0.4"
--    underscore "~1.6.0"
--    xml-crypto "^0.8.1"
--    xml-encryption "~0.7.4"
--    xml2js "~0.4.1"
--    xmlbuilder "~2.1.0"
--    xmldom "~0.1.19"
-+    async "^2.5.0"
-+    debug "^2.6.0"
-+    underscore "^1.8.0"
-+    xml-crypto "^0.10.0"
-+    xml-encryption "^0.11.0"
-+    xml2js "^0.4.0"
-+    xmlbuilder "~2.2.0"
-+    xmldom "^0.1.0"
- 
- sax@>=0.6.0:
-   version "1.2.4"
-   resolved "https://registry.yarnpkg.com/sax/-/sax-1.2.4.tgz#2816234e2378bddc4e5354fab5caa895df7100d9"
-+  integrity sha512-NqVDv9TpANUjFm0N8uM5GxL36UgKi9/atZw+x7YFnQ8ckwFGKrl4xX4yWtrey3UJm5nP1kUbnYgLopqWNSRhWw==
- 
--underscore@>=1.5.x:
-+underscore@^1.8.0:
-   version "1.9.1"
-   resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.9.1.tgz#06dce34a0e68a7babc29b365b8e74b8925203961"
-+  integrity sha512-5/4etnCkd9c8gwgowi5/om/mYO5ajCaOgdzj/oW+0eQV9WxKBDZw5+ycmKmeaTXjInS/W0BzpGLo2xR2aBwZdg==
- 
--underscore@~1.6.0:
--  version "1.6.0"
--  resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.6.0.tgz#8b38b10cacdef63337b8b24e4ff86d45aea529a8"
--
--xml-crypto@^0.8.1:
--  version "0.8.5"
--  resolved "http://registry.npmjs.org/xml-crypto/-/xml-crypto-0.8.5.tgz#2bbcfb3eb33f3a82a218b822bf672b6b1c20e538"
-+xml-crypto@^0.10.0:
-+  version "0.10.1"
-+  resolved "https://registry.yarnpkg.com/xml-crypto/-/xml-crypto-0.10.1.tgz#f832f74ccf56f24afcae1163a1fcab44d96774a8"
-+  integrity sha1-+DL3TM9W8kr8rhFjofyrRNlndKg=
-   dependencies:
-     xmldom "=0.1.19"
-     xpath.js ">=0.0.3"
- 
--xml-encryption@~0.7.4:
--  version "0.7.4"
--  resolved "https://registry.yarnpkg.com/xml-encryption/-/xml-encryption-0.7.4.tgz#42791ec64d556d2455dcb9da0a54123665ac65c7"
-+xml-encryption@^0.11.0:
-+  version "0.11.2"
-+  resolved "https://registry.yarnpkg.com/xml-encryption/-/xml-encryption-0.11.2.tgz#c217f5509547e34b500b829f2c0bca85cca73a21"
-+  integrity sha512-jVvES7i5ovdO7N+NjgncA326xYKjhqeAnnvIgRnY7ROLCfFqEDLwP0Sxp/30SHG0AXQV1048T5yinOFyvwGFzg==
-   dependencies:
--    async "~0.2.7"
--    ejs "~0.8.3"
--    node-forge "0.2.24"
-+    async "^2.1.5"
-+    ejs "^2.5.6"
-+    node-forge "^0.7.0"
-     xmldom "~0.1.15"
--    xpath "0.0.5"
-+    xpath "0.0.27"
- 
--xml2js@~0.4.1:
-+xml2js@^0.4.0:
-   version "0.4.19"
-   resolved "https://registry.yarnpkg.com/xml2js/-/xml2js-0.4.19.tgz#686c20f213209e94abf0d1bcf1efaa291c7827a7"
-+  integrity sha512-esZnJZJOiJR9wWKMyuvSE1y6Dq5LCuJanqhxslH2bxM6duahNZ+HMpCLhBQGZkbX6xRf8x1Y2eJlgt2q3qo49Q==
-   dependencies:
-     sax ">=0.6.0"
-     xmlbuilder "~9.0.1"
- 
--xmlbuilder@~2.1.0:
--  version "2.1.0"
--  resolved "http://registry.npmjs.org/xmlbuilder/-/xmlbuilder-2.1.0.tgz#6ddae31683b6df12100b29fc8a0d4f46349abbed"
-+xmlbuilder@~2.2.0:
-+  version "2.2.1"
-+  resolved "https://registry.yarnpkg.com/xmlbuilder/-/xmlbuilder-2.2.1.tgz#9326430f130d87435d4c4086643aa2926e105a32"
-+  integrity sha1-kyZDDxMNh0NdTECGZDqikm4QWjI=
-   dependencies:
--    underscore ">=1.5.x"
-+    lodash-node "~2.4.1"
- 
- xmlbuilder@~9.0.1:
-   version "9.0.7"
--  resolved "http://registry.npmjs.org/xmlbuilder/-/xmlbuilder-9.0.7.tgz#132ee63d2ec5565c557e20f4c22df9aca686b10d"
-+  resolved "https://registry.yarnpkg.com/xmlbuilder/-/xmlbuilder-9.0.7.tgz#132ee63d2ec5565c557e20f4c22df9aca686b10d"
-+  integrity sha1-Ey7mPS7FVlxVfiD0wi35rKaGsQ0=
- 
- xmldom@=0.1.19:
-   version "0.1.19"
-   resolved "https://registry.yarnpkg.com/xmldom/-/xmldom-0.1.19.tgz#631fc07776efd84118bf25171b37ed4d075a0abc"
-+  integrity sha1-Yx/Ad3bv2EEYvyUXGzftTQdaCrw=
- 
--xmldom@~0.1.15, xmldom@~0.1.19:
-+xmldom@^0.1.0, xmldom@~0.1.15:
-   version "0.1.27"
-   resolved "https://registry.yarnpkg.com/xmldom/-/xmldom-0.1.27.tgz#d501f97b3bdb403af8ef9ecc20573187aadac0e9"
-+  integrity sha1-1QH5ezvbQDr4757MIFcxh6rawOk=
- 
- xpath.js@>=0.0.3:
-   version "1.1.0"
-   resolved "https://registry.yarnpkg.com/xpath.js/-/xpath.js-1.1.0.tgz#3816a44ed4bb352091083d002a383dd5104a5ff1"
-+  integrity sha512-jg+qkfS4K8E7965sqaUl8mRngXiKb3WZGfONgE18pr03FUQiuSV6G+Ej4tS55B+rIQSFEIw3phdVAQ4pPqNWfQ==
- 
--xpath@0.0.5:
--  version "0.0.5"
--  resolved "https://registry.yarnpkg.com/xpath/-/xpath-0.0.5.tgz#454036f6ef0f3df5af5d4ba4a119fb75674b3e6c"
-+xpath@0.0.27:
-+  version "0.0.27"
-+  resolved "https://registry.yarnpkg.com/xpath/-/xpath-0.0.27.tgz#dd3421fbdcc5646ac32c48531b4d7e9d0c2cfa92"
-+  integrity sha512-fg03WRxtkCV6ohClePNAECYsmpKKTv5L8y/X3Dn1hQrec3POx2jHZ/0P2qQ6HvsrU1BmeqXcof3NGGueG6LxwQ==
diff --git a/spec/fixtures/security-reports/remediations/yarn.lock b/spec/fixtures/security-reports/remediations/yarn.lock
deleted file mode 100644
index 0ecc92fb711..00000000000
--- a/spec/fixtures/security-reports/remediations/yarn.lock
+++ /dev/null
@@ -1,104 +0,0 @@
-# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
-# yarn lockfile v1
-
-
-async@~0.2.7:
-  version "0.2.10"
-  resolved "http://registry.npmjs.org/async/-/async-0.2.10.tgz#b6bbe0b0674b9d719708ca38de8c237cb526c3d1"
-
-async@~1.5.2:
-  version "1.5.2"
-  resolved "http://registry.npmjs.org/async/-/async-1.5.2.tgz#ec6a61ae56480c0c3cb241c95618e20892f9672a"
-
-debug@^1.0.4:
-  version "1.0.5"
-  resolved "https://registry.yarnpkg.com/debug/-/debug-1.0.5.tgz#f7241217430f99dec4c2b473eab92228e874c2ac"
-  dependencies:
-    ms "2.0.0"
-
-ejs@~0.8.3:
-  version "0.8.8"
-  resolved "https://registry.yarnpkg.com/ejs/-/ejs-0.8.8.tgz#ffdc56dcc35d02926dd50ad13439bbc54061d598"
-
-ms@2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/ms/-/ms-2.0.0.tgz#5608aeadfc00be6c2901df5f9861788de0d597c8"
-
-node-forge@0.2.24:
-  version "0.2.24"
-  resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-0.2.24.tgz#fa6f846f42fa93f63a0a30c9fbff7b4e130e0858"
-
-saml2-js@^1.5.0:
-  version "1.5.0"
-  resolved "https://registry.yarnpkg.com/saml2-js/-/saml2-js-1.5.0.tgz#c0d2268a179e7329d29eb25aa82df5503774b0d9"
-  dependencies:
-    async "~1.5.2"
-    debug "^1.0.4"
-    underscore "~1.6.0"
-    xml-crypto "^0.8.1"
-    xml-encryption "~0.7.4"
-    xml2js "~0.4.1"
-    xmlbuilder "~2.1.0"
-    xmldom "~0.1.19"
-
-sax@>=0.6.0:
-  version "1.2.4"
-  resolved "https://registry.yarnpkg.com/sax/-/sax-1.2.4.tgz#2816234e2378bddc4e5354fab5caa895df7100d9"
-
-underscore@>=1.5.x:
-  version "1.9.1"
-  resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.9.1.tgz#06dce34a0e68a7babc29b365b8e74b8925203961"
-
-underscore@~1.6.0:
-  version "1.6.0"
-  resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.6.0.tgz#8b38b10cacdef63337b8b24e4ff86d45aea529a8"
-
-xml-crypto@^0.8.1:
-  version "0.8.5"
-  resolved "http://registry.npmjs.org/xml-crypto/-/xml-crypto-0.8.5.tgz#2bbcfb3eb33f3a82a218b822bf672b6b1c20e538"
-  dependencies:
-    xmldom "=0.1.19"
-    xpath.js ">=0.0.3"
-
-xml-encryption@~0.7.4:
-  version "0.7.4"
-  resolved "https://registry.yarnpkg.com/xml-encryption/-/xml-encryption-0.7.4.tgz#42791ec64d556d2455dcb9da0a54123665ac65c7"
-  dependencies:
-    async "~0.2.7"
-    ejs "~0.8.3"
-    node-forge "0.2.24"
-    xmldom "~0.1.15"
-    xpath "0.0.5"
-
-xml2js@~0.4.1:
-  version "0.4.19"
-  resolved "https://registry.yarnpkg.com/xml2js/-/xml2js-0.4.19.tgz#686c20f213209e94abf0d1bcf1efaa291c7827a7"
-  dependencies:
-    sax ">=0.6.0"
-    xmlbuilder "~9.0.1"
-
-xmlbuilder@~2.1.0:
-  version "2.1.0"
-  resolved "http://registry.npmjs.org/xmlbuilder/-/xmlbuilder-2.1.0.tgz#6ddae31683b6df12100b29fc8a0d4f46349abbed"
-  dependencies:
-    underscore ">=1.5.x"
-
-xmlbuilder@~9.0.1:
-  version "9.0.7"
-  resolved "http://registry.npmjs.org/xmlbuilder/-/xmlbuilder-9.0.7.tgz#132ee63d2ec5565c557e20f4c22df9aca686b10d"
-
-xmldom@=0.1.19:
-  version "0.1.19"
-  resolved "https://registry.yarnpkg.com/xmldom/-/xmldom-0.1.19.tgz#631fc07776efd84118bf25171b37ed4d075a0abc"
-
-xmldom@~0.1.15, xmldom@~0.1.19:
-  version "0.1.27"
-  resolved "https://registry.yarnpkg.com/xmldom/-/xmldom-0.1.27.tgz#d501f97b3bdb403af8ef9ecc20573187aadac0e9"
-
-xpath.js@>=0.0.3:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/xpath.js/-/xpath.js-1.1.0.tgz#3816a44ed4bb352091083d002a383dd5104a5ff1"
-
-xpath@0.0.5:
-  version "0.0.5"
-  resolved "https://registry.yarnpkg.com/xpath/-/xpath-0.0.5.tgz#454036f6ef0f3df5af5d4ba4a119fb75674b3e6c"
-- 
cgit v1.2.1


From 41e6c51613fc2bb97c22185cb5a231e0b6a7a38e Mon Sep 17 00:00:00 2001
From: Steve Azzopardi <sazzopardi@gitlab.com>
Date: Tue, 20 Aug 2019 07:02:30 +0000
Subject: Docs DOCKER_AUTH_CONFIG not available for k8s

---
 doc/ci/docker/using_docker_images.md | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/doc/ci/docker/using_docker_images.md b/doc/ci/docker/using_docker_images.md
index d5056568dff..489791141ed 100644
--- a/doc/ci/docker/using_docker_images.md
+++ b/doc/ci/docker/using_docker_images.md
@@ -495,14 +495,6 @@ that runner.
 
 ## Define an image from a private Container Registry
 
-> **Notes:**
->
-> - This feature requires GitLab Runner **1.8** or higher
-> - For GitLab Runner versions **>= 0.6, <1.8** there was a partial
->   support for using private registries, which required manual configuration
->   of credentials on runner's host. We recommend to upgrade your Runner to
->   at least version **1.8** if you want to use private registries.
-
 To access private container registries, the GitLab Runner process can use:
 
 - [Statically defined credentials](#using-statically-defined-credentials). That is, a username and password for a specific registry.
@@ -525,6 +517,17 @@ it's provided as an environment variable. This is because GitLab Runnner uses **
 `config.toml` configuration and doesn't interpolate **ANY** environment variables at
 runtime.
 
+### Requirements and limitations
+
+- This feature requires GitLab Runner **1.8** or higher.
+- For GitLab Runner versions **>= 0.6, <1.8** there was a partial
+  support for using private registries, which required manual configuration
+  of credentials on runner's host. We recommend to upgrade your Runner to
+  at least version **1.8** if you want to use private registries.
+- Not available for [Kubernetes executor](https://docs.gitlab.com/runner/executors/kubernetes.html),
+  follow <https://gitlab.com/gitlab-org/gitlab-runner/issues/2673> for
+  details.
+
 ### Using statically-defined credentials
 
 There are two approaches that you can take in order to access a
-- 
cgit v1.2.1


From dfabed5defb0ba5d509c889cf2bb29c2c5981b9b Mon Sep 17 00:00:00 2001
From: Cameron Swords <cswords@gitlab.com>
Date: Tue, 20 Aug 2019 07:55:03 +0000
Subject: Add missing SAST environment variables

---
 lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
index 4190de73e1f..90278122361 100644
--- a/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
@@ -46,11 +46,14 @@ sast:
           SAST_DOCKER_CLIENT_NEGOTIATION_TIMEOUT \
           SAST_PULL_ANALYZER_IMAGE_TIMEOUT \
           SAST_RUN_ANALYZER_TIMEOUT \
+          SAST_JAVA_VERSION \
           ANT_HOME \
           ANT_PATH \
           GRADLE_PATH \
           JAVA_OPTS \
           JAVA_PATH \
+          JAVA_8_VERSION \
+          JAVA_11_VERSION \
           MAVEN_CLI_OPTS \
           MAVEN_PATH \
           MAVEN_REPO_PATH \
-- 
cgit v1.2.1


From 92ac94c26e408842c6dfa44aae93e147a0f3d8f8 Mon Sep 17 00:00:00 2001
From: Krasimir Angelov <kangelov@gitlab.com>
Date: Tue, 20 Aug 2019 12:28:55 +0300
Subject: Replace finished_at with deployed_at for Deployment entity

Instead of `finished_at` attribute use `deployed_at` methods which also
takes into account the deployment status.

Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/56130.
---
 app/serializers/deployment_entity.rb        | 2 +-
 app/serializers/deployment_serializer.rb    | 2 +-
 changelogs/unreleased/56130-deployed_at.yml | 5 +++++
 spec/fixtures/api/schemas/deployment.json   | 4 ++--
 spec/serializers/deployment_entity_spec.rb  | 4 ++--
 5 files changed, 11 insertions(+), 6 deletions(-)
 create mode 100644 changelogs/unreleased/56130-deployed_at.yml

diff --git a/app/serializers/deployment_entity.rb b/app/serializers/deployment_entity.rb
index 6e91317eb20..d6466ad1cdd 100644
--- a/app/serializers/deployment_entity.rb
+++ b/app/serializers/deployment_entity.rb
@@ -18,7 +18,7 @@ class DeploymentEntity < Grape::Entity
   end
 
   expose :created_at
-  expose :finished_at
+  expose :deployed_at
   expose :tag
   expose :last?
   expose :user, using: UserEntity
diff --git a/app/serializers/deployment_serializer.rb b/app/serializers/deployment_serializer.rb
index 3fd3e1b9cc8..b48037dd53f 100644
--- a/app/serializers/deployment_serializer.rb
+++ b/app/serializers/deployment_serializer.rb
@@ -4,7 +4,7 @@ class DeploymentSerializer < BaseSerializer
   entity DeploymentEntity
 
   def represent_concise(resource, opts = {})
-    opts[:only] = [:iid, :id, :sha, :created_at, :finished_at, :tag, :last?, :id, ref: [:name]]
+    opts[:only] = [:iid, :id, :sha, :created_at, :deployed_at, :tag, :last?, :id, ref: [:name]]
     represent(resource, opts)
   end
 end
diff --git a/changelogs/unreleased/56130-deployed_at.yml b/changelogs/unreleased/56130-deployed_at.yml
new file mode 100644
index 00000000000..c53658de752
--- /dev/null
+++ b/changelogs/unreleased/56130-deployed_at.yml
@@ -0,0 +1,5 @@
+---
+title: Replace finished_at with deployed_at for the internal API Deployment entity
+merge_request: 32000
+author:
+type: other
diff --git a/spec/fixtures/api/schemas/deployment.json b/spec/fixtures/api/schemas/deployment.json
index 9216ad0060b..fe725b97c21 100644
--- a/spec/fixtures/api/schemas/deployment.json
+++ b/spec/fixtures/api/schemas/deployment.json
@@ -3,7 +3,7 @@
   "required": [
     "sha",
     "created_at",
-    "finished_at",
+    "deployed_at",
     "iid",
     "tag",
     "last?",
@@ -12,7 +12,7 @@
   ],
   "properties": {
     "created_at": { "type": "string" },
-    "finished_at": { "type": ["string", "null"] },
+    "deployed_at": { "type": ["string", "null"] },
     "id": { "type": "integer" },
     "iid": { "type": "integer" },
     "last?": { "type": "boolean" },
diff --git a/spec/serializers/deployment_entity_spec.rb b/spec/serializers/deployment_entity_spec.rb
index c0ea2b3c389..1b19eac9a97 100644
--- a/spec/serializers/deployment_entity_spec.rb
+++ b/spec/serializers/deployment_entity_spec.rb
@@ -32,8 +32,8 @@ describe DeploymentEntity do
     expect(subject).to include(:created_at)
   end
 
-  it 'exposes finished_at' do
-    expect(subject).to include(:finished_at)
+  it 'exposes deployed_at' do
+    expect(subject).to include(:deployed_at)
   end
 
   context 'when the pipeline has another manual action' do
-- 
cgit v1.2.1


From 6767326267a649a04a0f6c7634be87577a788a3d Mon Sep 17 00:00:00 2001
From: Peter Leitzen <pleitzen@gitlab.com>
Date: Tue, 20 Aug 2019 10:52:21 +0000
Subject: Use ActiveModel's type instead of virtus

The virtus project has been discontinued:

https://github.com/solnic/virtus/commit/a6f896984
---
 Gemfile                                        |  1 -
 Gemfile.lock                                   |  1 -
 app/controllers/projects/blob_controller.rb    |  6 +++-
 app/presenters/blobs/unfold_presenter.rb       | 43 +++++++++++++-------------
 lib/gt_one_coercion.rb                         |  7 -----
 spec/presenters/blobs/unfold_presenter_spec.rb | 25 +++++++++++----
 6 files changed, 46 insertions(+), 37 deletions(-)
 delete mode 100644 lib/gt_one_coercion.rb

diff --git a/Gemfile b/Gemfile
index 59aa67e642e..116c94bdaf8 100644
--- a/Gemfile
+++ b/Gemfile
@@ -275,7 +275,6 @@ gem 'font-awesome-rails', '~> 4.7'
 gem 'gemojione', '~> 3.3'
 gem 'gon', '~> 6.2'
 gem 'request_store', '~> 1.3'
-gem 'virtus', '~> 1.0.1'
 gem 'base32', '~> 0.3.0'
 
 # Sentry integration
diff --git a/Gemfile.lock b/Gemfile.lock
index d8f7ca994da..0ecf3aa2840 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1252,7 +1252,6 @@ DEPENDENCIES
   unicorn-worker-killer (~> 0.4.4)
   validates_hostname (~> 1.0.6)
   version_sorter (~> 2.2.4)
-  virtus (~> 1.0.1)
   vmstat (~> 2.3.0)
   webmock (~> 3.5.1)
   webpack-rails (~> 0.9.10)
diff --git a/app/controllers/projects/blob_controller.rb b/app/controllers/projects/blob_controller.rb
index b04ffe80db4..4125f44d00a 100644
--- a/app/controllers/projects/blob_controller.rb
+++ b/app/controllers/projects/blob_controller.rb
@@ -92,7 +92,7 @@ class Projects::BlobController < Projects::ApplicationController
   def diff
     apply_diff_view_cookie!
 
-    @form = Blobs::UnfoldPresenter.new(blob, params.to_unsafe_h)
+    @form = Blobs::UnfoldPresenter.new(blob, diff_params)
 
     # keep only json rendering when
     # https://gitlab.com/gitlab-org/gitlab-ce/issues/44988 is done
@@ -239,4 +239,8 @@ class Projects::BlobController < Projects::ApplicationController
   def tree_path
     @path.rpartition('/').first
   end
+
+  def diff_params
+    params.permit(:full, :since, :to, :bottom, :unfold, :offset, :indent)
+  end
 end
diff --git a/app/presenters/blobs/unfold_presenter.rb b/app/presenters/blobs/unfold_presenter.rb
index 4c6dd6895cf..a256dd05a4d 100644
--- a/app/presenters/blobs/unfold_presenter.rb
+++ b/app/presenters/blobs/unfold_presenter.rb
@@ -1,30 +1,34 @@
 # frozen_string_literal: true
 
-require 'gt_one_coercion'
-
 module Blobs
   class UnfoldPresenter < BlobPresenter
-    include Virtus.model
+    include ActiveModel::Attributes
+    include ActiveModel::AttributeAssignment
     include Gitlab::Utils::StrongMemoize
 
-    attribute :full, Boolean, default: false
-    attribute :since, GtOneCoercion
-    attribute :to, Integer
-    attribute :bottom, Boolean
-    attribute :unfold, Boolean, default: true
-    attribute :offset, Integer
-    attribute :indent, Integer, default: 0
+    attribute :full, :boolean, default: false
+    attribute :since, :integer, default: 1
+    attribute :to, :integer, default: 1
+    attribute :bottom, :boolean, default: false
+    attribute :unfold, :boolean, default: true
+    attribute :offset, :integer, default: 0
+    attribute :indent, :integer, default: 0
+
+    alias_method :full?, :full
+    alias_method :bottom?, :bottom
+    alias_method :unfold?, :unfold
 
     def initialize(blob, params)
+      super(blob)
+      self.attributes = params
+
       # Load all blob data first as we need to ensure they're all loaded first
       # so we can accurately show the rest of the diff when unfolding.
       load_all_blob_data
 
-      @subject = blob
       @all_lines = blob.data.lines
-      super(params)
 
-      self.attributes = prepare_attributes
+      handle_full_or_end!
     end
 
     # Returns an array of Gitlab::Diff::Line with match line added
@@ -56,21 +60,18 @@ module Blobs
 
     private
 
-    def prepare_attributes
-      return attributes unless full? || to == -1
+    def handle_full_or_end!
+      return unless full? || to == -1
 
-      full_opts = {
-        since: 1,
+      self.since = 1 if full?
+
+      self.attributes = {
         to: all_lines_size,
         bottom: false,
         unfold: false,
         offset: 0,
         indent: 0
       }
-
-      return full_opts if full?
-
-      full_opts.merge(attributes.slice(:since))
     end
 
     def all_lines_size
diff --git a/lib/gt_one_coercion.rb b/lib/gt_one_coercion.rb
deleted file mode 100644
index 99be51bc8c6..00000000000
--- a/lib/gt_one_coercion.rb
+++ /dev/null
@@ -1,7 +0,0 @@
-# frozen_string_literal: true
-
-class GtOneCoercion < Virtus::Attribute
-  def coerce(value)
-    [1, value.to_i].max
-  end
-end
diff --git a/spec/presenters/blobs/unfold_presenter_spec.rb b/spec/presenters/blobs/unfold_presenter_spec.rb
index ab3f8080257..83004809536 100644
--- a/spec/presenters/blobs/unfold_presenter_spec.rb
+++ b/spec/presenters/blobs/unfold_presenter_spec.rb
@@ -10,16 +10,31 @@ describe Blobs::UnfoldPresenter do
   let(:subject) { described_class.new(blob, params) }
 
   describe '#initialize' do
+    let(:result) { subject }
+
+    context 'with empty params' do
+      let(:params) { {} }
+
+      it 'sets default attributes' do
+        expect(result.full?).to eq(false)
+        expect(result.since).to eq(1)
+        expect(result.to).to eq(1)
+        expect(result.bottom).to eq(false)
+        expect(result.unfold).to eq(true)
+        expect(result.offset).to eq(0)
+        expect(result.indent).to eq(0)
+      end
+    end
+
     context 'when full is false' do
       let(:params) { { full: false, since: 2, to: 3, bottom: false, offset: 1, indent: 1 } }
 
       it 'sets attributes' do
-        result = subject
-
         expect(result.full?).to eq(false)
         expect(result.since).to eq(2)
         expect(result.to).to eq(3)
         expect(result.bottom).to eq(false)
+        expect(result.unfold).to eq(true)
         expect(result.offset).to eq(1)
         expect(result.indent).to eq(1)
       end
@@ -29,12 +44,11 @@ describe Blobs::UnfoldPresenter do
       let(:params) { { full: true, since: 2, to: 3, bottom: false, offset: 1, indent: 1 } }
 
       it 'sets other attributes' do
-        result = subject
-
         expect(result.full?).to eq(true)
         expect(result.since).to eq(1)
         expect(result.to).to eq(blob.lines.size)
         expect(result.bottom).to eq(false)
+        expect(result.unfold).to eq(false)
         expect(result.offset).to eq(0)
         expect(result.indent).to eq(0)
       end
@@ -44,12 +58,11 @@ describe Blobs::UnfoldPresenter do
       let(:params) { { full: false, since: 2, to: -1, bottom: true, offset: 1, indent: 1 } }
 
       it 'sets other attributes' do
-        result = subject
-
         expect(result.full?).to eq(false)
         expect(result.since).to eq(2)
         expect(result.to).to eq(blob.lines.size)
         expect(result.bottom).to eq(false)
+        expect(result.unfold).to eq(false)
         expect(result.offset).to eq(0)
         expect(result.indent).to eq(0)
       end
-- 
cgit v1.2.1


From 3b7df66eef935046363c39d835b0a34d85b51584 Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Sun, 18 Aug 2019 08:57:24 +0000
Subject: Require request specs when testing N+1 for controllers

---
 doc/development/query_recorder.md               | 7 +++++++
 doc/development/testing_guide/testing_levels.md | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/doc/development/query_recorder.md b/doc/development/query_recorder.md
index a6b60149ea4..3787e2ef187 100644
--- a/doc/development/query_recorder.md
+++ b/doc/development/query_recorder.md
@@ -36,6 +36,13 @@ it "avoids N+1 database queries" do
 end
 ```
 
+## Use request specs instead of controller specs
+
+Use a [request spec](https://gitlab.com/gitlab-org/gitlab-ce/tree/master/spec/requests) when writing a N+1 test on the controller level.
+
+Controller specs should not be used to write N+1 tests as the controller is only initialized once per example.
+This could lead to false successes where subsequent "requests" could have queries reduced (e.g. because of memoization).
+
 ## Finding the source of the query
 
 It may be useful to identify the source of the queries by looking at the call backtrace.
diff --git a/doc/development/testing_guide/testing_levels.md b/doc/development/testing_guide/testing_levels.md
index e1ce4d3b7d1..6e1fdc765a1 100644
--- a/doc/development/testing_guide/testing_levels.md
+++ b/doc/development/testing_guide/testing_levels.md
@@ -63,7 +63,7 @@ They're useful to test permissions, redirections, what view is rendered etc.
 
 | Code path | Tests path | Testing engine | Notes |
 | --------- | ---------- | -------------- | ----- |
-| `app/controllers/` | `spec/controllers/` | RSpec | |
+| `app/controllers/` | `spec/controllers/` | RSpec | For N+1 tests, use [request specs](../query_recorder.md#use-request-specs-instead-of-controller-specs) |
 | `app/mailers/` | `spec/mailers/` | RSpec | |
 | `lib/api/` | `spec/requests/api/` | RSpec | |
 | `lib/ci/api/` | `spec/requests/ci/api/` | RSpec | |
-- 
cgit v1.2.1


From 505dfe5939f4faf4d297e939aa84771f17eaae33 Mon Sep 17 00:00:00 2001
From: Zeger-Jan van de Weg <git@zjvandeweg.nl>
Date: Tue, 20 Aug 2019 14:03:38 +0200
Subject: Remove Gitaly version in the docs

It's very hard for end user to know what version of Gitaly is running,
and they should not have to care about this detail either. Gitaly 1.21.0
was released before 11.9 was tagged, so it's an unsupported version too.

This change removes the reference.
---
 doc/ci/merge_request_pipelines/pipelines_for_merged_results/index.md | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/doc/ci/merge_request_pipelines/pipelines_for_merged_results/index.md b/doc/ci/merge_request_pipelines/pipelines_for_merged_results/index.md
index ad07c662965..126e12e460f 100644
--- a/doc/ci/merge_request_pipelines/pipelines_for_merged_results/index.md
+++ b/doc/ci/merge_request_pipelines/pipelines_for_merged_results/index.md
@@ -35,10 +35,9 @@ get out of WIP status or resolve merge conflicts as soon as possible.
 
 ## Requirements and limitations
 
-Pipelines for merged results require:
+Pipelines for merged results require a [GitLab Runner][runner] 11.9 or newer.
 
-- [GitLab Runner](https://gitlab.com/gitlab-org/gitlab-runner) 11.9 or newer.
-- [Gitaly](https://gitlab.com/gitlab-org/gitaly) 1.21.0 or newer.
+[runner]: https://gitlab.com/gitlab-org/gitlab-runner
 
 In addition, pipelines for merged results have the following limitations:
 
-- 
cgit v1.2.1


From c4ef944c01538c7e6445e066762dd9f978df7b51 Mon Sep 17 00:00:00 2001
From: Patrick Bajao <ebajao@gitlab.com>
Date: Tue, 20 Aug 2019 20:50:18 +0800
Subject: Update to GitLab Shell v9.4.0

---
 GITLAB_SHELL_VERSION                                   | 2 +-
 changelogs/unreleased/pb-update-gitlab-shell-9-4-0.yml | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/pb-update-gitlab-shell-9-4-0.yml

diff --git a/GITLAB_SHELL_VERSION b/GITLAB_SHELL_VERSION
index b13d146a7b0..8148c559489 100644
--- a/GITLAB_SHELL_VERSION
+++ b/GITLAB_SHELL_VERSION
@@ -1 +1 @@
-9.3.0
+9.4.0
diff --git a/changelogs/unreleased/pb-update-gitlab-shell-9-4-0.yml b/changelogs/unreleased/pb-update-gitlab-shell-9-4-0.yml
new file mode 100644
index 00000000000..81db7bb4900
--- /dev/null
+++ b/changelogs/unreleased/pb-update-gitlab-shell-9-4-0.yml
@@ -0,0 +1,5 @@
+---
+title: Update to GitLab Shell v9.4.0
+merge_request: 32009
+author:
+type: other
-- 
cgit v1.2.1


From ce50d5c45158723925b098f7e0033963841137ff Mon Sep 17 00:00:00 2001
From: rossfuhrman <rfuhrman@gitlab.com>
Date: Tue, 20 Aug 2019 13:29:23 +0000
Subject: Move SAST reports logic for MR widget to backend

Update spec that is changed in corresponding EE MR
---
 .../feature-branch/gl-sast-report.json             | 86 ----------------------
 1 file changed, 86 deletions(-)

diff --git a/spec/fixtures/security-reports/feature-branch/gl-sast-report.json b/spec/fixtures/security-reports/feature-branch/gl-sast-report.json
index 4bef3d22f70..27c8661013a 100644
--- a/spec/fixtures/security-reports/feature-branch/gl-sast-report.json
+++ b/spec/fixtures/security-reports/feature-branch/gl-sast-report.json
@@ -856,92 +856,6 @@
       "line": 4,
       "url": "https://cwe.mitre.org/data/definitions/119.html",
       "tool": "flawfinder"
-    },
-    {
-      "category": "sast",
-      "message": "Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362)",
-      "cve": "c/subdir/utils.c:bab681140fcc8fc3085b6bba74081b44ea145c1c98b5e70cf19ace2417d30770:CWE-362",
-      "confidence": "Low",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "c/subdir/utils.c",
-        "start_line": 8
-      },
-      "identifiers": [
-        {
-          "type": "cwe",
-          "name": "CWE-362",
-          "value": "362",
-          "url": "https://cwe.mitre.org/data/definitions/362.html"
-        }
-      ],
-      "file": "c/subdir/utils.c",
-      "line": 8,
-      "url": "https://cwe.mitre.org/data/definitions/362.html",
-      "tool": "flawfinder"
-    },
-    {
-      "category": "sast",
-      "message": "Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120)",
-      "cve": "cplusplus/src/hello.cpp:c8c6dd0afdae6814194cf0930b719f757ab7b379cf8f261e7f4f9f2f323a818a:CWE-119!/CWE-120",
-      "confidence": "Low",
-      "solution": "Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "cplusplus/src/hello.cpp",
-        "start_line": 6
-      },
-      "identifiers": [
-        {
-          "type": "cwe",
-          "name": "CWE-119",
-          "value": "119",
-          "url": "https://cwe.mitre.org/data/definitions/119.html"
-        },
-        {
-          "type": "cwe",
-          "name": "CWE-120",
-          "value": "120",
-          "url": "https://cwe.mitre.org/data/definitions/120.html"
-        }
-      ],
-      "file": "cplusplus/src/hello.cpp",
-      "line": 6,
-      "url": "https://cwe.mitre.org/data/definitions/119.html",
-      "tool": "flawfinder"
-    },
-    {
-      "category": "sast",
-      "message": "Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120)",
-      "cve": "cplusplus/src/hello.cpp:331c04062c4fe0c7c486f66f59e82ad146ab33cdd76ae757ca41f392d568cbd0:CWE-120",
-      "confidence": "Low",
-      "solution": "Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "cplusplus/src/hello.cpp",
-        "start_line": 7
-      },
-      "identifiers": [
-        {
-          "type": "cwe",
-          "name": "CWE-120",
-          "value": "120",
-          "url": "https://cwe.mitre.org/data/definitions/120.html"
-        }
-      ],
-      "file": "cplusplus/src/hello.cpp",
-      "line": 7,
-      "url": "https://cwe.mitre.org/data/definitions/120.html",
-      "tool": "flawfinder"
     }
   ]
 }
-- 
cgit v1.2.1


From 790f64561a21a16c3f13e176f68530f9238ca78d Mon Sep 17 00:00:00 2001
From: Andrew Newdigate <andrew@gitlab.com>
Date: Tue, 20 Aug 2019 13:52:25 +0000
Subject: Allow measurement for Sidekiq jobs taking > 2.5s

Fix for https://gitlab.com/gitlab-org/gitlab-ce/issues/66319.
---
 changelogs/unreleased/an-fix-sidekiq-histogram-buckets.yml | 5 +++++
 lib/gitlab/sidekiq_middleware/metrics.rb                   | 6 +++++-
 spec/lib/gitlab/sidekiq_middleware/metrics_spec.rb         | 2 +-
 3 files changed, 11 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/an-fix-sidekiq-histogram-buckets.yml

diff --git a/changelogs/unreleased/an-fix-sidekiq-histogram-buckets.yml b/changelogs/unreleased/an-fix-sidekiq-histogram-buckets.yml
new file mode 100644
index 00000000000..696b8f3987e
--- /dev/null
+++ b/changelogs/unreleased/an-fix-sidekiq-histogram-buckets.yml
@@ -0,0 +1,5 @@
+---
+title: Allow latency measurements of sidekiq jobs taking > 2.5s
+merge_request: 32001
+author:
+type: fixed
diff --git a/lib/gitlab/sidekiq_middleware/metrics.rb b/lib/gitlab/sidekiq_middleware/metrics.rb
index b06ffa9c121..3dc9521ee8b 100644
--- a/lib/gitlab/sidekiq_middleware/metrics.rb
+++ b/lib/gitlab/sidekiq_middleware/metrics.rb
@@ -3,6 +3,10 @@
 module Gitlab
   module SidekiqMiddleware
     class Metrics
+      # SIDEKIQ_LATENCY_BUCKETS are latency histogram buckets better suited to Sidekiq
+      # timeframes than the DEFAULT_BUCKET definition. Defined in seconds.
+      SIDEKIQ_LATENCY_BUCKETS = [0.1, 0.25, 0.5, 1, 2.5, 5, 10, 60, 300, 600].freeze
+
       def initialize
         @metrics = init_metrics
       end
@@ -31,7 +35,7 @@ module Gitlab
 
       def init_metrics
         {
-          sidekiq_jobs_completion_seconds: ::Gitlab::Metrics.histogram(:sidekiq_jobs_completion_seconds, 'Seconds to complete sidekiq job'),
+          sidekiq_jobs_completion_seconds: ::Gitlab::Metrics.histogram(:sidekiq_jobs_completion_seconds, 'Seconds to complete sidekiq job', buckets: SIDEKIQ_LATENCY_BUCKETS),
           sidekiq_jobs_failed_total:       ::Gitlab::Metrics.counter(:sidekiq_jobs_failed_total, 'Sidekiq jobs failed'),
           sidekiq_jobs_retried_total:      ::Gitlab::Metrics.counter(:sidekiq_jobs_retried_total, 'Sidekiq jobs retried'),
           sidekiq_running_jobs:            ::Gitlab::Metrics.gauge(:sidekiq_running_jobs, 'Number of Sidekiq jobs running', {}, :livesum)
diff --git a/spec/lib/gitlab/sidekiq_middleware/metrics_spec.rb b/spec/lib/gitlab/sidekiq_middleware/metrics_spec.rb
index c6df1c6a0d8..e430599bd94 100644
--- a/spec/lib/gitlab/sidekiq_middleware/metrics_spec.rb
+++ b/spec/lib/gitlab/sidekiq_middleware/metrics_spec.rb
@@ -13,7 +13,7 @@ describe Gitlab::SidekiqMiddleware::Metrics do
     let(:running_jobs_metric) { double('running jobs metric') }
 
     before do
-      allow(Gitlab::Metrics).to receive(:histogram).with(:sidekiq_jobs_completion_seconds, anything).and_return(completion_seconds_metric)
+      allow(Gitlab::Metrics).to receive(:histogram).with(:sidekiq_jobs_completion_seconds, anything, anything).and_return(completion_seconds_metric)
       allow(Gitlab::Metrics).to receive(:counter).with(:sidekiq_jobs_failed_total, anything).and_return(failed_total_metric)
       allow(Gitlab::Metrics).to receive(:counter).with(:sidekiq_jobs_retried_total, anything).and_return(retried_total_metric)
       allow(Gitlab::Metrics).to receive(:gauge).with(:sidekiq_running_jobs, anything, {}, :livesum).and_return(running_jobs_metric)
-- 
cgit v1.2.1


From 0dcb9d21efc1db97765d82ee39a0f0905ba945ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Diego=20Louz=C3=A1n?= <diego.louzan.ext@siemens.com>
Date: Wed, 10 Jul 2019 21:40:28 +0200
Subject: feat: SMIME signed notification emails

- Add mail interceptor the signs outgoing email with SMIME
- Add lib and helpers to work with SMIME data
- New configuration params for setting up SMIME key and cert files
---
 .gitignore                                         |  2 +
 .../feat-smime-signed-notification-emails.yml      |  5 ++
 config/gitlab.yml.example                          |  9 +++
 config/initializers/1_settings.rb                  |  2 +
 config/initializers/action_mailer_hooks.rb         |  5 ++
 config/smime_signature_settings.rb                 | 11 ++++
 doc/administration/index.md                        |  1 +
 doc/administration/smime_signing_email.md          | 49 ++++++++++++++
 doc/development/emails.md                          |  4 ++
 .../email/hook/smime_signature_interceptor.rb      | 50 ++++++++++++++
 lib/gitlab/email/smime/certificate.rb              | 36 ++++++++++
 lib/gitlab/email/smime/signer.rb                   | 29 ++++++++
 spec/config/smime_signature_settings_spec.rb       | 56 ++++++++++++++++
 spec/initializers/action_mailer_hooks_spec.rb      | 46 +++++++++++++
 .../email/hook/disable_email_interceptor_spec.rb   |  3 -
 .../email/hook/smime_signature_interceptor_spec.rb | 52 +++++++++++++++
 spec/lib/gitlab/email/smime/certificate_spec.rb    | 77 ++++++++++++++++++++++
 spec/lib/gitlab/email/smime/signer_spec.rb         | 26 ++++++++
 spec/support/helpers/smime_helper.rb               | 55 ++++++++++++++++
 19 files changed, 515 insertions(+), 3 deletions(-)
 create mode 100644 changelogs/unreleased/feat-smime-signed-notification-emails.yml
 create mode 100644 config/smime_signature_settings.rb
 create mode 100644 doc/administration/smime_signing_email.md
 create mode 100644 lib/gitlab/email/hook/smime_signature_interceptor.rb
 create mode 100644 lib/gitlab/email/smime/certificate.rb
 create mode 100644 lib/gitlab/email/smime/signer.rb
 create mode 100644 spec/config/smime_signature_settings_spec.rb
 create mode 100644 spec/initializers/action_mailer_hooks_spec.rb
 create mode 100644 spec/lib/gitlab/email/hook/smime_signature_interceptor_spec.rb
 create mode 100644 spec/lib/gitlab/email/smime/certificate_spec.rb
 create mode 100644 spec/lib/gitlab/email/smime/signer_spec.rb
 create mode 100644 spec/support/helpers/smime_helper.rb

diff --git a/.gitignore b/.gitignore
index cb718a6939f..104c6930050 100644
--- a/.gitignore
+++ b/.gitignore
@@ -75,6 +75,8 @@ eslint-report.html
 /.rspec
 /plugins/*
 /.gitlab_pages_secret
+/.gitlab_smime_key
+/.gitlab_smime_cert
 package-lock.json
 /junit_*.xml
 /coverage-frontend/
diff --git a/changelogs/unreleased/feat-smime-signed-notification-emails.yml b/changelogs/unreleased/feat-smime-signed-notification-emails.yml
new file mode 100644
index 00000000000..9672d0d964c
--- /dev/null
+++ b/changelogs/unreleased/feat-smime-signed-notification-emails.yml
@@ -0,0 +1,5 @@
+---
+title: Notification emails can be signed with SMIME
+merge_request: 30644
+author: Diego Louzán
+type: added
diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
index 226f2ec3722..2f6658594cc 100644
--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
@@ -95,6 +95,15 @@ production: &base
     email_display_name: GitLab
     email_reply_to: noreply@example.com
     email_subject_suffix: ''
+    email_smime:
+      # Uncomment and set to true if you need to enable email S/MIME signing (default: false)
+      # enabled: false
+      # S/MIME private key file in PEM format, unencrypted
+      # Default is '.gitlab_smime_key' relative to Rails.root (i.e. root of the GitLab app).
+      # key_file: /home/git/gitlab/.gitlab_smime_key
+      # S/MIME public certificate key in PEM format, will be attached to signed messages
+      # Default is '.gitlab_smime_cert' relative to Rails.root (i.e. root of the GitLab app).
+      # cert_file: /home/git/gitlab/.gitlab_smime_cert
 
     # Email server smtp settings are in config/initializers/smtp_settings.rb.sample
 
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index 828732126b6..fdc6b0a05ab 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -1,5 +1,6 @@
 require_relative '../settings'
 require_relative '../object_store_settings'
+require_relative '../smime_signature_settings'
 
 # Default settings
 Settings['ldap'] ||= Settingslogic.new({})
@@ -171,6 +172,7 @@ Settings.gitlab['email_from'] ||= ENV['GITLAB_EMAIL_FROM'] || "gitlab@#{Settings
 Settings.gitlab['email_display_name'] ||= ENV['GITLAB_EMAIL_DISPLAY_NAME'] || 'GitLab'
 Settings.gitlab['email_reply_to'] ||= ENV['GITLAB_EMAIL_REPLY_TO'] || "noreply@#{Settings.gitlab.host}"
 Settings.gitlab['email_subject_suffix'] ||= ENV['GITLAB_EMAIL_SUBJECT_SUFFIX'] || ""
+Settings.gitlab['email_smime'] = SmimeSignatureSettings.parse(Settings.gitlab['email_smime'])
 Settings.gitlab['base_url']   ||= Settings.__send__(:build_base_gitlab_url)
 Settings.gitlab['url']        ||= Settings.__send__(:build_gitlab_url)
 Settings.gitlab['user']       ||= 'git'
diff --git a/config/initializers/action_mailer_hooks.rb b/config/initializers/action_mailer_hooks.rb
index f1b3c1f8ae8..02ca6ef13bf 100644
--- a/config/initializers/action_mailer_hooks.rb
+++ b/config/initializers/action_mailer_hooks.rb
@@ -10,3 +10,8 @@ ActionMailer::Base.register_interceptors(
 )
 
 ActionMailer::Base.register_observer(::Gitlab::Email::Hook::DeliveryMetricsObserver)
+
+if Gitlab.config.gitlab.email_enabled && Gitlab.config.gitlab.email_smime.enabled
+  ActionMailer::Base.register_interceptor(::Gitlab::Email::Hook::SmimeSignatureInterceptor)
+  Gitlab::AppLogger.debug "S/MIME signing of outgoing emails enabled"
+end
diff --git a/config/smime_signature_settings.rb b/config/smime_signature_settings.rb
new file mode 100644
index 00000000000..3d19db84c19
--- /dev/null
+++ b/config/smime_signature_settings.rb
@@ -0,0 +1,11 @@
+# Set default values for email_smime settings
+class SmimeSignatureSettings
+  def self.parse(email_smime)
+    email_smime ||= Settingslogic.new({})
+    email_smime['enabled'] = false unless email_smime['enabled']
+    email_smime['key_file'] ||= Rails.root.join('.gitlab_smime_key')
+    email_smime['cert_file'] ||= Rails.root.join('.gitlab_smime_cert')
+
+    email_smime
+  end
+end
diff --git a/doc/administration/index.md b/doc/administration/index.md
index f7f9d753e58..6aedd390125 100644
--- a/doc/administration/index.md
+++ b/doc/administration/index.md
@@ -64,6 +64,7 @@ Learn how to install, configure, update, and maintain your GitLab instance.
 - [External Classification Policy Authorization](../user/admin_area/settings/external_authorization.md) **(PREMIUM ONLY)**
 - [Upload a license](../user/admin_area/license.md): Upload a license to unlock features that are in paid tiers of GitLab. **(STARTER ONLY)**
 - [Admin Area](../user/admin_area/index.md): for self-managed instance-wide configuration and maintenance.
+- [S/MIME Signing](smime_signing_email.md): how to sign all outgoing notification emails with S/MIME
 
 #### Customizing GitLab's appearance
 
diff --git a/doc/administration/smime_signing_email.md b/doc/administration/smime_signing_email.md
new file mode 100644
index 00000000000..9f719088f25
--- /dev/null
+++ b/doc/administration/smime_signing_email.md
@@ -0,0 +1,49 @@
+# Signing outgoing email with S/MIME
+
+Notification emails sent by Gitlab can be signed with S/MIME for improved
+security.
+
+> **Note:**
+Please be aware that S/MIME certificates and TLS/SSL certificates are not the
+same and are used for different purposes: TLS creates a secure channel, whereas
+S/MIME signs and/or encrypts the message itself
+
+## Enable S/MIME signing
+
+This setting must be explicitly enabled and a single pair of key and certificate
+files must be provided in `gitlab.rb` or `gitlab.yml` if you are using Omnibus
+GitLab or installed GitLab from source respectively:
+
+```yaml
+email_smime:
+  enabled: true
+  key_file: /etc/pki/smime/private/gitlab.key
+  cert_file: /etc/pki/smime/certs/gitlab.crt
+```
+
+- Both files must be provided PEM-encoded.
+- The key file must be unencrypted so that Gitlab can read it without user 
+  intervention.
+
+NOTE: **Note:** Be mindful of the access levels for your private keys and visibility to
+third parties.
+
+### How to convert S/MIME PKCS#12 / PFX format to PEM encoding
+
+Typically S/MIME certificates are handled in binary PKCS#12 format (`.pfx` or `.p12`
+extensions), which contain the following in a single encrypted file:
+
+- Server certificate
+- Intermediate certificates (if any)
+- Private key
+
+In order to export the required files in PEM encoding from the PKCS#12 file,
+the `openssl` command can be used:
+
+```bash
+#-- Extract private key in PEM encoding (no password, unencrypted)
+$ openssl pkcs12 -in gitlab.p12 -nocerts -nodes -out gitlab.key
+
+#-- Extract certificates in PEM encoding (full certs chain including CA)
+$ openssl pkcs12 -in gitlab.p12 -nokeys -out gitlab.crt
+```
diff --git a/doc/development/emails.md b/doc/development/emails.md
index e6af075a282..edec0f86989 100644
--- a/doc/development/emails.md
+++ b/doc/development/emails.md
@@ -5,6 +5,10 @@
 To view rendered emails "sent" in your development instance, visit
 [`/rails/letter_opener`](http://localhost:3000/rails/letter_opener).
 
+Please note that [S/MIME signed](../administration/smime_signing_email.md) emails
+[cannot be currently previewed](https://github.com/fgrehm/letter_opener_web/issues/96) with 
+`letter_opener`.
+
 ## Mailer previews
 
 Rails provides a way to preview our mailer templates in HTML and plaintext using
diff --git a/lib/gitlab/email/hook/smime_signature_interceptor.rb b/lib/gitlab/email/hook/smime_signature_interceptor.rb
new file mode 100644
index 00000000000..e48041d9218
--- /dev/null
+++ b/lib/gitlab/email/hook/smime_signature_interceptor.rb
@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Email
+    module Hook
+      class SmimeSignatureInterceptor
+        # Sign emails with SMIME if enabled
+        class << self
+          def delivering_email(message)
+            signed_message = Gitlab::Email::Smime::Signer.sign(
+              cert: certificate.cert,
+              key: certificate.key,
+              data: message.encoded)
+            signed_email = Mail.new(signed_message)
+
+            overwrite_body(message, signed_email)
+            overwrite_headers(message, signed_email)
+          end
+
+          private
+
+          def certificate
+            @certificate ||= Gitlab::Email::Smime::Certificate.from_files(key_path, cert_path)
+          end
+
+          def key_path
+            Gitlab.config.gitlab.email_smime.key_file
+          end
+
+          def cert_path
+            Gitlab.config.gitlab.email_smime.cert_file
+          end
+
+          def overwrite_body(message, signed_email)
+            # since this is a multipart email, assignment to nil is important,
+            # otherwise Message#body will add a new mail part
+            message.body = nil
+            message.body = signed_email.body.encoded
+          end
+
+          def overwrite_headers(message, signed_email)
+            message.content_disposition = signed_email.content_disposition
+            message.content_transfer_encoding = signed_email.content_transfer_encoding
+            message.content_type = signed_email.content_type
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/email/smime/certificate.rb b/lib/gitlab/email/smime/certificate.rb
new file mode 100644
index 00000000000..b331c4ca19c
--- /dev/null
+++ b/lib/gitlab/email/smime/certificate.rb
@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Email
+    module Smime
+      class Certificate
+        include OpenSSL
+
+        attr_reader :key, :cert
+
+        def key_string
+          @key.to_s
+        end
+
+        def cert_string
+          @cert.to_pem
+        end
+
+        def self.from_strings(key_string, cert_string)
+          key = PKey::RSA.new(key_string)
+          cert = X509::Certificate.new(cert_string)
+          new(key, cert)
+        end
+
+        def self.from_files(key_path, cert_path)
+          from_strings(File.read(key_path), File.read(cert_path))
+        end
+
+        def initialize(key, cert)
+          @key = key
+          @cert = cert
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/email/smime/signer.rb b/lib/gitlab/email/smime/signer.rb
new file mode 100644
index 00000000000..2fa83014003
--- /dev/null
+++ b/lib/gitlab/email/smime/signer.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'openssl'
+
+module Gitlab
+  module Email
+    module Smime
+      # Tooling for signing and verifying data with SMIME
+      class Signer
+        include OpenSSL
+
+        def self.sign(cert:, key:, data:)
+          signed_data = PKCS7.sign(cert, key, data, nil, PKCS7::DETACHED)
+          PKCS7.write_smime(signed_data)
+        end
+
+        # return nil if data cannot be verified, otherwise the signed content data
+        def self.verify_signature(cert:, ca_cert: nil, signed_data:)
+          store = X509::Store.new
+          store.set_default_paths
+          store.add_cert(ca_cert) if ca_cert
+
+          signed_smime = PKCS7.read_smime(signed_data)
+          signed_smime if signed_smime.verify([cert], store)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/config/smime_signature_settings_spec.rb b/spec/config/smime_signature_settings_spec.rb
new file mode 100644
index 00000000000..4f0c227d866
--- /dev/null
+++ b/spec/config/smime_signature_settings_spec.rb
@@ -0,0 +1,56 @@
+require 'fast_spec_helper'
+
+describe SmimeSignatureSettings do
+  describe '.parse' do
+    let(:default_smime_key) { Rails.root.join('.gitlab_smime_key') }
+    let(:default_smime_cert) { Rails.root.join('.gitlab_smime_cert') }
+
+    it 'sets correct default values to disabled' do
+      parsed_settings = described_class.parse(nil)
+
+      expect(parsed_settings['enabled']).to be(false)
+      expect(parsed_settings['key_file']).to eq(default_smime_key)
+      expect(parsed_settings['cert_file']).to eq(default_smime_cert)
+    end
+
+    context 'when providing custom values' do
+      it 'sets correct default values to disabled' do
+        custom_settings = Settingslogic.new({})
+
+        parsed_settings = described_class.parse(custom_settings)
+
+        expect(parsed_settings['enabled']).to be(false)
+        expect(parsed_settings['key_file']).to eq(default_smime_key)
+        expect(parsed_settings['cert_file']).to eq(default_smime_cert)
+      end
+
+      it 'enables smime with default key and cert' do
+        custom_settings = Settingslogic.new({
+          'enabled' => true
+        })
+
+        parsed_settings = described_class.parse(custom_settings)
+
+        expect(parsed_settings['enabled']).to be(true)
+        expect(parsed_settings['key_file']).to eq(default_smime_key)
+        expect(parsed_settings['cert_file']).to eq(default_smime_cert)
+      end
+
+      it 'enables smime with custom key and cert' do
+        custom_key = '/custom/key'
+        custom_cert = '/custom/cert'
+        custom_settings = Settingslogic.new({
+          'enabled' => true,
+          'key_file' => custom_key,
+          'cert_file' => custom_cert
+        })
+
+        parsed_settings = described_class.parse(custom_settings)
+
+        expect(parsed_settings['enabled']).to be(true)
+        expect(parsed_settings['key_file']).to eq(custom_key)
+        expect(parsed_settings['cert_file']).to eq(custom_cert)
+      end
+    end
+  end
+end
diff --git a/spec/initializers/action_mailer_hooks_spec.rb b/spec/initializers/action_mailer_hooks_spec.rb
new file mode 100644
index 00000000000..3826ed9b00a
--- /dev/null
+++ b/spec/initializers/action_mailer_hooks_spec.rb
@@ -0,0 +1,46 @@
+require 'spec_helper'
+
+describe 'ActionMailer hooks' do
+  describe 'smime signature interceptor' do
+    before do
+      class_spy(ActionMailer::Base).as_stubbed_const
+    end
+
+    it 'is disabled by default' do
+      load Rails.root.join('config/initializers/action_mailer_hooks.rb')
+
+      expect(ActionMailer::Base).not_to(
+        have_received(:register_interceptor).with(Gitlab::Email::Hook::SmimeSignatureInterceptor))
+    end
+
+    describe 'interceptor testbed' do
+      where(:email_enabled, :email_smime_enabled, :smime_interceptor_enabled) do
+        [
+          [false, false, false],
+          [false, true,  false],
+          [true,  false, false],
+          [true,  true,  true]
+        ]
+      end
+
+      with_them do
+        before do
+          stub_config_setting(email_enabled: email_enabled)
+          stub_config_setting(email_smime: { enabled: email_smime_enabled })
+        end
+
+        it 'is enabled depending on settings' do
+          load Rails.root.join('config/initializers/action_mailer_hooks.rb')
+
+          if smime_interceptor_enabled
+            expect(ActionMailer::Base).to(
+              have_received(:register_interceptor).with(Gitlab::Email::Hook::SmimeSignatureInterceptor))
+          else
+            expect(ActionMailer::Base).not_to(
+              have_received(:register_interceptor).with(Gitlab::Email::Hook::SmimeSignatureInterceptor))
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/email/hook/disable_email_interceptor_spec.rb b/spec/lib/gitlab/email/hook/disable_email_interceptor_spec.rb
index 0c58cf088cc..c8ed12523d0 100644
--- a/spec/lib/gitlab/email/hook/disable_email_interceptor_spec.rb
+++ b/spec/lib/gitlab/email/hook/disable_email_interceptor_spec.rb
@@ -13,9 +13,6 @@ describe Gitlab::Email::Hook::DisableEmailInterceptor do
   end
 
   after do
-    # Removing interceptor from the list because unregister_interceptor is
-    # implemented in later version of mail gem
-    # See: https://github.com/mikel/mail/pull/705
     Mail.unregister_interceptor(described_class)
   end
 
diff --git a/spec/lib/gitlab/email/hook/smime_signature_interceptor_spec.rb b/spec/lib/gitlab/email/hook/smime_signature_interceptor_spec.rb
new file mode 100644
index 00000000000..35aa663b0a5
--- /dev/null
+++ b/spec/lib/gitlab/email/hook/smime_signature_interceptor_spec.rb
@@ -0,0 +1,52 @@
+require 'spec_helper'
+
+describe Gitlab::Email::Hook::SmimeSignatureInterceptor do
+  include SmimeHelper
+
+  # cert generation is an expensive operation and they are used read-only,
+  # so we share them as instance variables in all tests
+  before :context do
+    @root_ca = generate_root
+    @cert = generate_cert(root_ca: @root_ca)
+  end
+
+  let(:root_certificate) do
+    Gitlab::Email::Smime::Certificate.new(@root_ca[:key], @root_ca[:cert])
+  end
+
+  let(:certificate) do
+    Gitlab::Email::Smime::Certificate.new(@cert[:key], @cert[:cert])
+  end
+
+  let(:mail) do
+    ActionMailer::Base.mail(to: 'test@example.com', from: 'info@example.com', body: 'signed hello')
+  end
+
+  before do
+    allow(Gitlab::Email::Smime::Certificate).to receive_messages(from_files: certificate)
+
+    Mail.register_interceptor(described_class)
+    mail.deliver_now
+  end
+
+  after do
+    Mail.unregister_interceptor(described_class)
+  end
+
+  it 'signs the email appropriately with SMIME' do
+    expect(mail.header['To'].value).to eq('test@example.com')
+    expect(mail.header['From'].value).to eq('info@example.com')
+    expect(mail.header['Content-Type'].value).to match('multipart/signed').and match('protocol="application/x-pkcs7-signature"')
+
+    # verify signature and obtain pkcs7 encoded content
+    p7enc = Gitlab::Email::Smime::Signer.verify_signature(
+      cert: certificate.cert,
+      ca_cert: root_certificate.cert,
+      signed_data: mail.encoded)
+
+    # envelope in a Mail object and obtain the body
+    decoded_mail = Mail.new(p7enc.data)
+
+    expect(decoded_mail.body.encoded).to eq('signed hello')
+  end
+end
diff --git a/spec/lib/gitlab/email/smime/certificate_spec.rb b/spec/lib/gitlab/email/smime/certificate_spec.rb
new file mode 100644
index 00000000000..90b27602413
--- /dev/null
+++ b/spec/lib/gitlab/email/smime/certificate_spec.rb
@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::Email::Smime::Certificate do
+  include SmimeHelper
+
+  # cert generation is an expensive operation and they are used read-only,
+  # so we share them as instance variables in all tests
+  before :context do
+    @root_ca = generate_root
+    @cert = generate_cert(root_ca: @root_ca)
+  end
+
+  describe 'testing environment setup' do
+    describe 'generate_root' do
+      subject { @root_ca }
+
+      it 'generates a root CA that expires a long way in the future' do
+        expect(subject[:cert].not_after).to be > 999.years.from_now
+      end
+    end
+
+    describe 'generate_cert' do
+      subject { @cert }
+
+      it 'generates a cert properly signed by the root CA' do
+        expect(subject[:cert].issuer).to eq(@root_ca[:cert].subject)
+      end
+
+      it 'generates a cert that expires soon' do
+        expect(subject[:cert].not_after).to be < 60.minutes.from_now
+      end
+
+      it 'generates a cert intended for email signing' do
+        expect(subject[:cert].extensions).to include(an_object_having_attributes(oid: 'extendedKeyUsage', value: match('E-mail Protection')))
+      end
+
+      context 'passing in INFINITE_EXPIRY' do
+        subject { generate_cert(root_ca: @root_ca, expires_in: SmimeHelper::INFINITE_EXPIRY) }
+
+        it 'generates a cert that expires a long way in the future' do
+          expect(subject[:cert].not_after).to be > 999.years.from_now
+        end
+      end
+    end
+  end
+
+  describe '.from_strings' do
+    it 'parses correctly a certificate and key' do
+      parsed_cert = described_class.from_strings(@cert[:key].to_s, @cert[:cert].to_pem)
+
+      common_cert_tests(parsed_cert, @cert, @root_ca)
+    end
+  end
+
+  describe '.from_files' do
+    it 'parses correctly a certificate and key' do
+      allow(File).to receive(:read).with('a_key').and_return(@cert[:key].to_s)
+      allow(File).to receive(:read).with('a_cert').and_return(@cert[:cert].to_pem)
+
+      parsed_cert = described_class.from_files('a_key', 'a_cert')
+
+      common_cert_tests(parsed_cert, @cert, @root_ca)
+    end
+  end
+
+  def common_cert_tests(parsed_cert, cert, root_ca)
+    expect(parsed_cert.cert).to be_a(OpenSSL::X509::Certificate)
+    expect(parsed_cert.cert.subject).to eq(cert[:cert].subject)
+    expect(parsed_cert.cert.issuer).to eq(root_ca[:cert].subject)
+    expect(parsed_cert.cert.not_before).to eq(cert[:cert].not_before)
+    expect(parsed_cert.cert.not_after).to eq(cert[:cert].not_after)
+    expect(parsed_cert.cert.extensions).to include(an_object_having_attributes(oid: 'extendedKeyUsage', value: match('E-mail Protection')))
+    expect(parsed_cert.key).to be_a(OpenSSL::PKey::RSA)
+  end
+end
diff --git a/spec/lib/gitlab/email/smime/signer_spec.rb b/spec/lib/gitlab/email/smime/signer_spec.rb
new file mode 100644
index 00000000000..56048b7148c
--- /dev/null
+++ b/spec/lib/gitlab/email/smime/signer_spec.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::Email::Smime::Signer do
+  include SmimeHelper
+
+  it 'signs data appropriately with SMIME' do
+    root_certificate = generate_root
+    certificate = generate_cert(root_ca: root_certificate)
+
+    signed_content = described_class.sign(
+      cert: certificate[:cert],
+      key: certificate[:key],
+      data: 'signed content')
+    expect(signed_content).not_to be_nil
+
+    p7enc = described_class.verify_signature(
+      cert: certificate[:cert],
+      ca_cert: root_certificate[:cert],
+      signed_data: signed_content)
+
+    expect(p7enc).not_to be_nil
+    expect(p7enc.data).to eq('signed content')
+  end
+end
diff --git a/spec/support/helpers/smime_helper.rb b/spec/support/helpers/smime_helper.rb
new file mode 100644
index 00000000000..656b3e196ba
--- /dev/null
+++ b/spec/support/helpers/smime_helper.rb
@@ -0,0 +1,55 @@
+module SmimeHelper
+  include OpenSSL
+
+  INFINITE_EXPIRY = 1000.years
+  SHORT_EXPIRY = 30.minutes
+
+  def generate_root
+    issue(signed_by: nil, expires_in: INFINITE_EXPIRY, certificate_authority: true)
+  end
+
+  def generate_cert(root_ca:, expires_in: SHORT_EXPIRY)
+    issue(signed_by: root_ca, expires_in: expires_in, certificate_authority: false)
+  end
+
+  # returns a hash { key:, cert: } containing a generated key, cert pair
+  def issue(email_address: 'test@example.com', signed_by:, expires_in:, certificate_authority:)
+    key = OpenSSL::PKey::RSA.new(4096)
+    public_key = key.public_key
+
+    subject = if certificate_authority
+                X509::Name.parse("/CN=EU")
+              else
+                X509::Name.parse("/CN=#{email_address}")
+              end
+
+    cert = X509::Certificate.new
+    cert.subject = subject
+
+    cert.issuer = signed_by&.fetch(:cert, nil)&.subject || subject
+
+    cert.not_before = Time.now
+    cert.not_after = expires_in.from_now
+    cert.public_key = public_key
+    cert.serial = 0x0
+    cert.version = 2
+
+    extension_factory = X509::ExtensionFactory.new
+    if certificate_authority
+      extension_factory.subject_certificate = cert
+      extension_factory.issuer_certificate = cert
+      cert.add_extension(extension_factory.create_extension('subjectKeyIdentifier', 'hash'))
+      cert.add_extension(extension_factory.create_extension('basicConstraints', 'CA:TRUE', true))
+      cert.add_extension(extension_factory.create_extension('keyUsage', 'cRLSign,keyCertSign', true))
+    else
+      cert.add_extension(extension_factory.create_extension('subjectAltName', "email:#{email_address}", false))
+      cert.add_extension(extension_factory.create_extension('basicConstraints', 'CA:FALSE', true))
+      cert.add_extension(extension_factory.create_extension('keyUsage', 'digitalSignature,keyEncipherment', true))
+      cert.add_extension(extension_factory.create_extension('extendedKeyUsage', 'clientAuth,emailProtection', false))
+    end
+
+    cert.sign(signed_by&.fetch(:key, nil) || key, Digest::SHA256.new)
+
+    { key: key, cert: cert }
+  end
+end
-- 
cgit v1.2.1


From a6319d17263897a57ed6c12a386efe4ac0607959 Mon Sep 17 00:00:00 2001
From: Tristan Read <tread@gitlab.com>
Date: Tue, 20 Aug 2019 14:51:30 +0000
Subject: Embed metrics undefined param fix

---
 .../javascripts/monitoring/components/dashboard.vue  |  4 ++--
 changelogs/unreleased/tr-param-undefined-fix.yml     |  5 +++++
 spec/javascripts/monitoring/dashboard_spec.js        | 20 ++++++++++++++++++++
 3 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/tr-param-undefined-fix.yml

diff --git a/app/assets/javascripts/monitoring/components/dashboard.vue b/app/assets/javascripts/monitoring/components/dashboard.vue
index dfeeba238ca..c414c26ca61 100644
--- a/app/assets/javascripts/monitoring/components/dashboard.vue
+++ b/app/assets/javascripts/monitoring/components/dashboard.vue
@@ -264,12 +264,12 @@ export default {
     showToast() {
       this.$toast.show(__('Link copied to clipboard'));
     },
+    // TODO: END
     generateLink(group, title, yLabel) {
       const dashboard = this.currentDashboard || this.firstDashboard.path;
-      const params = { dashboard, group, title, y_label: yLabel };
+      const params = _.pick({ dashboard, group, title, y_label: yLabel }, value => value != null);
       return mergeUrlParams(params, window.location.href);
     },
-    // TODO: END
     hideAddMetricModal() {
       this.$refs.addMetricModal.hide();
     },
diff --git a/changelogs/unreleased/tr-param-undefined-fix.yml b/changelogs/unreleased/tr-param-undefined-fix.yml
new file mode 100644
index 00000000000..0a9051485bd
--- /dev/null
+++ b/changelogs/unreleased/tr-param-undefined-fix.yml
@@ -0,0 +1,5 @@
+---
+title: Fix for embedded metrics undefined params
+merge_request: 31975
+author:
+type: fixed
diff --git a/spec/javascripts/monitoring/dashboard_spec.js b/spec/javascripts/monitoring/dashboard_spec.js
index 624d8b14c8f..02c3f303912 100644
--- a/spec/javascripts/monitoring/dashboard_spec.js
+++ b/spec/javascripts/monitoring/dashboard_spec.js
@@ -414,6 +414,26 @@ describe('Dashboard', () => {
       expect(clipboardText()).toContain(`y_label=`);
     });
 
+    it('undefined parameter is stripped', done => {
+      wrapper.setProps({ currentDashboard: undefined });
+
+      wrapper.vm.$nextTick(() => {
+        expect(clipboardText()).not.toContain(`dashboard=`);
+        expect(clipboardText()).toContain(`y_label=`);
+        done();
+      });
+    });
+
+    it('null parameter is stripped', done => {
+      wrapper.setProps({ currentDashboard: null });
+
+      wrapper.vm.$nextTick(() => {
+        expect(clipboardText()).not.toContain(`dashboard=`);
+        expect(clipboardText()).toContain(`y_label=`);
+        done();
+      });
+    });
+
     it('creates a toast when clicked', () => {
       spyOn(wrapper.vm.$toast, 'show').and.stub();
 
-- 
cgit v1.2.1


From 183262ffe7f6b780a0bc066dc541622ca4c0fd07 Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Tue, 20 Aug 2019 15:51:56 +0100
Subject: Adds a height utility class

Backports EE changes
---
 app/assets/stylesheets/framework/common.scss | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/assets/stylesheets/framework/common.scss b/app/assets/stylesheets/framework/common.scss
index f384a49e0ae..e9218dcec67 100644
--- a/app/assets/stylesheets/framework/common.scss
+++ b/app/assets/stylesheets/framework/common.scss
@@ -438,6 +438,7 @@ img.emoji {
 .w-3rem { width: 3rem; }
 
 .h-12em { height: 12em; }
+.h-32-px { height: 32px;}
 
 .mw-460 { max-width: 460px; }
 .mw-6em { max-width: 6em; }
-- 
cgit v1.2.1


From 41896cbabe7bad958bd02b32281c76697ea4939e Mon Sep 17 00:00:00 2001
From: Jeremy Elder <jelder@gitlab.com>
Date: Tue, 20 Aug 2019 14:53:38 +0000
Subject: Resolve "Badge counter: Very low contrast between foreground and
 background colors"

---
 app/assets/stylesheets/framework/badges.scss                        | 2 +-
 ...ounter-very-low-contrast-between-foreground-and-background-c.yml | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/62373-badge-counter-very-low-contrast-between-foreground-and-background-c.yml

diff --git a/app/assets/stylesheets/framework/badges.scss b/app/assets/stylesheets/framework/badges.scss
index c6060161dec..c036267a7c8 100644
--- a/app/assets/stylesheets/framework/badges.scss
+++ b/app/assets/stylesheets/framework/badges.scss
@@ -1,6 +1,6 @@
 .badge.badge-pill {
   font-weight: $gl-font-weight-normal;
   background-color: $badge-bg;
-  color: $gl-text-color-secondary;
+  color: $gray-800;
   vertical-align: baseline;
 }
diff --git a/changelogs/unreleased/62373-badge-counter-very-low-contrast-between-foreground-and-background-c.yml b/changelogs/unreleased/62373-badge-counter-very-low-contrast-between-foreground-and-background-c.yml
new file mode 100644
index 00000000000..12b19da1868
--- /dev/null
+++ b/changelogs/unreleased/62373-badge-counter-very-low-contrast-between-foreground-and-background-c.yml
@@ -0,0 +1,6 @@
+---
+title: 'Resolve Badge counter: Very low contrast between foreground and background
+  colors'
+merge_request: 31922
+author:
+type: other
-- 
cgit v1.2.1


From 8e7c77eecd24a730d6d893e46fbb18820c4b578e Mon Sep 17 00:00:00 2001
From: rossfuhrman <rfuhrman@gitlab.com>
Date: Tue, 20 Aug 2019 15:26:49 +0000
Subject: Remove file that was accidentally added back

This file was moved to the EE project namespace, but
https://gitlab.com/gitlab-org/gitlab-ce/commit/ce50d5c45158723925b098f7e0033963841137ff
brought it back. It should not be present in this repo.
---
 .../feature-branch/gl-sast-report.json             | 861 ---------------------
 1 file changed, 861 deletions(-)
 delete mode 100644 spec/fixtures/security-reports/feature-branch/gl-sast-report.json

diff --git a/spec/fixtures/security-reports/feature-branch/gl-sast-report.json b/spec/fixtures/security-reports/feature-branch/gl-sast-report.json
deleted file mode 100644
index 27c8661013a..00000000000
--- a/spec/fixtures/security-reports/feature-branch/gl-sast-report.json
+++ /dev/null
@@ -1,861 +0,0 @@
-{
-  "version": "1.2",
-  "vulnerabilities": [
-    {
-      "category": "sast",
-      "message": "Probable insecure usage of temp file/directory.",
-      "cve": "python/hardcoded/hardcoded-tmp.py:52865813c884a507be1f152d654245af34aba8a391626d01f1ab6d3f52ec8779:B108",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-tmp.py",
-        "start_line": 1,
-        "end_line": 1
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B108",
-          "value": "B108",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "line": 1,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "name": "Predictable pseudorandom number generator",
-      "message": "Predictable pseudorandom number generator",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:47:PREDICTABLE_RANDOM",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 47,
-        "end_line": 47,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "generateSecretToken2"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-PREDICTABLE_RANDOM",
-          "value": "PREDICTABLE_RANDOM",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 47,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "name": "Predictable pseudorandom number generator",
-      "message": "Predictable pseudorandom number generator",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:41:PREDICTABLE_RANDOM",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 41,
-        "end_line": 41,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "generateSecretToken1"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-PREDICTABLE_RANDOM",
-          "value": "PREDICTABLE_RANDOM",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 41,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#PREDICTABLE_RANDOM",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:cb203b465dffb0cb3a8e8bd8910b84b93b0a5995a938e4b903dbb0cd6ffa1254:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 11,
-        "end_line": 11
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 11,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:a7173c43ae66bd07466632d819d450e0071e02dbf782763640d1092981f9631b:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 12,
-        "end_line": 12
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 12,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:017017b77deb0b8369b6065947833eeea752a92ec8a700db590fece3e934cf0d:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 13,
-        "end_line": 13
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 13,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Use of insecure MD2, MD4, or MD5 hash function.",
-      "cve": "python/imports/imports-aliases.py:45fc8c53aea7b84f06bc4e590cc667678d6073c4c8a1d471177ca2146fb22db2:B303",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 14,
-        "end_line": 14
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B303",
-          "value": "B303"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 14,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Pickle library appears to be in use, possible security issue.",
-      "cve": "python/imports/imports-aliases.py:5f200d47291e7bbd8352db23019b85453ca048dd98ea0c291260fa7d009963a4:B301",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 15,
-        "end_line": 15
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B301",
-          "value": "B301"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/imports/imports-aliases.py",
-      "line": 15,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "name": "ECB mode is insecure",
-      "message": "ECB mode is insecure",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:29:ECB_MODE",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 29,
-        "end_line": 29,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "insecureCypher"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-ECB_MODE",
-          "value": "ECB_MODE",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#ECB_MODE"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 29,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#ECB_MODE",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "name": "Cipher with no integrity",
-      "message": "Cipher with no integrity",
-      "cve": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy:29:CIPHER_INTEGRITY",
-      "severity": "Medium",
-      "confidence": "High",
-      "scanner": {
-        "id": "find_sec_bugs",
-        "name": "Find Security Bugs"
-      },
-      "location": {
-        "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-        "start_line": 29,
-        "end_line": 29,
-        "class": "com.gitlab.security_products.tests.App",
-        "method": "insecureCypher"
-      },
-      "identifiers": [
-        {
-          "type": "find_sec_bugs_type",
-          "name": "Find Security Bugs-CIPHER_INTEGRITY",
-          "value": "CIPHER_INTEGRITY",
-          "url": "https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY"
-        }
-      ],
-      "priority": "Medium",
-      "file": "groovy/src/main/java/com/gitlab/security_products/tests/App.groovy",
-      "line": 29,
-      "url": "https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY",
-      "tool": "find_sec_bugs"
-    },
-    {
-      "category": "sast",
-      "message": "Probable insecure usage of temp file/directory.",
-      "cve": "python/hardcoded/hardcoded-tmp.py:63dd4d626855555b816985d82c4614a790462a0a3ada89dc58eb97f9c50f3077:B108",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-tmp.py",
-        "start_line": 14,
-        "end_line": 14
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B108",
-          "value": "B108",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "line": 14,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Probable insecure usage of temp file/directory.",
-      "cve": "python/hardcoded/hardcoded-tmp.py:4ad6d4c40a8c263fc265f3384724014e0a4f8dd6200af83e51ff120420038031:B108",
-      "severity": "Medium",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-tmp.py",
-        "start_line": 10,
-        "end_line": 10
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B108",
-          "value": "B108",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html"
-        }
-      ],
-      "priority": "Medium",
-      "file": "python/hardcoded/hardcoded-tmp.py",
-      "line": 10,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b108_hardcoded_tmp_directory.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with Popen module.",
-      "cve": "python/imports/imports-aliases.py:2c3e1fa1e54c3c6646e8bcfaee2518153c6799b77587ff8d9a7b0631f6d34785:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 1,
-        "end_line": 1
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 1,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with pickle module.",
-      "cve": "python/imports/imports.py:af58d07f6ad519ef5287fcae65bf1a6999448a1a3a8bc1ac2a11daa80d0b96bf:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports.py",
-        "start_line": 2,
-        "end_line": 2
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports.py",
-      "line": 2,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with subprocess module.",
-      "cve": "python/imports/imports.py:8de9bc98029d212db530785a5f6780cfa663548746ff228ab8fa96c5bb82f089:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports.py",
-        "start_line": 4,
-        "end_line": 4
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports.py",
-      "line": 4,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'blerg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:97c30f1d76d2a88913e3ce9ae74087874d740f87de8af697a9c455f01119f633:B106",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 22,
-        "end_line": 22
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B106",
-          "value": "B106",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b106_hardcoded_password_funcarg.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 22,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b106_hardcoded_password_funcarg.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'root'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:7431c73a0bc16d94ece2a2e75ef38f302574d42c37ac0c3c38ad0b3bf8a59f10:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 5,
-        "end_line": 5
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 5,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: ''",
-      "cve": "python/hardcoded/hardcoded-passwords.py:d2d1857c27caedd49c57bfbcdc23afcc92bd66a22701fcdc632869aab4ca73ee:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 9,
-        "end_line": 9
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 9,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'ajklawejrkl42348swfgkg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:fb3866215a61393a5c9c32a3b60e2058171a23219c353f722cbd3567acab21d2:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 13,
-        "end_line": 13
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 13,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'blerg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:63c62a8b7e1e5224439bd26b28030585ac48741e28ca64561a6071080c560a5f:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 23,
-        "end_line": 23
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 23,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Possible hardcoded password: 'blerg'",
-      "cve": "python/hardcoded/hardcoded-passwords.py:4311b06d08df8fa58229b341c531da8e1a31ec4520597bdff920cd5c098d86f9:B105",
-      "severity": "Low",
-      "confidence": "Medium",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/hardcoded/hardcoded-passwords.py",
-        "start_line": 24,
-        "end_line": 24
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B105",
-          "value": "B105",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/hardcoded/hardcoded-passwords.py",
-      "line": 24,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b105_hardcoded_password_string.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with subprocess module.",
-      "cve": "python/imports/imports-function.py:5858400c2f39047787702de44d03361ef8d954c9d14bd54ee1c2bef9e6a7df93:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-function.py",
-        "start_line": 4,
-        "end_line": 4
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-function.py",
-      "line": 4,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with pickle module.",
-      "cve": "python/imports/imports-function.py:dbda3cf4190279d30e0aad7dd137eca11272b0b225e8af4e8bf39682da67d956:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-function.py",
-        "start_line": 2,
-        "end_line": 2
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-function.py",
-      "line": 2,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with Popen module.",
-      "cve": "python/imports/imports-from.py:eb8a0db9cd1a8c1ab39a77e6025021b1261cc2a0b026b2f4a11fca4e0636d8dd:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-from.py",
-        "start_line": 7,
-        "end_line": 7
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-from.py",
-      "line": 7,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell",
-      "cve": "python/imports/imports-aliases.py:f99f9721e27537fbcb6699a4cf39c6740d6234d2c6f06cfc2d9ea977313c483d:B602",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 9,
-        "end_line": 9
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B602",
-          "value": "B602",
-          "url": "https://docs.openstack.org/bandit/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 9,
-      "url": "https://docs.openstack.org/bandit/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html",
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with subprocess module.",
-      "cve": "python/imports/imports-from.py:332a12ab1146698f614a905ce6a6a5401497a12281aef200e80522711c69dcf4:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-from.py",
-        "start_line": 6,
-        "end_line": 6
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-from.py",
-      "line": 6,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with Popen module.",
-      "cve": "python/imports/imports-from.py:0a48de4a3d5348853a03666cb574697e3982998355e7a095a798bd02a5947276:B404",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-from.py",
-        "start_line": 1,
-        "end_line": 2
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B404",
-          "value": "B404"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-from.py",
-      "line": 1,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with pickle module.",
-      "cve": "python/imports/imports-aliases.py:51b71661dff994bde3529639a727a678c8f5c4c96f00d300913f6d5be1bbdf26:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 7,
-        "end_line": 8
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 7,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Consider possible security implications associated with loads module.",
-      "cve": "python/imports/imports-aliases.py:6ff02aeb3149c01ab68484d794a94f58d5d3e3bb0d58557ef4153644ea68ea54:B403",
-      "severity": "Low",
-      "confidence": "High",
-      "scanner": {
-        "id": "bandit",
-        "name": "Bandit"
-      },
-      "location": {
-        "file": "python/imports/imports-aliases.py",
-        "start_line": 6,
-        "end_line": 6
-      },
-      "identifiers": [
-        {
-          "type": "bandit_test_id",
-          "name": "Bandit Test ID B403",
-          "value": "B403"
-        }
-      ],
-      "priority": "Low",
-      "file": "python/imports/imports-aliases.py",
-      "line": 6,
-      "tool": "bandit"
-    },
-    {
-      "category": "sast",
-      "message": "Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120)",
-      "cve": "c/subdir/utils.c:b466873101951fe96e1332f6728eb7010acbbd5dfc3b65d7d53571d091a06d9e:CWE-119!/CWE-120",
-      "confidence": "Low",
-      "solution": "Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length",
-      "scanner": {
-        "id": "flawfinder",
-        "name": "Flawfinder"
-      },
-      "location": {
-        "file": "c/subdir/utils.c",
-        "start_line": 4
-      },
-      "identifiers": [
-        {
-          "type": "cwe",
-          "name": "CWE-119",
-          "value": "119",
-          "url": "https://cwe.mitre.org/data/definitions/119.html"
-        },
-        {
-          "type": "cwe",
-          "name": "CWE-120",
-          "value": "120",
-          "url": "https://cwe.mitre.org/data/definitions/120.html"
-        }
-      ],
-      "file": "c/subdir/utils.c",
-      "line": 4,
-      "url": "https://cwe.mitre.org/data/definitions/119.html",
-      "tool": "flawfinder"
-    }
-  ]
-}
-- 
cgit v1.2.1


From ca334da924dc2961e53e79456bb9e15ee81fd012 Mon Sep 17 00:00:00 2001
From: Zeff Morgan <zmorgan@gitlab.com>
Date: Tue, 20 Aug 2019 12:54:52 -0400
Subject: Update grammar in DAG docs

---
 doc/ci/directed_acyclic_graph/index.md | 2 +-
 doc/ci/yaml/README.md                  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/ci/directed_acyclic_graph/index.md b/doc/ci/directed_acyclic_graph/index.md
index e54be9f3bd9..1c38c08b7cb 100644
--- a/doc/ci/directed_acyclic_graph/index.md
+++ b/doc/ci/directed_acyclic_graph/index.md
@@ -65,7 +65,7 @@ as quickly as possible.
 Relationships are defined between jobs using the [`needs:` keyword](../yaml/README.md#needs).
 
 Note that `needs:` also works with the [parallel](../yaml/README.md#parallel) keyword,
-giving your powerful options for parallelization within your pipeline.
+giving you powerful options for parallelization within your pipeline.
 
 ## Limitations
 
diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md
index 76b73729d0b..335f3292444 100644
--- a/doc/ci/yaml/README.md
+++ b/doc/ci/yaml/README.md
@@ -1734,8 +1734,8 @@ This example creates three paths of execution:
    in the first stage (see [gitlab-ce#65504](https://gitlab.com/gitlab-org/gitlab-ce/issues/65504)).
 1. If `needs:` refers to a job that is marked as `parallel:`.
    the current job will depend on all parallel jobs created.
-1. `needs:` is similar to `dependencies:` in that needs to use jobs from
-   prior stages, this means that it is impossible to create circular
+1. `needs:` is similar to `dependencies:` in that it needs to use jobs from
+   prior stages, meaning it is impossible to create circular
    dependencies or depend on jobs in the current stage (see [gitlab-ce#65505](https://gitlab.com/gitlab-org/gitlab-ce/issues/65505)).
 1. Related to the above, stages must be explicitly defined for all jobs
    that have the keyword `needs:` or are referred to by one.
-- 
cgit v1.2.1


From 879c25d936feda76202a2d3533550b274608c0f8 Mon Sep 17 00:00:00 2001
From: Dennis Appelt <dappelt@gitlab.com>
Date: Tue, 20 Aug 2019 17:04:23 +0000
Subject: Enable DAST

---
 .gitlab/ci/reports.gitlab-ci.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index ca55bbd32a7..fc0e93ee9f1 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -2,6 +2,7 @@ include:
   - template: Code-Quality.gitlab-ci.yml
   - template: Security/SAST.gitlab-ci.yml
   - template: Security/Dependency-Scanning.gitlab-ci.yml
+  - template: Security/DAST.gitlab-ci.yml
 
 code_quality:
   extends: .dedicated-no-docs
@@ -24,3 +25,12 @@ dependency_scanning:
   tags: []
   before_script: []
   cache: {}
+
+dast:
+  extends: .dedicated-no-docs
+  stage: qa
+  dependencies:
+    - review-deploy
+  before_script:
+    - export DAST_WEBSITE="$(cat review_app_url.txt)"
+  cache: {}
-- 
cgit v1.2.1


From bb15224286661aa27570364bd222ddfe3485263b Mon Sep 17 00:00:00 2001
From: Walmyr Lima <walmyr@gitlab.com>
Date: Thu, 15 Aug 2019 16:38:46 +0200
Subject: Add testability on views

---
 app/assets/javascripts/boards/components/board_card.vue      | 1 +
 app/assets/javascripts/boards/components/board_list.vue      | 1 +
 app/assets/javascripts/boards/components/boards_selector.vue | 1 +
 app/views/shared/boards/_show.html.haml                      | 2 +-
 app/views/shared/boards/components/_board.html.haml          | 4 ++--
 5 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/app/assets/javascripts/boards/components/board_card.vue b/app/assets/javascripts/boards/components/board_card.vue
index 179148b6887..faf722f61af 100644
--- a/app/assets/javascripts/boards/components/board_card.vue
+++ b/app/assets/javascripts/boards/components/board_card.vue
@@ -83,6 +83,7 @@ export default {
     }"
     :index="index"
     :data-issue-id="issue.id"
+    data-qa-selector="board_card"
     class="board-card p-3 rounded"
     @mousedown="mouseDown"
     @mousemove="mouseMove"
diff --git a/app/assets/javascripts/boards/components/board_list.vue b/app/assets/javascripts/boards/components/board_list.vue
index 03a8a92575e..de41698ca04 100644
--- a/app/assets/javascripts/boards/components/board_list.vue
+++ b/app/assets/javascripts/boards/components/board_list.vue
@@ -227,6 +227,7 @@ export default {
   <div
     :class="{ 'd-none': !list.isExpanded, 'd-flex flex-column': list.isExpanded }"
     class="board-list-component position-relative h-100"
+    data-qa-selector="board_list_cards_area"
   >
     <div v-if="loading" class="board-list-loading text-center" :aria-label="__('Loading issues')">
       <gl-loading-icon />
diff --git a/app/assets/javascripts/boards/components/boards_selector.vue b/app/assets/javascripts/boards/components/boards_selector.vue
index b05de4538f2..7296426549a 100644
--- a/app/assets/javascripts/boards/components/boards_selector.vue
+++ b/app/assets/javascripts/boards/components/boards_selector.vue
@@ -226,6 +226,7 @@ export default {
   <div class="boards-switcher js-boards-selector append-right-10">
     <span class="boards-selector-wrapper js-boards-selector-wrapper">
       <gl-dropdown
+        data-qa-selector="boards_dropdown"
         toggle-class="dropdown-menu-toggle js-dropdown-toggle"
         menu-class="flex-column dropdown-extended-height"
         :text="board.name"
diff --git a/app/views/shared/boards/_show.html.haml b/app/views/shared/boards/_show.html.haml
index 1be230eedb9..4f0be117035 100644
--- a/app/views/shared/boards/_show.html.haml
+++ b/app/views/shared/boards/_show.html.haml
@@ -16,7 +16,7 @@
 #board-app.boards-app.position-relative{ "v-cloak" => "true", data: board_data, ":class" => "{ 'is-compact': detailIssueVisible }" }
   = render 'shared/issuable/search_bar', type: :boards, board: board
 
-  .boards-list.w-100.py-3.px-2.text-nowrap
+  .boards-list.w-100.py-3.px-2.text-nowrap{ data: { qa_selector: "boards_list" } }
     .boards-app-loading.w-100.text-center{ "v-if" => "loading" }
       = icon("spinner spin 2x")
     %board{ "v-cloak" => "true",
diff --git a/app/views/shared/boards/components/_board.html.haml b/app/views/shared/boards/components/_board.html.haml
index 6c0613605eb..5abd4ce0fb9 100644
--- a/app/views/shared/boards/components/_board.html.haml
+++ b/app/views/shared/boards/components/_board.html.haml
@@ -1,7 +1,7 @@
 .board.d-inline-block.h-100.px-2.align-top.ws-normal{ ":class" => '{ "is-draggable": !list.preset, "is-expandable": list.isExpandable, "is-collapsed": !list.isExpanded, "board-type-assignee": list.type === "assignee" }',
-  ":data-id" => "list.id" }
+  ":data-id" => "list.id", data: { qa_selector: "board_list" } }
   .board-inner.d-flex.flex-column.position-relative.h-100.rounded
-    %header.board-header{ ":class" => '{ "has-border": list.label && list.label.color, "position-relative": list.isExpanded, "position-absolute position-top-0 position-left-0 w-100 h-100": !list.isExpanded }', ":style" => "{ borderTopColor: (list.label && list.label.color ? list.label.color : null) }" }
+    %header.board-header{ ":class" => '{ "has-border": list.label && list.label.color, "position-relative": list.isExpanded, "position-absolute position-top-0 position-left-0 w-100 h-100": !list.isExpanded }', ":style" => "{ borderTopColor: (list.label && list.label.color ? list.label.color : null) }", data: { qa_selector: "board_list_header" } }
       %h3.board-title.m-0.d-flex.js-board-handle{ ":class" => '{ "user-can-drag": (!disabled && !list.preset), "border-bottom-0": !list.isExpanded }' }
 
         .board-title-caret.no-drag{ "v-if": "list.isExpandable",
-- 
cgit v1.2.1


From a971b7cb98439dfa1415b280dc63b113e6a699a4 Mon Sep 17 00:00:00 2001
From: Walmyr Lima <walmyr@gitlab.com>
Date: Mon, 19 Aug 2019 20:15:44 +0200
Subject: Allow issue fabrication with milestone

---
 qa/qa/resource/issue.rb | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/qa/qa/resource/issue.rb b/qa/qa/resource/issue.rb
index 51b2af8b4ef..16ab59352f3 100644
--- a/qa/qa/resource/issue.rb
+++ b/qa/qa/resource/issue.rb
@@ -3,7 +3,7 @@
 module QA
   module Resource
     class Issue < Base
-      attr_writer :description
+      attr_writer :description, :milestone
 
       attribute :project do
         Project.fabricate! do |resource|
@@ -44,7 +44,9 @@ module QA
         {
           labels: labels,
           title: title
-        }
+        }.tap do |hash|
+          hash[:milestone_id] = @milestone.id if @milestone
+        end
       end
     end
   end
-- 
cgit v1.2.1


From 126219850ef9e1016fa6c39e905745fb697aac09 Mon Sep 17 00:00:00 2001
From: Walmyr Lima <walmyr@gitlab.com>
Date: Tue, 20 Aug 2019 19:31:05 +0200
Subject: Expose id attribute on label resource

---
 qa/qa/resource/label.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/qa/qa/resource/label.rb b/qa/qa/resource/label.rb
index 3750725c440..b5e88d8aefc 100644
--- a/qa/qa/resource/label.rb
+++ b/qa/qa/resource/label.rb
@@ -7,6 +7,7 @@ module QA
     class Label < Base
       attr_accessor :description, :color
 
+      attribute :id
       attribute :title
 
       attribute :project do
-- 
cgit v1.2.1


From b4a0e14cb7798b76d14bf6d2a540a4dd586bb154 Mon Sep 17 00:00:00 2001
From: Evan Read <eread@gitlab.com>
Date: Tue, 20 Aug 2019 17:55:33 +0000
Subject: Clarify when new values are valid

---
 doc/ci/variables/README.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/doc/ci/variables/README.md b/doc/ci/variables/README.md
index d741482b662..5a15b907da0 100644
--- a/doc/ci/variables/README.md
+++ b/doc/ci/variables/README.md
@@ -94,7 +94,10 @@ This means that the value of the variable will be hidden in job logs,
 though it must match certain requirements to do so:
 
 - The value must be in a single line.
-- The value must only consist of characters from the Base64 alphabet ([RFC4648](https://tools.ietf.org/html/rfc4648)) with the addition of `@` and `:`.
+- The value must only consist of characters from the Base64 alphabet (RFC4648).
+
+  [In GitLab 12.2](https://gitlab.com/gitlab-org/gitlab-ce/issues/63043)
+  and newer, `@` and `:` are also valid values.
 - The value must be at least 8 characters long.
 - The value must not use variables.
 
@@ -509,7 +512,7 @@ Below you can find supported syntax reference:
 1. Checking for an empty variable
 
    Examples:
-  
+
    - `$VARIABLE == ""`
    - `$VARIABLE != ""` (introduced in GitLab 11.11)
 
-- 
cgit v1.2.1


From 5d298da8494c9749f861755851a616655df4b1ad Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Tue, 20 Aug 2019 17:57:37 +0000
Subject: Update project import doc

Update screenshot and improve text to match
---
 doc/user/project/import/gitlab_com.md                  |  14 +++++++-------
 .../project/import/img/gitlab_new_project_page.png     | Bin 21251 -> 0 bytes
 .../import/img/gitlab_new_project_page_v12_2.png       | Bin 0 -> 214213 bytes
 3 files changed, 7 insertions(+), 7 deletions(-)
 delete mode 100644 doc/user/project/import/img/gitlab_new_project_page.png
 create mode 100644 doc/user/project/import/img/gitlab_new_project_page_v12_2.png

diff --git a/doc/user/project/import/gitlab_com.md b/doc/user/project/import/gitlab_com.md
index f48a158e2d3..2f87f257754 100644
--- a/doc/user/project/import/gitlab_com.md
+++ b/doc/user/project/import/gitlab_com.md
@@ -1,21 +1,21 @@
 # Project importing from GitLab.com to your private GitLab instance
 
-You can import your existing GitLab.com projects to your GitLab instance. But keep in mind that it is possible only if
-GitLab.com integration is enabled on your GitLab instance.
+You can import your existing GitLab.com projects to your GitLab instance, but keep in
+mind that it is possible only if GitLab.com integration is enabled on your GitLab instance.
 [Read more about GitLab.com integration for self-managed GitLab instances](../../../integration/gitlab.md).
 
 To get to the importer page you need to go to "New project" page.
 
 >**Note:**
-If you are interested in importing Wiki and Merge Request data to your new
-instance, you'll need to follow the instructions for [project export](../settings/import_export.md)
+If you are interested in importing Wiki and Merge Request data to your new instance,
+you'll need to follow the instructions for [exporting a project](../settings/import_export.md#exporting-a-project-and-its-data)
 
-![New project page](img/gitlab_new_project_page.png)
+![New project page](img/gitlab_new_project_page_v12_2.png)
 
-Click on the "Import projects from GitLab.com" link and you will be redirected to GitLab.com
+Go to the **Import Projects** tab, then click on **GitLab.com**, and you will be redirected to GitLab.com
 for permission to access your projects. After accepting, you'll be automatically redirected to the importer.
 
 ![Importer page](img/gitlab_importer.png)
 
-To import a project, you can simple click "Import". The importer will import your repository and issues.
+To import a project, click "Import". The importer will import your repository and issues.
 Once the importer is done, a new GitLab project will be created with your imported data.
diff --git a/doc/user/project/import/img/gitlab_new_project_page.png b/doc/user/project/import/img/gitlab_new_project_page.png
deleted file mode 100644
index c673724f436..00000000000
Binary files a/doc/user/project/import/img/gitlab_new_project_page.png and /dev/null differ
diff --git a/doc/user/project/import/img/gitlab_new_project_page_v12_2.png b/doc/user/project/import/img/gitlab_new_project_page_v12_2.png
new file mode 100644
index 00000000000..e79c27f32c0
Binary files /dev/null and b/doc/user/project/import/img/gitlab_new_project_page_v12_2.png differ
-- 
cgit v1.2.1


From 8ff6003b0d0edc1048087766d254ffe1d837f359 Mon Sep 17 00:00:00 2001
From: Evan Read <eread@gitlab.com>
Date: Tue, 20 Aug 2019 18:02:33 +0000
Subject: Harmonizes titles between two Geo landing pages

Menu entries in global navigation will be updated to match.
---
 doc/administration/geo/disaster_recovery/index.md | 2 +-
 doc/administration/geo/replication/index.md       | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/administration/geo/disaster_recovery/index.md b/doc/administration/geo/disaster_recovery/index.md
index d44e141b66b..ba95843b0b0 100644
--- a/doc/administration/geo/disaster_recovery/index.md
+++ b/doc/administration/geo/disaster_recovery/index.md
@@ -1,4 +1,4 @@
-# Disaster Recovery **(PREMIUM ONLY)**
+# Disaster Recovery (Geo) **(PREMIUM ONLY)**
 
 Geo replicates your database, your Git repositories, and few other assets.
 We will support and replicate more data in the future, that will enable you to
diff --git a/doc/administration/geo/replication/index.md b/doc/administration/geo/replication/index.md
index 5aedb665935..dbd466b906d 100644
--- a/doc/administration/geo/replication/index.md
+++ b/doc/administration/geo/replication/index.md
@@ -1,4 +1,4 @@
-# Geo Replication **(PREMIUM ONLY)**
+# Replication (Geo) **(PREMIUM ONLY)**
 
 > - Introduced in GitLab Enterprise Edition 8.9.
 > - Using Geo in combination with
@@ -6,7 +6,7 @@
 >   is considered **Generally Available** (GA) in
 >   [GitLab Premium](https://about.gitlab.com/pricing/) 10.4.
 
-Geo is the solution for widely distributed development teams.
+Replication with Geo is the solution for widely distributed development teams.
 
 ## Overview
 
-- 
cgit v1.2.1


From 8505df15cec0378f4eff14d32b07a4447b9ce032 Mon Sep 17 00:00:00 2001
From: Douwe Maan <douwe@gitlab.com>
Date: Tue, 20 Aug 2019 18:02:50 +0000
Subject: Use gitlab-shell v9.4.1

---
 GITLAB_SHELL_VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/GITLAB_SHELL_VERSION b/GITLAB_SHELL_VERSION
index 8148c559489..ccfb75e5120 100644
--- a/GITLAB_SHELL_VERSION
+++ b/GITLAB_SHELL_VERSION
@@ -1 +1 @@
-9.4.0
+9.4.1
-- 
cgit v1.2.1


From e632ae80845f849f93e4d85ef9f836a4792844c9 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Tue, 20 Aug 2019 18:12:28 +0000
Subject: Standardize remote_ip and path keys for auth.log and api_json.log

Current `auth.log` uses `fullpath` and `ip`, while `api_json.log` uses
`remote_ip` and `path` for the same fields. Let's standardize these
namings to make it easier for people working with the data.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66167
---
 app/controllers/concerns/invisible_captcha.rb         |  4 ++--
 config/initializers/rack_attack_logging.rb            |  4 ++--
 doc/administration/logs.md                            |  2 +-
 lib/api/api.rb                                        |  2 +-
 lib/gitlab/action_rate_limiter.rb                     |  4 ++--
 lib/gitlab/grape_logging/loggers/client_env_logger.rb | 16 ++++++++++++++++
 spec/controllers/projects/raw_controller_spec.rb      |  4 ++--
 spec/controllers/registrations_controller_spec.rb     |  4 ++--
 spec/lib/gitlab/action_rate_limiter_spec.rb           |  4 ++--
 spec/requests/rack_attack_global_spec.rb              | 12 ++++++------
 10 files changed, 36 insertions(+), 20 deletions(-)
 create mode 100644 lib/gitlab/grape_logging/loggers/client_env_logger.rb

diff --git a/app/controllers/concerns/invisible_captcha.rb b/app/controllers/concerns/invisible_captcha.rb
index c9f66e5c194..45c0a5c58ef 100644
--- a/app/controllers/concerns/invisible_captcha.rb
+++ b/app/controllers/concerns/invisible_captcha.rb
@@ -41,9 +41,9 @@ module InvisibleCaptcha
     request_information = {
       message: message,
       env: :invisible_captcha_signup_bot_detected,
-      ip: request.ip,
+      remote_ip: request.ip,
       request_method: request.request_method,
-      fullpath: request.fullpath
+      path: request.fullpath
     }
 
     Gitlab::AuthLogger.error(request_information)
diff --git a/config/initializers/rack_attack_logging.rb b/config/initializers/rack_attack_logging.rb
index 7eb34bd69e5..b43fff24bb0 100644
--- a/config/initializers/rack_attack_logging.rb
+++ b/config/initializers/rack_attack_logging.rb
@@ -7,9 +7,9 @@ ActiveSupport::Notifications.subscribe('rack.attack') do |name, start, finish, r
     rack_attack_info = {
       message: 'Rack_Attack',
       env: req.env['rack.attack.match_type'],
-      ip: req.ip,
+      remote_ip: req.ip,
       request_method: req.request_method,
-      fullpath: req.fullpath
+      path: req.fullpath
     }
 
     if %w(throttle_authenticated_api throttle_authenticated_web).include? req.env['rack.attack.matched']
diff --git a/doc/administration/logs.md b/doc/administration/logs.md
index a57ef8ddc7d..9030c941cad 100644
--- a/doc/administration/logs.md
+++ b/doc/administration/logs.md
@@ -88,7 +88,7 @@ Introduced in GitLab 10.0, this file lives in
 It helps you see requests made directly to the API. For example:
 
 ```json
-{"time":"2018-10-29T12:49:42.123Z","severity":"INFO","duration":709.08,"db":14.59,"view":694.49,"status":200,"method":"GET","path":"/api/v4/projects","params":[{"key":"action","value":"git-upload-pack"},{"key":"changes","value":"_any"},{"key":"key_id","value":"secret"},{"key":"secret_token","value":"[FILTERED]"}],"host":"localhost","ip":"::1","ua":"Ruby","route":"/api/:version/projects","user_id":1,"username":"root","queue_duration":100.31,"gitaly_calls":30,"gitaly_duration":5.36}
+{"time":"2018-10-29T12:49:42.123Z","severity":"INFO","duration":709.08,"db":14.59,"view":694.49,"status":200,"method":"GET","path":"/api/v4/projects","params":[{"key":"action","value":"git-upload-pack"},{"key":"changes","value":"_any"},{"key":"key_id","value":"secret"},{"key":"secret_token","value":"[FILTERED]"}],"host":"localhost","remote_ip":"::1","ua":"Ruby","route":"/api/:version/projects","user_id":1,"username":"root","queue_duration":100.31,"gitaly_calls":30,"gitaly_duration":5.36}
 ```
 
 This entry above shows an access to an internal endpoint to check whether an
diff --git a/lib/api/api.rb b/lib/api/api.rb
index e500a93b31e..219ed45eff6 100644
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -18,7 +18,7 @@ module API
                   formatter: Gitlab::GrapeLogging::Formatters::LogrageWithTimestamp.new,
                   include: [
                     GrapeLogging::Loggers::FilterParameters.new(LOG_FILTERS),
-                    GrapeLogging::Loggers::ClientEnv.new,
+                    Gitlab::GrapeLogging::Loggers::ClientEnvLogger.new,
                     Gitlab::GrapeLogging::Loggers::RouteLogger.new,
                     Gitlab::GrapeLogging::Loggers::UserLogger.new,
                     Gitlab::GrapeLogging::Loggers::QueueDurationLogger.new,
diff --git a/lib/gitlab/action_rate_limiter.rb b/lib/gitlab/action_rate_limiter.rb
index fdb06d00548..0e8707af631 100644
--- a/lib/gitlab/action_rate_limiter.rb
+++ b/lib/gitlab/action_rate_limiter.rb
@@ -49,9 +49,9 @@ module Gitlab
       request_information = {
         message: 'Action_Rate_Limiter_Request',
         env: type,
-        ip: request.ip,
+        remote_ip: request.ip,
         request_method: request.request_method,
-        fullpath: request.fullpath
+        path: request.fullpath
       }
 
       if current_user
diff --git a/lib/gitlab/grape_logging/loggers/client_env_logger.rb b/lib/gitlab/grape_logging/loggers/client_env_logger.rb
new file mode 100644
index 00000000000..3acc6f6a2ef
--- /dev/null
+++ b/lib/gitlab/grape_logging/loggers/client_env_logger.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+# This is a fork of
+# https://github.com/aserafin/grape_logging/blob/master/lib/grape_logging/loggers/client_env.rb
+# to use remote_ip instead of ip.
+module Gitlab
+  module GrapeLogging
+    module Loggers
+      class ClientEnvLogger < ::GrapeLogging::Loggers::Base
+        def parameters(request, _)
+          { remote_ip: request.env["HTTP_X_FORWARDED_FOR"] || request.env["REMOTE_ADDR"], ua: request.env["HTTP_USER_AGENT"] }
+        end
+      end
+    end
+  end
+end
diff --git a/spec/controllers/projects/raw_controller_spec.rb b/spec/controllers/projects/raw_controller_spec.rb
index b958f419a19..8b43d1264b2 100644
--- a/spec/controllers/projects/raw_controller_spec.rb
+++ b/spec/controllers/projects/raw_controller_spec.rb
@@ -67,9 +67,9 @@ describe Projects::RawController do
         attributes = {
           message: 'Action_Rate_Limiter_Request',
           env: :raw_blob_request_limit,
-          ip: '0.0.0.0',
+          remote_ip: '0.0.0.0',
           request_method: 'GET',
-          fullpath: "/#{project.full_path}/raw/#{file_path}"
+          path: "/#{project.full_path}/raw/#{file_path}"
         }
 
         expect(Gitlab::AuthLogger).to receive(:error).with(attributes).once
diff --git a/spec/controllers/registrations_controller_spec.rb b/spec/controllers/registrations_controller_spec.rb
index fed4fc810f2..35487682462 100644
--- a/spec/controllers/registrations_controller_spec.rb
+++ b/spec/controllers/registrations_controller_spec.rb
@@ -129,9 +129,9 @@ describe RegistrationsController do
         {
           message: auth_log_message,
           env: :invisible_captcha_signup_bot_detected,
-          ip: '0.0.0.0',
+          remote_ip: '0.0.0.0',
           request_method: 'POST',
-          fullpath: '/users'
+          path: '/users'
         }
       end
 
diff --git a/spec/lib/gitlab/action_rate_limiter_spec.rb b/spec/lib/gitlab/action_rate_limiter_spec.rb
index 8dbad32dfb4..8b510a475d2 100644
--- a/spec/lib/gitlab/action_rate_limiter_spec.rb
+++ b/spec/lib/gitlab/action_rate_limiter_spec.rb
@@ -74,9 +74,9 @@ describe Gitlab::ActionRateLimiter, :clean_gitlab_redis_cache do
       {
         message: 'Action_Rate_Limiter_Request',
         env: type,
-        ip: '127.0.0.1',
+        remote_ip: '127.0.0.1',
         request_method: 'GET',
-        fullpath: fullpath
+        path: fullpath
       }
     end
 
diff --git a/spec/requests/rack_attack_global_spec.rb b/spec/requests/rack_attack_global_spec.rb
index d832963292c..478f09a7881 100644
--- a/spec/requests/rack_attack_global_spec.rb
+++ b/spec/requests/rack_attack_global_spec.rb
@@ -112,9 +112,9 @@ describe 'Rack Attack global throttles' do
         arguments = {
           message: 'Rack_Attack',
           env: :throttle,
-          ip: '127.0.0.1',
+          remote_ip: '127.0.0.1',
           request_method: 'GET',
-          fullpath: get_args.first,
+          path: get_args.first,
           user_id: user.id,
           username: user.username
         }
@@ -213,9 +213,9 @@ describe 'Rack Attack global throttles' do
         arguments = {
           message: 'Rack_Attack',
           env: :throttle,
-          ip: '127.0.0.1',
+          remote_ip: '127.0.0.1',
           request_method: 'GET',
-          fullpath: '/users/sign_in'
+          path: '/users/sign_in'
         }
 
         expect(Gitlab::AuthLogger).to receive(:error).with(arguments)
@@ -377,9 +377,9 @@ describe 'Rack Attack global throttles' do
         arguments = {
           message: 'Rack_Attack',
           env: :throttle,
-          ip: '127.0.0.1',
+          remote_ip: '127.0.0.1',
           request_method: 'GET',
-          fullpath: '/dashboard/snippets',
+          path: '/dashboard/snippets',
           user_id: user.id,
           username: user.username
         }
-- 
cgit v1.2.1


From a56712433e654625a77cae583a5af5a97266d7fb Mon Sep 17 00:00:00 2001
From: Winnie Hellmann <winnie@gitlab.com>
Date: Tue, 20 Aug 2019 18:20:21 +0000
Subject: Fix assertion in mocks_helper_spec.js

---
 spec/frontend/mocks/mocks_helper_spec.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/spec/frontend/mocks/mocks_helper_spec.js b/spec/frontend/mocks/mocks_helper_spec.js
index 34be110a7e3..b8bb02c2f43 100644
--- a/spec/frontend/mocks/mocks_helper_spec.js
+++ b/spec/frontend/mocks/mocks_helper_spec.js
@@ -46,7 +46,9 @@ describe('mocks_helper.js', () => {
     readdir.sync.mockReturnValue([]);
     setupManualMocks();
 
-    readdir.mock.calls.forEach(call => {
+    const readdirSpy = readdir.sync;
+    expect(readdirSpy).toHaveBeenCalled();
+    readdirSpy.mock.calls.forEach(call => {
       expect(call[1].deep).toBeLessThan(100);
     });
   });
-- 
cgit v1.2.1


From 46bab2df99f1fbeb75d1983b50808ac080339661 Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Tue, 20 Aug 2019 18:26:25 +0000
Subject: Update repository languages screenshot

---
 .../project/repository/img/repository_languages.png    | Bin 26516 -> 0 bytes
 .../repository/img/repository_languages_v12_2.gif      | Bin 0 -> 159195 bytes
 doc/user/project/repository/index.md                   |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)
 delete mode 100644 doc/user/project/repository/img/repository_languages.png
 create mode 100644 doc/user/project/repository/img/repository_languages_v12_2.gif

diff --git a/doc/user/project/repository/img/repository_languages.png b/doc/user/project/repository/img/repository_languages.png
deleted file mode 100644
index 5977ad7faae..00000000000
Binary files a/doc/user/project/repository/img/repository_languages.png and /dev/null differ
diff --git a/doc/user/project/repository/img/repository_languages_v12_2.gif b/doc/user/project/repository/img/repository_languages_v12_2.gif
new file mode 100644
index 00000000000..d0a0e57c919
Binary files /dev/null and b/doc/user/project/repository/img/repository_languages_v12_2.gif differ
diff --git a/doc/user/project/repository/index.md b/doc/user/project/repository/index.md
index 84d63d29929..bd966185c94 100644
--- a/doc/user/project/repository/index.md
+++ b/doc/user/project/repository/index.md
@@ -182,7 +182,7 @@ were used and display this on the projects pages. If this information is missing
 be added after updating the default branch on the project. This process can take up to 5
 minutes.
 
-![Repository Languages bar](img/repository_languages.png)
+![Repository Languages bar](img/repository_languages_v12_2.gif)
 
 Not all files are detected, among others; documentation,
 vendored code, and most markup languages are excluded. This behaviour can be
-- 
cgit v1.2.1


From ac77bb9376ad50899619ff8026e6c6b420ff9c4b Mon Sep 17 00:00:00 2001
From: drew <dscimino@gmail.com>
Date: Tue, 20 Aug 2019 20:03:43 +0000
Subject: Introducing new Syntax for Ci::Build inclusion rules

- Added Gitlab::Ci::Config::Entry::Rules and Gitlab::Ci::Config::Entry::Rules:Rule
  to handle lists of Rule objects to be evalauted for job inclusion
- Added `if:` and `changes:` as available Rules::Rule::Clause classes
- Added Rules handling logic to Seed::Build#included? with extra specs
- Use DisallowedKeysValidator to mutually exclude rules: from only:/except: on job config
---
 changelogs/unreleased/ci-config-on-policy.yml      |   5 +
 lib/gitlab/ci/build/policy/variables.rb            |   2 +-
 lib/gitlab/ci/build/rules.rb                       |  37 +++
 lib/gitlab/ci/build/rules/rule.rb                  |  32 +++
 lib/gitlab/ci/build/rules/rule/clause.rb           |  31 +++
 lib/gitlab/ci/build/rules/rule/clause/changes.rb   |  23 ++
 lib/gitlab/ci/build/rules/rule/clause/if.rb        |  19 ++
 lib/gitlab/ci/config/entry/job.rb                  |  31 ++-
 lib/gitlab/ci/config/entry/rules.rb                |  33 +++
 lib/gitlab/ci/config/entry/rules/rule.rb           |  42 +++
 lib/gitlab/ci/pipeline/seed/build.rb               |  67 ++++-
 lib/gitlab/config/entry/validators.rb              |  24 +-
 spec/lib/gitlab/ci/build/policy/variables_spec.rb  |  14 +-
 spec/lib/gitlab/ci/build/rules/rule_spec.rb        |  50 ++++
 spec/lib/gitlab/ci/build/rules_spec.rb             | 168 ++++++++++++
 spec/lib/gitlab/ci/config/entry/job_spec.rb        | 111 +++++++-
 spec/lib/gitlab/ci/config/entry/policy_spec.rb     |  12 +-
 spec/lib/gitlab/ci/config/entry/rules/rule_spec.rb | 208 +++++++++++++++
 spec/lib/gitlab/ci/config/entry/rules_spec.rb      | 135 ++++++++++
 spec/lib/gitlab/ci/pipeline/seed/build_spec.rb     | 287 ++++++++++++++++++++-
 spec/lib/gitlab/ci/yaml_processor_spec.rb          | 114 +++++++-
 spec/support/helpers/stub_gitlab_calls.rb          |   4 +
 22 files changed, 1406 insertions(+), 43 deletions(-)
 create mode 100644 changelogs/unreleased/ci-config-on-policy.yml
 create mode 100644 lib/gitlab/ci/build/rules.rb
 create mode 100644 lib/gitlab/ci/build/rules/rule.rb
 create mode 100644 lib/gitlab/ci/build/rules/rule/clause.rb
 create mode 100644 lib/gitlab/ci/build/rules/rule/clause/changes.rb
 create mode 100644 lib/gitlab/ci/build/rules/rule/clause/if.rb
 create mode 100644 lib/gitlab/ci/config/entry/rules.rb
 create mode 100644 lib/gitlab/ci/config/entry/rules/rule.rb
 create mode 100644 spec/lib/gitlab/ci/build/rules/rule_spec.rb
 create mode 100644 spec/lib/gitlab/ci/build/rules_spec.rb
 create mode 100644 spec/lib/gitlab/ci/config/entry/rules/rule_spec.rb
 create mode 100644 spec/lib/gitlab/ci/config/entry/rules_spec.rb

diff --git a/changelogs/unreleased/ci-config-on-policy.yml b/changelogs/unreleased/ci-config-on-policy.yml
new file mode 100644
index 00000000000..d9804f0323a
--- /dev/null
+++ b/changelogs/unreleased/ci-config-on-policy.yml
@@ -0,0 +1,5 @@
+---
+title: Introduced Build::Rules configuration for Ci::Build
+merge_request: 29011
+author:
+type: added
diff --git a/lib/gitlab/ci/build/policy/variables.rb b/lib/gitlab/ci/build/policy/variables.rb
index 0698136166a..e9c8864123f 100644
--- a/lib/gitlab/ci/build/policy/variables.rb
+++ b/lib/gitlab/ci/build/policy/variables.rb
@@ -10,7 +10,7 @@ module Gitlab
           end
 
           def satisfied_by?(pipeline, seed)
-            variables = seed.to_resource.scoped_variables_hash
+            variables = seed.scoped_variables_hash
 
             statements = @expressions.map do |statement|
               ::Gitlab::Ci::Pipeline::Expression::Statement
diff --git a/lib/gitlab/ci/build/rules.rb b/lib/gitlab/ci/build/rules.rb
new file mode 100644
index 00000000000..89623a809c9
--- /dev/null
+++ b/lib/gitlab/ci/build/rules.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Build
+      class Rules
+        include ::Gitlab::Utils::StrongMemoize
+
+        Result = Struct.new(:when, :start_in)
+
+        def initialize(rule_hashes, default_when = 'on_success')
+          @rule_list    = Rule.fabricate_list(rule_hashes)
+          @default_when = default_when
+        end
+
+        def evaluate(pipeline, build)
+          if @rule_list.nil?
+            Result.new(@default_when)
+          elsif matched_rule = match_rule(pipeline, build)
+            Result.new(
+              matched_rule.attributes[:when] || @default_when,
+              matched_rule.attributes[:start_in]
+            )
+          else
+            Result.new('never')
+          end
+        end
+
+        private
+
+        def match_rule(pipeline, build)
+          @rule_list.find { |rule| rule.matches?(pipeline, build) }
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/build/rules/rule.rb b/lib/gitlab/ci/build/rules/rule.rb
new file mode 100644
index 00000000000..8d52158c8d2
--- /dev/null
+++ b/lib/gitlab/ci/build/rules/rule.rb
@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Build
+      class Rules::Rule
+        attr_accessor :attributes
+
+        def self.fabricate_list(list)
+          list.map(&method(:new)) if list
+        end
+
+        def initialize(spec)
+          @clauses    = []
+          @attributes = {}
+
+          spec.each do |type, value|
+            if clause = Clause.fabricate(type, value)
+              @clauses << clause
+            else
+              @attributes.merge!(type => value)
+            end
+          end
+        end
+
+        def matches?(pipeline, build)
+          @clauses.all? { |clause| clause.satisfied_by?(pipeline, build) }
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/build/rules/rule/clause.rb b/lib/gitlab/ci/build/rules/rule/clause.rb
new file mode 100644
index 00000000000..ff0baf3348c
--- /dev/null
+++ b/lib/gitlab/ci/build/rules/rule/clause.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Build
+      class Rules::Rule::Clause
+        ##
+        # Abstract class that defines an interface of a single
+        # job rule specification.
+        #
+        # Used for job's inclusion rules configuration.
+        #
+        UnknownClauseError = Class.new(StandardError)
+
+        def self.fabricate(type, value)
+          type = type.to_s.camelize
+
+          self.const_get(type).new(value) if self.const_defined?(type)
+        end
+
+        def initialize(spec)
+          @spec = spec
+        end
+
+        def satisfied_by?(pipeline, seed = nil)
+          raise NotImplementedError
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/build/rules/rule/clause/changes.rb b/lib/gitlab/ci/build/rules/rule/clause/changes.rb
new file mode 100644
index 00000000000..81d2ee6c24c
--- /dev/null
+++ b/lib/gitlab/ci/build/rules/rule/clause/changes.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Build
+      class Rules::Rule::Clause::Changes < Rules::Rule::Clause
+        def initialize(globs)
+          @globs = Array(globs)
+        end
+
+        def satisfied_by?(pipeline, seed)
+          return true if pipeline.modified_paths.nil?
+
+          pipeline.modified_paths.any? do |path|
+            @globs.any? do |glob|
+              File.fnmatch?(glob, path, File::FNM_PATHNAME | File::FNM_DOTMATCH | File::FNM_EXTGLOB)
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/build/rules/rule/clause/if.rb b/lib/gitlab/ci/build/rules/rule/clause/if.rb
new file mode 100644
index 00000000000..18c3b450f95
--- /dev/null
+++ b/lib/gitlab/ci/build/rules/rule/clause/if.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Build
+      class Rules::Rule::Clause::If < Rules::Rule::Clause
+        def initialize(expression)
+          @expression = expression
+        end
+
+        def satisfied_by?(pipeline, seed)
+          variables = seed.scoped_variables_hash
+
+          ::Gitlab::Ci::Pipeline::Expression::Statement.new(@expression, variables).truthful?
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/config/entry/job.rb b/lib/gitlab/ci/config/entry/job.rb
index 29a52b9da17..6e11c582750 100644
--- a/lib/gitlab/ci/config/entry/job.rb
+++ b/lib/gitlab/ci/config/entry/job.rb
@@ -11,7 +11,8 @@ module Gitlab
           include ::Gitlab::Config::Entry::Configurable
           include ::Gitlab::Config::Entry::Attributable
 
-          ALLOWED_KEYS = %i[tags script only except type image services
+          ALLOWED_WHEN = %w[on_success on_failure always manual delayed].freeze
+          ALLOWED_KEYS = %i[tags script only except rules type image services
                             allow_failure type stage when start_in artifacts cache
                             dependencies needs before_script after_script variables
                             environment coverage retry parallel extends].freeze
@@ -19,12 +20,19 @@ module Gitlab
           REQUIRED_BY_NEEDS = %i[stage].freeze
 
           validations do
+            validates :config, type: Hash
             validates :config, allowed_keys: ALLOWED_KEYS
             validates :config, required_keys: REQUIRED_BY_NEEDS, if: :has_needs?
             validates :config, presence: true
             validates :script, presence: true
             validates :name, presence: true
             validates :name, type: Symbol
+            validates :config,
+              disallowed_keys: {
+                in: %i[only except when start_in],
+                message: 'key may not be used with `rules`'
+              },
+              if: :has_rules?
 
             with_options allow_nil: true do
               validates :tags, array_of_strings: true
@@ -32,17 +40,19 @@ module Gitlab
               validates :parallel, numericality: { only_integer: true,
                                                    greater_than_or_equal_to: 2,
                                                    less_than_or_equal_to: 50 }
-              validates :when,
-                inclusion: { in: %w[on_success on_failure always manual delayed],
-                             message: 'should be on_success, on_failure, ' \
-                                      'always, manual or delayed' }
+              validates :when, inclusion: {
+                in: ALLOWED_WHEN,
+                message: "should be one of: #{ALLOWED_WHEN.join(', ')}"
+              }
+
               validates :dependencies, array_of_strings: true
               validates :needs, array_of_strings: true
               validates :extends, array_of_strings_or_string: true
+              validates :rules, array_of_hashes: true
             end
 
             validates :start_in, duration: { limit: '1 day' }, if: :delayed?
-            validates :start_in, absence: true, unless: :delayed?
+            validates :start_in, absence: true, if: -> { has_rules? || !delayed? }
 
             validate do
               next unless dependencies.present?
@@ -91,6 +101,9 @@ module Gitlab
           entry :except, Entry::Policy,
             description: 'Refs policy this job will be executed for.'
 
+          entry :rules, Entry::Rules,
+            description: 'List of evaluable Rules to determine job inclusion.'
+
           entry :variables, Entry::Variables,
             description: 'Environment variables available for this job.'
 
@@ -112,7 +125,7 @@ module Gitlab
                   :parallel, :needs
 
           attributes :script, :tags, :allow_failure, :when, :dependencies,
-                     :needs, :retry, :parallel, :extends, :start_in
+                     :needs, :retry, :parallel, :extends, :start_in, :rules
 
           def self.matching?(name, config)
             !name.to_s.start_with?('.') &&
@@ -151,6 +164,10 @@ module Gitlab
             self.when == 'delayed'
           end
 
+          def has_rules?
+            @config.try(:key?, :rules)
+          end
+
           def ignored?
             allow_failure.nil? ? manual_action? : allow_failure
           end
diff --git a/lib/gitlab/ci/config/entry/rules.rb b/lib/gitlab/ci/config/entry/rules.rb
new file mode 100644
index 00000000000..65cad0880f5
--- /dev/null
+++ b/lib/gitlab/ci/config/entry/rules.rb
@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    class Config
+      module Entry
+        class Rules < ::Gitlab::Config::Entry::Node
+          include ::Gitlab::Config::Entry::Validatable
+
+          validations do
+            validates :config, presence: true
+            validates :config, type: Array
+          end
+
+          def compose!(deps = nil)
+            super(deps) do
+              @config.each_with_index do |rule, index|
+                @entries[index] = ::Gitlab::Config::Entry::Factory.new(Entry::Rules::Rule)
+                  .value(rule)
+                  .with(key: "rule", parent: self, description: "rule definition.") # rubocop:disable CodeReuse/ActiveRecord
+                  .create!
+              end
+
+              @entries.each_value do |entry|
+                entry.compose!(deps)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/config/entry/rules/rule.rb b/lib/gitlab/ci/config/entry/rules/rule.rb
new file mode 100644
index 00000000000..1f2a34ec90e
--- /dev/null
+++ b/lib/gitlab/ci/config/entry/rules/rule.rb
@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    class Config
+      module Entry
+        class Rules::Rule < ::Gitlab::Config::Entry::Node
+          include ::Gitlab::Config::Entry::Validatable
+          include ::Gitlab::Config::Entry::Attributable
+
+          CLAUSES      = %i[if changes].freeze
+          ALLOWED_KEYS = %i[if changes when start_in].freeze
+          ALLOWED_WHEN = %w[on_success on_failure always never manual delayed].freeze
+
+          attributes :if, :changes, :when, :start_in
+
+          validations do
+            validates :config, presence: true
+            validates :config, type: { with: Hash }
+            validates :config, allowed_keys: ALLOWED_KEYS
+            validates :config, disallowed_keys: %i[start_in], unless: :specifies_delay?
+            validates :start_in, presence: true, if: :specifies_delay?
+            validates :start_in, duration: { limit: '1 day' }, if: :specifies_delay?
+
+            with_options allow_nil: true do
+              validates :if, expression: true
+              validates :changes, array_of_strings: true
+              validates :when, allowed_values: { in: ALLOWED_WHEN }
+            end
+          end
+
+          def specifies_delay?
+            self.when == 'delayed'
+          end
+
+          def default
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/pipeline/seed/build.rb b/lib/gitlab/ci/pipeline/seed/build.rb
index 7ec03d132c0..1066331062b 100644
--- a/lib/gitlab/ci/pipeline/seed/build.rb
+++ b/lib/gitlab/ci/pipeline/seed/build.rb
@@ -7,7 +7,7 @@ module Gitlab
         class Build < Seed::Base
           include Gitlab::Utils::StrongMemoize
 
-          delegate :dig, to: :@attributes
+          delegate :dig, to: :@seed_attributes
 
           # When the `ci_dag_limit_needs` is enabled it uses the lower limit
           LOW_NEEDS_LIMIT = 5
@@ -15,14 +15,20 @@ module Gitlab
 
           def initialize(pipeline, attributes, previous_stages)
             @pipeline = pipeline
-            @attributes = attributes
+            @seed_attributes = attributes
             @previous_stages = previous_stages
             @needs_attributes = dig(:needs_attributes)
 
+            @using_rules  = attributes.key?(:rules)
+            @using_only   = attributes.key?(:only)
+            @using_except = attributes.key?(:except)
+
             @only = Gitlab::Ci::Build::Policy
               .fabricate(attributes.delete(:only))
             @except = Gitlab::Ci::Build::Policy
               .fabricate(attributes.delete(:except))
+            @rules = Gitlab::Ci::Build::Rules
+              .new(attributes.delete(:rules))
           end
 
           def name
@@ -31,8 +37,13 @@ module Gitlab
 
           def included?
             strong_memoize(:inclusion) do
-              all_of_only? &&
-                none_of_except?
+              if @using_rules
+                included_by_rules?
+              elsif @using_only || @using_except
+                all_of_only? && none_of_except?
+              else
+                true
+              end
             end
           end
 
@@ -45,19 +56,13 @@ module Gitlab
           end
 
           def attributes
-            @attributes.merge(
-              pipeline: @pipeline,
-              project: @pipeline.project,
-              user: @pipeline.user,
-              ref: @pipeline.ref,
-              tag: @pipeline.tag,
-              trigger_request: @pipeline.legacy_trigger,
-              protected: @pipeline.protected_ref?
-            )
+            @seed_attributes
+              .deep_merge(pipeline_attributes)
+              .deep_merge(rules_attributes)
           end
 
           def bridge?
-            attributes_hash = @attributes.to_h
+            attributes_hash = @seed_attributes.to_h
             attributes_hash.dig(:options, :trigger).present? ||
               (attributes_hash.dig(:options, :bridge_needs).instance_of?(Hash) &&
                attributes_hash.dig(:options, :bridge_needs, :pipeline).present?)
@@ -73,6 +78,18 @@ module Gitlab
             end
           end
 
+          def scoped_variables_hash
+            strong_memoize(:scoped_variables_hash) do
+              # This is a temporary piece of technical debt to allow us access
+              # to the CI variables to evaluate rules before we persist a Build
+              # with the result. We should refactor away the extra Build.new,
+              # but be able to get CI Variables directly from the Seed::Build.
+              ::Ci::Build.new(
+                @seed_attributes.merge(pipeline_attributes)
+              ).scoped_variables_hash
+            end
+          end
+
           private
 
           def all_of_only?
@@ -109,6 +126,28 @@ module Gitlab
               HARD_NEEDS_LIMIT
             end
           end
+
+          def pipeline_attributes
+            {
+              pipeline: @pipeline,
+              project: @pipeline.project,
+              user: @pipeline.user,
+              ref: @pipeline.ref,
+              tag: @pipeline.tag,
+              trigger_request: @pipeline.legacy_trigger,
+              protected: @pipeline.protected_ref?
+            }
+          end
+
+          def included_by_rules?
+            rules_attributes[:when] != 'never'
+          end
+
+          def rules_attributes
+            strong_memoize(:rules_attributes) do
+              @using_rules ? @rules.evaluate(@pipeline, self).to_h.compact : {}
+            end
+          end
         end
       end
     end
diff --git a/lib/gitlab/config/entry/validators.rb b/lib/gitlab/config/entry/validators.rb
index 0289e675c6b..374f929878e 100644
--- a/lib/gitlab/config/entry/validators.rb
+++ b/lib/gitlab/config/entry/validators.rb
@@ -20,8 +20,10 @@ module Gitlab
             present_keys = value.try(:keys).to_a & options[:in]
 
             if present_keys.any?
-              record.errors.add(attribute, "contains disallowed keys: " +
-                present_keys.join(', '))
+              message = options[:message] || "contains disallowed keys"
+              message += ": #{present_keys.join(', ')}"
+
+              record.errors.add(attribute, message)
             end
           end
         end
@@ -65,6 +67,16 @@ module Gitlab
           end
         end
 
+        class ArrayOfHashesValidator < ActiveModel::EachValidator
+          include LegacyValidationHelpers
+
+          def validate_each(record, attribute, value)
+            unless value.is_a?(Array) && value.map { |hsh| hsh.is_a?(Hash) }.all?
+              record.errors.add(attribute, 'should be an array of hashes')
+            end
+          end
+        end
+
         class ArrayOrStringValidator < ActiveModel::EachValidator
           def validate_each(record, attribute, value)
             unless value.is_a?(Array) || value.is_a?(String)
@@ -231,6 +243,14 @@ module Gitlab
           end
         end
 
+        class ExpressionValidator < ActiveModel::EachValidator
+          def validate_each(record, attribute, value)
+            unless value.is_a?(String) && ::Gitlab::Ci::Pipeline::Expression::Statement.new(value).valid?
+              record.errors.add(attribute, 'Invalid expression syntax')
+            end
+          end
+        end
+
         class PortNamePresentAndUniqueValidator < ActiveModel::EachValidator
           def validate_each(record, attribute, value)
             return unless value.is_a?(Array)
diff --git a/spec/lib/gitlab/ci/build/policy/variables_spec.rb b/spec/lib/gitlab/ci/build/policy/variables_spec.rb
index f712f47a558..7140c14facb 100644
--- a/spec/lib/gitlab/ci/build/policy/variables_spec.rb
+++ b/spec/lib/gitlab/ci/build/policy/variables_spec.rb
@@ -13,7 +13,12 @@ describe Gitlab::Ci::Build::Policy::Variables do
     build(:ci_build, pipeline: pipeline, project: project, ref: 'master')
   end
 
-  let(:seed) { double('build seed', to_resource: ci_build) }
+  let(:seed) do
+    double('build seed',
+      to_resource: ci_build,
+      scoped_variables_hash: ci_build.scoped_variables_hash
+    )
+  end
 
   before do
     pipeline.variables.build(key: 'CI_PROJECT_NAME', value: '')
@@ -83,7 +88,12 @@ describe Gitlab::Ci::Build::Policy::Variables do
         build(:ci_bridge, pipeline: pipeline, project: project, ref: 'master')
       end
 
-      let(:seed) { double('bridge seed', to_resource: bridge) }
+      let(:seed) do
+        double('bridge seed',
+          to_resource: bridge,
+          scoped_variables_hash: ci_build.scoped_variables_hash
+        )
+      end
 
       it 'is satisfied by a matching expression for a bridge job' do
         policy = described_class.new(['$MY_VARIABLE'])
diff --git a/spec/lib/gitlab/ci/build/rules/rule_spec.rb b/spec/lib/gitlab/ci/build/rules/rule_spec.rb
new file mode 100644
index 00000000000..99852bd4228
--- /dev/null
+++ b/spec/lib/gitlab/ci/build/rules/rule_spec.rb
@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe Gitlab::Ci::Build::Rules::Rule do
+  let(:seed) do
+    double('build seed',
+      to_resource: ci_build,
+      scoped_variables_hash: ci_build.scoped_variables_hash
+    )
+  end
+
+  let(:pipeline) { create(:ci_pipeline) }
+  let(:ci_build) { build(:ci_build, pipeline: pipeline) }
+  let(:rule)     { described_class.new(rule_hash) }
+
+  describe '#matches?' do
+    subject { rule.matches?(pipeline, seed) }
+
+    context 'with one matching clause' do
+      let(:rule_hash) do
+        { if: '$VAR == null', when: 'always' }
+      end
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'with two matching clauses' do
+      let(:rule_hash) do
+        { if: '$VAR == null', changes: '**/*', when: 'always' }
+      end
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'with a matching and non-matching clause' do
+      let(:rule_hash) do
+        { if: '$VAR != null', changes: '$VAR == null', when: 'always' }
+      end
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'with two non-matching clauses' do
+      let(:rule_hash) do
+        { if: '$VAR != null', changes: 'README', when: 'always' }
+      end
+
+      it { is_expected.to eq(false) }
+    end
+  end
+end
diff --git a/spec/lib/gitlab/ci/build/rules_spec.rb b/spec/lib/gitlab/ci/build/rules_spec.rb
new file mode 100644
index 00000000000..d7793ebc806
--- /dev/null
+++ b/spec/lib/gitlab/ci/build/rules_spec.rb
@@ -0,0 +1,168 @@
+require 'spec_helper'
+
+describe Gitlab::Ci::Build::Rules do
+  let(:pipeline) { create(:ci_pipeline) }
+  let(:ci_build) { build(:ci_build, pipeline: pipeline) }
+
+  let(:seed) do
+    double('build seed',
+      to_resource: ci_build,
+      scoped_variables_hash: ci_build.scoped_variables_hash
+    )
+  end
+
+  let(:rules) { described_class.new(rule_list) }
+
+  describe '.new' do
+    let(:rules_ivar)   { rules.instance_variable_get :@rule_list }
+    let(:default_when) { rules.instance_variable_get :@default_when }
+
+    context 'with no rules' do
+      let(:rule_list) { [] }
+
+      it 'sets @rule_list to an empty array' do
+        expect(rules_ivar).to eq([])
+      end
+
+      it 'sets @default_when to "on_success"' do
+        expect(default_when).to eq('on_success')
+      end
+    end
+
+    context 'with one rule' do
+      let(:rule_list) { [{ if: '$VAR == null', when: 'always' }] }
+
+      it 'sets @rule_list to an array of a single rule' do
+        expect(rules_ivar).to be_an(Array)
+      end
+
+      it 'sets @default_when to "on_success"' do
+        expect(default_when).to eq('on_success')
+      end
+    end
+
+    context 'with multiple rules' do
+      let(:rule_list) do
+        [
+          { if: '$VAR == null', when: 'always' },
+          { if: '$VAR == null', when: 'always' }
+        ]
+      end
+
+      it 'sets @rule_list to an array of a single rule' do
+        expect(rules_ivar).to be_an(Array)
+      end
+
+      it 'sets @default_when to "on_success"' do
+        expect(default_when).to eq('on_success')
+      end
+    end
+
+    context 'with a specified default when:' do
+      let(:rule_list) { [{ if: '$VAR == null', when: 'always' }] }
+      let(:rules)     { described_class.new(rule_list, 'manual') }
+
+      it 'sets @rule_list to an array of a single rule' do
+        expect(rules_ivar).to be_an(Array)
+      end
+
+      it 'sets @default_when to "manual"' do
+        expect(default_when).to eq('manual')
+      end
+    end
+  end
+
+  describe '#evaluate' do
+    subject { rules.evaluate(pipeline, seed) }
+
+    context 'with nil rules' do
+      let(:rule_list) { nil }
+
+      it { is_expected.to eq(described_class::Result.new('on_success')) }
+
+      context 'and when:manual set as the default' do
+        let(:rules) { described_class.new(rule_list, 'manual') }
+
+        it { is_expected.to eq(described_class::Result.new('manual')) }
+      end
+    end
+
+    context 'with no rules' do
+      let(:rule_list) { [] }
+
+      it { is_expected.to eq(described_class::Result.new('never')) }
+
+      context 'and when:manual set as the default' do
+        let(:rules) { described_class.new(rule_list, 'manual') }
+
+        it { is_expected.to eq(described_class::Result.new('never')) }
+      end
+    end
+
+    context 'with one rule without any clauses' do
+      let(:rule_list) { [{ when: 'manual' }] }
+
+      it { is_expected.to eq(described_class::Result.new('manual')) }
+    end
+
+    context 'with one matching rule' do
+      let(:rule_list) { [{ if: '$VAR == null', when: 'always' }] }
+
+      it { is_expected.to eq(described_class::Result.new('always')) }
+    end
+
+    context 'with two matching rules' do
+      let(:rule_list) do
+        [
+          { if: '$VAR == null', when: 'delayed', start_in: '1 day' },
+          { if: '$VAR == null', when: 'always' }
+        ]
+      end
+
+      it 'returns the value of the first matched rule in the list' do
+        expect(subject).to eq(described_class::Result.new('delayed', '1 day'))
+      end
+    end
+
+    context 'with a non-matching and matching rule' do
+      let(:rule_list) do
+        [
+          { if: '$VAR =! null', when: 'delayed', start_in: '1 day' },
+          { if: '$VAR == null', when: 'always' }
+        ]
+      end
+
+      it { is_expected.to eq(described_class::Result.new('always')) }
+    end
+
+    context 'with a matching and non-matching rule' do
+      let(:rule_list) do
+        [
+          { if: '$VAR == null', when: 'delayed', start_in: '1 day' },
+          { if: '$VAR != null', when: 'always' }
+        ]
+      end
+
+      it { is_expected.to eq(described_class::Result.new('delayed', '1 day')) }
+    end
+
+    context 'with non-matching rules' do
+      let(:rule_list) do
+        [
+          { if: '$VAR != null', when: 'delayed', start_in: '1 day' },
+          { if: '$VAR != null', when: 'always' }
+        ]
+      end
+
+      it { is_expected.to eq(described_class::Result.new('never')) }
+
+      context 'and when:manual set as the default' do
+        let(:rules) { described_class.new(rule_list, 'manual') }
+
+        it 'does not return the default when:' do
+          expect(subject).to eq(described_class::Result.new('never'))
+        end
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/ci/config/entry/job_spec.rb b/spec/lib/gitlab/ci/config/entry/job_spec.rb
index 415ade7a096..1853efde350 100644
--- a/spec/lib/gitlab/ci/config/entry/job_spec.rb
+++ b/spec/lib/gitlab/ci/config/entry/job_spec.rb
@@ -11,7 +11,7 @@ describe Gitlab::Ci::Config::Entry::Job do
 
       let(:result) do
         %i[before_script script stage type after_script cache
-           image services only except variables artifacts
+           image services only except rules variables artifacts
            environment coverage retry]
       end
 
@@ -201,6 +201,21 @@ describe Gitlab::Ci::Config::Entry::Job do
             expect(entry.errors).to include 'job parallel must be an integer'
           end
         end
+
+        context 'when it uses both "when:" and "rules:"' do
+          let(:config) do
+            {
+              script: 'echo',
+              when: 'on_failure',
+              rules: [{ if: '$VARIABLE', when: 'on_success' }]
+            }
+          end
+
+          it 'returns an error about when: being combined with rules' do
+            expect(entry).not_to be_valid
+            expect(entry.errors).to include 'job config key may not be used with `rules`: when'
+          end
+        end
       end
 
       context 'when delayed job' do
@@ -240,6 +255,100 @@ describe Gitlab::Ci::Config::Entry::Job do
         end
       end
 
+      context 'when only: is used with rules:' do
+        let(:config) { { only: ['merge_requests'], rules: [{ if: '$THIS' }] } }
+
+        it 'returns error about mixing only: with rules:' do
+          expect(entry).not_to be_valid
+          expect(entry.errors).to include /may not be used with `rules`/
+        end
+
+        context 'and only: is blank' do
+          let(:config) { { only: nil, rules: [{ if: '$THIS' }] } }
+
+          it 'returns error about mixing only: with rules:' do
+            expect(entry).not_to be_valid
+            expect(entry.errors).to include /may not be used with `rules`/
+          end
+        end
+
+        context 'and rules: is blank' do
+          let(:config) { { only: ['merge_requests'], rules: nil } }
+
+          it 'returns error about mixing only: with rules:' do
+            expect(entry).not_to be_valid
+            expect(entry.errors).to include /may not be used with `rules`/
+          end
+        end
+      end
+
+      context 'when except: is used with rules:' do
+        let(:config) { { except: { refs: %w[master] }, rules: [{ if: '$THIS' }] } }
+
+        it 'returns error about mixing except: with rules:' do
+          expect(entry).not_to be_valid
+          expect(entry.errors).to include /may not be used with `rules`/
+        end
+
+        context 'and except: is blank' do
+          let(:config) { { except: nil, rules: [{ if: '$THIS' }] } }
+
+          it 'returns error about mixing except: with rules:' do
+            expect(entry).not_to be_valid
+            expect(entry.errors).to include /may not be used with `rules`/
+          end
+        end
+
+        context 'and rules: is blank' do
+          let(:config) { { except: { refs: %w[master] }, rules: nil } }
+
+          it 'returns error about mixing except: with rules:' do
+            expect(entry).not_to be_valid
+            expect(entry.errors).to include /may not be used with `rules`/
+          end
+        end
+      end
+
+      context 'when only: and except: are both used with rules:' do
+        let(:config) do
+          {
+            only: %w[merge_requests],
+            except: { refs: %w[master] },
+            rules: [{ if: '$THIS' }]
+          }
+        end
+
+        it 'returns errors about mixing both only: and except: with rules:' do
+          expect(entry).not_to be_valid
+          expect(entry.errors).to include /may not be used with `rules`/
+          expect(entry.errors).to include /may not be used with `rules`/
+        end
+
+        context 'when only: and except: as both blank' do
+          let(:config) do
+            { only: nil, except: nil, rules: [{ if: '$THIS' }] }
+          end
+
+          it 'returns errors about mixing both only: and except: with rules:' do
+            expect(entry).not_to be_valid
+            expect(entry.errors).to include /may not be used with `rules`/
+            expect(entry.errors).to include /may not be used with `rules`/
+          end
+        end
+
+        context 'when rules: is blank' do
+          let(:config) do
+            { only: %w[merge_requests], except: { refs: %w[master] }, rules: nil }
+          end
+
+          it 'returns errors about mixing both only: and except: with rules:' do
+            expect(entry).not_to be_valid
+            expect(entry.errors).to include /may not be used with `rules`/
+            expect(entry.errors).to include /may not be used with `rules`/
+          end
+        end
+      end
+
       context 'when start_in specified without delayed specification' do
         let(:config) { { start_in: '1 day' } }
 
diff --git a/spec/lib/gitlab/ci/config/entry/policy_spec.rb b/spec/lib/gitlab/ci/config/entry/policy_spec.rb
index 266a27c1e47..a606eb303e7 100644
--- a/spec/lib/gitlab/ci/config/entry/policy_spec.rb
+++ b/spec/lib/gitlab/ci/config/entry/policy_spec.rb
@@ -51,8 +51,6 @@ describe Gitlab::Ci::Config::Entry::Policy do
 
           let(:config) { ['/^(?!master).+/'] }
 
-          subject { described_class.new([regexp]) }
-
           context 'when allow_unsafe_ruby_regexp is disabled' do
             before do
               stub_feature_flags(allow_unsafe_ruby_regexp: false)
@@ -113,8 +111,6 @@ describe Gitlab::Ci::Config::Entry::Policy do
 
       let(:config) { { refs: ['/^(?!master).+/'] } }
 
-      subject { described_class.new([regexp]) }
-
       context 'when allow_unsafe_ruby_regexp is disabled' do
         before do
           stub_feature_flags(allow_unsafe_ruby_regexp: false)
@@ -203,6 +199,14 @@ describe Gitlab::Ci::Config::Entry::Policy do
       end
     end
 
+    context 'when changes policy is invalid' do
+      let(:config) { { changes: 'some/*' } }
+
+      it 'returns errors' do
+        expect(entry.errors).to include /changes should be an array of strings/
+      end
+    end
+
     context 'when changes policy is invalid' do
       let(:config) { { changes: [1, 2] } }
 
diff --git a/spec/lib/gitlab/ci/config/entry/rules/rule_spec.rb b/spec/lib/gitlab/ci/config/entry/rules/rule_spec.rb
new file mode 100644
index 00000000000..c25344ec1a4
--- /dev/null
+++ b/spec/lib/gitlab/ci/config/entry/rules/rule_spec.rb
@@ -0,0 +1,208 @@
+require 'fast_spec_helper'
+require 'chronic_duration'
+require 'support/helpers/stub_feature_flags'
+require_dependency 'active_model'
+
+describe Gitlab::Ci::Config::Entry::Rules::Rule do
+  let(:entry) { described_class.new(config) }
+
+  describe '.new' do
+    subject { entry }
+
+    context 'with a when: value but no clauses' do
+      let(:config) { { when: 'manual' } }
+
+      it { is_expected.to be_valid }
+    end
+
+    context 'when specifying an if: clause' do
+      let(:config) { { if: '$THIS || $THAT', when: 'manual' } }
+
+      it { is_expected.to be_valid }
+
+      describe '#when' do
+        subject { entry.when }
+
+        it { is_expected.to eq('manual') }
+      end
+    end
+
+    context 'using a list of multiple expressions' do
+      let(:config) { { if: ['$MY_VAR == "this"', '$YOUR_VAR == "that"'] } }
+
+      it { is_expected.not_to be_valid }
+
+      it 'reports an error about invalid format' do
+        expect(subject.errors).to include(/invalid expression syntax/)
+      end
+    end
+
+    context 'when specifying an invalid if: clause expression' do
+      let(:config) { { if: ['$MY_VAR =='] } }
+
+      it { is_expected.not_to be_valid }
+
+      it 'reports an error about invalid statement' do
+        expect(subject.errors).to include(/invalid expression syntax/)
+      end
+    end
+
+    context 'when specifying an if: clause expression with an invalid token' do
+      let(:config) { { if: ['$MY_VAR == 123'] } }
+
+      it { is_expected.not_to be_valid }
+
+      it 'reports an error about invalid statement' do
+        expect(subject.errors).to include(/invalid expression syntax/)
+      end
+    end
+
+    context 'when using invalid regex in an if: clause' do
+      let(:config) { { if: ['$MY_VAR =~ /some ( thing/'] } }
+
+      it 'reports an error about invalid expression' do
+        expect(subject.errors).to include(/invalid expression syntax/)
+      end
+    end
+
+    context 'when using an if: clause with lookahead regex character "?"' do
+      let(:config) { { if: '$CI_COMMIT_REF =~ /^(?!master).+/' } }
+
+      context 'when allow_unsafe_ruby_regexp is disabled' do
+        it { is_expected.not_to be_valid }
+
+        it 'reports an error about invalid expression syntax' do
+          expect(subject.errors).to include(/invalid expression syntax/)
+        end
+      end
+    end
+
+    context 'when using a changes: clause' do
+      let(:config) { { changes: %w[app/ lib/ spec/ other/* paths/**/*.rb] } }
+
+      it { is_expected.to be_valid }
+    end
+
+    context 'when using a string as an invalid changes: clause' do
+      let(:config) { { changes: 'a regular string' } }
+
+      it { is_expected.not_to be_valid }
+
+      it 'reports an error about invalid policy' do
+        expect(subject.errors).to include(/should be an array of strings/)
+      end
+    end
+
+    context 'when using a list as an invalid changes: clause' do
+      let(:config) { { changes: [1, 2] } }
+
+      it { is_expected.not_to be_valid }
+
+      it 'returns errors' do
+        expect(subject.errors).to include(/changes should be an array of strings/)
+      end
+    end
+
+    context 'specifying a delayed job' do
+      let(:config) { { if: '$THIS || $THAT', when: 'delayed', start_in: '15 minutes' } }
+
+      it { is_expected.to be_valid }
+
+      it 'sets attributes for the job delay' do
+        expect(entry.when).to eq('delayed')
+        expect(entry.start_in).to eq('15 minutes')
+      end
+
+      context 'without a when: key' do
+        let(:config) { { if: '$THIS || $THAT', start_in: '15 minutes' } }
+
+        it { is_expected.not_to be_valid }
+
+        it 'returns an error about the disallowed key' do
+          expect(entry.errors).to include(/disallowed keys: start_in/)
+        end
+      end
+
+      context 'without a start_in: key' do
+        let(:config) { { if: '$THIS || $THAT', when: 'delayed' } }
+
+        it { is_expected.not_to be_valid }
+
+        it 'returns an error about tstart_in being blank' do
+          expect(entry.errors).to include(/start in can't be blank/)
+        end
+      end
+    end
+
+    context 'when specifying unknown policy' do
+      let(:config) { { invalid: :something } }
+
+      it { is_expected.not_to be_valid }
+
+      it 'returns error about invalid key' do
+        expect(entry.errors).to include(/unknown keys: invalid/)
+      end
+    end
+
+    context 'when clause is empty' do
+      let(:config) { {} }
+
+      it { is_expected.not_to be_valid }
+
+      it 'is not a valid configuration' do
+        expect(entry.errors).to include(/can't be blank/)
+      end
+    end
+
+    context 'when policy strategy does not match' do
+      let(:config) { 'string strategy' }
+
+      it { is_expected.not_to be_valid }
+
+      it 'returns information about errors' do
+        expect(entry.errors)
+          .to include(/should be a hash/)
+      end
+    end
+  end
+
+  describe '#value' do
+    subject { entry.value }
+
+    context 'when specifying an if: clause' do
+      let(:config) { { if: '$THIS || $THAT', when: 'manual' } }
+
+      it 'stores the expression as "if"' do
+        expect(subject).to eq(if: '$THIS || $THAT', when: 'manual')
+      end
+    end
+
+    context 'when using a changes: clause' do
+      let(:config) { { changes: %w[app/ lib/ spec/ other/* paths/**/*.rb] } }
+
+      it { is_expected.to eq(config) }
+    end
+
+    context 'when default value has been provided' do
+      let(:config) { { changes: %w[app/**/*.rb] } }
+
+      before do
+        entry.default = { changes: %w[**/*] }
+      end
+
+      it 'does not set a default value' do
+        expect(entry.default).to eq(nil)
+      end
+
+      it 'does not add to provided configuration' do
+        expect(entry.value).to eq(config)
+      end
+    end
+  end
+
+  describe '.default' do
+    it 'does not have default value' do
+      expect(described_class.default).to be_nil
+    end
+  end
+end
diff --git a/spec/lib/gitlab/ci/config/entry/rules_spec.rb b/spec/lib/gitlab/ci/config/entry/rules_spec.rb
new file mode 100644
index 00000000000..291e7373daf
--- /dev/null
+++ b/spec/lib/gitlab/ci/config/entry/rules_spec.rb
@@ -0,0 +1,135 @@
+require 'fast_spec_helper'
+require 'support/helpers/stub_feature_flags'
+require_dependency 'active_model'
+
+describe Gitlab::Ci::Config::Entry::Rules do
+  let(:entry) { described_class.new(config) }
+
+  describe '.new' do
+    subject { entry }
+
+    context 'with a list of rule rule' do
+      let(:config) do
+        [{ if: '$THIS == "that"', when: 'never' }]
+      end
+
+      it { is_expected.to be_a(described_class) }
+      it { is_expected.to be_valid }
+
+      context 'after #compose!' do
+        before do
+          subject.compose!
+        end
+
+        it { is_expected.to be_valid }
+      end
+    end
+
+    context 'with a list of two rules' do
+      let(:config) do
+        [
+          { if: '$THIS == "that"', when: 'always' },
+          { if: '$SKIP',           when: 'never' }
+        ]
+      end
+
+      it { is_expected.to be_a(described_class) }
+      it { is_expected.to be_valid }
+
+      context 'after #compose!' do
+        before do
+          subject.compose!
+        end
+
+        it { is_expected.to be_valid }
+      end
+    end
+
+    context 'with a single rule object' do
+      let(:config) do
+        { if: '$SKIP', when: 'never' }
+      end
+
+      it { is_expected.not_to be_valid }
+    end
+
+    context 'with an invalid boolean when:' do
+      let(:config) do
+        [{ if: '$THIS == "that"', when: false }]
+      end
+
+      it { is_expected.to be_a(described_class) }
+      it { is_expected.to be_valid }
+
+      context 'after #compose!' do
+        before do
+          subject.compose!
+        end
+
+        it { is_expected.not_to be_valid }
+
+        it 'returns an error about invalid when:' do
+          expect(subject.errors).to include(/when unknown value: false/)
+        end
+      end
+    end
+
+    context 'with an invalid string when:' do
+      let(:config) do
+        [{ if: '$THIS == "that"', when: 'explode' }]
+      end
+
+      it { is_expected.to be_a(described_class) }
+      it { is_expected.to be_valid }
+
+      context 'after #compose!' do
+        before do
+          subject.compose!
+        end
+
+        it { is_expected.not_to be_valid }
+
+        it 'returns an error about invalid when:' do
+          expect(subject.errors).to include(/when unknown value: explode/)
+        end
+      end
+    end
+  end
+
+  describe '#value' do
+    subject { entry.value }
+
+    context 'with a list of rule rule' do
+      let(:config) do
+        [{ if: '$THIS == "that"', when: 'never' }]
+      end
+
+      it { is_expected.to eq(config) }
+    end
+
+    context 'with a list of two rules' do
+      let(:config) do
+        [
+          { if: '$THIS == "that"', when: 'always' },
+          { if: '$SKIP',           when: 'never' }
+        ]
+      end
+
+      it { is_expected.to eq(config) }
+    end
+
+    context 'with a single rule object' do
+      let(:config) do
+        { if: '$SKIP', when: 'never' }
+      end
+
+      it { is_expected.to eq(config) }
+    end
+  end
+
+  describe '.default' do
+    it 'does not have default policy' do
+      expect(described_class.default).to be_nil
+    end
+  end
+end
diff --git a/spec/lib/gitlab/ci/pipeline/seed/build_spec.rb b/spec/lib/gitlab/ci/pipeline/seed/build_spec.rb
index 1a9350d68bd..89431b80be3 100644
--- a/spec/lib/gitlab/ci/pipeline/seed/build_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/seed/build_spec.rb
@@ -15,6 +15,60 @@ describe Gitlab::Ci::Pipeline::Seed::Build do
 
     it { is_expected.to be_a(Hash) }
     it { is_expected.to include(:name, :project, :ref) }
+
+    context 'with job:when' do
+      let(:attributes) { { name: 'rspec', ref: 'master', when: 'on_failure' } }
+
+      it { is_expected.to include(when: 'on_failure') }
+    end
+
+    context 'with job:when:delayed' do
+      let(:attributes) { { name: 'rspec', ref: 'master', when: 'delayed', start_in: '3 hours' } }
+
+      it { is_expected.to include(when: 'delayed', start_in: '3 hours') }
+    end
+
+    context 'with job:rules:[when:]' do
+      context 'is matched' do
+        let(:attributes) { { name: 'rspec', ref: 'master', rules: [{ if: '$VAR == null', when: 'always' }] } }
+
+        it { is_expected.to include(when: 'always') }
+      end
+
+      context 'is not matched' do
+        let(:attributes) { { name: 'rspec', ref: 'master', rules: [{ if: '$VAR != null', when: 'always' }] } }
+
+        it { is_expected.to include(when: 'never') }
+      end
+    end
+
+    context 'with job:rules:[when:delayed]' do
+      context 'is matched' do
+        let(:attributes) { { name: 'rspec', ref: 'master', rules: [{ if: '$VAR == null', when: 'delayed', start_in: '3 hours' }] } }
+
+        it { is_expected.to include(when: 'delayed', start_in: '3 hours') }
+      end
+
+      context 'is not matched' do
+        let(:attributes) { { name: 'rspec', ref: 'master', rules: [{ if: '$VAR != null', when: 'delayed', start_in: '3 hours' }] } }
+
+        it { is_expected.to include(when: 'never') }
+      end
+    end
+
+    context 'with job:rules but no explicit when:' do
+      context 'is matched' do
+        let(:attributes) { { name: 'rspec', ref: 'master', rules: [{ if: '$VAR == null' }] } }
+
+        it { is_expected.to include(when: 'on_success') }
+      end
+
+      context 'is not matched' do
+        let(:attributes) { { name: 'rspec', ref: 'master', rules: [{ if: '$VAR != null' }] } }
+
+        it { is_expected.to include(when: 'never') }
+      end
+    end
   end
 
   describe '#bridge?' do
@@ -366,9 +420,25 @@ describe Gitlab::Ci::Pipeline::Seed::Build do
 
         it { is_expected.not_to be_included }
       end
+
+      context 'when using both only and except policies' do
+        let(:attributes) do
+          {
+            name: 'rspec',
+            only: {
+              refs: ["branches@#{pipeline.project_full_path}"]
+            },
+            except: {
+              refs: ["branches@#{pipeline.project_full_path}"]
+            }
+          }
+        end
+
+        it { is_expected.not_to be_included }
+      end
     end
 
-    context 'when repository path does not matches' do
+    context 'when repository path does not match' do
       context 'when using only' do
         let(:attributes) do
           { name: 'rspec', only: { refs: %w[branches@fork] } }
@@ -397,6 +467,215 @@ describe Gitlab::Ci::Pipeline::Seed::Build do
         it { is_expected.not_to be_included }
       end
     end
+
+    context 'using rules:' do
+      using RSpec::Parameterized
+
+      let(:attributes) { { name: 'rspec', rules: rule_set } }
+
+      context 'with a matching if: rule' do
+        context 'with an explicit `when: never`' do
+          where(:rule_set) do
+            [
+              [[{ if: '$VARIABLE == null',              when: 'never' }]],
+              [[{ if: '$VARIABLE == null',              when: 'never' }, { if: '$VARIABLE == null', when: 'always' }]],
+              [[{ if: '$VARIABLE != "the wrong value"', when: 'never' }, { if: '$VARIABLE == null', when: 'always' }]]
+            ]
+          end
+
+          with_them do
+            it { is_expected.not_to be_included }
+
+            it 'correctly populates when:' do
+              expect(seed_build.attributes).to include(when: 'never')
+            end
+          end
+        end
+
+        context 'with an explicit `when: always`' do
+          where(:rule_set) do
+            [
+              [[{ if: '$VARIABLE == null',              when: 'always' }]],
+              [[{ if: '$VARIABLE == null',              when: 'always' }, { if: '$VARIABLE == null', when: 'never' }]],
+              [[{ if: '$VARIABLE != "the wrong value"', when: 'always' }, { if: '$VARIABLE == null', when: 'never' }]]
+            ]
+          end
+
+          with_them do
+            it { is_expected.to be_included }
+
+            it 'correctly populates when:' do
+              expect(seed_build.attributes).to include(when: 'always')
+            end
+          end
+        end
+
+        context 'with an explicit `when: on_failure`' do
+          where(:rule_set) do
+            [
+              [[{ if: '$CI_JOB_NAME == "rspec" && $VAR == null', when: 'on_failure' }]],
+              [[{ if: '$VARIABLE != null',              when: 'delayed', start_in: '1 day' }, { if: '$CI_JOB_NAME   == "rspec"', when: 'on_failure' }]],
+              [[{ if: '$VARIABLE == "the wrong value"', when: 'delayed', start_in: '1 day' }, { if: '$CI_BUILD_NAME == "rspec"', when: 'on_failure' }]]
+            ]
+          end
+
+          with_them do
+            it { is_expected.to be_included }
+
+            it 'correctly populates when:' do
+              expect(seed_build.attributes).to include(when: 'on_failure')
+            end
+          end
+        end
+
+        context 'with an explicit `when: delayed`' do
+          where(:rule_set) do
+            [
+              [[{ if: '$VARIABLE == null',              when: 'delayed', start_in: '1 day' }]],
+              [[{ if: '$VARIABLE == null',              when: 'delayed', start_in: '1 day' }, { if: '$VARIABLE == null', when: 'never' }]],
+              [[{ if: '$VARIABLE != "the wrong value"', when: 'delayed', start_in: '1 day' }, { if: '$VARIABLE == null', when: 'never' }]]
+            ]
+          end
+
+          with_them do
+            it { is_expected.to be_included }
+
+            it 'correctly populates when:' do
+              expect(seed_build.attributes).to include(when: 'delayed', start_in: '1 day')
+            end
+          end
+        end
+
+        context 'without an explicit when: value' do
+          where(:rule_set) do
+            [
+              [[{ if: '$VARIABLE == null'              }]],
+              [[{ if: '$VARIABLE == null'              }, { if: '$VARIABLE == null' }]],
+              [[{ if: '$VARIABLE != "the wrong value"' }, { if: '$VARIABLE == null' }]]
+            ]
+          end
+
+          with_them do
+            it { is_expected.to be_included }
+
+            it 'correctly populates when:' do
+              expect(seed_build.attributes).to include(when: 'on_success')
+            end
+          end
+        end
+      end
+
+      context 'with a matching changes: rule' do
+        let(:pipeline) do
+          create(:ci_pipeline, project: project).tap do |pipeline|
+            stub_pipeline_modified_paths(pipeline, %w[app/models/ci/pipeline.rb spec/models/ci/pipeline_spec.rb .gitlab-ci.yml])
+          end
+        end
+
+        context 'with an explicit `when: never`' do
+          where(:rule_set) do
+            [
+              [[{ changes: %w[*/**/*.rb],                 when: 'never' }, { changes: %w[*/**/*.rb],                 when: 'always' }]],
+              [[{ changes: %w[app/models/ci/pipeline.rb], when: 'never' }, { changes: %w[app/models/ci/pipeline.rb], when: 'always' }]],
+              [[{ changes: %w[spec/**/*.rb],              when: 'never' }, { changes: %w[spec/**/*.rb],              when: 'always' }]],
+              [[{ changes: %w[*.yml],                     when: 'never' }, { changes: %w[*.yml],                     when: 'always' }]],
+              [[{ changes: %w[.*.yml],                    when: 'never' }, { changes: %w[.*.yml],                    when: 'always' }]],
+              [[{ changes: %w[**/*],                      when: 'never' }, { changes: %w[**/*],                      when: 'always' }]],
+              [[{ changes: %w[*/**/*.rb *.yml],           when: 'never' }, { changes: %w[*/**/*.rb *.yml],           when: 'always' }]],
+              [[{ changes: %w[.*.yml **/*],               when: 'never' }, { changes: %w[.*.yml **/*],               when: 'always' }]]
+            ]
+          end
+
+          with_them do
+            it { is_expected.not_to be_included }
+
+            it 'correctly populates when:' do
+              expect(seed_build.attributes).to include(when: 'never')
+            end
+          end
+        end
+
+        context 'with an explicit `when: always`' do
+          where(:rule_set) do
+            [
+              [[{ changes: %w[*/**/*.rb],                 when: 'always' }, { changes: %w[*/**/*.rb],                 when: 'never' }]],
+              [[{ changes: %w[app/models/ci/pipeline.rb], when: 'always' }, { changes: %w[app/models/ci/pipeline.rb], when: 'never' }]],
+              [[{ changes: %w[spec/**/*.rb],              when: 'always' }, { changes: %w[spec/**/*.rb],              when: 'never' }]],
+              [[{ changes: %w[*.yml],                     when: 'always' }, { changes: %w[*.yml],                     when: 'never' }]],
+              [[{ changes: %w[.*.yml],                    when: 'always' }, { changes: %w[.*.yml],                    when: 'never' }]],
+              [[{ changes: %w[**/*],                      when: 'always' }, { changes: %w[**/*],                      when: 'never' }]],
+              [[{ changes: %w[*/**/*.rb *.yml],           when: 'always' }, { changes: %w[*/**/*.rb *.yml],           when: 'never' }]],
+              [[{ changes: %w[.*.yml **/*],               when: 'always' }, { changes: %w[.*.yml **/*],               when: 'never' }]]
+            ]
+          end
+
+          with_them do
+            it { is_expected.to be_included }
+
+            it 'correctly populates when:' do
+              expect(seed_build.attributes).to include(when: 'always')
+            end
+          end
+        end
+
+        context 'without an explicit when: value' do
+          where(:rule_set) do
+            [
+              [[{ changes: %w[*/**/*.rb]                 }]],
+              [[{ changes: %w[app/models/ci/pipeline.rb] }]],
+              [[{ changes: %w[spec/**/*.rb]              }]],
+              [[{ changes: %w[*.yml]                     }]],
+              [[{ changes: %w[.*.yml]                    }]],
+              [[{ changes: %w[**/*]                      }]],
+              [[{ changes: %w[*/**/*.rb *.yml]           }]],
+              [[{ changes: %w[.*.yml **/*]               }]]
+            ]
+          end
+
+          with_them do
+            it { is_expected.to be_included }
+
+            it 'correctly populates when:' do
+              expect(seed_build.attributes).to include(when: 'on_success')
+            end
+          end
+        end
+      end
+
+      context 'with no matching rule' do
+        where(:rule_set) do
+          [
+            [[{ if: '$VARIABLE != null',              when: 'never'  }]],
+            [[{ if: '$VARIABLE != null',              when: 'never'  }, { if: '$VARIABLE != null', when: 'always' }]],
+            [[{ if: '$VARIABLE == "the wrong value"', when: 'never'  }, { if: '$VARIABLE != null', when: 'always' }]],
+            [[{ if: '$VARIABLE != null',              when: 'always' }]],
+            [[{ if: '$VARIABLE != null',              when: 'always' }, { if: '$VARIABLE != null', when: 'never' }]],
+            [[{ if: '$VARIABLE == "the wrong value"', when: 'always' }, { if: '$VARIABLE != null', when: 'never' }]],
+            [[{ if: '$VARIABLE != null'                              }]],
+            [[{ if: '$VARIABLE != null'                              }, { if: '$VARIABLE != null' }]],
+            [[{ if: '$VARIABLE == "the wrong value"'                 }, { if: '$VARIABLE != null' }]]
+          ]
+        end
+
+        with_them do
+          it { is_expected.not_to be_included }
+
+          it 'correctly populates when:' do
+            expect(seed_build.attributes).to include(when: 'never')
+          end
+        end
+      end
+
+      context 'with no rules' do
+        let(:rule_set) { [] }
+
+        it { is_expected.not_to be_included }
+
+        it 'correctly populates when:' do
+          expect(seed_build.attributes).to include(when: 'never')
+        end
+      end
+    end
   end
 
   describe 'applying needs: dependency' do
@@ -476,4 +755,10 @@ describe Gitlab::Ci::Pipeline::Seed::Build do
       end
     end
   end
+
+  describe '#scoped_variables_hash' do
+    subject { seed_build.scoped_variables_hash }
+
+    it { is_expected.to eq(seed_build.to_resource.scoped_variables_hash) }
+  end
 end
diff --git a/spec/lib/gitlab/ci/yaml_processor_spec.rb b/spec/lib/gitlab/ci/yaml_processor_spec.rb
index d5567b4f166..91c559dcd9b 100644
--- a/spec/lib/gitlab/ci/yaml_processor_spec.rb
+++ b/spec/lib/gitlab/ci/yaml_processor_spec.rb
@@ -125,9 +125,11 @@ module Gitlab
         describe 'delayed job entry' do
           context 'when delayed is defined' do
             let(:config) do
-              YAML.dump(rspec: { script: 'rollout 10%',
-                                 when: 'delayed',
-                                 start_in: '1 day' })
+              YAML.dump(rspec: {
+                script:   'rollout 10%',
+                when:     'delayed',
+                start_in: '1 day'
+              })
             end
 
             it 'has the attributes' do
@@ -726,12 +728,12 @@ module Gitlab
         end
       end
 
-      describe "When" do
-        %w(on_success on_failure always).each do |when_state|
-          it "returns #{when_state} when defined" do
+      describe 'when:' do
+        (Gitlab::Ci::Config::Entry::Job::ALLOWED_WHEN - %w[delayed]).each do |when_state|
+          it "#{when_state} creates one build and sets when:" do
             config = YAML.dump({
-                                 rspec: { script: "rspec", when: when_state }
-                               })
+              rspec: { script: 'rspec', when: when_state }
+            })
 
             config_processor = Gitlab::Ci::YamlProcessor.new(config)
             builds = config_processor.stage_builds_attributes("test")
@@ -740,6 +742,35 @@ module Gitlab
             expect(builds.first[:when]).to eq(when_state)
           end
         end
+
+        context 'delayed' do
+          context 'with start_in' do
+            it 'creates one build and sets when:' do
+              config = YAML.dump({
+                rspec: { script: 'rspec', when: 'delayed', start_in: '1 hour' }
+              })
+
+              config_processor = Gitlab::Ci::YamlProcessor.new(config)
+              builds = config_processor.stage_builds_attributes("test")
+
+              expect(builds.size).to eq(1)
+              expect(builds.first[:when]).to eq('delayed')
+              expect(builds.first[:options][:start_in]).to eq('1 hour')
+            end
+          end
+
+          context 'without start_in' do
+            it 'raises an error' do
+              config = YAML.dump({
+                rspec: { script: 'rspec', when: 'delayed' }
+              })
+
+              expect do
+                Gitlab::Ci::YamlProcessor.new(config)
+              end.to raise_error(YamlProcessor::ValidationError, /start in should be a duration/)
+            end
+          end
+        end
       end
 
       describe 'Parallel' do
@@ -1132,7 +1163,7 @@ module Gitlab
           it { expect { subject }.not_to raise_error }
         end
 
-        context 'needs to builds' do
+        context 'needs two builds' do
           let(:needs) { %w(build1 build2) }
 
           it "does create jobs with valid specification" do
@@ -1169,7 +1200,7 @@ module Gitlab
           end
         end
 
-        context 'needs to builds defined as symbols' do
+        context 'needs two builds defined as symbols' do
           let(:needs) { [:build1, :build2] }
 
           it { expect { subject }.not_to raise_error }
@@ -1195,6 +1226,67 @@ module Gitlab
         end
       end
 
+      describe 'rules' do
+        subject { Gitlab::Ci::YamlProcessor.new(YAML.dump(config)) }
+
+        let(:config) do
+          {
+            var_default:     { stage: 'build',  script: 'test', rules: [{ if: '$VAR == null' }] },
+            var_when:        { stage: 'build',  script: 'test', rules: [{ if: '$VAR == null', when: 'always' }] },
+            var_and_changes: { stage: 'build',  script: 'test', rules: [{ if: '$VAR == null', changes: %w[README], when: 'always' }] },
+            changes_not_var: { stage: 'test',   script: 'test', rules: [{ if: '$VAR != null', changes: %w[README] }] },
+            var_not_changes: { stage: 'test',   script: 'test', rules: [{ if: '$VAR == null', changes: %w[other/file.rb], when: 'always' }] },
+            nothing:         { stage: 'test',   script: 'test', rules: [{ when: 'manual' }] },
+            var_never:       { stage: 'deploy', script: 'test', rules: [{ if: '$VAR == null', when: 'never' }] },
+            var_delayed:     { stage: 'deploy', script: 'test', rules: [{ if: '$VAR == null', when: 'delayed', start_in: '3 hours' }] },
+            two_rules:       { stage: 'deploy', script: 'test', rules: [{ if: '$VAR == null', when: 'on_success' }, { changes: %w[README], when: 'manual' }] }
+          }
+        end
+
+        it 'raises no exceptions' do
+          expect { subject }.not_to raise_error
+        end
+
+        it 'returns all jobs regardless of their inclusion' do
+          expect(subject.builds.count).to eq(config.keys.count)
+        end
+
+        context 'used with job-level when' do
+          let(:config) do
+            {
+              var_default: {
+                stage: 'build',
+                script: 'test',
+                when: 'always',
+                rules: [{ if: '$VAR == null' }]
+              }
+            }
+          end
+
+          it 'raises a ValidationError' do
+            expect { subject }.to raise_error(YamlProcessor::ValidationError, /may not be used with `rules`: when/)
+          end
+        end
+
+        context 'used with job-level when:delayed' do
+          let(:config) do
+            {
+              var_default: {
+                stage: 'build',
+                script: 'test',
+                when: 'delayed',
+                start_in: '10 minutes',
+                rules: [{ if: '$VAR == null' }]
+              }
+            }
+          end
+
+          it 'raises a ValidationError' do
+            expect { subject }.to raise_error(YamlProcessor::ValidationError, /may not be used with `rules`: when, start_in/)
+          end
+        end
+      end
+
       describe "Hidden jobs" do
         let(:config_processor) { Gitlab::Ci::YamlProcessor.new(config) }
         subject { config_processor.stage_builds_attributes("test") }
@@ -1513,7 +1605,7 @@ module Gitlab
           config = YAML.dump({ rspec: { script: "test", when: 1 } })
           expect do
             Gitlab::Ci::YamlProcessor.new(config)
-          end.to raise_error(Gitlab::Ci::YamlProcessor::ValidationError, "jobs:rspec when should be on_success, on_failure, always, manual or delayed")
+          end.to raise_error(Gitlab::Ci::YamlProcessor::ValidationError, "jobs:rspec when should be one of: #{Gitlab::Ci::Config::Entry::Job::ALLOWED_WHEN.join(', ')}")
         end
 
         it "returns errors if job artifacts:name is not an a string" do
diff --git a/spec/support/helpers/stub_gitlab_calls.rb b/spec/support/helpers/stub_gitlab_calls.rb
index badea94352a..7d10cffe920 100644
--- a/spec/support/helpers/stub_gitlab_calls.rb
+++ b/spec/support/helpers/stub_gitlab_calls.rb
@@ -22,6 +22,10 @@ module StubGitlabCalls
     allow_any_instance_of(Ci::Pipeline).to receive(:ci_yaml_file) { ci_yaml }
   end
 
+  def stub_pipeline_modified_paths(pipeline, modified_paths)
+    allow(pipeline).to receive(:modified_paths).and_return(modified_paths)
+  end
+
   def stub_repository_ci_yaml_file(sha:, path: '.gitlab-ci.yml')
     allow_any_instance_of(Repository)
       .to receive(:gitlab_ci_yml_for).with(sha, path)
-- 
cgit v1.2.1


From fd589be32f02c160812bbce0f5fb2178fb7142d3 Mon Sep 17 00:00:00 2001
From: Paul Slaughter <pslaughter@gitlab.com>
Date: Tue, 20 Aug 2019 15:14:39 -0500
Subject: Add CE changelog for assignee style change

---
 changelogs/unreleased/ce-22058-improve-ux-multi-assignees-in-mr.yml | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 changelogs/unreleased/ce-22058-improve-ux-multi-assignees-in-mr.yml

diff --git a/changelogs/unreleased/ce-22058-improve-ux-multi-assignees-in-mr.yml b/changelogs/unreleased/ce-22058-improve-ux-multi-assignees-in-mr.yml
new file mode 100644
index 00000000000..e7453a2b9bd
--- /dev/null
+++ b/changelogs/unreleased/ce-22058-improve-ux-multi-assignees-in-mr.yml
@@ -0,0 +1,5 @@
+---
+title: Update assignee (cannot merge) style
+merge_request: 31545
+author:
+type: changed
-- 
cgit v1.2.1


From f1f34baf6f4e0866feb3f4c7523e3dccf5784b0b Mon Sep 17 00:00:00 2001
From: Samantha Ming <sming@gitlab.com>
Date: Thu, 25 Jul 2019 19:30:50 -0700
Subject: Improve UX multi assigness in MR

Add merge warning on avatar in:
- open view assigness
- collapsed view assigness
- dropdown (search) view assigness

Add can_merge option to MR sidebar entity
---
 .../components/assignees/assignee_avatar.vue       |  48 +++++
 .../components/assignees/assignee_avatar_link.vue  |  74 ++++++++
 .../sidebar/components/assignees/assignees.vue     | 210 ++-------------------
 .../components/assignees/collapsed_assignee.vue    |  27 +++
 .../assignees/collapsed_assignee_list.vue          | 121 ++++++++++++
 .../assignees/uncollapsed_assignee_list.vue        |  96 ++++++++++
 app/assets/javascripts/users_select.js             |  66 +++++--
 app/assets/stylesheets/pages/issuable.scss         |  28 +--
 app/serializers/issuable_sidebar_basic_entity.rb   |   1 +
 app/serializers/merge_request_serializer.rb        |   2 +-
 .../merge_request_sidebar_basic_entity.rb          |   6 +
 .../shared/issuable/_sidebar_assignees.html.haml   |   2 +
 locale/gitlab.pot                                  |  21 ++-
 .../assignees/assignee_avatar_link_spec.js         |  84 +++++++++
 .../components/assignees/assignee_avatar_spec.js   |  78 ++++++++
 .../assignees/collapsed_assignee_list_spec.js      | 201 ++++++++++++++++++++
 .../assignees/collapsed_assignee_spec.js           |  34 ++++
 .../assignees/uncollapsed_assignee_list_spec.js    | 135 +++++++++++++
 spec/frontend/sidebar/user_data_mock.js            |   9 +
 spec/javascripts/sidebar/assignees_spec.js         | 208 +++-----------------
 spec/javascripts/sidebar/mock_data.js              |  10 +
 .../merge_request_sidebar_basic_entity_spec.rb     |  22 +++
 22 files changed, 1077 insertions(+), 406 deletions(-)
 create mode 100644 app/assets/javascripts/sidebar/components/assignees/assignee_avatar.vue
 create mode 100644 app/assets/javascripts/sidebar/components/assignees/assignee_avatar_link.vue
 create mode 100644 app/assets/javascripts/sidebar/components/assignees/collapsed_assignee.vue
 create mode 100644 app/assets/javascripts/sidebar/components/assignees/collapsed_assignee_list.vue
 create mode 100644 app/assets/javascripts/sidebar/components/assignees/uncollapsed_assignee_list.vue
 create mode 100644 app/serializers/merge_request_sidebar_basic_entity.rb
 create mode 100644 spec/frontend/sidebar/components/assignees/assignee_avatar_link_spec.js
 create mode 100644 spec/frontend/sidebar/components/assignees/assignee_avatar_spec.js
 create mode 100644 spec/frontend/sidebar/components/assignees/collapsed_assignee_list_spec.js
 create mode 100644 spec/frontend/sidebar/components/assignees/collapsed_assignee_spec.js
 create mode 100644 spec/frontend/sidebar/components/assignees/uncollapsed_assignee_list_spec.js
 create mode 100644 spec/frontend/sidebar/user_data_mock.js
 create mode 100644 spec/serializers/merge_request_sidebar_basic_entity_spec.rb

diff --git a/app/assets/javascripts/sidebar/components/assignees/assignee_avatar.vue b/app/assets/javascripts/sidebar/components/assignees/assignee_avatar.vue
new file mode 100644
index 00000000000..0bb4f757de8
--- /dev/null
+++ b/app/assets/javascripts/sidebar/components/assignees/assignee_avatar.vue
@@ -0,0 +1,48 @@
+<script>
+import { __, sprintf } from '~/locale';
+
+export default {
+  props: {
+    user: {
+      type: Object,
+      required: true,
+    },
+    imgSize: {
+      type: Number,
+      required: true,
+    },
+    issuableType: {
+      type: String,
+      require: true,
+      default: 'issue',
+    },
+  },
+  computed: {
+    assigneeAlt() {
+      return sprintf(__("%{userName}'s avatar"), { userName: this.user.name });
+    },
+    avatarUrl() {
+      return this.user.avatar || this.user.avatar_url || gon.default_avatar_url;
+    },
+    isMergeRequest() {
+      return this.issuableType === 'merge_request';
+    },
+    hasMergeIcon() {
+      return this.isMergeRequest && !this.user.can_merge;
+    },
+  },
+};
+</script>
+
+<template>
+  <span class="position-relative">
+    <img
+      :alt="assigneeAlt"
+      :src="avatarUrl"
+      :width="imgSize"
+      :class="`s${imgSize}`"
+      class="avatar avatar-inline m-0"
+    />
+    <i v-if="hasMergeIcon" aria-hidden="true" class="fa fa-exclamation-triangle merge-icon"></i>
+  </span>
+</template>
diff --git a/app/assets/javascripts/sidebar/components/assignees/assignee_avatar_link.vue b/app/assets/javascripts/sidebar/components/assignees/assignee_avatar_link.vue
new file mode 100644
index 00000000000..6563d1d3410
--- /dev/null
+++ b/app/assets/javascripts/sidebar/components/assignees/assignee_avatar_link.vue
@@ -0,0 +1,74 @@
+<script>
+import { __, sprintf } from '~/locale';
+import { GlTooltipDirective, GlLink } from '@gitlab/ui';
+import { joinPaths } from '~/lib/utils/url_utility';
+import AssigneeAvatar from './assignee_avatar.vue';
+
+export default {
+  components: {
+    AssigneeAvatar,
+    GlLink,
+  },
+  directives: {
+    GlTooltip: GlTooltipDirective,
+  },
+  props: {
+    user: {
+      type: Object,
+      required: true,
+    },
+    rootPath: {
+      type: String,
+      required: true,
+    },
+    tooltipPlacement: {
+      type: String,
+      default: 'bottom',
+      required: false,
+    },
+    tooltipHasName: {
+      type: Boolean,
+      default: true,
+      required: false,
+    },
+    issuableType: {
+      type: String,
+      default: 'issue',
+      required: false,
+    },
+  },
+  computed: {
+    cannotMerge() {
+      return this.issuableType === 'merge_request' && !this.user.can_merge;
+    },
+    tooltipTitle() {
+      if (this.cannotMerge && this.tooltipHasName) {
+        return sprintf(__('%{userName} (cannot merge)'), { userName: this.user.name });
+      } else if (this.cannotMerge) {
+        return __('Cannot merge');
+      } else if (this.tooltipHasName) {
+        return this.user.name;
+      }
+
+      return '';
+    },
+    tooltipOption() {
+      return {
+        container: 'body',
+        placement: this.tooltipPlacement,
+        boundary: 'viewport',
+      };
+    },
+    assigneeUrl() {
+      return joinPaths(`${this.rootPath}`, `${this.user.username}`);
+    },
+  },
+};
+</script>
+
+<template>
+  <gl-link v-gl-tooltip="tooltipOption" :href="assigneeUrl" :title="tooltipTitle" class="d-flex">
+    <assignee-avatar :user="user" :img-size="32" :issuable-type="issuableType" />
+    <slot :user="user"></slot>
+  </gl-link>
+</template>
diff --git a/app/assets/javascripts/sidebar/components/assignees/assignees.vue b/app/assets/javascripts/sidebar/components/assignees/assignees.vue
index 631e2e28d4d..ca4090eee96 100644
--- a/app/assets/javascripts/sidebar/components/assignees/assignees.vue
+++ b/app/assets/javascripts/sidebar/components/assignees/assignees.vue
@@ -1,13 +1,14 @@
 <script>
-import { __, sprintf } from '~/locale';
-import tooltip from '~/vue_shared/directives/tooltip';
+import CollapsedAssigneeList from '../assignees/collapsed_assignee_list.vue';
+import UncollapsedAssigneeList from '../assignees/uncollapsed_assignee_list.vue';
 
 export default {
   // name: 'Assignees' is a false positive: https://gitlab.com/gitlab-org/frontend/eslint-plugin-i18n/issues/26#possible-false-positives
   // eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings
   name: 'Assignees',
-  directives: {
-    tooltip,
+  components: {
+    CollapsedAssigneeList,
+    UncollapsedAssigneeList,
   },
   props: {
     rootPath: {
@@ -28,167 +29,30 @@ export default {
       default: 'issue',
     },
   },
-  data() {
-    return {
-      defaultRenderCount: 5,
-      defaultMaxCounter: 99,
-      showLess: true,
-    };
-  },
   computed: {
-    firstUser() {
-      return this.users[0];
-    },
-    hasMoreThanTwoAssignees() {
-      return this.users.length > 2;
-    },
-    hasMoreThanOneAssignee() {
-      return this.users.length > 1;
-    },
-    hasAssignees() {
-      return this.users.length > 0;
-    },
     hasNoUsers() {
       return !this.users.length;
     },
-    hasOneUser() {
-      return this.users.length === 1;
-    },
-    renderShowMoreSection() {
-      return this.users.length > this.defaultRenderCount;
-    },
-    numberOfHiddenAssignees() {
-      return this.users.length - this.defaultRenderCount;
-    },
-    isHiddenAssignees() {
-      return this.numberOfHiddenAssignees > 0;
-    },
-    hiddenAssigneesLabel() {
-      const { numberOfHiddenAssignees } = this;
-      return sprintf(__('+ %{numberOfHiddenAssignees} more'), { numberOfHiddenAssignees });
-    },
-    collapsedTooltipTitle() {
-      const maxRender = Math.min(this.defaultRenderCount, this.users.length);
-      const renderUsers = this.users.slice(0, maxRender);
-      const names = renderUsers.map(u => u.name);
-
-      if (this.users.length > maxRender) {
-        names.push(`+ ${this.users.length - maxRender} more`);
-      }
-
-      if (!this.users.length) {
-        const emptyTooltipLabel = __('Assignee(s)');
-        names.push(emptyTooltipLabel);
-      }
-
-      return names.join(', ');
-    },
-    sidebarAvatarCounter() {
-      let counter = `+${this.users.length - 1}`;
-
-      if (this.users.length > this.defaultMaxCounter) {
-        counter = `${this.defaultMaxCounter}+`;
-      }
+    sortedAssigness() {
+      const canMergeUsers = this.users.filter(user => user.can_merge);
+      const canNotMergeUsers = this.users.filter(user => !user.can_merge);
 
-      return counter;
-    },
-    mergeNotAllowedTooltipMessage() {
-      const assigneesCount = this.users.length;
-
-      if (this.issuableType !== 'merge_request' || assigneesCount === 0) {
-        return null;
-      }
-
-      const cannotMergeCount = this.users.filter(u => u.can_merge === false).length;
-      const canMergeCount = assigneesCount - cannotMergeCount;
-
-      if (canMergeCount === assigneesCount) {
-        // Everyone can merge
-        return null;
-      } else if (cannotMergeCount === assigneesCount && assigneesCount > 1) {
-        return __('No one can merge');
-      } else if (assigneesCount === 1) {
-        return __('Cannot merge');
-      }
-
-      return sprintf(__('%{canMergeCount}/%{assigneesCount} can merge'), {
-        canMergeCount,
-        assigneesCount,
-      });
+      return [...canMergeUsers, ...canNotMergeUsers];
     },
   },
   methods: {
     assignSelf() {
       this.$emit('assign-self');
     },
-    toggleShowLess() {
-      this.showLess = !this.showLess;
-    },
-    renderAssignee(index) {
-      return !this.showLess || (index < this.defaultRenderCount && this.showLess);
-    },
-    avatarUrl(user) {
-      return user.avatar || user.avatar_url || gon.default_avatar_url;
-    },
-    assigneeUrl(user) {
-      return `${this.rootPath}${user.username}`;
-    },
-    assigneeAlt(user) {
-      return sprintf(__("%{userName}'s avatar"), { userName: user.name });
-    },
-    assigneeUsername(user) {
-      return `@${user.username}`;
-    },
-    shouldRenderCollapsedAssignee(index) {
-      const firstTwo = this.users.length <= 2 && index <= 2;
-
-      return index === 0 || firstTwo;
-    },
   },
 };
 </script>
 
 <template>
   <div>
-    <div
-      v-tooltip
-      :class="{ 'multiple-users': hasMoreThanOneAssignee }"
-      :title="collapsedTooltipTitle"
-      class="sidebar-collapsed-icon sidebar-collapsed-user"
-      data-container="body"
-      data-placement="left"
-      data-boundary="viewport"
-    >
-      <i v-if="hasNoUsers" :aria-label="__('None')" class="fa fa-user"> </i>
-      <button
-        v-for="(user, index) in users"
-        v-if="shouldRenderCollapsedAssignee(index)"
-        :key="user.id"
-        type="button"
-        class="btn-link"
-      >
-        <img
-          :alt="assigneeAlt(user)"
-          :src="avatarUrl(user)"
-          width="24"
-          class="avatar avatar-inline s24"
-        />
-        <span class="author"> {{ user.name }} </span>
-      </button>
-      <button v-if="hasMoreThanTwoAssignees" class="btn-link" type="button">
-        <span class="avatar-counter sidebar-avatar-counter"> {{ sidebarAvatarCounter }} </span>
-      </button>
-    </div>
+    <collapsed-assignee-list :users="sortedAssigness" :issuable-type="issuableType" />
+
     <div class="value hide-collapsed">
-      <span
-        v-if="mergeNotAllowedTooltipMessage"
-        v-tooltip
-        :title="mergeNotAllowedTooltipMessage"
-        data-placement="left"
-        class="float-right cannot-be-merged"
-      >
-        <i aria-hidden="true" data-hidden="true" class="fa fa-exclamation-triangle"></i>
-      </span>
       <template v-if="hasNoUsers">
         <span class="assign-yourself no-value qa-assign-yourself">
           {{ __('None') }}
@@ -200,51 +64,13 @@ export default {
           </template>
         </span>
       </template>
-      <template v-else-if="hasOneUser">
-        <a :href="assigneeUrl(firstUser)" class="author-link bold">
-          <img
-            :alt="assigneeAlt(firstUser)"
-            :src="avatarUrl(firstUser)"
-            width="32"
-            class="avatar avatar-inline s32"
-          />
-          <span class="author"> {{ firstUser.name }} </span>
-          <span class="username"> {{ assigneeUsername(firstUser) }} </span>
-        </a>
-      </template>
-      <template v-else>
-        <div class="user-list">
-          <div
-            v-for="(user, index) in users"
-            v-if="renderAssignee(index)"
-            :key="user.id"
-            class="user-item"
-          >
-            <a
-              :href="assigneeUrl(user)"
-              :data-title="user.name"
-              class="user-link has-tooltip"
-              data-container="body"
-              data-placement="bottom"
-            >
-              <img
-                :alt="assigneeAlt(user)"
-                :src="avatarUrl(user)"
-                width="32"
-                class="avatar avatar-inline s32"
-              />
-            </a>
-          </div>
-        </div>
-        <div v-if="renderShowMoreSection" class="user-list-more">
-          <button type="button" class="btn-link" @click="toggleShowLess">
-            <template v-if="showLess">
-              {{ hiddenAssigneesLabel }}
-            </template>
-            <template v-else>{{ __('- show less') }}</template>
-          </button>
-        </div>
-      </template>
+
+      <uncollapsed-assignee-list
+        v-else
+        :users="sortedAssigness"
+        :root-path="rootPath"
+        :issuable-type="issuableType"
+      />
     </div>
   </div>
 </template>
diff --git a/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee.vue b/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee.vue
new file mode 100644
index 00000000000..3f3626092a8
--- /dev/null
+++ b/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee.vue
@@ -0,0 +1,27 @@
+<script>
+import AssigneeAvatar from './assignee_avatar.vue';
+
+export default {
+  components: {
+    AssigneeAvatar,
+  },
+  props: {
+    user: {
+      type: Object,
+      required: true,
+    },
+    issuableType: {
+      type: String,
+      require: true,
+      default: 'issue',
+    },
+  },
+};
+</script>
+
+<template>
+  <button type="button" class="btn-link">
+    <assignee-avatar :user="user" :img-size="24" :issuable-type="issuableType" />
+    <span class="author"> {{ user.name }} </span>
+  </button>
+</template>
diff --git a/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee_list.vue b/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee_list.vue
new file mode 100644
index 00000000000..6db198f1c1e
--- /dev/null
+++ b/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee_list.vue
@@ -0,0 +1,121 @@
+<script>
+import { __, sprintf } from '~/locale';
+import { GlTooltipDirective } from '@gitlab/ui';
+import CollapsedAssignee from './collapsed_assignee.vue';
+
+const DEFAULT_MAX_COUNTER = 99;
+const DEFAULT_RENDER_COUNT = 5;
+
+export default {
+  directives: {
+    GlTooltip: GlTooltipDirective,
+  },
+  components: {
+    CollapsedAssignee,
+  },
+  props: {
+    users: {
+      type: Array,
+      required: true,
+    },
+    issuableType: {
+      type: String,
+      require: true,
+      default: 'issue',
+    },
+  },
+  computed: {
+    isMergeRequest() {
+      return this.issuableType === 'merge_request';
+    },
+    hasNoUsers() {
+      return !this.users.length;
+    },
+    hasMoreThanOneAssignee() {
+      return this.users.length > 1;
+    },
+    hasMoreThanTwoAssignees() {
+      return this.users.length > 2;
+    },
+    allAssigneesCanMerge() {
+      return this.users.every(user => user.can_merge);
+    },
+    sidebarAvatarCounter() {
+      if (this.users.length > DEFAULT_MAX_COUNTER) {
+        return `${DEFAULT_MAX_COUNTER}+`;
+      }
+
+      return `+${this.users.length - 1}`;
+    },
+    collapsedUsers() {
+      const collapsedLength = this.hasMoreThanTwoAssignees ? 1 : this.users.length;
+
+      return this.users.slice(0, collapsedLength);
+    },
+    tooltipTitleMergeStatus() {
+      if (!this.isMergeRequest) {
+        return '';
+      }
+
+      const mergeLength = this.users.filter(u => u.can_merge).length;
+
+      if (mergeLength === this.users.length) {
+        return '';
+      } else if (mergeLength > 0) {
+        return sprintf(__('%{mergeLength}/%{usersLength} can merge'), {
+          mergeLength,
+          usersLength: this.users.length,
+        });
+      }
+
+      return this.users.length === 1 ? __('cannot merge') : __('no one can merge');
+    },
+    tooltipTitle() {
+      const maxRender = Math.min(DEFAULT_RENDER_COUNT, this.users.length);
+      const renderUsers = this.users.slice(0, maxRender);
+      const names = renderUsers.map(u => u.name);
+
+      if (!this.users.length) {
+        return __('Assignee(s)');
+      }
+
+      if (this.users.length > names.length) {
+        names.push(sprintf(__('+ %{amount} more'), { amount: this.users.length - names.length }));
+      }
+
+      const text = names.join(', ');
+
+      return this.tooltipTitleMergeStatus ? `${text} (${this.tooltipTitleMergeStatus})` : text;
+    },
+
+    tooltipOptions() {
+      return { container: 'body', placement: 'left', boundary: 'viewport' };
+    },
+  },
+};
+</script>
+
+<template>
+  <div
+    v-gl-tooltip="tooltipOptions"
+    :class="{ 'multiple-users': hasMoreThanOneAssignee }"
+    :title="tooltipTitle"
+    class="sidebar-collapsed-icon sidebar-collapsed-user"
+  >
+    <i v-if="hasNoUsers" :aria-label="__('None')" class="fa fa-user"> </i>
+    <collapsed-assignee
+      v-for="user in collapsedUsers"
+      :key="user.id"
+      :user="user"
+      :issuable-type="issuableType"
+    />
+    <button v-if="hasMoreThanTwoAssignees" class="btn-link" type="button">
+      <span class="avatar-counter sidebar-avatar-counter"> {{ sidebarAvatarCounter }} </span>
+      <i
+        v-if="isMergeRequest && !allAssigneesCanMerge"
+        aria-hidden="true"
+        class="fa fa-exclamation-triangle merge-icon"
+      ></i>
+    </button>
+  </div>
+</template>
diff --git a/app/assets/javascripts/sidebar/components/assignees/uncollapsed_assignee_list.vue b/app/assets/javascripts/sidebar/components/assignees/uncollapsed_assignee_list.vue
new file mode 100644
index 00000000000..e84b323c7bd
--- /dev/null
+++ b/app/assets/javascripts/sidebar/components/assignees/uncollapsed_assignee_list.vue
@@ -0,0 +1,96 @@
+<script>
+import { __, sprintf } from '~/locale';
+import AssigneeAvatarLink from './assignee_avatar_link.vue';
+
+const DEFAULT_RENDER_COUNT = 5;
+
+export default {
+  components: {
+    AssigneeAvatarLink,
+  },
+  props: {
+    users: {
+      type: Array,
+      required: true,
+    },
+    rootPath: {
+      type: String,
+      required: true,
+    },
+    issuableType: {
+      type: String,
+      require: true,
+      default: 'issue',
+    },
+  },
+  data() {
+    return {
+      showLess: true,
+    };
+  },
+  computed: {
+    firstUser() {
+      return this.users[0];
+    },
+    hasOneUser() {
+      return this.users.length === 1;
+    },
+    hiddenAssigneesLabel() {
+      const { numberOfHiddenAssignees } = this;
+      return sprintf(__('+ %{numberOfHiddenAssignees} more'), { numberOfHiddenAssignees });
+    },
+    renderShowMoreSection() {
+      return this.users.length > DEFAULT_RENDER_COUNT;
+    },
+    numberOfHiddenAssignees() {
+      return this.users.length - DEFAULT_RENDER_COUNT;
+    },
+    uncollapsedUsers() {
+      const uncollapsedLength = this.showLess
+        ? Math.min(this.users.length, DEFAULT_RENDER_COUNT)
+        : this.users.length;
+      return this.showLess ? this.users.slice(0, uncollapsedLength) : this.users;
+    },
+    username() {
+      return `@${this.firstUser.username}`;
+    },
+  },
+  methods: {
+    toggleShowLess() {
+      this.showLess = !this.showLess;
+    },
+  },
+};
+</script>
+
+<template>
+  <assignee-avatar-link
+    v-if="hasOneUser"
+    v-slot="{ user }"
+    tooltip-placement="left"
+    :tooltip-has-name="false"
+    :user="firstUser"
+    :root-path="rootPath"
+    :issuable-type="issuableType"
+  >
+    <div class="ml-2">
+      <span class="author"> {{ user.name }} </span>
+      <span class="username"> {{ username }} </span>
+    </div>
+  </assignee-avatar-link>
+  <div v-else>
+    <div class="user-list">
+      <div v-for="user in uncollapsedUsers" :key="user.id" class="user-item">
+        <assignee-avatar-link :user="user" :root-path="rootPath" :issuable-type="issuableType" />
+      </div>
+    </div>
+    <div v-if="renderShowMoreSection" class="user-list-more">
+      <button type="button" class="btn-link" @click="toggleShowLess">
+        <template v-if="showLess">
+          {{ hiddenAssigneesLabel }}
+        </template>
+        <template v-else>{{ __('- show less') }}</template>
+      </button>
+    </div>
+  </div>
+</template>
diff --git a/app/assets/javascripts/users_select.js b/app/assets/javascripts/users_select.js
index 33cedf78331..12c939aa70f 100644
--- a/app/assets/javascripts/users_select.js
+++ b/app/assets/javascripts/users_select.js
@@ -62,6 +62,8 @@ function UsersSelect(currentUser, els, options = {}) {
         options.showCurrentUser = $dropdown.data('currentUser');
         options.todoFilter = $dropdown.data('todoFilter');
         options.todoStateFilter = $dropdown.data('todoStateFilter');
+        options.iid = $dropdown.data('iid');
+        options.issuableType = $dropdown.data('issuableType');
         showNullUser = $dropdown.data('nullUser');
         defaultNullUser = $dropdown.data('nullUserDefault');
         showMenuAbove = $dropdown.data('showMenuAbove');
@@ -239,7 +241,7 @@ function UsersSelect(currentUser, els, options = {}) {
           '<% if( avatar ) { %> <a class="author-link" href="/<%- username %>"> <img width="24" class="avatar avatar-inline s24" alt="" src="<%- avatar %>"> </a> <% } else { %> <i class="fa fa-user"></i> <% } %>',
         );
         assigneeTemplate = _.template(
-          `<% if (username) { %> <a class="author-link bold" href="/<%- username %>"> <% if( avatar ) { %> <img width="32" class="avatar avatar-inline s32" alt="" src="<%- avatar %>"> <% } %> <span class="author"><%- name %></span> <span class="username"> @<%- username %> </span> </a> <% } else { %> <span class="no-value assign-yourself"> 
+          `<% if (username) { %> <a class="author-link bold" href="/<%- username %>"> <% if( avatar ) { %> <img width="32" class="avatar avatar-inline s32" alt="" src="<%- avatar %>"> <% } %> <span class="author"><%- name %></span> <span class="username"> @<%- username %> </span> </a> <% } else { %> <span class="no-value assign-yourself">
           ${sprintf(s__('UsersSelect|No assignee - %{openingTag} assign yourself %{closingTag}'), {
             openingTag: '<a href="#" class="js-assign-yourself">',
             closingTag: '</a>',
@@ -423,6 +425,8 @@ function UsersSelect(currentUser, els, options = {}) {
             const { $el, e, isMarking } = options;
             const user = options.selectedObj;
 
+            $el.tooltip('dispose');
+
             if ($dropdown.hasClass('js-multiselect')) {
               const isActive = $el.hasClass('is-active');
               const previouslySelected = $dropdown
@@ -570,20 +574,11 @@ function UsersSelect(currentUser, els, options = {}) {
                 user.name,
               )}</a></li>`;
             } else {
-              img = "<img src='" + avatar + "' class='avatar avatar-inline' width='32' />";
+              // 0 margin, because it's now handled by a wrapper
+              img = "<img src='" + avatar + "' class='avatar avatar-inline m-0' width='32' />";
             }
 
-            return `
-            <li data-user-id=${user.id}>
-              <a href='#' class='dropdown-menu-user-link ${selected === true ? 'is-active' : ''}'>
-                ${img}
-                <strong class='dropdown-menu-user-full-name'>
-                  ${_.escape(user.name)}
-                </strong>
-                ${username ? `<span class='dropdown-menu-user-username'>${username}</span>` : ''}
-              </a>
-            </li>
-          `;
+            return _this.renderRow(options.issuableType, user, selected, username, img);
           },
         });
       };
@@ -764,6 +759,11 @@ UsersSelect.prototype.users = function(query, options, callback) {
     author_id: options.authorId || null,
     skip_users: options.skipUsers || null,
   };
+
+  if (options.issuableType === 'merge_request') {
+    params.merge_request_iid = options.iid || null;
+  }
+
   return axios.get(url, { params }).then(({ data }) => {
     callback(data);
   });
@@ -776,4 +776,44 @@ UsersSelect.prototype.buildUrl = function(url) {
   return url;
 };
 
+UsersSelect.prototype.renderRow = function(issuableType, user, selected, username, img) {
+  const tooltip = issuableType === 'merge_request' && !user.can_merge ? __('Cannot merge') : '';
+  const tooltipClass = tooltip ? `has-tooltip` : '';
+  const selectedClass = selected === true ? 'is-active' : '';
+  const linkClasses = `${selectedClass} ${tooltipClass}`;
+  const tooltipAttributes = tooltip
+    ? `data-container="body" data-placement="left" data-title="${tooltip}"`
+    : '';
+
+  return `
+    <li data-user-id=${user.id}>
+      <a href="#" class="dropdown-menu-user-link d-flex align-items-center ${linkClasses}" ${tooltipAttributes}>
+        ${this.renderRowAvatar(issuableType, user, img)}
+        <span class="d-flex flex-column overflow-hidden">
+          <strong class="dropdown-menu-user-full-name">
+            ${_.escape(user.name)}
+          </strong>
+          ${username ? `<span class="dropdown-menu-user-username">${username}</span>` : ''}
+        </span>
+      </a>
+    </li>
+  `;
+};
+
+UsersSelect.prototype.renderRowAvatar = function(issuableType, user, img) {
+  if (user.beforeDivider) {
+    return img;
+  }
+
+  const mergeIcon =
+    issuableType === 'merge_request' && !user.can_merge
+      ? '<i class="fa fa-exclamation-triangle merge-icon"></i>'
+      : '';
+
+  return `<span class="position-relative mr-2">
+    ${img}
+    ${mergeIcon}
+  </span>`;
+};
+
 export default UsersSelect;
diff --git a/app/assets/stylesheets/pages/issuable.scss b/app/assets/stylesheets/pages/issuable.scss
index fa52ce6402d..0e844b0e4a5 100644
--- a/app/assets/stylesheets/pages/issuable.scss
+++ b/app/assets/stylesheets/pages/issuable.scss
@@ -126,6 +126,16 @@
   }
 }
 
+.assignee {
+  .merge-icon {
+    color: $orange-500;
+    position: absolute;
+    bottom: 0;
+    right: 0;
+    text-shadow: -1px -1px 0 $white-light, 1px -1px 0 $white-light, -1px 1px 0 $white-light, 1px 1px 0 $white-light;
+  }
+}
+
 .right-sidebar {
   position: fixed;
   top: $header-height;
@@ -202,7 +212,6 @@
     &.assignee {
       .author-link {
         display: block;
-        padding-left: 42px;
         position: relative;
 
         &:hover {
@@ -210,12 +219,6 @@
             text-decoration: underline;
           }
         }
-
-        .avatar {
-          left: 0;
-          position: absolute;
-          top: 0;
-        }
       }
     }
   }
@@ -354,13 +357,6 @@
       margin-top: 0;
     }
 
-    .assignee .avatar {
-      float: left;
-      margin-right: 10px;
-      margin-bottom: 0;
-      margin-left: 0;
-    }
-
     .assignee .user-list .avatar {
       margin: 0;
     }
@@ -521,6 +517,10 @@
       display: none;
     }
 
+    .merge-icon {
+      font-size: 10px;
+    }
+
     .multiple-users {
       position: relative;
       height: 24px;
diff --git a/app/serializers/issuable_sidebar_basic_entity.rb b/app/serializers/issuable_sidebar_basic_entity.rb
index c02fd024345..058c707ef9d 100644
--- a/app/serializers/issuable_sidebar_basic_entity.rb
+++ b/app/serializers/issuable_sidebar_basic_entity.rb
@@ -4,6 +4,7 @@ class IssuableSidebarBasicEntity < Grape::Entity
   include RequestAwareEntity
 
   expose :id
+  expose :iid
   expose :type do |issuable|
     issuable.to_ability_name
   end
diff --git a/app/serializers/merge_request_serializer.rb b/app/serializers/merge_request_serializer.rb
index 8ad1df5dfe0..bd2e682a122 100644
--- a/app/serializers/merge_request_serializer.rb
+++ b/app/serializers/merge_request_serializer.rb
@@ -8,7 +8,7 @@ class MergeRequestSerializer < BaseSerializer
     entity ||=
       case opts[:serializer]
       when 'sidebar'
-        IssuableSidebarBasicEntity
+        MergeRequestSidebarBasicEntity
       when 'sidebar_extras'
         MergeRequestSidebarExtrasEntity
       when 'basic'
diff --git a/app/serializers/merge_request_sidebar_basic_entity.rb b/app/serializers/merge_request_sidebar_basic_entity.rb
new file mode 100644
index 00000000000..fdd0cdc50d2
--- /dev/null
+++ b/app/serializers/merge_request_sidebar_basic_entity.rb
@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+class MergeRequestSidebarBasicEntity < IssuableSidebarBasicEntity
+end
+
+MergeRequestSidebarBasicEntity.prepend_if_ee('EE::MergeRequestSidebarBasicEntity')
diff --git a/app/views/shared/issuable/_sidebar_assignees.html.haml b/app/views/shared/issuable/_sidebar_assignees.html.haml
index ab01094ed6e..1dc538826dc 100644
--- a/app/views/shared/issuable/_sidebar_assignees.html.haml
+++ b/app/views/shared/issuable/_sidebar_assignees.html.haml
@@ -20,6 +20,8 @@
     placeholder: _('Search users'),
     data: { first_user: issuable_sidebar.dig(:current_user, :username),
       current_user: true,
+      iid: issuable_sidebar[:iid],
+      issuable_type: issuable_type,
       project_id: issuable_sidebar[:project_id],
       author_id: issuable_sidebar[:author_id],
       field_name: "#{issuable_type}[assignee_ids][]",
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 26e6cb524bd..2b71d099a01 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -128,9 +128,6 @@ msgstr[1] ""
 msgid "%{actionText} & %{openOrClose} %{noteable}"
 msgstr ""
 
-msgid "%{canMergeCount}/%{assigneesCount} can merge"
-msgstr ""
-
 msgid "%{commit_author_link} authored %{commit_timeago}"
 msgstr ""
 
@@ -202,6 +199,9 @@ msgstr ""
 msgid "%{lock_path} is locked by GitLab User %{lock_user_id}"
 msgstr ""
 
+msgid "%{mergeLength}/%{usersLength} can merge"
+msgstr ""
+
 msgid "%{mrText}, this issue will be closed automatically."
 msgstr ""
 
@@ -279,6 +279,9 @@ msgstr ""
 msgid "%{usage_ping_link_start}Learn more%{usage_ping_link_end} about what information is shared with GitLab Inc."
 msgstr ""
 
+msgid "%{userName} (cannot merge)"
+msgstr ""
+
 msgid "%{userName}'s avatar"
 msgstr ""
 
@@ -306,6 +309,9 @@ msgstr ""
 msgid "(external source)"
 msgstr ""
 
+msgid "+ %{amount} more"
+msgstr ""
+
 msgid "+ %{count} more"
 msgstr ""
 
@@ -7439,9 +7445,6 @@ msgstr ""
 msgid "No milestones to show"
 msgstr ""
 
-msgid "No one can merge"
-msgstr ""
-
 msgid "No other labels with such name or description"
 msgstr ""
 
@@ -13452,6 +13455,9 @@ msgstr ""
 msgid "cannot include leading slash or directory traversal."
 msgstr ""
 
+msgid "cannot merge"
+msgstr ""
+
 msgid "comment"
 msgstr ""
 
@@ -13879,6 +13885,9 @@ msgstr ""
 msgid "no contributions"
 msgstr ""
 
+msgid "no one can merge"
+msgstr ""
+
 msgid "none"
 msgstr ""
 
diff --git a/spec/frontend/sidebar/components/assignees/assignee_avatar_link_spec.js b/spec/frontend/sidebar/components/assignees/assignee_avatar_link_spec.js
new file mode 100644
index 00000000000..9e50eefc228
--- /dev/null
+++ b/spec/frontend/sidebar/components/assignees/assignee_avatar_link_spec.js
@@ -0,0 +1,84 @@
+import { shallowMount } from '@vue/test-utils';
+import { joinPaths } from '~/lib/utils/url_utility';
+import userDataMock from '../../user_data_mock';
+import AssigneeAvatarLink from '~/sidebar/components/assignees/assignee_avatar_link.vue';
+
+const TOOLTIP_PLACEMENT = 'bottom';
+const { name: USER_NAME } = userDataMock();
+
+describe('AssigneeAvatarLink component', () => {
+  let wrapper;
+
+  function createComponent(props = {}) {
+    const propsData = {
+      user: userDataMock(),
+      showLess: true,
+      rootPath: 'http://localhost:3000/',
+      tooltipPlacement: TOOLTIP_PLACEMENT,
+      singleUser: false,
+      issuableType: 'merge_request',
+      ...props,
+    };
+
+    wrapper = shallowMount(AssigneeAvatarLink, {
+      propsData,
+      sync: false,
+    });
+  }
+
+  afterEach(() => {
+    wrapper.destroy();
+  });
+
+  const findTooltipText = () => wrapper.attributes('data-original-title');
+
+  it('user who cannot merge has "cannot merge" in tooltip', () => {
+    createComponent({
+      user: {
+        can_merge: false,
+      },
+    });
+
+    expect(findTooltipText().includes('cannot merge')).toBe(true);
+  });
+
+  it('has the root url present in the assigneeUrl method', () => {
+    createComponent();
+    const assigneeUrl = joinPaths(
+      `${wrapper.props('rootPath')}`,
+      `${wrapper.props('user').username}`,
+    );
+
+    expect(wrapper.attributes().href).toEqual(assigneeUrl);
+  });
+
+  describe.each`
+    issuableType       | tooltipHasName | canMerge | expected
+    ${'merge_request'} | ${true}        | ${true}  | ${USER_NAME}
+    ${'merge_request'} | ${true}        | ${false} | ${`${USER_NAME} (cannot merge)`}
+    ${'merge_request'} | ${false}       | ${true}  | ${''}
+    ${'merge_request'} | ${false}       | ${false} | ${'Cannot merge'}
+    ${'issue'}         | ${true}        | ${true}  | ${USER_NAME}
+    ${'issue'}         | ${true}        | ${false} | ${USER_NAME}
+    ${'issue'}         | ${false}       | ${true}  | ${''}
+    ${'issue'}         | ${false}       | ${false} | ${''}
+  `(
+    'with $issuableType and tooltipHasName=$tooltipHasName and canMerge=$canMerge',
+    ({ issuableType, tooltipHasName, canMerge, expected }) => {
+      beforeEach(() => {
+        createComponent({
+          issuableType,
+          tooltipHasName,
+          user: {
+            ...userDataMock(),
+            can_merge: canMerge,
+          },
+        });
+      });
+
+      it('sets tooltip', () => {
+        expect(findTooltipText()).toBe(expected);
+      });
+    },
+  );
+});
diff --git a/spec/frontend/sidebar/components/assignees/assignee_avatar_spec.js b/spec/frontend/sidebar/components/assignees/assignee_avatar_spec.js
new file mode 100644
index 00000000000..53e5dbea1df
--- /dev/null
+++ b/spec/frontend/sidebar/components/assignees/assignee_avatar_spec.js
@@ -0,0 +1,78 @@
+import { shallowMount } from '@vue/test-utils';
+import AssigneeAvatar from '~/sidebar/components/assignees/assignee_avatar.vue';
+import { TEST_HOST } from 'helpers/test_constants';
+import userDataMock from '../../user_data_mock';
+
+const TEST_AVATAR = `${TEST_HOST}/avatar.png`;
+const TEST_DEFAULT_AVATAR_URL = `${TEST_HOST}/default/avatar/url.png`;
+
+describe('AssigneeAvatar', () => {
+  let origGon;
+  let wrapper;
+
+  function createComponent(props = {}) {
+    const propsData = {
+      user: userDataMock(),
+      imgSize: 24,
+      issuableType: 'merge_request',
+      ...props,
+    };
+
+    wrapper = shallowMount(AssigneeAvatar, {
+      propsData,
+      sync: false,
+    });
+  }
+
+  beforeEach(() => {
+    origGon = window.gon;
+    window.gon = { default_avatar_url: TEST_DEFAULT_AVATAR_URL };
+  });
+
+  afterEach(() => {
+    window.gon = origGon;
+    wrapper.destroy();
+  });
+
+  const findImg = () => wrapper.find('img');
+
+  it('does not show warning icon if assignee can merge', () => {
+    createComponent();
+
+    expect(wrapper.element.querySelector('.merge-icon')).toBeNull();
+  });
+
+  it('shows warning icon if assignee cannot merge', () => {
+    createComponent({
+      user: {
+        can_merge: false,
+      },
+    });
+
+    expect(wrapper.element.querySelector('.merge-icon')).not.toBeNull();
+  });
+
+  it('does not show warning icon for issuableType = "issue"', () => {
+    createComponent({
+      issuableType: 'issue',
+    });
+
+    expect(wrapper.element.querySelector('.merge-icon')).toBeNull();
+  });
+
+  it.each`
+    avatar         | avatar_url     | expected                   | desc
+    ${TEST_AVATAR} | ${null}        | ${TEST_AVATAR}             | ${'with avatar'}
+    ${null}        | ${TEST_AVATAR} | ${TEST_AVATAR}             | ${'with avatar_url'}
+    ${null}        | ${null}        | ${TEST_DEFAULT_AVATAR_URL} | ${'with no avatar'}
+  `('$desc', ({ avatar, avatar_url, expected }) => {
+    createComponent({
+      user: {
+        avatar,
+        avatar_url,
+      },
+    });
+
+    expect(findImg().attributes('src')).toEqual(expected);
+  });
+});
diff --git a/spec/frontend/sidebar/components/assignees/collapsed_assignee_list_spec.js b/spec/frontend/sidebar/components/assignees/collapsed_assignee_list_spec.js
new file mode 100644
index 00000000000..377c0e1d211
--- /dev/null
+++ b/spec/frontend/sidebar/components/assignees/collapsed_assignee_list_spec.js
@@ -0,0 +1,201 @@
+import { shallowMount } from '@vue/test-utils';
+import CollapsedAssigneeList from '~/sidebar/components/assignees/collapsed_assignee_list.vue';
+import CollapsedAssignee from '~/sidebar/components/assignees/collapsed_assignee.vue';
+import UsersMockHelper from 'helpers/user_mock_data_helper';
+
+const DEFAULT_MAX_COUNTER = 99;
+
+describe('CollapsedAssigneeList component', () => {
+  let wrapper;
+
+  function createComponent(props = {}) {
+    const propsData = {
+      users: [],
+      issuableType: 'merge_request',
+      ...props,
+    };
+
+    wrapper = shallowMount(CollapsedAssigneeList, {
+      propsData,
+      sync: false,
+    });
+  }
+
+  const findNoUsersIcon = () => wrapper.find('i[aria-label=None]');
+  const findAvatarCounter = () => wrapper.find('.avatar-counter');
+  const findAssignees = () => wrapper.findAll(CollapsedAssignee);
+  const getTooltipTitle = () => wrapper.attributes('data-original-title');
+
+  afterEach(() => {
+    wrapper.destroy();
+  });
+
+  describe('No assignees/users', () => {
+    beforeEach(() => {
+      createComponent({
+        users: [],
+      });
+    });
+
+    it('has no users', () => {
+      expect(findNoUsersIcon().exists()).toBe(true);
+    });
+  });
+
+  describe('One assignee/user', () => {
+    let users;
+
+    beforeEach(() => {
+      users = UsersMockHelper.createNumberRandomUsers(1);
+    });
+
+    it('should not show no users icon', () => {
+      createComponent({ users });
+
+      expect(findNoUsersIcon().exists()).toBe(false);
+    });
+
+    it('has correct "cannot merge" tooltip when user cannot merge', () => {
+      users[0].can_merge = false;
+
+      createComponent({ users });
+
+      expect(getTooltipTitle()).toContain('cannot merge');
+    });
+
+    it('does not have "merge" word in tooltip if user can merge', () => {
+      users[0].can_merge = true;
+
+      createComponent({ users });
+
+      expect(getTooltipTitle()).not.toContain('merge');
+    });
+  });
+
+  describe('More than one assignees/users', () => {
+    let users;
+
+    beforeEach(() => {
+      users = UsersMockHelper.createNumberRandomUsers(2);
+    });
+
+    describe('default', () => {
+      beforeEach(() => {
+        createComponent({ users });
+      });
+
+      it('has multiple-users class', () => {
+        expect(wrapper.classes('multiple-users')).toBe(true);
+      });
+
+      it('does not display an avatar count', () => {
+        expect(findAvatarCounter().exists()).toBe(false);
+      });
+
+      it('returns just two collapsed users', () => {
+        expect(findAssignees().length).toBe(2);
+      });
+    });
+
+    it('has correct "cannot merge" tooltip when no user can merge', () => {
+      users[0].can_merge = false;
+      users[1].can_merge = false;
+
+      createComponent({
+        users,
+      });
+
+      expect(getTooltipTitle()).toEqual(`${users[0].name}, ${users[1].name} (no one can merge)`);
+    });
+
+    it('does not have "merge" word in tooltip if everyone can merge', () => {
+      users[0].can_merge = true;
+      users[1].can_merge = true;
+
+      createComponent({
+        users,
+      });
+
+      expect(getTooltipTitle()).toEqual(`${users[0].name}, ${users[1].name}`);
+    });
+  });
+
+  describe('More than two assignees/users', () => {
+    let users;
+
+    beforeEach(() => {
+      users = UsersMockHelper.createNumberRandomUsers(3);
+    });
+
+    describe('default', () => {
+      beforeEach(() => {
+        createComponent({ users });
+      });
+
+      it('does display an avatar count', () => {
+        expect(findAvatarCounter().exists()).toBe(true);
+        expect(findAvatarCounter().text()).toEqual('+2');
+      });
+
+      it('returns one collapsed users', () => {
+        expect(findAssignees().length).toBe(1);
+      });
+    });
+
+    it('has correct "cannot merge" tooltip when one user can merge', () => {
+      users[0].can_merge = true;
+      users[1].can_merge = false;
+      users[2].can_merge = false;
+
+      createComponent({
+        users,
+      });
+
+      expect(getTooltipTitle()).toContain('1/3 can merge');
+    });
+
+    it('has correct "cannot merge" tooltip when more than one user can merge', () => {
+      users[0].can_merge = false;
+      users[1].can_merge = true;
+      users[2].can_merge = true;
+
+      createComponent({
+        users,
+      });
+
+      expect(getTooltipTitle()).toContain('2/3 can merge');
+    });
+
+    it('does not have "merge" in tooltip if everyone can merge', () => {
+      users[0].can_merge = true;
+      users[1].can_merge = true;
+      users[2].can_merge = true;
+
+      createComponent({
+        users,
+      });
+
+      expect(getTooltipTitle()).not.toContain('merge');
+    });
+
+    it('displays the correct avatar count via a computed property if less than default max counter', () => {
+      users = UsersMockHelper.createNumberRandomUsers(5);
+
+      createComponent({
+        users,
+      });
+
+      expect(findAvatarCounter().text()).toEqual(`+${users.length - 1}`);
+    });
+
+    it('displays the correct avatar count via a computed property if more than default max counter', () => {
+      users = UsersMockHelper.createNumberRandomUsers(100);
+
+      createComponent({
+        users,
+      });
+
+      expect(findAvatarCounter().text()).toEqual(`${DEFAULT_MAX_COUNTER}+`);
+    });
+  });
+});
diff --git a/spec/frontend/sidebar/components/assignees/collapsed_assignee_spec.js b/spec/frontend/sidebar/components/assignees/collapsed_assignee_spec.js
new file mode 100644
index 00000000000..03b61daa2f8
--- /dev/null
+++ b/spec/frontend/sidebar/components/assignees/collapsed_assignee_spec.js
@@ -0,0 +1,34 @@
+import { shallowMount } from '@vue/test-utils';
+import CollapsedAssignee from '~/sidebar/components/assignees/collapsed_assignee.vue';
+import userDataMock from '../../user_data_mock';
+
+describe('CollapsedAssignee assignee component', () => {
+  let wrapper;
+
+  function createComponent(props = {}) {
+    const propsData = {
+      user: userDataMock(),
+      ...props,
+    };
+
+    wrapper = shallowMount(CollapsedAssignee, {
+      propsData,
+      sync: false,
+    });
+  }
+
+  afterEach(() => {
+    wrapper.destroy();
+  });
+
+  it('has author name', () => {
+    createComponent();
+
+    expect(
+      wrapper
+        .find('.author')
+        .text()
+        .trim(),
+    ).toEqual(wrapper.vm.user.name);
+  });
+});
diff --git a/spec/frontend/sidebar/components/assignees/uncollapsed_assignee_list_spec.js b/spec/frontend/sidebar/components/assignees/uncollapsed_assignee_list_spec.js
new file mode 100644
index 00000000000..64170a53a7f
--- /dev/null
+++ b/spec/frontend/sidebar/components/assignees/uncollapsed_assignee_list_spec.js
@@ -0,0 +1,135 @@
+import Vue from 'vue';
+import { mount } from '@vue/test-utils';
+import UncollapsedAssigneeList from '~/sidebar/components/assignees/uncollapsed_assignee_list.vue';
+import AssigneeAvatarLink from '~/sidebar/components/assignees/assignee_avatar_link.vue';
+import { TEST_HOST } from 'helpers/test_constants';
+import userDataMock from '../../user_data_mock';
+import UsersMockHelper from '../../../helpers/user_mock_data_helper';
+
+const DEFAULT_RENDER_COUNT = 5;
+
+describe('UncollapsedAssigneeList component', () => {
+  let wrapper;
+
+  function createComponent(props = {}) {
+    const propsData = {
+      users: [],
+      rootPath: TEST_HOST,
+      ...props,
+    };
+
+    wrapper = mount(UncollapsedAssigneeList, {
+      sync: false,
+      propsData,
+    });
+  }
+
+  afterEach(() => {
+    wrapper.destroy();
+  });
+
+  const findMoreButton = () => wrapper.find('.user-list-more button');
+
+  describe('One assignee/user', () => {
+    let user;
+
+    beforeEach(() => {
+      user = userDataMock();
+
+      createComponent({
+        users: [user],
+      });
+    });
+
+    it('only has one user', () => {
+      expect(wrapper.findAll(AssigneeAvatarLink).length).toBe(1);
+    });
+
+    it('calls the AssigneeAvatarLink with the proper props', () => {
+      expect(wrapper.find(AssigneeAvatarLink).exists()).toBe(true);
+      expect(wrapper.find(AssigneeAvatarLink).props().tooltipPlacement).toEqual('left');
+    });
+
+    it('Shows one user with avatar, username and author name', () => {
+      expect(wrapper.text()).toContain(user.name);
+      expect(wrapper.text()).toContain(`@${user.username}`);
+    });
+  });
+
+  describe('Two or more assignees/users', () => {
+    beforeEach(() => {
+      createComponent({
+        users: UsersMockHelper.createNumberRandomUsers(3),
+      });
+    });
+
+    it('more than one user', () => {
+      expect(wrapper.findAll(AssigneeAvatarLink).length).toBe(3);
+    });
+
+    it('shows the "show-less" assignees label', done => {
+      const users = UsersMockHelper.createNumberRandomUsers(6);
+
+      createComponent({
+        users,
+      });
+
+      expect(wrapper.vm.$el.querySelectorAll('.user-item').length).toEqual(DEFAULT_RENDER_COUNT);
+
+      expect(wrapper.vm.$el.querySelector('.user-list-more')).not.toBe(null);
+      const usersLabelExpectation = users.length - DEFAULT_RENDER_COUNT;
+
+      expect(wrapper.vm.$el.querySelector('.user-list-more .btn-link').innerText.trim()).not.toBe(
+        `+${usersLabelExpectation} more`,
+      );
+      wrapper.vm.toggleShowLess();
+      Vue.nextTick(() => {
+        expect(wrapper.vm.$el.querySelector('.user-list-more .btn-link').innerText.trim()).toBe(
+          '- show less',
+        );
+        done();
+      });
+    });
+
+    it('shows the "show-less" when "n+ more " label is clicked', done => {
+      createComponent({
+        users: UsersMockHelper.createNumberRandomUsers(6),
+      });
+
+      wrapper.vm.$el.querySelector('.user-list-more .btn-link').click();
+      Vue.nextTick(() => {
+        expect(wrapper.vm.$el.querySelector('.user-list-more .btn-link').innerText.trim()).toBe(
+          '- show less',
+        );
+        done();
+      });
+    });
+
+    it('does not show n+ more label when less than render count', () => {
+      expect(findMoreButton().exists()).toBe(false);
+    });
+  });
+
+  describe('n+ more label', () => {
+    beforeEach(() => {
+      createComponent({
+        users: UsersMockHelper.createNumberRandomUsers(DEFAULT_RENDER_COUNT + 1),
+      });
+    });
+
+    it('shows "+1 more" label', () => {
+      expect(findMoreButton().text()).toBe('+ 1 more');
+      expect(wrapper.findAll(AssigneeAvatarLink).length).toBe(DEFAULT_RENDER_COUNT);
+    });
+
+    it('shows "show less" label', done => {
+      findMoreButton().trigger('click');
+
+      Vue.nextTick(() => {
+        expect(findMoreButton().text()).toBe('- show less');
+        expect(wrapper.findAll(AssigneeAvatarLink).length).toBe(DEFAULT_RENDER_COUNT + 1);
+        done();
+      });
+    });
+  });
+});
diff --git a/spec/frontend/sidebar/user_data_mock.js b/spec/frontend/sidebar/user_data_mock.js
new file mode 100644
index 00000000000..8ad70bb3499
--- /dev/null
+++ b/spec/frontend/sidebar/user_data_mock.js
@@ -0,0 +1,9 @@
+export default () => ({
+  avatar_url: 'mock_path',
+  id: 1,
+  name: 'Root',
+  state: 'active',
+  username: 'root',
+  web_url: '',
+  can_merge: true,
+});
diff --git a/spec/javascripts/sidebar/assignees_spec.js b/spec/javascripts/sidebar/assignees_spec.js
index 4ae2141d5f0..fc731e731ae 100644
--- a/spec/javascripts/sidebar/assignees_spec.js
+++ b/spec/javascripts/sidebar/assignees_spec.js
@@ -94,115 +94,9 @@ describe('Assignee component', () => {
 
       expect(assignee.querySelector('.author').innerText.trim()).toEqual(UsersMock.user.name);
     });
-
-    it('Shows one user with avatar, username and author name', () => {
-      component = new AssigneeComponent({
-        propsData: {
-          rootPath: 'http://localhost:3000/',
-          users: [UsersMock.user],
-          editable: true,
-        },
-      }).$mount();
-
-      expect(component.$el.querySelector('.author-link')).not.toBeNull();
-      // The image
-      expect(component.$el.querySelector('.author-link img').getAttribute('src')).toEqual(
-        UsersMock.user.avatar,
-      );
-      // Author name
-      expect(component.$el.querySelector('.author-link .author').innerText.trim()).toEqual(
-        UsersMock.user.name,
-      );
-      // Username
-      expect(component.$el.querySelector('.author-link .username').innerText.trim()).toEqual(
-        `@${UsersMock.user.username}`,
-      );
-    });
-
-    it('has the root url present in the assigneeUrl method', () => {
-      component = new AssigneeComponent({
-        propsData: {
-          rootPath: 'http://localhost:3000/',
-          users: [UsersMock.user],
-          editable: true,
-        },
-      }).$mount();
-
-      expect(component.assigneeUrl(UsersMock.user).indexOf('http://localhost:3000/')).not.toEqual(
-        -1,
-      );
-    });
-
-    it('has correct "cannot merge" tooltip when user cannot merge', () => {
-      const user = Object.assign({}, UsersMock.user, { can_merge: false });
-
-      component = new AssigneeComponent({
-        propsData: {
-          rootPath: 'http://localhost:3000/',
-          users: [user],
-          editable: true,
-          issuableType: 'merge_request',
-        },
-      }).$mount();
-
-      expect(component.mergeNotAllowedTooltipMessage).toEqual('Cannot merge');
-    });
   });
 
   describe('Two or more assignees/users', () => {
-    it('has correct "cannot merge" tooltip when one user can merge', () => {
-      const users = UsersMockHelper.createNumberRandomUsers(3);
-      users[0].can_merge = true;
-      users[1].can_merge = false;
-      users[2].can_merge = false;
-
-      component = new AssigneeComponent({
-        propsData: {
-          rootPath: 'http://localhost:3000/',
-          users,
-          editable: true,
-          issuableType: 'merge_request',
-        },
-      }).$mount();
-
-      expect(component.mergeNotAllowedTooltipMessage).toEqual('1/3 can merge');
-    });
-
-    it('has correct "cannot merge" tooltip when no user can merge', () => {
-      const users = UsersMockHelper.createNumberRandomUsers(2);
-      users[0].can_merge = false;
-      users[1].can_merge = false;
-
-      component = new AssigneeComponent({
-        propsData: {
-          rootPath: 'http://localhost:3000/',
-          users,
-          editable: true,
-          issuableType: 'merge_request',
-        },
-      }).$mount();
-
-      expect(component.mergeNotAllowedTooltipMessage).toEqual('No one can merge');
-    });
-
-    it('has correct "cannot merge" tooltip when more than one user can merge', () => {
-      const users = UsersMockHelper.createNumberRandomUsers(3);
-      users[0].can_merge = false;
-      users[1].can_merge = true;
-      users[2].can_merge = true;
-
-      component = new AssigneeComponent({
-        propsData: {
-          rootPath: 'http://localhost:3000/',
-          users,
-          editable: true,
-          issuableType: 'merge_request',
-        },
-      }).$mount();
-
-      expect(component.mergeNotAllowedTooltipMessage).toEqual('2/3 can merge');
-    });
-
     it('has no "cannot merge" tooltip when every user can merge', () => {
       const users = UsersMockHelper.createNumberRandomUsers(2);
       users[0].can_merge = true;
@@ -217,7 +111,7 @@ describe('Assignee component', () => {
         },
       }).$mount();
 
-      expect(component.mergeNotAllowedTooltipMessage).toEqual(null);
+      expect(component.collapsedTooltipTitle).not.toContain('cannot merge');
     });
 
     it('displays two assignee icons when collapsed', () => {
@@ -295,8 +189,12 @@ describe('Assignee component', () => {
       expect(component.$el.querySelector('.user-list-more')).toBe(null);
     });
 
-    it('sets tooltip container to body', () => {
-      const users = UsersMockHelper.createNumberRandomUsers(2);
+    it('shows sorted assignee where "can merge" users are sorted first', () => {
+      const users = UsersMockHelper.createNumberRandomUsers(3);
+      users[0].can_merge = false;
+      users[1].can_merge = false;
+      users[2].can_merge = true;
+
       component = new AssigneeComponent({
         propsData: {
           rootPath: 'http://localhost:3000',
@@ -305,98 +203,48 @@ describe('Assignee component', () => {
         },
       }).$mount();
 
-      expect(component.$el.querySelector('.user-link').getAttribute('data-container')).toBe('body');
+      expect(component.sortedAssigness[0].can_merge).toBe(true);
     });
 
-    it('Shows the "show-less" assignees label', done => {
-      const users = UsersMockHelper.createNumberRandomUsers(6);
+    it('passes the sorted assignees to the uncollapsed-assignee-list', () => {
+      const users = UsersMockHelper.createNumberRandomUsers(3);
+      users[0].can_merge = false;
+      users[1].can_merge = false;
+      users[2].can_merge = true;
+
       component = new AssigneeComponent({
         propsData: {
           rootPath: 'http://localhost:3000',
           users,
-          editable: true,
+          editable: false,
         },
       }).$mount();
 
-      expect(component.$el.querySelectorAll('.user-item').length).toEqual(
-        component.defaultRenderCount,
-      );
-
-      expect(component.$el.querySelector('.user-list-more')).not.toBe(null);
-      const usersLabelExpectation = users.length - component.defaultRenderCount;
+      const userItems = component.$el.querySelectorAll('.user-list .user-item a');
 
-      expect(component.$el.querySelector('.user-list-more .btn-link').innerText.trim()).not.toBe(
-        `+${usersLabelExpectation} more`,
-      );
-      component.toggleShowLess();
-      Vue.nextTick(() => {
-        expect(component.$el.querySelector('.user-list-more .btn-link').innerText.trim()).toBe(
-          '- show less',
-        );
-        done();
-      });
+      expect(userItems.length).toBe(3);
+      expect(userItems[0].dataset.originalTitle).toBe(users[2].name);
+      expect(userItems[0].dataset.originalTitle).not.toBe(users[0].name);
     });
 
-    it('Shows the "show-less" when "n+ more " label is clicked', done => {
-      const users = UsersMockHelper.createNumberRandomUsers(6);
-      component = new AssigneeComponent({
-        propsData: {
-          rootPath: 'http://localhost:3000',
-          users,
-          editable: true,
-        },
-      }).$mount();
-
-      component.$el.querySelector('.user-list-more .btn-link').click();
-      Vue.nextTick(() => {
-        expect(component.$el.querySelector('.user-list-more .btn-link').innerText.trim()).toBe(
-          '- show less',
-        );
-        done();
-      });
-    });
+    it('passes the sorted assignees to the collapsed-assignee-list', () => {
+      const users = UsersMockHelper.createNumberRandomUsers(3);
+      users[0].can_merge = false;
+      users[1].can_merge = false;
+      users[2].can_merge = true;
 
-    it('gets the count of avatar via a computed property ', () => {
-      const users = UsersMockHelper.createNumberRandomUsers(6);
       component = new AssigneeComponent({
         propsData: {
           rootPath: 'http://localhost:3000',
           users,
-          editable: true,
+          editable: false,
         },
       }).$mount();
 
-      expect(component.sidebarAvatarCounter).toEqual(`+${users.length - 1}`);
-    });
+      const collapsedButton = component.$el.querySelector('.sidebar-collapsed-user button');
 
-    describe('n+ more label', () => {
-      beforeEach(() => {
-        const users = UsersMockHelper.createNumberRandomUsers(6);
-        component = new AssigneeComponent({
-          propsData: {
-            rootPath: 'http://localhost:3000',
-            users,
-            editable: true,
-          },
-        }).$mount();
-      });
-
-      it('shows "+1 more" label', () => {
-        expect(component.$el.querySelector('.user-list-more .btn-link').innerText.trim()).toBe(
-          '+ 1 more',
-        );
-      });
-
-      it('shows "show less" label', done => {
-        component.toggleShowLess();
-
-        Vue.nextTick(() => {
-          expect(component.$el.querySelector('.user-list-more .btn-link').innerText.trim()).toBe(
-            '- show less',
-          );
-          done();
-        });
-      });
+      expect(collapsedButton.innerText.trim()).toBe(users[2].name);
+      expect(collapsedButton.innerText.trim()).not.toBe(users[0].name);
     });
   });
 });
diff --git a/spec/javascripts/sidebar/mock_data.js b/spec/javascripts/sidebar/mock_data.js
index 7f20b0da991..107acead3c6 100644
--- a/spec/javascripts/sidebar/mock_data.js
+++ b/spec/javascripts/sidebar/mock_data.js
@@ -1,3 +1,13 @@
+export const userDataMock = {
+  avatar_url: 'mock_path',
+  id: 1,
+  name: 'Root',
+  state: 'active',
+  username: 'root',
+  web_url: '',
+  can_merge: true,
+};
+
 const RESPONSE_MAP = {
   GET: {
     '/gitlab-org/gitlab-shell/issues/5.json': {
diff --git a/spec/serializers/merge_request_sidebar_basic_entity_spec.rb b/spec/serializers/merge_request_sidebar_basic_entity_spec.rb
new file mode 100644
index 00000000000..b364b1a3306
--- /dev/null
+++ b/spec/serializers/merge_request_sidebar_basic_entity_spec.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe MergeRequestSidebarBasicEntity do
+  let(:project) { create :project, :repository }
+  let(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let(:user) { create(:user) }
+
+  let(:request) { double('request', current_user: user, project: project) }
+
+  let(:entity) { described_class.new(merge_request, request: request).as_json }
+
+  describe '#current_user' do
+    it 'contains attributes related to the current user' do
+      expect(entity[:current_user].keys).to contain_exactly(
+        :id, :name, :username, :state, :avatar_url, :web_url, :todo,
+        :can_edit, :can_move, :can_admin_label, :can_merge
+      )
+    end
+  end
+end
-- 
cgit v1.2.1


From 4e3c7a0bab0dc42cb46dd06059820eea538adfc9 Mon Sep 17 00:00:00 2001
From: Paul Slaughter <pslaughter@gitlab.com>
Date: Sat, 17 Aug 2019 00:50:04 -0500
Subject: Fix `require` typo to `required`

---
 app/assets/javascripts/sidebar/components/assignees/assignee_avatar.vue | 2 +-
 app/assets/javascripts/sidebar/components/assignees/assignees.vue       | 2 +-
 .../javascripts/sidebar/components/assignees/collapsed_assignee.vue     | 2 +-
 .../sidebar/components/assignees/collapsed_assignee_list.vue            | 2 +-
 .../javascripts/sidebar/components/assignees/sidebar_assignees.vue      | 2 +-
 .../sidebar/components/assignees/uncollapsed_assignee_list.vue          | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/app/assets/javascripts/sidebar/components/assignees/assignee_avatar.vue b/app/assets/javascripts/sidebar/components/assignees/assignee_avatar.vue
index 0bb4f757de8..71a1fc31315 100644
--- a/app/assets/javascripts/sidebar/components/assignees/assignee_avatar.vue
+++ b/app/assets/javascripts/sidebar/components/assignees/assignee_avatar.vue
@@ -13,7 +13,7 @@ export default {
     },
     issuableType: {
       type: String,
-      require: true,
+      required: false,
       default: 'issue',
     },
   },
diff --git a/app/assets/javascripts/sidebar/components/assignees/assignees.vue b/app/assets/javascripts/sidebar/components/assignees/assignees.vue
index ca4090eee96..d9739e8d197 100644
--- a/app/assets/javascripts/sidebar/components/assignees/assignees.vue
+++ b/app/assets/javascripts/sidebar/components/assignees/assignees.vue
@@ -25,7 +25,7 @@ export default {
     },
     issuableType: {
       type: String,
-      require: true,
+      required: false,
       default: 'issue',
     },
   },
diff --git a/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee.vue b/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee.vue
index 3f3626092a8..2f654409561 100644
--- a/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee.vue
+++ b/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee.vue
@@ -12,7 +12,7 @@ export default {
     },
     issuableType: {
       type: String,
-      require: true,
+      required: false,
       default: 'issue',
     },
   },
diff --git a/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee_list.vue b/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee_list.vue
index 6db198f1c1e..5b4a43399ca 100644
--- a/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee_list.vue
+++ b/app/assets/javascripts/sidebar/components/assignees/collapsed_assignee_list.vue
@@ -20,7 +20,7 @@ export default {
     },
     issuableType: {
       type: String,
-      require: true,
+      required: false,
       default: 'issue',
     },
   },
diff --git a/app/assets/javascripts/sidebar/components/assignees/sidebar_assignees.vue b/app/assets/javascripts/sidebar/components/assignees/sidebar_assignees.vue
index be1e4811856..c6cc04a139f 100644
--- a/app/assets/javascripts/sidebar/components/assignees/sidebar_assignees.vue
+++ b/app/assets/javascripts/sidebar/components/assignees/sidebar_assignees.vue
@@ -29,7 +29,7 @@ export default {
     },
     issuableType: {
       type: String,
-      require: true,
+      required: false,
       default: 'issue',
     },
   },
diff --git a/app/assets/javascripts/sidebar/components/assignees/uncollapsed_assignee_list.vue b/app/assets/javascripts/sidebar/components/assignees/uncollapsed_assignee_list.vue
index e84b323c7bd..3a4623121f4 100644
--- a/app/assets/javascripts/sidebar/components/assignees/uncollapsed_assignee_list.vue
+++ b/app/assets/javascripts/sidebar/components/assignees/uncollapsed_assignee_list.vue
@@ -19,7 +19,7 @@ export default {
     },
     issuableType: {
       type: String,
-      require: true,
+      required: false,
       default: 'issue',
     },
   },
-- 
cgit v1.2.1


From 96b994bd05db072655bcd28204770013feeaa779 Mon Sep 17 00:00:00 2001
From: Igor Drozdov <idrozdov@gitlab.com>
Date: Mon, 19 Aug 2019 11:34:19 +0300
Subject: Fix comments related to BE part

- Edit commit messge body to fix "danger-review"
---
 app/serializers/merge_request_sidebar_basic_entity.rb         | 7 +++++--
 spec/fixtures/api/schemas/entities/merge_request_sidebar.json | 1 +
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/app/serializers/merge_request_sidebar_basic_entity.rb b/app/serializers/merge_request_sidebar_basic_entity.rb
index fdd0cdc50d2..3c911bbe4c8 100644
--- a/app/serializers/merge_request_sidebar_basic_entity.rb
+++ b/app/serializers/merge_request_sidebar_basic_entity.rb
@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 class MergeRequestSidebarBasicEntity < IssuableSidebarBasicEntity
+  expose :current_user, if: lambda { |_issuable| current_user } do
+    expose :can_merge do |merge_request|
+      merge_request.can_be_merged_by?(current_user)
+    end
+  end
 end
-
-MergeRequestSidebarBasicEntity.prepend_if_ee('EE::MergeRequestSidebarBasicEntity')
diff --git a/spec/fixtures/api/schemas/entities/merge_request_sidebar.json b/spec/fixtures/api/schemas/entities/merge_request_sidebar.json
index 214b67a9a0f..9945de8a856 100644
--- a/spec/fixtures/api/schemas/entities/merge_request_sidebar.json
+++ b/spec/fixtures/api/schemas/entities/merge_request_sidebar.json
@@ -2,6 +2,7 @@
   "type": "object",
   "properties" : {
     "id": { "type": "integer" },
+    "iid": { "type": "integer" },
     "type": { "type": "string" },
     "author_id": { "type": "integer" },
     "project_id": { "type": "integer" },
-- 
cgit v1.2.1


From 1c7cbc25b9a877e492643d8749fa2862d86fd93f Mon Sep 17 00:00:00 2001
From: Samantha Ming <sming@gitlab.com>
Date: Mon, 19 Aug 2019 21:29:47 -0700
Subject: Apply patch and update spec per MR comments

- Use wrapper instead of global Vue object
- Use vue utils helper method
- Remove redundant spec tests
---
 .../assignees/assignee_avatar_link_spec.js         | 35 +++++----
 .../components/assignees/assignee_avatar_spec.js   |  6 +-
 .../assignees/collapsed_assignee_list_spec.js      | 64 +++++++--------
 .../assignees/collapsed_assignee_spec.js           | 17 +++-
 .../assignees/uncollapsed_assignee_list_spec.js    | 90 +++++++---------------
 spec/javascripts/sidebar/assignees_spec.js         |  2 -
 spec/javascripts/sidebar/mock_data.js              | 10 ---
 7 files changed, 92 insertions(+), 132 deletions(-)

diff --git a/spec/frontend/sidebar/components/assignees/assignee_avatar_link_spec.js b/spec/frontend/sidebar/components/assignees/assignee_avatar_link_spec.js
index 9e50eefc228..452d4cd07cc 100644
--- a/spec/frontend/sidebar/components/assignees/assignee_avatar_link_spec.js
+++ b/spec/frontend/sidebar/components/assignees/assignee_avatar_link_spec.js
@@ -1,10 +1,13 @@
 import { shallowMount } from '@vue/test-utils';
 import { joinPaths } from '~/lib/utils/url_utility';
-import userDataMock from '../../user_data_mock';
+import { TEST_HOST } from 'helpers/test_constants';
 import AssigneeAvatarLink from '~/sidebar/components/assignees/assignee_avatar_link.vue';
+import AssigneeAvatar from '~/sidebar/components/assignees/assignee_avatar.vue';
+import userDataMock from '../../user_data_mock';
 
 const TOOLTIP_PLACEMENT = 'bottom';
-const { name: USER_NAME } = userDataMock();
+const { name: USER_NAME, username: USER_USERNAME } = userDataMock();
+const TEST_ISSUABLE_TYPE = 'merge_request';
 
 describe('AssigneeAvatarLink component', () => {
   let wrapper;
@@ -13,10 +16,10 @@ describe('AssigneeAvatarLink component', () => {
     const propsData = {
       user: userDataMock(),
       showLess: true,
-      rootPath: 'http://localhost:3000/',
+      rootPath: TEST_HOST,
       tooltipPlacement: TOOLTIP_PLACEMENT,
       singleUser: false,
-      issuableType: 'merge_request',
+      issuableType: TEST_ISSUABLE_TYPE,
       ...props,
     };
 
@@ -32,24 +35,22 @@ describe('AssigneeAvatarLink component', () => {
 
   const findTooltipText = () => wrapper.attributes('data-original-title');
 
-  it('user who cannot merge has "cannot merge" in tooltip', () => {
-    createComponent({
-      user: {
-        can_merge: false,
-      },
-    });
+  it('has the root url present in the assigneeUrl method', () => {
+    createComponent();
+    const assigneeUrl = joinPaths(TEST_HOST, USER_USERNAME);
 
-    expect(findTooltipText().includes('cannot merge')).toBe(true);
+    expect(wrapper.attributes().href).toEqual(assigneeUrl);
   });
 
-  it('has the root url present in the assigneeUrl method', () => {
+  it('renders assignee avatar', () => {
     createComponent();
-    const assigneeUrl = joinPaths(
-      `${wrapper.props('rootPath')}`,
-      `${wrapper.props('user').username}`,
-    );
 
-    expect(wrapper.attributes().href).toEqual(assigneeUrl);
+    expect(wrapper.find(AssigneeAvatar).props()).toEqual(
+      expect.objectContaining({
+        issuableType: TEST_ISSUABLE_TYPE,
+        user: userDataMock(),
+      }),
+    );
   });
 
   describe.each`
diff --git a/spec/frontend/sidebar/components/assignees/assignee_avatar_spec.js b/spec/frontend/sidebar/components/assignees/assignee_avatar_spec.js
index 53e5dbea1df..d60ae17733b 100644
--- a/spec/frontend/sidebar/components/assignees/assignee_avatar_spec.js
+++ b/spec/frontend/sidebar/components/assignees/assignee_avatar_spec.js
@@ -39,7 +39,7 @@ describe('AssigneeAvatar', () => {
   it('does not show warning icon if assignee can merge', () => {
     createComponent();
 
-    expect(wrapper.element.querySelector('.merge-icon')).toBeNull();
+    expect(wrapper.find('.merge-icon').exists()).toBe(false);
   });
 
   it('shows warning icon if assignee cannot merge', () => {
@@ -49,7 +49,7 @@ describe('AssigneeAvatar', () => {
       },
     });
 
-    expect(wrapper.element.querySelector('.merge-icon')).not.toBeNull();
+    expect(wrapper.find('.merge-icon').exists()).toBe(true);
   });
 
   it('does not show warning icon for issuableType = "issue"', () => {
@@ -57,7 +57,7 @@ describe('AssigneeAvatar', () => {
       issuableType: 'issue',
     });
 
-    expect(wrapper.element.querySelector('.merge-icon')).toBeNull();
+    expect(wrapper.find('.merge-icon').exists()).toBe(false);
   });
 
   it.each`
diff --git a/spec/frontend/sidebar/components/assignees/collapsed_assignee_list_spec.js b/spec/frontend/sidebar/components/assignees/collapsed_assignee_list_spec.js
index 377c0e1d211..ff0c8d181b5 100644
--- a/spec/frontend/sidebar/components/assignees/collapsed_assignee_list_spec.js
+++ b/spec/frontend/sidebar/components/assignees/collapsed_assignee_list_spec.js
@@ -77,54 +77,30 @@ describe('CollapsedAssigneeList component', () => {
 
     beforeEach(() => {
       users = UsersMockHelper.createNumberRandomUsers(2);
-    });
-
-    describe('default', () => {
-      beforeEach(() => {
-        createComponent({ users });
-      });
-
-      it('has multiple-users class', () => {
-        expect(wrapper.classes('multiple-users')).toBe(true);
-      });
-
-      it('does not display an avatar count', () => {
-        expect(findAvatarCounter().exists()).toBe(false);
-      });
 
-      it('returns just two collapsed users', () => {
-        expect(findAssignees().length).toBe(2);
-      });
+      createComponent({ users });
     });
 
-    it('has correct "cannot merge" tooltip when no user can merge', () => {
-      users[0].can_merge = false;
-      users[1].can_merge = false;
-
-      createComponent({
-        users,
-      });
-
-      expect(getTooltipTitle()).toEqual(`${users[0].name}, ${users[1].name} (no one can merge)`);
+    it('has multiple-users class', () => {
+      expect(wrapper.classes('multiple-users')).toBe(true);
     });
 
-    it('does not have "merge" word in tooltip if everyone can merge', () => {
-      users[0].can_merge = true;
-      users[1].can_merge = true;
-
-      createComponent({
-        users,
-      });
+    it('does not display an avatar count', () => {
+      expect(findAvatarCounter().exists()).toBe(false);
+    });
 
-      expect(getTooltipTitle()).toEqual(`${users[0].name}, ${users[1].name}`);
+    it('returns just two collapsed users', () => {
+      expect(findAssignees().length).toBe(2);
     });
   });
 
   describe('More than two assignees/users', () => {
     let users;
+    let userNames;
 
     beforeEach(() => {
       users = UsersMockHelper.createNumberRandomUsers(3);
+      userNames = users.map(x => x.name).join(', ');
     });
 
     describe('default', () => {
@@ -142,6 +118,18 @@ describe('CollapsedAssigneeList component', () => {
       });
     });
 
+    it('has corrent "no one can merge" tooltip when no one can merge', () => {
+      users[0].can_merge = false;
+      users[1].can_merge = false;
+      users[2].can_merge = false;
+
+      createComponent({
+        users,
+      });
+
+      expect(getTooltipTitle()).toEqual(`${userNames} (no one can merge)`);
+    });
+
     it('has correct "cannot merge" tooltip when one user can merge', () => {
       users[0].can_merge = true;
       users[1].can_merge = false;
@@ -151,7 +139,7 @@ describe('CollapsedAssigneeList component', () => {
         users,
       });
 
-      expect(getTooltipTitle()).toContain('1/3 can merge');
+      expect(getTooltipTitle()).toEqual(`${userNames} (1/3 can merge)`);
     });
 
     it('has correct "cannot merge" tooltip when more than one user can merge', () => {
@@ -163,7 +151,7 @@ describe('CollapsedAssigneeList component', () => {
         users,
       });
 
-      expect(getTooltipTitle()).toContain('2/3 can merge');
+      expect(getTooltipTitle()).toEqual(`${userNames} (2/3 can merge)`);
     });
 
     it('does not have "merge" in tooltip if everyone can merge', () => {
@@ -175,10 +163,10 @@ describe('CollapsedAssigneeList component', () => {
         users,
       });
 
-      expect(getTooltipTitle()).not.toContain('merge');
+      expect(getTooltipTitle()).toEqual(userNames);
     });
 
-    it('displays the correct avatar count via a computed property if less than default max counter', () => {
+    it('displays the correct avatar count', () => {
       users = UsersMockHelper.createNumberRandomUsers(5);
 
       createComponent({
diff --git a/spec/frontend/sidebar/components/assignees/collapsed_assignee_spec.js b/spec/frontend/sidebar/components/assignees/collapsed_assignee_spec.js
index 03b61daa2f8..f9ca7bc1ecb 100644
--- a/spec/frontend/sidebar/components/assignees/collapsed_assignee_spec.js
+++ b/spec/frontend/sidebar/components/assignees/collapsed_assignee_spec.js
@@ -1,13 +1,18 @@
 import { shallowMount } from '@vue/test-utils';
 import CollapsedAssignee from '~/sidebar/components/assignees/collapsed_assignee.vue';
+import AssigneeAvatar from '~/sidebar/components/assignees/assignee_avatar.vue';
 import userDataMock from '../../user_data_mock';
 
+const TEST_USER = userDataMock();
+const TEST_ISSUABLE_TYPE = 'merge_request';
+
 describe('CollapsedAssignee assignee component', () => {
   let wrapper;
 
   function createComponent(props = {}) {
     const propsData = {
       user: userDataMock(),
+      issuableType: TEST_ISSUABLE_TYPE,
       ...props,
     };
 
@@ -29,6 +34,16 @@ describe('CollapsedAssignee assignee component', () => {
         .find('.author')
         .text()
         .trim(),
-    ).toEqual(wrapper.vm.user.name);
+    ).toEqual(TEST_USER.name);
+  });
+
+  it('has assignee avatar', () => {
+    createComponent();
+
+    expect(wrapper.find(AssigneeAvatar).props()).toEqual({
+      imgSize: 24,
+      user: TEST_USER,
+      issuableType: TEST_ISSUABLE_TYPE,
+    });
   });
 });
diff --git a/spec/frontend/sidebar/components/assignees/uncollapsed_assignee_list_spec.js b/spec/frontend/sidebar/components/assignees/uncollapsed_assignee_list_spec.js
index 64170a53a7f..6398351834c 100644
--- a/spec/frontend/sidebar/components/assignees/uncollapsed_assignee_list_spec.js
+++ b/spec/frontend/sidebar/components/assignees/uncollapsed_assignee_list_spec.js
@@ -1,4 +1,3 @@
-import Vue from 'vue';
 import { mount } from '@vue/test-utils';
 import UncollapsedAssigneeList from '~/sidebar/components/assignees/uncollapsed_assignee_list.vue';
 import AssigneeAvatarLink from '~/sidebar/components/assignees/assignee_avatar_link.vue';
@@ -56,79 +55,48 @@ describe('UncollapsedAssigneeList component', () => {
     });
   });
 
-  describe('Two or more assignees/users', () => {
-    beforeEach(() => {
-      createComponent({
-        users: UsersMockHelper.createNumberRandomUsers(3),
-      });
-    });
-
-    it('more than one user', () => {
-      expect(wrapper.findAll(AssigneeAvatarLink).length).toBe(3);
-    });
-
-    it('shows the "show-less" assignees label', done => {
-      const users = UsersMockHelper.createNumberRandomUsers(6);
-
-      createComponent({
-        users,
+  describe('n+ more label', () => {
+    describe('when users count is rendered users', () => {
+      beforeEach(() => {
+        createComponent({
+          users: UsersMockHelper.createNumberRandomUsers(DEFAULT_RENDER_COUNT),
+        });
       });
 
-      expect(wrapper.vm.$el.querySelectorAll('.user-item').length).toEqual(DEFAULT_RENDER_COUNT);
-
-      expect(wrapper.vm.$el.querySelector('.user-list-more')).not.toBe(null);
-      const usersLabelExpectation = users.length - DEFAULT_RENDER_COUNT;
-
-      expect(wrapper.vm.$el.querySelector('.user-list-more .btn-link').innerText.trim()).not.toBe(
-        `+${usersLabelExpectation} more`,
-      );
-      wrapper.vm.toggleShowLess();
-      Vue.nextTick(() => {
-        expect(wrapper.vm.$el.querySelector('.user-list-more .btn-link').innerText.trim()).toBe(
-          '- show less',
-        );
-        done();
+      it('does not show more label', () => {
+        expect(findMoreButton().exists()).toBe(false);
       });
     });
 
-    it('shows the "show-less" when "n+ more " label is clicked', done => {
-      createComponent({
-        users: UsersMockHelper.createNumberRandomUsers(6),
+    describe('when more than rendered users', () => {
+      beforeEach(() => {
+        createComponent({
+          users: UsersMockHelper.createNumberRandomUsers(DEFAULT_RENDER_COUNT + 1),
+        });
       });
 
-      wrapper.vm.$el.querySelector('.user-list-more .btn-link').click();
-      Vue.nextTick(() => {
-        expect(wrapper.vm.$el.querySelector('.user-list-more .btn-link').innerText.trim()).toBe(
-          '- show less',
-        );
-        done();
+      it('shows "+1 more" label', () => {
+        expect(findMoreButton().text()).toBe('+ 1 more');
       });
-    });
-
-    it('does not show n+ more label when less than render count', () => {
-      expect(findMoreButton().exists()).toBe(false);
-    });
-  });
 
-  describe('n+ more label', () => {
-    beforeEach(() => {
-      createComponent({
-        users: UsersMockHelper.createNumberRandomUsers(DEFAULT_RENDER_COUNT + 1),
+      it('shows truncated users', () => {
+        expect(wrapper.findAll(AssigneeAvatarLink).length).toBe(DEFAULT_RENDER_COUNT);
       });
-    });
 
-    it('shows "+1 more" label', () => {
-      expect(findMoreButton().text()).toBe('+ 1 more');
-      expect(wrapper.findAll(AssigneeAvatarLink).length).toBe(DEFAULT_RENDER_COUNT);
-    });
+      describe('when more button is clicked', () => {
+        beforeEach(() => {
+          findMoreButton().trigger('click');
+
+          return wrapper.vm.$nextTick();
+        });
 
-    it('shows "show less" label', done => {
-      findMoreButton().trigger('click');
+        it('shows "show less" label', () => {
+          expect(findMoreButton().text()).toBe('- show less');
+        });
 
-      Vue.nextTick(() => {
-        expect(findMoreButton().text()).toBe('- show less');
-        expect(wrapper.findAll(AssigneeAvatarLink).length).toBe(DEFAULT_RENDER_COUNT + 1);
-        done();
+        it('shows all users', () => {
+          expect(wrapper.findAll(AssigneeAvatarLink).length).toBe(DEFAULT_RENDER_COUNT + 1);
+        });
       });
     });
   });
diff --git a/spec/javascripts/sidebar/assignees_spec.js b/spec/javascripts/sidebar/assignees_spec.js
index fc731e731ae..a1df5389a38 100644
--- a/spec/javascripts/sidebar/assignees_spec.js
+++ b/spec/javascripts/sidebar/assignees_spec.js
@@ -224,7 +224,6 @@ describe('Assignee component', () => {
 
       expect(userItems.length).toBe(3);
       expect(userItems[0].dataset.originalTitle).toBe(users[2].name);
-      expect(userItems[0].dataset.originalTitle).not.toBe(users[0].name);
     });
 
     it('passes the sorted assignees to the collapsed-assignee-list', () => {
@@ -244,7 +243,6 @@ describe('Assignee component', () => {
       const collapsedButton = component.$el.querySelector('.sidebar-collapsed-user button');
 
       expect(collapsedButton.innerText.trim()).toBe(users[2].name);
-      expect(collapsedButton.innerText.trim()).not.toBe(users[0].name);
     });
   });
 });
diff --git a/spec/javascripts/sidebar/mock_data.js b/spec/javascripts/sidebar/mock_data.js
index 107acead3c6..7f20b0da991 100644
--- a/spec/javascripts/sidebar/mock_data.js
+++ b/spec/javascripts/sidebar/mock_data.js
@@ -1,13 +1,3 @@
-export const userDataMock = {
-  avatar_url: 'mock_path',
-  id: 1,
-  name: 'Root',
-  state: 'active',
-  username: 'root',
-  web_url: '',
-  can_merge: true,
-};
-
 const RESPONSE_MAP = {
   GET: {
     '/gitlab-org/gitlab-shell/issues/5.json': {
-- 
cgit v1.2.1


From e4c44b089b58d010fe8e05dbc76acbc68720ae43 Mon Sep 17 00:00:00 2001
From: Paul Slaughter <pslaughter@gitlab.com>
Date: Tue, 20 Aug 2019 13:34:36 -0500
Subject: Fix tooltip alignment issue caused by flex-basis

**Context:**
https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/14851#note_205954645
---
 .../sidebar/components/assignees/assignee_avatar_link.vue | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/app/assets/javascripts/sidebar/components/assignees/assignee_avatar_link.vue b/app/assets/javascripts/sidebar/components/assignees/assignee_avatar_link.vue
index 6563d1d3410..6633a63d046 100644
--- a/app/assets/javascripts/sidebar/components/assignees/assignee_avatar_link.vue
+++ b/app/assets/javascripts/sidebar/components/assignees/assignee_avatar_link.vue
@@ -67,8 +67,17 @@ export default {
 </script>
 
 <template>
-  <gl-link v-gl-tooltip="tooltipOption" :href="assigneeUrl" :title="tooltipTitle" class="d-flex">
-    <assignee-avatar :user="user" :img-size="32" :issuable-type="issuableType" />
-    <slot :user="user"></slot>
+  <!-- must be `d-inline-block` or parent flex-basis causes width issues -->
+  <gl-link
+    v-gl-tooltip="tooltipOption"
+    :href="assigneeUrl"
+    :title="tooltipTitle"
+    class="d-inline-block"
+  >
+    <!-- use d-flex so that slot can be appropriately styled -->
+    <span class="d-flex">
+      <assignee-avatar :user="user" :img-size="32" :issuable-type="issuableType" />
+      <slot :user="user"></slot>
+    </span>
   </gl-link>
 </template>
-- 
cgit v1.2.1


From 6f00586e4c366e7a7a4760a7e3e8bcdce5c17a94 Mon Sep 17 00:00:00 2001
From: Samantha Ming <sming@gitlab.com>
Date: Tue, 20 Aug 2019 20:18:06 +0000
Subject: Add syntax highlighting for line expansion

- dark
- white
- monokai
- none
- solarized-dark
- solarized-light
---
 .../diffs/components/diff_expansion_cell.vue           |  6 +++---
 app/assets/stylesheets/highlight/common.scss           | 13 +++++++++++++
 app/assets/stylesheets/highlight/themes/dark.scss      |  4 ++++
 app/assets/stylesheets/highlight/themes/monokai.scss   |  4 ++++
 app/assets/stylesheets/highlight/themes/none.scss      |  5 ++++-
 .../stylesheets/highlight/themes/solarized-dark.scss   |  4 ++++
 .../stylesheets/highlight/themes/solarized-light.scss  |  4 ++++
 app/assets/stylesheets/highlight/white_base.scss       | 18 +-----------------
 ...6066-dark-theme-style-for-expansion-on-mr-diffs.yml |  5 +++++
 9 files changed, 42 insertions(+), 21 deletions(-)
 create mode 100644 changelogs/unreleased/66066-dark-theme-style-for-expansion-on-mr-diffs.yml

diff --git a/app/assets/javascripts/diffs/components/diff_expansion_cell.vue b/app/assets/javascripts/diffs/components/diff_expansion_cell.vue
index 43edc116ed1..839ab542377 100644
--- a/app/assets/javascripts/diffs/components/diff_expansion_cell.vue
+++ b/app/assets/javascripts/diffs/components/diff_expansion_cell.vue
@@ -212,12 +212,12 @@ export default {
 </script>
 
 <template>
-  <td :colspan="colspan">
+  <td :colspan="colspan" class="text-center">
     <div class="content js-line-expansion-content">
       <a
         v-if="canExpandUp"
         v-tooltip
-        class="cursor-pointer js-unfold unfold-icon"
+        class="cursor-pointer js-unfold unfold-icon d-inline-block pt-2 pb-2"
         data-placement="top"
         data-container="body"
         :title="__('Expand up')"
@@ -231,7 +231,7 @@ export default {
       <a
         v-if="canExpandDown"
         v-tooltip
-        class="cursor-pointer js-unfold-down has-tooltip unfold-icon"
+        class="cursor-pointer js-unfold-down has-tooltip unfold-icon d-inline-block pt-2 pb-2"
         data-placement="top"
         data-container="body"
         :title="__('Expand down')"
diff --git a/app/assets/stylesheets/highlight/common.scss b/app/assets/stylesheets/highlight/common.scss
index ac3214a07d9..bdeac7e97c0 100644
--- a/app/assets/stylesheets/highlight/common.scss
+++ b/app/assets/stylesheets/highlight/common.scss
@@ -16,3 +16,16 @@
   color: $dark-diff-match-bg;
   background: $dark-diff-match-color;
 }
+
+@mixin diff-expansion($background, $border, $link) {
+  background-color: $background;
+
+  td {
+    border-top: 1px solid $border;
+    border-bottom: 1px solid $border;
+  }
+
+  a {
+    color: $link;
+  }
+}
diff --git a/app/assets/stylesheets/highlight/themes/dark.scss b/app/assets/stylesheets/highlight/themes/dark.scss
index 16893dd047e..cbce0ba3f1e 100644
--- a/app/assets/stylesheets/highlight/themes/dark.scss
+++ b/app/assets/stylesheets/highlight/themes/dark.scss
@@ -111,6 +111,10 @@ $dark-il: #de935f;
     color: $dark-line-color;
   }
 
+  .line_expansion {
+    @include diff-expansion($dark-main-bg, $dark-border, $dark-na);
+  }
+
   // Diff line
   .line_holder {
     &.match .line_content,
diff --git a/app/assets/stylesheets/highlight/themes/monokai.scss b/app/assets/stylesheets/highlight/themes/monokai.scss
index 37fe61b925c..1b61ffa37e3 100644
--- a/app/assets/stylesheets/highlight/themes/monokai.scss
+++ b/app/assets/stylesheets/highlight/themes/monokai.scss
@@ -111,6 +111,10 @@ $monokai-gi: #a6e22e;
     color: $monokai-text-color;
   }
 
+  .line_expansion {
+    @include diff-expansion($monokai-bg, $monokai-border, $monokai-k);
+  }
+
   // Diff line
   .line_holder {
     &.match .line_content,
diff --git a/app/assets/stylesheets/highlight/themes/none.scss b/app/assets/stylesheets/highlight/themes/none.scss
index b4217aac37a..a7ede266fb5 100644
--- a/app/assets/stylesheets/highlight/themes/none.scss
+++ b/app/assets/stylesheets/highlight/themes/none.scss
@@ -34,8 +34,11 @@
     color: $gl-text-color;
   }
 
-// Diff line
+  .line_expansion {
+    @include diff-expansion($gray-light, $white-normal, $gl-text-color);
+  }
 
+  // Diff line
   $none-over-bg: #ded7fc;
   $none-expanded-border: #e0e0e0;
   $none-expanded-bg: #e0e0e0;
diff --git a/app/assets/stylesheets/highlight/themes/solarized-dark.scss b/app/assets/stylesheets/highlight/themes/solarized-dark.scss
index a4e9eda22c9..6569f3abc8b 100644
--- a/app/assets/stylesheets/highlight/themes/solarized-dark.scss
+++ b/app/assets/stylesheets/highlight/themes/solarized-dark.scss
@@ -115,6 +115,10 @@ $solarized-dark-il: #2aa198;
     color: $solarized-dark-pre-color;
   }
 
+  .line_expansion {
+    @include diff-expansion($solarized-dark-line-bg, $solarized-dark-border, $solarized-dark-kd);
+  }
+
   // Diff line
   .line_holder {
     &.match .line_content,
diff --git a/app/assets/stylesheets/highlight/themes/solarized-light.scss b/app/assets/stylesheets/highlight/themes/solarized-light.scss
index b604d1ccb6c..4e74a9ea50a 100644
--- a/app/assets/stylesheets/highlight/themes/solarized-light.scss
+++ b/app/assets/stylesheets/highlight/themes/solarized-light.scss
@@ -122,6 +122,10 @@ $solarized-light-il: #2aa198;
     color: $solarized-light-pre-color;
   }
 
+  .line_expansion {
+    @include diff-expansion($solarized-light-line-bg, $solarized-light-border, $solarized-light-kd);
+  }
+
   // Diff line
   .line_holder {
     &.match .line_content,
diff --git a/app/assets/stylesheets/highlight/white_base.scss b/app/assets/stylesheets/highlight/white_base.scss
index b3974df8639..973f94c63aa 100644
--- a/app/assets/stylesheets/highlight/white_base.scss
+++ b/app/assets/stylesheets/highlight/white_base.scss
@@ -101,24 +101,8 @@ pre.code,
   color: $white-code-color;
 }
 
-// Expansion line
 .line_expansion {
-  background-color: $gray-light;
-
-  td {
-    border-top: 1px solid $border-color;
-    border-bottom: 1px solid $border-color;
-    text-align: center;
-  }
-
-  a {
-    color: $blue-600;
-  }
-
-  .unfold-icon {
-    display: inline-block;
-    padding: 8px 0;
-  }
+  @include diff-expansion($gray-light, $border-color, $blue-600);
 }
 
 // Diff line
diff --git a/changelogs/unreleased/66066-dark-theme-style-for-expansion-on-mr-diffs.yml b/changelogs/unreleased/66066-dark-theme-style-for-expansion-on-mr-diffs.yml
new file mode 100644
index 00000000000..13607ae938a
--- /dev/null
+++ b/changelogs/unreleased/66066-dark-theme-style-for-expansion-on-mr-diffs.yml
@@ -0,0 +1,5 @@
+---
+title: Add syntax highlighting for line expansion
+merge_request: 31821
+author:
+type: fixed
-- 
cgit v1.2.1


From 289576ccbad15a59cb12fe84afd54ff7b4e43dca Mon Sep 17 00:00:00 2001
From: Lucy Fox <lucy@afox.org>
Date: Tue, 20 Aug 2019 20:50:59 +0000
Subject: Remove margin from user header buttons

---
 app/assets/stylesheets/framework/header.scss             | 2 --
 app/views/layouts/header/_default.html.haml              | 7 ++++---
 changelogs/unreleased/remove-margin-from-user-header.yml | 5 +++++
 3 files changed, 9 insertions(+), 5 deletions(-)
 create mode 100644 changelogs/unreleased/remove-margin-from-user-header.yml

diff --git a/app/assets/stylesheets/framework/header.scss b/app/assets/stylesheets/framework/header.scss
index 1bc597bd4ae..ca737c53318 100644
--- a/app/assets/stylesheets/framework/header.scss
+++ b/app/assets/stylesheets/framework/header.scss
@@ -131,7 +131,6 @@
       > li:not(.d-none) a {
         @include media-breakpoint-down(xs) {
           margin-left: 0;
-          min-width: 100%;
         }
       }
     }
@@ -233,7 +232,6 @@
       .impersonation-btn,
       .impersonation-btn:hover {
         background-color: $white-light;
-        margin-left: 0;
         border-top-left-radius: 0;
         border-bottom-left-radius: 0;
 
diff --git a/app/views/layouts/header/_default.html.haml b/app/views/layouts/header/_default.html.haml
index 89f99472270..14c7b2428b2 100644
--- a/app/views/layouts/header/_default.html.haml
+++ b/app/views/layouts/header/_default.html.haml
@@ -4,6 +4,7 @@
   - search_path_url = search_path(group_id: group.id)
 - else
   - search_path_url = search_path
+- has_impersonation_link = header_link?(:admin_impersonation)
 
 %header.navbar.navbar-gitlab.navbar-expand-sm.js-navbar{ data: { qa_selector: 'navbar' } }
   %a.sr-only.gl-accessibility{ href: "#content-body", tabindex: "1" } Skip to content
@@ -64,14 +65,14 @@
             .dropdown-menu.dropdown-menu-right
               = render 'layouts/header/help_dropdown'
           - if header_link?(:user_dropdown)
-            %li.nav-item.header-user.dropdown{ data: { track_label: "profile_dropdown", track_event: "click_dropdown", track_value: "", qa_selector: 'user_menu' } }
+            %li.nav-item.header-user.dropdown{ data: { track_label: "profile_dropdown", track_event: "click_dropdown", track_value: "", qa_selector: 'user_menu' }, class: ('mr-0' if has_impersonation_link) }
               = link_to current_user, class: user_dropdown_class, data: { toggle: "dropdown" } do
                 = image_tag avatar_icon_for_user(current_user, 23), width: 23, height: 23, class: "header-user-avatar qa-user-avatar"
                 = sprite_icon('angle-down', css_class: 'caret-down')
               .dropdown-menu.dropdown-menu-right
                 = render 'layouts/header/current_user_dropdown'
-          - if header_link?(:admin_impersonation)
-            %li.nav-item.impersonation
+          - if has_impersonation_link
+            %li.nav-item.impersonation.ml-0
               = link_to admin_impersonation_path, class: 'nav-link impersonation-btn', method: :delete, title: _('Stop impersonation'), aria: { label: _('Stop impersonation') }, data: { toggle: 'tooltip', placement: 'bottom', container: 'body' } do
                 = icon('user-secret')
           - if header_link?(:sign_in)
diff --git a/changelogs/unreleased/remove-margin-from-user-header.yml b/changelogs/unreleased/remove-margin-from-user-header.yml
new file mode 100644
index 00000000000..31200d13c93
--- /dev/null
+++ b/changelogs/unreleased/remove-margin-from-user-header.yml
@@ -0,0 +1,5 @@
+---
+title: Remove margin from user header
+merge_request: 30878
+author: lucyfox
+type: fixed
-- 
cgit v1.2.1


From 2d1014713c23d5454bcc06110fd7e1bf6b39eb9c Mon Sep 17 00:00:00 2001
From: Enrique Alcantara <ealcantara@gitlab.com>
Date: Tue, 20 Aug 2019 17:07:29 -0400
Subject: Fix serverless entry page layout

---
 app/views/projects/serverless/functions/index.html.haml | 2 +-
 changelogs/unreleased/64764-fix-serverless-layout.yml   | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/64764-fix-serverless-layout.yml

diff --git a/app/views/projects/serverless/functions/index.html.haml b/app/views/projects/serverless/functions/index.html.haml
index 9c69aedfbfc..bac6c76684b 100644
--- a/app/views/projects/serverless/functions/index.html.haml
+++ b/app/views/projects/serverless/functions/index.html.haml
@@ -14,5 +14,5 @@
   .js-serverless-functions-notice
     .flash-container
 
-  .top-area.adjust
+  .top-area.adjust.d-flex.justify-content-center
     .serverless-functions-table#js-serverless-functions
diff --git a/changelogs/unreleased/64764-fix-serverless-layout.yml b/changelogs/unreleased/64764-fix-serverless-layout.yml
new file mode 100644
index 00000000000..9717062df93
--- /dev/null
+++ b/changelogs/unreleased/64764-fix-serverless-layout.yml
@@ -0,0 +1,5 @@
+---
+title: Fix serverless entry page layout
+merge_request: 32029
+author:
+type: fixed
-- 
cgit v1.2.1


From 93a618f0e54b5ae28f7525b8861763130c692415 Mon Sep 17 00:00:00 2001
From: Luke Duncalfe <lduncalfe@eml.cc>
Date: Thu, 1 Aug 2019 17:54:52 +1200
Subject: New wiki page redirects user to random slug

Previously we asked a user to enter a new slug before taking them to
the Create Page page.

As a UX improvement, we now take them to a randomly generated URI so
they can begin creating their new page.

https://gitlab.com/gitlab-org/gitlab-ce/issues/46299
---
 .../javascripts/pages/projects/wikis/wikis.js      | 42 +++++-----
 app/controllers/projects/wikis_controller.rb       | 31 ++++++--
 app/models/project_wiki.rb                         |  4 +
 app/views/projects/wikis/_form.html.haml           | 18 +++--
 app/views/projects/wikis/_main_links.html.haml     |  6 +-
 app/views/projects/wikis/_new.html.haml            | 18 -----
 app/views/projects/wikis/_sidebar.html.haml        |  2 -
 app/views/projects/wikis/edit.html.haml            | 11 +--
 changelogs/unreleased/46299-wiki-page-creation.yml |  5 ++
 config/routes/wiki.rb                              |  1 +
 doc/user/project/wiki/index.md                     |  9 ++-
 locale/gitlab.pot                                  | 18 ++---
 spec/controllers/projects/wikis_controller_spec.rb | 77 +++++++++++++-----
 .../projects/wiki/markdown_preview_spec.rb         | 93 +++++++---------------
 .../projects/wiki/user_creates_wiki_page_spec.rb   | 68 ++++++----------
 .../projects/wiki/user_updates_wiki_page_spec.rb   | 16 +++-
 .../projects/wiki/user_views_wiki_page_spec.rb     |  5 +-
 spec/frontend/wikis_spec.js                        | 74 +++++++++++++++++
 18 files changed, 287 insertions(+), 211 deletions(-)
 delete mode 100644 app/views/projects/wikis/_new.html.haml
 create mode 100644 changelogs/unreleased/46299-wiki-page-creation.yml
 create mode 100644 spec/frontend/wikis_spec.js

diff --git a/app/assets/javascripts/pages/projects/wikis/wikis.js b/app/assets/javascripts/pages/projects/wikis/wikis.js
index 9b58d42b47d..d41199f6374 100644
--- a/app/assets/javascripts/pages/projects/wikis/wikis.js
+++ b/app/assets/javascripts/pages/projects/wikis/wikis.js
@@ -1,6 +1,5 @@
 import bp from '../../../breakpoints';
-import { parseQueryStringIntoObject } from '../../../lib/utils/common_utils';
-import { mergeUrlParams, redirectTo } from '../../../lib/utils/url_utility';
+import { s__, sprintf } from '~/locale';
 
 export default class Wikis {
   constructor() {
@@ -12,32 +11,37 @@ export default class Wikis {
       sidebarToggles[i].addEventListener('click', e => this.handleToggleSidebar(e));
     }
 
-    this.newWikiForm = document.querySelector('form.new-wiki-page');
-    if (this.newWikiForm) {
-      this.newWikiForm.addEventListener('submit', e => this.handleNewWikiSubmit(e));
+    this.isNewWikiPage = Boolean(document.querySelector('.js-new-wiki-page'));
+    this.editTitleInput = document.querySelector('form.wiki-form #wiki_title');
+    this.commitMessageInput = document.querySelector('form.wiki-form #wiki_message');
+    this.commitMessageI18n = this.isNewWikiPage
+      ? s__('WikiPageCreate|Create %{pageTitle}')
+      : s__('WikiPageEdit|Update %{pageTitle}');
+
+    if (this.editTitleInput) {
+      // Initialize the commit message on load
+      if (this.editTitleInput.value) this.setWikiCommitMessage(this.editTitleInput.value);
+
+      // Set the commit message as the page title is changed
+      this.editTitleInput.addEventListener('keyup', e => this.handleWikiTitleChange(e));
     }
 
     window.addEventListener('resize', () => this.renderSidebar());
     this.renderSidebar();
   }
 
-  handleNewWikiSubmit(e) {
-    if (!this.newWikiForm) return;
-
-    const slugInput = this.newWikiForm.querySelector('#new_wiki_path');
-
-    const slug = slugInput.value;
+  handleWikiTitleChange(e) {
+    this.setWikiCommitMessage(e.target.value);
+  }
 
-    if (slug.length > 0) {
-      const wikisPath = slugInput.getAttribute('data-wikis-path');
+  setWikiCommitMessage(rawTitle) {
+    let title = rawTitle;
 
-      // If the wiki is empty, we need to merge the current URL params to keep the "create" view.
-      const params = parseQueryStringIntoObject(window.location.search.substr(1));
-      const url = mergeUrlParams(params, `${wikisPath}/${slug}`);
-      redirectTo(url);
+    // Replace hyphens with spaces
+    if (title) title = title.replace(/-+/g, ' ');
 
-      e.preventDefault();
-    }
+    const newCommitMessage = sprintf(this.commitMessageI18n, { pageTitle: title });
+    this.commitMessageInput.value = newCommitMessage;
   }
 
   handleToggleSidebar(e) {
diff --git a/app/controllers/projects/wikis_controller.rb b/app/controllers/projects/wikis_controller.rb
index d1914c35bd3..b187fdb2723 100644
--- a/app/controllers/projects/wikis_controller.rb
+++ b/app/controllers/projects/wikis_controller.rb
@@ -16,6 +16,10 @@ class Projects::WikisController < Projects::ApplicationController
     redirect_to(project_wiki_path(@project, @page))
   end
 
+  def new
+    redirect_to project_wiki_path(@project, SecureRandom.uuid, random_title: true)
+  end
+
   def pages
     @wiki_pages = Kaminari.paginate_array(
       @project_wiki.list_pages(sort: params[:sort], direction: params[:direction])
@@ -24,17 +28,25 @@ class Projects::WikisController < Projects::ApplicationController
     @wiki_entries = WikiPage.group_by_directory(@wiki_pages)
   end
 
+  # `#show` handles a number of scenarios:
+  #
+  # - If `id` matches a WikiPage, then show the wiki page.
+  # - If `id` is a file in the wiki repository, then send the file.
+  # - If we know the user wants to create a new page with the given `id`,
+  #   then display a create form.
+  # - Otherwise show the empty wiki page and invite the user to create a page.
   def show
-    view_param = @project_wiki.empty? ? params[:view] : 'create'
-
     if @page
       set_encoding_error unless valid_encoding?
 
       render 'show'
     elsif file_blob
       send_blob(@project_wiki.repository, file_blob)
-    elsif can?(current_user, :create_wiki, @project) && view_param == 'create'
-      @page = build_page(title: params[:id])
+    elsif show_create_form?
+      # Assign a title to the WikiPage unless `id` is a randomly generated slug from #new
+      title = params[:id] unless params[:random_title].present?
+
+      @page = build_page(title: title)
 
       render 'edit'
     else
@@ -110,6 +122,15 @@ class Projects::WikisController < Projects::ApplicationController
 
   private
 
+  def show_create_form?
+    can?(current_user, :create_wiki, @project) &&
+      @page.nil? &&
+      # Always show the create form when the wiki has had at least one page created.
+      # Otherwise, we only show the form when the user has navigated from
+      # the 'empty wiki' page
+      (@project_wiki.exists? || params[:view] == 'create')
+  end
+
   def load_project_wiki
     @project_wiki = load_wiki
 
@@ -135,7 +156,7 @@ class Projects::WikisController < Projects::ApplicationController
     params.require(:wiki).permit(:title, :content, :format, :message, :last_commit_sha)
   end
 
-  def build_page(args)
+  def build_page(args = {})
     WikiPage.new(@project_wiki).tap do |page|
       page.update_attributes(args) # rubocop:disable Rails/ActiveRecordAliases
     end
diff --git a/app/models/project_wiki.rb b/app/models/project_wiki.rb
index c91add6439f..4a19e05bf76 100644
--- a/app/models/project_wiki.rb
+++ b/app/models/project_wiki.rb
@@ -85,6 +85,10 @@ class ProjectWiki
     list_pages(limit: 1).empty?
   end
 
+  def exists?
+    !empty?
+  end
+
   # Lists wiki pages of the repository.
   #
   # limit - max number of pages returned by the method.
diff --git a/app/views/projects/wikis/_form.html.haml b/app/views/projects/wikis/_form.html.haml
index 858731b2dda..a153f527ee0 100644
--- a/app/views/projects/wikis/_form.html.haml
+++ b/app/views/projects/wikis/_form.html.haml
@@ -1,8 +1,8 @@
-- commit_message = @page.persisted? ? s_("WikiPageEdit|Update %{page_title}") : s_("WikiPageCreate|Create %{page_title}")
-- commit_message = commit_message % { page_title: @page.title }
+- form_classes = 'wiki-form common-note-form prepend-top-default js-quick-submit'
+- form_classes += ' js-new-wiki-page' unless @page.persisted?
 
 = form_for [@project.namespace.becomes(Namespace), @project, @page], method: @page.persisted? ? :put : :post,
-           html: { class: 'wiki-form common-note-form prepend-top-default js-quick-submit' },
+           html: { class: form_classes },
            data: { uploads_path: uploads_path } do |f|
   = form_errors(@page)
 
@@ -12,12 +12,14 @@
   .form-group.row
     .col-sm-12= f.label :title, class: 'control-label-full-width'
     .col-sm-12
-      = f.text_field :title, class: 'form-control qa-wiki-title-textbox', value: @page.title
-      - if @page.persisted?
-        %span.d-inline-block.mw-100.prepend-top-5
-          = icon('lightbulb-o')
+      = f.text_field :title, class: 'form-control qa-wiki-title-textbox', value: @page.title, required: true, autofocus: !@page.persisted?, placeholder: _('Wiki|Page title')
+      %span.d-inline-block.mw-100.prepend-top-5
+        = icon('lightbulb-o')
+        - if @page.persisted?
           = s_("WikiEditPageTip|Tip: You can move this page by adding the path to the beginning of the title.")
           = link_to icon('question-circle'), help_page_path('user/project/wiki/index', anchor: 'moving-a-wiki-page'), target: '_blank'
+        - else
+          = s_("WikiNewPageTip|Tip: You can specify the full path for the new file. We will automatically create any missing directories.")
   .form-group.row
     .col-sm-12= f.label :format, class: 'control-label-full-width'
     .col-sm-12
@@ -43,7 +45,7 @@
 
   .form-group.row
     .col-sm-12= f.label :commit_message, class: 'control-label-full-width'
-    .col-sm-12= f.text_field :message, class: 'form-control qa-wiki-message-textbox', rows: 18, value: commit_message
+    .col-sm-12= f.text_field :message, class: 'form-control qa-wiki-message-textbox', rows: 18, value: nil
 
   .form-actions
     - if @page && @page.persisted?
diff --git a/app/views/projects/wikis/_main_links.html.haml b/app/views/projects/wikis/_main_links.html.haml
index 643b51e01d1..2e1e176c42a 100644
--- a/app/views/projects/wikis/_main_links.html.haml
+++ b/app/views/projects/wikis/_main_links.html.haml
@@ -1,9 +1,9 @@
 - if (@page && @page.persisted?)
   - if can?(current_user, :create_wiki, @project)
-    = link_to '#modal-new-wiki', class: "add-new-wiki btn btn-success", "data-toggle" => "modal" do
+    = link_to project_wikis_new_path(@project), class: "add-new-wiki btn btn-success", role: "button" do
       = s_("Wiki|New page")
-  = link_to project_wiki_history_path(@project, @page), class: "btn" do
+  = link_to project_wiki_history_path(@project, @page), class: "btn", role: "button" do
     = s_("Wiki|Page history")
   - if can?(current_user, :create_wiki, @project) && @page.latest? && @valid_encoding
-    = link_to project_wiki_edit_path(@project, @page), class: "btn js-wiki-edit" do
+    = link_to project_wiki_edit_path(@project, @page), class: "btn js-wiki-edit", role: "button" do
       = _("Edit")
diff --git a/app/views/projects/wikis/_new.html.haml b/app/views/projects/wikis/_new.html.haml
deleted file mode 100644
index 2c675c0de9c..00000000000
--- a/app/views/projects/wikis/_new.html.haml
+++ /dev/null
@@ -1,18 +0,0 @@
-#modal-new-wiki.modal
-  .modal-dialog
-    .modal-content
-      .modal-header
-        %h3.page-title= s_("WikiNewPageTitle|New Wiki Page")
-        %button.close{ type: "button", "data-dismiss": "modal", "aria-label" => _('Close') }
-          %span{ "aria-hidden": true } &times;
-      .modal-body
-        %form.new-wiki-page
-          .form-group
-            = label_tag :new_wiki_path do
-              %span= s_("WikiPage|Page slug")
-            = text_field_tag :new_wiki_path, nil, placeholder: s_("WikiNewPagePlaceholder|how-to-setup"), class: 'form-control', required: true, :'data-wikis-path' => project_wikis_path(@project), autofocus: true
-            %span.d-inline-block.mw-100.prepend-top-5
-              = icon('lightbulb-o')
-              = s_("WikiNewPageTip|Tip: You can specify the full path for the new file. We will automatically create any missing directories.")
-          .form-actions
-            = button_tag s_("Wiki|Create page"), class: "build-new-wiki btn btn-success"
diff --git a/app/views/projects/wikis/_sidebar.html.haml b/app/views/projects/wikis/_sidebar.html.haml
index 28353927135..a9d21470944 100644
--- a/app/views/projects/wikis/_sidebar.html.haml
+++ b/app/views/projects/wikis/_sidebar.html.haml
@@ -19,5 +19,3 @@
       .block
         = link_to project_wikis_pages_path(@project), class: 'btn btn-block' do
           = s_("Wiki|More Pages")
-
-= render 'projects/wikis/new'
diff --git a/app/views/projects/wikis/edit.html.haml b/app/views/projects/wikis/edit.html.haml
index e8b59a3b8c4..815b4a51261 100644
--- a/app/views/projects/wikis/edit.html.haml
+++ b/app/views/projects/wikis/edit.html.haml
@@ -13,14 +13,11 @@
     %h2.wiki-page-title
       - if @page.persisted?
         = link_to @page.human_title, project_wiki_path(@project, @page)
-      - else
-        = @page.human_title
-      %span.light
-        &middot;
-        - if @page.persisted?
+        %span.light
+          &middot;
           = s_("Wiki|Edit Page")
-        - else
-          = s_("Wiki|Create Page")
+      - else
+        = s_("Wiki|Create New Page")
 
   .nav-controls
     - if @page.persisted?
diff --git a/changelogs/unreleased/46299-wiki-page-creation.yml b/changelogs/unreleased/46299-wiki-page-creation.yml
new file mode 100644
index 00000000000..2e8f2accf45
--- /dev/null
+++ b/changelogs/unreleased/46299-wiki-page-creation.yml
@@ -0,0 +1,5 @@
+---
+title: Remove wiki page slug dialog step when creating wiki page
+merge_request: 31362
+author:
+type: changed
diff --git a/config/routes/wiki.rb b/config/routes/wiki.rb
index 2ca52e55fca..d439c99270e 100644
--- a/config/routes/wiki.rb
+++ b/config/routes/wiki.rb
@@ -2,6 +2,7 @@ scope(controller: :wikis) do
   scope(path: 'wikis', as: :wikis) do
     get :git_access
     get :pages
+    get :new
     get '/', to: redirect('%{namespace_id}/%{project_id}/wikis/home')
     post '/', to: 'wikis#create'
   end
diff --git a/doc/user/project/wiki/index.md b/doc/user/project/wiki/index.md
index e3c6cd6d6ff..d1bab47de25 100644
--- a/doc/user/project/wiki/index.md
+++ b/doc/user/project/wiki/index.md
@@ -28,11 +28,12 @@ NOTE: **Note:**
 Requires Developer [permissions](../../permissions.md).
 
 Create a new page by clicking the **New page** button that can be found
-in all wiki pages. You will be asked to fill in the page name from which GitLab
-will create the path to the page. You can specify a full path for the new file
-and any missing directories will be created automatically.
+in all wiki pages.
 
-![New page modal](img/wiki_create_new_page_modal.png)
+You will be asked to fill in a title for your new wiki page. Wiki titles
+also determine the path to the wiki page. You can specify a full path
+(using "`/`" for subdirectories) for the new title and any missing
+directories will be created automatically.
 
 Once you enter the page name, it's time to fill in its content. GitLab wikis
 support Markdown, RDoc and AsciiDoc. For Markdown based pages, all the
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 26e6cb524bd..89c3ffd004e 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -12888,15 +12888,9 @@ msgstr ""
 msgid "WikiMarkdownTip|To link to a (new) page, simply type %{link_example}"
 msgstr ""
 
-msgid "WikiNewPagePlaceholder|how-to-setup"
-msgstr ""
-
 msgid "WikiNewPageTip|Tip: You can specify the full path for the new file. We will automatically create any missing directories."
 msgstr ""
 
-msgid "WikiNewPageTitle|New Wiki Page"
-msgstr ""
-
 msgid "WikiPageConfirmDelete|Are you sure you want to delete this page?"
 msgstr ""
 
@@ -12912,19 +12906,16 @@ msgstr ""
 msgid "WikiPageConflictMessage|the page"
 msgstr ""
 
-msgid "WikiPageCreate|Create %{page_title}"
+msgid "WikiPageCreate|Create %{pageTitle}"
 msgstr ""
 
-msgid "WikiPageEdit|Update %{page_title}"
-msgstr ""
-
-msgid "WikiPage|Page slug"
+msgid "WikiPageEdit|Update %{pageTitle}"
 msgstr ""
 
 msgid "WikiPage|Write your content or drag files here…"
 msgstr ""
 
-msgid "Wiki|Create Page"
+msgid "Wiki|Create New Page"
 msgstr ""
 
 msgid "Wiki|Create page"
@@ -12945,6 +12936,9 @@ msgstr ""
 msgid "Wiki|Page history"
 msgstr ""
 
+msgid "Wiki|Page title"
+msgstr ""
+
 msgid "Wiki|Page version"
 msgstr ""
 
diff --git a/spec/controllers/projects/wikis_controller_spec.rb b/spec/controllers/projects/wikis_controller_spec.rb
index fbca1d5740f..6fea6bca4f2 100644
--- a/spec/controllers/projects/wikis_controller_spec.rb
+++ b/spec/controllers/projects/wikis_controller_spec.rb
@@ -3,11 +3,11 @@
 require 'spec_helper'
 
 describe Projects::WikisController do
-  let(:project) { create(:project, :public, :repository) }
-  let(:user) { project.owner }
+  set(:project) { create(:project, :public, :repository) }
+  set(:user) { project.owner }
   let(:project_wiki) { ProjectWiki.new(project, user) }
   let(:wiki) { project_wiki.wiki }
-  let(:wiki_title) { 'page-title-test' }
+  let(:wiki_title) { 'page title test' }
 
   before do
     create_page(wiki_title, 'hello world')
@@ -19,6 +19,21 @@ describe Projects::WikisController do
     destroy_page(wiki_title)
   end
 
+  describe 'GET #new' do
+    subject { get :new, params: { namespace_id: project.namespace, project_id: project } }
+
+    it 'redirects to #show and appends a `random_title` param' do
+      subject
+
+      expect(response).to have_http_status(302)
+      expect(Rails.application.routes.recognize_path(response.redirect_url)).to include(
+        controller: 'projects/wikis',
+        action: 'show'
+      )
+      expect(response.redirect_url).to match(/\?random_title=true\Z/)
+    end
+  end
+
   describe 'GET #pages' do
     subject { get :pages, params: { namespace_id: project.namespace, project_id: project, id: wiki_title } }
 
@@ -75,40 +90,62 @@ describe Projects::WikisController do
   describe 'GET #show' do
     render_views
 
-    subject { get :show, params: { namespace_id: project.namespace, project_id: project, id: wiki_title } }
+    let(:random_title) { nil }
 
-    it 'limits the retrieved pages for the sidebar' do
-      expect(controller).to receive(:load_wiki).and_return(project_wiki)
+    subject { get :show, params: { namespace_id: project.namespace, project_id: project, id: id, random_title: random_title } }
 
-      # empty? call
-      expect(project_wiki).to receive(:list_pages).with(limit: 1).and_call_original
-      # Sidebar entries
-      expect(project_wiki).to receive(:list_pages).with(limit: 15).and_call_original
+    context 'when page exists' do
+      let(:id) { wiki_title }
 
-      subject
+      it 'limits the retrieved pages for the sidebar' do
+        expect(controller).to receive(:load_wiki).and_return(project_wiki)
+        expect(project_wiki).to receive(:list_pages).with(limit: 15).and_call_original
+
+        subject
+
+        expect(response).to have_http_status(:ok)
+        expect(assigns(:page).title).to eq(wiki_title)
+      end
+
+      context 'when page content encoding is invalid' do
+        it 'sets flash error' do
+          allow(controller).to receive(:valid_encoding?).and_return(false)
 
-      expect(response).to have_http_status(:ok)
-      expect(response.body).to include(wiki_title)
+          subject
+
+          expect(response).to have_http_status(:ok)
+          expect(flash[:notice]).to eq('The content of this page is not encoded in UTF-8. Edits can only be made via the Git repository.')
+        end
+      end
     end
 
-    context 'when page content encoding is invalid' do
-      it 'sets flash error' do
-        allow(controller).to receive(:valid_encoding?).and_return(false)
+    context 'when the page does not exist' do
+      let(:id) { 'does not exist' }
 
+      before do
         subject
+      end
 
-        expect(response).to have_http_status(:ok)
-        expect(flash[:notice]).to eq 'The content of this page is not encoded in UTF-8. Edits can only be made via the Git repository.'
+      it 'builds a new wiki page with the id as the title' do
+        expect(assigns(:page).title).to eq(id)
+      end
+
+      context 'when a random_title param is present' do
+        let(:random_title) { true }
+
+        it 'builds a new wiki page with no title' do
+          expect(assigns(:page).title).to be_empty
+        end
       end
     end
 
     context 'when page is a file' do
       include WikiHelpers
 
-      let(:path) { upload_file_to_wiki(project, user, file_name) }
+      let(:id) { upload_file_to_wiki(project, user, file_name) }
 
       before do
-        get :show, params: { namespace_id: project.namespace, project_id: project, id: path }
+        subject
       end
 
       context 'when file is an image' do
diff --git a/spec/features/projects/wiki/markdown_preview_spec.rb b/spec/features/projects/wiki/markdown_preview_spec.rb
index 7b511c4d3d5..5c6b04a7141 100644
--- a/spec/features/projects/wiki/markdown_preview_spec.rb
+++ b/spec/features/projects/wiki/markdown_preview_spec.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 describe 'Projects > Wiki > User previews markdown changes', :js do
-  let(:user) { create(:user) }
+  set(:user) { create(:user) }
   let(:project) { create(:project, :wiki_repo, namespace: user.namespace) }
   let(:wiki_page) { create(:wiki_page, wiki: project.wiki, attrs: { title: 'home', content: '[some link](other-page)' }) }
   let(:wiki_content) do
@@ -20,23 +20,12 @@ describe 'Projects > Wiki > User previews markdown changes', :js do
     project.add_maintainer(user)
 
     sign_in(user)
-
-    visit project_wiki_path(project, wiki_page)
   end
 
   context "while creating a new wiki page" do
     context "when there are no spaces or hyphens in the page name" do
       it "rewrites relative links as expected" do
-        find('.add-new-wiki').click
-        page.within '#modal-new-wiki' do
-          fill_in :new_wiki_path, with: 'a/b/c/d'
-          click_button 'Create page'
-        end
-
-        page.within '.wiki-form' do
-          fill_in :wiki_content, with: wiki_content
-          click_on "Preview"
-        end
+        create_wiki_page('a/b/c/d', content: wiki_content)
 
         expect(page).to have_content("regular link")
 
@@ -50,16 +39,7 @@ describe 'Projects > Wiki > User previews markdown changes', :js do
 
     context "when there are spaces in the page name" do
       it "rewrites relative links as expected" do
-        click_link 'New page'
-        page.within '#modal-new-wiki' do
-          fill_in :new_wiki_path, with: 'a page/b page/c page/d page'
-          click_button 'Create page'
-        end
-
-        page.within '.wiki-form' do
-          fill_in :wiki_content, with: wiki_content
-          click_on "Preview"
-        end
+        create_wiki_page('a page/b page/c page/d page', content: wiki_content)
 
         expect(page).to have_content("regular link")
 
@@ -73,16 +53,7 @@ describe 'Projects > Wiki > User previews markdown changes', :js do
 
     context "when there are hyphens in the page name" do
       it "rewrites relative links as expected" do
-        click_link 'New page'
-        page.within '#modal-new-wiki' do
-          fill_in :new_wiki_path, with: 'a-page/b-page/c-page/d-page'
-          click_button 'Create page'
-        end
-
-        page.within '.wiki-form' do
-          fill_in :wiki_content, with: wiki_content
-          click_on "Preview"
-        end
+        create_wiki_page('a-page/b-page/c-page/d-page', content: wiki_content)
 
         expect(page).to have_content("regular link")
 
@@ -96,23 +67,9 @@ describe 'Projects > Wiki > User previews markdown changes', :js do
   end
 
   context "while editing a wiki page" do
-    def create_wiki_page(path)
-      find('.add-new-wiki').click
-
-      page.within '#modal-new-wiki' do
-        fill_in :new_wiki_path, with: path
-        click_button 'Create page'
-      end
-
-      page.within '.wiki-form' do
-        fill_in :wiki_content, with: 'content'
-        click_on "Create page"
-      end
-    end
-
     context "when there are no spaces or hyphens in the page name" do
       it "rewrites relative links as expected" do
-        create_wiki_page 'a/b/c/d'
+        create_wiki_page('a/b/c/d')
         click_link 'Edit'
 
         fill_in :wiki_content, with: wiki_content
@@ -130,7 +87,7 @@ describe 'Projects > Wiki > User previews markdown changes', :js do
 
     context "when there are spaces in the page name" do
       it "rewrites relative links as expected" do
-        create_wiki_page 'a page/b page/c page/d page'
+        create_wiki_page('a page/b page/c page/d page')
         click_link 'Edit'
 
         fill_in :wiki_content, with: wiki_content
@@ -148,7 +105,7 @@ describe 'Projects > Wiki > User previews markdown changes', :js do
 
     context "when there are hyphens in the page name" do
       it "rewrites relative links as expected" do
-        create_wiki_page 'a-page/b-page/c-page/d-page'
+        create_wiki_page('a-page/b-page/c-page/d-page')
         click_link 'Edit'
 
         fill_in :wiki_content, with: wiki_content
@@ -166,7 +123,7 @@ describe 'Projects > Wiki > User previews markdown changes', :js do
 
     context 'when rendering the preview' do
       it 'renders content with CommonMark' do
-        create_wiki_page 'a-page/b-page/c-page/common-mark'
+        create_wiki_page('a-page/b-page/c-page/common-mark')
         click_link 'Edit'
 
         fill_in :wiki_content, with: "1. one\n  - sublist\n"
@@ -180,25 +137,31 @@ describe 'Projects > Wiki > User previews markdown changes', :js do
   end
 
   it "does not linkify double brackets inside code blocks as expected" do
-    click_link 'New page'
-    page.within '#modal-new-wiki' do
-      fill_in :new_wiki_path, with: 'linkify_test'
-      click_button 'Create page'
-    end
+    wiki_content = <<-HEREDOC
+      `[[do_not_linkify]]`
+      ```
+      [[also_do_not_linkify]]
+      ```
+    HEREDOC
 
-    page.within '.wiki-form' do
-      fill_in :wiki_content, with: <<-HEREDOC
-        `[[do_not_linkify]]`
-        ```
-        [[also_do_not_linkify]]
-        ```
-      HEREDOC
-      click_on "Preview"
-    end
+    create_wiki_page('linkify_test', wiki_content)
 
     expect(page).to have_content("do_not_linkify")
 
     expect(page.html).to include('[[do_not_linkify]]')
     expect(page.html).to include('[[also_do_not_linkify]]')
   end
+
+  private
+
+  def create_wiki_page(path, content = 'content')
+    visit project_wiki_path(project, wiki_page)
+
+    click_link 'New page'
+
+    fill_in :wiki_title, with: path
+    fill_in :wiki_content, with: content
+
+    click_button 'Create page'
+  end
 end
diff --git a/spec/features/projects/wiki/user_creates_wiki_page_spec.rb b/spec/features/projects/wiki/user_creates_wiki_page_spec.rb
index cc6dbaa6eb8..56d0518015d 100644
--- a/spec/features/projects/wiki/user_creates_wiki_page_spec.rb
+++ b/spec/features/projects/wiki/user_creates_wiki_page_spec.rb
@@ -42,10 +42,10 @@ describe "User creates wiki page" do
 
         click_link("link test")
 
-        expect(page).to have_content("Create Page")
+        expect(page).to have_content("Create New Page")
       end
 
-      it "shows non-escaped link in the pages list", :js, :quarantine do
+      it "shows non-escaped link in the pages list", :quarantine do
         fill_in(:wiki_title, with: "one/two/three-test")
 
         page.within(".wiki-form") do
@@ -58,7 +58,9 @@ describe "User creates wiki page" do
         expect(page).to have_xpath("//a[@href='/#{project.full_path}/wikis/one/two/three-test']")
       end
 
-      it "has `Create home` as a commit message" do
+      it "has `Create home` as a commit message", :js do
+        wait_for_requests
+
         expect(page).to have_field("wiki[message]", with: "Create home")
       end
 
@@ -81,7 +83,7 @@ describe "User creates wiki page" do
         expect(current_path).to eq(project_wiki_path(project, "test"))
 
         page.within(:css, ".nav-text") do
-          expect(page).to have_content("test").and have_content("Create Page")
+          expect(page).to have_content("Create New Page")
         end
 
         click_link("Home")
@@ -93,7 +95,7 @@ describe "User creates wiki page" do
         expect(current_path).to eq(project_wiki_path(project, "api"))
 
         page.within(:css, ".nav-text") do
-          expect(page).to have_content("Create").and have_content("api")
+          expect(page).to have_content("Create")
         end
 
         click_link("Home")
@@ -105,7 +107,7 @@ describe "User creates wiki page" do
         expect(current_path).to eq(project_wiki_path(project, "raketasks"))
 
         page.within(:css, ".nav-text") do
-          expect(page).to have_content("Create").and have_content("rake")
+          expect(page).to have_content("Create")
         end
       end
 
@@ -150,6 +152,8 @@ describe "User creates wiki page" do
       let(:project) { create(:project, :wiki_repo, namespace: create(:group, :public)) }
 
       it "has `Create home` as a commit message" do
+        wait_for_requests
+
         expect(page).to have_field("wiki[message]", with: "Create home")
       end
 
@@ -181,20 +185,15 @@ describe "User creates wiki page" do
         it "creates a page with a single word" do
           click_link("New page")
 
-          page.within("#modal-new-wiki") do
-            fill_in(:new_wiki_path, with: "foo")
-
-            click_button("Create page")
+          page.within(".wiki-form") do
+            fill_in(:wiki_title, with: "foo")
+            fill_in(:wiki_content, with: "My awesome wiki!")
           end
 
           # Commit message field should have correct value.
           expect(page).to have_field("wiki[message]", with: "Create foo")
 
-          page.within(".wiki-form") do
-            fill_in(:wiki_content, with: "My awesome wiki!")
-
-            click_button("Create page")
-          end
+          click_button("Create page")
 
           expect(page).to have_content("foo")
                      .and have_content("Last edited by #{user.name}")
@@ -204,20 +203,15 @@ describe "User creates wiki page" do
         it "creates a page with spaces in the name" do
           click_link("New page")
 
-          page.within("#modal-new-wiki") do
-            fill_in(:new_wiki_path, with: "Spaces in the name")
-
-            click_button("Create page")
+          page.within(".wiki-form") do
+            fill_in(:wiki_title, with: "Spaces in the name")
+            fill_in(:wiki_content, with: "My awesome wiki!")
           end
 
           # Commit message field should have correct value.
           expect(page).to have_field("wiki[message]", with: "Create Spaces in the name")
 
-          page.within(".wiki-form") do
-            fill_in(:wiki_content, with: "My awesome wiki!")
-
-            click_button("Create page")
-          end
+          click_button("Create page")
 
           expect(page).to have_content("Spaces in the name")
                      .and have_content("Last edited by #{user.name}")
@@ -227,10 +221,9 @@ describe "User creates wiki page" do
         it "creates a page with hyphens in the name" do
           click_link("New page")
 
-          page.within("#modal-new-wiki") do
-            fill_in(:new_wiki_path, with: "hyphens-in-the-name")
-
-            click_button("Create page")
+          page.within(".wiki-form") do
+            fill_in(:wiki_title, with: "hyphens-in-the-name")
+            fill_in(:wiki_content, with: "My awesome wiki!")
           end
 
           # Commit message field should have correct value.
@@ -251,12 +244,6 @@ describe "User creates wiki page" do
       it "shows the emoji autocompletion dropdown" do
         click_link("New page")
 
-        page.within("#modal-new-wiki") do
-          fill_in(:new_wiki_path, with: "test-autocomplete")
-
-          click_button("Create page")
-        end
-
         page.within(".wiki-form") do
           find("#wiki_content").native.send_keys("")
 
@@ -274,20 +261,15 @@ describe "User creates wiki page" do
         it "creates a page" do
           click_link("New page")
 
-          page.within("#modal-new-wiki") do
-            fill_in(:new_wiki_path, with: "foo")
-
-            click_button("Create page")
+          page.within(".wiki-form") do
+            fill_in(:wiki_title, with: "foo")
+            fill_in(:wiki_content, with: "My awesome wiki!")
           end
 
           # Commit message field should have correct value.
           expect(page).to have_field("wiki[message]", with: "Create foo")
 
-          page.within(".wiki-form") do
-            fill_in(:wiki_content, with: "My awesome wiki!")
-
-            click_button("Create page")
-          end
+          click_button("Create page")
 
           expect(page).to have_content("foo")
                      .and have_content("Last edited by #{user.name}")
diff --git a/spec/features/projects/wiki/user_updates_wiki_page_spec.rb b/spec/features/projects/wiki/user_updates_wiki_page_spec.rb
index 2aab8fda62d..3f3711f9eb8 100644
--- a/spec/features/projects/wiki/user_updates_wiki_page_spec.rb
+++ b/spec/features/projects/wiki/user_updates_wiki_page_spec.rb
@@ -70,7 +70,7 @@ describe 'User updates wiki page' do
     context 'in a user namespace' do
       let(:project) { create(:project, :wiki_repo) }
 
-      it 'updates a page' do
+      it 'updates a page', :js do
         # Commit message field should have correct value.
         expect(page).to have_field('wiki[message]', with: 'Update home')
 
@@ -82,6 +82,18 @@ describe 'User updates wiki page' do
         expect(page).to have_content('My awesome wiki!')
       end
 
+      it 'updates the commit message as the title is changed', :js do
+        fill_in(:wiki_title, with: 'Wiki title')
+
+        expect(page).to have_field('wiki[message]', with: 'Update Wiki title')
+      end
+
+      it 'does not allow XSS', :js do
+        fill_in(:wiki_title, with: '<script>')
+
+        expect(page).to have_field('wiki[message]', with: 'Update &lt;script&gt;')
+      end
+
       it 'shows a validation error message' do
         fill_in(:wiki_content, with: '')
         click_button('Save changes')
@@ -129,7 +141,7 @@ describe 'User updates wiki page' do
     context 'in a group namespace' do
       let(:project) { create(:project, :wiki_repo, namespace: create(:group, :public)) }
 
-      it 'updates a page' do
+      it 'updates a page', :js do
         # Commit message field should have correct value.
         expect(page).to have_field('wiki[message]', with: 'Update home')
 
diff --git a/spec/features/projects/wiki/user_views_wiki_page_spec.rb b/spec/features/projects/wiki/user_views_wiki_page_spec.rb
index 05742b63c43..77e725e7f11 100644
--- a/spec/features/projects/wiki/user_views_wiki_page_spec.rb
+++ b/spec/features/projects/wiki/user_views_wiki_page_spec.rb
@@ -101,8 +101,7 @@ describe 'User views a wiki page' do
       click_on('image')
 
       expect(current_path).to match("wikis/#{path}")
-      expect(page).to have_content('New Wiki Page')
-      expect(page).to have_content('Create page')
+      expect(page).to have_content('Create New Page')
     end
   end
 
@@ -156,6 +155,6 @@ describe 'User views a wiki page' do
     find('.shortcuts-wiki').click
     click_link "Create your first page"
 
-    expect(page).to have_content('Home · Create Page')
+    expect(page).to have_content('Create New Page')
   end
 end
diff --git a/spec/frontend/wikis_spec.js b/spec/frontend/wikis_spec.js
new file mode 100644
index 00000000000..b2475488d97
--- /dev/null
+++ b/spec/frontend/wikis_spec.js
@@ -0,0 +1,74 @@
+import Wikis from '~/pages/projects/wikis/wikis';
+import { setHTMLFixture } from './helpers/fixtures';
+
+describe('Wikis', () => {
+  describe('setting the commit message when the title changes', () => {
+    const editFormHtmlFixture = args => `<form class="wiki-form ${
+      args.newPage ? 'js-new-wiki-page' : ''
+    }">
+        <input type="text" id="wiki_title" value="My title" />
+        <input type="text" id="wiki_message" />
+      </form>`;
+
+    let wikis;
+    let titleInput;
+    let messageInput;
+
+    describe('when the wiki page is being created', () => {
+      const formHtmlFixture = editFormHtmlFixture({ newPage: true });
+
+      beforeEach(() => {
+        setHTMLFixture(formHtmlFixture);
+
+        titleInput = document.getElementById('wiki_title');
+        messageInput = document.getElementById('wiki_message');
+        wikis = new Wikis();
+      });
+
+      it('binds an event listener to the title input', () => {
+        wikis.handleWikiTitleChange = jest.fn();
+
+        titleInput.dispatchEvent(new Event('keyup'));
+
+        expect(wikis.handleWikiTitleChange).toHaveBeenCalled();
+      });
+
+      it('sets the commit message when title changes', () => {
+        titleInput.value = 'My title';
+        messageInput.value = '';
+
+        titleInput.dispatchEvent(new Event('keyup'));
+
+        expect(messageInput.value).toEqual('Create My title');
+      });
+
+      it('replaces hyphens with spaces', () => {
+        titleInput.value = 'my-hyphenated-title';
+        titleInput.dispatchEvent(new Event('keyup'));
+
+        expect(messageInput.value).toEqual('Create my hyphenated title');
+      });
+    });
+
+    describe('when the wiki page is being updated', () => {
+      const formHtmlFixture = editFormHtmlFixture({ newPage: false });
+
+      beforeEach(() => {
+        setHTMLFixture(formHtmlFixture);
+
+        titleInput = document.getElementById('wiki_title');
+        messageInput = document.getElementById('wiki_message');
+        wikis = new Wikis();
+      });
+
+      it('sets the commit message when title changes, prefixing with "Update"', () => {
+        titleInput.value = 'My title';
+        messageInput.value = '';
+
+        titleInput.dispatchEvent(new Event('keyup'));
+
+        expect(messageInput.value).toEqual('Update My title');
+      });
+    });
+  });
+});
-- 
cgit v1.2.1


From 0284917c701acfa5d88a98fef641ab35164ed9a8 Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Thu, 15 Aug 2019 15:29:29 +0800
Subject: Remove inline JS in links

Changes these to use unobtrusive JS
---
 app/assets/stylesheets/errors.scss                                  | 2 +-
 app/views/admin/applications/_delete_form.html.haml                 | 2 +-
 app/views/doorkeeper/authorized_applications/_delete_form.html.haml | 2 +-
 app/views/errors/access_denied.html.haml                            | 4 ++--
 app/views/layouts/errors.html.haml                                  | 6 +++++-
 app/views/profiles/personal_access_tokens/index.html.haml           | 4 ++--
 6 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/app/assets/stylesheets/errors.scss b/app/assets/stylesheets/errors.scss
index d287215096e..89029a58d1e 100644
--- a/app/assets/stylesheets/errors.scss
+++ b/app/assets/stylesheets/errors.scss
@@ -96,7 +96,7 @@ a {
 }
 
 .error-nav {
-  padding: 0;
+  padding: $gl-padding 0 0;
   text-align: center;
 
   li {
diff --git a/app/views/admin/applications/_delete_form.html.haml b/app/views/admin/applications/_delete_form.html.haml
index 82781f6716d..86f09bf1cb0 100644
--- a/app/views/admin/applications/_delete_form.html.haml
+++ b/app/views/admin/applications/_delete_form.html.haml
@@ -1,4 +1,4 @@
 - submit_btn_css ||= 'btn btn-link btn-remove btn-sm'
 = form_tag admin_application_path(application) do
   %input{ :name => "_method", :type => "hidden", :value => "delete" }/
-  = submit_tag 'Destroy', onclick: "return confirm('Are you sure?')", class: submit_btn_css
+  = submit_tag 'Destroy', class: submit_btn_css, data: { confirm: _('Are you sure?') }
diff --git a/app/views/doorkeeper/authorized_applications/_delete_form.html.haml b/app/views/doorkeeper/authorized_applications/_delete_form.html.haml
index 69cc510e9c1..9bc5e2ee42f 100644
--- a/app/views/doorkeeper/authorized_applications/_delete_form.html.haml
+++ b/app/views/doorkeeper/authorized_applications/_delete_form.html.haml
@@ -5,4 +5,4 @@
 
 = form_tag path do
   %input{ :name => "_method", :type => "hidden", :value => "delete" }/
-  = submit_tag _('Revoke'), onclick: "return confirm('#{_('Are you sure?')}')", class: 'btn btn-remove btn-sm'
+  = submit_tag _('Revoke'), class: 'btn btn-remove btn-sm', data: { confirm: _('Are you sure?') }
diff --git a/app/views/errors/access_denied.html.haml b/app/views/errors/access_denied.html.haml
index 46931b5932d..1ed7b56db1d 100644
--- a/app/views/errors/access_denied.html.haml
+++ b/app/views/errors/access_denied.html.haml
@@ -10,7 +10,7 @@
       = message
   %p
     = s_('403|Please contact your GitLab administrator to get permission.')
-  .action-container.js-go-back{ style: 'display: none' }
-    %a{ href: 'javascript:history.back()', class: 'btn btn-success' }
+  .action-container.js-go-back{ hidden: true }
+    %button{ type: 'button', class: 'btn btn-success' }
       = s_('Go Back')
 = render "errors/footer"
diff --git a/app/views/layouts/errors.html.haml b/app/views/layouts/errors.html.haml
index 74484005b48..dc924a0e25d 100644
--- a/app/views/layouts/errors.html.haml
+++ b/app/views/layouts/errors.html.haml
@@ -14,6 +14,10 @@
           var goBackElement = document.querySelector('.js-go-back');
 
           if (goBackElement && history.length > 1) {
-            goBackElement.style.display = 'block';
+            goBackElement.removeAttribute('hidden');
+
+            goBackElement.querySelector('button').addEventListener('click', function() {
+              history.back();
+            });
           }
         }());
diff --git a/app/views/profiles/personal_access_tokens/index.html.haml b/app/views/profiles/personal_access_tokens/index.html.haml
index 65ef9690062..08a39fc4f58 100644
--- a/app/views/profiles/personal_access_tokens/index.html.haml
+++ b/app/views/profiles/personal_access_tokens/index.html.haml
@@ -31,7 +31,7 @@
       = s_('AccessTokens|It cannot be used to access any other data.')
   .col-lg-8.feed-token-reset
     = label_tag :feed_token, s_('AccessTokens|Feed token'), class: "label-bold"
-    = text_field_tag :feed_token, current_user.feed_token, class: 'form-control', readonly: true, onclick: 'this.select()'
+    = text_field_tag :feed_token, current_user.feed_token, class: 'form-control js-select-on-focus', readonly: true
     %p.form-text.text-muted
       - reset_link = link_to s_('AccessTokens|reset it'), [:reset, :feed_token, :profile], method: :put, data: { confirm: s_('AccessTokens|Are you sure? Any RSS or calendar URLs currently in use will stop working.') }
       - reset_message = s_('AccessTokens|Keep this token secret. Anyone who gets ahold of it can read activity and issue RSS feeds or your calendar feed as if they were you. You should %{link_reset_it} if that ever happens.') % { link_reset_it: reset_link }
@@ -49,7 +49,7 @@
         = s_('AccessTokens|It cannot be used to access any other data.')
     .col-lg-8.incoming-email-token-reset
       = label_tag :incoming_email_token, s_('AccessTokens|Incoming email token'), class: "label-bold"
-      = text_field_tag :incoming_email_token, current_user.incoming_email_token, class: 'form-control', readonly: true, onclick: 'this.select()'
+      = text_field_tag :incoming_email_token, current_user.incoming_email_token, class: 'form-control js-select-on-focus', readonly: true
       %p.form-text.text-muted
         - reset_link = link_to s_('AccessTokens|reset it'), [:reset, :incoming_email_token, :profile], method: :put, data: { confirm: s_('AccessTokens|Are you sure? Any issue email addresses currently in use will stop working.') }
         - reset_message = s_('AccessTokens|Keep this token secret. Anyone who gets ahold of it can create issues as if they were you. You should %{link_reset_it} if that ever happens.') % { link_reset_it: reset_link }
-- 
cgit v1.2.1


From 330cbddec30840a72a52aade383286e58545ce98 Mon Sep 17 00:00:00 2001
From: Luke Duncalfe <lduncalfe@eml.cc>
Date: Tue, 18 Jun 2019 17:15:53 +1200
Subject: Renaming AwardedEmojiFinder to a Service

This finder class acts more as a service, as it only returns mapped
data.

Renaming this class allows us to create a new AwardEmojiFinder without
the ambiguity of there being two similarly-named finders.

https://gitlab.com/gitlab-org/gitlab-ce/issues/63372
---
 app/controllers/autocomplete_controller.rb         |  2 +-
 app/finders/awarded_emoji_finder.rb                | 21 ------------------
 .../award_emojis/collect_user_emoji_service.rb     | 23 ++++++++++++++++++++
 spec/finders/awarded_emoji_finder_spec.rb          | 25 ----------------------
 .../collect_user_emoji_service_spec.rb             | 25 ++++++++++++++++++++++
 5 files changed, 49 insertions(+), 47 deletions(-)
 delete mode 100644 app/finders/awarded_emoji_finder.rb
 create mode 100644 app/services/award_emojis/collect_user_emoji_service.rb
 delete mode 100644 spec/finders/awarded_emoji_finder_spec.rb
 create mode 100644 spec/services/award_emojis/collect_user_emoji_service_spec.rb

diff --git a/app/controllers/autocomplete_controller.rb b/app/controllers/autocomplete_controller.rb
index f111c7ca8cc..30a567c3bef 100644
--- a/app/controllers/autocomplete_controller.rb
+++ b/app/controllers/autocomplete_controller.rb
@@ -36,7 +36,7 @@ class AutocompleteController < ApplicationController
   end
 
   def award_emojis
-    render json: AwardedEmojiFinder.new(current_user).execute
+    render json: AwardEmojis::CollectUserEmojiService.new(current_user).execute
   end
 
   def merge_request_target_branches
diff --git a/app/finders/awarded_emoji_finder.rb b/app/finders/awarded_emoji_finder.rb
deleted file mode 100644
index f0cc17f3b26..00000000000
--- a/app/finders/awarded_emoji_finder.rb
+++ /dev/null
@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-# Class for retrieving information about emoji awarded _by_ a particular user.
-class AwardedEmojiFinder
-  attr_reader :current_user
-
-  # current_user - The User to generate the data for.
-  def initialize(current_user = nil)
-    @current_user = current_user
-  end
-
-  def execute
-    return [] unless current_user
-
-    # We want the resulting data set to be an Array containing the emoji names
-    # in descending order, based on how often they were awarded.
-    AwardEmoji
-      .award_counts_for_user(current_user)
-      .map { |name, _| { name: name } }
-  end
-end
diff --git a/app/services/award_emojis/collect_user_emoji_service.rb b/app/services/award_emojis/collect_user_emoji_service.rb
new file mode 100644
index 00000000000..6cab23f3edf
--- /dev/null
+++ b/app/services/award_emojis/collect_user_emoji_service.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+# Class for retrieving information about emoji awarded _by_ a particular user.
+module AwardEmojis
+  class CollectUserEmojiService
+    attr_reader :current_user
+
+    # current_user - The User to generate the data for.
+    def initialize(current_user = nil)
+      @current_user = current_user
+    end
+
+    def execute
+      return [] unless current_user
+
+      # We want the resulting data set to be an Array containing the emoji names
+      # in descending order, based on how often they were awarded.
+      AwardEmoji
+        .award_counts_for_user(current_user)
+        .map { |name, _| { name: name } }
+    end
+  end
+end
diff --git a/spec/finders/awarded_emoji_finder_spec.rb b/spec/finders/awarded_emoji_finder_spec.rb
deleted file mode 100644
index d4479df7418..00000000000
--- a/spec/finders/awarded_emoji_finder_spec.rb
+++ /dev/null
@@ -1,25 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-describe AwardedEmojiFinder do
-  describe '#execute' do
-    it 'returns an Array containing the awarded emoji names' do
-      user = create(:user)
-
-      create(:award_emoji, user: user, name: 'thumbsup')
-      create(:award_emoji, user: user, name: 'thumbsup')
-      create(:award_emoji, user: user, name: 'thumbsdown')
-
-      awarded = described_class.new(user).execute
-
-      expect(awarded).to eq([{ name: 'thumbsup' }, { name: 'thumbsdown' }])
-    end
-
-    it 'returns an empty Array when no user is given' do
-      awarded = described_class.new.execute
-
-      expect(awarded).to be_empty
-    end
-  end
-end
diff --git a/spec/services/award_emojis/collect_user_emoji_service_spec.rb b/spec/services/award_emojis/collect_user_emoji_service_spec.rb
new file mode 100644
index 00000000000..a0dea31b403
--- /dev/null
+++ b/spec/services/award_emojis/collect_user_emoji_service_spec.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe AwardEmojis::CollectUserEmojiService do
+  describe '#execute' do
+    it 'returns an Array containing the awarded emoji names' do
+      user = create(:user)
+
+      create(:award_emoji, user: user, name: 'thumbsup')
+      create(:award_emoji, user: user, name: 'thumbsup')
+      create(:award_emoji, user: user, name: 'thumbsdown')
+
+      awarded = described_class.new(user).execute
+
+      expect(awarded).to eq([{ name: 'thumbsup' }, { name: 'thumbsdown' }])
+    end
+
+    it 'returns an empty Array when no user is given' do
+      awarded = described_class.new.execute
+
+      expect(awarded).to be_empty
+    end
+  end
+end
-- 
cgit v1.2.1


From e0826b0cb522dc4a112f6617c6fb222f6e3f4ce2 Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Fri, 19 Jul 2019 14:12:02 +1200
Subject: Override hostname when connecting via Kubeclient

Kubeclient uses rest-client. We hack into to access the net/http object
so that we can patch to connect to the resolved IP + set
hostname_override.

Add specs for discord. The discord integration also uses rest-client, so
since we patched rest-client, spec that the DNS rebinding protection
works
---
 .../unreleased/security-ssrf-kubernetes-dns.yml    |   5 +
 .../initializers/rest-client-hostname_override.rb  |  49 +++++++
 .../rest-client-hostname_override_spec.rb          | 147 +++++++++++++++++++++
 spec/lib/gitlab/kubernetes/kube_client_spec.rb     |  53 +++++---
 .../project_services/discord_service_spec.rb       |  33 +++++
 5 files changed, 269 insertions(+), 18 deletions(-)
 create mode 100644 changelogs/unreleased/security-ssrf-kubernetes-dns.yml
 create mode 100644 config/initializers/rest-client-hostname_override.rb
 create mode 100644 spec/initializers/rest-client-hostname_override_spec.rb

diff --git a/changelogs/unreleased/security-ssrf-kubernetes-dns.yml b/changelogs/unreleased/security-ssrf-kubernetes-dns.yml
new file mode 100644
index 00000000000..4d6335e4b08
--- /dev/null
+++ b/changelogs/unreleased/security-ssrf-kubernetes-dns.yml
@@ -0,0 +1,5 @@
+---
+title: Fix SSRF via DNS rebinding in Kubernetes Integration
+merge_request:
+author:
+type: security
diff --git a/config/initializers/rest-client-hostname_override.rb b/config/initializers/rest-client-hostname_override.rb
new file mode 100644
index 00000000000..bc1b70bd73f
--- /dev/null
+++ b/config/initializers/rest-client-hostname_override.rb
@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module RestClient
+  class Request
+    attr_accessor :hostname_override
+
+    module UrlBlocker
+      def transmit(uri, req, payload, &block)
+        begin
+          ip, hostname_override = Gitlab::UrlBlocker.validate!(uri, allow_local_network: allow_settings_local_requests?,
+                                                               allow_localhost: allow_settings_local_requests?,
+                                                               dns_rebind_protection: dns_rebind_protection?)
+
+          self.hostname_override = hostname_override
+        rescue Gitlab::UrlBlocker::BlockedUrlError => e
+          raise ArgumentError, "URL '#{uri}' is blocked: #{e.message}"
+        end
+
+        # Gitlab::UrlBlocker returns a Addressable::URI which we need to coerce
+        # to URI so that rest-client can use it to determine if it's a
+        # URI::HTTPS or not. It uses it to set `net.use_ssl` to true or not:
+        #
+        # https://github.com/rest-client/rest-client/blob/f450a0f086f1cd1049abbef2a2c66166a1a9ba71/lib/restclient/request.rb#L656
+        ip_as_uri = URI.parse(ip)
+        super(ip_as_uri, req, payload, &block)
+      end
+
+      def net_http_object(hostname, port)
+        super.tap do |http|
+          http.hostname_override = hostname_override if hostname_override
+        end
+      end
+
+      private
+
+      def dns_rebind_protection?
+        return false if Gitlab.http_proxy_env?
+
+        Gitlab::CurrentSettings.dns_rebinding_protection_enabled?
+      end
+
+      def allow_settings_local_requests?
+        Gitlab::CurrentSettings.allow_local_requests_from_hooks_and_services?
+      end
+    end
+
+    prepend UrlBlocker
+  end
+end
diff --git a/spec/initializers/rest-client-hostname_override_spec.rb b/spec/initializers/rest-client-hostname_override_spec.rb
new file mode 100644
index 00000000000..1ff82342fb5
--- /dev/null
+++ b/spec/initializers/rest-client-hostname_override_spec.rb
@@ -0,0 +1,147 @@
+require 'spec_helper'
+
+describe 'rest-client dns rebinding protection' do
+  include StubRequests
+
+  context 'when local requests are not allowed' do
+    it 'allows an external request with http' do
+      request_stub = stub_full_request('http://example.com', ip_address: '93.184.216.34')
+
+      RestClient.get('http://example.com/')
+
+      expect(request_stub).to have_been_requested
+    end
+
+    it 'allows an external request with https' do
+      request_stub = stub_full_request('https://example.com', ip_address: '93.184.216.34')
+
+      RestClient.get('https://example.com/')
+
+      expect(request_stub).to have_been_requested
+    end
+
+    it 'raises error when it is a request that resolves to a local address' do
+      stub_full_request('https://example.com', ip_address: '172.16.0.0')
+
+      expect { RestClient.get('https://example.com') }
+        .to raise_error(ArgumentError,
+                        "URL 'https://example.com' is blocked: Requests to the local network are not allowed")
+    end
+
+    it 'raises error when it is a request that resolves to a localhost address' do
+      stub_full_request('https://example.com', ip_address: '127.0.0.1')
+
+      expect { RestClient.get('https://example.com') }
+        .to raise_error(ArgumentError,
+                        "URL 'https://example.com' is blocked: Requests to localhost are not allowed")
+    end
+
+    it 'raises error when it is a request to local address' do
+      expect { RestClient.get('http://172.16.0.0') }
+        .to raise_error(ArgumentError,
+                        "URL 'http://172.16.0.0' is blocked: Requests to the local network are not allowed")
+    end
+
+    it 'raises error when it is a request to localhost address' do
+      expect { RestClient.get('http://127.0.0.1') }
+        .to raise_error(ArgumentError,
+                        "URL 'http://127.0.0.1' is blocked: Requests to localhost are not allowed")
+    end
+  end
+
+  context 'when port different from URL scheme is used' do
+    it 'allows the request' do
+      request_stub = stub_full_request('https://example.com:8080', ip_address: '93.184.216.34')
+
+      RestClient.get('https://example.com:8080/')
+
+      expect(request_stub).to have_been_requested
+    end
+
+    it 'raises error when it is a request to local address' do
+      expect { RestClient.get('https://172.16.0.0:8080') }
+        .to raise_error(ArgumentError,
+                        "URL 'https://172.16.0.0:8080' is blocked: Requests to the local network are not allowed")
+    end
+
+    it 'raises error when it is a request to localhost address' do
+      expect { RestClient.get('https://127.0.0.1:8080') }
+        .to raise_error(ArgumentError,
+                        "URL 'https://127.0.0.1:8080' is blocked: Requests to localhost are not allowed")
+    end
+  end
+
+  context 'when DNS rebinding protection is disabled' do
+    before do
+      stub_application_setting(dns_rebinding_protection_enabled: false)
+    end
+
+    it 'allows the request' do
+      request_stub = stub_request(:get, 'https://example.com')
+
+      RestClient.get('https://example.com/')
+
+      expect(request_stub).to have_been_requested
+    end
+  end
+
+  context 'when http(s) proxy environment variable is set' do
+    before do
+      stub_env('https_proxy' => 'https://my.proxy')
+    end
+
+    it 'allows the request' do
+      request_stub = stub_request(:get, 'https://example.com')
+
+      RestClient.get('https://example.com/')
+
+      expect(request_stub).to have_been_requested
+    end
+  end
+
+  context 'when local requests are allowed' do
+    before do
+      stub_application_setting(allow_local_requests_from_hooks_and_services: true)
+    end
+
+    it 'allows an external request' do
+      request_stub = stub_full_request('https://example.com', ip_address: '93.184.216.34')
+
+      RestClient.get('https://example.com/')
+
+      expect(request_stub).to have_been_requested
+    end
+
+    it 'allows an external request that resolves to a local address' do
+      request_stub = stub_full_request('https://example.com', ip_address: '172.16.0.0')
+
+      RestClient.get('https://example.com/')
+
+      expect(request_stub).to have_been_requested
+    end
+
+    it 'allows an external request that resolves to a localhost address' do
+      request_stub = stub_full_request('https://example.com', ip_address: '127.0.0.1')
+
+      RestClient.get('https://example.com/')
+
+      expect(request_stub).to have_been_requested
+    end
+
+    it 'allows a local address request' do
+      request_stub = stub_request(:get, 'http://172.16.0.0')
+
+      RestClient.get('http://172.16.0.0')
+
+      expect(request_stub).to have_been_requested
+    end
+
+    it 'allows a localhost address request' do
+      request_stub = stub_request(:get, 'http://127.0.0.1')
+
+      RestClient.get('http://127.0.0.1')
+
+      expect(request_stub).to have_been_requested
+    end
+  end
+end
diff --git a/spec/lib/gitlab/kubernetes/kube_client_spec.rb b/spec/lib/gitlab/kubernetes/kube_client_spec.rb
index f49d4e23e39..e5d688aa391 100644
--- a/spec/lib/gitlab/kubernetes/kube_client_spec.rb
+++ b/spec/lib/gitlab/kubernetes/kube_client_spec.rb
@@ -3,6 +3,7 @@
 require 'spec_helper'
 
 describe Gitlab::Kubernetes::KubeClient do
+  include StubRequests
   include KubernetesHelpers
 
   let(:api_url) { 'https://kubernetes.example.com/prefix' }
@@ -14,6 +15,17 @@ describe Gitlab::Kubernetes::KubeClient do
     stub_kubeclient_discover(api_url)
   end
 
+  def method_call(client, method_name)
+    case method_name
+    when /\A(get_|delete_)/
+      client.public_send(method_name)
+    when /\A(create_|update_)/
+      client.public_send(method_name, {})
+    else
+      raise "Unknown method name #{method_name}"
+    end
+  end
+
   shared_examples 'a Kubeclient' do
     it 'is a Kubeclient::Client' do
       is_expected.to be_an_instance_of Kubeclient::Client
@@ -25,28 +37,30 @@ describe Gitlab::Kubernetes::KubeClient do
   end
 
   shared_examples 'redirection not allowed' do |method_name|
-    before do
-      redirect_url = 'https://not-under-our-control.example.com/api/v1/pods'
+    context 'api_url is redirected' do
+      before do
+        redirect_url = 'https://not-under-our-control.example.com/api/v1/pods'
 
-      stub_request(:get, %r{\A#{api_url}/})
-        .to_return(status: 302, headers: { location: redirect_url })
+        stub_request(:get, %r{\A#{api_url}/})
+          .to_return(status: 302, headers: { location: redirect_url })
 
-      stub_request(:get, redirect_url)
-        .to_return(status: 200, body: '{}')
-    end
+        stub_request(:get, redirect_url)
+          .to_return(status: 200, body: '{}')
+      end
 
-    it 'does not follow redirects' do
-      method_call = -> do
-        case method_name
-        when /\A(get_|delete_)/
-          client.public_send(method_name)
-        when /\A(create_|update_)/
-          client.public_send(method_name, {})
-        else
-          raise "Unknown method name #{method_name}"
-        end
+      it 'does not follow redirects' do
+        expect { method_call(client, method_name) }.to raise_error(Kubeclient::HttpError)
       end
-      expect { method_call.call }.to raise_error(Kubeclient::HttpError)
+    end
+  end
+
+  shared_examples 'dns rebinding not allowed' do |method_name|
+    it 'does not allow DNS rebinding' do
+      stub_dns(api_url, ip_address: '8.8.8.8')
+      client
+
+      stub_dns(api_url, ip_address: '192.168.2.120')
+      expect { method_call(client, method_name) }.to raise_error(ArgumentError, /is blocked/)
     end
   end
 
@@ -160,6 +174,7 @@ describe Gitlab::Kubernetes::KubeClient do
     ].each do |method|
       describe "##{method}" do
         include_examples 'redirection not allowed', method
+        include_examples 'dns rebinding not allowed', method
 
         it 'delegates to the core client' do
           expect(client).to delegate_method(method).to(:core_client)
@@ -185,6 +200,7 @@ describe Gitlab::Kubernetes::KubeClient do
     ].each do |method|
       describe "##{method}" do
         include_examples 'redirection not allowed', method
+        include_examples 'dns rebinding not allowed', method
 
         it 'delegates to the rbac client' do
           expect(client).to delegate_method(method).to(:rbac_client)
@@ -203,6 +219,7 @@ describe Gitlab::Kubernetes::KubeClient do
 
     describe '#get_deployments' do
       include_examples 'redirection not allowed', 'get_deployments'
+      include_examples 'dns rebinding not allowed', 'get_deployments'
 
       it 'delegates to the extensions client' do
         expect(client).to delegate_method(:get_deployments).to(:extensions_client)
diff --git a/spec/models/project_services/discord_service_spec.rb b/spec/models/project_services/discord_service_spec.rb
index be82f223478..96ac532dcd1 100644
--- a/spec/models/project_services/discord_service_spec.rb
+++ b/spec/models/project_services/discord_service_spec.rb
@@ -8,4 +8,37 @@ describe DiscordService do
     let(:client_arguments) { { url: webhook_url } }
     let(:content_key) { :content }
   end
+
+  describe '#execute' do
+    include StubRequests
+
+    let(:user) { create(:user) }
+    let(:project) { create(:project, :repository) }
+    let(:webhook_url) { "https://example.gitlab.com/" }
+
+    let(:sample_data) do
+      Gitlab::DataBuilder::Push.build_sample(project, user)
+    end
+
+    before do
+      allow(subject).to receive_messages(
+        project: project,
+        project_id: project.id,
+        service_hook: true,
+        webhook: webhook_url
+      )
+
+      WebMock.stub_request(:post, webhook_url)
+    end
+
+    context 'DNS rebind to local address' do
+      before do
+        stub_dns(webhook_url, ip_address: '192.168.2.120')
+      end
+
+      it 'does not allow DNS rebinding' do
+        expect { subject.execute(sample_data) }.to raise_error(ArgumentError, /is blocked/)
+      end
+    end
+  end
 end
-- 
cgit v1.2.1


From 37b17fa61a1fb5efe5942ab2cb27b15685bf905e Mon Sep 17 00:00:00 2001
From: Luke Duncalfe <lduncalfe@eml.cc>
Date: Tue, 18 Jun 2019 13:44:43 +1200
Subject: Add service classes for mutating AwardEmoji

Adding, destroying and toggling emoji previously lacked services and
instead were performed through methods called on Awardable models.

This led to inconsistencies where relevant todos would be marked as done
only when emoji were awarded through our controllers, but not through
the API. Todos could also be marked as done when an emoji was being
removed.

Behaviour changes

- Awarding emoji through the API will now mark a relevant Todo as done
- Toggling an emoji off (destroying it) through our controllers will no
  longer mark a relevant Todo as done

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/63372
---
 app/controllers/concerns/toggle_award_emoji.rb     |  19 +---
 app/finders/award_emojis_finder.rb                 |  55 +++++++++++
 app/models/award_emoji.rb                          |   6 +-
 app/models/concerns/awardable.rb                   |  26 +-----
 app/services/award_emojis/add_service.rb           |  42 +++++++++
 app/services/award_emojis/base_service.rb          |  32 +++++++
 app/services/award_emojis/destroy_service.rb       |  21 +++++
 app/services/award_emojis/toggle_service.rb        |  13 +++
 app/services/issuable_base_service.rb              |   5 +-
 db/fixtures/development/15_award_emoji.rb          |  35 +++----
 lib/api/award_emoji.rb                             |   8 +-
 spec/controllers/snippets/notes_controller_spec.rb |   6 +-
 spec/finders/award_emojis_finder_spec.rb           |  49 ++++++++++
 spec/models/award_emoji_spec.rb                    |  23 +++++
 spec/models/concerns/awardable_spec.rb             |  10 --
 spec/services/award_emojis/add_service_spec.rb     | 103 +++++++++++++++++++++
 spec/services/award_emojis/destroy_service_spec.rb |  89 ++++++++++++++++++
 spec/services/award_emojis/toggle_service_spec.rb  |  72 ++++++++++++++
 spec/services/projects/create_service_spec.rb      |   1 +
 .../award_emoji_todo_shared_examples.rb            |  59 ++++++++++++
 20 files changed, 586 insertions(+), 88 deletions(-)
 create mode 100644 app/finders/award_emojis_finder.rb
 create mode 100644 app/services/award_emojis/add_service.rb
 create mode 100644 app/services/award_emojis/base_service.rb
 create mode 100644 app/services/award_emojis/destroy_service.rb
 create mode 100644 app/services/award_emojis/toggle_service.rb
 create mode 100644 spec/finders/award_emojis_finder_spec.rb
 create mode 100644 spec/services/award_emojis/add_service_spec.rb
 create mode 100644 spec/services/award_emojis/destroy_service_spec.rb
 create mode 100644 spec/services/award_emojis/toggle_service_spec.rb
 create mode 100644 spec/support/shared_examples/award_emoji_todo_shared_examples.rb

diff --git a/app/controllers/concerns/toggle_award_emoji.rb b/app/controllers/concerns/toggle_award_emoji.rb
index 97b343f8b1a..24d178781d6 100644
--- a/app/controllers/concerns/toggle_award_emoji.rb
+++ b/app/controllers/concerns/toggle_award_emoji.rb
@@ -7,12 +7,9 @@ module ToggleAwardEmoji
     authenticate_user!
     name = params.require(:name)
 
-    if awardable.user_can_award?(current_user)
-      awardable.toggle_award_emoji(name, current_user)
-
-      todoable = to_todoable(awardable)
-      TodoService.new.new_award_emoji(todoable, current_user) if todoable
+    service = AwardEmojis::ToggleService.new(awardable, name, current_user).execute
 
+    if service[:status] == :success
       render json: { ok: true }
     else
       render json: { ok: false }
@@ -21,18 +18,6 @@ module ToggleAwardEmoji
 
   private
 
-  def to_todoable(awardable)
-    case awardable
-    when Note
-      # we don't create todos for personal snippet comments for now
-      awardable.for_personal_snippet? ? nil : awardable.noteable
-    when MergeRequest, Issue
-      awardable
-    when Snippet
-      nil
-    end
-  end
-
   def awardable
     raise NotImplementedError
   end
diff --git a/app/finders/award_emojis_finder.rb b/app/finders/award_emojis_finder.rb
new file mode 100644
index 00000000000..7320e035409
--- /dev/null
+++ b/app/finders/award_emojis_finder.rb
@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+class AwardEmojisFinder
+  attr_reader :awardable, :params
+
+  def initialize(awardable, params = {})
+    @awardable = awardable
+    @params = params
+
+    validate_params
+  end
+
+  def execute
+    awards = awardable.award_emoji
+    awards = by_name(awards)
+    awards = by_awarded_by(awards)
+    awards
+  end
+
+  private
+
+  def by_name(awards)
+    return awards unless params[:name]
+
+    awards.named(params[:name])
+  end
+
+  def by_awarded_by(awards)
+    return awards unless params[:awarded_by]
+
+    awards.awarded_by(params[:awarded_by])
+  end
+
+  def validate_params
+    return unless params.present?
+
+    validate_name_param
+    validate_awarded_by_param
+  end
+
+  def validate_name_param
+    return unless params[:name]
+
+    raise ArgumentError, 'Invalid name param' unless params[:name].in?(Gitlab::Emoji.emojis_names)
+  end
+
+  def validate_awarded_by_param
+    return unless params[:awarded_by]
+
+    # awarded_by can be a `User`, or an ID
+    unless params[:awarded_by].is_a?(User) || params[:awarded_by].to_s.match(/\A\d+\Z/)
+      raise ArgumentError, 'Invalid awarded_by param'
+    end
+  end
+end
diff --git a/app/models/award_emoji.rb b/app/models/award_emoji.rb
index e26162f6151..0ab302a0f3e 100644
--- a/app/models/award_emoji.rb
+++ b/app/models/award_emoji.rb
@@ -16,8 +16,10 @@ class AwardEmoji < ApplicationRecord
 
   participant :user
 
-  scope :downvotes, -> { where(name: DOWNVOTE_NAME) }
-  scope :upvotes,   -> { where(name: UPVOTE_NAME) }
+  scope :downvotes, -> { named(DOWNVOTE_NAME) }
+  scope :upvotes, -> { named(UPVOTE_NAME) }
+  scope :named, -> (names) { where(name: names) }
+  scope :awarded_by, -> (users) { where(user: users) }
 
   after_save :expire_etag_cache
   after_destroy :expire_etag_cache
diff --git a/app/models/concerns/awardable.rb b/app/models/concerns/awardable.rb
index 14bc56f0eee..f229b42ade6 100644
--- a/app/models/concerns/awardable.rb
+++ b/app/models/concerns/awardable.rb
@@ -106,30 +106,6 @@ module Awardable
   end
 
   def awarded_emoji?(emoji_name, current_user)
-    award_emoji.where(name: emoji_name, user: current_user).exists?
-  end
-
-  def create_award_emoji(name, current_user)
-    return unless emoji_awardable?
-
-    award_emoji.create(name: normalize_name(name), user: current_user)
-  end
-
-  def remove_award_emoji(name, current_user)
-    award_emoji.where(name: name, user: current_user).destroy_all # rubocop: disable DestroyAll
-  end
-
-  def toggle_award_emoji(emoji_name, current_user)
-    if awarded_emoji?(emoji_name, current_user)
-      remove_award_emoji(emoji_name, current_user)
-    else
-      create_award_emoji(emoji_name, current_user)
-    end
-  end
-
-  private
-
-  def normalize_name(name)
-    Gitlab::Emoji.normalize_emoji_name(name)
+    award_emoji.named(emoji_name).awarded_by(current_user).exists?
   end
 end
diff --git a/app/services/award_emojis/add_service.rb b/app/services/award_emojis/add_service.rb
new file mode 100644
index 00000000000..eac15dabbf0
--- /dev/null
+++ b/app/services/award_emojis/add_service.rb
@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module AwardEmojis
+  class AddService < AwardEmojis::BaseService
+    include Gitlab::Utils::StrongMemoize
+
+    def execute
+      unless awardable.user_can_award?(current_user)
+        return error('User cannot award emoji to awardable', status: :forbidden)
+      end
+
+      unless awardable.emoji_awardable?
+        return error('Awardable cannot be awarded emoji', status: :unprocessable_entity)
+      end
+
+      award = awardable.award_emoji.create(name: name, user: current_user)
+
+      if award.persisted?
+        TodoService.new.new_award_emoji(todoable, current_user) if todoable
+        success(award: award)
+      else
+        error(award.errors.full_messages, award: award)
+      end
+    end
+
+    private
+
+    def todoable
+      strong_memoize(:todoable) do
+        case awardable
+        when Note
+          # We don't create todos for personal snippet comments for now
+          awardable.noteable unless awardable.for_personal_snippet?
+        when MergeRequest, Issue
+          awardable
+        when Snippet
+          nil
+        end
+      end
+    end
+  end
+end
diff --git a/app/services/award_emojis/base_service.rb b/app/services/award_emojis/base_service.rb
new file mode 100644
index 00000000000..a677d03a221
--- /dev/null
+++ b/app/services/award_emojis/base_service.rb
@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module AwardEmojis
+  class BaseService < ::BaseService
+    attr_accessor :awardable, :name
+
+    def initialize(awardable, name, current_user)
+      @awardable = awardable
+      @name = normalize_name(name)
+
+      super(awardable.project, current_user)
+    end
+
+    private
+
+    def normalize_name(name)
+      Gitlab::Emoji.normalize_emoji_name(name)
+    end
+
+    # Provide more error state data than what BaseService allows.
+    # - An array of errors
+    # - The `AwardEmoji` if present
+    def error(errors, award: nil, status: nil)
+      errors = Array.wrap(errors)
+
+      super(errors.to_sentence.presence, status).merge({
+        award: award,
+        errors: errors
+      })
+    end
+  end
+end
diff --git a/app/services/award_emojis/destroy_service.rb b/app/services/award_emojis/destroy_service.rb
new file mode 100644
index 00000000000..3789a8403bc
--- /dev/null
+++ b/app/services/award_emojis/destroy_service.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module AwardEmojis
+  class DestroyService < AwardEmojis::BaseService
+    def execute
+      unless awardable.user_can_award?(current_user)
+        return error('User cannot destroy emoji on the awardable', status: :forbidden)
+      end
+
+      awards = AwardEmojisFinder.new(awardable, name: name, awarded_by: current_user).execute
+
+      if awards.empty?
+        return error("User has not awarded emoji of type #{name} on the awardable", status: :forbidden)
+      end
+
+      award = awards.destroy_all.first # rubocop: disable DestroyAll
+
+      success(award: award)
+    end
+  end
+end
diff --git a/app/services/award_emojis/toggle_service.rb b/app/services/award_emojis/toggle_service.rb
new file mode 100644
index 00000000000..812dd1c2889
--- /dev/null
+++ b/app/services/award_emojis/toggle_service.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module AwardEmojis
+  class ToggleService < AwardEmojis::BaseService
+    def execute
+      if awardable.awarded_emoji?(name, current_user)
+        DestroyService.new(awardable, name, current_user).execute
+      else
+        AddService.new(awardable, name, current_user).execute
+      end
+    end
+  end
+end
diff --git a/app/services/issuable_base_service.rb b/app/services/issuable_base_service.rb
index 77c2224ee3b..2ab6e88599f 100644
--- a/app/services/issuable_base_service.rb
+++ b/app/services/issuable_base_service.rb
@@ -344,10 +344,7 @@ class IssuableBaseService < BaseService
 
   def toggle_award(issuable)
     award = params.delete(:emoji_award)
-    if award
-      todo_service.new_award_emoji(issuable, current_user)
-      issuable.toggle_award_emoji(award, current_user)
-    end
+    AwardEmojis::ToggleService.new(issuable, award, current_user).execute if award
   end
 
   def associations_before_update(issuable)
diff --git a/db/fixtures/development/15_award_emoji.rb b/db/fixtures/development/15_award_emoji.rb
index 137a036edaf..a9dcc048586 100644
--- a/db/fixtures/development/15_award_emoji.rb
+++ b/db/fixtures/development/15_award_emoji.rb
@@ -1,35 +1,22 @@
 require './spec/support/sidekiq'
 
 Gitlab::Seeder.quiet do
-  emoji = Gitlab::Emoji.emojis.keys
+  EMOJI = Gitlab::Emoji.emojis.keys
 
-  Issue.order(Gitlab::Database.random).limit(Issue.count / 2).each do |issue|
-    project = issue.project
+  def seed_award_emoji(klass)
+    klass.order(Gitlab::Database.random).limit(klass.count / 2).each do |awardable|
+      awardable.project.authorized_users.where('project_authorizations.access_level > ?', Gitlab::Access::GUEST).sample(2).each do |user|
+        AwardEmojis::AddService.new(awardable, EMOJI.sample, user).execute
 
-    project.team.users.sample(2).each do |user|
-      issue.create_award_emoji(emoji.sample, user)
+        awardable.notes.user.sample(2).each do |note|
+          AwardEmojis::AddService.new(note, EMOJI.sample, user).execute
+        end
 
-      issue.notes.sample(2).each do |note|
-        next if note.system?
-        note.create_award_emoji(emoji.sample, user)
+        print '.'
       end
-
-      print '.'
     end
   end
 
-  MergeRequest.order(Gitlab::Database.random).limit(MergeRequest.count / 2).each do |mr|
-    project = mr.project
-
-    project.team.users.sample(2).each do |user|
-      mr.create_award_emoji(emoji.sample, user)
-
-      mr.notes.sample(2).each do |note|
-        next if note.system?
-        note.create_award_emoji(emoji.sample, user)
-      end
-
-      print '.'
-    end
-  end
+  seed_award_emoji(Issue)
+  seed_award_emoji(MergeRequest)
 end
diff --git a/lib/api/award_emoji.rb b/lib/api/award_emoji.rb
index a1851ba3627..89b7e5c5e4b 100644
--- a/lib/api/award_emoji.rb
+++ b/lib/api/award_emoji.rb
@@ -69,12 +69,12 @@ module API
           post endpoint do
             not_found!('Award Emoji') unless can_read_awardable? && can_award_awardable?
 
-            award = awardable.create_award_emoji(params[:name], current_user)
+            service = AwardEmojis::AddService.new(awardable, params[:name], current_user).execute
 
-            if award.persisted?
-              present award, with: Entities::AwardEmoji
+            if service[:status] == :success
+              present service[:award], with: Entities::AwardEmoji
             else
-              not_found!("Award Emoji #{award.errors.messages}")
+              not_found!("Award Emoji #{service[:message]}")
             end
           end
 
diff --git a/spec/controllers/snippets/notes_controller_spec.rb b/spec/controllers/snippets/notes_controller_spec.rb
index 652533ac49f..fd4b95ce226 100644
--- a/spec/controllers/snippets/notes_controller_spec.rb
+++ b/spec/controllers/snippets/notes_controller_spec.rb
@@ -288,11 +288,13 @@ describe Snippets::NotesController do
 
   describe 'POST toggle_award_emoji' do
     let(:note) { create(:note_on_personal_snippet, noteable: public_snippet) }
+    let(:emoji_name) { 'thumbsup'}
+
     before do
       sign_in(user)
     end
 
-    subject { post(:toggle_award_emoji, params: { snippet_id: public_snippet, id: note.id, name: "thumbsup" }) }
+    subject { post(:toggle_award_emoji, params: { snippet_id: public_snippet, id: note.id, name: emoji_name }) }
 
     it "toggles the award emoji" do
       expect { subject }.to change { note.award_emoji.count }.by(1)
@@ -301,7 +303,7 @@ describe Snippets::NotesController do
     end
 
     it "removes the already awarded emoji when it exists" do
-      note.toggle_award_emoji('thumbsup', user) # create award emoji before
+      create(:award_emoji, awardable: note, name: emoji_name, user: user)
 
       expect { subject }.to change { AwardEmoji.count }.by(-1)
 
diff --git a/spec/finders/award_emojis_finder_spec.rb b/spec/finders/award_emojis_finder_spec.rb
new file mode 100644
index 00000000000..ccac475daad
--- /dev/null
+++ b/spec/finders/award_emojis_finder_spec.rb
@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe AwardEmojisFinder do
+  set(:issue_1) { create(:issue) }
+  set(:issue_1_thumbsup) { create(:award_emoji, name: 'thumbsup', awardable: issue_1) }
+  set(:issue_1_thumbsdown) { create(:award_emoji, name: 'thumbsdown', awardable: issue_1) }
+  # Create a matching set of emoji for a second issue.
+  # These should never appear in our finder results
+  set(:issue_2) { create(:issue) }
+  set(:issue_2_thumbsup) { create(:award_emoji, name: 'thumbsup', awardable: issue_2) }
+  set(:issue_2_thumbsdown) { create(:award_emoji, name: 'thumbsdown', awardable: issue_2) }
+
+  describe 'param validation' do
+    it 'raises an error if `name` is invalid' do
+      expect { described_class.new(issue_1, { name: 'invalid' }).execute }.to raise_error(
+        ArgumentError,
+        'Invalid name param'
+      )
+    end
+
+    it 'raises an error if `awarded_by` is invalid' do
+      expectation = [ArgumentError, 'Invalid awarded_by param']
+
+      expect { described_class.new(issue_1, { awarded_by: issue_2 }).execute }.to raise_error(*expectation)
+      expect { described_class.new(issue_1, { awarded_by: 'not-an-id' }).execute }.to raise_error(*expectation)
+      expect { described_class.new(issue_1, { awarded_by: 1.123 }).execute }.to raise_error(*expectation)
+    end
+  end
+
+  describe '#execute' do
+    it 'scopes to the awardable' do
+      expect(described_class.new(issue_1).execute).to contain_exactly(
+        issue_1_thumbsup, issue_1_thumbsdown
+      )
+    end
+
+    it 'filters by emoji name' do
+      expect(described_class.new(issue_1, { name: 'thumbsup' }).execute).to contain_exactly(issue_1_thumbsup)
+      expect(described_class.new(issue_1, { name: '8ball' }).execute).to be_empty
+    end
+
+    it 'filters by user' do
+      expect(described_class.new(issue_1, { awarded_by: issue_1_thumbsup.user }).execute).to contain_exactly(issue_1_thumbsup)
+      expect(described_class.new(issue_1, { awarded_by: issue_2_thumbsup.user }).execute).to be_empty
+    end
+  end
+end
diff --git a/spec/models/award_emoji_spec.rb b/spec/models/award_emoji_spec.rb
index 8452ac69734..b15b26b1630 100644
--- a/spec/models/award_emoji_spec.rb
+++ b/spec/models/award_emoji_spec.rb
@@ -44,6 +44,29 @@ describe AwardEmoji do
     end
   end
 
+  describe 'scopes' do
+    set(:thumbsup) { create(:award_emoji, name: 'thumbsup') }
+    set(:thumbsdown) { create(:award_emoji, name: 'thumbsdown') }
+
+    describe '.upvotes' do
+      it { expect(described_class.upvotes).to contain_exactly(thumbsup) }
+    end
+
+    describe '.downvotes' do
+      it { expect(described_class.downvotes).to contain_exactly(thumbsdown) }
+    end
+
+    describe '.named' do
+      it { expect(described_class.named('thumbsup')).to contain_exactly(thumbsup) }
+      it { expect(described_class.named(%w[thumbsup thumbsdown])).to contain_exactly(thumbsup, thumbsdown) }
+    end
+
+    describe '.awarded_by' do
+      it { expect(described_class.awarded_by(thumbsup.user)).to contain_exactly(thumbsup) }
+      it { expect(described_class.awarded_by([thumbsup.user, thumbsdown.user])).to contain_exactly(thumbsup, thumbsdown) }
+    end
+  end
+
   describe 'expiring ETag cache' do
     context 'on a note' do
       let(:note) { create(:note_on_issue) }
diff --git a/spec/models/concerns/awardable_spec.rb b/spec/models/concerns/awardable_spec.rb
index 9e7106281ee..76da42cf243 100644
--- a/spec/models/concerns/awardable_spec.rb
+++ b/spec/models/concerns/awardable_spec.rb
@@ -82,16 +82,6 @@ describe Awardable do
     end
   end
 
-  describe "#toggle_award_emoji" do
-    it "adds an emoji if it isn't awarded yet" do
-      expect { issue.toggle_award_emoji("thumbsup", award_emoji.user) }.to change { AwardEmoji.count }.by(1)
-    end
-
-    it "toggles already awarded emoji" do
-      expect { issue.toggle_award_emoji("thumbsdown", award_emoji.user) }.to change { AwardEmoji.count }.by(-1)
-    end
-  end
-
   describe 'querying award_emoji on an Awardable' do
     let(:issue) { create(:issue) }
 
diff --git a/spec/services/award_emojis/add_service_spec.rb b/spec/services/award_emojis/add_service_spec.rb
new file mode 100644
index 00000000000..037db39ba80
--- /dev/null
+++ b/spec/services/award_emojis/add_service_spec.rb
@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe AwardEmojis::AddService do
+  set(:user) { create(:user) }
+  set(:project) { create(:project) }
+  set(:awardable) { create(:note, project: project) }
+  let(:name) { 'thumbsup' }
+  subject(:service) { described_class.new(awardable, name, user) }
+
+  describe '#execute' do
+    context 'when user is not authorized' do
+      it 'does not add an emoji' do
+        expect { service.execute }.not_to change { AwardEmoji.count }
+      end
+
+      it 'returns an error state' do
+        result = service.execute
+
+        expect(result[:status]).to eq(:error)
+        expect(result[:http_status]).to eq(:forbidden)
+      end
+    end
+
+    context 'when user is authorized' do
+      before do
+        project.add_developer(user)
+      end
+
+      it 'creates an award emoji' do
+        expect { service.execute }.to change { AwardEmoji.count }.by(1)
+      end
+
+      it 'returns the award emoji' do
+        result = service.execute
+
+        expect(result[:award]).to be_kind_of(AwardEmoji)
+      end
+
+      it 'return a success status' do
+        result = service.execute
+
+        expect(result[:status]).to eq(:success)
+      end
+
+      it 'sets the correct properties on the award emoji' do
+        award = service.execute[:award]
+
+        expect(award.name).to eq(name)
+        expect(award.user).to eq(user)
+      end
+
+      describe 'marking Todos as done' do
+        subject { service.execute }
+
+        include_examples 'creating award emojis marks Todos as done'
+      end
+
+      context 'when the awardable cannot have emoji awarded to it' do
+        before do
+          expect(awardable).to receive(:emoji_awardable?).and_return(false)
+        end
+
+        it 'does not add an emoji' do
+          expect { service.execute }.not_to change { AwardEmoji.count }
+        end
+
+        it 'returns an error status' do
+          result = service.execute
+
+          expect(result[:status]).to eq(:error)
+          expect(result[:http_status]).to eq(:unprocessable_entity)
+        end
+      end
+
+      context 'when the awardable is invalid' do
+        before do
+          expect_next_instance_of(AwardEmoji) do |award|
+            expect(award).to receive(:valid?).and_return(false)
+            expect(award).to receive_message_chain(:errors, :full_messages).and_return(['Error 1', 'Error 2'])
+          end
+        end
+
+        it 'does not add an emoji' do
+          expect { service.execute }.not_to change { AwardEmoji.count }
+        end
+
+        it 'returns an error status' do
+          result = service.execute
+
+          expect(result[:status]).to eq(:error)
+        end
+
+        it 'returns an error message' do
+          result = service.execute
+
+          expect(result[:message]).to eq('Error 1 and Error 2')
+        end
+      end
+    end
+  end
+end
diff --git a/spec/services/award_emojis/destroy_service_spec.rb b/spec/services/award_emojis/destroy_service_spec.rb
new file mode 100644
index 00000000000..c4a7d5ec20e
--- /dev/null
+++ b/spec/services/award_emojis/destroy_service_spec.rb
@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe AwardEmojis::DestroyService do
+  set(:user) { create(:user) }
+  set(:awardable) { create(:note) }
+  set(:project) { awardable.project }
+  let(:name) { 'thumbsup' }
+  let!(:award_from_other_user) do
+    create(:award_emoji, name: name, awardable: awardable, user: create(:user))
+  end
+  subject(:service) { described_class.new(awardable, name, user) }
+
+  describe '#execute' do
+    shared_examples_for 'a service that does not authorize the user' do |error:|
+      it 'does not remove the emoji' do
+        expect { service.execute }.not_to change { AwardEmoji.count }
+      end
+
+      it 'returns an error state' do
+        result = service.execute
+
+        expect(result[:status]).to eq(:error)
+        expect(result[:http_status]).to eq(:forbidden)
+      end
+
+      it 'returns a nil award' do
+        result = service.execute
+
+        expect(result).to have_key(:award)
+        expect(result[:award]).to be_nil
+      end
+
+      it 'returns the error' do
+        result = service.execute
+
+        expect(result[:message]).to eq(error)
+        expect(result[:errors]).to eq([error])
+      end
+    end
+
+    context 'when user is not authorized' do
+      it_behaves_like 'a service that does not authorize the user',
+                      error: 'User cannot destroy emoji on the awardable'
+    end
+
+    context 'when the user is authorized' do
+      before do
+        project.add_developer(user)
+      end
+
+      context 'when user has not awarded an emoji to the awardable' do
+        let!(:award_from_user) { create(:award_emoji, name: name, user: user) }
+
+        it_behaves_like 'a service that does not authorize the user',
+                         error: 'User has not awarded emoji of type thumbsup on the awardable'
+      end
+
+      context 'when user has awarded an emoji to the awardable' do
+        let!(:award_from_user) { create(:award_emoji, name: name, awardable: awardable, user: user) }
+
+        it 'removes the emoji' do
+          expect { service.execute }.to change { AwardEmoji.count }.by(-1)
+        end
+
+        it 'returns a success status' do
+          result = service.execute
+
+          expect(result[:status]).to eq(:success)
+        end
+
+        it 'returns no errors' do
+          result = service.execute
+
+          expect(result).not_to have_key(:error)
+          expect(result).not_to have_key(:errors)
+        end
+
+        it 'returns the destroyed award' do
+          result = service.execute
+
+          expect(result[:award]).to eq(award_from_user)
+          expect(result[:award]).to be_destroyed
+        end
+      end
+    end
+  end
+end
diff --git a/spec/services/award_emojis/toggle_service_spec.rb b/spec/services/award_emojis/toggle_service_spec.rb
new file mode 100644
index 00000000000..972a1d5fc06
--- /dev/null
+++ b/spec/services/award_emojis/toggle_service_spec.rb
@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe AwardEmojis::ToggleService do
+  set(:user) { create(:user) }
+  set(:project) { create(:project, :public) }
+  set(:awardable) { create(:note, project: project) }
+  let(:name) { 'thumbsup' }
+  subject(:service) { described_class.new(awardable, name, user) }
+
+  describe '#execute' do
+    context 'when user has awarded an emoji' do
+      let!(:award_from_other_user) { create(:award_emoji, name: name, awardable: awardable, user: create(:user)) }
+      let!(:award) { create(:award_emoji, name: name, awardable: awardable, user: user) }
+
+      it 'calls AwardEmojis::DestroyService' do
+        expect(AwardEmojis::AddService).not_to receive(:new)
+
+        expect_next_instance_of(AwardEmojis::DestroyService) do |service|
+          expect(service).to receive(:execute)
+        end
+
+        service.execute
+      end
+
+      it 'destroys an AwardEmoji' do
+        expect { service.execute }.to change { AwardEmoji.count }.by(-1)
+      end
+
+      it 'returns the result of DestroyService#execute' do
+        mock_result = double(foo: true)
+
+        expect_next_instance_of(AwardEmojis::DestroyService) do |service|
+          expect(service).to receive(:execute).and_return(mock_result)
+        end
+
+        result = service.execute
+
+        expect(result).to eq(mock_result)
+      end
+    end
+
+    context 'when user has not awarded an emoji' do
+      it 'calls AwardEmojis::AddService' do
+        expect_next_instance_of(AwardEmojis::AddService) do |service|
+          expect(service).to receive(:execute)
+        end
+
+        expect(AwardEmojis::DestroyService).not_to receive(:new)
+
+        service.execute
+      end
+
+      it 'creates an AwardEmoji' do
+        expect { service.execute }.to change { AwardEmoji.count }.by(1)
+      end
+
+      it 'returns the result of AddService#execute' do
+        mock_result = double(foo: true)
+
+        expect_next_instance_of(AwardEmojis::AddService) do |service|
+          expect(service).to receive(:execute).and_return(mock_result)
+        end
+
+        result = service.execute
+
+        expect(result).to eq(mock_result)
+      end
+    end
+  end
+end
diff --git a/spec/services/projects/create_service_spec.rb b/spec/services/projects/create_service_spec.rb
index b0b74407812..d4fa62fa85d 100644
--- a/spec/services/projects/create_service_spec.rb
+++ b/spec/services/projects/create_service_spec.rb
@@ -78,6 +78,7 @@ describe Projects::CreateService, '#execute' do
       expect(project).to be_valid
       expect(project.owner).to eq(group)
       expect(project.namespace).to eq(group)
+      expect(project.team.owners).to include(user)
       expect(user.authorized_projects).to include(project)
     end
   end
diff --git a/spec/support/shared_examples/award_emoji_todo_shared_examples.rb b/spec/support/shared_examples/award_emoji_todo_shared_examples.rb
new file mode 100644
index 00000000000..88ad37d232f
--- /dev/null
+++ b/spec/support/shared_examples/award_emoji_todo_shared_examples.rb
@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+# Shared examples to that test code that creates AwardEmoji also mark Todos
+# as done.
+#
+# The examples expect these to be defined in the calling spec:
+# - `subject` the callable code that executes the creation of an AwardEmoji
+# - `user`
+# - `project`
+RSpec.shared_examples 'creating award emojis marks Todos as done' do
+  using RSpec::Parameterized::TableSyntax
+
+  before do
+    project.add_developer(user)
+  end
+
+  where(:type, :expectation) do
+    :issue           | true
+    :merge_request   | true
+    :project_snippet | false
+  end
+
+  with_them do
+    let(:project) { awardable.project }
+    let(:awardable) { create(type) }
+    let!(:todo) { create(:todo, target: awardable, project: project, user: user) }
+
+    it do
+      subject
+
+      expect(todo.reload.done?).to eq(expectation)
+    end
+  end
+
+  # Notes have more complicated rules than other Todoables
+  describe 'for notes' do
+    let!(:todo) { create(:todo, target: awardable.noteable, project: project, user: user) }
+
+    context 'regular Notes' do
+      let(:awardable) { create(:note, project: project) }
+
+      it 'marks the Todo as done' do
+        subject
+
+        expect(todo.reload.done?).to eq(true)
+      end
+    end
+
+    context 'PersonalSnippet Notes' do
+      let(:awardable) { create(:note, noteable: create(:personal_snippet, author: user)) }
+
+      it 'does not mark the Todo as done' do
+        subject
+
+        expect(todo.reload.done?).to eq(false)
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 15b02da69f1b3bfac859d076728a46586b53db6b Mon Sep 17 00:00:00 2001
From: Luke Duncalfe <lduncalfe@eml.cc>
Date: Tue, 9 Jul 2019 13:57:04 +1200
Subject: Use AwardEmojis services in GraphQL mutations

https://gitlab.com/gitlab-org/gitlab-ce/issues/63372
---
 app/graphql/mutations/award_emojis/add.rb               |  9 +++------
 app/graphql/mutations/award_emojis/remove.rb            | 15 ++-------------
 app/graphql/mutations/award_emojis/toggle.rb            | 14 +++-----------
 .../api/graphql/mutations/award_emojis/add_spec.rb      | 17 ++++++++++++-----
 .../api/graphql/mutations/award_emojis/toggle_spec.rb   | 17 ++++++++++++-----
 5 files changed, 32 insertions(+), 40 deletions(-)

diff --git a/app/graphql/mutations/award_emojis/add.rb b/app/graphql/mutations/award_emojis/add.rb
index 8e050dd6d29..85f3eb065bb 100644
--- a/app/graphql/mutations/award_emojis/add.rb
+++ b/app/graphql/mutations/award_emojis/add.rb
@@ -10,14 +10,11 @@ module Mutations
 
         check_object_is_awardable!(awardable)
 
-        # TODO this will be handled by AwardEmoji::AddService
-        # See https://gitlab.com/gitlab-org/gitlab-ce/issues/63372 and
-        # https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/29782
-        award = awardable.create_award_emoji(args[:name], current_user)
+        service = ::AwardEmojis::AddService.new(awardable, args[:name], current_user).execute
 
         {
-          award_emoji: (award if award.persisted?),
-          errors: errors_on_object(award)
+          award_emoji: (service[:award] if service[:status] == :success),
+          errors: service[:errors] || []
         }
       end
     end
diff --git a/app/graphql/mutations/award_emojis/remove.rb b/app/graphql/mutations/award_emojis/remove.rb
index 3ba85e445b8..f8a3d0ce390 100644
--- a/app/graphql/mutations/award_emojis/remove.rb
+++ b/app/graphql/mutations/award_emojis/remove.rb
@@ -10,22 +10,11 @@ module Mutations
 
         check_object_is_awardable!(awardable)
 
-        # TODO this check can be removed once AwardEmoji services are available.
-        # See https://gitlab.com/gitlab-org/gitlab-ce/issues/63372 and
-        # https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/29782
-        unless awardable.awarded_emoji?(args[:name], current_user)
-          raise Gitlab::Graphql::Errors::ResourceNotAvailable,
-                'You have not awarded emoji of type name to the awardable'
-        end
-
-        # TODO this will be handled by AwardEmoji::DestroyService
-        # See https://gitlab.com/gitlab-org/gitlab-ce/issues/63372 and
-        # https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/29782
-        awardable.remove_award_emoji(args[:name], current_user)
+        service = ::AwardEmojis::DestroyService.new(awardable, args[:name], current_user).execute
 
         {
           # Mutation response is always a `nil` award_emoji
-          errors: []
+          errors: service[:errors] || []
         }
       end
     end
diff --git a/app/graphql/mutations/award_emojis/toggle.rb b/app/graphql/mutations/award_emojis/toggle.rb
index c03902e8035..d822048f3a6 100644
--- a/app/graphql/mutations/award_emojis/toggle.rb
+++ b/app/graphql/mutations/award_emojis/toggle.rb
@@ -15,23 +15,15 @@ module Mutations
 
         check_object_is_awardable!(awardable)
 
-        # TODO this will be handled by AwardEmoji::ToggleService
-        # See https://gitlab.com/gitlab-org/gitlab-ce/issues/63372 and
-        # https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/29782
-        award = awardable.toggle_award_emoji(args[:name], current_user)
-
-        # Destroy returns a collection :(
-        award = award.first if award.is_a?(Array)
-
-        errors = errors_on_object(award)
+        service = ::AwardEmojis::ToggleService.new(awardable, args[:name], current_user).execute
 
         toggled_on = awardable.awarded_emoji?(args[:name], current_user)
 
         {
           # For consistency with the AwardEmojis::Remove mutation, only return
           # the AwardEmoji if it was created and not destroyed
-          award_emoji: (award if toggled_on),
-          errors: errors,
+          award_emoji: (service[:award] if toggled_on),
+          errors: service[:errors] || [],
           toggled_on: toggled_on
         }
       end
diff --git a/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb b/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb
index 3982125a38a..5b910d5bfe0 100644
--- a/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb
+++ b/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb
@@ -5,9 +5,9 @@ require 'spec_helper'
 describe 'Adding an AwardEmoji' do
   include GraphqlHelpers
 
-  let(:current_user) { create(:user) }
-  let(:awardable) { create(:note) }
-  let(:project) { awardable.project }
+  set(:current_user) { create(:user) }
+  set(:project) { create(:project) }
+  set(:awardable) { create(:note, project: project) }
   let(:emoji_name) { 'thumbsup' }
   let(:mutation) do
     variables = {
@@ -43,7 +43,7 @@ describe 'Adding an AwardEmoji' do
     end
 
     context 'when the given awardable is not an Awardable' do
-      let(:awardable) { create(:label) }
+      let(:awardable) { create(:label, project: project) }
 
       it_behaves_like 'a mutation that does not create an AwardEmoji'
 
@@ -52,7 +52,7 @@ describe 'Adding an AwardEmoji' do
     end
 
     context 'when the given awardable is an Awardable but still cannot be awarded an emoji' do
-      let(:awardable) { create(:system_note) }
+      let(:awardable) { create(:system_note, project: project) }
 
       it_behaves_like 'a mutation that does not create an AwardEmoji'
 
@@ -73,6 +73,13 @@ describe 'Adding an AwardEmoji' do
         expect(mutation_response['awardEmoji']['name']).to eq(emoji_name)
       end
 
+      describe 'marking Todos as done' do
+        let(:user) { current_user}
+        subject { post_graphql_mutation(mutation, current_user: user) }
+
+        include_examples 'creating award emojis marks Todos as done'
+      end
+
       context 'when there were active record validation errors' do
         before do
           expect_next_instance_of(AwardEmoji) do |award|
diff --git a/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb b/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb
index 31145730f10..ae628d3e56c 100644
--- a/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb
+++ b/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb
@@ -5,9 +5,9 @@ require 'spec_helper'
 describe 'Toggling an AwardEmoji' do
   include GraphqlHelpers
 
-  let(:current_user) { create(:user) }
-  let(:awardable) { create(:note) }
-  let(:project) { awardable.project }
+  set(:current_user) { create(:user) }
+  set(:project) { create(:project) }
+  set(:awardable) { create(:note, project: project) }
   let(:emoji_name) { 'thumbsup' }
   let(:mutation) do
     variables = {
@@ -40,7 +40,7 @@ describe 'Toggling an AwardEmoji' do
     end
 
     context 'when the given awardable is not an Awardable' do
-      let(:awardable) { create(:label) }
+      let(:awardable) { create(:label, project: project) }
 
       it_behaves_like 'a mutation that does not create or destroy an AwardEmoji'
 
@@ -49,7 +49,7 @@ describe 'Toggling an AwardEmoji' do
     end
 
     context 'when the given awardable is an Awardable but still cannot be awarded an emoji' do
-      let(:awardable) { create(:system_note) }
+      let(:awardable) { create(:system_note, project: project) }
 
       it_behaves_like 'a mutation that does not create or destroy an AwardEmoji'
 
@@ -81,6 +81,13 @@ describe 'Toggling an AwardEmoji' do
           expect(mutation_response['toggledOn']).to eq(true)
         end
 
+        describe 'marking Todos as done' do
+          let(:user) { current_user}
+          subject { post_graphql_mutation(mutation, current_user: user) }
+
+          include_examples 'creating award emojis marks Todos as done'
+        end
+
         context 'when there were active record validation errors' do
           before do
             expect_next_instance_of(AwardEmoji) do |award|
-- 
cgit v1.2.1


From 926bf71e511e084fa033b4e96f5b4067e0eeca0a Mon Sep 17 00:00:00 2001
From: Luke Duncalfe <lduncalfe@eml.cc>
Date: Tue, 9 Jul 2019 13:58:57 +1200
Subject: Improve specs for Issues and Notes controllers

This adds test that Todos are completed.

https://gitlab.com/gitlab-org/gitlab-ce/issues/63372
---
 .../controllers/projects/issues_controller_spec.rb | 33 ++++++++++++++++++----
 spec/controllers/projects/notes_controller_spec.rb | 19 +++++++++----
 spec/requests/api/award_emoji_spec.rb              | 16 +++++++++++
 3 files changed, 57 insertions(+), 11 deletions(-)

diff --git a/spec/controllers/projects/issues_controller_spec.rb b/spec/controllers/projects/issues_controller_spec.rb
index fab47aa4701..187c7864ad7 100644
--- a/spec/controllers/projects/issues_controller_spec.rb
+++ b/spec/controllers/projects/issues_controller_spec.rb
@@ -1104,18 +1104,39 @@ describe Projects::IssuesController do
       project.add_developer(user)
     end
 
+    subject do
+      post(:toggle_award_emoji, params: {
+        namespace_id: project.namespace,
+        project_id: project,
+        id: issue.iid,
+        name: emoji_name
+      })
+    end
+    let(:emoji_name) { 'thumbsup' }
+
     it "toggles the award emoji" do
       expect do
-        post(:toggle_award_emoji, params: {
-                                    namespace_id: project.namespace,
-                                    project_id: project,
-                                    id: issue.iid,
-                                    name: "thumbsup"
-                                  })
+        subject
       end.to change { issue.award_emoji.count }.by(1)
 
       expect(response).to have_gitlab_http_status(200)
     end
+
+    it "removes the already awarded emoji" do
+      create(:award_emoji, awardable: issue, name: emoji_name, user: user)
+
+      expect { subject }.to change { AwardEmoji.count }.by(-1)
+
+      expect(response).to have_gitlab_http_status(200)
+    end
+
+    it 'marks Todos on the Issue as done' do
+      todo = create(:todo, target: issue, project: project, user: user)
+
+      subject
+
+      expect(todo.reload).to be_done
+    end
   end
 
   describe 'POST create_merge_request' do
diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb
index 9ab565dc2e8..4500c412521 100644
--- a/spec/controllers/projects/notes_controller_spec.rb
+++ b/spec/controllers/projects/notes_controller_spec.rb
@@ -543,23 +543,32 @@ describe Projects::NotesController do
       project.add_developer(user)
     end
 
+    subject { post(:toggle_award_emoji, params: request_params.merge(name: emoji_name)) }
+    let(:emoji_name) { 'thumbsup' }
+
     it "toggles the award emoji" do
       expect do
-        post(:toggle_award_emoji, params: request_params.merge(name: "thumbsup"))
+        subject
       end.to change { note.award_emoji.count }.by(1)
 
       expect(response).to have_gitlab_http_status(200)
     end
 
     it "removes the already awarded emoji" do
-      post(:toggle_award_emoji, params: request_params.merge(name: "thumbsup"))
+      create(:award_emoji, awardable: note, name: emoji_name, user: user)
 
-      expect do
-        post(:toggle_award_emoji, params: request_params.merge(name: "thumbsup"))
-      end.to change { AwardEmoji.count }.by(-1)
+      expect { subject }.to change { AwardEmoji.count }.by(-1)
 
       expect(response).to have_gitlab_http_status(200)
     end
+
+    it 'marks Todos on the Noteable as done' do
+      todo = create(:todo, target: note.noteable, project: project, user: user)
+
+      subject
+
+      expect(todo.reload).to be_done
+    end
   end
 
   describe "resolving and unresolving" do
diff --git a/spec/requests/api/award_emoji_spec.rb b/spec/requests/api/award_emoji_spec.rb
index 6c67d84b59b..342fcfa1041 100644
--- a/spec/requests/api/award_emoji_spec.rb
+++ b/spec/requests/api/award_emoji_spec.rb
@@ -155,6 +155,14 @@ describe API::AwardEmoji do
         expect(json_response['user']['username']).to eq(user.username)
       end
 
+      it 'marks Todos on the Issue as done' do
+        todo = create(:todo, target: issue, project: project, user: user)
+
+        post api("/projects/#{project.id}/issues/#{issue.iid}/award_emoji", user), params: { name: '8ball' }
+
+        expect(todo.reload).to be_done
+      end
+
       it "returns a 400 bad request error if the name is not given" do
         post api("/projects/#{project.id}/issues/#{issue.iid}/award_emoji", user)
 
@@ -209,6 +217,14 @@ describe API::AwardEmoji do
       expect(json_response['user']['username']).to eq(user.username)
     end
 
+    it 'marks Todos on the Noteable as done' do
+      todo = create(:todo, target: note2.noteable, project: project, user: user)
+
+      post api("/projects/#{project.id}/issues/#{issue.iid}/notes/#{note.id}/award_emoji", user), params: { name: 'rocket' }
+
+      expect(todo.reload).to be_done
+    end
+
     it "normalizes +1 as thumbsup award" do
       post api("/projects/#{project.id}/issues/#{issue.iid}/notes/#{note.id}/award_emoji", user), params: { name: '+1' }
 
-- 
cgit v1.2.1


From f69dba8f1091d163fb7b8cfdee8758346d520a59 Mon Sep 17 00:00:00 2001
From: Winnie Hellmann <winnie@gitlab.com>
Date: Wed, 21 Aug 2019 02:02:23 +0000
Subject: Fix code blocks in frontend testing guide (docs)

---
 doc/development/testing_guide/frontend_testing.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/doc/development/testing_guide/frontend_testing.md b/doc/development/testing_guide/frontend_testing.md
index 52ac746716c..ed867c41f59 100644
--- a/doc/development/testing_guide/frontend_testing.md
+++ b/doc/development/testing_guide/frontend_testing.md
@@ -232,7 +232,7 @@ module. GitLab has a custom `spyOnDependency` method which utilizes
 [babel-plugin-rewire](https://github.com/speedskater/babel-plugin-rewire) to
 achieve this. It can be used like so:
 
-```js
+```javascript
 // my_module.js
 import { visitUrl } from '~/lib/utils/url_utility';
 
@@ -241,7 +241,7 @@ export default function doSomething() {
 }
 ```
 
-```js
+```javascript
 // my_module_spec.js
 import doSomething from '~/my_module';
 
@@ -847,7 +847,7 @@ See also the [RSpec testing guidelines](../testing_guide/best_practices.md#rspec
 
 A `:js` flag is added to the test to make sure the full environment is loaded.
 
-```js
+```ruby
 scenario 'successfully', :js do
   sign_in(create(:admin))
 end
@@ -857,7 +857,7 @@ The steps of each test are written using capybara methods ([documentation](https
 
 Bear in mind <abbr title="XMLHttpRequest">XHR</abbr> calls might require you to use `wait_for_requests` in between steps, like so:
 
-```rspec
+```ruby
 find('.form-control').native.send_keys(:enter)
 
 wait_for_requests
@@ -871,7 +871,7 @@ expect(page).not_to have_selector('.card')
 
 We have a helper available to make testing actions easier, as per [official documentation](https://vuex.vuejs.org/guide/testing.html):
 
-```js
+```javascript
 testAction(
   actions.actionName, // action
   { }, // params to be passed to action
@@ -899,7 +899,7 @@ To make mounting a Vue component easier and more readable, we have a few helpers
 
 Examples of usage:
 
-```js
+```javascript
 beforeEach(() => {
   vm = createComponentWithStore(Component, store);
 
@@ -909,7 +909,7 @@ beforeEach(() => {
 });
 ```
 
-```js
+```javascript
 beforeEach(() => {
   vm = mountComponentWithStore(Component, {
     el: '#dummy-element',
@@ -921,7 +921,7 @@ beforeEach(() => {
 
 Don't forget to clean up:
 
-```js
+```javascript
 afterEach(() => {
   vm.$destroy();
 });
-- 
cgit v1.2.1


From d1de6fd4d867ee817a1979e05344e580d33c7759 Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Wed, 21 Aug 2019 11:59:58 +1200
Subject: Column was renamed in 12.2

---
 config/initializers/rest-client-hostname_override.rb    | 2 +-
 spec/initializers/rest-client-hostname_override_spec.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/initializers/rest-client-hostname_override.rb b/config/initializers/rest-client-hostname_override.rb
index bc1b70bd73f..80b123ebe61 100644
--- a/config/initializers/rest-client-hostname_override.rb
+++ b/config/initializers/rest-client-hostname_override.rb
@@ -40,7 +40,7 @@ module RestClient
       end
 
       def allow_settings_local_requests?
-        Gitlab::CurrentSettings.allow_local_requests_from_hooks_and_services?
+        Gitlab::CurrentSettings.allow_local_requests_from_web_hooks_and_services?
       end
     end
 
diff --git a/spec/initializers/rest-client-hostname_override_spec.rb b/spec/initializers/rest-client-hostname_override_spec.rb
index 1ff82342fb5..3707e001d41 100644
--- a/spec/initializers/rest-client-hostname_override_spec.rb
+++ b/spec/initializers/rest-client-hostname_override_spec.rb
@@ -101,7 +101,7 @@ describe 'rest-client dns rebinding protection' do
 
   context 'when local requests are allowed' do
     before do
-      stub_application_setting(allow_local_requests_from_hooks_and_services: true)
+      stub_application_setting(allow_local_requests_from_web_hooks_and_services: true)
     end
 
     it 'allows an external request' do
-- 
cgit v1.2.1


From a07efbdfd0ccb332df124b6c40287bdccb26fd89 Mon Sep 17 00:00:00 2001
From: manojmj <mmj@gitlab.com>
Date: Wed, 21 Aug 2019 09:12:48 +0530
Subject: CE: Audit event for archiving and unarchiving projects

---
 app/controllers/projects_controller.rb       |  5 +-
 doc/administration/audit_events.md           |  2 +
 spec/controllers/projects_controller_spec.rb | 96 ++++++++++++++++++++++++++++
 3 files changed, 99 insertions(+), 4 deletions(-)

diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb
index e04cbf10470..5f335de4d6b 100644
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -29,6 +29,7 @@ class ProjectsController < Projects::ApplicationController
 
   # Authorize
   before_action :authorize_admin_project!, only: [:edit, :update, :housekeeping, :download_export, :export, :remove_export, :generate_new_export]
+  before_action :authorize_archive_project!, only: [:archive, :unarchive]
   before_action :event_filter, only: [:show, :activity]
 
   layout :determine_layout
@@ -164,8 +165,6 @@ class ProjectsController < Projects::ApplicationController
   end
 
   def archive
-    return access_denied! unless can?(current_user, :archive_project, @project)
-
     ::Projects::UpdateService.new(@project, current_user, archived: true).execute
 
     respond_to do |format|
@@ -174,8 +173,6 @@ class ProjectsController < Projects::ApplicationController
   end
 
   def unarchive
-    return access_denied! unless can?(current_user, :archive_project, @project)
-
     ::Projects::UpdateService.new(@project, current_user, archived: false).execute
 
     respond_to do |format|
diff --git a/doc/administration/audit_events.md b/doc/administration/audit_events.md
index 02de2caf558..8075a40cae7 100644
--- a/doc/administration/audit_events.md
+++ b/doc/administration/audit_events.md
@@ -75,6 +75,8 @@ From there, you can see the following actions:
 - User was removed from project
 - Project export was downloaded
 - Project repository was downloaded
+- Project was archived
+- Project was unarchived
 
 ### Instance events **(PREMIUM ONLY)**
 
diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb
index 083a1c1383a..c732caa6160 100644
--- a/spec/controllers/projects_controller_spec.rb
+++ b/spec/controllers/projects_controller_spec.rb
@@ -318,6 +318,102 @@ describe ProjectsController do
     end
   end
 
+  describe 'POST #archive' do
+    let(:group) { create(:group) }
+    let(:project) { create(:project, group: group) }
+
+    before do
+      sign_in(user)
+    end
+
+    context 'for a user with the ability to archive a project' do
+      before do
+        group.add_owner(user)
+
+        post :archive, params: {
+          namespace_id: project.namespace.path,
+          id: project.path
+        }
+      end
+
+      it 'archives the project' do
+        expect(project.reload.archived?).to be_truthy
+      end
+
+      it 'redirects to projects path' do
+        expect(response).to have_gitlab_http_status(302)
+        expect(response).to redirect_to(project_path(project))
+      end
+    end
+
+    context 'for a user that does not have the ability to archive a project' do
+      before do
+        project.add_maintainer(user)
+
+        post :archive, params: {
+          namespace_id: project.namespace.path,
+          id: project.path
+        }
+      end
+
+      it 'does not archive the project' do
+        expect(project.reload.archived?).to be_falsey
+      end
+
+      it 'returns 404' do
+        expect(response).to have_gitlab_http_status(404)
+      end
+    end
+  end
+
+  describe 'POST #unarchive' do
+    let(:group) { create(:group) }
+    let(:project) { create(:project, :archived, group: group) }
+
+    before do
+      sign_in(user)
+    end
+
+    context 'for a user with the ability to unarchive a project' do
+      before do
+        group.add_owner(user)
+
+        post :unarchive, params: {
+          namespace_id: project.namespace.path,
+          id: project.path
+        }
+      end
+
+      it 'unarchives the project' do
+        expect(project.reload.archived?).to be_falsey
+      end
+
+      it 'redirects to projects path' do
+        expect(response).to have_gitlab_http_status(302)
+        expect(response).to redirect_to(project_path(project))
+      end
+    end
+
+    context 'for a user that does not have the ability to unarchive a project' do
+      before do
+        project.add_maintainer(user)
+
+        post :unarchive, params: {
+          namespace_id: project.namespace.path,
+          id: project.path
+        }
+      end
+
+      it 'does not unarchive the project' do
+        expect(project.reload.archived?).to be_truthy
+      end
+
+      it 'returns 404' do
+        expect(response).to have_gitlab_http_status(404)
+      end
+    end
+  end
+
   describe '#housekeeping' do
     let(:group) { create(:group) }
     let(:project) { create(:project, group: group) }
-- 
cgit v1.2.1


From cc5f51970ab6bb8212b52e954bf66e6e9f9cc11b Mon Sep 17 00:00:00 2001
From: Ben Bodenmiller <bbodenmiller@hotmail.com>
Date: Wed, 21 Aug 2019 06:16:17 +0000
Subject: Improve details about when rebase button is offered

---
 doc/user/project/merge_requests/fast_forward_merge.md |  10 ++++++++--
 doc/user/project/merge_requests/img/ff_merge_mr.png   | Bin 0 -> 21380 bytes
 2 files changed, 8 insertions(+), 2 deletions(-)
 create mode 100644 doc/user/project/merge_requests/img/ff_merge_mr.png

diff --git a/doc/user/project/merge_requests/fast_forward_merge.md b/doc/user/project/merge_requests/fast_forward_merge.md
index 4f3c68090e4..2d59e535ce1 100644
--- a/doc/user/project/merge_requests/fast_forward_merge.md
+++ b/doc/user/project/merge_requests/fast_forward_merge.md
@@ -15,7 +15,7 @@ to accept merge requests without creating merge commits.
 When the fast-forward merge
 ([`--ff-only`](https://git-scm.com/docs/git-merge#git-merge---ff-only)) setting
 is enabled, no merge commits will be created and all merges are fast-forwarded,
-which means that merging is only allowed if the branch could be fast-forwarded.
+which means that merging is only allowed if the branch can be fast-forwarded.
 
 When a fast-forward merge is not possible, the user is given the option to rebase.
 
@@ -28,9 +28,15 @@ When a fast-forward merge is not possible, the user is given the option to rebas
 Now, when you visit the merge request page, you will be able to accept it
 **only if a fast-forward merge is possible**.
 
+![Fast forward merge request](img/ff_merge_mr.png)
+
+If a fast-forward merge is not possible but a conflict free rebase is possible,
+a rebase button will be offered.
+
 ![Fast forward merge request](img/ff_merge_rebase.png)
 
-If the target branch is ahead of the source branch, you need to rebase the
+If the target branch is ahead of the source branch and a conflict free rebase is
+not possible, you need to rebase the
 source branch locally before you will be able to do a fast-forward merge.
 
 ![Fast forward merge rebase locally](img/ff_merge_rebase_locally.png)
diff --git a/doc/user/project/merge_requests/img/ff_merge_mr.png b/doc/user/project/merge_requests/img/ff_merge_mr.png
new file mode 100644
index 00000000000..241cc990343
Binary files /dev/null and b/doc/user/project/merge_requests/img/ff_merge_mr.png differ
-- 
cgit v1.2.1


From 6e3cd4c560572decf7b75ed79c69a483d8cae974 Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Wed, 21 Aug 2019 06:49:23 +0000
Subject: Update capitalization in k8s cheat sheet

---
 .../troubleshooting/kubernetes_cheat_sheet.md      | 28 +++++++++++-----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/doc/administration/troubleshooting/kubernetes_cheat_sheet.md b/doc/administration/troubleshooting/kubernetes_cheat_sheet.md
index 95cdb1508fa..238c522a0ee 100644
--- a/doc/administration/troubleshooting/kubernetes_cheat_sheet.md
+++ b/doc/administration/troubleshooting/kubernetes_cheat_sheet.md
@@ -29,7 +29,7 @@ and they will assist you with any issues you are having.
   ```bash
   # for minikube:
   minikube dashboard —url
-  # for non-local installations if access via kubectl is configured:
+  # for non-local installations if access via Kubectl is configured:
   kubectl proxy
   ```
 
@@ -49,7 +49,7 @@ and they will assist you with any issues you are having.
 - What to do with pods in `CrashLoopBackoff` status:
 
   - Check logs via Kubernetes dashboard.
-  - Check logs via `kubectl`:
+  - Check logs via Kubectl:
 
     ```bash
     kubectl logs <unicorn pod> -c dependencies
@@ -72,7 +72,7 @@ and they will assist you with any issues you are having.
   This is the principle of Kubernetes, read [Twelve-factor app](https://12factor.net/)
   for details.
 
-## Gitlab-specific kubernetes information
+## GitLab-specific kubernetes information
 
 - Minimal config that can be used to test a Kubernetes helm chart can be found
   [here](https://gitlab.com/charts/gitlab/issues/620).
@@ -83,7 +83,7 @@ and they will assist you with any issues you are having.
   kubectl logs gitlab-unicorn-7656fdd6bf-jqzfs -c unicorn
   ```
 
-- It is not possible to get all the logs via `kubectl` at once, like with `gitlab-ctl tail`,
+- It is not possible to get all the logs via Kubectl at once, like with `gitlab-ctl tail`,
   but a number of third-party tools can be used to do it:
 
   - [Kubetail](https://github.com/johanhaleby/kubetail)
@@ -131,7 +131,7 @@ and they will assist you with any issues you are having.
   - Check the output of `kubectl get events -w --all-namespaces`.
   - Check the logs of pods within `gitlab-managed-apps` namespace.
   - On the side of GitLab check sidekiq log and kubernetes log. When GitLab is installed
-    via helm chart, kubernetes.log can be found inside the sidekiq pod.
+    via Helm Chart, `kubernetes.log` can be found inside the sidekiq pod.
 
 - How to get your initial admin password <https://docs.gitlab.com/charts/installation/deployment.html#initial-login>:
 
@@ -142,19 +142,19 @@ and they will assist you with any issues you are having.
   kubectl get secret <secret-name> -ojsonpath={.data.password} | base64 --decode ; echo
   ```
 
-- How to connect to a GitLab postgres database:
+- How to connect to a GitLab Postgres database:
 
   ```bash
   kubectl exec -it <task-runner-pod-name> -- /srv/gitlab/bin/rails dbconsole -p
   ```
   
-- How to get info about helm installation status:
+- How to get info about Helm installation status:
 
   ```bash
   helm status name-of-installation
   ```
 
-- How to update GitLab installed using helm chart:
+- How to update GitLab installed using Helm Chart:
 
   ```bash
   helm repo upgrade
@@ -179,25 +179,25 @@ and they will assist you with any issues you are having.
     helm upgrade <release name> <chart path> -f gitlab.yaml
     ```
 
-## Installation of minimal GitLab config via minukube on macOS
+## Installation of minimal GitLab config via Minukube on macOS
 
 This section is based on [Developing for Kubernetes with Minikube](https://gitlab.com/charts/gitlab/blob/master/doc/minikube/index.md)
 and [Helm](https://gitlab.com/charts/gitlab/blob/master/doc/helm/index.md). Refer
 to those documents for details.
 
-- Install kubectl via Homebrew:
+- Install Kubectl via Homebrew:
 
   ```bash
   brew install kubernetes-cli
   ```
 
-- Install minikube via Homebrew:
+- Install Minikube via Homebrew:
 
   ```bash
   brew cask install minikube
   ```
 
-- Start minikube and configure it. If minikube cannot start, try running `minikube delete && minikube start`
+- Start Minikube and configure it. If Minikube cannot start, try running `minikube delete && minikube start`
   and repeat the steps:
 
   ```bash
@@ -206,7 +206,7 @@ to those documents for details.
   minikube addons enable kube-dns
   ```
 
-- Install helm via Homebrew and initialize it:
+- Install Helm via Homebrew and initialize it:
 
   ```bash
   brew install kubernetes-helm
@@ -219,7 +219,7 @@ to those documents for details.
 - Find the IP address in the output of `minikube ip` and update the yaml file with
   this IP address.
 
-- Install the GitLab helm chart:
+- Install the GitLab Helm Chart:
 
   ```bash
   helm repo add gitlab https://charts.gitlab.io
-- 
cgit v1.2.1


From cdabb9d5b6f44016fbe61979d3338add34fc9956 Mon Sep 17 00:00:00 2001
From: drew <dscimino@gmail.com>
Date: Wed, 21 Aug 2019 07:15:43 +0000
Subject: Added an example to doumentation for using multiple build policies
 with only: and except:

---
 doc/ci/yaml/README.md | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md
index 335f3292444..c957ed2cc6b 100644
--- a/doc/ci/yaml/README.md
+++ b/doc/ci/yaml/README.md
@@ -518,10 +518,24 @@ Four keys are available:
 - `changes`
 - `kubernetes`
 
-If you use multiple keys under `only` or `except`, they act as an AND. The logic is:
+If you use multiple keys under `only` or `except`, the keys will be evaluated as a
+single conjoined expression. That is:
+
+- `only:` means "include this job if all of the conditions match".
+- `except:` means "exclude this job if any of the conditions match".
+
+The the individual keys are logically joined by an AND:
 
 > (any of refs) AND (any of variables) AND (any of changes) AND (if kubernetes is active)
 
+`except` is implemented as a negation of this complete expression:
+
+> NOT((any of refs) AND (any of variables) AND (any of changes) AND (if kubernetes is active))
+
+This, more intuitively, means the keys join by an OR. A functionally equivalent expression:
+
+> (any of refs) OR (any of variables) OR (any of changes) OR (if kubernetes is active)
+
 #### `only:refs`/`except:refs`
 
 > `refs` policy introduced in GitLab 10.0.
-- 
cgit v1.2.1


From 55f9739c9c609154cb5bdd5daefbd28fc918cf49 Mon Sep 17 00:00:00 2001
From: Mark Chao <mchao@gitlab.com>
Date: Fri, 9 Aug 2019 16:15:34 +0800
Subject: ES: sync with EE

Doc for multi-indices archtecture
---
 config/initializers/zz_metrics.rb                  |  6 +---
 doc/development/elasticsearch.md                   | 37 ++++++++++++++++------
 doc/development/img/elasticsearch_architecture.svg |  1 +
 3 files changed, 29 insertions(+), 15 deletions(-)
 create mode 100644 doc/development/img/elasticsearch_architecture.svg

diff --git a/config/initializers/zz_metrics.rb b/config/initializers/zz_metrics.rb
index b005fdf159b..af4aec7b355 100644
--- a/config/initializers/zz_metrics.rb
+++ b/config/initializers/zz_metrics.rb
@@ -100,11 +100,7 @@ def instrument_classes(instrumentation)
     instrumentation.instrument_instance_methods(Gitlab::Elastic::SnippetSearchResults)
     instrumentation.instrument_methods(Gitlab::Elastic::Helper)
 
-    instrumentation.instrument_instance_methods(Elastic::ApplicationSearch)
-    instrumentation.instrument_instance_methods(Elastic::IssuesSearch)
-    instrumentation.instrument_instance_methods(Elastic::MergeRequestsSearch)
-    instrumentation.instrument_instance_methods(Elastic::MilestonesSearch)
-    instrumentation.instrument_instance_methods(Elastic::NotesSearch)
+    instrumentation.instrument_instance_methods(Elastic::ApplicationVersionedSearch)
     instrumentation.instrument_instance_methods(Elastic::ProjectsSearch)
     instrumentation.instrument_instance_methods(Elastic::RepositoriesSearch)
     instrumentation.instrument_instance_methods(Elastic::SnippetsSearch)
diff --git a/doc/development/elasticsearch.md b/doc/development/elasticsearch.md
index 635895051bc..bcc95d73d39 100644
--- a/doc/development/elasticsearch.md
+++ b/doc/development/elasticsearch.md
@@ -148,26 +148,43 @@ Uses an [Edge NGram token filter](https://www.elastic.co/guide/en/elasticsearch/
 - Searches can have their own analyzers. Remember to check when editing analyzers
 - `Character` filters (as opposed to token filters) always replace the original character, so they're not a good choice as they can hinder exact searches
 
-## Architecture
+## Zero downtime reindexing with multiple indices
 
-GitLab uses `elasticsearch-rails` for handling communication with Elasticsearch server. However, in order to achieve zero-downtime deployment during schema changes, an extra abstraction layer is built to allow:
+Currently GitLab can only handle a single version of setting. Any setting/schema changes would require reindexing everything from scratch. Since reindexing can take a long time, this can cause search functionality downtime.
 
-* Indexing (writes) to multiple indexes, with different mappings
-* Switching to different index for searches (reads) on the fly
+To avoid downtime, GitLab is working on to allow multiple indices to function at the same time. Whenever the schema changes, the admin will be able to create a new index and reindex to it, while users still searches using the older stable index. Any data updates would be forwarded to both indices. Once the new index is ready, admin can mark it as the read node where search takes place, and remove the old index.
 
-Currently we are on the process of migrating models to this new design (e.g. `Snippet`), and it is hardwired to work with a single version for now.
+This is also helpful for migrating to new servers, e.g. moving to/from AWS.
 
-Traditionally, `elasticsearch-rails` provides class and instance level `__elasticsearch__` proxy methods. If you call `Issue.__elasticsearch__`, you will get an instance of `Elasticsearch::Model::Proxy::ClassMethodsProxy`, and if you call `Issue.first.__elasticsearch__`, you will get an instance of `Elasticsearch::Model::Proxy::InstanceMethodsProxy`. These proxy objects would talk to Elasticsearch server directly.
+Currently we are on the process of migrating to this new design. Everything is hardwired to work with one single version for now.
 
-In the new design, `__elasticsearch__` instead represents one extra layer of proxy. It would keep multiple versions of the actual proxy objects, and it would forward read and write calls to the proxy of the intended version.
+### Architecture
 
-The `elasticsearch-rails`'s way of specifying each model's mappings and other settings is to create a module for the model to include. However in the new design, each model would have its own corresponding subclassed proxy object, where the settings reside in. For example, snippet related setting in the past reside in `SnippetsSearch` module, but in the new design would reside in `SnippetClassProxy` (which is a subclass of `Elasticsearch::Model::Proxy::ClassMethodsProxy`). This reduces namespace pollution in model classes.
+The traditional setup, provided by `elasticsearch-rails`, is to communicate through its internal proxy classes. Developers would write model-specific logic in a module for the model to include in (e.g. `SnippetsSearch`). The `__elasticsearch__` methods would return a proxy object, e.g.:
+
+- `Issue.__elasticsearch__` returns an instance of `Elasticsearch::Model::Proxy::ClassMethodsProxy`
+- `Issue.first.__elasticsearch__` returns an instance of `Elasticsearch::Model::Proxy::InstanceMethodsProxy`.
+
+These proxy objects would talk to Elasticsearch server directly (see top half of the diagram).
+
+![Elasticsearch Architecture](img/elasticsearch_architecture.svg)
+
+In the planned new design, each model would have a pair of corresponding subclassed proxy objects, in which model-specific logic is located. For example, `Snippet` would have `SnippetClassProxy` and `SnippetInstanceProxy` (being subclass of `Elasticsearch::Model::Proxy::ClassMethodsProxy` and `Elasticsearch::Model::Proxy::InstanceMethodsProxy`, respectively).
+
+`__elasticsearch__` would represent another layer of proxy object, keeping track of multiple actual proxy objects. It would forward method calls to the appropriate index. For example:
+
+- `model.__elasticsearch__.search` would be forwarded to the one stable index, since it is a read operation.
+- `model.__elasticsearch__.update_document` would be forwarded to all indices, to keep all indices up-to-date.
 
 The global configurations per version are now in the `Elastic::(Version)::Config` class. You can change mappings there.
 
 ### Creating new version of schema
 
-Currently GitLab would still work with a single version of setting. Once it is implemented, multiple versions of setting can exists in different folders (e.g. `ee/lib/elastic/v12p1` and `ee/lib/elastic/v12p3`). To keep a continuous git history, the latest version lives under the `/latest` folder, but is aliased as the latest version.
+NOTE: **Note:** this is not applicable yet as multiple indices functionality is not fully implemented.
+
+Folders like `ee/lib/elastic/v12p1` contain snapshots of search logic from different versions. To keep a continuous git history, the latest version lives under `ee/lib/elastic/latest`, but its classes are aliased under an actual version (e.g. `ee/lib/elastic/v12p3`). When referencing these classes, never use the `Latest` namespace directly, but use the actual version (e.g. `V12p3`).
+
+The version name basically follows GitLab's release version. If setting is changed in 12.3, we will create a new namespace called `V12p3` (p stands for "point"). Raise an issue if there is a need to name a version differently.
 
 If the current version is `v12p1`, and we need to create a new version for `v12p3`, the steps are as follows:
 
@@ -176,7 +193,7 @@ If the current version is `v12p1`, and we need to create a new version for `v12p
 1. Delete `v12p1` folder
 1. Copy the entire folder of `latest` as `v12p1`
 1. Change the namespace for files under `v12p1` folder from `Latest` to `V12p1`
-1. Make changes to `Latest` as needed
+1. Make changes to files under the `latest` folder as needed
 
 ## Troubleshooting
 
diff --git a/doc/development/img/elasticsearch_architecture.svg b/doc/development/img/elasticsearch_architecture.svg
new file mode 100644
index 00000000000..2f38f9b04ee
--- /dev/null
+++ b/doc/development/img/elasticsearch_architecture.svg
@@ -0,0 +1 @@
+<svg version="1.2" width="210mm" height="297mm" viewBox="0 0 21000 29700" preserveAspectRatio="xMidYMid" fill-rule="evenodd" stroke-width="28.222" stroke-linejoin="round" xmlns="http://www.w3.org/2000/svg"><defs class="ClipPathGroup"><clipPath id="a" clipPathUnits="userSpaceOnUse"><path d="M0 0h21000v29700H0z"/></clipPath></defs><g class="SlideGroup"><g class="Slide" clip-path="url(#a)"><g class="Page"><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M1975 5575h3051v1651H1975z"/><path fill="#FFF" d="M3500 7200H2000V5600h3000v1600H3500z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M3500 7200H2000V5600h3000v1600H3500z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="2778" y="6311"><tspan>Snippet</tspan></tspan><tspan class="TextPosition" x="2099" y="6785"><tspan>(ActiveRecord)</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M1475 3975h4051v3551H1475z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M3500 7500H1500V4000h4000v3500H3500z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="1788" y="5048"><tspan>ApplicationSearch</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.ConnectorShape"><path class="BoundingBox" fill="none" d="M5975 4675h8051v701H5975z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M6000 5350h4000v-650h4000"/></g><g class="com.sun.star.drawing.ConnectorShape"><path class="BoundingBox" fill="none" d="M5975 5325h8051v1101H5975z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M6000 5350h4000v1050h4000"/></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M1075 2875h4951v4951H1075z"/><path fill="none" stroke="#F33" stroke-width="50" d="M3550 7800H1100V2900h4900v4900H3550z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="700"><tspan class="TextPosition" x="1946" y="3514"><tspan fill="#C9211E">SnippetsSearch</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M1975 12175h3051v1651H1975z"/><path fill="#FFF" d="M3500 13800H2000v-1600h3000v1600H3500z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M3500 13800H2000v-1600h3000v1600H3500z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="2778" y="12911"><tspan>Snippet</tspan></tspan><tspan class="TextPosition" x="2099" y="13385"><tspan>(ActiveRecord)</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M1075 10775h4951v3251H1075z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M3550 14000H1100v-3200h4900v3200H3550z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="2511" y="11461"><tspan>Application</tspan></tspan><tspan class="TextPosition" x="1933" y="11935"><tspan>VersionedSearch</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.ConnectorShape"><path class="BoundingBox" fill="none" d="M3525 13975h4501v7451H3525z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M3550 14000v7400h4450"/></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M14008 14075h4985v851h-4985z"/><path fill="none" stroke="#999" stroke-width="50" d="M16500 14900h-2467v-800h4934v800h-2467z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="14720" y="14648"><tspan fill="gray">ClassMethodProxy</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M13375 13075h6251v2151h-6251z"/><path fill="none" stroke="#F33" stroke-width="50" d="M16500 15200h-3100v-2100h6200v2100h-3100z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="700"><tspan class="TextPosition" x="13799" y="13731"><tspan fill="#C9211E">V12p1::SnippetClassProxy</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M7975 14575h3051v1851H7975z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M9500 16400H8000v-1800h3000v1800H9500z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="8277" y="15411"><tspan>MultiVersion-</tspan></tspan><tspan class="TextPosition" x="8429" y="15885"><tspan>ClassProxy</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M14008 16875h4985v851h-4985z"/><path fill="none" stroke="#999" stroke-width="50" d="M16500 17700h-2467v-800h4934v800h-2467z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="14720" y="17448"><tspan fill="gray">ClassMethodProxy</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M13375 15875h6251v2151h-6251z"/><path fill="none" stroke="#F33" stroke-width="50" d="M16500 18000h-3100v-2100h6200v2100h-3100z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="700"><tspan class="TextPosition" x="13799" y="16531"><tspan fill="#C9211E">V12p2::SnippetClassProxy</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.ConnectorShape"><path class="BoundingBox" fill="none" d="M10975 14125h2451v1401h-2451z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M11000 15500h1463v-1350h937"/></g><g class="com.sun.star.drawing.ConnectorShape"><path class="BoundingBox" fill="none" d="M10975 15475h2451v1501h-2451z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M11000 15500h1463v1450h937"/></g><g class="com.sun.star.drawing.ConnectorShape"><path class="BoundingBox" fill="none" d="M3525 13975h4501v1551H3525z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M3550 14000v1500h4450"/></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M14008 19975h4985v851h-4985z"/><path fill="none" stroke="#999" stroke-width="50" d="M16500 20800h-2467v-800h4934v800h-2467z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="14445" y="20548"><tspan fill="gray">InstanceMethodProxy</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M13375 18975h6251v2151h-6251z"/><path fill="none" stroke="#F33" stroke-width="50" d="M16500 21100h-3100v-2100h6200v2100h-3100z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="700"><tspan class="TextPosition" x="13505" y="19631"><tspan fill="#C9211E">V12p1::SnippetInstanceProxy</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M7975 20275h3051v2251H7975z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M9500 22500H8000v-2200h3000v2200H9500z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="8277" y="21311"><tspan>MultiVersion-</tspan></tspan><tspan class="TextPosition" x="8154" y="21785"><tspan>InstanceProxy</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M14008 22775h4985v851h-4985z"/><path fill="none" stroke="#999" stroke-width="50" d="M16500 23600h-2467v-800h4934v800h-2467z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="14445" y="23348"><tspan fill="gray">InstanceMethodProxy</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M13375 21775h6251v2151h-6251z"/><path fill="none" stroke="#F33" stroke-width="50" d="M16500 23900h-3100v-2100h6200v2100h-3100z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="700"><tspan class="TextPosition" x="13505" y="22431"><tspan fill="#C9211E">V12p2::SnippetInstanceProxy</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.ConnectorShape"><path class="BoundingBox" fill="none" d="M10975 20025h2451v1401h-2451z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M11000 21400h1463v-1350h937"/></g><g class="com.sun.star.drawing.ConnectorShape"><path class="BoundingBox" fill="none" d="M10975 21375h2451v1501h-2451z"/><path fill="none" stroke="#3465A4" stroke-width="50" d="M11000 21400h1463v1450h937"/></g><g class="com.sun.star.drawing.TextShape"><path class="BoundingBox" fill="none" d="M900 1600h10697v879H900z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="564" font-weight="400"><tspan class="TextPosition" x="1150" y="2233"><tspan>Standard elasticsearch-rails setup</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.TextShape"><path class="BoundingBox" fill="none" d="M900 9300h7683v879H900z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="564" font-weight="400"><tspan class="TextPosition" x="1150" y="9933"><tspan>GitLab multi-indices setup</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.TextShape"><path class="BoundingBox" fill="none" d="M3400 21300h4821v1197H3400z"/><text class="TextShape"><tspan class="TextParagraph" font-size="388" font-weight="400"><tspan class="TextPosition" x="4250" y="21840"><tspan fill="gray">(instance method)</tspan></tspan><tspan class="TextPosition" x="3651" y="22264"><tspan font-family="Courier" font-size="423">__elasticsearch__</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.TextShape"><path class="BoundingBox" fill="none" d="M3380 15400h4821v1197H3380z"/><text class="TextShape"><tspan class="TextParagraph" font-size="388" font-weight="400"><tspan class="TextPosition" x="4512" y="15940"><tspan fill="gray">(class method)</tspan></tspan><tspan class="TextPosition" x="3631" y="16364"><tspan font-family="Courier" font-size="423">__elasticsearch__</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.TextShape"><path class="BoundingBox" fill="none" d="M9000 3500h4821v1197H9000z"/><text class="TextShape"><tspan class="TextParagraph" font-size="388" font-weight="400"><tspan class="TextPosition" x="10132" y="4040"><tspan fill="gray">(class method)</tspan></tspan><tspan class="TextPosition" x="9251" y="4464"><tspan font-family="Courier" font-size="423">__elasticsearch__</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.TextShape"><path class="BoundingBox" fill="none" d="M9000 6400h4821v1197H9000z"/><text class="TextShape"><tspan class="TextParagraph" font-size="388" font-weight="400"><tspan class="TextPosition" x="9850" y="6940"><tspan fill="gray">(instance method)</tspan></tspan><tspan class="TextPosition" x="9251" y="7364"><tspan font-family="Courier" font-size="423">__elasticsearch__</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M1975 25175h2051v851H1975z"/><path fill="none" stroke="#999" stroke-width="50" d="M3000 26000H2000v-800h2000v800H3000z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="2634" y="25748"><tspan fill="gray">Foo</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.TextShape"><path class="BoundingBox" fill="none" d="M4400 25200h7101v726H4400z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="4650" y="25710"><tspan>elasticsearch-rails’ internal class</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.TextShape"><path class="BoundingBox" fill="none" d="M4400 26400h8601v1200H4400z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="4650" y="26910"><tspan>where model-specific logic is</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M1975 26275h2051v851H1975z"/><path fill="none" stroke="#F33" stroke-width="50" d="M3000 27100H2000v-800h2000v800H3000z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="700"><tspan class="TextPosition" x="2613" y="26848"><tspan fill="#C9211E">Foo</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.TextShape"><path class="BoundingBox" fill="none" d="M4900 17289h5901v2312H4900z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="370" font-weight="400"><tspan class="TextPosition" x="7236" y="17748"><tspan fill="gray">Write operations like </tspan></tspan><tspan class="TextPosition" x="5323" y="18159"><tspan fill="gray">indexing/updating are forwarded </tspan></tspan><tspan class="TextPosition" x="8024" y="18570"><tspan fill="gray">to all instances.</tspan></tspan></tspan><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="370" font-weight="400"><tspan class="TextPosition" x="5501" y="18981"><tspan fill="gray">Read operations are forwarded </tspan></tspan><tspan class="TextPosition" x="7126" y="19392"><tspan fill="gray">to specified instance.</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.ConnectorShape"><path class="BoundingBox" fill="none" d="M10785 15769h1422v2691h-1422z"/><path fill="none" stroke="#999" stroke-width="30" d="M10800 18444c1429 0 934-1618 1119-2337"/><path fill="#999" d="M12206 15769l-460 293 267 217 193-510z"/></g><g class="com.sun.star.drawing.ConnectorShape"><path class="BoundingBox" fill="none" d="M10785 18429h1528v2862h-1528z"/><path fill="none" stroke="#999" stroke-width="30" d="M10800 18444c1509 0 970 1782 1200 2526"/><path fill="#999" d="M12312 21290l-227-496-252 235 479 261z"/></g><g class="com.sun.star.drawing.TextShape"><path class="BoundingBox" fill="none" d="M1800 24000h7101v807H1800z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="494" font-weight="700"><tspan class="TextPosition" x="2050" y="24574"><tspan>Legend</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M13975 4275h5085v851h-5085z"/><path fill="none" stroke="#999" stroke-width="50" d="M16517 5100h-2517v-800h5034v800h-2517z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="14737" y="4848"><tspan fill="gray">ClassMethodProxy</tspan></tspan></tspan></text></g><g class="com.sun.star.drawing.CustomShape"><path class="BoundingBox" fill="none" d="M13975 5975h5085v851h-5085z"/><path fill="none" stroke="#999" stroke-width="50" d="M16517 6800h-2517v-800h5034v800h-2517z"/><text class="TextShape"><tspan class="TextParagraph" font-family="Arial, sans-serif" font-size="423" font-weight="400"><tspan class="TextPosition" x="14462" y="6548"><tspan fill="gray">InstanceMethodProxy</tspan></tspan></tspan></text></g></g></g></g></svg>
\ No newline at end of file
-- 
cgit v1.2.1


From 208cc38d989afaf9c9fafd4a90962a23ab3e6195 Mon Sep 17 00:00:00 2001
From: Winnie Hellmann <winnie@gitlab.com>
Date: Wed, 21 Aug 2019 08:01:58 +0000
Subject: Make native event test in autosave_spec.js synchronous

---
 spec/frontend/autosave_spec.js | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/spec/frontend/autosave_spec.js b/spec/frontend/autosave_spec.js
index 4d9c8f96d62..33d402388c9 100644
--- a/spec/frontend/autosave_spec.js
+++ b/spec/frontend/autosave_spec.js
@@ -63,12 +63,15 @@ describe('Autosave', () => {
         expect(field.trigger).toHaveBeenCalled();
       });
 
-      it('triggers native event', done => {
-        autosave.field.get(0).addEventListener('change', () => {
-          done();
-        });
+      it('triggers native event', () => {
+        const fieldElement = autosave.field.get(0);
+        const eventHandler = jest.fn();
+        fieldElement.addEventListener('change', eventHandler);
 
         Autosave.prototype.restore.call(autosave);
+
+        expect(eventHandler).toHaveBeenCalledTimes(1);
+        fieldElement.removeEventListener('change', eventHandler);
       });
     });
 
-- 
cgit v1.2.1


From 45c5144e36e73c80e34282dda7b7c1c32a1fc0ea Mon Sep 17 00:00:00 2001
From: Fabio Pitino <fpitino@gitlab.com>
Date: Mon, 19 Aug 2019 16:29:53 +0200
Subject: Add active_jobs_limit to plans table

This is a port from EE changes where
we introduce a new limit for Plan model.

https://dev.gitlab.org/gitlab/gitlab-ee/merge_requests/1182
---
 app/models/ci/pipeline.rb                           |  1 +
 app/services/ci/create_pipeline_service.rb          |  3 ++-
 ...20190816151221_add_active_jobs_limit_to_plans.rb | 17 +++++++++++++++++
 db/schema.rb                                        |  3 ++-
 lib/gitlab/ci/pipeline/chain/limit/job_activity.rb  | 21 +++++++++++++++++++++
 5 files changed, 43 insertions(+), 2 deletions(-)
 create mode 100644 db/migrate/20190816151221_add_active_jobs_limit_to_plans.rb
 create mode 100644 lib/gitlab/ci/pipeline/chain/limit/job_activity.rb

diff --git a/app/models/ci/pipeline.rb b/app/models/ci/pipeline.rb
index 0a943a33bbb..64e372878e6 100644
--- a/app/models/ci/pipeline.rb
+++ b/app/models/ci/pipeline.rb
@@ -203,6 +203,7 @@ module Ci
     scope :for_sha, -> (sha) { where(sha: sha) }
     scope :for_source_sha, -> (source_sha) { where(source_sha: source_sha) }
     scope :for_sha_or_source_sha, -> (sha) { for_sha(sha).or(for_source_sha(sha)) }
+    scope :created_after, -> (time) { where('ci_pipelines.created_at > ?', time) }
 
     scope :triggered_by_merge_request, -> (merge_request) do
       where(source: :merge_request_event, merge_request: merge_request)
diff --git a/app/services/ci/create_pipeline_service.rb b/app/services/ci/create_pipeline_service.rb
index cdcc4b15bea..29317f1176e 100644
--- a/app/services/ci/create_pipeline_service.rb
+++ b/app/services/ci/create_pipeline_service.rb
@@ -15,7 +15,8 @@ module Ci
                 Gitlab::Ci::Pipeline::Chain::Limit::Size,
                 Gitlab::Ci::Pipeline::Chain::Populate,
                 Gitlab::Ci::Pipeline::Chain::Create,
-                Gitlab::Ci::Pipeline::Chain::Limit::Activity].freeze
+                Gitlab::Ci::Pipeline::Chain::Limit::Activity,
+                Gitlab::Ci::Pipeline::Chain::Limit::JobActivity].freeze
 
     def execute(source, ignore_skip_ci: false, save_on_errors: true, trigger_request: nil, schedule: nil, merge_request: nil, **options, &block)
       @pipeline = Ci::Pipeline.new
diff --git a/db/migrate/20190816151221_add_active_jobs_limit_to_plans.rb b/db/migrate/20190816151221_add_active_jobs_limit_to_plans.rb
new file mode 100644
index 00000000000..951ff41f1a8
--- /dev/null
+++ b/db/migrate/20190816151221_add_active_jobs_limit_to_plans.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddActiveJobsLimitToPlans < ActiveRecord::Migration[5.2]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_column_with_default :plans, :active_jobs_limit, :integer, default: 0
+  end
+
+  def down
+    remove_column :plans, :active_jobs_limit
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index ce5fd38129a..7bdc8c5d849 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2019_08_15_093949) do
+ActiveRecord::Schema.define(version: 2019_08_16_151221) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "pg_trgm"
@@ -2500,6 +2500,7 @@ ActiveRecord::Schema.define(version: 2019_08_15_093949) do
     t.string "title"
     t.integer "active_pipelines_limit"
     t.integer "pipeline_size_limit"
+    t.integer "active_jobs_limit", default: 0
     t.index ["name"], name: "index_plans_on_name"
   end
 
diff --git a/lib/gitlab/ci/pipeline/chain/limit/job_activity.rb b/lib/gitlab/ci/pipeline/chain/limit/job_activity.rb
new file mode 100644
index 00000000000..31c218bf954
--- /dev/null
+++ b/lib/gitlab/ci/pipeline/chain/limit/job_activity.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Pipeline
+      module Chain
+        module Limit
+          class JobActivity < Chain::Base
+            def perform!
+              # to be overridden in EE
+            end
+
+            def break?
+              false # to be overridden in EE
+            end
+          end
+        end
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From b6ea6d7f9b8dd5f27060a8f699542a6f7d86b2a9 Mon Sep 17 00:00:00 2001
From: Miguel Rincon <mrincon@gitlab.com>
Date: Wed, 21 Aug 2019 08:06:05 +0000
Subject: CE Port: Use EE panel type to display alert menu correctly in
 dashboards

---
 .../monitoring/components/dashboard.vue            |  14 +-
 .../monitoring/components/dashboard_spec.js        | 588 +++++++++++++++++++++
 spec/javascripts/monitoring/dashboard_spec.js      | 588 ---------------------
 3 files changed, 601 insertions(+), 589 deletions(-)
 create mode 100644 spec/javascripts/monitoring/components/dashboard_spec.js
 delete mode 100644 spec/javascripts/monitoring/dashboard_spec.js

diff --git a/app/assets/javascripts/monitoring/components/dashboard.vue b/app/assets/javascripts/monitoring/components/dashboard.vue
index c414c26ca61..ebd610af7b6 100644
--- a/app/assets/javascripts/monitoring/components/dashboard.vue
+++ b/app/assets/javascripts/monitoring/components/dashboard.vue
@@ -14,9 +14,9 @@ import { __, s__ } from '~/locale';
 import Icon from '~/vue_shared/components/icon.vue';
 import { getParameterValues, mergeUrlParams } from '~/lib/utils/url_utility';
 import invalidUrl from '~/lib/utils/invalid_url';
+import PanelType from 'ee_else_ce/monitoring/components/panel_type.vue';
 import MonitorAreaChart from './charts/area.vue';
 import MonitorSingleStatChart from './charts/single_stat.vue';
-import PanelType from './panel_type.vue';
 import GraphGroup from './graph_group.vue';
 import EmptyState from './empty_state.vue';
 import { sidebarAnimationDuration, timeWindows } from '../constants';
@@ -141,6 +141,16 @@ export default {
       required: false,
       default: false,
     },
+    alertsEndpoint: {
+      type: String,
+      required: false,
+      default: null,
+    },
+    prometheusAlertsAvailable: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
   },
   data() {
     return {
@@ -449,6 +459,8 @@ export default {
             :clipboard-text="generateLink(groupData.group, graphData.title, graphData.y_label)"
             :graph-data="graphData"
             :dashboard-width="elWidth"
+            :alerts-endpoint="alertsEndpoint"
+            :prometheus-alerts-available="prometheusAlertsAvailable"
             :index="`${index}-${graphIndex}`"
           />
         </template>
diff --git a/spec/javascripts/monitoring/components/dashboard_spec.js b/spec/javascripts/monitoring/components/dashboard_spec.js
new file mode 100644
index 00000000000..f3ec7520c6f
--- /dev/null
+++ b/spec/javascripts/monitoring/components/dashboard_spec.js
@@ -0,0 +1,588 @@
+import Vue from 'vue';
+import { shallowMount, createLocalVue } from '@vue/test-utils';
+import { GlToast } from '@gitlab/ui';
+import MockAdapter from 'axios-mock-adapter';
+import Dashboard from '~/monitoring/components/dashboard.vue';
+import { timeWindows, timeWindowsKeyNames } from '~/monitoring/constants';
+import * as types from '~/monitoring/stores/mutation_types';
+import { createStore } from '~/monitoring/stores';
+import axios from '~/lib/utils/axios_utils';
+import MonitoringMock, {
+  metricsGroupsAPIResponse,
+  mockApiEndpoint,
+  environmentData,
+  singleGroupResponse,
+  dashboardGitResponse,
+} from '../mock_data';
+
+const localVue = createLocalVue();
+const propsData = {
+  hasMetrics: false,
+  documentationPath: '/path/to/docs',
+  settingsPath: '/path/to/settings',
+  clustersPath: '/path/to/clusters',
+  tagsPath: '/path/to/tags',
+  projectPath: '/path/to/project',
+  metricsEndpoint: mockApiEndpoint,
+  deploymentsEndpoint: null,
+  emptyGettingStartedSvgPath: '/path/to/getting-started.svg',
+  emptyLoadingSvgPath: '/path/to/loading.svg',
+  emptyNoDataSvgPath: '/path/to/no-data.svg',
+  emptyUnableToConnectSvgPath: '/path/to/unable-to-connect.svg',
+  environmentsEndpoint: '/root/hello-prometheus/environments/35',
+  currentEnvironmentName: 'production',
+  customMetricsAvailable: false,
+  customMetricsPath: '',
+  validateQueryPath: '',
+};
+
+export default propsData;
+
+describe('Dashboard', () => {
+  let DashboardComponent;
+  let mock;
+  let store;
+  let component;
+  let mockGraphData;
+
+  beforeEach(() => {
+    setFixtures(`
+      <div class="prometheus-graphs"></div>
+      <div class="layout-page"></div>
+    `);
+
+    window.gon = {
+      ...window.gon,
+      ee: false,
+    };
+
+    store = createStore();
+    mock = new MockAdapter(axios);
+    DashboardComponent = Vue.extend(Dashboard);
+  });
+
+  afterEach(() => {
+    if (component) {
+      component.$destroy();
+    }
+    mock.restore();
+  });
+
+  describe('no metrics are available yet', () => {
+    beforeEach(() => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: { ...propsData },
+        store,
+      });
+    });
+
+    it('shows a getting started empty state when no metrics are present', () => {
+      expect(component.$el.querySelector('.prometheus-graphs')).toBe(null);
+      expect(component.emptyState).toEqual('gettingStarted');
+    });
+
+    it('shows the environment selector', () => {
+      expect(component.$el.querySelector('.js-environments-dropdown')).toBeTruthy();
+    });
+  });
+
+  describe('no data found', () => {
+    it('shows the environment selector dropdown', () => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: { ...propsData, showEmptyState: true },
+        store,
+      });
+
+      expect(component.$el.querySelector('.js-environments-dropdown')).toBeTruthy();
+    });
+  });
+
+  describe('requests information to the server', () => {
+    beforeEach(() => {
+      mock.onGet(mockApiEndpoint).reply(200, metricsGroupsAPIResponse);
+    });
+
+    it('shows up a loading state', done => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: { ...propsData, hasMetrics: true },
+        store,
+      });
+
+      Vue.nextTick(() => {
+        expect(component.emptyState).toEqual('loading');
+        done();
+      });
+    });
+
+    it('hides the legend when showLegend is false', done => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: {
+          ...propsData,
+          hasMetrics: true,
+          showLegend: false,
+        },
+        store,
+      });
+
+      setTimeout(() => {
+        expect(component.showEmptyState).toEqual(false);
+        expect(component.$el.querySelector('.legend-group')).toEqual(null);
+        expect(component.$el.querySelector('.prometheus-graph-group')).toBeTruthy();
+        done();
+      });
+    });
+
+    it('hides the group panels when showPanels is false', done => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: {
+          ...propsData,
+          hasMetrics: true,
+          showPanels: false,
+        },
+        store,
+      });
+
+      setTimeout(() => {
+        expect(component.showEmptyState).toEqual(false);
+        expect(component.$el.querySelector('.prometheus-panel')).toEqual(null);
+        expect(component.$el.querySelector('.prometheus-graph-group')).toBeTruthy();
+        done();
+      });
+    });
+
+    it('renders the environments dropdown with a number of environments', done => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: {
+          ...propsData,
+          hasMetrics: true,
+          showPanels: false,
+        },
+        store,
+      });
+
+      component.$store.commit(
+        `monitoringDashboard/${types.RECEIVE_ENVIRONMENTS_DATA_SUCCESS}`,
+        environmentData,
+      );
+      component.$store.commit(
+        `monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`,
+        singleGroupResponse,
+      );
+
+      Vue.nextTick()
+        .then(() => {
+          const dropdownMenuEnvironments = component.$el.querySelectorAll(
+            '.js-environments-dropdown .dropdown-item',
+          );
+
+          expect(component.environments.length).toEqual(environmentData.length);
+          expect(dropdownMenuEnvironments.length).toEqual(component.environments.length);
+
+          Array.from(dropdownMenuEnvironments).forEach((value, index) => {
+            if (environmentData[index].metrics_path) {
+              expect(value).toHaveAttr('href', environmentData[index].metrics_path);
+            }
+          });
+
+          done();
+        })
+        .catch(done.fail);
+    });
+
+    it('hides the environments dropdown list when there is no environments', done => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: {
+          ...propsData,
+          hasMetrics: true,
+          showPanels: false,
+        },
+        store,
+      });
+
+      component.$store.commit(`monitoringDashboard/${types.RECEIVE_ENVIRONMENTS_DATA_SUCCESS}`, []);
+      component.$store.commit(
+        `monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`,
+        singleGroupResponse,
+      );
+
+      Vue.nextTick()
+        .then(() => {
+          const dropdownMenuEnvironments = component.$el.querySelectorAll(
+            '.js-environments-dropdown .dropdown-item',
+          );
+
+          expect(dropdownMenuEnvironments.length).toEqual(0);
+          done();
+        })
+        .catch(done.fail);
+    });
+
+    it('renders the environments dropdown with a single active element', done => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: {
+          ...propsData,
+          hasMetrics: true,
+          showPanels: false,
+        },
+        store,
+      });
+
+      component.$store.commit(
+        `monitoringDashboard/${types.RECEIVE_ENVIRONMENTS_DATA_SUCCESS}`,
+        environmentData,
+      );
+      component.$store.commit(
+        `monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`,
+        singleGroupResponse,
+      );
+
+      Vue.nextTick()
+        .then(() => {
+          const dropdownItems = component.$el.querySelectorAll(
+            '.js-environments-dropdown .dropdown-item.active',
+          );
+
+          expect(dropdownItems.length).toEqual(1);
+          done();
+        })
+        .catch(done.fail);
+    });
+
+    it('hides the dropdown', done => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: {
+          ...propsData,
+          hasMetrics: true,
+          showPanels: false,
+          environmentsEndpoint: '',
+        },
+        store,
+      });
+
+      Vue.nextTick(() => {
+        const dropdownIsActiveElement = component.$el.querySelectorAll('.environments');
+
+        expect(dropdownIsActiveElement.length).toEqual(0);
+        done();
+      });
+    });
+
+    it('renders the time window dropdown with a set of options', done => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: {
+          ...propsData,
+          hasMetrics: true,
+          showPanels: false,
+        },
+        store,
+      });
+      const numberOfTimeWindows = Object.keys(timeWindows).length;
+
+      setTimeout(() => {
+        const timeWindowDropdown = component.$el.querySelector('.js-time-window-dropdown');
+        const timeWindowDropdownEls = component.$el.querySelectorAll(
+          '.js-time-window-dropdown .dropdown-item',
+        );
+
+        expect(timeWindowDropdown).not.toBeNull();
+        expect(timeWindowDropdownEls.length).toEqual(numberOfTimeWindows);
+
+        done();
+      });
+    });
+
+    it('fetches the metrics data with proper time window', done => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: {
+          ...propsData,
+          hasMetrics: true,
+          showPanels: false,
+        },
+        store,
+      });
+
+      spyOn(component.$store, 'dispatch').and.stub();
+      const getTimeDiffSpy = spyOnDependency(Dashboard, 'getTimeDiff').and.callThrough();
+
+      component.$store.commit(
+        `monitoringDashboard/${types.RECEIVE_ENVIRONMENTS_DATA_SUCCESS}`,
+        environmentData,
+      );
+
+      component.$mount();
+
+      Vue.nextTick()
+        .then(() => {
+          expect(component.$store.dispatch).toHaveBeenCalled();
+          expect(getTimeDiffSpy).toHaveBeenCalled();
+
+          done();
+        })
+        .catch(done.fail);
+    });
+
+    it('shows a specific time window selected from the url params', done => {
+      const start = 1564439536;
+      const end = 1564441336;
+      spyOnDependency(Dashboard, 'getTimeDiff').and.returnValue({
+        start,
+        end,
+      });
+      spyOnDependency(Dashboard, 'getParameterValues').and.callFake(param => {
+        if (param === 'start') return [start];
+        if (param === 'end') return [end];
+        return [];
+      });
+
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: { ...propsData, hasMetrics: true },
+        store,
+      });
+
+      setTimeout(() => {
+        const selectedTimeWindow = component.$el.querySelector('.js-time-window-dropdown .active');
+
+        expect(selectedTimeWindow.textContent.trim()).toEqual('30 minutes');
+        done();
+      });
+    });
+
+    it('defaults to the eight hours time window for non valid url parameters', done => {
+      spyOnDependency(Dashboard, 'getParameterValues').and.returnValue([
+        '<script>alert("XSS")</script>',
+      ]);
+
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: { ...propsData, hasMetrics: true },
+        store,
+      });
+
+      Vue.nextTick(() => {
+        expect(component.selectedTimeWindowKey).toEqual(timeWindowsKeyNames.eightHours);
+
+        done();
+      });
+    });
+  });
+
+  describe('link to chart', () => {
+    let wrapper;
+    const currentDashboard = 'TEST_DASHBOARD';
+    localVue.use(GlToast);
+    const link = () => wrapper.find('.js-chart-link');
+    const clipboardText = () => link().element.dataset.clipboardText;
+
+    beforeEach(done => {
+      mock.onGet(mockApiEndpoint).reply(200, metricsGroupsAPIResponse);
+
+      wrapper = shallowMount(DashboardComponent, {
+        localVue,
+        sync: false,
+        attachToDocument: true,
+        propsData: { ...propsData, hasMetrics: true, currentDashboard },
+        store,
+      });
+
+      setTimeout(done);
+    });
+
+    afterEach(() => {
+      wrapper.destroy();
+    });
+
+    it('adds a copy button to the dropdown', () => {
+      expect(link().text()).toContain('Generate link to chart');
+    });
+
+    it('contains a link to the dashboard', () => {
+      expect(clipboardText()).toContain(`dashboard=${currentDashboard}`);
+      expect(clipboardText()).toContain(`group=`);
+      expect(clipboardText()).toContain(`title=`);
+      expect(clipboardText()).toContain(`y_label=`);
+    });
+
+    it('undefined parameter is stripped', done => {
+      wrapper.setProps({ currentDashboard: undefined });
+
+      wrapper.vm.$nextTick(() => {
+        expect(clipboardText()).not.toContain(`dashboard=`);
+        expect(clipboardText()).toContain(`y_label=`);
+        done();
+      });
+    });
+
+    it('null parameter is stripped', done => {
+      wrapper.setProps({ currentDashboard: null });
+
+      wrapper.vm.$nextTick(() => {
+        expect(clipboardText()).not.toContain(`dashboard=`);
+        expect(clipboardText()).toContain(`y_label=`);
+        done();
+      });
+    });
+
+    it('creates a toast when clicked', () => {
+      spyOn(wrapper.vm.$toast, 'show').and.stub();
+
+      link().vm.$emit('click');
+
+      expect(wrapper.vm.$toast.show).toHaveBeenCalled();
+    });
+  });
+
+  describe('when the window resizes', () => {
+    beforeEach(() => {
+      mock.onGet(mockApiEndpoint).reply(200, metricsGroupsAPIResponse);
+      jasmine.clock().install();
+    });
+
+    afterEach(() => {
+      jasmine.clock().uninstall();
+    });
+
+    it('sets elWidth to page width when the sidebar is resized', done => {
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: {
+          ...propsData,
+          hasMetrics: true,
+          showPanels: false,
+        },
+        store,
+      });
+
+      expect(component.elWidth).toEqual(0);
+
+      const pageLayoutEl = document.querySelector('.layout-page');
+      pageLayoutEl.classList.add('page-with-icon-sidebar');
+
+      Vue.nextTick()
+        .then(() => {
+          jasmine.clock().tick(1000);
+          return Vue.nextTick();
+        })
+        .then(() => {
+          expect(component.elWidth).toEqual(pageLayoutEl.clientWidth);
+          done();
+        })
+        .catch(done.fail);
+    });
+  });
+
+  describe('external dashboard link', () => {
+    beforeEach(() => {
+      mock.onGet(mockApiEndpoint).reply(200, metricsGroupsAPIResponse);
+
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: {
+          ...propsData,
+          hasMetrics: true,
+          showPanels: false,
+          showTimeWindowDropdown: false,
+          externalDashboardUrl: '/mockUrl',
+        },
+        store,
+      });
+    });
+
+    it('shows the link', done => {
+      setTimeout(() => {
+        expect(component.$el.querySelector('.js-external-dashboard-link').innerText).toContain(
+          'View full dashboard',
+        );
+        done();
+      });
+    });
+  });
+
+  describe('Dashboard dropdown', () => {
+    beforeEach(() => {
+      mock.onGet(mockApiEndpoint).reply(200, metricsGroupsAPIResponse);
+
+      component = new DashboardComponent({
+        el: document.querySelector('.prometheus-graphs'),
+        propsData: {
+          ...propsData,
+          hasMetrics: true,
+          showPanels: false,
+        },
+        store,
+      });
+
+      component.$store.dispatch('monitoringDashboard/setFeatureFlags', {
+        prometheusEndpoint: false,
+        multipleDashboardsEnabled: true,
+      });
+
+      component.$store.commit(
+        `monitoringDashboard/${types.RECEIVE_ENVIRONMENTS_DATA_SUCCESS}`,
+        environmentData,
+      );
+
+      component.$store.commit(
+        `monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`,
+        singleGroupResponse,
+      );
+
+      component.$store.commit(
+        `monitoringDashboard/${types.SET_ALL_DASHBOARDS}`,
+        dashboardGitResponse,
+      );
+    });
+
+    it('shows the dashboard dropdown', done => {
+      setTimeout(() => {
+        const dashboardDropdown = component.$el.querySelector('.js-dashboards-dropdown');
+
+        expect(dashboardDropdown).not.toEqual(null);
+        done();
+      });
+    });
+  });
+
+  describe('when downloading metrics data as CSV', () => {
+    beforeEach(() => {
+      component = new DashboardComponent({
+        propsData: {
+          ...propsData,
+        },
+        store,
+      });
+      store.commit(
+        `monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`,
+        MonitoringMock.data,
+      );
+      [mockGraphData] = component.$store.state.monitoringDashboard.groups[0].metrics;
+    });
+
+    describe('csvText', () => {
+      it('converts metrics data from json to csv', () => {
+        const header = `timestamp,${mockGraphData.y_label}`;
+        const data = mockGraphData.queries[0].result[0].values;
+        const firstRow = `${data[0][0]},${data[0][1]}`;
+
+        expect(component.csvText(mockGraphData)).toMatch(`^${header}\r\n${firstRow}`);
+      });
+    });
+
+    describe('downloadCsv', () => {
+      it('produces a link with a Blob', () => {
+        expect(component.downloadCsv(mockGraphData)).toContain(`blob:`);
+      });
+    });
+  });
+});
diff --git a/spec/javascripts/monitoring/dashboard_spec.js b/spec/javascripts/monitoring/dashboard_spec.js
deleted file mode 100644
index 02c3f303912..00000000000
--- a/spec/javascripts/monitoring/dashboard_spec.js
+++ /dev/null
@@ -1,588 +0,0 @@
-import Vue from 'vue';
-import { shallowMount, createLocalVue } from '@vue/test-utils';
-import { GlToast } from '@gitlab/ui';
-import MockAdapter from 'axios-mock-adapter';
-import Dashboard from '~/monitoring/components/dashboard.vue';
-import { timeWindows, timeWindowsKeyNames } from '~/monitoring/constants';
-import * as types from '~/monitoring/stores/mutation_types';
-import { createStore } from '~/monitoring/stores';
-import axios from '~/lib/utils/axios_utils';
-import MonitoringMock, {
-  metricsGroupsAPIResponse,
-  mockApiEndpoint,
-  environmentData,
-  singleGroupResponse,
-  dashboardGitResponse,
-} from './mock_data';
-
-const localVue = createLocalVue();
-const propsData = {
-  hasMetrics: false,
-  documentationPath: '/path/to/docs',
-  settingsPath: '/path/to/settings',
-  clustersPath: '/path/to/clusters',
-  tagsPath: '/path/to/tags',
-  projectPath: '/path/to/project',
-  metricsEndpoint: mockApiEndpoint,
-  deploymentsEndpoint: null,
-  emptyGettingStartedSvgPath: '/path/to/getting-started.svg',
-  emptyLoadingSvgPath: '/path/to/loading.svg',
-  emptyNoDataSvgPath: '/path/to/no-data.svg',
-  emptyUnableToConnectSvgPath: '/path/to/unable-to-connect.svg',
-  environmentsEndpoint: '/root/hello-prometheus/environments/35',
-  currentEnvironmentName: 'production',
-  customMetricsAvailable: false,
-  customMetricsPath: '',
-  validateQueryPath: '',
-};
-
-export default propsData;
-
-describe('Dashboard', () => {
-  let DashboardComponent;
-  let mock;
-  let store;
-  let component;
-  let mockGraphData;
-
-  beforeEach(() => {
-    setFixtures(`
-      <div class="prometheus-graphs"></div>
-      <div class="layout-page"></div>
-    `);
-
-    window.gon = {
-      ...window.gon,
-      ee: false,
-    };
-
-    store = createStore();
-    mock = new MockAdapter(axios);
-    DashboardComponent = Vue.extend(Dashboard);
-  });
-
-  afterEach(() => {
-    if (component) {
-      component.$destroy();
-    }
-    mock.restore();
-  });
-
-  describe('no metrics are available yet', () => {
-    beforeEach(() => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: { ...propsData },
-        store,
-      });
-    });
-
-    it('shows a getting started empty state when no metrics are present', () => {
-      expect(component.$el.querySelector('.prometheus-graphs')).toBe(null);
-      expect(component.emptyState).toEqual('gettingStarted');
-    });
-
-    it('shows the environment selector', () => {
-      expect(component.$el.querySelector('.js-environments-dropdown')).toBeTruthy();
-    });
-  });
-
-  describe('no data found', () => {
-    it('shows the environment selector dropdown', () => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: { ...propsData, showEmptyState: true },
-        store,
-      });
-
-      expect(component.$el.querySelector('.js-environments-dropdown')).toBeTruthy();
-    });
-  });
-
-  describe('requests information to the server', () => {
-    beforeEach(() => {
-      mock.onGet(mockApiEndpoint).reply(200, metricsGroupsAPIResponse);
-    });
-
-    it('shows up a loading state', done => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: { ...propsData, hasMetrics: true },
-        store,
-      });
-
-      Vue.nextTick(() => {
-        expect(component.emptyState).toEqual('loading');
-        done();
-      });
-    });
-
-    it('hides the legend when showLegend is false', done => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: {
-          ...propsData,
-          hasMetrics: true,
-          showLegend: false,
-        },
-        store,
-      });
-
-      setTimeout(() => {
-        expect(component.showEmptyState).toEqual(false);
-        expect(component.$el.querySelector('.legend-group')).toEqual(null);
-        expect(component.$el.querySelector('.prometheus-graph-group')).toBeTruthy();
-        done();
-      });
-    });
-
-    it('hides the group panels when showPanels is false', done => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: {
-          ...propsData,
-          hasMetrics: true,
-          showPanels: false,
-        },
-        store,
-      });
-
-      setTimeout(() => {
-        expect(component.showEmptyState).toEqual(false);
-        expect(component.$el.querySelector('.prometheus-panel')).toEqual(null);
-        expect(component.$el.querySelector('.prometheus-graph-group')).toBeTruthy();
-        done();
-      });
-    });
-
-    it('renders the environments dropdown with a number of environments', done => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: {
-          ...propsData,
-          hasMetrics: true,
-          showPanels: false,
-        },
-        store,
-      });
-
-      component.$store.commit(
-        `monitoringDashboard/${types.RECEIVE_ENVIRONMENTS_DATA_SUCCESS}`,
-        environmentData,
-      );
-      component.$store.commit(
-        `monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`,
-        singleGroupResponse,
-      );
-
-      Vue.nextTick()
-        .then(() => {
-          const dropdownMenuEnvironments = component.$el.querySelectorAll(
-            '.js-environments-dropdown .dropdown-item',
-          );
-
-          expect(component.environments.length).toEqual(environmentData.length);
-          expect(dropdownMenuEnvironments.length).toEqual(component.environments.length);
-
-          Array.from(dropdownMenuEnvironments).forEach((value, index) => {
-            if (environmentData[index].metrics_path) {
-              expect(value).toHaveAttr('href', environmentData[index].metrics_path);
-            }
-          });
-
-          done();
-        })
-        .catch(done.fail);
-    });
-
-    it('hides the environments dropdown list when there is no environments', done => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: {
-          ...propsData,
-          hasMetrics: true,
-          showPanels: false,
-        },
-        store,
-      });
-
-      component.$store.commit(`monitoringDashboard/${types.RECEIVE_ENVIRONMENTS_DATA_SUCCESS}`, []);
-      component.$store.commit(
-        `monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`,
-        singleGroupResponse,
-      );
-
-      Vue.nextTick()
-        .then(() => {
-          const dropdownMenuEnvironments = component.$el.querySelectorAll(
-            '.js-environments-dropdown .dropdown-item',
-          );
-
-          expect(dropdownMenuEnvironments.length).toEqual(0);
-          done();
-        })
-        .catch(done.fail);
-    });
-
-    it('renders the environments dropdown with a single active element', done => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: {
-          ...propsData,
-          hasMetrics: true,
-          showPanels: false,
-        },
-        store,
-      });
-
-      component.$store.commit(
-        `monitoringDashboard/${types.RECEIVE_ENVIRONMENTS_DATA_SUCCESS}`,
-        environmentData,
-      );
-      component.$store.commit(
-        `monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`,
-        singleGroupResponse,
-      );
-
-      Vue.nextTick()
-        .then(() => {
-          const dropdownItems = component.$el.querySelectorAll(
-            '.js-environments-dropdown .dropdown-item.active',
-          );
-
-          expect(dropdownItems.length).toEqual(1);
-          done();
-        })
-        .catch(done.fail);
-    });
-
-    it('hides the dropdown', done => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: {
-          ...propsData,
-          hasMetrics: true,
-          showPanels: false,
-          environmentsEndpoint: '',
-        },
-        store,
-      });
-
-      Vue.nextTick(() => {
-        const dropdownIsActiveElement = component.$el.querySelectorAll('.environments');
-
-        expect(dropdownIsActiveElement.length).toEqual(0);
-        done();
-      });
-    });
-
-    it('renders the time window dropdown with a set of options', done => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: {
-          ...propsData,
-          hasMetrics: true,
-          showPanels: false,
-        },
-        store,
-      });
-      const numberOfTimeWindows = Object.keys(timeWindows).length;
-
-      setTimeout(() => {
-        const timeWindowDropdown = component.$el.querySelector('.js-time-window-dropdown');
-        const timeWindowDropdownEls = component.$el.querySelectorAll(
-          '.js-time-window-dropdown .dropdown-item',
-        );
-
-        expect(timeWindowDropdown).not.toBeNull();
-        expect(timeWindowDropdownEls.length).toEqual(numberOfTimeWindows);
-
-        done();
-      });
-    });
-
-    it('fetches the metrics data with proper time window', done => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: {
-          ...propsData,
-          hasMetrics: true,
-          showPanels: false,
-        },
-        store,
-      });
-
-      spyOn(component.$store, 'dispatch').and.stub();
-      const getTimeDiffSpy = spyOnDependency(Dashboard, 'getTimeDiff').and.callThrough();
-
-      component.$store.commit(
-        `monitoringDashboard/${types.RECEIVE_ENVIRONMENTS_DATA_SUCCESS}`,
-        environmentData,
-      );
-
-      component.$mount();
-
-      Vue.nextTick()
-        .then(() => {
-          expect(component.$store.dispatch).toHaveBeenCalled();
-          expect(getTimeDiffSpy).toHaveBeenCalled();
-
-          done();
-        })
-        .catch(done.fail);
-    });
-
-    it('shows a specific time window selected from the url params', done => {
-      const start = 1564439536;
-      const end = 1564441336;
-      spyOnDependency(Dashboard, 'getTimeDiff').and.returnValue({
-        start,
-        end,
-      });
-      spyOnDependency(Dashboard, 'getParameterValues').and.callFake(param => {
-        if (param === 'start') return [start];
-        if (param === 'end') return [end];
-        return [];
-      });
-
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: { ...propsData, hasMetrics: true },
-        store,
-      });
-
-      setTimeout(() => {
-        const selectedTimeWindow = component.$el.querySelector('.js-time-window-dropdown .active');
-
-        expect(selectedTimeWindow.textContent.trim()).toEqual('30 minutes');
-        done();
-      });
-    });
-
-    it('defaults to the eight hours time window for non valid url parameters', done => {
-      spyOnDependency(Dashboard, 'getParameterValues').and.returnValue([
-        '<script>alert("XSS")</script>',
-      ]);
-
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: { ...propsData, hasMetrics: true },
-        store,
-      });
-
-      Vue.nextTick(() => {
-        expect(component.selectedTimeWindowKey).toEqual(timeWindowsKeyNames.eightHours);
-
-        done();
-      });
-    });
-  });
-
-  describe('link to chart', () => {
-    let wrapper;
-    const currentDashboard = 'TEST_DASHBOARD';
-    localVue.use(GlToast);
-    const link = () => wrapper.find('.js-chart-link');
-    const clipboardText = () => link().element.dataset.clipboardText;
-
-    beforeEach(done => {
-      mock.onGet(mockApiEndpoint).reply(200, metricsGroupsAPIResponse);
-
-      wrapper = shallowMount(DashboardComponent, {
-        localVue,
-        sync: false,
-        attachToDocument: true,
-        propsData: { ...propsData, hasMetrics: true, currentDashboard },
-        store,
-      });
-
-      setTimeout(done);
-    });
-
-    afterEach(() => {
-      wrapper.destroy();
-    });
-
-    it('adds a copy button to the dropdown', () => {
-      expect(link().text()).toContain('Generate link to chart');
-    });
-
-    it('contains a link to the dashboard', () => {
-      expect(clipboardText()).toContain(`dashboard=${currentDashboard}`);
-      expect(clipboardText()).toContain(`group=`);
-      expect(clipboardText()).toContain(`title=`);
-      expect(clipboardText()).toContain(`y_label=`);
-    });
-
-    it('undefined parameter is stripped', done => {
-      wrapper.setProps({ currentDashboard: undefined });
-
-      wrapper.vm.$nextTick(() => {
-        expect(clipboardText()).not.toContain(`dashboard=`);
-        expect(clipboardText()).toContain(`y_label=`);
-        done();
-      });
-    });
-
-    it('null parameter is stripped', done => {
-      wrapper.setProps({ currentDashboard: null });
-
-      wrapper.vm.$nextTick(() => {
-        expect(clipboardText()).not.toContain(`dashboard=`);
-        expect(clipboardText()).toContain(`y_label=`);
-        done();
-      });
-    });
-
-    it('creates a toast when clicked', () => {
-      spyOn(wrapper.vm.$toast, 'show').and.stub();
-
-      link().vm.$emit('click');
-
-      expect(wrapper.vm.$toast.show).toHaveBeenCalled();
-    });
-  });
-
-  describe('when the window resizes', () => {
-    beforeEach(() => {
-      mock.onGet(mockApiEndpoint).reply(200, metricsGroupsAPIResponse);
-      jasmine.clock().install();
-    });
-
-    afterEach(() => {
-      jasmine.clock().uninstall();
-    });
-
-    it('sets elWidth to page width when the sidebar is resized', done => {
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: {
-          ...propsData,
-          hasMetrics: true,
-          showPanels: false,
-        },
-        store,
-      });
-
-      expect(component.elWidth).toEqual(0);
-
-      const pageLayoutEl = document.querySelector('.layout-page');
-      pageLayoutEl.classList.add('page-with-icon-sidebar');
-
-      Vue.nextTick()
-        .then(() => {
-          jasmine.clock().tick(1000);
-          return Vue.nextTick();
-        })
-        .then(() => {
-          expect(component.elWidth).toEqual(pageLayoutEl.clientWidth);
-          done();
-        })
-        .catch(done.fail);
-    });
-  });
-
-  describe('external dashboard link', () => {
-    beforeEach(() => {
-      mock.onGet(mockApiEndpoint).reply(200, metricsGroupsAPIResponse);
-
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: {
-          ...propsData,
-          hasMetrics: true,
-          showPanels: false,
-          showTimeWindowDropdown: false,
-          externalDashboardUrl: '/mockUrl',
-        },
-        store,
-      });
-    });
-
-    it('shows the link', done => {
-      setTimeout(() => {
-        expect(component.$el.querySelector('.js-external-dashboard-link').innerText).toContain(
-          'View full dashboard',
-        );
-        done();
-      });
-    });
-  });
-
-  describe('Dashboard dropdown', () => {
-    beforeEach(() => {
-      mock.onGet(mockApiEndpoint).reply(200, metricsGroupsAPIResponse);
-
-      component = new DashboardComponent({
-        el: document.querySelector('.prometheus-graphs'),
-        propsData: {
-          ...propsData,
-          hasMetrics: true,
-          showPanels: false,
-        },
-        store,
-      });
-
-      component.$store.dispatch('monitoringDashboard/setFeatureFlags', {
-        prometheusEndpoint: false,
-        multipleDashboardsEnabled: true,
-      });
-
-      component.$store.commit(
-        `monitoringDashboard/${types.RECEIVE_ENVIRONMENTS_DATA_SUCCESS}`,
-        environmentData,
-      );
-
-      component.$store.commit(
-        `monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`,
-        singleGroupResponse,
-      );
-
-      component.$store.commit(
-        `monitoringDashboard/${types.SET_ALL_DASHBOARDS}`,
-        dashboardGitResponse,
-      );
-    });
-
-    it('shows the dashboard dropdown', done => {
-      setTimeout(() => {
-        const dashboardDropdown = component.$el.querySelector('.js-dashboards-dropdown');
-
-        expect(dashboardDropdown).not.toEqual(null);
-        done();
-      });
-    });
-  });
-
-  describe('when downloading metrics data as CSV', () => {
-    beforeEach(() => {
-      component = new DashboardComponent({
-        propsData: {
-          ...propsData,
-        },
-        store,
-      });
-      store.commit(
-        `monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`,
-        MonitoringMock.data,
-      );
-      [mockGraphData] = component.$store.state.monitoringDashboard.groups[0].metrics;
-    });
-
-    describe('csvText', () => {
-      it('converts metrics data from json to csv', () => {
-        const header = `timestamp,${mockGraphData.y_label}`;
-        const data = mockGraphData.queries[0].result[0].values;
-        const firstRow = `${data[0][0]},${data[0][1]}`;
-
-        expect(component.csvText(mockGraphData)).toMatch(`^${header}\r\n${firstRow}`);
-      });
-    });
-
-    describe('downloadCsv', () => {
-      it('produces a link with a Blob', () => {
-        expect(component.downloadCsv(mockGraphData)).toContain(`blob:`);
-      });
-    });
-  });
-});
-- 
cgit v1.2.1


From a28c77f2adcb1a355a7497bd3a46d86a4c5d4d05 Mon Sep 17 00:00:00 2001
From: Winnie Hellmann <winnie@gitlab.com>
Date: Wed, 21 Aug 2019 08:06:50 +0000
Subject: Throw error for multiple RecaptchaModal instances

---
 app/assets/javascripts/vue_shared/components/recaptcha_modal.vue | 7 +++++++
 spec/javascripts/issue_show/components/description_spec.js       | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/app/assets/javascripts/vue_shared/components/recaptcha_modal.vue b/app/assets/javascripts/vue_shared/components/recaptcha_modal.vue
index df19906309c..f0aae20477b 100644
--- a/app/assets/javascripts/vue_shared/components/recaptcha_modal.vue
+++ b/app/assets/javascripts/vue_shared/components/recaptcha_modal.vue
@@ -30,9 +30,16 @@ export default {
   },
 
   mounted() {
+    if (window.recaptchaDialogCallback) {
+      throw new Error('recaptchaDialogCallback is already defined!');
+    }
     window.recaptchaDialogCallback = this.submit.bind(this);
   },
 
+  beforeDestroy() {
+    window.recaptchaDialogCallback = null;
+  },
+
   methods: {
     appendRecaptchaScript() {
       this.removeRecaptchaScript();
diff --git a/spec/javascripts/issue_show/components/description_spec.js b/spec/javascripts/issue_show/components/description_spec.js
index 7e00fbf2745..e10426a9858 100644
--- a/spec/javascripts/issue_show/components/description_spec.js
+++ b/spec/javascripts/issue_show/components/description_spec.js
@@ -1,5 +1,6 @@
 import $ from 'jquery';
 import Vue from 'vue';
+import '~/behaviors/markdown/render_gfm';
 import Description from '~/issue_show/components/description.vue';
 import mountComponent from 'spec/helpers/vue_mount_component_helper';
 
@@ -91,6 +92,7 @@ describe('Description component', () => {
     let TaskList;
 
     beforeEach(() => {
+      vm.$destroy();
       vm = mountComponent(
         DescriptionComponent,
         Object.assign({}, props, {
-- 
cgit v1.2.1


From 261f4fe7accfb0cad82feed4f74a26e9ccebcbe3 Mon Sep 17 00:00:00 2001
From: Samantha Ming <sming@gitlab.com>
Date: Wed, 21 Aug 2019 08:23:22 +0000
Subject: Fix to show renamed file in mr

---
 app/assets/javascripts/diffs/components/diff_file_header.vue | 2 +-
 changelogs/unreleased/59786-show-renamed-file-in-mr.yml      | 5 +++++
 spec/javascripts/diffs/components/diff_file_header_spec.js   | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/59786-show-renamed-file-in-mr.yml

diff --git a/app/assets/javascripts/diffs/components/diff_file_header.vue b/app/assets/javascripts/diffs/components/diff_file_header.vue
index 32fbeaaa905..69ec6ab8600 100644
--- a/app/assets/javascripts/diffs/components/diff_file_header.vue
+++ b/app/assets/javascripts/diffs/components/diff_file_header.vue
@@ -130,7 +130,7 @@ export default {
       return `\`${this.diffFile.file_path}\``;
     },
     isFileRenamed() {
-      return this.diffFile.viewer.name === diffViewerModes.renamed;
+      return this.diffFile.renamed_file;
     },
     isModeChanged() {
       return this.diffFile.viewer.name === diffViewerModes.mode_changed;
diff --git a/changelogs/unreleased/59786-show-renamed-file-in-mr.yml b/changelogs/unreleased/59786-show-renamed-file-in-mr.yml
new file mode 100644
index 00000000000..e8c52b592d2
--- /dev/null
+++ b/changelogs/unreleased/59786-show-renamed-file-in-mr.yml
@@ -0,0 +1,5 @@
+---
+title: Fix to show renamed file in mr
+merge_request: 31888
+author:
+type: changed
diff --git a/spec/javascripts/diffs/components/diff_file_header_spec.js b/spec/javascripts/diffs/components/diff_file_header_spec.js
index d4280d3ec2c..356e7a8f1fe 100644
--- a/spec/javascripts/diffs/components/diff_file_header_spec.js
+++ b/spec/javascripts/diffs/components/diff_file_header_spec.js
@@ -372,7 +372,7 @@ describe('diff_file_header', () => {
       });
 
       it('displays old and new path if the file was renamed', () => {
-        props.diffFile.viewer.name = diffViewerModes.renamed;
+        props.diffFile.renamed_file = true;
 
         vm = mountComponentWithStore(Component, { props, store });
 
-- 
cgit v1.2.1


From 75e2302d0126c4bc8ea215ffb4e72612d44e73bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kamil=20Trzci=C5=84ski?= <ayufan@ayufan.eu>
Date: Wed, 14 Aug 2019 17:56:37 +0200
Subject: Allow to interrupt running jobs

This adds a middleware to track all threads
for running jobs.

This makes sidekiq to watch for redis-delivered notifications.

This makes be able to send notification to interrupt
running sidekiq jobs.

This does not take into account any native code,
as `Thread.raise` generates exception once the control gets
back to Ruby.

The separate measure should be taken to interrupt gRPC, shellouts,
or anything else that escapes Ruby.
---
 config/initializers/sidekiq.rb                     |  3 +
 lib/gitlab/sidekiq_middleware/jobs_threads.rb      | 49 +++++++++++++
 lib/gitlab/sidekiq_status/monitor.rb               | 46 ++++++++++++
 .../gitlab/sidekiq_middleware/jobs_threads_spec.rb | 83 ++++++++++++++++++++++
 4 files changed, 181 insertions(+)
 create mode 100644 lib/gitlab/sidekiq_middleware/jobs_threads.rb
 create mode 100644 lib/gitlab/sidekiq_status/monitor.rb
 create mode 100644 spec/lib/gitlab/sidekiq_middleware/jobs_threads_spec.rb

diff --git a/config/initializers/sidekiq.rb b/config/initializers/sidekiq.rb
index 7217f098fd9..b05d4342e23 100644
--- a/config/initializers/sidekiq.rb
+++ b/config/initializers/sidekiq.rb
@@ -33,6 +33,7 @@ Sidekiq.configure_server do |config|
   config.redis = queues_config_hash
 
   config.server_middleware do |chain|
+    chain.add Gitlab::SidekiqMiddleware::JobsThreads unless ENV['DISABLE_SIDEKIQ_INTERRUPT_RUNNING_JOBS']
     chain.add Gitlab::SidekiqMiddleware::Metrics if Settings.monitoring.sidekiq_exporter
     chain.add Gitlab::SidekiqMiddleware::ArgumentsLogger if ENV['SIDEKIQ_LOG_ARGUMENTS'] && !enable_json_logs
     chain.add Gitlab::SidekiqMiddleware::MemoryKiller if ENV['SIDEKIQ_MEMORY_KILLER_MAX_RSS']
@@ -57,6 +58,8 @@ Sidekiq.configure_server do |config|
     # Clear any connections that might have been obtained before starting
     # Sidekiq (e.g. in an initializer).
     ActiveRecord::Base.clear_all_connections!
+
+    Gitlab::SidekiqStatus::Monitor.instance.start unless ENV['DISABLE_SIDEKIQ_INTERRUPT_RUNNING_JOBS']
   end
 
   if enable_reliable_fetch?
diff --git a/lib/gitlab/sidekiq_middleware/jobs_threads.rb b/lib/gitlab/sidekiq_middleware/jobs_threads.rb
new file mode 100644
index 00000000000..d0603bcee2d
--- /dev/null
+++ b/lib/gitlab/sidekiq_middleware/jobs_threads.rb
@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module SidekiqMiddleware
+    class JobsThreads
+      @@jobs = {} # rubocop:disable Style/ClassVars
+      MUTEX = Mutex.new
+
+      def call(worker, job, queue)
+        jid = job['jid']
+
+        MUTEX.synchronize do
+          @@jobs[jid] = Thread.current
+        end
+
+        return if self.class.cancelled?(jid)
+
+        yield
+      ensure
+        MUTEX.synchronize do
+          @@jobs.delete(jid)
+        end
+      end
+
+      def self.interrupt(jid)
+        MUTEX.synchronize do
+          thread = @@jobs[jid]
+          break unless thread
+
+          thread.raise(Interrupt)
+          thread
+        end
+      end
+
+      def self.cancelled?(jid)
+        Sidekiq.redis {|c| c.exists("cancelled-#{jid}") }
+      end
+
+      def self.mark_job_as_cancelled(jid)
+        Sidekiq.redis {|c| c.setex("cancelled-#{jid}", 86400, 1) }
+        "Marked job as cancelled(if Sidekiq retry within 24 hours, the job will be skipped as `processed`). Jid: #{jid}"
+      end
+
+      def self.jobs
+        @@jobs
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/sidekiq_status/monitor.rb b/lib/gitlab/sidekiq_status/monitor.rb
new file mode 100644
index 00000000000..3fd9f02b166
--- /dev/null
+++ b/lib/gitlab/sidekiq_status/monitor.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module SidekiqStatus
+    class Monitor < Daemon
+      include ::Gitlab::Utils::StrongMemoize
+
+      NOTIFICATION_CHANNEL = 'sidekiq:cancel:notifications'.freeze
+
+      def start_working
+        Sidekiq.logger.info "Watching sidekiq monitor"
+
+        ::Gitlab::Redis::SharedState.with do |redis|
+          redis.subscribe(NOTIFICATION_CHANNEL) do |on|
+            on.message do |channel, message|
+              Sidekiq.logger.info "Received #{message} on #{channel}..."
+              execute_job_cancel(message)
+            end
+          end
+        end
+      end
+
+      def self.cancel_job(jid)
+        Gitlab::Redis::SharedState.with do |redis|
+          redis.publish(NOTIFICATION_CHANNEL, jid)
+          "Notification sent. Job should be cancelled soon. Check log to confirm. Jid: #{jid}"
+        end
+      end
+
+      private
+
+      def execute_job_cancel(jid)
+        Gitlab::SidekiqMiddleware::JobsThreads.mark_job_as_cancelled(jid)
+
+        thread = Gitlab::SidekiqMiddleware::JobsThreads
+          .interrupt(jid)
+
+        if thread
+          Sidekiq.logger.info "Interrupted thread: #{thread} for #{jid}."
+        else
+          Sidekiq.logger.info "Did not find thread for #{jid}."
+        end
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/sidekiq_middleware/jobs_threads_spec.rb b/spec/lib/gitlab/sidekiq_middleware/jobs_threads_spec.rb
new file mode 100644
index 00000000000..58cae3e42e0
--- /dev/null
+++ b/spec/lib/gitlab/sidekiq_middleware/jobs_threads_spec.rb
@@ -0,0 +1,83 @@
+require 'spec_helper'
+
+describe Gitlab::SidekiqMiddleware::JobsThreads do
+  subject { described_class.new }
+
+  let(:worker) { double(:worker, class: Chaos::SleepWorker) }
+  let(:jid) { '581f90fbd2f24deabcbde2f9' }
+  let(:job) { { 'jid' => jid } }
+  let(:jid_thread) { '684f90fbd2f24deabcbde2f9' }
+  let(:job_thread) { { 'jid' => jid_thread } }
+  let(:queue) { 'test_queue' }
+  let(:mark_job_as_cancelled) { Sidekiq.redis {|c| c.setex("cancelled-#{jid}", 2, 1) } }
+
+  def run_job
+    subject.call(worker, job, queue) do
+      sleep 2
+      "mock return from yield"
+    end
+  end
+
+  def run_job_thread
+    Thread.new do
+      subject.call(worker, job_thread, queue) do
+        sleep 3
+        "mock return from yield"
+      end
+    end
+  end
+
+  describe '.call' do
+    context 'by default' do
+      it 'return from yield' do
+        expect(run_job).to eq("mock return from yield")
+      end
+    end
+
+    context 'when job is marked as cancelled' do
+      before do
+        mark_job_as_cancelled
+      end
+
+      it 'return directly' do
+        expect(run_job).to be_nil
+      end
+    end
+  end
+
+  describe '.self.interrupt' do
+    before do
+      run_job_thread
+      sleep 1
+    end
+
+    it 'interrupt the job with correct jid' do
+      expect(described_class.jobs[jid_thread]).to receive(:raise).with(Interrupt)
+      expect(described_class.interrupt jid_thread).to eq(described_class.jobs[jid_thread])
+    end
+
+    it 'do nothing with wrong jid' do
+      expect(described_class.jobs[jid_thread]).not_to receive(:raise)
+      expect(described_class.interrupt 'wrong_jid').to be_nil
+    end
+  end
+
+  describe '.self.cancelled?' do
+    it 'return true when job is marked as cancelled' do
+      mark_job_as_cancelled
+      expect(described_class.cancelled? jid).to be true
+    end
+
+    it 'return false when job is not marked as cancelled' do
+      expect(described_class.cancelled? 'non-exists-jid').to be false
+    end
+  end
+
+  describe '.self.mark_job_as_cancelled' do
+    it 'set Redis key' do
+      described_class.mark_job_as_cancelled('jid_123')
+
+      expect(described_class.cancelled? 'jid_123').to be true
+    end
+  end
+end
-- 
cgit v1.2.1


From ff3e9930cb118cd02d19407d7ed68992f5a77a33 Mon Sep 17 00:00:00 2001
From: Simon Knox <simon@gitlab.com>
Date: Wed, 21 Aug 2019 09:06:31 +0000
Subject: Adds specific metric styles and prop

This MR adds the styles for displaying a single
chart next to another one when embedding them
in an issue.
---
 .../project/integrations/img/generate_link_to_chart.png | Bin 0 -> 35573 bytes
 doc/user/project/integrations/prometheus.md             |   4 ++++
 2 files changed, 4 insertions(+)
 create mode 100644 doc/user/project/integrations/img/generate_link_to_chart.png

diff --git a/doc/user/project/integrations/img/generate_link_to_chart.png b/doc/user/project/integrations/img/generate_link_to_chart.png
new file mode 100644
index 00000000000..03e018969b1
Binary files /dev/null and b/doc/user/project/integrations/img/generate_link_to_chart.png differ
diff --git a/doc/user/project/integrations/prometheus.md b/doc/user/project/integrations/prometheus.md
index aa7db97c413..3ddda802796 100644
--- a/doc/user/project/integrations/prometheus.md
+++ b/doc/user/project/integrations/prometheus.md
@@ -363,6 +363,10 @@ It is possible to display metrics charts within [GitLab Flavored Markdown](../..
 
 To display a metric chart, include a link of the form `https://<root_url>/<project>/environments/<environment_id>/metrics`.
 
+A single chart may also be embedded. You can generate a link to the chart via the dropdown located on the right side of the chart:  
+
+![Generate Link To Chart](img/generate_link_to_chart.png)
+
 The following requirements must be met for the metric to unfurl:
 
 - The `<environment_id>` must correspond to a real environment.
-- 
cgit v1.2.1


From 3277f75666993bdb805768fe96554454206a3479 Mon Sep 17 00:00:00 2001
From: Afzaal Ahmad Zeeshan <afzaal.ahmad.zeeshan@hotmail.com>
Date: Wed, 21 Aug 2019 09:17:47 +0000
Subject: Update doc/gitlab-basics/start-using-git.md

---
 doc/gitlab-basics/start-using-git.md | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/doc/gitlab-basics/start-using-git.md b/doc/gitlab-basics/start-using-git.md
index 3e3f96fb31f..5de173abbff 100644
--- a/doc/gitlab-basics/start-using-git.md
+++ b/doc/gitlab-basics/start-using-git.md
@@ -63,8 +63,8 @@ git config --global user.email
 
 You'll need to do this only once, since you are using the `--global` option. It tells
 Git to always use this information for anything you do on that system. If you want
-to override this with a different username or email address for specific projects,
-you can run the command without the `--global` option when you’re in that project.
+to override this with a different username or email address for specific projects or repositories,
+you can run the command without the `--global` option when you’re in that project, and that will default to `--local`. You can read more on how Git manages configurations in the [Git Config](https://git-scm.com/book/en/v2/Customizing-Git-Git-Configuration) documentation.
 
 ## Check your information
 
@@ -102,8 +102,7 @@ files to your local computer, automatically preserving the Git connection with t
 remote repository.
 
 You can either clone it via HTTPS or [SSH](../ssh/README.md). If you chose to clone
-it via HTTPS, you'll have to enter your credentials every time you pull and push.
-With SSH, you enter your credentials only once.
+it via HTTPS, you'll have to enter your credentials every time you pull and push. You can read more about credential storage in the [Git Credentials documentation](https://git-scm.com/book/en/v2/Git-Tools-Credential-Storage). With SSH, you enter your credentials only once. 
 
 You can find both paths (HTTPS and SSH) by navigating to your project's landing page
 and clicking **Clone**. GitLab will prompt you with both paths, from which you can copy
@@ -152,13 +151,15 @@ to get the main branch code, or the branch name of the branch you are currently
 in.
 
 ```bash
-git pull REMOTE <name-of-branch>
+git pull <REMOTE> <name-of-branch>
 ```
 
-When you first clone a repository, REMOTE is typically `origin`. This is where the
+When you clone a repository, `REMOTE` is typically `origin`. This is where the
 repository was cloned from, and it indicates the SSH or HTTPS URL of the repository
 on the remote server. `<name-of-branch>` is usually `master`, but it may be any existing
-branch.
+branch. You can create additional named remotes and branches as necessary. 
+
+You can learn more on how Git manages remote repositories in the [Git Remote documentation](https://git-scm.com/book/en/v2/Git-Basics-Working-with-Remotes).
 
 ### View your remote repositories
 
@@ -168,6 +169,8 @@ To view your remote repositories, type:
 git remote -v
 ```
 
+The `-v` flag stands for verbose. 
+
 ### Add a remote repository
 
 To add a link to a remote repository:
@@ -186,7 +189,7 @@ following (spaces won't be recognized in the branch name, so you will need to us
 hyphen or underscore):
 
 ```bash
-git checkout -b <name-of-branch>>
+git checkout -b <name-of-branch>
 ```
 
 ### Work on an existing branch
@@ -238,7 +241,7 @@ git commit -m "COMMENT TO DESCRIBE THE INTENTION OF THE COMMIT"
 ```
 
 NOTE: **Note:**
-The `.` character typically means _all_ in Git.
+The `.` character means _all file changes in the current directory and all subdirectories_.
 
 ### Send changes to GitLab.com
 
-- 
cgit v1.2.1


From 39c7ac8da4f6d29c90d6a1e2ef6acad262a29705 Mon Sep 17 00:00:00 2001
From: Tristan Williams <2390023-tristan@users.noreply.gitlab.com>
Date: Wed, 21 Aug 2019 09:18:59 +0000
Subject: Docs: Refresh project request access screenshots

---
 .../members/img/access_requests_management.png      | Bin 11005 -> 10436 bytes
 .../project/members/img/request_access_button.png   | Bin 25271 -> 27958 bytes
 .../members/img/withdraw_access_request_button.png  | Bin 26123 -> 28154 bytes
 3 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/doc/user/project/members/img/access_requests_management.png b/doc/user/project/members/img/access_requests_management.png
index 8996d9564d7..9a1c9621e41 100644
Binary files a/doc/user/project/members/img/access_requests_management.png and b/doc/user/project/members/img/access_requests_management.png differ
diff --git a/doc/user/project/members/img/request_access_button.png b/doc/user/project/members/img/request_access_button.png
index e8b490b91b8..e693f9a9ac2 100644
Binary files a/doc/user/project/members/img/request_access_button.png and b/doc/user/project/members/img/request_access_button.png differ
diff --git a/doc/user/project/members/img/withdraw_access_request_button.png b/doc/user/project/members/img/withdraw_access_request_button.png
index 6a3172dfcdb..e5a8fe0b356 100644
Binary files a/doc/user/project/members/img/withdraw_access_request_button.png and b/doc/user/project/members/img/withdraw_access_request_button.png differ
-- 
cgit v1.2.1


From 869bce99af3018d0dedd9fda85ef580e7b27a733 Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Wed, 21 Aug 2019 09:20:03 +0000
Subject: Update container_registry.md to handle CA Bundle certs and validation

---
 doc/administration/container_registry.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/doc/administration/container_registry.md b/doc/administration/container_registry.md
index d0adeb89543..c90a633ec5a 100644
--- a/doc/administration/container_registry.md
+++ b/doc/administration/container_registry.md
@@ -137,6 +137,15 @@ otherwise you will run into conflicts.
 
 1. Save the file and [reconfigure GitLab][] for the changes to take effect.
 
+1. Validate using:
+
+   ```sh
+   openssl s_client -showcerts -servername gitlab.example.com -connect gitlab.example.com:443 > cacert.pem
+   ```
+
+NOTE: **Note:**
+If your certificate provider provides the CA Bundle certificates, append them to the TLS certificate file.
+
 **Installations from source**
 
 1. Open `/home/git/gitlab/config/gitlab.yml`, find the `registry` entry and
-- 
cgit v1.2.1


From a5b14d8231ecd12cec2c7357b534a57df9cdb630 Mon Sep 17 00:00:00 2001
From: Winnie Hellmann <winnie@gitlab.com>
Date: Wed, 21 Aug 2019 09:28:13 +0000
Subject: Add diagrams for frontend testing levels (docs)

---
 doc/development/testing_guide/frontend_testing.md | 152 ++++++++++++++++++++++
 1 file changed, 152 insertions(+)

diff --git a/doc/development/testing_guide/frontend_testing.md b/doc/development/testing_guide/frontend_testing.md
index ed867c41f59..7dc89a3fcdb 100644
--- a/doc/development/testing_guide/frontend_testing.md
+++ b/doc/development/testing_guide/frontend_testing.md
@@ -619,6 +619,42 @@ See also [Notes on testing Vue components](../fe_guide/vue.html#testing-vue-comp
 
 Unit tests are on the lowest abstraction level and typically test functionality that is not directly perceivable by a user.
 
+```mermaid
+graph RL
+    plain[Plain JavaScript];
+    Vue[Vue Components];
+    feature-flags[Feature Flags];
+    license-checks[License Checks];
+
+    plain---Vuex;
+    plain---GraphQL;
+    Vue---plain;
+    Vue---Vuex;
+    Vue---GraphQL;
+    browser---plain;
+    browser---Vue;
+    plain---backend;
+    Vuex---backend;
+    GraphQL---backend;
+    Vue---backend;
+    backend---database;
+    backend---feature-flags;
+    backend---license-checks;
+
+    class plain tested;
+    class Vuex tested;
+
+    classDef node color:#909090,fill:#f0f0f0,stroke-width:2px,stroke:#909090
+    classDef label stroke-width:0;
+    classDef tested color:#000000,fill:#a0c0ff,stroke:#6666ff,stroke-width:2px,stroke-dasharray: 5, 5;
+
+    subgraph " "
+    tested;
+    mocked;
+    class tested tested;
+    end
+```
+
 #### When to use unit tests
 
 <details>
@@ -711,6 +747,41 @@ Unit tests are on the lowest abstraction level and typically test functionality
 
 Component tests cover the state of a single component that is perceivable by a user depending on external signals such as user input, events fired from other components, or application state.
 
+```mermaid
+graph RL
+    plain[Plain JavaScript];
+    Vue[Vue Components];
+    feature-flags[Feature Flags];
+    license-checks[License Checks];
+
+    plain---Vuex;
+    plain---GraphQL;
+    Vue---plain;
+    Vue---Vuex;
+    Vue---GraphQL;
+    browser---plain;
+    browser---Vue;
+    plain---backend;
+    Vuex---backend;
+    GraphQL---backend;
+    Vue---backend;
+    backend---database;
+    backend---feature-flags;
+    backend---license-checks;
+
+    class Vue tested;
+
+    classDef node color:#909090,fill:#f0f0f0,stroke-width:2px,stroke:#909090
+    classDef label stroke-width:0;
+    classDef tested color:#000000,fill:#a0c0ff,stroke:#6666ff,stroke-width:2px,stroke-dasharray: 5, 5;
+
+    subgraph " "
+    tested;
+    mocked;
+    class tested tested;
+    end
+```
+
 #### When to use component tests
 
 - Vue components
@@ -781,6 +852,46 @@ Component tests cover the state of a single component that is perceivable by a u
 Integration tests cover the interaction between all components on a single page.
 Their abstraction level is comparable to how a user would interact with the UI.
 
+```mermaid
+graph RL
+    plain[Plain JavaScript];
+    Vue[Vue Components];
+    feature-flags[Feature Flags];
+    license-checks[License Checks];
+
+    plain---Vuex;
+    plain---GraphQL;
+    Vue---plain;
+    Vue---Vuex;
+    Vue---GraphQL;
+    browser---plain;
+    browser---Vue;
+    plain---backend;
+    Vuex---backend;
+    GraphQL---backend;
+    Vue---backend;
+    backend---database;
+    backend---feature-flags;
+    backend---license-checks;
+
+    class plain tested;
+    class Vue tested;
+    class Vuex tested;
+    class GraphQL tested;
+    class browser tested;
+    linkStyle 0,1,2,3,4,5,6 stroke:#6666ff,stroke-width:2px,stroke-dasharray: 5, 5;
+
+    classDef node color:#909090,fill:#f0f0f0,stroke-width:2px,stroke:#909090
+    classDef label stroke-width:0;
+    classDef tested color:#000000,fill:#a0c0ff,stroke:#6666ff,stroke-width:2px,stroke-dasharray: 5, 5;
+
+    subgraph " "
+    tested;
+    mocked;
+    class tested tested;
+    end
+```
+
 #### When to use integration tests
 
 <details>
@@ -838,6 +949,47 @@ This also implies that database queries are executed which makes this category s
 
 See also the [RSpec testing guidelines](../testing_guide/best_practices.md#rspec).
 
+```mermaid
+graph RL
+    plain[Plain JavaScript];
+    Vue[Vue Components];
+    feature-flags[Feature Flags];
+    license-checks[License Checks];
+
+    plain---Vuex;
+    plain---GraphQL;
+    Vue---plain;
+    Vue---Vuex;
+    Vue---GraphQL;
+    browser---plain;
+    browser---Vue;
+    plain---backend;
+    Vuex---backend;
+    GraphQL---backend;
+    Vue---backend;
+    backend---database;
+    backend---feature-flags;
+    backend---license-checks;
+
+    class backend tested;
+    class plain tested;
+    class Vue tested;
+    class Vuex tested;
+    class GraphQL tested;
+    class browser tested;
+    linkStyle 0,1,2,3,4,5,6,7,8,9,10 stroke:#6666ff,stroke-width:2px,stroke-dasharray: 5, 5;
+
+    classDef node color:#909090,fill:#f0f0f0,stroke-width:2px,stroke:#909090
+    classDef label stroke-width:0;
+    classDef tested color:#000000,fill:#a0c0ff,stroke:#6666ff,stroke-width:2px,stroke-dasharray: 5, 5;
+
+    subgraph " "
+    tested;
+    mocked;
+    class tested tested;
+    end
+```
+
 #### When to use feature tests
 
 - Use cases that require a backend and cannot be tested using fixtures.
-- 
cgit v1.2.1


From c10aeb121706687d9c776672e9b31db64d669313 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Wed, 21 Aug 2019 11:34:42 +0200
Subject: Ensure the dast job does not run on master
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 .gitlab/ci/global.gitlab-ci.yml  | 12 ++++++++++++
 .gitlab/ci/reports.gitlab-ci.yml |  4 +++-
 .gitlab/ci/review.gitlab-ci.yml  | 24 +++++++-----------------
 3 files changed, 22 insertions(+), 18 deletions(-)

diff --git a/.gitlab/ci/global.gitlab-ci.yml b/.gitlab/ci/global.gitlab-ci.yml
index 78ef346d417..56fe9739d5f 100644
--- a/.gitlab/ci/global.gitlab-ci.yml
+++ b/.gitlab/ci/global.gitlab-ci.yml
@@ -76,3 +76,15 @@
     - apk add --update openssl
     - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/$SCRIPT_NAME
     - chmod 755 $(basename $SCRIPT_NAME)
+
+.review-only: &review-only
+  only:
+    refs:
+      - branches@gitlab-org/gitlab-ce
+      - branches@gitlab-org/gitlab-ee
+    kubernetes: active
+  except:
+    refs:
+      - master
+      - /^\d+-\d+-auto-deploy-\d+$/
+      - /(^docs[\/-].+|.+-docs$)/
diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index fc0e93ee9f1..ccd7d6ec84d 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -27,7 +27,9 @@ dependency_scanning:
   cache: {}
 
 dast:
-  extends: .dedicated-no-docs
+  extends:
+    - .dedicated-runner
+    - .review-only
   stage: qa
   dependencies:
     - review-deploy
diff --git a/.gitlab/ci/review.gitlab-ci.yml b/.gitlab/ci/review.gitlab-ci.yml
index 3cbfa32d9a5..78431e3d842 100644
--- a/.gitlab/ci/review.gitlab-ci.yml
+++ b/.gitlab/ci/review.gitlab-ci.yml
@@ -1,15 +1,3 @@
-.review-only: &review-only
-  only:
-    refs:
-      - branches@gitlab-org/gitlab-ce
-      - branches@gitlab-org/gitlab-ee
-    kubernetes: active
-  except:
-    refs:
-      - master
-      - /^\d+-\d+-auto-deploy-\d+$/
-      - /(^docs[\/-].+|.+-docs$)/
-
 .review-schedules-only: &review-schedules-only
   only:
     refs:
@@ -24,8 +12,9 @@
       - /(^docs[\/-].+|.+-docs$)/
 
 .review-base: &review-base
-  extends: .dedicated-runner
-  <<: *review-only
+  extends:
+    - .dedicated-runner
+    - .review-only
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-charts-build-base
   cache: {}
   dependencies: []
@@ -68,7 +57,7 @@ build-qa-image:
     - BUILD_TRIGGER_TOKEN=$REVIEW_APPS_BUILD_TRIGGER_TOKEN ./scripts/trigger-build cng
 
 review-build-cng:
-  <<: *review-only
+  extends: .review-only
   <<: *review-build-cng-base
 
 schedule:review-build-cng:
@@ -117,8 +106,9 @@ schedule:review-deploy:
   <<: *review-schedules-only
 
 review-stop:
-  <<: *review-only
-  extends: .single-script-job-dedicated-runner
+  extends:
+    - .single-script-job-dedicated-runner
+    - .review-only
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-charts-build-base
   stage: review
   when: manual
-- 
cgit v1.2.1


From 8627131929293949ed1918b713fd947615f9743c Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Wed, 21 Aug 2019 09:53:06 +0000
Subject: Add let's encrypt omnibus guide link

---
 doc/administration/container_registry.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/doc/administration/container_registry.md b/doc/administration/container_registry.md
index c90a633ec5a..d43b3718bf9 100644
--- a/doc/administration/container_registry.md
+++ b/doc/administration/container_registry.md
@@ -172,9 +172,13 @@ docker login gitlab.example.com:4567
 
 If the Registry is configured to use its own domain, you will need a TLS
 certificate for that specific domain (e.g., `registry.example.com`) or maybe
-a wildcard certificate if hosted under a subdomain  of your existing GitLab
+a wildcard certificate if hosted under a subdomain of your existing GitLab
 domain (e.g., `registry.gitlab.example.com`).
 
+NOTE: **Note:**
+As well as manually generated SSL certificates (explained here), certificates automatically
+generated by Let's Encrypt are also [supported in Omnibus installs](https://docs.gitlab.com/omnibus/settings/ssl.html#host-services).
+
 Let's assume that you want the container Registry to be accessible at
 `https://registry.gitlab.example.com`.
 
-- 
cgit v1.2.1


From c2cbfc5c4afbe8385659f97769db8450284639cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kamil=20Trzci=C5=84ski?= <ayufan@ayufan.eu>
Date: Tue, 20 Aug 2019 17:25:04 +0200
Subject: Rework `Sidekiq::JobsThreads` into `Monitor`

This makes:
- very shallow `Middleware::Monitor` to only request tracking
  of sidekiq jobs,
- `SidekiqStatus::Monitor` to be responsible to maintain persistent
  connection to receive messages,
- `SidekiqStatus::Monitor` to always use structured logging
  and instance variables
---
 config/initializers/sidekiq.rb                     |   6 +-
 doc/administration/troubleshooting/sidekiq.md      | 118 ++++++++++++
 lib/gitlab/sidekiq_middleware/jobs_threads.rb      |  49 -----
 lib/gitlab/sidekiq_middleware/monitor.rb           |  13 ++
 lib/gitlab/sidekiq_monitor.rb                      | 153 +++++++++++++++
 lib/gitlab/sidekiq_status/monitor.rb               |  46 -----
 .../gitlab/sidekiq_middleware/jobs_threads_spec.rb |  83 ---------
 spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb |  29 +++
 spec/lib/gitlab/sidekiq_monitor_spec.rb            | 206 +++++++++++++++++++++
 9 files changed, 523 insertions(+), 180 deletions(-)
 delete mode 100644 lib/gitlab/sidekiq_middleware/jobs_threads.rb
 create mode 100644 lib/gitlab/sidekiq_middleware/monitor.rb
 create mode 100644 lib/gitlab/sidekiq_monitor.rb
 delete mode 100644 lib/gitlab/sidekiq_status/monitor.rb
 delete mode 100644 spec/lib/gitlab/sidekiq_middleware/jobs_threads_spec.rb
 create mode 100644 spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb
 create mode 100644 spec/lib/gitlab/sidekiq_monitor_spec.rb

diff --git a/config/initializers/sidekiq.rb b/config/initializers/sidekiq.rb
index b05d4342e23..e145af5e2d5 100644
--- a/config/initializers/sidekiq.rb
+++ b/config/initializers/sidekiq.rb
@@ -33,7 +33,7 @@ Sidekiq.configure_server do |config|
   config.redis = queues_config_hash
 
   config.server_middleware do |chain|
-    chain.add Gitlab::SidekiqMiddleware::JobsThreads unless ENV['DISABLE_SIDEKIQ_INTERRUPT_RUNNING_JOBS']
+    chain.add Gitlab::SidekiqMiddleware::Monitor
     chain.add Gitlab::SidekiqMiddleware::Metrics if Settings.monitoring.sidekiq_exporter
     chain.add Gitlab::SidekiqMiddleware::ArgumentsLogger if ENV['SIDEKIQ_LOG_ARGUMENTS'] && !enable_json_logs
     chain.add Gitlab::SidekiqMiddleware::MemoryKiller if ENV['SIDEKIQ_MEMORY_KILLER_MAX_RSS']
@@ -59,7 +59,9 @@ Sidekiq.configure_server do |config|
     # Sidekiq (e.g. in an initializer).
     ActiveRecord::Base.clear_all_connections!
 
-    Gitlab::SidekiqStatus::Monitor.instance.start unless ENV['DISABLE_SIDEKIQ_INTERRUPT_RUNNING_JOBS']
+    if ENV.fetch("SIDEKIQ_MONITOR_WORKER", 0).to_i.nonzero?
+      Gitlab::SidekiqMonitor.instance.start
+    end
   end
 
   if enable_reliable_fetch?
diff --git a/doc/administration/troubleshooting/sidekiq.md b/doc/administration/troubleshooting/sidekiq.md
index 7067958ecb4..9b016c64e29 100644
--- a/doc/administration/troubleshooting/sidekiq.md
+++ b/doc/administration/troubleshooting/sidekiq.md
@@ -169,3 +169,121 @@ The PostgreSQL wiki has details on the query you can run to see blocking
 queries. The query is different based on PostgreSQL version. See
 [Lock Monitoring](https://wiki.postgresql.org/wiki/Lock_Monitoring) for
 the query details.
+
+## Managing Sidekiq queues
+
+It is possible to use [Sidekiq API](https://github.com/mperham/sidekiq/wiki/API)
+to perform a number of troubleshoting on Sidekiq.
+
+These are the administrative commands and it should only be used if currently
+admin interface is not suitable due to scale of installation.
+
+All this commands should be run using `gitlab-rails console`.
+
+### View the queue size
+
+```ruby
+Sidekiq::Queue.new("pipeline_processing:build_queue").size
+```
+
+### Enumerate all enqueued jobs
+
+```ruby
+queue = Sidekiq::Queue.new("chaos:chaos_sleep")
+queue.each do |job|
+  # job.klass # => 'MyWorker'
+  # job.args # => [1, 2, 3]
+  # job.jid # => jid
+  # job.queue # => chaos:chaos_sleep
+  # job["retry"] # => 3
+  # job.item # => {
+  #   "class"=>"Chaos::SleepWorker",
+  #   "args"=>[1000],
+  #   "retry"=>3,
+  #   "queue"=>"chaos:chaos_sleep",
+  #   "backtrace"=>true,
+  #   "queue_namespace"=>"chaos",
+  #   "jid"=>"39bc482b823cceaf07213523",
+  #   "created_at"=>1566317076.266069,
+  #   "correlation_id"=>"c323b832-a857-4858-b695-672de6f0e1af",
+  #   "enqueued_at"=>1566317076.26761},
+  # }
+
+  # job.delete if job.jid == 'abcdef1234567890'
+end
+```
+
+### Enumerate currently running jobs
+
+```ruby
+workers = Sidekiq::Workers.new
+workers.each do |process_id, thread_id, work|
+  # process_id is a unique identifier per Sidekiq process
+  # thread_id is a unique identifier per thread
+  # work is a Hash which looks like:
+  # {"queue"=>"chaos:chaos_sleep",
+  #  "payload"=>
+  #  { "class"=>"Chaos::SleepWorker",
+  #    "args"=>[1000],
+  #    "retry"=>3,
+  #    "queue"=>"chaos:chaos_sleep",
+  #    "backtrace"=>true,
+  #    "queue_namespace"=>"chaos",
+  #    "jid"=>"b2a31e3eac7b1a99ff235869",
+  #    "created_at"=>1566316974.9215662,
+  #    "correlation_id"=>"e484fb26-7576-45f9-bf21-b99389e1c53c",
+  #    "enqueued_at"=>1566316974.9229589},
+  #  "run_at"=>1566316974}],
+end
+```
+
+### Remove sidekiq jobs for given parameters (destructive)
+
+```ruby
+# for jobs like this:
+# RepositoryImportWorker.new.perform_async(100)
+id_list = [100]
+
+queue = Sidekiq::Queue.new('repository_import')
+queue.each do |job|
+  job.delete if id_list.include?(job.args[0])
+end
+```
+
+### Remove specific job ID (destructive)
+
+```ruby
+queue = Sidekiq::Queue.new('repository_import')
+queue.each do |job|
+  job.delete if job.jid == 'my-job-id'
+end
+```
+
+## Canceling running jobs (destructive)
+
+> Introduced in GitLab 12.3.
+
+This is highly risky operation and use it as last resort.
+Doing that might result in data corruption, as the job
+is interrupted mid-execution and it is not guaranteed
+that proper rollback of transactions is implemented.
+
+```ruby
+Gitlab::SidekiqMonitor.cancel_job('job-id')
+```
+
+> This requires the Sidekiq to be run with `SIDEKIQ_MONITOR_WORKER=1`
+> environment variable.
+
+To perform of the interrupt we use `Thread.raise` which
+has number of drawbacks, as mentioned in [Why Ruby’s Timeout is dangerous (and Thread.raise is terrifying)](https://jvns.ca/blog/2015/11/27/why-rubys-timeout-is-dangerous-and-thread-dot-raise-is-terrifying/):
+
+> This is where the implications get interesting, and terrifying. This means that an exception can get raised:
+>
+> * during a network request (ok, as long as the surrounding code is prepared to catch Timeout::Error)
+> * during the cleanup for the network request
+> * during a rescue block
+> * while creating an object to save to the database afterwards
+> * in any of your code, regardless of whether it could have possibly raised an exception before
+>
+> Nobody writes code to defend against an exception being raised on literally any line. That’s not even possible. So Thread.raise is  basically like a sneak attack on your code that could result in almost anything. It would probably be okay if it were pure-functional code that did not modify any state. But this is Ruby, so that’s unlikely :)
diff --git a/lib/gitlab/sidekiq_middleware/jobs_threads.rb b/lib/gitlab/sidekiq_middleware/jobs_threads.rb
deleted file mode 100644
index d0603bcee2d..00000000000
--- a/lib/gitlab/sidekiq_middleware/jobs_threads.rb
+++ /dev/null
@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module SidekiqMiddleware
-    class JobsThreads
-      @@jobs = {} # rubocop:disable Style/ClassVars
-      MUTEX = Mutex.new
-
-      def call(worker, job, queue)
-        jid = job['jid']
-
-        MUTEX.synchronize do
-          @@jobs[jid] = Thread.current
-        end
-
-        return if self.class.cancelled?(jid)
-
-        yield
-      ensure
-        MUTEX.synchronize do
-          @@jobs.delete(jid)
-        end
-      end
-
-      def self.interrupt(jid)
-        MUTEX.synchronize do
-          thread = @@jobs[jid]
-          break unless thread
-
-          thread.raise(Interrupt)
-          thread
-        end
-      end
-
-      def self.cancelled?(jid)
-        Sidekiq.redis {|c| c.exists("cancelled-#{jid}") }
-      end
-
-      def self.mark_job_as_cancelled(jid)
-        Sidekiq.redis {|c| c.setex("cancelled-#{jid}", 86400, 1) }
-        "Marked job as cancelled(if Sidekiq retry within 24 hours, the job will be skipped as `processed`). Jid: #{jid}"
-      end
-
-      def self.jobs
-        @@jobs
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/sidekiq_middleware/monitor.rb b/lib/gitlab/sidekiq_middleware/monitor.rb
new file mode 100644
index 00000000000..2d0e5a6d635
--- /dev/null
+++ b/lib/gitlab/sidekiq_middleware/monitor.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module SidekiqMiddleware
+    class Monitor
+      def call(worker, job, queue)
+        Gitlab::SidekiqMonitor.instance.within_job(job['jid'], queue) do
+          yield
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/sidekiq_monitor.rb b/lib/gitlab/sidekiq_monitor.rb
new file mode 100644
index 00000000000..0d4709508a0
--- /dev/null
+++ b/lib/gitlab/sidekiq_monitor.rb
@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+module Gitlab
+  class SidekiqMonitor < Daemon
+    include ::Gitlab::Utils::StrongMemoize
+
+    NOTIFICATION_CHANNEL = 'sidekiq:cancel:notifications'.freeze
+    CANCEL_DEADLINE = 24.hours.seconds
+
+    # We use exception derived from `Exception`
+    # to consider this as an very low-level exception
+    # that should not be caught by application
+    CancelledError = Class.new(Exception) # rubocop:disable Lint/InheritException
+
+    attr_reader :jobs_thread
+    attr_reader :jobs_mutex
+
+    def initialize
+      super
+
+      @jobs_thread = {}
+      @jobs_mutex = Mutex.new
+    end
+
+    def within_job(jid, queue)
+      jobs_mutex.synchronize do
+        jobs_thread[jid] = Thread.current
+      end
+
+      if cancelled?(jid)
+        Sidekiq.logger.warn(
+          class: self.class,
+          action: 'run',
+          queue: queue,
+          jid: jid,
+          canceled: true)
+        raise CancelledError
+      end
+
+      yield
+    ensure
+      jobs_mutex.synchronize do
+        jobs_thread.delete(jid)
+      end
+    end
+
+    def start_working
+      Sidekiq.logger.info(
+        class: self.class,
+        action: 'start',
+        message: 'Starting Monitor Daemon')
+
+      ::Gitlab::Redis::SharedState.with do |redis|
+        redis.subscribe(NOTIFICATION_CHANNEL) do |on|
+          on.message do |channel, message|
+            process_message(message)
+          end
+        end
+      end
+
+      Sidekiq.logger.warn(
+        class: self.class,
+        action: 'stop',
+        message: 'Stopping Monitor Daemon')
+    rescue Exception => e # rubocop:disable Lint/RescueException
+      Sidekiq.logger.warn(
+        class: self.class,
+        action: 'exception',
+        message: e.message)
+      raise e
+    end
+
+    def self.cancel_job(jid)
+      payload = {
+        action: 'cancel',
+        jid: jid
+      }.to_json
+
+      ::Gitlab::Redis::SharedState.with do |redis|
+        redis.setex(cancel_job_key(jid), CANCEL_DEADLINE, 1)
+        redis.publish(NOTIFICATION_CHANNEL, payload)
+      end
+    end
+
+    private
+
+    def process_message(message)
+      Sidekiq.logger.info(
+        class: self.class,
+        channel: NOTIFICATION_CHANNEL,
+        message: 'Received payload on channel',
+        payload: message)
+
+      message = safe_parse(message)
+      return unless message
+
+      case message['action']
+      when 'cancel'
+        process_job_cancel(message['jid'])
+      else
+        # unknown message
+      end
+    end
+
+    def safe_parse(message)
+      JSON.parse(message)
+    rescue JSON::ParserError
+    end
+
+    def process_job_cancel(jid)
+      return unless jid
+
+      # since this might take time, process cancel in a new thread
+      Thread.new do
+        find_thread(jid) do |thread|
+          next unless thread
+
+          Sidekiq.logger.warn(
+            class: self.class,
+            action: 'cancel',
+            message: 'Canceling thread with CancelledError',
+            jid: jid,
+            thread_id: thread.object_id)
+
+          thread&.raise(CancelledError)
+        end
+      end
+    end
+
+    # This method needs to be thread-safe
+    # This is why it passes thread in block,
+    # to ensure that we do process this thread
+    def find_thread(jid)
+      return unless jid
+
+      jobs_mutex.synchronize do
+        thread = jobs_thread[jid]
+        yield(thread)
+        thread
+      end
+    end
+
+    def cancelled?(jid)
+      ::Gitlab::Redis::SharedState.with do |redis|
+        redis.exists(self.class.cancel_job_key(jid))
+      end
+    end
+
+    def self.cancel_job_key(jid)
+      "sidekiq:cancel:#{jid}"
+    end
+  end
+end
diff --git a/lib/gitlab/sidekiq_status/monitor.rb b/lib/gitlab/sidekiq_status/monitor.rb
deleted file mode 100644
index 3fd9f02b166..00000000000
--- a/lib/gitlab/sidekiq_status/monitor.rb
+++ /dev/null
@@ -1,46 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module SidekiqStatus
-    class Monitor < Daemon
-      include ::Gitlab::Utils::StrongMemoize
-
-      NOTIFICATION_CHANNEL = 'sidekiq:cancel:notifications'.freeze
-
-      def start_working
-        Sidekiq.logger.info "Watching sidekiq monitor"
-
-        ::Gitlab::Redis::SharedState.with do |redis|
-          redis.subscribe(NOTIFICATION_CHANNEL) do |on|
-            on.message do |channel, message|
-              Sidekiq.logger.info "Received #{message} on #{channel}..."
-              execute_job_cancel(message)
-            end
-          end
-        end
-      end
-
-      def self.cancel_job(jid)
-        Gitlab::Redis::SharedState.with do |redis|
-          redis.publish(NOTIFICATION_CHANNEL, jid)
-          "Notification sent. Job should be cancelled soon. Check log to confirm. Jid: #{jid}"
-        end
-      end
-
-      private
-
-      def execute_job_cancel(jid)
-        Gitlab::SidekiqMiddleware::JobsThreads.mark_job_as_cancelled(jid)
-
-        thread = Gitlab::SidekiqMiddleware::JobsThreads
-          .interrupt(jid)
-
-        if thread
-          Sidekiq.logger.info "Interrupted thread: #{thread} for #{jid}."
-        else
-          Sidekiq.logger.info "Did not find thread for #{jid}."
-        end
-      end
-    end
-  end
-end
diff --git a/spec/lib/gitlab/sidekiq_middleware/jobs_threads_spec.rb b/spec/lib/gitlab/sidekiq_middleware/jobs_threads_spec.rb
deleted file mode 100644
index 58cae3e42e0..00000000000
--- a/spec/lib/gitlab/sidekiq_middleware/jobs_threads_spec.rb
+++ /dev/null
@@ -1,83 +0,0 @@
-require 'spec_helper'
-
-describe Gitlab::SidekiqMiddleware::JobsThreads do
-  subject { described_class.new }
-
-  let(:worker) { double(:worker, class: Chaos::SleepWorker) }
-  let(:jid) { '581f90fbd2f24deabcbde2f9' }
-  let(:job) { { 'jid' => jid } }
-  let(:jid_thread) { '684f90fbd2f24deabcbde2f9' }
-  let(:job_thread) { { 'jid' => jid_thread } }
-  let(:queue) { 'test_queue' }
-  let(:mark_job_as_cancelled) { Sidekiq.redis {|c| c.setex("cancelled-#{jid}", 2, 1) } }
-
-  def run_job
-    subject.call(worker, job, queue) do
-      sleep 2
-      "mock return from yield"
-    end
-  end
-
-  def run_job_thread
-    Thread.new do
-      subject.call(worker, job_thread, queue) do
-        sleep 3
-        "mock return from yield"
-      end
-    end
-  end
-
-  describe '.call' do
-    context 'by default' do
-      it 'return from yield' do
-        expect(run_job).to eq("mock return from yield")
-      end
-    end
-
-    context 'when job is marked as cancelled' do
-      before do
-        mark_job_as_cancelled
-      end
-
-      it 'return directly' do
-        expect(run_job).to be_nil
-      end
-    end
-  end
-
-  describe '.self.interrupt' do
-    before do
-      run_job_thread
-      sleep 1
-    end
-
-    it 'interrupt the job with correct jid' do
-      expect(described_class.jobs[jid_thread]).to receive(:raise).with(Interrupt)
-      expect(described_class.interrupt jid_thread).to eq(described_class.jobs[jid_thread])
-    end
-
-    it 'do nothing with wrong jid' do
-      expect(described_class.jobs[jid_thread]).not_to receive(:raise)
-      expect(described_class.interrupt 'wrong_jid').to be_nil
-    end
-  end
-
-  describe '.self.cancelled?' do
-    it 'return true when job is marked as cancelled' do
-      mark_job_as_cancelled
-      expect(described_class.cancelled? jid).to be true
-    end
-
-    it 'return false when job is not marked as cancelled' do
-      expect(described_class.cancelled? 'non-exists-jid').to be false
-    end
-  end
-
-  describe '.self.mark_job_as_cancelled' do
-    it 'set Redis key' do
-      described_class.mark_job_as_cancelled('jid_123')
-
-      expect(described_class.cancelled? 'jid_123').to be true
-    end
-  end
-end
diff --git a/spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb b/spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb
new file mode 100644
index 00000000000..3ca2ddf3cb1
--- /dev/null
+++ b/spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::SidekiqMiddleware::Monitor do
+  let(:monitor) { described_class.new }
+
+  describe '#call' do
+    let(:worker) { double }
+    let(:job) { { 'jid' => 'job-id' } }
+    let(:queue) { 'my-queue' }
+
+    it 'calls SidekiqMonitor' do
+      expect(Gitlab::SidekiqMonitor.instance).to receive(:within_job)
+        .with('job-id', 'my-queue')
+        .and_call_original
+
+      expect { |blk| monitor.call(worker, job, queue, &blk) }.to yield_control
+    end
+
+    it 'passthroughs the return value' do
+      result = monitor.call(worker, job, queue) do
+        'value'
+      end
+
+      expect(result).to eq('value')
+    end
+  end
+end
diff --git a/spec/lib/gitlab/sidekiq_monitor_spec.rb b/spec/lib/gitlab/sidekiq_monitor_spec.rb
new file mode 100644
index 00000000000..7c9fc598b02
--- /dev/null
+++ b/spec/lib/gitlab/sidekiq_monitor_spec.rb
@@ -0,0 +1,206 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::SidekiqMonitor do
+  let(:monitor) { described_class.new }
+
+  describe '#within_job' do
+    it 'tracks thread' do
+      blk = proc do
+        expect(monitor.jobs_thread['jid']).not_to be_nil
+
+        "OK"
+      end
+
+      expect(monitor.within_job('jid', 'queue', &blk)).to eq("OK")
+    end
+
+    context 'when job is canceled' do
+      let(:jid) { SecureRandom.hex }
+
+      before do
+        described_class.cancel_job(jid)
+      end
+
+      it 'does not execute a block' do
+        expect do |blk|
+          monitor.within_job(jid, 'queue', &blk)
+        rescue described_class::CancelledError
+        end.not_to yield_control
+      end
+
+      it 'raises exception' do
+        expect { monitor.within_job(jid, 'queue') }.to raise_error(described_class::CancelledError)
+      end
+    end
+  end
+
+  describe '#start_working' do
+    subject { monitor.start_working }
+
+    context 'when structured logging is used' do
+      before do
+        allow_any_instance_of(::Redis).to receive(:subscribe)
+      end
+
+      it 'logs start message' do
+        expect(Sidekiq.logger).to receive(:info)
+          .with(
+            class: described_class,
+            action: 'start',
+            message: 'Starting Monitor Daemon')
+
+        subject
+      end
+
+      it 'logs stop message' do
+        expect(Sidekiq.logger).to receive(:warn)
+          .with(
+            class: described_class,
+            action: 'stop',
+            message: 'Stopping Monitor Daemon')
+
+        subject
+      end
+
+      it 'logs exception message' do
+        expect(Sidekiq.logger).to receive(:warn)
+          .with(
+            class: described_class,
+            action: 'exception',
+            message: 'My Exception')
+
+        expect(::Gitlab::Redis::SharedState).to receive(:with)
+          .and_raise(Exception, 'My Exception')
+
+        expect { subject }.to raise_error(Exception, 'My Exception')
+      end
+    end
+
+    context 'when message is published' do
+      let(:subscribed) { double }
+
+      before do
+        expect_any_instance_of(::Redis).to receive(:subscribe)
+          .and_yield(subscribed)
+
+        expect(subscribed).to receive(:message)
+          .and_yield(
+            described_class::NOTIFICATION_CHANNEL,
+            payload
+          )
+
+        expect(Sidekiq.logger).to receive(:info)
+          .with(
+            class: described_class,
+            action: 'start',
+            message: 'Starting Monitor Daemon')
+
+        expect(Sidekiq.logger).to receive(:info)
+          .with(
+            class: described_class,
+            channel: described_class::NOTIFICATION_CHANNEL,
+            message: 'Received payload on channel',
+            payload: payload
+          )
+      end
+
+      context 'and message is valid' do
+        let(:payload) { '{"action":"cancel","jid":"my-jid"}' }
+
+        it 'processes cancel' do
+          expect(monitor).to receive(:process_job_cancel).with('my-jid')
+
+          subject
+        end
+      end
+
+      context 'and message is not valid json' do
+        let(:payload) { '{"action"}' }
+
+        it 'skips processing' do
+          expect(monitor).not_to receive(:process_job_cancel)
+
+          subject
+        end
+      end
+    end
+  end
+
+  describe '#process_job_cancel' do
+    subject { monitor.send(:process_job_cancel, jid) }
+
+    context 'when jid is missing' do
+      let(:jid) { nil }
+
+      it 'does not run thread' do
+        expect(subject).to be_nil
+      end
+    end
+
+    context 'when jid is provided' do
+      let(:jid) { 'my-jid' }
+
+      context 'when jid is not found' do
+        it 'does not log cancellation message' do
+          expect(Sidekiq.logger).not_to receive(:warn)
+          expect(subject).to be_a(Thread)
+
+          subject.join
+        end
+      end
+
+      context 'when jid is found' do
+        let(:thread) { Thread.new { sleep 1000 } }
+
+        before do
+          monitor.jobs_thread[jid] = thread
+        end
+
+        it 'does log cancellation message' do
+          expect(Sidekiq.logger).to receive(:warn)
+            .with(
+              class: described_class,
+              action: 'cancel',
+              message: 'Canceling thread with CancelledError',
+              jid: 'my-jid',
+              thread_id: thread.object_id)
+
+          expect(subject).to be_a(Thread)
+
+          subject.join
+        end
+
+        it 'does cancel the thread' do
+          expect(subject).to be_a(Thread)
+
+          subject.join
+
+          expect(thread).not_to be_alive
+          expect { thread.value }.to raise_error(described_class::CancelledError)
+        end
+      end
+    end
+  end
+
+  describe '.cancel_job' do
+    subject { described_class.cancel_job('my-jid') }
+
+    it 'sets a redis key' do
+      expect_any_instance_of(::Redis).to receive(:setex)
+        .with('sidekiq:cancel:my-jid', anything, 1)
+
+      subject
+    end
+
+    it 'notifies all workers' do
+      payload = '{"action":"cancel","jid":"my-jid"}'
+
+      expect_any_instance_of(::Redis).to receive(:publish)
+        .with('sidekiq:cancel:notifications', payload)
+
+      subject
+    end
+  end
+end
-- 
cgit v1.2.1


From 3683d2d251889865334f861791e5e743dca48898 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kamil=20Trzci=C5=84ski?= <ayufan@ayufan.eu>
Date: Tue, 20 Aug 2019 21:09:04 +0200
Subject: Perform cheap thread find

If we process message that is not designated to us
previously we would fire a separate Thread for that.
We don't need to do it. We can cheaply check if thread
is available, if it is, we can perform expensive operation
then.
---
 lib/gitlab/sidekiq_monitor.rb           | 25 ++++++++++++++++---------
 spec/lib/gitlab/sidekiq_monitor_spec.rb |  4 +---
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/lib/gitlab/sidekiq_monitor.rb b/lib/gitlab/sidekiq_monitor.rb
index 0d4709508a0..bfbf998b3a0 100644
--- a/lib/gitlab/sidekiq_monitor.rb
+++ b/lib/gitlab/sidekiq_monitor.rb
@@ -110,11 +110,13 @@ module Gitlab
     def process_job_cancel(jid)
       return unless jid
 
-      # since this might take time, process cancel in a new thread
-      Thread.new do
-        find_thread(jid) do |thread|
-          next unless thread
+      # try to find thread without lock
+      return unless find_thread_unsafe(jid)
 
+      Thread.new do
+        # try to find a thread, but with guaranteed
+        # handle that this thread corresponds to actually running job
+        find_thread_with_lock(jid) do |thread|
           Sidekiq.logger.warn(
             class: self.class,
             action: 'cancel',
@@ -130,13 +132,18 @@ module Gitlab
     # This method needs to be thread-safe
     # This is why it passes thread in block,
     # to ensure that we do process this thread
-    def find_thread(jid)
-      return unless jid
+    def find_thread_unsafe(jid)
+      jobs_thread[jid]
+    end
+
+    def find_thread_with_lock(jid)
+      # don't try to lock if we cannot find the thread
+      return unless find_thread_unsafe(jid)
 
       jobs_mutex.synchronize do
-        thread = jobs_thread[jid]
-        yield(thread)
-        thread
+        find_thread_unsafe(jid).tap do |thread|
+          yield(thread) if thread
+        end
       end
     end
 
diff --git a/spec/lib/gitlab/sidekiq_monitor_spec.rb b/spec/lib/gitlab/sidekiq_monitor_spec.rb
index 7c9fc598b02..f1804bd0755 100644
--- a/spec/lib/gitlab/sidekiq_monitor_spec.rb
+++ b/spec/lib/gitlab/sidekiq_monitor_spec.rb
@@ -145,9 +145,7 @@ describe Gitlab::SidekiqMonitor do
       context 'when jid is not found' do
         it 'does not log cancellation message' do
           expect(Sidekiq.logger).not_to receive(:warn)
-          expect(subject).to be_a(Thread)
-
-          subject.join
+          expect(subject).to be_nil
         end
       end
 
-- 
cgit v1.2.1


From cb193cd6b54ee9ac0cf87650100585293540abfa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kamil=20Trzci=C5=84ski?= <ayufan@ayufan.eu>
Date: Wed, 21 Aug 2019 11:32:45 +0200
Subject: Improve resillency of monitor

- Retry connection when it fails
- Properly shutdown daemon
- Stop monitor if the Exception is raised
- Properly guard exception handling
---
 lib/gitlab/daemon.rb                    |  5 ++-
 lib/gitlab/sidekiq_monitor.rb           | 72 ++++++++++++++++++++-----------
 spec/lib/gitlab/daemon_spec.rb          | 30 ++++++++++---
 spec/lib/gitlab/sidekiq_monitor_spec.rb | 75 +++++++++++++++++++++++++++++----
 4 files changed, 141 insertions(+), 41 deletions(-)

diff --git a/lib/gitlab/daemon.rb b/lib/gitlab/daemon.rb
index 6d5fc4219fb..2f4ae010e74 100644
--- a/lib/gitlab/daemon.rb
+++ b/lib/gitlab/daemon.rb
@@ -46,7 +46,10 @@ module Gitlab
 
         if thread
           thread.wakeup if thread.alive?
-          thread.join unless Thread.current == thread
+          begin
+            thread.join unless Thread.current == thread
+          rescue Exception # rubocop:disable Lint/RescueException
+          end
           @thread = nil
         end
       end
diff --git a/lib/gitlab/sidekiq_monitor.rb b/lib/gitlab/sidekiq_monitor.rb
index bfbf998b3a0..9ec3be48adb 100644
--- a/lib/gitlab/sidekiq_monitor.rb
+++ b/lib/gitlab/sidekiq_monitor.rb
@@ -6,6 +6,7 @@ module Gitlab
 
     NOTIFICATION_CHANNEL = 'sidekiq:cancel:notifications'.freeze
     CANCEL_DEADLINE = 24.hours.seconds
+    RECONNECT_TIME = 3.seconds
 
     # We use exception derived from `Exception`
     # to consider this as an very low-level exception
@@ -33,7 +34,8 @@ module Gitlab
           action: 'run',
           queue: queue,
           jid: jid,
-          canceled: true)
+          canceled: true
+        )
         raise CancelledError
       end
 
@@ -44,12 +46,45 @@ module Gitlab
       end
     end
 
+    def self.cancel_job(jid)
+      payload = {
+        action: 'cancel',
+        jid: jid
+      }.to_json
+
+      ::Gitlab::Redis::SharedState.with do |redis|
+        redis.setex(cancel_job_key(jid), CANCEL_DEADLINE, 1)
+        redis.publish(NOTIFICATION_CHANNEL, payload)
+      end
+    end
+
+    private
+
     def start_working
       Sidekiq.logger.info(
         class: self.class,
         action: 'start',
-        message: 'Starting Monitor Daemon')
+        message: 'Starting Monitor Daemon'
+      )
+
+      while enabled?
+        process_messages
+        sleep(RECONNECT_TIME)
+      end
 
+    ensure
+      Sidekiq.logger.warn(
+        class: self.class,
+        action: 'stop',
+        message: 'Stopping Monitor Daemon'
+      )
+    end
+
+    def stop_working
+      thread.raise(Interrupt) if thread.alive?
+    end
+
+    def process_messages
       ::Gitlab::Redis::SharedState.with do |redis|
         redis.subscribe(NOTIFICATION_CHANNEL) do |on|
           on.message do |channel, message|
@@ -57,39 +92,24 @@ module Gitlab
           end
         end
       end
-
-      Sidekiq.logger.warn(
-        class: self.class,
-        action: 'stop',
-        message: 'Stopping Monitor Daemon')
     rescue Exception => e # rubocop:disable Lint/RescueException
       Sidekiq.logger.warn(
         class: self.class,
         action: 'exception',
-        message: e.message)
-      raise e
-    end
-
-    def self.cancel_job(jid)
-      payload = {
-        action: 'cancel',
-        jid: jid
-      }.to_json
+        message: e.message
+      )
 
-      ::Gitlab::Redis::SharedState.with do |redis|
-        redis.setex(cancel_job_key(jid), CANCEL_DEADLINE, 1)
-        redis.publish(NOTIFICATION_CHANNEL, payload)
-      end
+      # we re-raise system exceptions
+      raise e unless e.is_a?(StandardError)
     end
 
-    private
-
     def process_message(message)
       Sidekiq.logger.info(
         class: self.class,
         channel: NOTIFICATION_CHANNEL,
         message: 'Received payload on channel',
-        payload: message)
+        payload: message
+      )
 
       message = safe_parse(message)
       return unless message
@@ -115,14 +135,16 @@ module Gitlab
 
       Thread.new do
         # try to find a thread, but with guaranteed
-        # handle that this thread corresponds to actually running job
+        # that handle for thread corresponds to actually
+        # running job
         find_thread_with_lock(jid) do |thread|
           Sidekiq.logger.warn(
             class: self.class,
             action: 'cancel',
             message: 'Canceling thread with CancelledError',
             jid: jid,
-            thread_id: thread.object_id)
+            thread_id: thread.object_id
+          )
 
           thread&.raise(CancelledError)
         end
diff --git a/spec/lib/gitlab/daemon_spec.rb b/spec/lib/gitlab/daemon_spec.rb
index d3e73314b87..0372b770844 100644
--- a/spec/lib/gitlab/daemon_spec.rb
+++ b/spec/lib/gitlab/daemon_spec.rb
@@ -34,12 +34,12 @@ describe Gitlab::Daemon do
     end
   end
 
-  describe 'when Daemon is enabled' do
+  context 'when Daemon is enabled' do
     before do
       allow(subject).to receive(:enabled?).and_return(true)
     end
 
-    describe 'when Daemon is stopped' do
+    context 'when Daemon is stopped' do
       describe '#start' do
         it 'starts the Daemon' do
           expect { subject.start.join }.to change { subject.thread? }.from(false).to(true)
@@ -57,14 +57,14 @@ describe Gitlab::Daemon do
       end
     end
 
-    describe 'when Daemon is running' do
+    context 'when Daemon is running' do
       before do
-        subject.start.join
+        subject.start
       end
 
       describe '#start' do
         it "doesn't start running Daemon" do
-          expect { subject.start.join }.not_to change { subject.thread? }
+          expect { subject.start.join }.not_to change { subject.thread }
 
           expect(subject).to have_received(:start_working).once
         end
@@ -76,11 +76,29 @@ describe Gitlab::Daemon do
 
           expect(subject).to have_received(:stop_working)
         end
+
+        context 'when stop_working raises exception' do
+          before do
+            allow(subject).to receive(:start_working) do
+              sleep(1000)
+            end
+          end
+
+          it 'shutdowns Daemon' do
+            expect(subject).to receive(:stop_working) do
+              subject.thread.raise(Interrupt)
+            end
+
+            expect(subject.thread).to be_alive
+            expect { subject.stop }.not_to raise_error
+            expect(subject.thread).to be_nil
+          end
+        end
       end
     end
   end
 
-  describe 'when Daemon is disabled' do
+  context 'when Daemon is disabled' do
     before do
       allow(subject).to receive(:enabled?).and_return(false)
     end
diff --git a/spec/lib/gitlab/sidekiq_monitor_spec.rb b/spec/lib/gitlab/sidekiq_monitor_spec.rb
index f1804bd0755..62baa326887 100644
--- a/spec/lib/gitlab/sidekiq_monitor_spec.rb
+++ b/spec/lib/gitlab/sidekiq_monitor_spec.rb
@@ -31,19 +31,26 @@ describe Gitlab::SidekiqMonitor do
       end
 
       it 'raises exception' do
-        expect { monitor.within_job(jid, 'queue') }.to raise_error(described_class::CancelledError)
+        expect { monitor.within_job(jid, 'queue') }.to raise_error(
+          described_class::CancelledError)
       end
     end
   end
 
   describe '#start_working' do
-    subject { monitor.start_working }
+    subject { monitor.send(:start_working) }
 
-    context 'when structured logging is used' do
-      before do
-        allow_any_instance_of(::Redis).to receive(:subscribe)
-      end
+    before do
+      # we want to run at most once cycle
+      # we toggle `enabled?` flag after the first call
+      stub_const('Gitlab::SidekiqMonitor::RECONNECT_TIME', 0)
+      allow(monitor).to receive(:enabled?).and_return(true, false)
+
+      allow(Sidekiq.logger).to receive(:info)
+      allow(Sidekiq.logger).to receive(:warn)
+    end
 
+    context 'when structured logging is used' do
       it 'logs start message' do
         expect(Sidekiq.logger).to receive(:info)
           .with(
@@ -51,6 +58,8 @@ describe Gitlab::SidekiqMonitor do
             action: 'start',
             message: 'Starting Monitor Daemon')
 
+        expect(::Gitlab::Redis::SharedState).to receive(:with)
+
         subject
       end
 
@@ -61,10 +70,25 @@ describe Gitlab::SidekiqMonitor do
             action: 'stop',
             message: 'Stopping Monitor Daemon')
 
+        expect(::Gitlab::Redis::SharedState).to receive(:with)
+
         subject
       end
 
-      it 'logs exception message' do
+      it 'logs StandardError message' do
+        expect(Sidekiq.logger).to receive(:warn)
+          .with(
+            class: described_class,
+            action: 'exception',
+            message: 'My Exception')
+
+        expect(::Gitlab::Redis::SharedState).to receive(:with)
+          .and_raise(StandardError, 'My Exception')
+
+        expect { subject }.not_to raise_error
+      end
+
+      it 'logs and raises Exception message' do
         expect(Sidekiq.logger).to receive(:warn)
           .with(
             class: described_class,
@@ -78,6 +102,20 @@ describe Gitlab::SidekiqMonitor do
       end
     end
 
+    context 'when StandardError is raised' do
+      it 'does retry connection' do
+        expect(::Gitlab::Redis::SharedState).to receive(:with)
+          .and_raise(StandardError, 'My Exception')
+
+        expect(::Gitlab::Redis::SharedState).to receive(:with)
+
+        # we expect to run `process_messages` twice
+        expect(monitor).to receive(:enabled?).and_return(true, true, false)
+
+        subject
+      end
+    end
+
     context 'when message is published' do
       let(:subscribed) { double }
 
@@ -128,6 +166,19 @@ describe Gitlab::SidekiqMonitor do
     end
   end
 
+  describe '#stop' do
+    let!(:monitor_thread) { monitor.start }
+
+    it 'does stop the thread' do
+      expect(monitor_thread).to be_alive
+
+      expect { monitor.stop }.not_to raise_error
+
+      expect(monitor_thread).not_to be_alive
+      expect { monitor_thread.value }.to raise_error(Interrupt)
+    end
+  end
+
   describe '#process_job_cancel' do
     subject { monitor.send(:process_job_cancel, jid) }
 
@@ -156,6 +207,11 @@ describe Gitlab::SidekiqMonitor do
           monitor.jobs_thread[jid] = thread
         end
 
+        after do
+          thread.kill
+        rescue
+        end
+
         it 'does log cancellation message' do
           expect(Sidekiq.logger).to receive(:warn)
             .with(
@@ -175,8 +231,9 @@ describe Gitlab::SidekiqMonitor do
 
           subject.join
 
-          expect(thread).not_to be_alive
-          expect { thread.value }.to raise_error(described_class::CancelledError)
+          # we wait for the thread to be cancelled
+          # by `process_job_cancel`
+          expect { thread.join(5) }.to raise_error(described_class::CancelledError)
         end
       end
     end
-- 
cgit v1.2.1


From 8bcc47ac02e69eb4564238b454ca8286a4126765 Mon Sep 17 00:00:00 2001
From: George Koltsov <koltsov.george@gmail.com>
Date: Wed, 21 Aug 2019 10:13:45 +0000
Subject: Add SortingPreference concern

Sorting preference functionality has been extracted
from `IssuableCollections` to a new `SortingPreference`
concern in order to reuse this functionality in projects
(and groups in the future).
---
 app/controllers/concerns/issuable_collections.rb   | 56 +------------
 .../concerns/issuable_collections_action.rb        |  2 +-
 app/controllers/concerns/sorting_preference.rb     | 85 +++++++++++++++++++
 app/controllers/dashboard/projects_controller.rb   | 22 +++--
 app/controllers/explore/projects_controller.rb     | 19 ++++-
 app/controllers/projects/issues_controller.rb      |  2 +-
 .../projects/merge_requests_controller.rb          |  2 +-
 app/models/project.rb                              |  2 +
 ...orgekoltsov-18720-persistent-dashboard-sort.yml |  5 ++
 ...d_projects_sorting_field_to_user_preferences.rb | 13 +++
 db/schema.rb                                       |  1 +
 .../concerns/issuable_collections_spec.rb          | 72 ----------------
 .../concerns/sorting_preference_spec.rb            | 93 +++++++++++++++++++++
 .../dashboard/projects_controller_spec.rb          |  8 ++
 .../explore/projects_controller_spec.rb            | 95 +++++++++++++++-------
 ...t_order_from_user_preference_shared_examples.rb |  6 +-
 16 files changed, 313 insertions(+), 170 deletions(-)
 create mode 100644 app/controllers/concerns/sorting_preference.rb
 create mode 100644 changelogs/unreleased/georgekoltsov-18720-persistent-dashboard-sort.yml
 create mode 100644 db/migrate/20190808152507_add_projects_sorting_field_to_user_preferences.rb
 create mode 100644 spec/controllers/concerns/sorting_preference_spec.rb

diff --git a/app/controllers/concerns/issuable_collections.rb b/app/controllers/concerns/issuable_collections.rb
index 3489ea78b77..8ea77b994de 100644
--- a/app/controllers/concerns/issuable_collections.rb
+++ b/app/controllers/concerns/issuable_collections.rb
@@ -2,8 +2,8 @@
 
 module IssuableCollections
   extend ActiveSupport::Concern
-  include CookiesHelper
   include SortingHelper
+  include SortingPreference
   include Gitlab::IssuableMetadata
   include Gitlab::Utils::StrongMemoize
 
@@ -127,47 +127,8 @@ module IssuableCollections
     'opened'
   end
 
-  def set_sort_order
-    set_sort_order_from_user_preference || set_sort_order_from_cookie || default_sort_order
-  end
-
-  def set_sort_order_from_user_preference
-    return unless current_user
-    return unless issuable_sorting_field
-
-    user_preference = current_user.user_preference
-
-    sort_param = params[:sort]
-    sort_param ||= user_preference[issuable_sorting_field]
-
-    return sort_param if Gitlab::Database.read_only?
-
-    if user_preference[issuable_sorting_field] != sort_param
-      user_preference.update(issuable_sorting_field => sort_param)
-    end
-
-    sort_param
-  end
-
-  # Implement issuable_sorting_field method on controllers
-  # to choose which column to store the sorting parameter.
-  def issuable_sorting_field
-    nil
-  end
-
-  def set_sort_order_from_cookie
-    sort_param = params[:sort] if params[:sort].present?
-    # fallback to legacy cookie value for backward compatibility
-    sort_param ||= cookies['issuable_sort']
-    sort_param ||= cookies[remember_sorting_key]
-
-    sort_value = update_cookie_value(sort_param)
-    set_secure_cookie(remember_sorting_key, sort_value)
-    sort_value
-  end
-
-  def remember_sorting_key
-    @remember_sorting_key ||= "#{collection_type.downcase}_sort"
+  def legacy_sort_cookie_name
+    'issuable_sort'
   end
 
   def default_sort_order
@@ -178,17 +139,6 @@ module IssuableCollections
     end
   end
 
-  # Update old values to the actual ones.
-  def update_cookie_value(value)
-    case value
-    when 'id_asc'             then sort_value_oldest_created
-    when 'id_desc'            then sort_value_recently_created
-    when 'downvotes_asc'      then sort_value_popularity
-    when 'downvotes_desc'     then sort_value_popularity
-    else value
-    end
-  end
-
   def finder
     @finder ||= issuable_finder_for(finder_type)
   end
diff --git a/app/controllers/concerns/issuable_collections_action.rb b/app/controllers/concerns/issuable_collections_action.rb
index 4ad287c4a13..0a6f684a9fc 100644
--- a/app/controllers/concerns/issuable_collections_action.rb
+++ b/app/controllers/concerns/issuable_collections_action.rb
@@ -32,7 +32,7 @@ module IssuableCollectionsAction
 
   private
 
-  def issuable_sorting_field
+  def sorting_field
     case action_name
     when 'issues'
       Issue::SORTING_PREFERENCE_FIELD
diff --git a/app/controllers/concerns/sorting_preference.rb b/app/controllers/concerns/sorting_preference.rb
new file mode 100644
index 00000000000..a51b68147d5
--- /dev/null
+++ b/app/controllers/concerns/sorting_preference.rb
@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module SortingPreference
+  include SortingHelper
+  include CookiesHelper
+
+  def set_sort_order
+    set_sort_order_from_user_preference || set_sort_order_from_cookie || params[:sort] || default_sort_order
+  end
+
+  # Implement sorting_field method on controllers
+  # to choose which column to store the sorting parameter.
+  def sorting_field
+    nil
+  end
+
+  # Implement default_sort_order method on controllers
+  # to choose which default sort should be applied if
+  # sort param is not provided.
+  def default_sort_order
+    nil
+  end
+
+  # Implement legacy_sort_cookie_name method on controllers
+  # to set sort from cookie for backwards compatibility.
+  def legacy_sort_cookie_name
+    nil
+  end
+
+  private
+
+  def set_sort_order_from_user_preference
+    return unless current_user
+    return unless sorting_field
+
+    user_preference = current_user.user_preference
+
+    sort_param = params[:sort]
+    sort_param ||= user_preference[sorting_field]
+
+    return sort_param if Gitlab::Database.read_only?
+
+    if user_preference[sorting_field] != sort_param
+      user_preference.update(sorting_field => sort_param)
+    end
+
+    sort_param
+  end
+
+  def set_sort_order_from_cookie
+    return unless legacy_sort_cookie_name
+
+    sort_param = params[:sort] if params[:sort].present?
+    # fallback to legacy cookie value for backward compatibility
+    sort_param ||= cookies[legacy_sort_cookie_name]
+    sort_param ||= cookies[remember_sorting_key]
+
+    sort_value = update_cookie_value(sort_param)
+    set_secure_cookie(remember_sorting_key, sort_value)
+    sort_value
+  end
+
+  # Convert sorting_field to legacy cookie name for backwards compatibility
+  # :merge_requests_sort => 'mergerequest_sort'
+  # :issues_sort => 'issue_sort'
+  def remember_sorting_key
+    @remember_sorting_key ||= sorting_field
+      .to_s
+      .split('_')[0..-2]
+      .map(&:singularize)
+      .join('')
+      .concat('_sort')
+  end
+
+  # Update old values to the actual ones.
+  def update_cookie_value(value)
+    case value
+    when 'id_asc'             then sort_value_oldest_created
+    when 'id_desc'            then sort_value_recently_created
+    when 'downvotes_asc'      then sort_value_popularity
+    when 'downvotes_desc'     then sort_value_popularity
+    else value
+    end
+  end
+end
diff --git a/app/controllers/dashboard/projects_controller.rb b/app/controllers/dashboard/projects_controller.rb
index daeb8fda417..71f18694613 100644
--- a/app/controllers/dashboard/projects_controller.rb
+++ b/app/controllers/dashboard/projects_controller.rb
@@ -4,10 +4,12 @@ class Dashboard::ProjectsController < Dashboard::ApplicationController
   include ParamsBackwardCompatibility
   include RendersMemberAccess
   include OnboardingExperimentHelper
+  include SortingHelper
+  include SortingPreference
 
   prepend_before_action(only: [:index]) { authenticate_sessionless_user!(:rss) }
   before_action :set_non_archived_param
-  before_action :default_sorting
+  before_action :set_sorting
   before_action :projects, only: [:index]
   skip_cross_project_access_check :index, :starred
 
@@ -59,11 +61,6 @@ class Dashboard::ProjectsController < Dashboard::ApplicationController
     end
   end
 
-  def default_sorting
-    params[:sort] ||= 'latest_activity_desc'
-    @sort = params[:sort]
-  end
-
   # rubocop: disable CodeReuse/ActiveRecord
   def load_projects(finder_params)
     @total_user_projects_count = ProjectsFinder.new(params: { non_public: true }, current_user: current_user).execute
@@ -88,4 +85,17 @@ class Dashboard::ProjectsController < Dashboard::ApplicationController
 
     Events::RenderService.new(current_user).execute(@events, atom_request: request.format.atom?)
   end
+
+  def set_sorting
+    params[:sort] = set_sort_order
+    @sort = params[:sort]
+  end
+
+  def default_sort_order
+    sort_value_latest_activity
+  end
+
+  def sorting_field
+    Project::SORTING_PREFERENCE_FIELD
+  end
 end
diff --git a/app/controllers/explore/projects_controller.rb b/app/controllers/explore/projects_controller.rb
index ef86d5f981a..271f2b4b57d 100644
--- a/app/controllers/explore/projects_controller.rb
+++ b/app/controllers/explore/projects_controller.rb
@@ -3,12 +3,13 @@
 class Explore::ProjectsController < Explore::ApplicationController
   include ParamsBackwardCompatibility
   include RendersMemberAccess
+  include SortingHelper
+  include SortingPreference
 
   before_action :set_non_archived_param
+  before_action :set_sorting
 
   def index
-    params[:sort] ||= 'latest_activity_desc'
-    @sort = params[:sort]
     @projects = load_projects
 
     respond_to do |format|
@@ -23,7 +24,6 @@ class Explore::ProjectsController < Explore::ApplicationController
 
   def trending
     params[:trending] = true
-    @sort = params[:sort]
     @projects = load_projects
 
     respond_to do |format|
@@ -67,4 +67,17 @@ class Explore::ProjectsController < Explore::ApplicationController
     prepare_projects_for_rendering(projects)
   end
   # rubocop: enable CodeReuse/ActiveRecord
+
+  def set_sorting
+    params[:sort] = set_sort_order
+    @sort = params[:sort]
+  end
+
+  def default_sort_order
+    sort_value_latest_activity
+  end
+
+  def sorting_field
+    Project::SORTING_PREFERENCE_FIELD
+  end
 end
diff --git a/app/controllers/projects/issues_controller.rb b/app/controllers/projects/issues_controller.rb
index bc9166b9df3..b7fd286bfe0 100644
--- a/app/controllers/projects/issues_controller.rb
+++ b/app/controllers/projects/issues_controller.rb
@@ -190,7 +190,7 @@ class Projects::IssuesController < Projects::ApplicationController
 
   protected
 
-  def issuable_sorting_field
+  def sorting_field
     Issue::SORTING_PREFERENCE_FIELD
   end
 
diff --git a/app/controllers/projects/merge_requests_controller.rb b/app/controllers/projects/merge_requests_controller.rb
index f4d381244d9..f4cc0a5851b 100644
--- a/app/controllers/projects/merge_requests_controller.rb
+++ b/app/controllers/projects/merge_requests_controller.rb
@@ -219,7 +219,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
   alias_method :issuable, :merge_request
   alias_method :awardable, :merge_request
 
-  def issuable_sorting_field
+  def sorting_field
     MergeRequest::SORTING_PREFERENCE_FIELD
   end
 
diff --git a/app/models/project.rb b/app/models/project.rb
index 8efe4b06f87..10679fb1f85 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -55,6 +55,8 @@ class Project < ApplicationRecord
   VALID_MIRROR_PORTS = [22, 80, 443].freeze
   VALID_MIRROR_PROTOCOLS = %w(http https ssh git).freeze
 
+  SORTING_PREFERENCE_FIELD = :projects_sort
+
   cache_markdown_field :description, pipeline: :description
 
   delegate :feature_available?, :builds_enabled?, :wiki_enabled?,
diff --git a/changelogs/unreleased/georgekoltsov-18720-persistent-dashboard-sort.yml b/changelogs/unreleased/georgekoltsov-18720-persistent-dashboard-sort.yml
new file mode 100644
index 00000000000..7eed8550acd
--- /dev/null
+++ b/changelogs/unreleased/georgekoltsov-18720-persistent-dashboard-sort.yml
@@ -0,0 +1,5 @@
+---
+title: Add persistance to last choice of projects sorting on projects dashboard page
+merge_request: 31669
+author:
+type: added
diff --git a/db/migrate/20190808152507_add_projects_sorting_field_to_user_preferences.rb b/db/migrate/20190808152507_add_projects_sorting_field_to_user_preferences.rb
new file mode 100644
index 00000000000..941fead655e
--- /dev/null
+++ b/db/migrate/20190808152507_add_projects_sorting_field_to_user_preferences.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class AddProjectsSortingFieldToUserPreferences < ActiveRecord::Migration[5.2]
+  DOWNTIME = false
+
+  def up
+    add_column :user_preferences, :projects_sort, :string, limit: 64
+  end
+
+  def down
+    remove_column :user_preferences, :projects_sort
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index ce5fd38129a..3f7917654cf 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -3411,6 +3411,7 @@ ActiveRecord::Schema.define(version: 2019_08_15_093949) do
     t.string "epics_sort"
     t.integer "roadmap_epics_state"
     t.string "roadmaps_sort"
+    t.string "projects_sort", limit: 64
     t.index ["user_id"], name: "index_user_preferences_on_user_id", unique: true
   end
 
diff --git a/spec/controllers/concerns/issuable_collections_spec.rb b/spec/controllers/concerns/issuable_collections_spec.rb
index f210537aad5..7bdf5c49425 100644
--- a/spec/controllers/concerns/issuable_collections_spec.rb
+++ b/spec/controllers/concerns/issuable_collections_spec.rb
@@ -24,78 +24,6 @@ describe IssuableCollections do
     controller
   end
 
-  describe '#set_sort_order_from_user_preference' do
-    describe 'when sort param given' do
-      let(:params) { { sort: 'updated_desc' } }
-
-      context 'when issuable_sorting_field is defined' do
-        before do
-          controller.class.define_method(:issuable_sorting_field) { :issues_sort}
-        end
-
-        it 'sets user_preference with the right value' do
-          controller.send(:set_sort_order_from_user_preference)
-
-          expect(user.user_preference.reload.issues_sort).to eq('updated_desc')
-        end
-      end
-
-      context 'when no issuable_sorting_field is defined on the controller' do
-        it 'does not touch user_preference' do
-          allow(user).to receive(:user_preference)
-
-          controller.send(:set_sort_order_from_user_preference)
-
-          expect(user).not_to have_received(:user_preference)
-        end
-      end
-    end
-
-    context 'when a user sorting preference exists' do
-      let(:params) { {} }
-
-      before do
-        controller.class.define_method(:issuable_sorting_field) { :issues_sort }
-      end
-
-      it 'returns the set preference' do
-        user.user_preference.update(issues_sort: 'updated_asc')
-
-        sort_preference = controller.send(:set_sort_order_from_user_preference)
-
-        expect(sort_preference).to eq('updated_asc')
-      end
-    end
-  end
-
-  describe '#set_set_order_from_cookie' do
-    describe 'when sort param given' do
-      let(:cookies) { {} }
-      let(:params) { { sort: 'downvotes_asc' } }
-
-      it 'sets the cookie with the right values and flags' do
-        allow(controller).to receive(:cookies).and_return(cookies)
-
-        controller.send(:set_sort_order_from_cookie)
-
-        expect(cookies['issue_sort']).to eq({ value: 'popularity', secure: false, httponly: false })
-      end
-    end
-
-    describe 'when cookie exists' do
-      let(:cookies) { { 'issue_sort' => 'id_asc' } }
-      let(:params) { {} }
-
-      it 'sets the cookie with the right values and flags' do
-        allow(controller).to receive(:cookies).and_return(cookies)
-
-        controller.send(:set_sort_order_from_cookie)
-
-        expect(cookies['issue_sort']).to eq({ value: 'created_asc', secure: false, httponly: false })
-      end
-    end
-  end
-
   describe '#page_count_for_relation' do
     let(:params) { { state: 'opened' } }
 
diff --git a/spec/controllers/concerns/sorting_preference_spec.rb b/spec/controllers/concerns/sorting_preference_spec.rb
new file mode 100644
index 00000000000..a36124c6776
--- /dev/null
+++ b/spec/controllers/concerns/sorting_preference_spec.rb
@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe SortingPreference do
+  let(:user) { create(:user) }
+
+  let(:controller_class) do
+    Class.new do
+      def self.helper_method(name); end
+
+      include SortingPreference
+      include SortingHelper
+    end
+  end
+
+  let(:controller) { controller_class.new }
+
+  before do
+    allow(controller).to receive(:params).and_return(ActionController::Parameters.new(params))
+    allow(controller).to receive(:current_user).and_return(user)
+    allow(controller).to receive(:legacy_sort_cookie_name).and_return('issuable_sort')
+    allow(controller).to receive(:sorting_field).and_return(:issues_sort)
+  end
+
+  describe '#set_sort_order_from_user_preference' do
+    subject { controller.send(:set_sort_order_from_user_preference) }
+
+    context 'when sort param given' do
+      let(:params) { { sort: 'updated_desc' } }
+
+      context 'when sorting_field is defined' do
+        it 'sets user_preference with the right value' do
+          is_expected.to eq('updated_desc')
+        end
+      end
+
+      context 'when no sorting_field is defined on the controller' do
+        before do
+          allow(controller).to receive(:sorting_field).and_return(nil)
+        end
+
+        it 'does not touch user_preference' do
+          expect(user).not_to receive(:user_preference)
+
+          subject
+        end
+      end
+    end
+
+    context 'when a user sorting preference exists' do
+      let(:params) { {} }
+
+      before do
+        user.user_preference.update!(issues_sort: 'updated_asc')
+      end
+
+      it 'returns the set preference' do
+        is_expected.to eq('updated_asc')
+      end
+    end
+  end
+
+  describe '#set_set_order_from_cookie' do
+    subject { controller.send(:set_sort_order_from_cookie) }
+
+    before do
+      allow(controller).to receive(:cookies).and_return(cookies)
+    end
+
+    context 'when sort param given' do
+      let(:cookies) { {} }
+      let(:params) { { sort: 'downvotes_asc' } }
+
+      it 'sets the cookie with the right values and flags' do
+        subject
+
+        expect(cookies['issue_sort']).to eq(value: 'popularity', secure: false, httponly: false)
+      end
+    end
+
+    context 'when cookie exists' do
+      let(:cookies) { { 'issue_sort' => 'id_asc' } }
+      let(:params) { {} }
+
+      it 'sets the cookie with the right values and flags' do
+        subject
+
+        expect(cookies['issue_sort']).to eq(value: 'created_asc', secure: false, httponly: false)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/dashboard/projects_controller_spec.rb b/spec/controllers/dashboard/projects_controller_spec.rb
index 6591901a9dc..8b95c9f2496 100644
--- a/spec/controllers/dashboard/projects_controller_spec.rb
+++ b/spec/controllers/dashboard/projects_controller_spec.rb
@@ -40,6 +40,14 @@ describe Dashboard::ProjectsController do
 
         expect(assigns(:projects)).to eq([project, project2])
       end
+
+      context 'project sorting' do
+        let(:project) { create(:project) }
+
+        it_behaves_like 'set sort order from user preference' do
+          let(:sorting_param) { 'created_asc' }
+        end
+      end
     end
   end
 
diff --git a/spec/controllers/explore/projects_controller_spec.rb b/spec/controllers/explore/projects_controller_spec.rb
index 463586ee422..6752d2b8ebd 100644
--- a/spec/controllers/explore/projects_controller_spec.rb
+++ b/spec/controllers/explore/projects_controller_spec.rb
@@ -3,56 +3,91 @@
 require 'spec_helper'
 
 describe Explore::ProjectsController do
-  describe 'GET #index.json' do
-    render_views
+  shared_examples 'explore projects' do
+    describe 'GET #index.json' do
+      render_views
 
-    before do
-      get :index, format: :json
+      before do
+        get :index, format: :json
+      end
+
+      it { is_expected.to respond_with(:success) }
     end
 
-    it { is_expected.to respond_with(:success) }
-  end
+    describe 'GET #trending.json' do
+      render_views
 
-  describe 'GET #trending.json' do
-    render_views
+      before do
+        get :trending, format: :json
+      end
 
-    before do
-      get :trending, format: :json
+      it { is_expected.to respond_with(:success) }
+    end
+
+    describe 'GET #starred.json' do
+      render_views
+
+      before do
+        get :starred, format: :json
+      end
+
+      it { is_expected.to respond_with(:success) }
     end
 
-    it { is_expected.to respond_with(:success) }
+    describe 'GET #trending' do
+      context 'sorting by update date' do
+        let(:project1) { create(:project, :public, updated_at: 3.days.ago) }
+        let(:project2) { create(:project, :public, updated_at: 1.day.ago) }
+
+        before do
+          create(:trending_project, project: project1)
+          create(:trending_project, project: project2)
+        end
+
+        it 'sorts by last updated' do
+          get :trending, params: { sort: 'updated_desc' }
+
+          expect(assigns(:projects)).to eq [project2, project1]
+        end
+
+        it 'sorts by oldest updated' do
+          get :trending, params: { sort: 'updated_asc' }
+
+          expect(assigns(:projects)).to eq [project1, project2]
+        end
+      end
+    end
   end
 
-  describe 'GET #starred.json' do
-    render_views
+  context 'when user is signed in' do
+    let(:user) { create(:user) }
 
     before do
-      get :starred, format: :json
+      sign_in(user)
     end
 
-    it { is_expected.to respond_with(:success) }
-  end
+    include_examples 'explore projects'
 
-  describe 'GET #trending' do
-    context 'sorting by update date' do
-      let(:project1) { create(:project, :public, updated_at: 3.days.ago) }
-      let(:project2) { create(:project, :public, updated_at: 1.day.ago) }
+    context 'user preference sorting' do
+      let(:project) { create(:project) }
 
-      before do
-        create(:trending_project, project: project1)
-        create(:trending_project, project: project2)
+      it_behaves_like 'set sort order from user preference' do
+        let(:sorting_param) { 'created_asc' }
       end
+    end
+  end
 
-      it 'sorts by last updated' do
-        get :trending, params: { sort: 'updated_desc' }
+  context 'when user is not signed in' do
+    include_examples 'explore projects'
 
-        expect(assigns(:projects)).to eq [project2, project1]
-      end
+    context 'user preference sorting' do
+      let(:project) { create(:project) }
+      let(:sorting_param) { 'created_asc' }
 
-      it 'sorts by oldest updated' do
-        get :trending, params: { sort: 'updated_asc' }
+      it 'does not set sort order from user preference' do
+        expect_any_instance_of(UserPreference).not_to receive(:update)
 
-        expect(assigns(:projects)).to eq [project1, project2]
+        get :index, params: { sort: sorting_param }
       end
     end
   end
diff --git a/spec/support/shared_examples/controllers/set_sort_order_from_user_preference_shared_examples.rb b/spec/support/shared_examples/controllers/set_sort_order_from_user_preference_shared_examples.rb
index 1cd14ea2251..d89eded6e69 100644
--- a/spec/support/shared_examples/controllers/set_sort_order_from_user_preference_shared_examples.rb
+++ b/spec/support/shared_examples/controllers/set_sort_order_from_user_preference_shared_examples.rb
@@ -2,14 +2,14 @@
 
 shared_examples 'set sort order from user preference' do
   describe '#set_sort_order_from_user_preference' do
-    # There is no issuable_sorting_field defined in any CE controllers yet,
+    # There is no sorting_field defined in any CE controllers yet,
     # however any other field present in user_preferences table can be used for testing.
 
     context 'when database is in read-only mode' do
       it 'does not update user preference' do
         allow(Gitlab::Database).to receive(:read_only?).and_return(true)
 
-        expect_any_instance_of(UserPreference).not_to receive(:update).with({ controller.send(:issuable_sorting_field) => sorting_param })
+        expect_any_instance_of(UserPreference).not_to receive(:update).with({ controller.send(:sorting_field) => sorting_param })
 
         get :index, params: { namespace_id: project.namespace, project_id: project, sort: sorting_param }
       end
@@ -19,7 +19,7 @@ shared_examples 'set sort order from user preference' do
       it 'updates user preference' do
         allow(Gitlab::Database).to receive(:read_only?).and_return(false)
 
-        expect_any_instance_of(UserPreference).to receive(:update).with({ controller.send(:issuable_sorting_field) => sorting_param })
+        expect_any_instance_of(UserPreference).to receive(:update).with({ controller.send(:sorting_field) => sorting_param })
 
         get :index, params: { namespace_id: project.namespace, project_id: project, sort: sorting_param }
       end
-- 
cgit v1.2.1


From 5012c622405e63655256735d266168450ad1d159 Mon Sep 17 00:00:00 2001
From: Sebastian Arcila Valenzuela <sarcila@gitlab.com>
Date: Mon, 12 Aug 2019 15:41:05 +0200
Subject: Add User#will_save_change_to_login? to clear reset_password_tokens

Devise checks before updating any of the authentication_keys if it
needs to clear the reset_password_tokens.

This should fix:
https://gitlab.com/gitlab-org/gitlab-ce/issues/42733 (Weak
authentication and session management)
---
 app/models/user.rb                                 |  7 ++++
 ...ecurity-sarcila-fix-weak-session-management.yml |  6 ++++
 spec/features/profiles/user_edit_profile_spec.rb   | 17 +++++++++
 spec/models/user_spec.rb                           | 41 ++++++++++++++++++++++
 4 files changed, 71 insertions(+)
 create mode 100644 changelogs/unreleased/security-sarcila-fix-weak-session-management.yml

diff --git a/app/models/user.rb b/app/models/user.rb
index 6131a8dc710..909f5f3873d 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -643,6 +643,13 @@ class User < ApplicationRecord
     end
   end
 
+  # will_save_change_to_attribute? is used by Devise to check if it is necessary
+  # to clear any existing reset_password_tokens before updating an authentication_key
+  # and login in our case is a virtual attribute to allow login by username or email.
+  def will_save_change_to_login?
+    will_save_change_to_username? || will_save_change_to_email?
+  end
+
   def unique_email
     if !emails.exists?(email: email) && Email.exists?(email: email)
       errors.add(:email, _('has already been taken'))
diff --git a/changelogs/unreleased/security-sarcila-fix-weak-session-management.yml b/changelogs/unreleased/security-sarcila-fix-weak-session-management.yml
new file mode 100644
index 00000000000..a37a3099519
--- /dev/null
+++ b/changelogs/unreleased/security-sarcila-fix-weak-session-management.yml
@@ -0,0 +1,6 @@
+---
+title: Fix weak session management by clearing password reset tokens after login (username/email)
+  are updated
+merge_request:
+author:
+type: security
diff --git a/spec/features/profiles/user_edit_profile_spec.rb b/spec/features/profiles/user_edit_profile_spec.rb
index 1ab7742b36e..0905ab0aef8 100644
--- a/spec/features/profiles/user_edit_profile_spec.rb
+++ b/spec/features/profiles/user_edit_profile_spec.rb
@@ -49,6 +49,23 @@ describe 'User edit profile' do
     end
   end
 
+  describe 'when I change my email' do
+    before do
+      user.send_reset_password_instructions
+    end
+
+    it 'clears the reset password token' do
+      expect(user.reset_password_token?).to be true
+
+      fill_in 'user_email', with: 'new-email@example.com'
+      submit_settings
+
+      user.reload
+      expect(user.confirmation_token).not_to be_nil
+      expect(user.reset_password_token?).to be false
+    end
+  end
+
   context 'user avatar' do
     before do
       attach_file(:user_avatar, Rails.root.join('spec', 'fixtures', 'banana_sample.gif'))
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 46b86e8393d..1a641c868d9 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -3045,6 +3045,47 @@ describe User do
     end
   end
 
+  describe '#will_save_change_to_login?' do
+    let(:user) { create(:user, username: 'old-username', email: 'old-email@example.org') }
+    let(:new_username) { 'new-name' }
+    let(:new_email) { 'new-email@example.org' }
+
+    subject { user.will_save_change_to_login? }
+
+    context 'when the username is changed' do
+      before do
+        user.username = new_username
+      end
+
+      it { is_expected.to be true }
+    end
+
+    context 'when the email is changed' do
+      before do
+        user.email = new_email
+      end
+
+      it { is_expected.to be true }
+    end
+
+    context 'when both email and username are changed' do
+      before do
+        user.username = new_username
+        user.email = new_email
+      end
+
+      it { is_expected.to be true }
+    end
+
+    context 'when email and username aren\'t changed' do
+      before do
+        user.name = 'new_name'
+      end
+
+      it { is_expected.to be_falsy }
+    end
+  end
+
   describe '#sync_attribute?' do
     let(:user) { described_class.new }
 
-- 
cgit v1.2.1


From 8d17c4dae6b4662dddffe9e2ddca8100e8cd3d0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kamil=20Trzci=C5=84ski?= <ayufan@ayufan.eu>
Date: Wed, 21 Aug 2019 12:03:42 +0200
Subject: Properly handle `sidekiq` skip

Transform `CancelledError` into `JobRetry::Skip`
---
 config/initializers/sidekiq.rb                     |  7 +++----
 lib/gitlab/sidekiq_middleware/monitor.rb           |  3 +++
 lib/gitlab/sidekiq_monitor.rb                      | 12 ++++++------
 spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb | 12 ++++++++++++
 spec/lib/gitlab/sidekiq_monitor_spec.rb            | 14 +++++++-------
 5 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/config/initializers/sidekiq.rb b/config/initializers/sidekiq.rb
index e145af5e2d5..9f3e104bc2b 100644
--- a/config/initializers/sidekiq.rb
+++ b/config/initializers/sidekiq.rb
@@ -28,12 +28,13 @@ if Rails.env.development?
 end
 
 enable_json_logs = Gitlab.config.sidekiq.log_format == 'json'
+enable_sidekiq_monitor = ENV.fetch("SIDEKIQ_MONITOR_WORKER", 0).to_i.nonzero?
 
 Sidekiq.configure_server do |config|
   config.redis = queues_config_hash
 
   config.server_middleware do |chain|
-    chain.add Gitlab::SidekiqMiddleware::Monitor
+    chain.add Gitlab::SidekiqMiddleware::Monitor if enable_sidekiq_monitor
     chain.add Gitlab::SidekiqMiddleware::Metrics if Settings.monitoring.sidekiq_exporter
     chain.add Gitlab::SidekiqMiddleware::ArgumentsLogger if ENV['SIDEKIQ_LOG_ARGUMENTS'] && !enable_json_logs
     chain.add Gitlab::SidekiqMiddleware::MemoryKiller if ENV['SIDEKIQ_MEMORY_KILLER_MAX_RSS']
@@ -59,9 +60,7 @@ Sidekiq.configure_server do |config|
     # Sidekiq (e.g. in an initializer).
     ActiveRecord::Base.clear_all_connections!
 
-    if ENV.fetch("SIDEKIQ_MONITOR_WORKER", 0).to_i.nonzero?
-      Gitlab::SidekiqMonitor.instance.start
-    end
+    Gitlab::SidekiqMonitor.instance.start if enable_sidekiq_monitor
   end
 
   if enable_reliable_fetch?
diff --git a/lib/gitlab/sidekiq_middleware/monitor.rb b/lib/gitlab/sidekiq_middleware/monitor.rb
index 2d0e5a6d635..0d88fe760d3 100644
--- a/lib/gitlab/sidekiq_middleware/monitor.rb
+++ b/lib/gitlab/sidekiq_middleware/monitor.rb
@@ -7,6 +7,9 @@ module Gitlab
         Gitlab::SidekiqMonitor.instance.within_job(job['jid'], queue) do
           yield
         end
+      rescue Gitlab::SidekiqMonitor::CancelledError
+        # ignore retries
+        raise Sidekiq::JobRetry::Skip
       end
     end
   end
diff --git a/lib/gitlab/sidekiq_monitor.rb b/lib/gitlab/sidekiq_monitor.rb
index 9ec3be48adb..9842f1f53f7 100644
--- a/lib/gitlab/sidekiq_monitor.rb
+++ b/lib/gitlab/sidekiq_monitor.rb
@@ -30,7 +30,7 @@ module Gitlab
 
       if cancelled?(jid)
         Sidekiq.logger.warn(
-          class: self.class,
+          class: self.class.to_s,
           action: 'run',
           queue: queue,
           jid: jid,
@@ -62,7 +62,7 @@ module Gitlab
 
     def start_working
       Sidekiq.logger.info(
-        class: self.class,
+        class: self.class.to_s,
         action: 'start',
         message: 'Starting Monitor Daemon'
       )
@@ -74,7 +74,7 @@ module Gitlab
 
     ensure
       Sidekiq.logger.warn(
-        class: self.class,
+        class: self.class.to_s,
         action: 'stop',
         message: 'Stopping Monitor Daemon'
       )
@@ -94,7 +94,7 @@ module Gitlab
       end
     rescue Exception => e # rubocop:disable Lint/RescueException
       Sidekiq.logger.warn(
-        class: self.class,
+        class: self.class.to_s,
         action: 'exception',
         message: e.message
       )
@@ -105,7 +105,7 @@ module Gitlab
 
     def process_message(message)
       Sidekiq.logger.info(
-        class: self.class,
+        class: self.class.to_s,
         channel: NOTIFICATION_CHANNEL,
         message: 'Received payload on channel',
         payload: message
@@ -139,7 +139,7 @@ module Gitlab
         # running job
         find_thread_with_lock(jid) do |thread|
           Sidekiq.logger.warn(
-            class: self.class,
+            class: self.class.to_s,
             action: 'cancel',
             message: 'Canceling thread with CancelledError',
             jid: jid,
diff --git a/spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb b/spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb
index 3ca2ddf3cb1..2933d26a387 100644
--- a/spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb
+++ b/spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb
@@ -25,5 +25,17 @@ describe Gitlab::SidekiqMiddleware::Monitor do
 
       expect(result).to eq('value')
     end
+
+    context 'when cancel happens' do
+      subject do
+        monitor.call(worker, job, queue) do
+          raise Gitlab::SidekiqMonitor::CancelledError
+        end
+      end
+
+      it 'does skip this job' do
+        expect { subject }.to raise_error(Sidekiq::JobRetry::Skip)
+      end
+    end
   end
 end
diff --git a/spec/lib/gitlab/sidekiq_monitor_spec.rb b/spec/lib/gitlab/sidekiq_monitor_spec.rb
index 62baa326887..bbd7bf90217 100644
--- a/spec/lib/gitlab/sidekiq_monitor_spec.rb
+++ b/spec/lib/gitlab/sidekiq_monitor_spec.rb
@@ -54,7 +54,7 @@ describe Gitlab::SidekiqMonitor do
       it 'logs start message' do
         expect(Sidekiq.logger).to receive(:info)
           .with(
-            class: described_class,
+            class: described_class.to_s,
             action: 'start',
             message: 'Starting Monitor Daemon')
 
@@ -66,7 +66,7 @@ describe Gitlab::SidekiqMonitor do
       it 'logs stop message' do
         expect(Sidekiq.logger).to receive(:warn)
           .with(
-            class: described_class,
+            class: described_class.to_s,
             action: 'stop',
             message: 'Stopping Monitor Daemon')
 
@@ -78,7 +78,7 @@ describe Gitlab::SidekiqMonitor do
       it 'logs StandardError message' do
         expect(Sidekiq.logger).to receive(:warn)
           .with(
-            class: described_class,
+            class: described_class.to_s,
             action: 'exception',
             message: 'My Exception')
 
@@ -91,7 +91,7 @@ describe Gitlab::SidekiqMonitor do
       it 'logs and raises Exception message' do
         expect(Sidekiq.logger).to receive(:warn)
           .with(
-            class: described_class,
+            class: described_class.to_s,
             action: 'exception',
             message: 'My Exception')
 
@@ -131,13 +131,13 @@ describe Gitlab::SidekiqMonitor do
 
         expect(Sidekiq.logger).to receive(:info)
           .with(
-            class: described_class,
+            class: described_class.to_s,
             action: 'start',
             message: 'Starting Monitor Daemon')
 
         expect(Sidekiq.logger).to receive(:info)
           .with(
-            class: described_class,
+            class: described_class.to_s,
             channel: described_class::NOTIFICATION_CHANNEL,
             message: 'Received payload on channel',
             payload: payload
@@ -215,7 +215,7 @@ describe Gitlab::SidekiqMonitor do
         it 'does log cancellation message' do
           expect(Sidekiq.logger).to receive(:warn)
             .with(
-              class: described_class,
+              class: described_class.to_s,
               action: 'cancel',
               message: 'Canceling thread with CancelledError',
               jid: 'my-jid',
-- 
cgit v1.2.1


From fffba04a0da9d0bb920c89f75b003931f2f051fc Mon Sep 17 00:00:00 2001
From: Ben Bodenmiller <bbodenmiller@hotmail.com>
Date: Wed, 21 Aug 2019 12:55:37 +0000
Subject: Clarify how to setup and use multiple Gitaly servers

---
 doc/administration/gitaly/index.md | 82 ++++++++++++++++++++++++++++----------
 1 file changed, 61 insertions(+), 21 deletions(-)

diff --git a/doc/administration/gitaly/index.md b/doc/administration/gitaly/index.md
index 150494c47e5..878f0ef842d 100644
--- a/doc/administration/gitaly/index.md
+++ b/doc/administration/gitaly/index.md
@@ -64,6 +64,7 @@ The following list depicts what the network architecture of Gitaly is:
   topology.
 - A `(Gitaly address, Gitaly token)` corresponds to a Gitaly server.
 - A Gitaly server hosts one or more storages.
+- A GitLab server can use one or more Gitaly servers.
 - Gitaly addresses must be specified in such a way that they resolve
   correctly for ALL Gitaly clients.
 - Gitaly clients are: Unicorn, Sidekiq, gitlab-workhorse,
@@ -77,14 +78,16 @@ The following list depicts what the network architecture of Gitaly is:
 - Authentication is done through a static token which is shared among the Gitaly
   and GitLab Rails nodes.
 
-Below we describe how to configure a Gitaly server at address
-`gitaly.internal:8075` with secret token `abc123secret`. We assume
-your GitLab installation has two repository storages, `default` and
-`storage1`.
+Below we describe how to configure two Gitaly servers one at
+`gitaly1.internal` and the other at `gitaly2.internal`
+with secret token `abc123secret`. We assume
+your GitLab installation has three repository storages: `default`,
+`storage1` and `storage2`.
 
 ### 1. Installation
 
-First install Gitaly using either Omnibus GitLab or install it from source:
+First install Gitaly on each Gitaly server using either
+Omnibus GitLab or install it from source:
 
 - For Omnibus GitLab: [Download/install](https://about.gitlab.com/install/) the Omnibus GitLab
   package you want using **steps 1 and 2** from the GitLab downloads page but
@@ -119,7 +122,7 @@ Configure a token on the instance that runs the GitLab Rails application.
 
 ### 3. Gitaly server configuration
 
-Next, on the Gitaly server, you need to configure storage paths, enable
+Next, on the Gitaly servers, you need to configure storage paths, enable
 the network listener and configure the token.
 
 NOTE: **Note:** if you want to reduce the risk of downtime when you enable
@@ -175,15 +178,29 @@ Check the directory layout on your Gitaly server to be sure.
    gitaly['listen_addr'] = "0.0.0.0:8075"
    gitaly['auth_token'] = 'abc123secret'
 
+   # To use TLS for Gitaly you need to add
+   gitaly['tls_listen_addr'] = "0.0.0.0:9999"
+   gitaly['certificate_path'] = "path/to/cert.pem"
+   gitaly['key_path'] = "path/to/key.pem"
+   ```
+
+1. Append the following to `/etc/gitlab/gitlab.rb` for each respective server:
+   
+   For `gitaly1.internal`:
+
+   ```
    gitaly['storage'] = [
      { 'name' => 'default' },
      { 'name' => 'storage1' },
    ]
+   ```
+   
+   For `gitaly2.internal`:
 
-   # To use TLS for Gitaly you need to add
-   gitaly['tls_listen_addr'] = "0.0.0.0:9999"
-   gitaly['certificate_path'] = "path/to/cert.pem"
-   gitaly['key_path'] = "path/to/key.pem"
+   ```
+   gitaly['storage'] = [
+     { 'name' => 'storage2' },
+   ]
    ```
 
    NOTE: **Note:**
@@ -206,13 +223,26 @@ Check the directory layout on your Gitaly server to be sure.
 
    [auth]
    token = 'abc123secret'
+   ```
+
+1. Append the following to `/home/git/gitaly/config.toml` for each respective server:
+   
+   For `gitaly1.internal`:
 
+   ```toml
    [[storage]]
    name = 'default'
 
    [[storage]]
    name = 'storage1'
    ```
+   
+   For `gitaly2.internal`:
+
+   ```toml
+   [[storage]]
+   name = 'storage2'
+   ```
 
    NOTE: **Note:**
    In some cases, you'll have to set `path` for each `[[storage]]` in the
@@ -231,9 +261,13 @@ then all Gitaly requests will fail.
 Additionally, you need to
 [disable Rugged if previously manually enabled](../high_availability/nfs.md#improving-nfs-performance-with-gitlab).
 
-We assume that your Gitaly server can be reached at
-`gitaly.internal:8075` from your GitLab server, and that Gitaly can read and
-write to `/mnt/gitlab/default` and `/mnt/gitlab/storage1` respectively.
+We assume that your `gitaly1.internal` Gitaly server can be reached at
+`gitaly1.internal:8075` from your GitLab server, and that Gitaly server 
+can read and write to `/mnt/gitlab/default` and `/mnt/gitlab/storage1`.
+
+We assume also that your `gitaly2.internal` Gitaly server can be reached at
+`gitaly2.internal:8075` from your GitLab server, and that Gitaly server 
+can read and write to `/mnt/gitlab/storage2`. 
 
 **For Omnibus GitLab**
 
@@ -241,8 +275,9 @@ write to `/mnt/gitlab/default` and `/mnt/gitlab/storage1` respectively.
 
    ```ruby
    git_data_dirs({
-     'default' => { 'gitaly_address' => 'tcp://gitaly.internal:8075' },
-     'storage1' => { 'gitaly_address' => 'tcp://gitaly.internal:8075' },
+     'default' => { 'gitaly_address' => 'tcp://gitaly1.internal:8075' },
+     'storage1' => { 'gitaly_address' => 'tcp://gitaly1.internal:8075' },
+     'storage2' => { 'gitaly_address' => 'tcp://gitaly2.internal:8075' },
    })
 
    gitlab_rails['gitaly_token'] = 'abc123secret'
@@ -268,9 +303,11 @@ write to `/mnt/gitlab/default` and `/mnt/gitlab/storage1` respectively.
      repositories:
        storages:
          default:
-           gitaly_address: tcp://gitaly.internal:8075
+           gitaly_address: tcp://gitaly1.internal:8075
          storage1:
-           gitaly_address: tcp://gitaly.internal:8075
+           gitaly_address: tcp://gitaly1.internal:8075
+         storage2:
+           gitaly_address: tcp://gitaly2.internal:8075
 
      gitaly:
        token: 'abc123secret'
@@ -350,8 +387,9 @@ To configure Gitaly with TLS:
 
    ```ruby
    git_data_dirs({
-     'default' => { 'gitaly_address' => 'tls://gitaly.internal:9999' },
-     'storage1' => { 'gitaly_address' => 'tls://gitaly.internal:9999' },
+     'default' => { 'gitaly_address' => 'tls://gitaly1.internal:9999' },
+     'storage1' => { 'gitaly_address' => 'tls://gitaly1.internal:9999' },
+     'storage2' => { 'gitaly_address' => 'tls://gitaly2.internal:9999' },
    })
 
    gitlab_rails['gitaly_token'] = 'abc123secret'
@@ -377,9 +415,11 @@ To configure Gitaly with TLS:
      repositories:
        storages:
          default:
-           gitaly_address: tls://gitaly.internal:9999
+           gitaly_address: tls://gitaly1.internal:9999
          storage1:
-           gitaly_address: tls://gitaly.internal:9999
+           gitaly_address: tls://gitaly1.internal:9999
+         storage2:
+           gitaly_address: tls://gitaly2.internal:9999
 
      gitaly:
        token: 'abc123secret'
-- 
cgit v1.2.1


From 91d31e4cc986e5f1d7088fda9bf92d2719da9976 Mon Sep 17 00:00:00 2001
From: Laura Montemayor <lmontemayor@gitlab.com>
Date: Wed, 21 Aug 2019 13:04:50 +0000
Subject: Add docs for csv download

---
 doc/user/project/integrations/img/download_as_csv.png | Bin 0 -> 33801 bytes
 doc/user/project/integrations/prometheus.md           |   6 ++++++
 2 files changed, 6 insertions(+)
 create mode 100644 doc/user/project/integrations/img/download_as_csv.png

diff --git a/doc/user/project/integrations/img/download_as_csv.png b/doc/user/project/integrations/img/download_as_csv.png
new file mode 100644
index 00000000000..0ed5ab8db89
Binary files /dev/null and b/doc/user/project/integrations/img/download_as_csv.png differ
diff --git a/doc/user/project/integrations/prometheus.md b/doc/user/project/integrations/prometheus.md
index 3ddda802796..e2f45b8a32f 100644
--- a/doc/user/project/integrations/prometheus.md
+++ b/doc/user/project/integrations/prometheus.md
@@ -269,6 +269,12 @@ Note the following properties:
 
 ![single stat panel type](img/prometheus_dashboard_single_stat_panel_type.png)
 
+### Downloading data as CSV
+
+Data from Prometheus charts on the metrics dashboard can be downloaded as CSV. 
+
+![Downloading as CSV](img/download_as_csv.png)
+
 ### Setting up alerts for Prometheus metrics **(ULTIMATE)**
 
 #### Managed Prometheus instances
-- 
cgit v1.2.1


From be273ce3b4cddf2d4b767d033757fd0efeeb26d3 Mon Sep 17 00:00:00 2001
From: Evan Read <eread@gitlab.com>
Date: Wed, 21 Aug 2019 13:05:53 +0000
Subject: Make text clearer

---
 doc/ci/yaml/README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md
index c957ed2cc6b..f7a67931793 100644
--- a/doc/ci/yaml/README.md
+++ b/doc/ci/yaml/README.md
@@ -524,7 +524,7 @@ single conjoined expression. That is:
 - `only:` means "include this job if all of the conditions match".
 - `except:` means "exclude this job if any of the conditions match".
 
-The the individual keys are logically joined by an AND:
+With `only`, individual keys are logically joined by an AND:
 
 > (any of refs) AND (any of variables) AND (any of changes) AND (if kubernetes is active)
 
@@ -1735,7 +1735,7 @@ This example creates three paths of execution:
 1. If `needs:` is set to point to a job that is not instantiated
    because of `only/except` rules or otherwise does not exist, the
    job will fail.
-1. Note that on day one of the launch, we are temporarily limiting the 
+1. Note that on day one of the launch, we are temporarily limiting the
    maximum number of jobs that a single job can need in the `needs:` array. Track
    our [infrastructure issue](https://gitlab.com/gitlab-com/gl-infra/infrastructure/issues/7541)
    for details on the current limit.
-- 
cgit v1.2.1


From d80c218c0cf7c3d543400e7d9213a9fc800bb584 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Wed, 21 Aug 2019 06:24:54 -0700
Subject: Elasticsearch docs: Minor copyedits and add links to issues

---
 doc/development/elasticsearch.md | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/doc/development/elasticsearch.md b/doc/development/elasticsearch.md
index bcc95d73d39..5d48968b5dc 100644
--- a/doc/development/elasticsearch.md
+++ b/doc/development/elasticsearch.md
@@ -152,7 +152,13 @@ Uses an [Edge NGram token filter](https://www.elastic.co/guide/en/elasticsearch/
 
 Currently GitLab can only handle a single version of setting. Any setting/schema changes would require reindexing everything from scratch. Since reindexing can take a long time, this can cause search functionality downtime.
 
-To avoid downtime, GitLab is working on to allow multiple indices to function at the same time. Whenever the schema changes, the admin will be able to create a new index and reindex to it, while users still searches using the older stable index. Any data updates would be forwarded to both indices. Once the new index is ready, admin can mark it as the read node where search takes place, and remove the old index.
+To avoid downtime, GitLab is working to support multiple indices that
+can function at the same time. Whenever the schema changes, the admin
+will be able to create a new index and reindex to it, while searches
+continue to go to the older, stable index. Any data updates will be
+forwarded to both indices. Once the new index is ready, an admin can
+mark it active, which will direct all searches to it, and remove the old
+index.
 
 This is also helpful for migrating to new servers, e.g. moving to/from AWS.
 
@@ -180,7 +186,12 @@ The global configurations per version are now in the `Elastic::(Version)::Config
 
 ### Creating new version of schema
 
-NOTE: **Note:** this is not applicable yet as multiple indices functionality is not fully implemented.
+NOTE: **Note:** this is not applicable yet as multiple indices functionality is not fully implemented. See the
+the following issues for more details:
+
+* https://gitlab.com/gitlab-org/gitlab-ee/issues/12548
+* https://gitlab.com/gitlab-org/gitlab-ee/issues/12555
+* https://gitlab.com/gitlab-org/gitlab-ee/issues/13533
 
 Folders like `ee/lib/elastic/v12p1` contain snapshots of search logic from different versions. To keep a continuous git history, the latest version lives under `ee/lib/elastic/latest`, but its classes are aliased under an actual version (e.g. `ee/lib/elastic/v12p3`). When referencing these classes, never use the `Latest` namespace directly, but use the actual version (e.g. `V12p3`).
 
-- 
cgit v1.2.1


From 90f2adcb0808c7e310f0302c0b593cb26f1272aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Wed, 21 Aug 2019 15:30:24 +0200
Subject: Make Danger consider .md files as documentation files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 danger/only_documentation/Dangerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/danger/only_documentation/Dangerfile b/danger/only_documentation/Dangerfile
index ff65f8713d2..dad12c0d29c 100644
--- a/danger/only_documentation/Dangerfile
+++ b/danger/only_documentation/Dangerfile
@@ -1,7 +1,7 @@
 # rubocop:disable Style/SignalException
 # frozen_string_literal: true
 
-has_only_docs_changes = helper.all_changed_files.all? { |file| file.start_with?('doc/', '.gitlab/ci/docs.gitlab-ci.yml', '.mdlrc') }
+has_only_docs_changes = helper.all_changed_files.all? { |file| file.start_with?('doc/', '.gitlab/ci/docs.gitlab-ci.yml', '.mdlrc') || file.end_with?('.md') }
 is_docs_only_branch = gitlab.branch_for_head =~ /(^docs[\/-].*|.*-docs$)/
 
 if is_docs_only_branch && !has_only_docs_changes
-- 
cgit v1.2.1


From f2619e21bebe388182ec282bfec78da2b2625d49 Mon Sep 17 00:00:00 2001
From: Miguel Rincon <mrincon@gitlab.com>
Date: Wed, 21 Aug 2019 13:43:01 +0000
Subject: This commit adds a new time series component

Adds a time series component for line and area charts.
Displays new charts in the dashboard.

- Use dynamic components for line/area swapping
- Add new line charts to dashboard in 2 panels
---
 .../monitoring/components/charts/area.vue          |   3 +
 .../monitoring/components/charts/time_series.vue   | 334 ++++++++++++++++++++
 .../monitoring/components/dashboard.vue            |  10 +-
 app/assets/javascripts/monitoring/constants.js     |   9 +
 .../65412-add-support-for-line-charts.yml          |   5 +
 config/prometheus/common_metrics.yml               |   8 +-
 ...0814205640_import_common_metrics_line_charts.rb |  13 +
 .../monitoring/charts/time_series_spec.js          | 335 +++++++++++++++++++++
 spec/javascripts/monitoring/mock_data.js           |   4 +-
 9 files changed, 711 insertions(+), 10 deletions(-)
 create mode 100644 app/assets/javascripts/monitoring/components/charts/time_series.vue
 create mode 100644 changelogs/unreleased/65412-add-support-for-line-charts.yml
 create mode 100644 db/migrate/20190814205640_import_common_metrics_line_charts.rb
 create mode 100644 spec/javascripts/monitoring/charts/time_series_spec.js

diff --git a/app/assets/javascripts/monitoring/components/charts/area.vue b/app/assets/javascripts/monitoring/components/charts/area.vue
index 90c764587a3..78d97a3c122 100644
--- a/app/assets/javascripts/monitoring/components/charts/area.vue
+++ b/app/assets/javascripts/monitoring/components/charts/area.vue
@@ -12,6 +12,9 @@ import { graphDataValidatorForValues } from '../../utils';
 
 let debouncedResize;
 
+// TODO: Remove this component in favor of the more general time_series.vue
+// Please port all changes here to time_series.vue as well.
+
 export default {
   components: {
     GlAreaChart,
diff --git a/app/assets/javascripts/monitoring/components/charts/time_series.vue b/app/assets/javascripts/monitoring/components/charts/time_series.vue
new file mode 100644
index 00000000000..2fdc75f63ca
--- /dev/null
+++ b/app/assets/javascripts/monitoring/components/charts/time_series.vue
@@ -0,0 +1,334 @@
+<script>
+import { __ } from '~/locale';
+import { mapState } from 'vuex';
+import { GlLink, GlButton } from '@gitlab/ui';
+import { GlAreaChart, GlLineChart, GlChartSeriesLabel } from '@gitlab/ui/dist/charts';
+import dateFormat from 'dateformat';
+import { debounceByAnimationFrame, roundOffFloat } from '~/lib/utils/common_utils';
+import { getSvgIconPathContent } from '~/lib/utils/icon_utils';
+import Icon from '~/vue_shared/components/icon.vue';
+import { chartHeight, graphTypes, lineTypes, symbolSizes, dateFormats } from '../../constants';
+import { makeDataSeries } from '~/helpers/monitor_helper';
+import { graphDataValidatorForValues } from '../../utils';
+
+let debouncedResize;
+
+export default {
+  components: {
+    GlAreaChart,
+    GlLineChart,
+    GlButton,
+    GlChartSeriesLabel,
+    GlLink,
+    Icon,
+  },
+  inheritAttrs: false,
+  props: {
+    graphData: {
+      type: Object,
+      required: true,
+      validator: graphDataValidatorForValues.bind(null, false),
+    },
+    containerWidth: {
+      type: Number,
+      required: true,
+    },
+    deploymentData: {
+      type: Array,
+      required: false,
+      default: () => [],
+    },
+    projectPath: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    showBorder: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    thresholds: {
+      type: Array,
+      required: false,
+      default: () => [],
+    },
+  },
+  data() {
+    return {
+      tooltip: {
+        title: '',
+        content: [],
+        commitUrl: '',
+        isDeployment: false,
+        sha: '',
+      },
+      width: 0,
+      height: chartHeight,
+      svgs: {},
+      primaryColor: null,
+    };
+  },
+  computed: {
+    ...mapState('monitoringDashboard', ['exportMetricsToCsvEnabled']),
+    chartData() {
+      // Transforms & supplements query data to render appropriate labels & styles
+      // Input: [{ queryAttributes1 }, { queryAttributes2 }]
+      // Output: [{ seriesAttributes1 }, { seriesAttributes2 }]
+      return this.graphData.queries.reduce((acc, query) => {
+        const { appearance } = query;
+        const lineType =
+          appearance && appearance.line && appearance.line.type
+            ? appearance.line.type
+            : lineTypes.default;
+        const lineWidth =
+          appearance && appearance.line && appearance.line.width
+            ? appearance.line.width
+            : undefined;
+        const areaStyle = {
+          opacity:
+            appearance && appearance.area && typeof appearance.area.opacity === 'number'
+              ? appearance.area.opacity
+              : undefined,
+        };
+
+        const series = makeDataSeries(query.result, {
+          name: this.formatLegendLabel(query),
+          lineStyle: {
+            type: lineType,
+            width: lineWidth,
+          },
+          showSymbol: false,
+          areaStyle: this.graphData.type === 'area-chart' ? areaStyle : undefined,
+        });
+
+        return acc.concat(series);
+      }, []);
+    },
+    chartOptions() {
+      return {
+        xAxis: {
+          name: __('Time'),
+          type: 'time',
+          axisLabel: {
+            formatter: date => dateFormat(date, dateFormats.timeOfDay),
+          },
+          axisPointer: {
+            snap: true,
+          },
+        },
+        yAxis: {
+          name: this.yAxisLabel,
+          axisLabel: {
+            formatter: num => roundOffFloat(num, 3).toString(),
+          },
+        },
+        series: this.scatterSeries,
+        dataZoom: this.dataZoomConfig,
+      };
+    },
+    dataZoomConfig() {
+      const handleIcon = this.svgs['scroll-handle'];
+
+      return handleIcon ? { handleIcon } : {};
+    },
+    earliestDatapoint() {
+      return this.chartData.reduce((acc, series) => {
+        const { data } = series;
+        const { length } = data;
+        if (!length) {
+          return acc;
+        }
+
+        const [first] = data[0];
+        const [last] = data[length - 1];
+        const seriesEarliest = first < last ? first : last;
+
+        return seriesEarliest < acc || acc === null ? seriesEarliest : acc;
+      }, null);
+    },
+    glChartComponent() {
+      const chartTypes = {
+        'area-chart': GlAreaChart,
+        'line-chart': GlLineChart,
+      };
+      return chartTypes[this.graphData.type] || GlAreaChart;
+    },
+    isMultiSeries() {
+      return this.tooltip.content.length > 1;
+    },
+    recentDeployments() {
+      return this.deploymentData.reduce((acc, deployment) => {
+        if (deployment.created_at >= this.earliestDatapoint) {
+          const { id, created_at, sha, ref, tag } = deployment;
+          acc.push({
+            id,
+            createdAt: created_at,
+            sha,
+            commitUrl: `${this.projectPath}/commit/${sha}`,
+            tag,
+            tagUrl: tag ? `${this.tagsPath}/${ref.name}` : null,
+            ref: ref.name,
+            showDeploymentFlag: false,
+          });
+        }
+
+        return acc;
+      }, []);
+    },
+    scatterSeries() {
+      return {
+        type: graphTypes.deploymentData,
+        data: this.recentDeployments.map(deployment => [deployment.createdAt, 0]),
+        symbol: this.svgs.rocket,
+        symbolSize: symbolSizes.default,
+        itemStyle: {
+          color: this.primaryColor,
+        },
+      };
+    },
+    yAxisLabel() {
+      return `${this.graphData.y_label}`;
+    },
+    csvText() {
+      const chartData = this.chartData[0].data;
+      const header = `timestamp,${this.graphData.y_label}\r\n`; // eslint-disable-line @gitlab/i18n/no-non-i18n-strings
+      return chartData.reduce((csv, data) => {
+        const row = data.join(',');
+        return `${csv}${row}\r\n`;
+      }, header);
+    },
+    downloadLink() {
+      const data = new Blob([this.csvText], { type: 'text/plain' });
+      return window.URL.createObjectURL(data);
+    },
+  },
+  watch: {
+    containerWidth: 'onResize',
+  },
+  beforeDestroy() {
+    window.removeEventListener('resize', debouncedResize);
+  },
+  created() {
+    debouncedResize = debounceByAnimationFrame(this.onResize);
+    window.addEventListener('resize', debouncedResize);
+    this.setSvg('rocket');
+    this.setSvg('scroll-handle');
+  },
+  methods: {
+    formatLegendLabel(query) {
+      return `${query.label}`;
+    },
+    formatTooltipText(params) {
+      this.tooltip.title = dateFormat(params.value, dateFormats.default);
+      this.tooltip.content = [];
+      params.seriesData.forEach(dataPoint => {
+        const [xVal, yVal] = dataPoint.value;
+        this.tooltip.isDeployment = dataPoint.componentSubType === graphTypes.deploymentData;
+        if (this.tooltip.isDeployment) {
+          const [deploy] = this.recentDeployments.filter(
+            deployment => deployment.createdAt === xVal,
+          );
+          this.tooltip.sha = deploy.sha.substring(0, 8);
+          this.tooltip.commitUrl = deploy.commitUrl;
+        } else {
+          const { seriesName, color } = dataPoint;
+          const value = yVal.toFixed(3);
+          this.tooltip.content.push({
+            name: seriesName,
+            value,
+            color,
+          });
+        }
+      });
+    },
+    setSvg(name) {
+      getSvgIconPathContent(name)
+        .then(path => {
+          if (path) {
+            this.$set(this.svgs, name, `path://${path}`);
+          }
+        })
+        .catch(e => {
+          // eslint-disable-next-line no-console, @gitlab/i18n/no-non-i18n-strings
+          console.error('SVG could not be rendered correctly: ', e);
+        });
+    },
+    onChartUpdated(chart) {
+      [this.primaryColor] = chart.getOption().color;
+    },
+    onResize() {
+      if (!this.$refs.chart) return;
+      const { width } = this.$refs.chart.$el.getBoundingClientRect();
+      this.width = width;
+    },
+  },
+};
+</script>
+
+<template>
+  <div class="prometheus-graph col-12 col-lg-6" :class="[showBorder ? 'p-2' : 'p-0']">
+    <div :class="{ 'prometheus-graph-embed w-100 p-3': showBorder }">
+      <div class="prometheus-graph-header">
+        <h5 class="prometheus-graph-title js-graph-title">{{ graphData.title }}</h5>
+        <gl-button
+          v-if="exportMetricsToCsvEnabled"
+          :href="downloadLink"
+          :title="__('Download CSV')"
+          :aria-label="__('Download CSV')"
+          style="margin-left: 200px;"
+          download="chart_metrics.csv"
+        >
+          {{ __('Download CSV') }}
+        </gl-button>
+        <div class="prometheus-graph-widgets js-graph-widgets">
+          <slot></slot>
+        </div>
+      </div>
+
+      <component
+        :is="glChartComponent"
+        ref="chart"
+        v-bind="$attrs"
+        :data="chartData"
+        :option="chartOptions"
+        :format-tooltip-text="formatTooltipText"
+        :thresholds="thresholds"
+        :width="width"
+        :height="height"
+        @updated="onChartUpdated"
+      >
+        <template v-if="tooltip.isDeployment">
+          <template slot="tooltipTitle">
+            {{ __('Deployed') }}
+          </template>
+          <div slot="tooltipContent" class="d-flex align-items-center">
+            <icon name="commit" class="mr-2" />
+            <gl-link :href="tooltip.commitUrl">{{ tooltip.sha }}</gl-link>
+          </div>
+        </template>
+        <template v-else>
+          <template slot="tooltipTitle">
+            <div class="text-nowrap">
+              {{ tooltip.title }}
+            </div>
+          </template>
+          <template slot="tooltipContent">
+            <div
+              v-for="(content, key) in tooltip.content"
+              :key="key"
+              class="d-flex justify-content-between"
+            >
+              <gl-chart-series-label :color="isMultiSeries ? content.color : ''">
+                {{ content.name }}
+              </gl-chart-series-label>
+              <div class="prepend-left-32">
+                {{ content.value }}
+              </div>
+            </div>
+          </template>
+        </template>
+      </component>
+    </div>
+  </div>
+</template>
diff --git a/app/assets/javascripts/monitoring/components/dashboard.vue b/app/assets/javascripts/monitoring/components/dashboard.vue
index ebd610af7b6..d330ceb836c 100644
--- a/app/assets/javascripts/monitoring/components/dashboard.vue
+++ b/app/assets/javascripts/monitoring/components/dashboard.vue
@@ -15,7 +15,7 @@ import Icon from '~/vue_shared/components/icon.vue';
 import { getParameterValues, mergeUrlParams } from '~/lib/utils/url_utility';
 import invalidUrl from '~/lib/utils/invalid_url';
 import PanelType from 'ee_else_ce/monitoring/components/panel_type.vue';
-import MonitorAreaChart from './charts/area.vue';
+import MonitorTimeSeriesChart from './charts/time_series.vue';
 import MonitorSingleStatChart from './charts/single_stat.vue';
 import GraphGroup from './graph_group.vue';
 import EmptyState from './empty_state.vue';
@@ -26,7 +26,7 @@ let sidebarMutationObserver;
 
 export default {
   components: {
-    MonitorAreaChart,
+    MonitorTimeSeriesChart,
     MonitorSingleStatChart,
     PanelType,
     GraphGroup,
@@ -465,7 +465,7 @@ export default {
           />
         </template>
         <template v-else>
-          <monitor-area-chart
+          <monitor-time-series-chart
             v-for="(graphData, graphIndex) in chartsWithData(groupData.metrics)"
             :key="graphIndex"
             :graph-data="graphData"
@@ -473,7 +473,7 @@ export default {
             :thresholds="getGraphAlertValues(graphData.queries)"
             :container-width="elWidth"
             :project-path="projectPath"
-            group-id="monitor-area-chart"
+            group-id="monitor-time-series-chart"
           >
             <div class="d-flex align-items-center">
               <alert-widget
@@ -515,7 +515,7 @@ export default {
                 </gl-dropdown-item>
               </gl-dropdown>
             </div>
-          </monitor-area-chart>
+          </monitor-time-series-chart>
         </template>
       </graph-group>
     </div>
diff --git a/app/assets/javascripts/monitoring/constants.js b/app/assets/javascripts/monitoring/constants.js
index d7d89522732..13aba3d9f44 100644
--- a/app/assets/javascripts/monitoring/constants.js
+++ b/app/assets/javascripts/monitoring/constants.js
@@ -8,6 +8,10 @@ export const graphTypes = {
   deploymentData: 'scatter',
 };
 
+export const symbolSizes = {
+  default: 14,
+};
+
 export const lineTypes = {
   default: 'solid',
 };
@@ -21,6 +25,11 @@ export const timeWindows = {
   oneWeek: __('1 week'),
 };
 
+export const dateFormats = {
+  timeOfDay: 'h:MM TT',
+  default: 'dd mmm yyyy, h:MMTT',
+};
+
 export const secondsIn = {
   thirtyMinutes: 60 * 30,
   threeHours: 60 * 60 * 3,
diff --git a/changelogs/unreleased/65412-add-support-for-line-charts.yml b/changelogs/unreleased/65412-add-support-for-line-charts.yml
new file mode 100644
index 00000000000..cb9043596b7
--- /dev/null
+++ b/changelogs/unreleased/65412-add-support-for-line-charts.yml
@@ -0,0 +1,5 @@
+---
+title: Create component to display area and line charts in monitor dashboards
+merge_request: 31639
+author:
+type: added
diff --git a/config/prometheus/common_metrics.yml b/config/prometheus/common_metrics.yml
index 32475ef8380..08504d6f7d5 100644
--- a/config/prometheus/common_metrics.yml
+++ b/config/prometheus/common_metrics.yml
@@ -166,7 +166,7 @@ panel_groups:
       label: Total (cores)
       unit: "cores"
   - title: "Memory Usage (Pod average)"
-    type: "area-chart"
+    type: "line-chart"
     y_label: "Memory Used per Pod (MB)"
     weight: 2
     metrics:
@@ -175,7 +175,7 @@ panel_groups:
       label: Pod average (MB)
       unit: MB
   - title: "Canary: Memory Usage (Pod Average)"
-    type: "area-chart"
+    type: "line-chart"
     y_label: "Memory Used per Pod (MB)"
     weight: 2
     metrics:
@@ -185,7 +185,7 @@ panel_groups:
       unit: MB
       track: canary
   - title: "Core Usage (Pod Average)"
-    type: "area-chart"
+    type: "line-chart"
     y_label: "Cores per Pod"
     weight: 1
     metrics:
@@ -194,7 +194,7 @@ panel_groups:
       label: Pod average (cores)
       unit: "cores"
   - title: "Canary: Core Usage (Pod Average)"
-    type: "area-chart"
+    type: "line-chart"
     y_label: "Cores per Pod"
     weight: 1
     metrics:
diff --git a/db/migrate/20190814205640_import_common_metrics_line_charts.rb b/db/migrate/20190814205640_import_common_metrics_line_charts.rb
new file mode 100644
index 00000000000..1c28d686a42
--- /dev/null
+++ b/db/migrate/20190814205640_import_common_metrics_line_charts.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class ImportCommonMetricsLineCharts < ActiveRecord::Migration[5.2]
+  DOWNTIME = false
+
+  def up
+    ::Gitlab::DatabaseImporters::CommonMetrics::Importer.new.execute
+  end
+
+  def down
+    # no-op
+  end
+end
diff --git a/spec/javascripts/monitoring/charts/time_series_spec.js b/spec/javascripts/monitoring/charts/time_series_spec.js
new file mode 100644
index 00000000000..d145a64e8d0
--- /dev/null
+++ b/spec/javascripts/monitoring/charts/time_series_spec.js
@@ -0,0 +1,335 @@
+import { shallowMount } from '@vue/test-utils';
+import { createStore } from '~/monitoring/stores';
+import { GlLink } from '@gitlab/ui';
+import { GlAreaChart, GlLineChart, GlChartSeriesLabel } from '@gitlab/ui/dist/charts';
+import { shallowWrapperContainsSlotText } from 'spec/helpers/vue_test_utils_helper';
+import TimeSeries from '~/monitoring/components/charts/time_series.vue';
+import * as types from '~/monitoring/stores/mutation_types';
+import { TEST_HOST } from 'spec/test_constants';
+import MonitoringMock, { deploymentData, mockProjectPath } from '../mock_data';
+
+describe('Time series component', () => {
+  const mockSha = 'mockSha';
+  const mockWidgets = 'mockWidgets';
+  const mockSvgPathContent = 'mockSvgPathContent';
+  const projectPath = `${TEST_HOST}${mockProjectPath}`;
+  const commitUrl = `${projectPath}/commit/${mockSha}`;
+  let mockGraphData;
+  let makeTimeSeriesChart;
+  let spriteSpy;
+  let store;
+
+  beforeEach(() => {
+    store = createStore();
+    store.commit(`monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`, MonitoringMock.data);
+    store.commit(`monitoringDashboard/${types.RECEIVE_DEPLOYMENTS_DATA_SUCCESS}`, deploymentData);
+    store.dispatch('monitoringDashboard/setFeatureFlags', { exportMetricsToCsvEnabled: true });
+    [mockGraphData] = store.state.monitoringDashboard.groups[0].metrics;
+
+    makeTimeSeriesChart = (graphData, type) =>
+      shallowMount(TimeSeries, {
+        propsData: {
+          graphData: { ...graphData, type },
+          containerWidth: 0,
+          deploymentData: store.state.monitoringDashboard.deploymentData,
+          projectPath,
+        },
+        slots: {
+          default: mockWidgets,
+        },
+        sync: false,
+        store,
+      });
+
+    spriteSpy = spyOnDependency(TimeSeries, 'getSvgIconPathContent').and.callFake(
+      () => new Promise(resolve => resolve(mockSvgPathContent)),
+    );
+  });
+
+  describe('general functions', () => {
+    let timeSeriesChart;
+
+    beforeEach(() => {
+      timeSeriesChart = makeTimeSeriesChart(mockGraphData, 'area-chart');
+    });
+
+    it('renders chart title', () => {
+      expect(timeSeriesChart.find('.js-graph-title').text()).toBe(mockGraphData.title);
+    });
+
+    it('contains graph widgets from slot', () => {
+      expect(timeSeriesChart.find('.js-graph-widgets').text()).toBe(mockWidgets);
+    });
+
+    describe('when exportMetricsToCsvEnabled is disabled', () => {
+      beforeEach(() => {
+        store.dispatch('monitoringDashboard/setFeatureFlags', { exportMetricsToCsvEnabled: false });
+      });
+
+      it('does not render the Download CSV button', done => {
+        timeSeriesChart.vm.$nextTick(() => {
+          expect(timeSeriesChart.contains('glbutton-stub')).toBe(false);
+          done();
+        });
+      });
+    });
+
+    describe('methods', () => {
+      describe('formatTooltipText', () => {
+        const mockDate = deploymentData[0].created_at;
+        const mockCommitUrl = deploymentData[0].commitUrl;
+        const generateSeriesData = type => ({
+          seriesData: [
+            {
+              seriesName: timeSeriesChart.vm.chartData[0].name,
+              componentSubType: type,
+              value: [mockDate, 5.55555],
+              seriesIndex: 0,
+            },
+          ],
+          value: mockDate,
+        });
+
+        describe('when series is of line type', () => {
+          beforeEach(done => {
+            timeSeriesChart.vm.formatTooltipText(generateSeriesData('line'));
+            timeSeriesChart.vm.$nextTick(done);
+          });
+
+          it('formats tooltip title', () => {
+            expect(timeSeriesChart.vm.tooltip.title).toBe('31 May 2017, 9:23PM');
+          });
+
+          it('formats tooltip content', () => {
+            const name = 'Core Usage';
+            const value = '5.556';
+            const seriesLabel = timeSeriesChart.find(GlChartSeriesLabel);
+
+            expect(seriesLabel.vm.color).toBe('');
+            expect(shallowWrapperContainsSlotText(seriesLabel, 'default', name)).toBe(true);
+            expect(timeSeriesChart.vm.tooltip.content).toEqual([{ name, value, color: undefined }]);
+            expect(
+              shallowWrapperContainsSlotText(
+                timeSeriesChart.find(GlAreaChart),
+                'tooltipContent',
+                value,
+              ),
+            ).toBe(true);
+          });
+        });
+
+        describe('when series is of scatter type', () => {
+          beforeEach(() => {
+            timeSeriesChart.vm.formatTooltipText(generateSeriesData('scatter'));
+          });
+
+          it('formats tooltip title', () => {
+            expect(timeSeriesChart.vm.tooltip.title).toBe('31 May 2017, 9:23PM');
+          });
+
+          it('formats tooltip sha', () => {
+            expect(timeSeriesChart.vm.tooltip.sha).toBe('f5bcd1d9');
+          });
+
+          it('formats tooltip commit url', () => {
+            expect(timeSeriesChart.vm.tooltip.commitUrl).toBe(mockCommitUrl);
+          });
+        });
+      });
+
+      describe('setSvg', () => {
+        const mockSvgName = 'mockSvgName';
+
+        beforeEach(done => {
+          timeSeriesChart.vm.setSvg(mockSvgName);
+          timeSeriesChart.vm.$nextTick(done);
+        });
+
+        it('gets svg path content', () => {
+          expect(spriteSpy).toHaveBeenCalledWith(mockSvgName);
+        });
+
+        it('sets svg path content', () => {
+          timeSeriesChart.vm.$nextTick(() => {
+            expect(timeSeriesChart.vm.svgs[mockSvgName]).toBe(`path://${mockSvgPathContent}`);
+          });
+        });
+      });
+
+      describe('onResize', () => {
+        const mockWidth = 233;
+
+        beforeEach(() => {
+          spyOn(Element.prototype, 'getBoundingClientRect').and.callFake(() => ({
+            width: mockWidth,
+          }));
+          timeSeriesChart.vm.onResize();
+        });
+
+        it('sets area chart width', () => {
+          expect(timeSeriesChart.vm.width).toBe(mockWidth);
+        });
+      });
+    });
+
+    describe('computed', () => {
+      describe('chartData', () => {
+        let chartData;
+        const seriesData = () => chartData[0];
+
+        beforeEach(() => {
+          ({ chartData } = timeSeriesChart.vm);
+        });
+
+        it('utilizes all data points', () => {
+          const { values } = mockGraphData.queries[0].result[0];
+
+          expect(chartData.length).toBe(1);
+          expect(seriesData().data.length).toBe(values.length);
+        });
+
+        it('creates valid data', () => {
+          const { data } = seriesData();
+
+          expect(
+            data.filter(
+              ([time, value]) => new Date(time).getTime() > 0 && typeof value === 'number',
+            ).length,
+          ).toBe(data.length);
+        });
+
+        it('formats line width correctly', () => {
+          expect(chartData[0].lineStyle.width).toBe(2);
+        });
+      });
+
+      describe('chartOptions', () => {
+        describe('yAxis formatter', () => {
+          let format;
+
+          beforeEach(() => {
+            format = timeSeriesChart.vm.chartOptions.yAxis.axisLabel.formatter;
+          });
+
+          it('rounds to 3 decimal places', () => {
+            expect(format(0.88888)).toBe('0.889');
+          });
+        });
+      });
+
+      describe('scatterSeries', () => {
+        it('utilizes deployment data', () => {
+          expect(timeSeriesChart.vm.scatterSeries.data).toEqual([
+            ['2017-05-31T21:23:37.881Z', 0],
+            ['2017-05-30T20:08:04.629Z', 0],
+            ['2017-05-30T17:42:38.409Z', 0],
+          ]);
+
+          expect(timeSeriesChart.vm.scatterSeries.symbolSize).toBe(14);
+        });
+      });
+
+      describe('yAxisLabel', () => {
+        it('constructs a label for the chart y-axis', () => {
+          expect(timeSeriesChart.vm.yAxisLabel).toBe('CPU');
+        });
+      });
+
+      describe('csvText', () => {
+        it('converts data from json to csv', () => {
+          const header = `timestamp,${mockGraphData.y_label}`;
+          const data = mockGraphData.queries[0].result[0].values;
+          const firstRow = `${data[0][0]},${data[0][1]}`;
+
+          expect(timeSeriesChart.vm.csvText).toMatch(`^${header}\r\n${firstRow}`);
+        });
+      });
+
+      describe('downloadLink', () => {
+        it('produces a link to download metrics as csv', () => {
+          const link = timeSeriesChart.vm.downloadLink;
+
+          expect(link).toContain('blob:');
+        });
+      });
+    });
+
+    afterEach(() => {
+      timeSeriesChart.destroy();
+    });
+  });
+
+  describe('wrapped components', () => {
+    const glChartComponents = [
+      {
+        chartType: 'area-chart',
+        component: GlAreaChart,
+      },
+      {
+        chartType: 'line-chart',
+        component: GlLineChart,
+      },
+    ];
+
+    glChartComponents.forEach(dynamicComponent => {
+      describe(`GitLab UI: ${dynamicComponent.chartType}`, () => {
+        let timeSeriesAreaChart;
+        let glChart;
+
+        beforeEach(done => {
+          timeSeriesAreaChart = makeTimeSeriesChart(mockGraphData, dynamicComponent.chartType);
+          glChart = timeSeriesAreaChart.find(dynamicComponent.component);
+          timeSeriesAreaChart.vm.$nextTick(done);
+        });
+
+        it('is a Vue instance', () => {
+          expect(glChart.exists()).toBe(true);
+          expect(glChart.isVueInstance()).toBe(true);
+        });
+
+        it('receives data properties needed for proper chart render', () => {
+          const props = glChart.props();
+
+          expect(props.data).toBe(timeSeriesAreaChart.vm.chartData);
+          expect(props.option).toBe(timeSeriesAreaChart.vm.chartOptions);
+          expect(props.formatTooltipText).toBe(timeSeriesAreaChart.vm.formatTooltipText);
+          expect(props.thresholds).toBe(timeSeriesAreaChart.vm.thresholds);
+        });
+
+        it('recieves a tooltip title', done => {
+          const mockTitle = 'mockTitle';
+          timeSeriesAreaChart.vm.tooltip.title = mockTitle;
+
+          timeSeriesAreaChart.vm.$nextTick(() => {
+            expect(shallowWrapperContainsSlotText(glChart, 'tooltipTitle', mockTitle)).toBe(true);
+            done();
+          });
+        });
+
+        describe('when tooltip is showing deployment data', () => {
+          beforeEach(done => {
+            timeSeriesAreaChart.vm.tooltip.isDeployment = true;
+            timeSeriesAreaChart.vm.$nextTick(done);
+          });
+
+          it('uses deployment title', () => {
+            expect(shallowWrapperContainsSlotText(glChart, 'tooltipTitle', 'Deployed')).toBe(true);
+          });
+
+          it('renders clickable commit sha in tooltip content', done => {
+            timeSeriesAreaChart.vm.tooltip.sha = mockSha;
+            timeSeriesAreaChart.vm.tooltip.commitUrl = commitUrl;
+
+            timeSeriesAreaChart.vm.$nextTick(() => {
+              const commitLink = timeSeriesAreaChart.find(GlLink);
+
+              expect(shallowWrapperContainsSlotText(commitLink, 'default', mockSha)).toBe(true);
+              expect(commitLink.attributes('href')).toEqual(commitUrl);
+              done();
+            });
+          });
+        });
+      });
+    });
+  });
+});
diff --git a/spec/javascripts/monitoring/mock_data.js b/spec/javascripts/monitoring/mock_data.js
index 85e660d3925..17e7314e214 100644
--- a/spec/javascripts/monitoring/mock_data.js
+++ b/spec/javascripts/monitoring/mock_data.js
@@ -1,5 +1,7 @@
 export const mockApiEndpoint = `${gl.TEST_HOST}/monitoring/mock`;
 
+export const mockProjectPath = '/frontend-fixtures/environments-project';
+
 export const metricsGroupsAPIResponse = {
   success: true,
   data: [
@@ -902,7 +904,7 @@ export const metricsDashboardResponse = {
           },
           {
             title: 'Memory Usage (Pod average)',
-            type: 'area-chart',
+            type: 'line-chart',
             y_label: 'Memory Used per Pod',
             weight: 2,
             metrics: [
-- 
cgit v1.2.1


From e2d4fadbf83381b7ed3fbb3a00b5dee28e0817d9 Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Wed, 21 Aug 2019 13:50:22 +0000
Subject: Fix markdown causing kramdown warnings

Use of square brackets can cause kramdown warnings, as well
as angle brackets, so they should be removed or put in backticks
---
 .../high_availability/load_balancer.md             | 57 +++++++++++-----------
 .../index.md                                       |  2 +-
 .../monitoring/performance/request_profiling.md    |  2 +-
 doc/install/azure/index.md                         |  2 +-
 4 files changed, 31 insertions(+), 32 deletions(-)

diff --git a/doc/administration/high_availability/load_balancer.md b/doc/administration/high_availability/load_balancer.md
index 9e9f604317a..f11d27487d1 100644
--- a/doc/administration/high_availability/load_balancer.md
+++ b/doc/administration/high_availability/load_balancer.md
@@ -60,11 +60,21 @@ for details on managing SSL certificates and configuring Nginx.
 
 ### Basic ports
 
-| LB Port | Backend Port | Protocol        |
-| ------- | ------------ | --------------- |
-| 80      | 80           | HTTP  [^1]      |
-| 443     | 443          | TCP or HTTPS [^1] [^2] |
-| 22      | 22           | TCP             |
+| LB Port | Backend Port | Protocol                 |
+| ------- | ------------ | ------------------------ |
+| 80      | 80           | HTTP (*1*)               |
+| 443     | 443          | TCP or HTTPS (*1*) (*2*) |
+| 22      | 22           | TCP                      |
+
+- (*1*): [Web terminal](../../ci/environments.md#web-terminals) support requires
+  your load balancer to correctly handle WebSocket connections. When using
+  HTTP or HTTPS proxying, this means your load balancer must be configured
+  to pass through the `Connection` and `Upgrade` hop-by-hop headers. See the
+  [web terminal](../integration/terminal.md) integration guide for
+  more details.
+- (*2*): When using HTTPS protocol for port 443, you will need to add an SSL
+  certificate to the load balancers. If you wish to terminate SSL at the
+  GitLab application server instead, use TCP protocol.
 
 ### GitLab Pages Ports
 
@@ -72,12 +82,19 @@ If you're using GitLab Pages with custom domain support you will need some
 additional port configurations.
 GitLab Pages requires a separate virtual IP address. Configure DNS to point the
 `pages_external_url` from `/etc/gitlab/gitlab.rb` at the new virtual IP address. See the
-[GitLab Pages documentation][gitlab-pages] for more information.
+[GitLab Pages documentation](../pages/index.md) for more information.
 
-| LB Port | Backend Port | Protocol |
-| ------- | ------------ | -------- |
-| 80      | Varies [^3]  | HTTP     |
-| 443     | Varies [^3]  | TCP [^4] |
+| LB Port | Backend Port  | Protocol  |
+| ------- | ------------- | --------- |
+| 80      | Varies (*1*)  | HTTP      |
+| 443     | Varies (*1*)  | TCP (*2*) |
+
+- (*1*): The backend port for GitLab Pages depends on the
+  `gitlab_pages['external_http']` and `gitlab_pages['external_https']`
+  setting. See [GitLab Pages documentation](../pages/index.md) for more details.
+- (*2*): Port 443 for GitLab Pages should always use the TCP protocol. Users can
+  configure custom domains with custom SSL, which would not be possible
+  if SSL was terminated at the load balancer.
 
 ### Alternate SSH Port
 
@@ -86,7 +103,7 @@ it may be helpful to configure an alternate SSH hostname that allows users
 to use SSH on port 443. An alternate SSH hostname will require a new virtual IP address
 compared to the other GitLab HTTP configuration above.
 
-Configure DNS for an alternate SSH hostname such as altssh.gitlab.example.com.
+Configure DNS for an alternate SSH hostname such as `altssh.gitlab.example.com`.
 
 | LB Port | Backend Port | Protocol |
 | ------- | ------------ | -------- |
@@ -101,24 +118,6 @@ Read more on high-availability configuration:
 1. [Configure NFS](nfs.md)
 1. [Configure the GitLab application servers](gitlab.md)
 
-[^1]: [Web terminal](../../ci/environments.md#web-terminals) support requires
-      your load balancer to correctly handle WebSocket connections. When using
-      HTTP or HTTPS proxying, this means your load balancer must be configured
-      to pass through the `Connection` and `Upgrade` hop-by-hop headers. See the
-      [web terminal](../integration/terminal.md) integration guide for
-      more details.
-[^2]: When using HTTPS protocol for port 443, you will need to add an SSL
-      certificate to the load balancers. If you wish to terminate SSL at the
-      GitLab application server instead, use TCP protocol.
-[^3]: The backend port for GitLab Pages depends on the
-      `gitlab_pages['external_http']` and `gitlab_pages['external_https']`
-      setting. See [GitLab Pages documentation][gitlab-pages] for more details.
-[^4]: Port 443 for GitLab Pages should always use the TCP protocol. Users can
-      configure custom domains with custom SSL, which would not be possible
-      if SSL was terminated at the load balancer.
-
-[gitlab-pages]: ../pages/index.md
-
 <!-- ## Troubleshooting
 
 Include any troubleshooting steps that you can foresee. If you know beforehand what issues
diff --git a/doc/administration/monitoring/gitlab_instance_administration_project/index.md b/doc/administration/monitoring/gitlab_instance_administration_project/index.md
index 8e33cea6217..d445b68721d 100644
--- a/doc/administration/monitoring/gitlab_instance_administration_project/index.md
+++ b/doc/administration/monitoring/gitlab_instance_administration_project/index.md
@@ -27,7 +27,7 @@ If that's not the case or if you have an external Prometheus instance or an HA s
 you should
 [configure it manually](../../../user/project/integrations/prometheus.md#manual-configuration-of-prometheus).
 
-## Taking action on Prometheus alerts **[ULTIMATE]**
+## Taking action on Prometheus alerts **(ULTIMATE)**
 
 You can [add a webhook](../../../user/project/integrations/prometheus.md#external-prometheus-instances)
 to the Prometheus config in order for GitLab to receive notifications of any alerts.
diff --git a/doc/administration/monitoring/performance/request_profiling.md b/doc/administration/monitoring/performance/request_profiling.md
index 9f671e0db11..c32edb60f9d 100644
--- a/doc/administration/monitoring/performance/request_profiling.md
+++ b/doc/administration/monitoring/performance/request_profiling.md
@@ -5,7 +5,7 @@
 1. Grab the profiling token from **Monitoring > Requests Profiles** admin page
   (highlighted in a blue in the image below).
   ![Profile token](img/request_profiling_token.png)
-1. Pass the header `X-Profile-Token: <token>` and `X-Profile-Mode: <mode>`(where <mode> can be `execution` or `memory`) to the request you want to profile. You can use:
+1. Pass the header `X-Profile-Token: <token>` and `X-Profile-Mode: <mode>`(where `<mode>` can be `execution` or `memory`) to the request you want to profile. You can use:
     - Browser extensions. For example, [ModHeader](https://chrome.google.com/webstore/detail/modheader/idgpnmonknjnojddfkpgkljpfnnfcklj) Chrome extension.
     - `curl`. For example, `curl --header 'X-Profile-Token: <token>' --header 'X-Profile-Mode: <mode>' https://gitlab.example.com/group/project`.
 1. Once request is finished (which will take a little longer than usual), you can
diff --git a/doc/install/azure/index.md b/doc/install/azure/index.md
index 543a222bd25..c5939dc6856 100644
--- a/doc/install/azure/index.md
+++ b/doc/install/azure/index.md
@@ -407,7 +407,7 @@ on any cloud service you choose.
 
 ## Where to next?
 
-Check out our other [Technical Articles](../../articles/index.md) or browse the [GitLab Documentation][GitLab-Docs](../../README.md) to learn more about GitLab.
+Check out our other [Technical Articles](../../articles/index.md) or browse the [GitLab Documentation](../../README.md) to learn more about GitLab.
 
 ### Useful links
 
-- 
cgit v1.2.1


From 07d349092e429707c4d963f323ce38b60ae43499 Mon Sep 17 00:00:00 2001
From: Miguel Rincon <mrincon@gitlab.com>
Date: Fri, 9 Aug 2019 16:53:56 -0500
Subject: This commit adds a new time series component

Adds a time series component for line and area charts.
Displays new charts in the dashboard.

- Use dynamic components for line/area swapping
- Add new line charts to dashboard in 2 panels
---
 .../components/charts/time_series_spec.js          | 321 +++++++++++++++++++++
 1 file changed, 321 insertions(+)
 create mode 100644 spec/frontend/monitoring/components/charts/time_series_spec.js

diff --git a/spec/frontend/monitoring/components/charts/time_series_spec.js b/spec/frontend/monitoring/components/charts/time_series_spec.js
new file mode 100644
index 00000000000..75f7170442e
--- /dev/null
+++ b/spec/frontend/monitoring/components/charts/time_series_spec.js
@@ -0,0 +1,321 @@
+import { shallowMount } from '@vue/test-utils';
+import { createStore } from '~/monitoring/stores';
+import { GlLink } from '@gitlab/ui';
+import { GlAreaChart, GlLineChart, GlChartSeriesLabel } from '@gitlab/ui/dist/charts';
+import { getSvgIconPathContent } from '~/lib/utils/icon_utils';
+import TimeSeries from '~/monitoring/components/charts/time_series.vue';
+import * as types from '~/monitoring/stores/mutation_types';
+import { TEST_HOST } from 'helpers/test_constants';
+import { shallowWrapperContainsSlotText } from '../../../helpers/vue_test_utils_helper';
+import MonitoringMock, { deploymentData } from '../../../../javascripts/monitoring/mock_data';
+
+jest.mock('~/lib/utils/icon_utils');
+
+describe('Time Series component', () => {
+  const mockSha = 'mockSha';
+  const mockWidgets = 'mockWidgets';
+  const mockSvgPathContent = 'mockSvgPathContent';
+  const projectPath = `${TEST_HOST}/path/to/project`;
+  const commitUrl = `${projectPath}/commit/${mockSha}`;
+  let mockGraphData;
+  let timeSeriesChart;
+  let spriteSpy;
+  let store;
+
+  beforeEach(() => {
+    store = createStore();
+    store.commit(`monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`, MonitoringMock.data);
+    store.commit(`monitoringDashboard/${types.RECEIVE_DEPLOYMENTS_DATA_SUCCESS}`, deploymentData);
+    store.dispatch('monitoringDashboard/setFeatureFlags', { exportMetricsToCsvEnabled: true });
+
+    [mockGraphData] = store.state.monitoringDashboard.groups[0].metrics;
+
+    getSvgIconPathContent.mockResolvedValue('mockSvgPathContent');
+
+    window.URL.createObjectURL = jest.fn();
+
+    timeSeriesChart = shallowMount(TimeSeries, {
+      propsData: {
+        graphData: mockGraphData,
+        containerWidth: 0,
+        deploymentData: store.state.monitoringDashboard.deploymentData,
+        projectPath,
+      },
+      slots: {
+        default: mockWidgets,
+      },
+      store,
+    });
+  });
+
+  afterEach(() => {
+    timeSeriesChart.destroy();
+    window.URL.createObjectURL.mockReset();
+  });
+
+  it('renders chart title', () => {
+    expect(timeSeriesChart.find({ ref: 'graphTitle' }).text()).toBe(mockGraphData.title);
+  });
+
+  it('contains graph widgets from slot', () => {
+    expect(timeSeriesChart.find({ ref: 'graphWidgets' }).text()).toBe(mockWidgets);
+  });
+
+  describe('wrapped components', () => {
+    describe('GitLab UI area chart', () => {
+      let glAreaChart;
+      let glLineChart;
+
+      beforeEach(() => {
+        glAreaChart = timeSeriesChart.find(GlAreaChart);
+        glLineChart = timeSeriesChart.find(GlLineChart);
+      });
+
+      it('area chart is present and a Vue instance', () => {
+        expect(glAreaChart.isVueInstance()).toBe(true);
+      });
+
+      it('line chart is not present', () => {
+        expect(glLineChart.exists()).toBe(false);
+      });
+
+      describe('computed', () => {
+        describe('chartData', () => {
+          let chartData;
+
+          beforeEach(() => {
+            ({ chartData } = timeSeriesChart.vm);
+          });
+          it('has area style defined', () => {
+            expect(chartData[0].areaStyle).toBeDefined();
+          });
+        })
+      })
+    })
+
+    describe('GitLab UI line chart', () => {
+      let glLineChart;
+
+      beforeEach(() => {
+        glLineChart = timeSeriesChart.find(GlLineChart);
+      });
+
+      it('is a Vue instance', () => {
+        expect(glLineChart.isVueInstance()).toBe(true);
+      });
+
+      it('receives data properties needed for proper chart render', () => {
+        const props = glLineChart.props();
+
+       expect(props.data).toBe(timeSeriesChart.vm.chartData);
+        expect(props.option).toBe(timeSeriesChart.vm.chartOptions);
+        expect(props.formatTooltipText).toBe(timeSeriesChart.vm.formatTooltipText);
+        expect(props.thresholds).toBe(timeSeriesChart.vm.thresholds);
+      });
+
+      it('recieves a tooltip title', () => {
+        const mockTitle = 'mockTitle';
+        timeSeriesChart.vm.tooltip.title = mockTitle;
+
+        expect(shallowWrapperContainsSlotText(glLineChart, 'tooltipTitle', mockTitle)).toBe(true);
+      });
+
+      describe('when tooltip is showing deployment data', () => {
+        beforeEach(() => {
+          timeSeriesChart.vm.tooltip.isDeployment = true;
+        });
+
+        it('uses deployment title', () => {
+          expect(shallowWrapperContainsSlotText(glLineChart, 'tooltipTitle', 'Deployed')).toBe(
+            true,
+          );
+        });
+
+        it('renders clickable commit sha in tooltip content', () => {
+          timeSeriesChart.vm.tooltip.sha = mockSha;
+          timeSeriesChart.vm.tooltip.commitUrl = commitUrl;
+
+          const commitLink = timeSeriesChart.find(GlLink);
+
+          expect(shallowWrapperContainsSlotText(commitLink, 'default', mockSha)).toBe(true);
+          expect(commitLink.attributes('href')).toEqual(commitUrl);
+        });
+      });
+    });
+  });
+
+  describe('when exportMetricsToCsvEnabled is disabled', () => {
+    beforeEach(() => {
+      store.dispatch('monitoringDashboard/setFeatureFlags', { exportMetricsToCsvEnabled: false });
+    });
+
+    it('does not render the Download CSV button', () => {
+      expect(timeSeriesChart.contains('glbutton-stub')).toBe(false);
+    });
+  });
+
+  describe('methods', () => {
+    describe('formatTooltipText', () => {
+      const mockDate = deploymentData[0].created_at;
+      const generateSeriesData = type => ({
+        seriesData: [
+          {
+            seriesName: timeSeriesChart.vm.chartData[0].name,
+            componentSubType: type,
+            value: [mockDate, 5.55555],
+            seriesIndex: 0,
+          },
+        ],
+        value: mockDate,
+      });
+
+      describe('when series is of line type', () => {
+        beforeEach(() => {
+          timeSeriesChart.vm.formatTooltipText(generateSeriesData('line'));
+        });
+
+        it('formats tooltip title', () => {
+          expect(timeSeriesChart.vm.tooltip.title).toBe('31 May 2017, 9:23PM');
+        });
+
+        it('formats tooltip content', () => {
+          const name = 'Core Usage';
+          const value = '5.556';
+          const seriesLabel = timeSeriesChart.find(GlChartSeriesLabel);
+
+          expect(seriesLabel.vm.color).toBe('');
+          expect(shallowWrapperContainsSlotText(seriesLabel, 'default', name)).toBe(true);
+          expect(timeSeriesChart.vm.tooltip.content).toEqual([{ name, value, color: undefined }]);
+          expect(
+            shallowWrapperContainsSlotText(timeSeriesChart.find(GlAreaChart), 'tooltipContent', value),
+          ).toBe(true);
+        });
+      });
+
+      describe('when series is of scatter type', () => {
+        beforeEach(() => {
+          timeSeriesChart.vm.formatTooltipText(generateSeriesData('scatter'));
+        });
+
+        it('formats tooltip title', () => {
+          expect(timeSeriesChart.vm.tooltip.title).toBe('31 May 2017, 9:23PM');
+        });
+
+        it('formats tooltip sha', () => {
+          expect(timeSeriesChart.vm.tooltip.sha).toBe('f5bcd1d9');
+        });
+      });
+    });
+
+    describe('setSvg', () => {
+      const mockSvgName = 'mockSvgName';
+
+      beforeEach(() => {
+        timeSeriesChart.vm.setSvg(mockSvgName);
+      });
+
+      it('gets svg path content', () => {
+        expect(getSvgIconPathContent).toHaveBeenCalledWith(mockSvgName);
+      });
+
+      it('sets svg path content', done => {
+        timeSeriesChart.vm.$nextTick(() => {
+          expect(timeSeriesChart.vm.svgs[mockSvgName]).toBe(`path://${mockSvgPathContent}`);
+          done();
+        });
+      });
+    });
+
+    describe('onResize', () => {
+      const mockWidth = 233;
+
+      beforeEach(() => {
+        jest.spyOn(Element.prototype, 'getBoundingClientRect').and.callFake(() => ({
+          width: mockWidth,
+        }));
+        timeSeriesChart.vm.onResize();
+      });
+
+      it('sets time series chart width', () => {
+        expect(timeSeriesChart.vm.width).toBe(mockWidth);
+      });
+    });
+  });
+
+  describe('computed', () => {
+    describe('chartData', () => {
+      let chartData;
+      const seriesData = () => chartData[0];
+
+      beforeEach(() => {
+        ({ chartData } = timeSeriesChart.vm);
+      });
+
+      it('utilizes all data points', () => {
+        expect(chartData.length).toBe(1);
+        expect(seriesData().data.length).toBe(297);
+      });
+
+      it('creates valid data', () => {
+        const { data } = seriesData();
+
+        expect(
+          data.filter(([time, value]) => new Date(time).getTime() > 0 && typeof value === 'number')
+            .length,
+        ).toBe(data.length);
+      });
+
+      it('formats line width correctly', () => {
+        expect(chartData[0].lineStyle.width).toBe(2);
+      });
+    });
+
+    describe('chartOptions', () => {
+      describe('yAxis formatter', () => {
+        let format;
+
+        beforeEach(() => {
+          format = timeSeriesChart.vm.chartOptions.yAxis.axisLabel.formatter;
+        });
+
+        it('rounds to 3 decimal places', () => {
+          expect(format(0.88888)).toBe('0.889');
+        });
+      });
+    });
+
+    describe('scatterSeries', () => {
+      it('utilizes deployment data', () => {
+        expect(timeSeriesChart.vm.scatterSeries.data).toEqual([
+          ['2017-05-31T21:23:37.881Z', 0],
+          ['2017-05-30T20:08:04.629Z', 0],
+          ['2017-05-30T17:42:38.409Z', 0],
+        ]);
+      });
+    });
+
+    describe('yAxisLabel', () => {
+      it('constructs a label for the chart y-axis', () => {
+        expect(timeSeriesChart.vm.yAxisLabel).toBe('CPU');
+      });
+    });
+
+    describe('csvText', () => {
+      it('converts data from json to csv', () => {
+        const header = `timestamp,${mockGraphData.y_label}`;
+        const data = mockGraphData.queries[0].result[0].values;
+        const firstRow = `${data[0][0]},${data[0][1]}`;
+
+        expect(timeSeriesChart.vm.csvText).toMatch(`^${header}\r\n${firstRow}`);
+      });
+    });
+
+    describe('downloadLink', () => {
+      it('produces a link to download metrics as csv', () => {
+        const link = timeSeriesChart.vm.downloadLink;
+
+        expect(link).toContain('blob:');
+      });
+    });
+  });
+});
-- 
cgit v1.2.1


From 38775a7f31db23fae3c39cb3f56c387de6e7c216 Mon Sep 17 00:00:00 2001
From: Miguel Rincon <mrincon@gitlab.com>
Date: Tue, 13 Aug 2019 17:30:46 -0500
Subject: Add karma test for time_series.vue

New spec file for time_series.vue written using karma. New spec
extends the spec from area.vue
---
 .../components/charts/time_series_spec.js          | 321 ---------------------
 1 file changed, 321 deletions(-)
 delete mode 100644 spec/frontend/monitoring/components/charts/time_series_spec.js

diff --git a/spec/frontend/monitoring/components/charts/time_series_spec.js b/spec/frontend/monitoring/components/charts/time_series_spec.js
deleted file mode 100644
index 75f7170442e..00000000000
--- a/spec/frontend/monitoring/components/charts/time_series_spec.js
+++ /dev/null
@@ -1,321 +0,0 @@
-import { shallowMount } from '@vue/test-utils';
-import { createStore } from '~/monitoring/stores';
-import { GlLink } from '@gitlab/ui';
-import { GlAreaChart, GlLineChart, GlChartSeriesLabel } from '@gitlab/ui/dist/charts';
-import { getSvgIconPathContent } from '~/lib/utils/icon_utils';
-import TimeSeries from '~/monitoring/components/charts/time_series.vue';
-import * as types from '~/monitoring/stores/mutation_types';
-import { TEST_HOST } from 'helpers/test_constants';
-import { shallowWrapperContainsSlotText } from '../../../helpers/vue_test_utils_helper';
-import MonitoringMock, { deploymentData } from '../../../../javascripts/monitoring/mock_data';
-
-jest.mock('~/lib/utils/icon_utils');
-
-describe('Time Series component', () => {
-  const mockSha = 'mockSha';
-  const mockWidgets = 'mockWidgets';
-  const mockSvgPathContent = 'mockSvgPathContent';
-  const projectPath = `${TEST_HOST}/path/to/project`;
-  const commitUrl = `${projectPath}/commit/${mockSha}`;
-  let mockGraphData;
-  let timeSeriesChart;
-  let spriteSpy;
-  let store;
-
-  beforeEach(() => {
-    store = createStore();
-    store.commit(`monitoringDashboard/${types.RECEIVE_METRICS_DATA_SUCCESS}`, MonitoringMock.data);
-    store.commit(`monitoringDashboard/${types.RECEIVE_DEPLOYMENTS_DATA_SUCCESS}`, deploymentData);
-    store.dispatch('monitoringDashboard/setFeatureFlags', { exportMetricsToCsvEnabled: true });
-
-    [mockGraphData] = store.state.monitoringDashboard.groups[0].metrics;
-
-    getSvgIconPathContent.mockResolvedValue('mockSvgPathContent');
-
-    window.URL.createObjectURL = jest.fn();
-
-    timeSeriesChart = shallowMount(TimeSeries, {
-      propsData: {
-        graphData: mockGraphData,
-        containerWidth: 0,
-        deploymentData: store.state.monitoringDashboard.deploymentData,
-        projectPath,
-      },
-      slots: {
-        default: mockWidgets,
-      },
-      store,
-    });
-  });
-
-  afterEach(() => {
-    timeSeriesChart.destroy();
-    window.URL.createObjectURL.mockReset();
-  });
-
-  it('renders chart title', () => {
-    expect(timeSeriesChart.find({ ref: 'graphTitle' }).text()).toBe(mockGraphData.title);
-  });
-
-  it('contains graph widgets from slot', () => {
-    expect(timeSeriesChart.find({ ref: 'graphWidgets' }).text()).toBe(mockWidgets);
-  });
-
-  describe('wrapped components', () => {
-    describe('GitLab UI area chart', () => {
-      let glAreaChart;
-      let glLineChart;
-
-      beforeEach(() => {
-        glAreaChart = timeSeriesChart.find(GlAreaChart);
-        glLineChart = timeSeriesChart.find(GlLineChart);
-      });
-
-      it('area chart is present and a Vue instance', () => {
-        expect(glAreaChart.isVueInstance()).toBe(true);
-      });
-
-      it('line chart is not present', () => {
-        expect(glLineChart.exists()).toBe(false);
-      });
-
-      describe('computed', () => {
-        describe('chartData', () => {
-          let chartData;
-
-          beforeEach(() => {
-            ({ chartData } = timeSeriesChart.vm);
-          });
-          it('has area style defined', () => {
-            expect(chartData[0].areaStyle).toBeDefined();
-          });
-        })
-      })
-    })
-
-    describe('GitLab UI line chart', () => {
-      let glLineChart;
-
-      beforeEach(() => {
-        glLineChart = timeSeriesChart.find(GlLineChart);
-      });
-
-      it('is a Vue instance', () => {
-        expect(glLineChart.isVueInstance()).toBe(true);
-      });
-
-      it('receives data properties needed for proper chart render', () => {
-        const props = glLineChart.props();
-
-       expect(props.data).toBe(timeSeriesChart.vm.chartData);
-        expect(props.option).toBe(timeSeriesChart.vm.chartOptions);
-        expect(props.formatTooltipText).toBe(timeSeriesChart.vm.formatTooltipText);
-        expect(props.thresholds).toBe(timeSeriesChart.vm.thresholds);
-      });
-
-      it('recieves a tooltip title', () => {
-        const mockTitle = 'mockTitle';
-        timeSeriesChart.vm.tooltip.title = mockTitle;
-
-        expect(shallowWrapperContainsSlotText(glLineChart, 'tooltipTitle', mockTitle)).toBe(true);
-      });
-
-      describe('when tooltip is showing deployment data', () => {
-        beforeEach(() => {
-          timeSeriesChart.vm.tooltip.isDeployment = true;
-        });
-
-        it('uses deployment title', () => {
-          expect(shallowWrapperContainsSlotText(glLineChart, 'tooltipTitle', 'Deployed')).toBe(
-            true,
-          );
-        });
-
-        it('renders clickable commit sha in tooltip content', () => {
-          timeSeriesChart.vm.tooltip.sha = mockSha;
-          timeSeriesChart.vm.tooltip.commitUrl = commitUrl;
-
-          const commitLink = timeSeriesChart.find(GlLink);
-
-          expect(shallowWrapperContainsSlotText(commitLink, 'default', mockSha)).toBe(true);
-          expect(commitLink.attributes('href')).toEqual(commitUrl);
-        });
-      });
-    });
-  });
-
-  describe('when exportMetricsToCsvEnabled is disabled', () => {
-    beforeEach(() => {
-      store.dispatch('monitoringDashboard/setFeatureFlags', { exportMetricsToCsvEnabled: false });
-    });
-
-    it('does not render the Download CSV button', () => {
-      expect(timeSeriesChart.contains('glbutton-stub')).toBe(false);
-    });
-  });
-
-  describe('methods', () => {
-    describe('formatTooltipText', () => {
-      const mockDate = deploymentData[0].created_at;
-      const generateSeriesData = type => ({
-        seriesData: [
-          {
-            seriesName: timeSeriesChart.vm.chartData[0].name,
-            componentSubType: type,
-            value: [mockDate, 5.55555],
-            seriesIndex: 0,
-          },
-        ],
-        value: mockDate,
-      });
-
-      describe('when series is of line type', () => {
-        beforeEach(() => {
-          timeSeriesChart.vm.formatTooltipText(generateSeriesData('line'));
-        });
-
-        it('formats tooltip title', () => {
-          expect(timeSeriesChart.vm.tooltip.title).toBe('31 May 2017, 9:23PM');
-        });
-
-        it('formats tooltip content', () => {
-          const name = 'Core Usage';
-          const value = '5.556';
-          const seriesLabel = timeSeriesChart.find(GlChartSeriesLabel);
-
-          expect(seriesLabel.vm.color).toBe('');
-          expect(shallowWrapperContainsSlotText(seriesLabel, 'default', name)).toBe(true);
-          expect(timeSeriesChart.vm.tooltip.content).toEqual([{ name, value, color: undefined }]);
-          expect(
-            shallowWrapperContainsSlotText(timeSeriesChart.find(GlAreaChart), 'tooltipContent', value),
-          ).toBe(true);
-        });
-      });
-
-      describe('when series is of scatter type', () => {
-        beforeEach(() => {
-          timeSeriesChart.vm.formatTooltipText(generateSeriesData('scatter'));
-        });
-
-        it('formats tooltip title', () => {
-          expect(timeSeriesChart.vm.tooltip.title).toBe('31 May 2017, 9:23PM');
-        });
-
-        it('formats tooltip sha', () => {
-          expect(timeSeriesChart.vm.tooltip.sha).toBe('f5bcd1d9');
-        });
-      });
-    });
-
-    describe('setSvg', () => {
-      const mockSvgName = 'mockSvgName';
-
-      beforeEach(() => {
-        timeSeriesChart.vm.setSvg(mockSvgName);
-      });
-
-      it('gets svg path content', () => {
-        expect(getSvgIconPathContent).toHaveBeenCalledWith(mockSvgName);
-      });
-
-      it('sets svg path content', done => {
-        timeSeriesChart.vm.$nextTick(() => {
-          expect(timeSeriesChart.vm.svgs[mockSvgName]).toBe(`path://${mockSvgPathContent}`);
-          done();
-        });
-      });
-    });
-
-    describe('onResize', () => {
-      const mockWidth = 233;
-
-      beforeEach(() => {
-        jest.spyOn(Element.prototype, 'getBoundingClientRect').and.callFake(() => ({
-          width: mockWidth,
-        }));
-        timeSeriesChart.vm.onResize();
-      });
-
-      it('sets time series chart width', () => {
-        expect(timeSeriesChart.vm.width).toBe(mockWidth);
-      });
-    });
-  });
-
-  describe('computed', () => {
-    describe('chartData', () => {
-      let chartData;
-      const seriesData = () => chartData[0];
-
-      beforeEach(() => {
-        ({ chartData } = timeSeriesChart.vm);
-      });
-
-      it('utilizes all data points', () => {
-        expect(chartData.length).toBe(1);
-        expect(seriesData().data.length).toBe(297);
-      });
-
-      it('creates valid data', () => {
-        const { data } = seriesData();
-
-        expect(
-          data.filter(([time, value]) => new Date(time).getTime() > 0 && typeof value === 'number')
-            .length,
-        ).toBe(data.length);
-      });
-
-      it('formats line width correctly', () => {
-        expect(chartData[0].lineStyle.width).toBe(2);
-      });
-    });
-
-    describe('chartOptions', () => {
-      describe('yAxis formatter', () => {
-        let format;
-
-        beforeEach(() => {
-          format = timeSeriesChart.vm.chartOptions.yAxis.axisLabel.formatter;
-        });
-
-        it('rounds to 3 decimal places', () => {
-          expect(format(0.88888)).toBe('0.889');
-        });
-      });
-    });
-
-    describe('scatterSeries', () => {
-      it('utilizes deployment data', () => {
-        expect(timeSeriesChart.vm.scatterSeries.data).toEqual([
-          ['2017-05-31T21:23:37.881Z', 0],
-          ['2017-05-30T20:08:04.629Z', 0],
-          ['2017-05-30T17:42:38.409Z', 0],
-        ]);
-      });
-    });
-
-    describe('yAxisLabel', () => {
-      it('constructs a label for the chart y-axis', () => {
-        expect(timeSeriesChart.vm.yAxisLabel).toBe('CPU');
-      });
-    });
-
-    describe('csvText', () => {
-      it('converts data from json to csv', () => {
-        const header = `timestamp,${mockGraphData.y_label}`;
-        const data = mockGraphData.queries[0].result[0].values;
-        const firstRow = `${data[0][0]},${data[0][1]}`;
-
-        expect(timeSeriesChart.vm.csvText).toMatch(`^${header}\r\n${firstRow}`);
-      });
-    });
-
-    describe('downloadLink', () => {
-      it('produces a link to download metrics as csv', () => {
-        const link = timeSeriesChart.vm.downloadLink;
-
-        expect(link).toContain('blob:');
-      });
-    });
-  });
-});
-- 
cgit v1.2.1


From 2c9c1e6dbf6b63711a98e338807578fec2c29967 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Wed, 21 Aug 2019 07:28:55 -0700
Subject: Remove links to issues to make docs lint happy

---
 doc/development/elasticsearch.md | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/doc/development/elasticsearch.md b/doc/development/elasticsearch.md
index 5d48968b5dc..090e5235619 100644
--- a/doc/development/elasticsearch.md
+++ b/doc/development/elasticsearch.md
@@ -186,12 +186,7 @@ The global configurations per version are now in the `Elastic::(Version)::Config
 
 ### Creating new version of schema
 
-NOTE: **Note:** this is not applicable yet as multiple indices functionality is not fully implemented. See the
-the following issues for more details:
-
-* https://gitlab.com/gitlab-org/gitlab-ee/issues/12548
-* https://gitlab.com/gitlab-org/gitlab-ee/issues/12555
-* https://gitlab.com/gitlab-org/gitlab-ee/issues/13533
+NOTE: **Note:** this is not applicable yet as multiple indices functionality is not fully implemented.
 
 Folders like `ee/lib/elastic/v12p1` contain snapshots of search logic from different versions. To keep a continuous git history, the latest version lives under `ee/lib/elastic/latest`, but its classes are aliased under an actual version (e.g. `ee/lib/elastic/v12p3`). When referencing these classes, never use the `Latest` namespace directly, but use the actual version (e.g. `V12p3`).
 
-- 
cgit v1.2.1


From 9cbb1b10935ce036316279ff056e817f215c9baa Mon Sep 17 00:00:00 2001
From: Miguel Rincon <mrincon@gitlab.com>
Date: Fri, 16 Aug 2019 17:30:05 -0500
Subject: Replace the area with time series where used

- Replace in panel_type.vue
- Replace in embed.vue
- Port changes to support embed in 2 cols in large screens
- Update specs
---
 .../javascripts/monitoring/components/charts/time_series.vue   | 10 +++++++++-
 app/assets/javascripts/monitoring/components/embed.vue         |  6 +++---
 app/assets/javascripts/monitoring/components/panel_type.vue    |  8 ++++----
 spec/frontend/monitoring/embed/embed_spec.js                   |  8 ++++----
 spec/javascripts/monitoring/panel_type_spec.js                 |  7 ++++---
 5 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/app/assets/javascripts/monitoring/components/charts/time_series.vue b/app/assets/javascripts/monitoring/components/charts/time_series.vue
index 2fdc75f63ca..02e7a7ba0a6 100644
--- a/app/assets/javascripts/monitoring/components/charts/time_series.vue
+++ b/app/assets/javascripts/monitoring/components/charts/time_series.vue
@@ -48,6 +48,11 @@ export default {
       required: false,
       default: false,
     },
+    singleEmbed: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
     thresholds: {
       type: Array,
       required: false,
@@ -267,7 +272,10 @@ export default {
 </script>
 
 <template>
-  <div class="prometheus-graph col-12 col-lg-6" :class="[showBorder ? 'p-2' : 'p-0']">
+  <div
+    class="prometheus-graph col-12"
+    :class="[showBorder ? 'p-2' : 'p-0', { 'col-lg-6': !singleEmbed }]"
+  >
     <div :class="{ 'prometheus-graph-embed w-100 p-3': showBorder }">
       <div class="prometheus-graph-header">
         <h5 class="prometheus-graph-title js-graph-title">{{ graphData.title }}</h5>
diff --git a/app/assets/javascripts/monitoring/components/embed.vue b/app/assets/javascripts/monitoring/components/embed.vue
index e3256147618..b516a82c170 100644
--- a/app/assets/javascripts/monitoring/components/embed.vue
+++ b/app/assets/javascripts/monitoring/components/embed.vue
@@ -2,7 +2,7 @@
 import { mapActions, mapState } from 'vuex';
 import { getParameterValues, removeParams } from '~/lib/utils/url_utility';
 import GraphGroup from './graph_group.vue';
-import MonitorAreaChart from './charts/area.vue';
+import MonitorTimeSeriesChart from './charts/time_series.vue';
 import { sidebarAnimationDuration } from '../constants';
 import { getTimeDiff } from '../utils';
 
@@ -11,7 +11,7 @@ let sidebarMutationObserver;
 export default {
   components: {
     GraphGroup,
-    MonitorAreaChart,
+    MonitorTimeSeriesChart,
   },
   props: {
     dashboardUrl: {
@@ -92,7 +92,7 @@ export default {
 <template>
   <div class="metrics-embed" :class="{ 'd-inline-flex col-lg-6 p-0': isSingleChart }">
     <div v-if="charts.length" class="row w-100 m-n2 pb-4">
-      <monitor-area-chart
+      <monitor-time-series-chart
         v-for="graphData in charts"
         :key="graphData.title"
         :graph-data="graphData"
diff --git a/app/assets/javascripts/monitoring/components/panel_type.vue b/app/assets/javascripts/monitoring/components/panel_type.vue
index 96f62bc85ee..73ff651d510 100644
--- a/app/assets/javascripts/monitoring/components/panel_type.vue
+++ b/app/assets/javascripts/monitoring/components/panel_type.vue
@@ -10,14 +10,14 @@ import {
   GlTooltipDirective,
 } from '@gitlab/ui';
 import Icon from '~/vue_shared/components/icon.vue';
-import MonitorAreaChart from './charts/area.vue';
+import MonitorTimeSeriesChart from './charts/time_series.vue';
 import MonitorSingleStatChart from './charts/single_stat.vue';
 import MonitorEmptyChart from './charts/empty_chart.vue';
 
 export default {
   components: {
-    MonitorAreaChart,
     MonitorSingleStatChart,
+    MonitorTimeSeriesChart,
     MonitorEmptyChart,
     Icon,
     GlDropdown,
@@ -92,7 +92,7 @@ export default {
     v-if="isPanelType('single-stat') && graphDataHasMetrics"
     :graph-data="graphData"
   />
-  <monitor-area-chart
+  <monitor-time-series-chart
     v-else-if="graphDataHasMetrics"
     :graph-data="graphData"
     :deployment-data="deploymentData"
@@ -136,6 +136,6 @@ export default {
         </gl-dropdown-item>
       </gl-dropdown>
     </div>
-  </monitor-area-chart>
+  </monitor-time-series-chart>
   <monitor-empty-chart v-else :graph-title="graphData.title" />
 </template>
diff --git a/spec/frontend/monitoring/embed/embed_spec.js b/spec/frontend/monitoring/embed/embed_spec.js
index 3b18a0f77c7..1ce14e2418a 100644
--- a/spec/frontend/monitoring/embed/embed_spec.js
+++ b/spec/frontend/monitoring/embed/embed_spec.js
@@ -1,7 +1,7 @@
 import { createLocalVue, shallowMount } from '@vue/test-utils';
 import Vuex from 'vuex';
 import Embed from '~/monitoring/components/embed.vue';
-import MonitorAreaChart from '~/monitoring/components/charts/area.vue';
+import MonitorTimeSeriesChart from '~/monitoring/components/charts/time_series.vue';
 import { TEST_HOST } from 'helpers/test_constants';
 import { groups, initialState, metricsData, metricsWithData } from './mock_data';
 
@@ -55,7 +55,7 @@ describe('Embed', () => {
 
     it('shows an empty state when no metrics are present', () => {
       expect(wrapper.find('.metrics-embed').exists()).toBe(true);
-      expect(wrapper.find(MonitorAreaChart).exists()).toBe(false);
+      expect(wrapper.find(MonitorTimeSeriesChart).exists()).toBe(false);
     });
   });
 
@@ -71,8 +71,8 @@ describe('Embed', () => {
     it('shows a chart when metrics are present', () => {
       wrapper.setProps({});
       expect(wrapper.find('.metrics-embed').exists()).toBe(true);
-      expect(wrapper.find(MonitorAreaChart).exists()).toBe(true);
-      expect(wrapper.findAll(MonitorAreaChart).length).toBe(2);
+      expect(wrapper.find(MonitorTimeSeriesChart).exists()).toBe(true);
+      expect(wrapper.findAll(MonitorTimeSeriesChart).length).toBe(2);
     });
   });
 });
diff --git a/spec/javascripts/monitoring/panel_type_spec.js b/spec/javascripts/monitoring/panel_type_spec.js
index 086be628093..a2366e74d43 100644
--- a/spec/javascripts/monitoring/panel_type_spec.js
+++ b/spec/javascripts/monitoring/panel_type_spec.js
@@ -1,7 +1,7 @@
 import { shallowMount } from '@vue/test-utils';
 import PanelType from '~/monitoring/components/panel_type.vue';
 import EmptyChart from '~/monitoring/components/charts/empty_chart.vue';
-import AreaChart from '~/monitoring/components/charts/area.vue';
+import TimeSeriesChart from '~/monitoring/components/charts/time_series.vue';
 import { graphDataPrometheusQueryRange } from './mock_data';
 import { createStore } from '~/monitoring/stores';
 
@@ -62,9 +62,10 @@ describe('Panel Type component', () => {
       });
     });
 
-    describe('Area Chart panel type', () => {
+    describe('Time Series Chart panel type', () => {
       it('is rendered', () => {
-        expect(panelType.find(AreaChart).exists()).toBe(true);
+        expect(panelType.find(TimeSeriesChart).isVueInstance()).toBe(true);
+        expect(panelType.find(TimeSeriesChart).exists()).toBe(true);
       });
 
       it('sets clipboard text on the dropdown', () => {
-- 
cgit v1.2.1


From 2e9c4e9156b1906c36ec72f49ff26779d5654a19 Mon Sep 17 00:00:00 2001
From: Miguel Rincon <mrincon@gitlab.com>
Date: Wed, 21 Aug 2019 09:34:53 -0500
Subject: Add changelog entry

---
 ...73-use-time-series-chart-instead-of-area-chart-in-panel_types.yml | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 changelogs/unreleased/66073-use-time-series-chart-instead-of-area-chart-in-panel_types.yml

diff --git a/changelogs/unreleased/66073-use-time-series-chart-instead-of-area-chart-in-panel_types.yml b/changelogs/unreleased/66073-use-time-series-chart-instead-of-area-chart-in-panel_types.yml
new file mode 100644
index 00000000000..8d7af96a7d8
--- /dev/null
+++ b/changelogs/unreleased/66073-use-time-series-chart-instead-of-area-chart-in-panel_types.yml
@@ -0,0 +1,5 @@
+---
+title: Enable line charts in dashbaord panels and embedded charts
+merge_request: 31920
+author:
+type: added
-- 
cgit v1.2.1


From b7e6c898c7449eb48744b7312dbfa6baa92a00d6 Mon Sep 17 00:00:00 2001
From: Ezekiel Kigbo <ekigbo@gitlab.com>
Date: Wed, 21 Aug 2019 14:47:04 +0000
Subject: Resolve "HTML code shown in merge request"

- Fixes double escaped text in `mr_widget_rebase.vue`
---
 .../components/states/mr_widget_rebase.vue             |  1 +
 .../32032-html-code-shown-in-merge-request.yml         |  5 +++++
 .../vue_mr_widget/components/mr_widget_rebase_spec.js  | 18 ++++++++++++++++++
 3 files changed, 24 insertions(+)
 create mode 100644 changelogs/unreleased/32032-html-code-shown-in-merge-request.yml

diff --git a/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_rebase.vue b/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_rebase.vue
index c7b064b8506..339e154affc 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_rebase.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_rebase.vue
@@ -50,6 +50,7 @@ export default {
           startTag: '<span class="label-branch">',
           endTag: '</span>',
         },
+        false,
       );
     },
   },
diff --git a/changelogs/unreleased/32032-html-code-shown-in-merge-request.yml b/changelogs/unreleased/32032-html-code-shown-in-merge-request.yml
new file mode 100644
index 00000000000..ffd58067784
--- /dev/null
+++ b/changelogs/unreleased/32032-html-code-shown-in-merge-request.yml
@@ -0,0 +1,5 @@
+---
+title: Fix HTML rendering for fast-forward rebases in merge request widget
+merge_request: 32032
+author:
+type: fixed
diff --git a/spec/javascripts/vue_mr_widget/components/mr_widget_rebase_spec.js b/spec/javascripts/vue_mr_widget/components/mr_widget_rebase_spec.js
index 212519743aa..7216ad00cc1 100644
--- a/spec/javascripts/vue_mr_widget/components/mr_widget_rebase_spec.js
+++ b/spec/javascripts/vue_mr_widget/components/mr_widget_rebase_spec.js
@@ -83,6 +83,24 @@ describe('Merge request widget rebase component', () => {
       expect(text).toContain('foo');
       expect(text.replace(/\s\s+/g, ' ')).toContain('to allow this merge request to be merged.');
     });
+
+    it('should render the correct target branch name', () => {
+      const targetBranch = 'fake-branch-to-test-with';
+      vm = mountComponent(Component, {
+        mr: {
+          rebaseInProgress: false,
+          canPushToSourceBranch: false,
+          targetBranch,
+        },
+        service: {},
+      });
+
+      const elem = vm.$el.querySelector('.rebase-state-find-class-convention span');
+
+      expect(elem.innerHTML).toContain(
+        `Fast-forward merge is not possible. Rebase the source branch onto <span class="label-branch">${targetBranch}</span> to allow this merge request to be merged.`,
+      );
+    });
   });
 
   describe('methods', () => {
-- 
cgit v1.2.1


From 4daf3dc0dba8be985ee7d7e3e331e0468d5a72ad Mon Sep 17 00:00:00 2001
From: Oswaldo Ferreira <oswaldo@gitlab.com>
Date: Tue, 20 Aug 2019 17:36:57 -0300
Subject: Avoid exposing unaccessible repo data upon GFM processing

When post-processing relative links to absolute links
RelativeLinkFilter didn't take into consideration that
internal repository data could be exposed for users
that do not have repository access to the project.

This commit solves that by checking whether the user
can `download_code` at this repository, avoiding any
processing of this filter if the user can't.

Additionally, if we're processing for a group (
no project was given), we check if the user can
read it in order to expand the href as an extra.
That doesn't seem necessarily a breach now,
but an extra check doesn't hurt as after all
the user needs to be able to `read_group`.
---
 .../unreleased/security-exposed-default-branch.yml |  5 ++
 lib/banzai/filter/relative_link_filter.rb          | 16 +++++
 spec/helpers/markup_helper_spec.rb                 |  6 ++
 .../lib/banzai/filter/relative_link_filter_spec.rb | 72 +++++++++++++++++++++-
 4 files changed, 97 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/security-exposed-default-branch.yml

diff --git a/changelogs/unreleased/security-exposed-default-branch.yml b/changelogs/unreleased/security-exposed-default-branch.yml
new file mode 100644
index 00000000000..bf32617ee8a
--- /dev/null
+++ b/changelogs/unreleased/security-exposed-default-branch.yml
@@ -0,0 +1,5 @@
+---
+title: Avoid exposing unaccessible repo data upon GFM post processing
+merge_request:
+author:
+type: security
diff --git a/lib/banzai/filter/relative_link_filter.rb b/lib/banzai/filter/relative_link_filter.rb
index 86f18679496..846a7d46aad 100644
--- a/lib/banzai/filter/relative_link_filter.rb
+++ b/lib/banzai/filter/relative_link_filter.rb
@@ -9,6 +9,7 @@ module Banzai
     # Context options:
     #   :commit
     #   :group
+    #   :current_user
     #   :project
     #   :project_wiki
     #   :ref
@@ -18,6 +19,7 @@ module Banzai
 
       def call
         return doc if context[:system_note]
+        return doc unless visible_to_user?
 
         @uri_types = {}
         clear_memoization(:linkable_files)
@@ -166,6 +168,16 @@ module Banzai
         Gitlab.config.gitlab.relative_url_root.presence || '/'
       end
 
+      def visible_to_user?
+        if project
+          Ability.allowed?(current_user, :download_code, project)
+        elsif group
+          Ability.allowed?(current_user, :read_group, group)
+        else # Objects detached from projects or groups, e.g. Personal Snippets.
+          true
+        end
+      end
+
       def ref
         context[:ref] || project.default_branch
       end
@@ -178,6 +190,10 @@ module Banzai
         context[:project]
       end
 
+      def current_user
+        context[:current_user]
+      end
+
       def repository
         @repository ||= project&.repository
       end
diff --git a/spec/helpers/markup_helper_spec.rb b/spec/helpers/markup_helper_spec.rb
index f6e1720e113..1757ec8fa4d 100644
--- a/spec/helpers/markup_helper_spec.rb
+++ b/spec/helpers/markup_helper_spec.rb
@@ -65,6 +65,9 @@ describe MarkupHelper do
 
       describe 'inside a group' do
         before do
+          # Ensure the generated reference links aren't redacted
+          group.add_maintainer(user)
+
           helper.instance_variable_set(:@group, group)
           helper.instance_variable_set(:@project, nil)
         end
@@ -78,6 +81,9 @@ describe MarkupHelper do
         let(:project_in_group) { create(:project, group: group) }
 
         before do
+          # Ensure the generated reference links aren't redacted
+          project_in_group.add_maintainer(user)
+
           helper.instance_variable_set(:@group, group)
           helper.instance_variable_set(:@project, project_in_group)
         end
diff --git a/spec/lib/banzai/filter/relative_link_filter_spec.rb b/spec/lib/banzai/filter/relative_link_filter_spec.rb
index ecb83b6cb66..789530fbc56 100644
--- a/spec/lib/banzai/filter/relative_link_filter_spec.rb
+++ b/spec/lib/banzai/filter/relative_link_filter_spec.rb
@@ -7,6 +7,7 @@ describe Banzai::Filter::RelativeLinkFilter do
     contexts.reverse_merge!({
       commit:         commit,
       project:        project,
+      current_user:   user,
       group:          group,
       project_wiki:   project_wiki,
       ref:            ref,
@@ -33,7 +34,8 @@ describe Banzai::Filter::RelativeLinkFilter do
     %(<div>#{element}</div>)
   end
 
-  let(:project)        { create(:project, :repository) }
+  let(:project)        { create(:project, :repository, :public) }
+  let(:user)           { create(:user) }
   let(:group)          { nil }
   let(:project_path)   { project.full_path }
   let(:ref)            { 'markdown' }
@@ -75,6 +77,11 @@ describe Banzai::Filter::RelativeLinkFilter do
     include_examples :preserve_unchanged
   end
 
+  context 'without project repository access' do
+    let(:project) { create(:project, :repository, repository_access_level: ProjectFeature::PRIVATE) }
+    include_examples :preserve_unchanged
+  end
+
   it 'does not raise an exception on invalid URIs' do
     act = link("://foo")
     expect { filter(act) }.not_to raise_error
@@ -282,6 +289,37 @@ describe Banzai::Filter::RelativeLinkFilter do
     let(:relative_path) { "/#{project.full_path}#{upload_path}" }
 
     context 'to a project upload' do
+      context 'without project repository access' do
+        let(:project) { create(:project, :repository, repository_access_level: ProjectFeature::PRIVATE) }
+
+        it 'does not rebuild relative URL for a link' do
+          doc = filter(link(upload_path))
+          expect(doc.at_css('a')['href']).to eq(upload_path)
+
+          doc = filter(nested(link(upload_path)))
+          expect(doc.at_css('a')['href']).to eq(upload_path)
+        end
+
+        it 'does not rebuild relative URL for an image' do
+          doc = filter(image(upload_path))
+          expect(doc.at_css('img')['src']).to eq(upload_path)
+
+          doc = filter(nested(image(upload_path)))
+          expect(doc.at_css('img')['src']).to eq(upload_path)
+        end
+
+        context 'with an absolute URL' do
+          let(:absolute_path) { Gitlab.config.gitlab.url + relative_path }
+          let(:only_path) { false }
+
+          it 'does not rewrite the link' do
+            doc = filter(link(upload_path))
+
+            expect(doc.at_css('a')['href']).to eq(upload_path)
+          end
+        end
+      end
+
       context 'with an absolute URL' do
         let(:absolute_path) { Gitlab.config.gitlab.url + relative_path }
         let(:only_path) { false }
@@ -331,11 +369,41 @@ describe Banzai::Filter::RelativeLinkFilter do
     end
 
     context 'to a group upload' do
-      let(:upload_link) { link('/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg') }
+      let(:upload_path) { '/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg' }
+      let(:upload_link) { link(upload_path) }
       let(:group) { create(:group) }
       let(:project) { nil }
       let(:relative_path) { "/groups/#{group.full_path}/-/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg" }
 
+      context 'without group read access' do
+        let(:group) { create(:group, :private) }
+
+        it 'does not rewrite the link' do
+          doc = filter(upload_link)
+
+          expect(doc.at_css('a')['href']).to eq(upload_path)
+        end
+
+        it 'does not rewrite the link for subgroup' do
+          group.update!(parent: create(:group))
+
+          doc = filter(upload_link)
+
+          expect(doc.at_css('a')['href']).to eq(upload_path)
+        end
+
+        context 'with an absolute URL' do
+          let(:absolute_path) { Gitlab.config.gitlab.url + relative_path }
+          let(:only_path) { false }
+
+          it 'does not rewrite the link' do
+            doc = filter(upload_link)
+
+            expect(doc.at_css('a')['href']).to eq(upload_path)
+          end
+        end
+      end
+
       context 'with an absolute URL' do
         let(:absolute_path) { Gitlab.config.gitlab.url + relative_path }
         let(:only_path) { false }
-- 
cgit v1.2.1


From 5146279041219a7f64b25d7e0c646a7a11c9d725 Mon Sep 17 00:00:00 2001
From: Stefan Schmalzhaf <stefanschmalzhaf@gmx.de>
Date: Wed, 21 Aug 2019 15:32:50 +0000
Subject: Docs: Add Sailfish app to 2fa

---
 doc/user/profile/account/two_factor_authentication.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/user/profile/account/two_factor_authentication.md b/doc/user/profile/account/two_factor_authentication.md
index e2b1a20a605..f7ba921aa7d 100644
--- a/doc/user/profile/account/two_factor_authentication.md
+++ b/doc/user/profile/account/two_factor_authentication.md
@@ -48,6 +48,7 @@ To enable 2FA:
       - [andOTP](https://github.com/andOTP/andOTP): feature rich open source app for Android which supports PGP encrypted backups.
       - [FreeOTP](https://freeotp.github.io/): open source app for Android.
       - [Google Authenticator](https://support.google.com/accounts/answer/1066447?hl=en): proprietary app for iOS and Android.
+      - [SailOTP](https://openrepos.net/content/seiichiro0185/sailotp): open source app for SailFish OS.
    1. In the application, add a new entry in one of two ways:
       - Scan the code presented in GitLab with your device's camera to add the
         entry automatically.
-- 
cgit v1.2.1


From 8987e78b7794383ed6c089979b6d3aa1af1380fe Mon Sep 17 00:00:00 2001
From: Jeremy Watson <jwatson@gitlab.com>
Date: Wed, 21 Aug 2019 17:46:57 +0000
Subject: Documentation MVC for group managed accounts

---
 doc/user/group/saml_sso/index.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/doc/user/group/saml_sso/index.md b/doc/user/group/saml_sso/index.md
index e3f657af564..bd50367681e 100644
--- a/doc/user/group/saml_sso/index.md
+++ b/doc/user/group/saml_sso/index.md
@@ -39,6 +39,25 @@ However, users will not be prompted to log via SSO on each visit. GitLab will ch
 
 We intend to add a similar SSO requirement for [Git and API activity](https://gitlab.com/gitlab-org/gitlab-ee/issues/9152) in the future.
 
+#### Group-managed accounts
+
+[Introduced in GitLab 12.1](https://gitlab.com/groups/gitlab-org/-/epics/709).
+
+When SSO is being enforced, groups can enable an additional level of protection by enforcing the creation of dedicated user accounts to access the group.
+
+Without group-managed accounts, users can link their SAML identity with any existing user on the instance. With group-managed accounts enabled, users are required to create a new, dedicated user linked to the group. The notification email address associated with the user is locked to the email address received from the configured identity provider.
+
+When this option is enabled:
+
+- All existing and new users in the group will be required to log in via the SSO URL associated with the group.
+- On successfully authenticating, GitLab will prompt the user to create a new, dedicated account using the email address received from the configured identity provider.
+- After the group managed account has been created, group activity will require the use of this user account.
+
+Since use of the group managed account requires the use of SSO, users of group managed accounts will lose access to these accounts when they are no longer able to authenticate with the connected identity provider. In the case of an offboarded employee who has been removed from your identity provider:
+
+- The user will be unable to access the group (their credentials will no longer work on the identity provider when prompted to SSO).
+- Contributions in the group (e.g. issues, merge requests) will remain intact.
+
 ### NameID
 
 GitLab.com uses the SAML NameID to identify users. The NameID element:
-- 
cgit v1.2.1


From bc04fad727fdecc11b5f1f14bd10b84bb969fdf3 Mon Sep 17 00:00:00 2001
From: Felipe Artur <felipefac@gmail.com>
Date: Wed, 21 Aug 2019 14:57:30 -0300
Subject: Upgrade Gitaly to v1.60.0

---
 GITALY_SERVER_VERSION                                              | 2 +-
 changelogs/unreleased/uncomment_commit_signatures_feature_flag.yml | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/uncomment_commit_signatures_feature_flag.yml

diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index bb120e876c6..4d5fde5bd16 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-1.59.0
+1.60.0
diff --git a/changelogs/unreleased/uncomment_commit_signatures_feature_flag.yml b/changelogs/unreleased/uncomment_commit_signatures_feature_flag.yml
new file mode 100644
index 00000000000..8f6c89e7dd3
--- /dev/null
+++ b/changelogs/unreleased/uncomment_commit_signatures_feature_flag.yml
@@ -0,0 +1,5 @@
+---
+title: Upgrade to Gitaly 1.60.0
+merge_request: 31981
+author:
+type: changed
-- 
cgit v1.2.1


From d0e53f1aca212e36a741fc8870579a39054c1b7a Mon Sep 17 00:00:00 2001
From: Winnie Hellmann <winnie@gitlab.com>
Date: Wed, 21 Aug 2019 18:20:08 +0000
Subject: Make sure that each Jest test contains an assertion

---
 spec/frontend/test_setup.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/spec/frontend/test_setup.js b/spec/frontend/test_setup.js
index df8a625319b..d52aeb1fe6b 100644
--- a/spec/frontend/test_setup.js
+++ b/spec/frontend/test_setup.js
@@ -93,3 +93,9 @@ Object.assign(global, {
     clearTimeout(id);
   },
 });
+
+// make sure that each test actually tests something
+// see https://jestjs.io/docs/en/expect#expecthasassertions
+beforeEach(() => {
+  expect.hasAssertions();
+});
-- 
cgit v1.2.1


From 65b20f35dc2b9a52d3bac5e234f124b7b3e466a3 Mon Sep 17 00:00:00 2001
From: Marius Bobin <mbobin@gitlab.com>
Date: Wed, 21 Aug 2019 18:48:16 +0000
Subject: Ensure CI matching operator receives an object

Ensure the evaluation of right-hand side expression always
results in the returning of an object or an empty String
---
 ...riables-causes-gitlabs-ci-lint-to-throw-500.yml |  5 ++++
 .../ci/pipeline/expression/lexeme/matches.rb       |  3 ++-
 .../ci/pipeline/expression/lexeme/not_matches.rb   |  3 ++-
 .../ci/pipeline/expression/lexeme/matches_spec.rb  | 28 ++++++++++++++++++++++
 .../pipeline/expression/lexeme/not_matches_spec.rb | 28 ++++++++++++++++++++++
 5 files changed, 65 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/64383-pattern-matching-with-variables-causes-gitlabs-ci-lint-to-throw-500.yml

diff --git a/changelogs/unreleased/64383-pattern-matching-with-variables-causes-gitlabs-ci-lint-to-throw-500.yml b/changelogs/unreleased/64383-pattern-matching-with-variables-causes-gitlabs-ci-lint-to-throw-500.yml
new file mode 100644
index 00000000000..ba4bd614170
--- /dev/null
+++ b/changelogs/unreleased/64383-pattern-matching-with-variables-causes-gitlabs-ci-lint-to-throw-500.yml
@@ -0,0 +1,5 @@
+---
+title: Fix 500 errors caused by pattern matching with variables in CI Lint
+merge_request: 31719
+author:
+type: fixed
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb b/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
index 942e4e55323..f7b0720d4a9 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
@@ -11,8 +11,9 @@ module Gitlab
             def evaluate(variables = {})
               text = @left.evaluate(variables)
               regexp = @right.evaluate(variables)
+              return false unless regexp
 
-              regexp.scan(text.to_s).any?
+              regexp.scan(text.to_s).present?
             end
 
             def self.build(_value, behind, ahead)
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb b/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb
index 831c27fa0ea..02479ed28a4 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb
@@ -11,8 +11,9 @@ module Gitlab
             def evaluate(variables = {})
               text = @left.evaluate(variables)
               regexp = @right.evaluate(variables)
+              return true unless regexp
 
-              regexp.scan(text.to_s).none?
+              regexp.scan(text.to_s).empty?
             end
 
             def self.build(_value, behind, ahead)
diff --git a/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb b/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb
index 4e4f1bf6ad3..a527783ffac 100644
--- a/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb
@@ -69,6 +69,34 @@ describe Gitlab::Ci::Pipeline::Expression::Lexeme::Matches do
       it { is_expected.to eq(false) }
     end
 
+    context 'when right is nil' do
+      let(:left_value)  { 'my-awesome-string' }
+      let(:right_value) { nil }
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'when left and right are nil' do
+      let(:left_value)  { nil }
+      let(:right_value) { nil }
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'when left is an empty string' do
+      let(:left_value)  { '' }
+      let(:right_value) { Gitlab::UntrustedRegexp.new('pattern') }
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'when left and right are empty strings' do
+      let(:left_value)  { '' }
+      let(:right_value) { Gitlab::UntrustedRegexp.new('') }
+
+      it { is_expected.to eq(true) }
+    end
+
     context 'when left is a multiline string and matches right' do
       let(:left_value) do
         <<~TEXT
diff --git a/spec/lib/gitlab/ci/pipeline/expression/lexeme/not_matches_spec.rb b/spec/lib/gitlab/ci/pipeline/expression/lexeme/not_matches_spec.rb
index 6b81008ffb1..fb4238ecaf3 100644
--- a/spec/lib/gitlab/ci/pipeline/expression/lexeme/not_matches_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/expression/lexeme/not_matches_spec.rb
@@ -69,6 +69,34 @@ describe Gitlab::Ci::Pipeline::Expression::Lexeme::NotMatches do
       it { is_expected.to eq(true) }
     end
 
+    context 'when right is nil' do
+      let(:left_value)  { 'my-awesome-string' }
+      let(:right_value) { nil }
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'when left and right are nil' do
+      let(:left_value)  { nil }
+      let(:right_value) { nil }
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'when left is an empty string' do
+      let(:left_value)  { '' }
+      let(:right_value) { Gitlab::UntrustedRegexp.new('pattern') }
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'when left and right are empty strings' do
+      let(:left_value)  { '' }
+      let(:right_value) { Gitlab::UntrustedRegexp.new('') }
+
+      it { is_expected.to eq(false) }
+    end
+
     context 'when left is a multiline string and matches right' do
       let(:left_value) do
         <<~TEXT
-- 
cgit v1.2.1


From 646913f4e2c141327bacaf8ee20279c120fdeedf Mon Sep 17 00:00:00 2001
From: Nick Kipling <nkipling@gitlab.com>
Date: Wed, 21 Aug 2019 18:55:42 +0000
Subject: Fixed tech debt of using custom component

Changed the container registry to use the empty state component
Removed the custom svg-component
---
 app/assets/javascripts/registry/components/app.vue | 101 +++++++++++----------
 .../registry/components/svg_message.vue            |  26 ------
 .../stylesheets/pages/container_registry.scss      |   4 -
 spec/javascripts/registry/components/app_spec.js   |  11 +--
 4 files changed, 56 insertions(+), 86 deletions(-)
 delete mode 100644 app/assets/javascripts/registry/components/svg_message.vue

diff --git a/app/assets/javascripts/registry/components/app.vue b/app/assets/javascripts/registry/components/app.vue
index efbf0a4e3cf..346dc470a59 100644
--- a/app/assets/javascripts/registry/components/app.vue
+++ b/app/assets/javascripts/registry/components/app.vue
@@ -1,10 +1,9 @@
 <script>
 import { mapGetters, mapActions } from 'vuex';
-import { GlLoadingIcon } from '@gitlab/ui';
+import { GlLoadingIcon, GlEmptyState } from '@gitlab/ui';
 import store from '../stores';
 import clipboardButton from '../../vue_shared/components/clipboard_button.vue';
 import CollapsibleContainer from './collapsible_container.vue';
-import SvgMessage from './svg_message.vue';
 import { s__, sprintf } from '../../locale';
 
 export default {
@@ -12,8 +11,8 @@ export default {
   components: {
     clipboardButton,
     CollapsibleContainer,
+    GlEmptyState,
     GlLoadingIcon,
-    SvgMessage,
   },
   props: {
     endpoint: {
@@ -93,7 +92,9 @@ export default {
     this.setMainEndpoint(this.endpoint);
   },
   mounted() {
-    this.fetchRepos();
+    if (!this.characterError) {
+      this.fetchRepos();
+    }
   },
   methods: {
     ...mapActions(['setMainEndpoint', 'fetchRepos']),
@@ -102,61 +103,63 @@ export default {
 </script>
 <template>
   <div>
-    <svg-message v-if="characterError" id="invalid-characters" :svg-path="containersErrorImage">
-      <h4>
-        {{ s__('ContainerRegistry|Docker connection error') }}
-      </h4>
-      <p v-html="dockerConnectionErrorText"></p>
-    </svg-message>
+    <gl-empty-state
+      v-if="characterError"
+      :title="s__('ContainerRegistry|Docker connection error')"
+      :svg-path="containersErrorImage"
+    >
+      <template #description>
+        <p v-html="dockerConnectionErrorText"></p>
+      </template>
+    </gl-empty-state>
 
-    <gl-loading-icon v-else-if="isLoading && !characterError" size="md" class="prepend-top-16" />
+    <gl-loading-icon v-else-if="isLoading" size="md" class="prepend-top-16" />
 
-    <div v-else-if="!isLoading && !characterError && repos.length">
+    <div v-else-if="!isLoading && repos.length">
       <h4>{{ s__('ContainerRegistry|Container Registry') }}</h4>
       <p v-html="introText"></p>
       <collapsible-container v-for="item in repos" :key="item.id" :repo="item" />
     </div>
 
-    <svg-message
-      v-else-if="!isLoading && !characterError && !repos.length"
-      id="no-container-images"
+    <gl-empty-state
+      v-else
+      :title="s__('ContainerRegistry|There are no container images stored for this project')"
       :svg-path="noContainersImage"
+      class="container-message"
     >
-      <h4>
-        {{ s__('ContainerRegistry|There are no container images stored for this project') }}
-      </h4>
-      <p v-html="noContainerImagesText"></p>
-
-      <h5>{{ s__('ContainerRegistry|Quick Start') }}</h5>
-      <p>
-        {{
-          s__(
-            'ContainerRegistry|You can add an image to this registry with the following commands:',
-          )
-        }}
-      </p>
+      <template #description>
+        <p class="js-no-container-images-text" v-html="noContainerImagesText"></p>
+        <h5>{{ s__('ContainerRegistry|Quick Start') }}</h5>
+        <p>
+          {{
+            s__(
+              'ContainerRegistry|You can add an image to this registry with the following commands:',
+            )
+          }}
+        </p>
 
-      <div class="input-group append-bottom-10">
-        <input :value="dockerBuildCommand" type="text" class="form-control monospace" readonly />
-        <span class="input-group-append">
-          <clipboard-button
-            :text="dockerBuildCommand"
-            :title="s__('ContainerRegistry|Copy build command to clipboard')"
-            class="input-group-text"
-          />
-        </span>
-      </div>
+        <div class="input-group append-bottom-10">
+          <input :value="dockerBuildCommand" type="text" class="form-control monospace" readonly />
+          <span class="input-group-append">
+            <clipboard-button
+              :text="dockerBuildCommand"
+              :title="s__('ContainerRegistry|Copy build command to clipboard')"
+              class="input-group-text"
+            />
+          </span>
+        </div>
 
-      <div class="input-group">
-        <input :value="dockerPushCommand" type="text" class="form-control monospace" readonly />
-        <span class="input-group-append">
-          <clipboard-button
-            :text="dockerPushCommand"
-            :title="s__('ContainerRegistry|Copy push command to clipboard')"
-            class="input-group-text"
-          />
-        </span>
-      </div>
-    </svg-message>
+        <div class="input-group">
+          <input :value="dockerPushCommand" type="text" class="form-control monospace" readonly />
+          <span class="input-group-append">
+            <clipboard-button
+              :text="dockerPushCommand"
+              :title="s__('ContainerRegistry|Copy push command to clipboard')"
+              class="input-group-text"
+            />
+          </span>
+        </div>
+      </template>
+    </gl-empty-state>
   </div>
 </template>
diff --git a/app/assets/javascripts/registry/components/svg_message.vue b/app/assets/javascripts/registry/components/svg_message.vue
deleted file mode 100644
index 617093e054e..00000000000
--- a/app/assets/javascripts/registry/components/svg_message.vue
+++ /dev/null
@@ -1,26 +0,0 @@
-<script>
-export default {
-  name: 'RegistrySvgMessage',
-  props: {
-    id: {
-      type: String,
-      required: true,
-    },
-    svgPath: {
-      type: String,
-      required: true,
-    },
-  },
-};
-</script>
-
-<template>
-  <div :id="id" class="empty-state container-message">
-    <div class="svg-content">
-      <img :src="svgPath" class="flex-align-self-center" />
-    </div>
-    <div class="text-content">
-      <slot></slot>
-    </div>
-  </div>
-</template>
diff --git a/app/assets/stylesheets/pages/container_registry.scss b/app/assets/stylesheets/pages/container_registry.scss
index 0f4bdb219a3..b88bd78cf3d 100644
--- a/app/assets/stylesheets/pages/container_registry.scss
+++ b/app/assets/stylesheets/pages/container_registry.scss
@@ -3,10 +3,6 @@
  */
 
 .container-message {
-  pre {
-    white-space: pre-line;
-  }
-
   span .btn {
     margin: 0;
   }
diff --git a/spec/javascripts/registry/components/app_spec.js b/spec/javascripts/registry/components/app_spec.js
index e7675669f7a..5ea3f85a247 100644
--- a/spec/javascripts/registry/components/app_spec.js
+++ b/spec/javascripts/registry/components/app_spec.js
@@ -84,12 +84,7 @@ describe('Registry List', () => {
 
     it('should render empty message', done => {
       setTimeout(() => {
-        expect(
-          vm.$el
-            .querySelector('p')
-            .textContent.trim()
-            .replace(/[\r\n]+/g, ' '),
-        ).toEqual(
+        expect(vm.$el.querySelector('.js-no-container-images-text').textContent).toEqual(
           'With the Container Registry, every project can have its own space to store its Docker images. More Information',
         );
         done();
@@ -124,7 +119,9 @@ describe('Registry List', () => {
 
     it('should render invalid characters error message', done => {
       setTimeout(() => {
-        expect(vm.$el.querySelector('.container-message')).not.toBe(null);
+        expect(vm.$el.querySelector('p')).not.toContain(
+          'We are having trouble connecting to Docker, which could be due to an issue with your project name or path. More information',
+        );
         done();
       });
     });
-- 
cgit v1.2.1


From 293ef17e7352fa33ce70cae8233b5a415f326596 Mon Sep 17 00:00:00 2001
From: Donald Cook <dcook@gitlab.com>
Date: Wed, 21 Aug 2019 19:12:11 +0000
Subject: Backport: Issue sidebar tracking

Added snowplow event tracking to Edit buttons
---
 app/assets/javascripts/event_tracking/issue_sidebar.js     |  2 ++
 app/assets/javascripts/issue_show/index.js                 |  4 ++++
 .../sidebar/components/assignees/assignee_title.vue        | 13 ++++++++++++-
 .../components/confidential/confidential_issue_sidebar.vue |  8 +++++++-
 .../sidebar/components/lock/lock_issue_sidebar.vue         |  7 ++++++-
 .../sidebar/components/subscriptions/subscriptions.vue     |  3 +++
 app/helpers/issuables_helper.rb                            |  6 +++++-
 app/views/shared/issuable/_sidebar.html.haml               |  8 ++++----
 spec/javascripts/sidebar/assignee_title_spec.js            | 14 ++++++++++++++
 .../javascripts/sidebar/confidential_issue_sidebar_spec.js |  8 ++++++++
 spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js   |  8 ++++++++
 spec/javascripts/sidebar/subscriptions_spec.js             |  9 +++++++++
 12 files changed, 82 insertions(+), 8 deletions(-)
 create mode 100644 app/assets/javascripts/event_tracking/issue_sidebar.js

diff --git a/app/assets/javascripts/event_tracking/issue_sidebar.js b/app/assets/javascripts/event_tracking/issue_sidebar.js
new file mode 100644
index 00000000000..6909f82c66f
--- /dev/null
+++ b/app/assets/javascripts/event_tracking/issue_sidebar.js
@@ -0,0 +1,2 @@
+export const initSidebarTracking = () => {};
+export const trackEvent = () => {};
diff --git a/app/assets/javascripts/issue_show/index.js b/app/assets/javascripts/issue_show/index.js
index 529b6386221..5a9dd91817e 100644
--- a/app/assets/javascripts/issue_show/index.js
+++ b/app/assets/javascripts/issue_show/index.js
@@ -1,4 +1,5 @@
 import Vue from 'vue';
+import { initSidebarTracking } from 'ee_else_ce/event_tracking/issue_sidebar';
 import issuableApp from './components/app.vue';
 import { parseIssuableData } from './utils/parse_data';
 import '../vue_shared/vue_resource_interceptor';
@@ -9,6 +10,9 @@ export default function initIssueableApp() {
     components: {
       issuableApp,
     },
+    mounted() {
+      initSidebarTracking();
+    },
     render(createElement) {
       return createElement('issuable-app', {
         props: parseIssuableData(),
diff --git a/app/assets/javascripts/sidebar/components/assignees/assignee_title.vue b/app/assets/javascripts/sidebar/components/assignees/assignee_title.vue
index fa6b6bfaef1..63b93a80ead 100644
--- a/app/assets/javascripts/sidebar/components/assignees/assignee_title.vue
+++ b/app/assets/javascripts/sidebar/components/assignees/assignee_title.vue
@@ -1,5 +1,6 @@
 <script>
 import { n__ } from '~/locale';
+import { trackEvent } from 'ee_else_ce/event_tracking/issue_sidebar';
 
 export default {
   name: 'AssigneeTitle',
@@ -29,13 +30,23 @@ export default {
       return n__('Assignee', `%d Assignees`, assignees);
     },
   },
+  methods: {
+    trackEdit() {
+      trackEvent('click_edit_button', 'assignee');
+    },
+  },
 };
 </script>
 <template>
   <div class="title hide-collapsed">
     {{ assigneeTitle }}
     <i v-if="loading" aria-hidden="true" class="fa fa-spinner fa-spin block-loading"></i>
-    <a v-if="editable" class="js-sidebar-dropdown-toggle edit-link float-right" href="#">
+    <a
+      v-if="editable"
+      class="js-sidebar-dropdown-toggle edit-link float-right"
+      href="#"
+      @click.prevent="trackEdit"
+    >
       {{ __('Edit') }}
     </a>
     <a
diff --git a/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue b/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue
index 597b723a9d9..1c75b6148e8 100644
--- a/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue
+++ b/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue
@@ -5,6 +5,7 @@ import tooltip from '~/vue_shared/directives/tooltip';
 import Icon from '~/vue_shared/components/icon.vue';
 import eventHub from '~/sidebar/event_hub';
 import editForm from './edit_form.vue';
+import { trackEvent } from 'ee_else_ce/event_tracking/issue_sidebar';
 
 export default {
   components: {
@@ -51,6 +52,11 @@ export default {
     toggleForm() {
       this.edit = !this.edit;
     },
+    onEditClick() {
+      this.toggleForm();
+
+      trackEvent('click_edit_button', 'confidentiality');
+    },
     updateConfidentialAttribute(confidential) {
       this.service
         .update('issue', { confidential })
@@ -82,7 +88,7 @@ export default {
         v-if="isEditable"
         class="float-right confidential-edit"
         href="#"
-        @click.prevent="toggleForm"
+        @click.prevent="onEditClick"
       >
         {{ __('Edit') }}
       </a>
diff --git a/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
index c5cfa92f3c8..ec2a7b93a98 100644
--- a/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
+++ b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
@@ -6,6 +6,7 @@ import issuableMixin from '~/vue_shared/mixins/issuable';
 import Icon from '~/vue_shared/components/icon.vue';
 import eventHub from '~/sidebar/event_hub';
 import editForm from './edit_form.vue';
+import { trackEvent } from 'ee_else_ce/event_tracking/issue_sidebar';
 
 export default {
   components: {
@@ -65,7 +66,11 @@ export default {
     toggleForm() {
       this.mediator.store.isLockDialogOpen = !this.mediator.store.isLockDialogOpen;
     },
+    onEditClick() {
+      this.toggleForm();
 
+      trackEvent('click_edit_button', 'lock_issue');
+    },
     updateLockedAttribute(locked) {
       this.mediator.service
         .update(this.issuableType, {
@@ -109,7 +114,7 @@ export default {
         v-if="isEditable"
         class="float-right lock-edit"
         type="button"
-        @click.prevent="toggleForm"
+        @click.prevent="onEditClick"
       >
         {{ __('Edit') }}
       </button>
diff --git a/app/assets/javascripts/sidebar/components/subscriptions/subscriptions.vue b/app/assets/javascripts/sidebar/components/subscriptions/subscriptions.vue
index 0d1faceef11..1f5f19d1931 100644
--- a/app/assets/javascripts/sidebar/components/subscriptions/subscriptions.vue
+++ b/app/assets/javascripts/sidebar/components/subscriptions/subscriptions.vue
@@ -4,6 +4,7 @@ import icon from '~/vue_shared/components/icon.vue';
 import toggleButton from '~/vue_shared/components/toggle_button.vue';
 import tooltip from '~/vue_shared/directives/tooltip';
 import eventHub from '../../event_hub';
+import { trackEvent } from 'ee_else_ce/event_tracking/issue_sidebar';
 
 const ICON_ON = 'notifications';
 const ICON_OFF = 'notifications-off';
@@ -63,6 +64,8 @@ export default {
 
       // Component event emission.
       this.$emit('toggleSubscription', this.id);
+
+      trackEvent('toggle_button', 'notifications', this.subscribed ? 0 : 1);
     },
     onClickCollapsedIcon() {
       this.$emit('toggleSidebar');
diff --git a/app/helpers/issuables_helper.rb b/app/helpers/issuables_helper.rb
index e2e007eee50..b88b25eb845 100644
--- a/app/helpers/issuables_helper.rb
+++ b/app/helpers/issuables_helper.rb
@@ -405,7 +405,11 @@ module IssuablesHelper
       placement: is_collapsed ? 'left' : nil,
       container: is_collapsed ? 'body' : nil,
       boundary: 'viewport',
-      is_collapsed: is_collapsed
+      is_collapsed: is_collapsed,
+      track_label: "right_sidebar",
+      track_property: "update_todo",
+      track_event: "click_button",
+      track_value: ""
     }
   end
 
diff --git a/app/views/shared/issuable/_sidebar.html.haml b/app/views/shared/issuable/_sidebar.html.haml
index 825088a58e7..aea09bf8d4d 100644
--- a/app/views/shared/issuable/_sidebar.html.haml
+++ b/app/views/shared/issuable/_sidebar.html.haml
@@ -38,7 +38,7 @@
           = _('Milestone')
           = icon('spinner spin', class: 'hidden block-loading', 'aria-hidden': 'true')
           - if can_edit_issuable
-            = link_to _('Edit'), '#', class: 'js-sidebar-dropdown-toggle edit-link float-right'
+            = link_to _('Edit'), '#', class: 'js-sidebar-dropdown-toggle edit-link float-right', data: { track_label: "right_sidebar", track_property: "milestone", track_event: "click_edit_button", track_value: "" }
         .value.hide-collapsed
           - if milestone.present?
             = link_to milestone[:title], milestone[:web_url], class: "bold has-tooltip", title: sidebar_milestone_remaining_days(milestone), data: { container: "body", html: 'true', boundary: 'viewport' }
@@ -66,7 +66,7 @@
             = _('Due date')
             = icon('spinner spin', class: 'hidden block-loading', 'aria-hidden': 'true')
             - if can_edit_issuable
-              = link_to _('Edit'), '#', class: 'js-sidebar-dropdown-toggle edit-link float-right'
+              = link_to _('Edit'), '#', class: 'js-sidebar-dropdown-toggle edit-link float-right', data: { track_label: "right_sidebar", track_property: "due_date", track_event: "click_edit_button", track_value: "" }
           .value.hide-collapsed
             %span.value-content
               - if issuable_sidebar[:due_date]
@@ -102,7 +102,7 @@
           = _('Labels')
           = icon('spinner spin', class: 'hidden block-loading', 'aria-hidden': 'true')
           - if can_edit_issuable
-            = link_to _('Edit'), '#', class: 'js-sidebar-dropdown-toggle edit-link qa-edit-link-labels float-right'
+            = link_to _('Edit'), '#', class: 'js-sidebar-dropdown-toggle edit-link qa-edit-link-labels float-right', data: { track_label: "right_sidebar", track_property: "labels", track_event: "click_edit_button", track_value: "" }
         .value.issuable-show-labels.dont-hide.hide-collapsed.qa-labels-block{ class: ("has-labels" if selected_labels.any?) }
           - if selected_labels.any?
             - selected_labels.each do |label_hash|
@@ -160,7 +160,7 @@
             = custom_icon('icon_arrow_right')
           .dropdown.sidebar-move-issue-dropdown.hide-collapsed
             %button.btn.btn-default.btn-block.js-sidebar-dropdown-toggle.js-move-issue{ type: 'button',
-              data: { toggle: 'dropdown', display: 'static' } }
+              data: { toggle: 'dropdown', display: 'static', track_label: "right_sidebar", track_property: "move_issue", track_event: "click_button", track_value: "" } }
               = _('Move issue')
             .dropdown-menu.dropdown-menu-selectable.dropdown-extended-height
               = dropdown_title(_('Move issue'))
diff --git a/spec/javascripts/sidebar/assignee_title_spec.js b/spec/javascripts/sidebar/assignee_title_spec.js
index 509edba2036..7fff7c075d9 100644
--- a/spec/javascripts/sidebar/assignee_title_spec.js
+++ b/spec/javascripts/sidebar/assignee_title_spec.js
@@ -4,8 +4,10 @@ import AssigneeTitle from '~/sidebar/components/assignees/assignee_title.vue';
 describe('AssigneeTitle component', () => {
   let component;
   let AssigneeTitleComponent;
+  let statsSpy;
 
   beforeEach(() => {
+    statsSpy = spyOnDependency(AssigneeTitle, 'trackEvent');
     AssigneeTitleComponent = Vue.extend(AssigneeTitle);
   });
 
@@ -102,4 +104,16 @@ describe('AssigneeTitle component', () => {
 
     expect(component.$el.querySelector('.edit-link')).not.toBeNull();
   });
+
+  it('calls trackEvent when edit is clicked', () => {
+    component = new AssigneeTitleComponent({
+      propsData: {
+        numberOfAssignees: 0,
+        editable: true,
+      },
+    }).$mount();
+    component.$el.querySelector('.js-sidebar-dropdown-toggle').click();
+
+    expect(statsSpy).toHaveBeenCalled();
+  });
 });
diff --git a/spec/javascripts/sidebar/confidential_issue_sidebar_spec.js b/spec/javascripts/sidebar/confidential_issue_sidebar_spec.js
index 486a7241e33..ea9e5677bc5 100644
--- a/spec/javascripts/sidebar/confidential_issue_sidebar_spec.js
+++ b/spec/javascripts/sidebar/confidential_issue_sidebar_spec.js
@@ -4,8 +4,10 @@ import confidentialIssueSidebar from '~/sidebar/components/confidential/confiden
 describe('Confidential Issue Sidebar Block', () => {
   let vm1;
   let vm2;
+  let statsSpy;
 
   beforeEach(() => {
+    statsSpy = spyOnDependency(confidentialIssueSidebar, 'trackEvent');
     const Component = Vue.extend(confidentialIssueSidebar);
     const service = {
       update: () => Promise.resolve(true),
@@ -67,4 +69,10 @@ describe('Confidential Issue Sidebar Block', () => {
       done();
     });
   });
+
+  it('calls trackEvent when "Edit" is clicked', () => {
+    vm1.$el.querySelector('.confidential-edit').click();
+
+    expect(statsSpy).toHaveBeenCalled();
+  });
 });
diff --git a/spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js b/spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js
index ca882032bdf..2d930428230 100644
--- a/spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js
+++ b/spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js
@@ -4,8 +4,10 @@ import lockIssueSidebar from '~/sidebar/components/lock/lock_issue_sidebar.vue';
 describe('LockIssueSidebar', () => {
   let vm1;
   let vm2;
+  let statsSpy;
 
   beforeEach(() => {
+    statsSpy = spyOnDependency(lockIssueSidebar, 'trackEvent');
     const Component = Vue.extend(lockIssueSidebar);
 
     const mediator = {
@@ -59,6 +61,12 @@ describe('LockIssueSidebar', () => {
     });
   });
 
+  it('calls trackEvent when "Edit" is clicked', () => {
+    vm1.$el.querySelector('.lock-edit').click();
+
+    expect(statsSpy).toHaveBeenCalled();
+  });
+
   it('displays the edit form when opened from collapsed state', done => {
     expect(vm1.isLockDialogOpen).toBe(false);
 
diff --git a/spec/javascripts/sidebar/subscriptions_spec.js b/spec/javascripts/sidebar/subscriptions_spec.js
index 32728e58b06..2efa13f3fe8 100644
--- a/spec/javascripts/sidebar/subscriptions_spec.js
+++ b/spec/javascripts/sidebar/subscriptions_spec.js
@@ -6,8 +6,10 @@ import mountComponent from 'spec/helpers/vue_mount_component_helper';
 describe('Subscriptions', function() {
   let vm;
   let Subscriptions;
+  let statsSpy;
 
   beforeEach(() => {
+    statsSpy = spyOnDependency(subscriptions, 'trackEvent');
     Subscriptions = Vue.extend(subscriptions);
   });
 
@@ -58,6 +60,13 @@ describe('Subscriptions', function() {
     expect(vm.$emit).toHaveBeenCalledWith('toggleSubscription', jasmine.any(Object));
   });
 
+  it('calls trackEvent when toggled', () => {
+    vm = mountComponent(Subscriptions, { subscribed: true });
+    vm.toggleSubscription();
+
+    expect(statsSpy).toHaveBeenCalled();
+  });
+
   it('onClickCollapsedIcon method emits `toggleSidebar` event on component', () => {
     vm = mountComponent(Subscriptions, { subscribed: true });
     spyOn(vm, '$emit');
-- 
cgit v1.2.1


From dbd88c02d6d2e4cb8af5347dd8e7b3ae63079a9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kamil=20Trzci=C5=84ski?= <ayufan@ayufan.eu>
Date: Wed, 21 Aug 2019 21:15:03 +0200
Subject: Put cancelled job in DeadSet

This replicates Sidekiq behavior
of pushing dead job into DeadSet.
---
 lib/gitlab/sidekiq_middleware/monitor.rb           |  6 +++++-
 spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb | 10 +++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/lib/gitlab/sidekiq_middleware/monitor.rb b/lib/gitlab/sidekiq_middleware/monitor.rb
index 0d88fe760d3..53a6132edac 100644
--- a/lib/gitlab/sidekiq_middleware/monitor.rb
+++ b/lib/gitlab/sidekiq_middleware/monitor.rb
@@ -8,8 +8,12 @@ module Gitlab
           yield
         end
       rescue Gitlab::SidekiqMonitor::CancelledError
+        # push job to DeadSet
+        payload = ::Sidekiq.dump_json(job)
+        ::Sidekiq::DeadSet.new.kill(payload, notify_failure: false)
+
         # ignore retries
-        raise Sidekiq::JobRetry::Skip
+        raise ::Sidekiq::JobRetry::Skip
       end
     end
   end
diff --git a/spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb b/spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb
index 2933d26a387..7319cdc2399 100644
--- a/spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb
+++ b/spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb
@@ -33,9 +33,17 @@ describe Gitlab::SidekiqMiddleware::Monitor do
         end
       end
 
-      it 'does skip this job' do
+      it 'skips the job' do
         expect { subject }.to raise_error(Sidekiq::JobRetry::Skip)
       end
+
+      it 'puts job in DeadSet' do
+        ::Sidekiq::DeadSet.new.clear
+
+        expect do
+          subject rescue Sidekiq::JobRetry::Skip
+        end.to change { ::Sidekiq::DeadSet.new.size }.by(1)
+      end
     end
   end
 end
-- 
cgit v1.2.1


From ac94033b2db012f6d9e2dcca2bf48f7ac94f38a0 Mon Sep 17 00:00:00 2001
From: Alex Kalderimis <akalderimis@gitlab.com>
Date: Wed, 21 Aug 2019 19:23:27 +0000
Subject: Handle namespaced models

We encountered issues with setting module headers for namespaced models.
These changes address this. We retain the namespacing, but transform the
classnames to make them into safe email headers.
---
 app/mailers/notify.rb       | 15 ++++++++--
 spec/mailers/notify_spec.rb | 67 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 80 insertions(+), 2 deletions(-)

diff --git a/app/mailers/notify.rb b/app/mailers/notify.rb
index 5d292094a05..3683f2ea9a9 100644
--- a/app/mailers/notify.rb
+++ b/app/mailers/notify.rb
@@ -125,9 +125,8 @@ class Notify < BaseMailer
   def mail_thread(model, headers = {})
     add_project_headers
     add_unsubscription_headers_and_links
+    add_model_headers(model)
 
-    headers["X-GitLab-#{model.class.name}-ID"] = model.id
-    headers["X-GitLab-#{model.class.name}-IID"] = model.iid if model.respond_to?(:iid)
     headers['X-GitLab-Reply-Key'] = reply_key
 
     @reason = headers['X-GitLab-NotificationReason']
@@ -196,6 +195,18 @@ class Notify < BaseMailer
     @reply_key ||= SentNotification.reply_key
   end
 
+  # This method applies threading headers to the email to identify
+  # the instance we are discussing.
+  #
+  # All model instances must have `#id`, and may implement `#iid`.
+  def add_model_headers(object)
+    # Use replacement so we don't strip the module.
+    prefix = "X-GitLab-#{object.class.name.gsub(/::/, '-')}"
+
+    headers["#{prefix}-ID"] = object.id
+    headers["#{prefix}-IID"] = object.iid if object.respond_to?(:iid)
+  end
+
   def add_project_headers
     return unless @project
 
diff --git a/spec/mailers/notify_spec.rb b/spec/mailers/notify_spec.rb
index dcc4b70a382..6cba7df114c 100644
--- a/spec/mailers/notify_spec.rb
+++ b/spec/mailers/notify_spec.rb
@@ -543,6 +543,73 @@ describe Notify do
       end
     end
 
+    describe '#mail_thread' do
+      set(:mail_thread_note) { create(:note) }
+
+      let(:headers) do
+        {
+          from: 'someone@test.com',
+          to: 'someone-else@test.com',
+          subject: 'something',
+          template_name: '_note_email' # re-use this for testing
+        }
+      end
+
+      let(:mailer) do
+        mailer = described_class.new
+        mailer.instance_variable_set(:@note, mail_thread_note)
+        mailer
+      end
+
+      context 'the model has no namespace' do
+        class TopLevelThing
+          include Referable
+          include Noteable
+
+          def to_reference(*_args)
+            'tlt-ref'
+          end
+
+          def id
+            'tlt-id'
+          end
+        end
+
+        subject do
+          mailer.send(:mail_thread, TopLevelThing.new, headers)
+        end
+
+        it 'has X-GitLab-Namespaced-Thing-ID header' do
+          expect(subject.header['X-GitLab-TopLevelThing-ID'].value).to eq('tlt-id')
+        end
+      end
+
+      context 'the model has a namespace' do
+        module Namespaced
+          class Thing
+            include Referable
+            include Noteable
+
+            def to_reference(*_args)
+              'some-reference'
+            end
+
+            def id
+              'some-id'
+            end
+          end
+        end
+
+        subject do
+          mailer.send(:mail_thread, Namespaced::Thing.new, headers)
+        end
+
+        it 'has X-GitLab-Namespaced-Thing-ID header' do
+          expect(subject.header['X-GitLab-Namespaced-Thing-ID'].value).to eq('some-id')
+        end
+      end
+    end
+
     context 'for issue notes' do
       let(:host) { Gitlab.config.gitlab.host }
 
-- 
cgit v1.2.1


From 49d8393f286ec92a4198c0407de0c5776f22f981 Mon Sep 17 00:00:00 2001
From: Evan Read <eread@gitlab.com>
Date: Wed, 21 Aug 2019 20:17:04 +0000
Subject: Edit of new Worker section

---
 doc/topics/autodevops/index.md | 31 +++++++++++++++++--------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/doc/topics/autodevops/index.md b/doc/topics/autodevops/index.md
index 4bfcd4aad96..b8ad552accc 100644
--- a/doc/topics/autodevops/index.md
+++ b/doc/topics/autodevops/index.md
@@ -587,29 +587,32 @@ procfile exec` to replicate the environment where your application will run.
 #### Workers
 
 Some web applications need to run extra deployments for "worker processes". For
-example it is common in a Rails application to have a separate worker process
+example, it is common in a Rails application to have a separate worker process
 to run background tasks like sending emails.
 
 The [default Helm chart](https://gitlab.com/gitlab-org/charts/auto-deploy-app)
 used in Auto Deploy [has support for running worker
 processes](https://gitlab.com/gitlab-org/charts/auto-deploy-app/merge_requests/9).
 
-In order to run a worker you'll need to ensure that it is able to respond to
-the standard health checks which expect a successful HTTP response on port
-`5000`. For sidekiq you could make use of the
-[sidekiq_alive gem](https://rubygems.org/gems/sidekiq_alive) to do this. 
+In order to run a worker, you'll need to ensure that it is able to respond to
+the standard health checks, which expect a successful HTTP response on port
+`5000`. For [Sidekiq](https://github.com/mperham/sidekiq), you could make use of
+the [`sidekiq_alive` gem](https://rubygems.org/gems/sidekiq_alive) to do this.
 
-In order to work with sidekiq you'll also need to ensure your deployments have
-access to a redis instance. Auto DevOps won't deploy this for you so you'll
-need to manage this separately and then set a CI variable
-`K8S_SECRET_REDIS_URL` which the URL of this instance to ensure it's passed
-into your deployments.
+In order to work with Sidekiq, you'll also need to ensure your deployments have
+access to a Redis instance. Auto DevOps won't deploy this for you so you'll
+need to:
 
-Once you have configured your worker to respond to health checks you you will
+- Maintain your own Redis instance.
+- Set a CI variable `K8S_SECRET_REDIS_URL`, which the URL of this instance to
+  ensure it's passed into your deployments.
+
+Once you have configured your worker to respond to health checks, you will
 need to configure a CI variable `HELM_UPGRADE_EXTRA_ARGS` with the value
-`--values helm-values.yaml`. Then you can, for example, run a
-[sidekiq](https://github.com/mperham/sidekiq) worker for your rails application
-by adding a file named `helm-values.yaml` to your repo with the following
+`--values helm-values.yaml`.
+
+Then you can, for example, run a Sidekiq worker for your Rails application
+by adding a file named `helm-values.yaml` to your repository with the following
 content:
 
 ```yml
-- 
cgit v1.2.1


From 3e8af110c04a77ca5ca78b82e67574f3706b6683 Mon Sep 17 00:00:00 2001
From: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Date: Wed, 21 Aug 2019 20:36:56 +0000
Subject: Update CHANGELOG.md for 12.2.0

[ci skip]
---
 CHANGELOG.md                                       | 240 +++++++++++++++++++++
 ...0-adjust-copy-for-adding-additional-members.yml |   5 -
 ...ting-group-members-by-a-domain-whitelist-ce.yml |   5 -
 .../11090-export-design-management-lfs-data.yml    |   5 -
 .../12502-add-view-stats-to-cycle-analytics.yml    |   5 -
 ...ge-in-displaying-svg-in-the-same-repository.yml |   5 -
 .../19186-redirect-wiki-git-route-to-wiki.yml      |   5 -
 changelogs/unreleased/20137-starrers.yml           |   5 -
 .../21671-multiple-pipeline-status-api.yml         |   5 -
 ...multi-selection-for-delete-on-registry-page.yml |   5 -
 ...t-to-list-the-docker-images-tags-of-a-group.yml |   6 -
 .../unreleased/30974-issue-search-by-number.yml    |   5 -
 .../31434-make-issue-boards-importable.yml         |   5 -
 ...prove-slack-notification-on-pipeline-status.yml |   5 -
 ...escriptions-to-reflect-registry-permissions.yml |   6 -
 ...39217-remove-kubernetes-service-integration.yml |   5 -
 .../unreleased/43080-speed-up-deploy-keys.yml      |   5 -
 ...ed-the-issue-at-the-same-time-false-warning.yml |   5 -
 changelogs/unreleased/47814-search-view-labels.yml |   5 -
 .../48717-rate-limit-raw-controller-show.yml       |   5 -
 ...ons-to-be-disabled-for-all-users-of-a-group.yml |   5 -
 ...ons-to-be-disabled-for-all-users-of-a-group.yml |   5 -
 changelogs/unreleased/50070-legacy-attachments.yml |   5 -
 ...date-automatically-after-cluster-is-created.yml |   5 -
 ...rate-namespace-per-project-environment-slug.yml |   5 -
 .../55564-remove-if-in-before-after-action.yml     |   5 -
 ...-action-commands-applied-banner-more-useful.yml |   5 -
 changelogs/unreleased/56130-deployment-date.yml    |   5 -
 .../57953-fix-unfolded-diff-suggestions.yml        |   5 -
 changelogs/unreleased/58035-expand-mr-diff.yml     |   5 -
 ...e-message-displayed-on-explore-projects-tab.yml |   5 -
 ...re-not-shown-on-the-performance-dashboard-2.yml |   5 -
 .../59521-job-sidebar-has-a-blank-block.yml        |   5 -
 ...tcut-for-jump-to-next-unresolved-discussion.yml |   5 -
 .../59712-resolve-the-search-problem-issue.yml     |   5 -
 .../unreleased/59829-fix-style-lint-wiki.yml       |   5 -
 ...e-gitaly-calls-when-rendering-commits-in-md.yml |   5 -
 changelogs/unreleased/60516-uninstall-tiller.yml   |   5 -
 ...ernetes-applications-uninstall-cert-manager.yml |   5 -
 ...8-kubernetes-applications-uninstall-knative.yml |   5 -
 .../60948-display-groupid-on-group-admin-page.yml  |   5 -
 ...949-display-projectid-on-project-admin-page.yml |   5 -
 .../61207-adjusted-hoverable-area-in-sidebar.yml   |   5 -
 ...-ide-mr-branch-dropdown-closes-unexpectedly.yml |   5 -
 .../unreleased/61335-fix-file-icon-status.yml      |   5 -
 ...nt-persisting-auto-switch-discussion-filter.yml |   6 -
 ...-fixing-the-U2F-warning-message-text-colour.yml |   5 -
 ...ide-default-options-with-descriptive-labels.yml |   5 -
 ...d-label-state-in-the-merge-request-pipeline.yml |   5 -
 ...ction-elements-in-user-settings-preferences.yml |   5 -
 ...9-test-summary-loading-spinner-is-too-large.yml |   5 -
 ...62971-embed-specific-metrics-chart-in-issue.yml |   5 -
 ...ame-in-shareable-link-for-embedding-metrics.yml |   5 -
 changelogs/unreleased/63181-collapsible-line.yml   |   5 -
 ...2-support-with-gitlab-personal-access-token.yml |   5 -
 ...85-fix-pipeline-emails-to-use-group-setting.yml |   5 -
 ...a-zoom-call-was-added-removed-from-an-issue.yml |   5 -
 ...568-access-email-notifications-custom-email.yml |   5 -
 .../63571-fix-gc-profiler-data-being-wiped.yml     |   5 -
 ...xtra-padding-from-the-disabled-comment-area.yml |   5 -
 .../unreleased/63730-fix-500-status-labels-pd.yml  |   5 -
 .../unreleased/63833-fix-jira-issues-url.yml       |   5 -
 .../63888-snippets-usage-ping-for-create-smau.yml  |   5 -
 ...thenticated_cookie_encryption-configuration.yml |   5 -
 .../64081-override-helm-release-name.yml           |   5 -
 ...es-update-statistics-namespace-feature-flag.yml |   5 -
 .../unreleased/64160-fix-duplicate-buttons.yml     |   5 -
 ...ains-slow-database-query-with-or-conditions.yml |   5 -
 changelogs/unreleased/64190-add-mr-form.yml        |   5 -
 .../64257-active_session_lookup_key_cleanup.yml    |   5 -
 .../unreleased/64257-warden_set_user_fix.yml       |   5 -
 .../unreleased/64265-center-loading-icon.yml       |   5 -
 .../64295-predictable-environment-slugs.yml        |   5 -
 .../64341-user-callout-deferred-link-support.yml   |   5 -
 changelogs/unreleased/64608-double-tooltips.yml    |   5 -
 .../64675-Dashboard-URL-legend-border.yml          |   5 -
 ...box-inside-blockquote-status-won-t-be-saved.yml |   5 -
 ...lor-of-the-visibility-icon-on-project-lists.yml |   5 -
 ...d-menu-is-cramped-with-new-features-enabled.yml |   5 -
 ...etched-in-commit-view-if-no-image-is-loaded.yml |   5 -
 .../unreleased/64763-fix-tags-page-layout.yml      |   5 -
 .../64831-add-padding-to-merged-by-widget.yml      |   5 -
 ...-functionality-in-metrics-dashboard-cards-i.yml |   5 -
 .../64972-fix-unicorn-workers-metric.yml           |   5 -
 ...74-remove-livesum-from-ruby-sampler-metrics.yml |   5 -
 ...ct-message-interpolation-on-project-listing.yml |   5 -
 changelogs/unreleased/65263-manual-action.yml      |   5 -
 .../65278-fix-puma-master-counter-wipe.yml         |   5 -
 .../65483-add-a-resend-confirmation-link.yml       |   5 -
 ...nd-fix-regression-in-shortcuts-helper-modal.yml |   6 -
 .../unreleased/65660-update-karma-to-4-2-0.yml     |   5 -
 .../65671-update-mini_magick-to-4-9-5.yml          |   5 -
 .../65700-document-max-replication-slots-pg-ha.yml |   5 -
 changelogs/unreleased/65705-two-buttons.yml        |   5 -
 changelogs/unreleased/65790-highlight.yml          |   5 -
 .../65803-invalidate-branches-cache-on-refresh.yml |   5 -
 ...08-fix-project-image-in-slack-notifications.yml |   5 -
 ...starrers-count-do-not-match-after-searching.yml |   5 -
 changelogs/unreleased/FixLocaleEN.yml              |   5 -
 changelogs/unreleased/GL-12412.yml                 |   5 -
 changelogs/unreleased/GL-12757.yml                 |   5 -
 .../unreleased/ab-add-index-on-environments.yml    |   5 -
 changelogs/unreleased/ab-count-strategies.yml      |   5 -
 .../unreleased/add-caching-to-archive-endpoint.yml |   5 -
 changelogs/unreleased/add-git-blame-api.yml        |   5 -
 ...bound-requests-whitelist-for-local-networks.yml |   5 -
 .../unreleased/add-release-to-github-importer.yml  |   5 -
 .../add-support-for-start-sha-to-commits-api.yml   |   5 -
 ...roup-level-analytics-to-accept-multiple-ids.yml |   5 -
 ...v-fix-wiki_can_not_be_created_total-counter.yml |   5 -
 .../unreleased/allow-all-users-to-see-history.yml  |   4 -
 changelogs/unreleased/an-sidekiq-chaos.yml         |   5 -
 .../unreleased/an-sidekiq-scheduling_latency.yml   |   5 -
 changelogs/unreleased/bjk-64064_cache_metrics.yml  |   5 -
 changelogs/unreleased/bjk-usage_ping.yml           |   5 -
 .../bring-scoped-environment-variables-to-core.yml |   5 -
 changelogs/unreleased/bump_helm_kubectl_gitlab.yml |   5 -
 .../bvl-mark-remote-mirrors-as-failed-sooner.yml   |   5 -
 .../bvl-remote-mirror-exception-handling.yml       |   6 -
 .../bw-add-index-for-relative-position.yml         |   5 -
 .../unreleased/ce-xanf-add-links-to-admin-area.yml |   5 -
 .../dblessing-fix-admin-user-radio-labels.yml      |   5 -
 ...sing-fix-public-project-ssh-only-ci-failure.yml |   5 -
 changelogs/unreleased/delete-designs-v2.yml        |   4 -
 .../unreleased/dm-process-commit-worker-n-1.yml    |   5 -
 changelogs/unreleased/double-slash-64592.yml       |   5 -
 changelogs/unreleased/enable-specific-embeds.yml   |   5 -
 .../extract_auto_deploy_into_base_image.yml        |   5 -
 .../unreleased/fe-delete-old-boardservice.yml      |   6 -
 .../feat-add-support-page-link-in-help-menu.yml    |   5 -
 ...ature-gb-serverless-app-deployment-template.yml |   5 -
 ...filter-title-description-and-body-from-logs.yml |   5 -
 .../fix-alignment-on-security-reports.yml          |   5 -
 ...x-bin-web-puma-script-to-consider-rails-env.yml |   5 -
 .../unreleased/fix-commits-api-empty-refname.yml   |   5 -
 changelogs/unreleased/fix-job-log-formatting.yml   |   5 -
 ...ix-name-vs-path-problem-for-cycle-analytics.yml |   5 -
 ...void-incresaing-usage-ping-when-not-enabled.yml |   5 -
 .../unreleased/fj-count-web-ide-merge-requests.yml |   5 -
 .../fj-navbar-searches-usage-ping-counter.yml      |   5 -
 ...georgekoltsov-48854-fix-empty-flash-message.yml |   6 -
 ...60-add-filtering-to-bitbucket-server-import.yml |   5 -
 ...koltsov-55474-outbound-setting-system-hooks.yml |   5 -
 .../georgekoltsov-63408-user-mapping.yml           |   5 -
 ...t-visibility-private-if-internal-restricted.yml |   5 -
 ...-64377-add-better-log-msg-to-members-mapper.yml |   6 -
 changelogs/unreleased/gitaly-version-v1.57.0.yml   |   5 -
 changelogs/unreleased/gitaly-version-v1.59.0.yml   |   5 -
 .../group-milestones-dashboard-blunceford.yml      |   5 -
 .../unreleased/id-mr-widget-etag-caching.yml       |   5 -
 changelogs/unreleased/id-source-code-smau.yml      |   5 -
 changelogs/unreleased/implement-dag.yml            |   5 -
 .../unreleased/improve-quick-action-messages.yml   |   5 -
 ...61873-no-error-message-for-general-settings.yml |   5 -
 changelogs/unreleased/issue_58494.yml              |   5 -
 changelogs/unreleased/je-separate-namespace-fe.yml |   5 -
 .../unreleased/jivanvl-add-chart-empty-state.yml   |   5 -
 changelogs/unreleased/jprovazn-fix-positioning.yml |   5 -
 changelogs/unreleased/jprovazn-project-search.yml  |   5 -
 .../jramsay-fix-mirroring-help-text-typo.yml       |   5 -
 changelogs/unreleased/jupyter-fixes-v1.yml         |   5 -
 .../unreleased/khair1-master-patch-79459.yml       |   5 -
 changelogs/unreleased/label-descr-push-opts.yml    |   5 -
 ...wnload-csv-of-charts-from-metrics-dashboard.yml |   5 -
 changelogs/unreleased/load-search-counts-async.yml |   5 -
 .../unreleased/maintainers-can-create-subgroup.yml |   5 -
 .../mc-feature-add-at-colon-variable-masking.yml   |   5 -
 .../unreleased/mc-feature-manual-job-variables.yml |   5 -
 .../new-cycle-analytics-backend-migrations.yml     |   5 -
 changelogs/unreleased/optimize-note-indexes.yml    |   5 -
 .../unreleased/post-migrate-private-profile.yml    |   5 -
 changelogs/unreleased/rails-template-update.yml    |   5 -
 .../remove-line-profile-from-performance-bar.yml   |   5 -
 changelogs/unreleased/remove-peek-gc.yml           |   5 -
 ...oyment_metrics_deployment_platform_fallback.yml |   6 -
 .../unreleased/report-missing-job-dependency.yml   |   6 -
 ...up-overview-security-dashboard-feature-flag.yml |   5 -
 changelogs/unreleased/rm-src-branch.yml            |   5 -
 .../unreleased/safe-archiving-for-traces.yml       |   5 -
 ...73-blocked-user-slash-command-bypass-master.yml |   5 -
 .../unreleased/security-60551-fix-upload-scope.yml |   5 -
 changelogs/unreleased/sh-add-cmaps-for-pdfjs.yml   |   5 -
 .../sh-add-gitaly-and-rugged-data-sidekiq.yml      |   5 -
 changelogs/unreleased/sh-add-index-extern-uid.yml  |   5 -
 .../unreleased/sh-add-missing-csp-report-uri.yml   |   5 -
 changelogs/unreleased/sh-add-rugged-logs.yml       |   5 -
 changelogs/unreleased/sh-add-rugged-to-peek.yml    |   5 -
 .../sh-break-out-invited-group-members.yml         |   5 -
 changelogs/unreleased/sh-disable-redis-peek.yml    |   5 -
 .../unreleased/sh-disable-registry-delete.yml      |   5 -
 changelogs/unreleased/sh-enable-bootsnap.yml       |   5 -
 .../unreleased/sh-fix-discussions-api-perf.yml     |   5 -
 .../sh-fix-import-export-suggestions.yml           |   5 -
 .../sh-fix-pipelines-not-being-created.yml         |   5 -
 .../unreleased/sh-fix-special-role-error-500.yml   |   5 -
 .../sh-ignore-git-errors-delete-project.yml        |   5 -
 changelogs/unreleased/sh-make-githost-json.yml     |   5 -
 .../sh-only-flush-tags-once-per-push.yml           |   5 -
 .../sh-optimize-commit-deltas-post-receive.yml     |   5 -
 .../sh-post-receive-cache-clear-once.yml           |   5 -
 .../unreleased/sh-remove-pdfjs-deprecations.yml    |   5 -
 .../unreleased/sh-rename-githost-to-gitjson.yml    |   5 -
 changelogs/unreleased/sh-support-csp-nonce.yml     |   5 -
 changelogs/unreleased/sh-update-mermaid.yml        |   5 -
 changelogs/unreleased/sh-update-rouge-3-7-0.yml    |   5 -
 changelogs/unreleased/sh-update-rugged-0-28-3.yml  |   5 -
 .../unreleased/sh-use-redis-caching-store.yml      |   5 -
 .../sh-use-shared-state-cluster-pubsub.yml         |   5 -
 changelogs/unreleased/snowplow-ee-to-ce.yml        |   5 -
 changelogs/unreleased/speed-up-labels-api.yml      |   5 -
 changelogs/unreleased/tr-embed-metric-links.yml    |   5 -
 .../unreleased/tr-remove-embed-metrics-flag.yml    |   5 -
 .../update-gitlab-runner-helm-chart-to-0-7-0.yml   |   5 -
 .../unreleased/update-graphicsmagick-to-1-3-33.yml |   5 -
 ...es-expiry-banner-to-an-alert-component-type.yml |   5 -
 .../visual-review-tools-constant-storage-keys.yml  |   5 -
 changelogs/unreleased/wiki-usage-pings.yml         |   5 -
 217 files changed, 240 insertions(+), 1088 deletions(-)
 delete mode 100644 changelogs/unreleased/10-adjust-copy-for-adding-additional-members.yml
 delete mode 100644 changelogs/unreleased/10972-be-allow-restricting-group-members-by-a-domain-whitelist-ce.yml
 delete mode 100644 changelogs/unreleased/11090-export-design-management-lfs-data.yml
 delete mode 100644 changelogs/unreleased/12502-add-view-stats-to-cycle-analytics.yml
 delete mode 100644 changelogs/unreleased/17276-breakage-in-displaying-svg-in-the-same-repository.yml
 delete mode 100644 changelogs/unreleased/19186-redirect-wiki-git-route-to-wiki.yml
 delete mode 100644 changelogs/unreleased/20137-starrers.yml
 delete mode 100644 changelogs/unreleased/21671-multiple-pipeline-status-api.yml
 delete mode 100644 changelogs/unreleased/24705-multi-selection-for-delete-on-registry-page.yml
 delete mode 100644 changelogs/unreleased/26866-api-endpoint-to-list-the-docker-images-tags-of-a-group.yml
 delete mode 100644 changelogs/unreleased/30974-issue-search-by-number.yml
 delete mode 100644 changelogs/unreleased/31434-make-issue-boards-importable.yml
 delete mode 100644 changelogs/unreleased/32495-improve-slack-notification-on-pipeline-status.yml
 delete mode 100644 changelogs/unreleased/34414-update-personal-access-token-scope-descriptions-to-reflect-registry-permissions.yml
 delete mode 100644 changelogs/unreleased/39217-remove-kubernetes-service-integration.yml
 delete mode 100644 changelogs/unreleased/43080-speed-up-deploy-keys.yml
 delete mode 100644 changelogs/unreleased/44036-fix-someone-edited-the-issue-at-the-same-time-false-warning.yml
 delete mode 100644 changelogs/unreleased/47814-search-view-labels.yml
 delete mode 100644 changelogs/unreleased/48717-rate-limit-raw-controller-show.yml
 delete mode 100644 changelogs/unreleased/50020-allow-email-notifications-to-be-disabled-for-all-users-of-a-group.yml
 delete mode 100644 changelogs/unreleased/50020-fe-allow-email-notifications-to-be-disabled-for-all-users-of-a-group.yml
 delete mode 100644 changelogs/unreleased/50070-legacy-attachments.yml
 delete mode 100644 changelogs/unreleased/50130-cluster-cluster-details-update-automatically-after-cluster-is-created.yml
 delete mode 100644 changelogs/unreleased/52494-separate-namespace-per-project-environment-slug.yml
 delete mode 100644 changelogs/unreleased/55564-remove-if-in-before-after-action.yml
 delete mode 100644 changelogs/unreleased/56100-make-quick-action-commands-applied-banner-more-useful.yml
 delete mode 100644 changelogs/unreleased/56130-deployment-date.yml
 delete mode 100644 changelogs/unreleased/57953-fix-unfolded-diff-suggestions.yml
 delete mode 100644 changelogs/unreleased/58035-expand-mr-diff.yml
 delete mode 100644 changelogs/unreleased/58256-incorrect-empty-state-message-displayed-on-explore-projects-tab.yml
 delete mode 100644 changelogs/unreleased/59325-units-are-not-shown-on-the-performance-dashboard-2.yml
 delete mode 100644 changelogs/unreleased/59521-job-sidebar-has-a-blank-block.yml
 delete mode 100644 changelogs/unreleased/59590-keyboard-shortcut-for-jump-to-next-unresolved-discussion.yml
 delete mode 100644 changelogs/unreleased/59712-resolve-the-search-problem-issue.yml
 delete mode 100644 changelogs/unreleased/59829-fix-style-lint-wiki.yml
 delete mode 100644 changelogs/unreleased/60449-reduce-gitaly-calls-when-rendering-commits-in-md.yml
 delete mode 100644 changelogs/unreleased/60516-uninstall-tiller.yml
 delete mode 100644 changelogs/unreleased/60664-kubernetes-applications-uninstall-cert-manager.yml
 delete mode 100644 changelogs/unreleased/60668-kubernetes-applications-uninstall-knative.yml
 delete mode 100644 changelogs/unreleased/60948-display-groupid-on-group-admin-page.yml
 delete mode 100644 changelogs/unreleased/60949-display-projectid-on-project-admin-page.yml
 delete mode 100644 changelogs/unreleased/61207-adjusted-hoverable-area-in-sidebar.yml
 delete mode 100644 changelogs/unreleased/61332-web-ide-mr-branch-dropdown-closes-unexpectedly.yml
 delete mode 100644 changelogs/unreleased/61335-fix-file-icon-status.yml
 delete mode 100644 changelogs/unreleased/61445-prevent-persisting-auto-switch-discussion-filter.yml
 delete mode 100644 changelogs/unreleased/61776-fixing-the-U2F-warning-message-text-colour.yml
 delete mode 100644 changelogs/unreleased/61787-broadcast-messages-colour-selector-provide-default-options-with-descriptive-labels.yml
 delete mode 100644 changelogs/unreleased/62137-add-tooltip-to-improve-clarity-of-detached-label-state-in-the-merge-request-pipeline.yml
 delete mode 100644 changelogs/unreleased/62286-Consistent-selection-elements-in-user-settings-preferences.yml
 delete mode 100644 changelogs/unreleased/62609-test-summary-loading-spinner-is-too-large.yml
 delete mode 100644 changelogs/unreleased/62971-embed-specific-metrics-chart-in-issue.yml
 delete mode 100644 changelogs/unreleased/62973-specify-time-frame-in-shareable-link-for-embedding-metrics.yml
 delete mode 100644 changelogs/unreleased/63181-collapsible-line.yml
 delete mode 100644 changelogs/unreleased/63438-oauth2-support-with-gitlab-personal-access-token.yml
 delete mode 100644 changelogs/unreleased/63485-fix-pipeline-emails-to-use-group-setting.yml
 delete mode 100644 changelogs/unreleased/63547-add-system-notes-for-when-a-zoom-call-was-added-removed-from-an-issue.yml
 delete mode 100644 changelogs/unreleased/63568-access-email-notifications-custom-email.yml
 delete mode 100644 changelogs/unreleased/63571-fix-gc-profiler-data-being-wiped.yml
 delete mode 100644 changelogs/unreleased/63671-remove-extra-padding-from-the-disabled-comment-area.yml
 delete mode 100644 changelogs/unreleased/63730-fix-500-status-labels-pd.yml
 delete mode 100644 changelogs/unreleased/63833-fix-jira-issues-url.yml
 delete mode 100644 changelogs/unreleased/63888-snippets-usage-ping-for-create-smau.yml
 delete mode 100644 changelogs/unreleased/63942-remove-config-action_dispatch-use_authenticated_cookie_encryption-configuration.yml
 delete mode 100644 changelogs/unreleased/64081-override-helm-release-name.yml
 delete mode 100644 changelogs/unreleased/64092-removes-update-statistics-namespace-feature-flag.yml
 delete mode 100644 changelogs/unreleased/64160-fix-duplicate-buttons.yml
 delete mode 100644 changelogs/unreleased/64180-membersfinder-contains-slow-database-query-with-or-conditions.yml
 delete mode 100644 changelogs/unreleased/64190-add-mr-form.yml
 delete mode 100644 changelogs/unreleased/64257-active_session_lookup_key_cleanup.yml
 delete mode 100644 changelogs/unreleased/64257-warden_set_user_fix.yml
 delete mode 100644 changelogs/unreleased/64265-center-loading-icon.yml
 delete mode 100644 changelogs/unreleased/64295-predictable-environment-slugs.yml
 delete mode 100644 changelogs/unreleased/64341-user-callout-deferred-link-support.yml
 delete mode 100644 changelogs/unreleased/64608-double-tooltips.yml
 delete mode 100644 changelogs/unreleased/64675-Dashboard-URL-legend-border.yml
 delete mode 100644 changelogs/unreleased/64697-markdown-issues-checkbox-inside-blockquote-status-won-t-be-saved.yml
 delete mode 100644 changelogs/unreleased/64700-fix-the-color-of-the-visibility-icon-on-project-lists.yml
 delete mode 100644 changelogs/unreleased/64730-metrics-dashboard-menu-is-cramped-with-new-features-enabled.yml
 delete mode 100644 changelogs/unreleased/64746-Commit-authors-avatar-sretched-in-commit-view-if-no-image-is-loaded.yml
 delete mode 100644 changelogs/unreleased/64763-fix-tags-page-layout.yml
 delete mode 100644 changelogs/unreleased/64831-add-padding-to-merged-by-widget.yml
 delete mode 100644 changelogs/unreleased/64950-move-download-csv-button-functionality-in-metrics-dashboard-cards-i.yml
 delete mode 100644 changelogs/unreleased/64972-fix-unicorn-workers-metric.yml
 delete mode 100644 changelogs/unreleased/64974-remove-livesum-from-ruby-sampler-metrics.yml
 delete mode 100644 changelogs/unreleased/65088-incorrect-message-interpolation-on-project-listing.yml
 delete mode 100644 changelogs/unreleased/65263-manual-action.yml
 delete mode 100644 changelogs/unreleased/65278-fix-puma-master-counter-wipe.yml
 delete mode 100644 changelogs/unreleased/65483-add-a-resend-confirmation-link.yml
 delete mode 100644 changelogs/unreleased/65530-add-externalization-and-fix-regression-in-shortcuts-helper-modal.yml
 delete mode 100644 changelogs/unreleased/65660-update-karma-to-4-2-0.yml
 delete mode 100644 changelogs/unreleased/65671-update-mini_magick-to-4-9-5.yml
 delete mode 100644 changelogs/unreleased/65700-document-max-replication-slots-pg-ha.yml
 delete mode 100644 changelogs/unreleased/65705-two-buttons.yml
 delete mode 100644 changelogs/unreleased/65790-highlight.yml
 delete mode 100644 changelogs/unreleased/65803-invalidate-branches-cache-on-refresh.yml
 delete mode 100644 changelogs/unreleased/66008-fix-project-image-in-slack-notifications.yml
 delete mode 100644 changelogs/unreleased/66023-starrers-count-do-not-match-after-searching.yml
 delete mode 100644 changelogs/unreleased/FixLocaleEN.yml
 delete mode 100644 changelogs/unreleased/GL-12412.yml
 delete mode 100644 changelogs/unreleased/GL-12757.yml
 delete mode 100644 changelogs/unreleased/ab-add-index-on-environments.yml
 delete mode 100644 changelogs/unreleased/ab-count-strategies.yml
 delete mode 100644 changelogs/unreleased/add-caching-to-archive-endpoint.yml
 delete mode 100644 changelogs/unreleased/add-git-blame-api.yml
 delete mode 100644 changelogs/unreleased/add-outbound-requests-whitelist-for-local-networks.yml
 delete mode 100644 changelogs/unreleased/add-release-to-github-importer.yml
 delete mode 100644 changelogs/unreleased/add-support-for-start-sha-to-commits-api.yml
 delete mode 100644 changelogs/unreleased/adjust-group-level-analytics-to-accept-multiple-ids.yml
 delete mode 100644 changelogs/unreleased/alipniagov-fix-wiki_can_not_be_created_total-counter.yml
 delete mode 100644 changelogs/unreleased/allow-all-users-to-see-history.yml
 delete mode 100644 changelogs/unreleased/an-sidekiq-chaos.yml
 delete mode 100644 changelogs/unreleased/an-sidekiq-scheduling_latency.yml
 delete mode 100644 changelogs/unreleased/bjk-64064_cache_metrics.yml
 delete mode 100644 changelogs/unreleased/bjk-usage_ping.yml
 delete mode 100644 changelogs/unreleased/bring-scoped-environment-variables-to-core.yml
 delete mode 100644 changelogs/unreleased/bump_helm_kubectl_gitlab.yml
 delete mode 100644 changelogs/unreleased/bvl-mark-remote-mirrors-as-failed-sooner.yml
 delete mode 100644 changelogs/unreleased/bvl-remote-mirror-exception-handling.yml
 delete mode 100644 changelogs/unreleased/bw-add-index-for-relative-position.yml
 delete mode 100644 changelogs/unreleased/ce-xanf-add-links-to-admin-area.yml
 delete mode 100644 changelogs/unreleased/dblessing-fix-admin-user-radio-labels.yml
 delete mode 100644 changelogs/unreleased/dblessing-fix-public-project-ssh-only-ci-failure.yml
 delete mode 100644 changelogs/unreleased/delete-designs-v2.yml
 delete mode 100644 changelogs/unreleased/dm-process-commit-worker-n-1.yml
 delete mode 100644 changelogs/unreleased/double-slash-64592.yml
 delete mode 100644 changelogs/unreleased/enable-specific-embeds.yml
 delete mode 100644 changelogs/unreleased/extract_auto_deploy_into_base_image.yml
 delete mode 100644 changelogs/unreleased/fe-delete-old-boardservice.yml
 delete mode 100644 changelogs/unreleased/feat-add-support-page-link-in-help-menu.yml
 delete mode 100644 changelogs/unreleased/feature-gb-serverless-app-deployment-template.yml
 delete mode 100644 changelogs/unreleased/filter-title-description-and-body-from-logs.yml
 delete mode 100644 changelogs/unreleased/fix-alignment-on-security-reports.yml
 delete mode 100644 changelogs/unreleased/fix-bin-web-puma-script-to-consider-rails-env.yml
 delete mode 100644 changelogs/unreleased/fix-commits-api-empty-refname.yml
 delete mode 100644 changelogs/unreleased/fix-job-log-formatting.yml
 delete mode 100644 changelogs/unreleased/fix-name-vs-path-problem-for-cycle-analytics.yml
 delete mode 100644 changelogs/unreleased/fj-avoid-incresaing-usage-ping-when-not-enabled.yml
 delete mode 100644 changelogs/unreleased/fj-count-web-ide-merge-requests.yml
 delete mode 100644 changelogs/unreleased/fj-navbar-searches-usage-ping-counter.yml
 delete mode 100644 changelogs/unreleased/georgekoltsov-48854-fix-empty-flash-message.yml
 delete mode 100644 changelogs/unreleased/georgekoltsov-51260-add-filtering-to-bitbucket-server-import.yml
 delete mode 100644 changelogs/unreleased/georgekoltsov-55474-outbound-setting-system-hooks.yml
 delete mode 100644 changelogs/unreleased/georgekoltsov-63408-user-mapping.yml
 delete mode 100644 changelogs/unreleased/georgekoltsov-64311-set-visibility-private-if-internal-restricted.yml
 delete mode 100644 changelogs/unreleased/georgekoltsov-64377-add-better-log-msg-to-members-mapper.yml
 delete mode 100644 changelogs/unreleased/gitaly-version-v1.57.0.yml
 delete mode 100644 changelogs/unreleased/gitaly-version-v1.59.0.yml
 delete mode 100644 changelogs/unreleased/group-milestones-dashboard-blunceford.yml
 delete mode 100644 changelogs/unreleased/id-mr-widget-etag-caching.yml
 delete mode 100644 changelogs/unreleased/id-source-code-smau.yml
 delete mode 100644 changelogs/unreleased/implement-dag.yml
 delete mode 100644 changelogs/unreleased/improve-quick-action-messages.yml
 delete mode 100644 changelogs/unreleased/issue-61873-no-error-message-for-general-settings.yml
 delete mode 100644 changelogs/unreleased/issue_58494.yml
 delete mode 100644 changelogs/unreleased/je-separate-namespace-fe.yml
 delete mode 100644 changelogs/unreleased/jivanvl-add-chart-empty-state.yml
 delete mode 100644 changelogs/unreleased/jprovazn-fix-positioning.yml
 delete mode 100644 changelogs/unreleased/jprovazn-project-search.yml
 delete mode 100644 changelogs/unreleased/jramsay-fix-mirroring-help-text-typo.yml
 delete mode 100644 changelogs/unreleased/jupyter-fixes-v1.yml
 delete mode 100644 changelogs/unreleased/khair1-master-patch-79459.yml
 delete mode 100644 changelogs/unreleased/label-descr-push-opts.yml
 delete mode 100644 changelogs/unreleased/lm-download-csv-of-charts-from-metrics-dashboard.yml
 delete mode 100644 changelogs/unreleased/load-search-counts-async.yml
 delete mode 100644 changelogs/unreleased/maintainers-can-create-subgroup.yml
 delete mode 100644 changelogs/unreleased/mc-feature-add-at-colon-variable-masking.yml
 delete mode 100644 changelogs/unreleased/mc-feature-manual-job-variables.yml
 delete mode 100644 changelogs/unreleased/new-cycle-analytics-backend-migrations.yml
 delete mode 100644 changelogs/unreleased/optimize-note-indexes.yml
 delete mode 100644 changelogs/unreleased/post-migrate-private-profile.yml
 delete mode 100644 changelogs/unreleased/rails-template-update.yml
 delete mode 100644 changelogs/unreleased/remove-line-profile-from-performance-bar.yml
 delete mode 100644 changelogs/unreleased/remove-peek-gc.yml
 delete mode 100644 changelogs/unreleased/remove_deployment_metrics_deployment_platform_fallback.yml
 delete mode 100644 changelogs/unreleased/report-missing-job-dependency.yml
 delete mode 100644 changelogs/unreleased/rf-remove-group-overview-security-dashboard-feature-flag.yml
 delete mode 100644 changelogs/unreleased/rm-src-branch.yml
 delete mode 100644 changelogs/unreleased/safe-archiving-for-traces.yml
 delete mode 100644 changelogs/unreleased/security-2873-blocked-user-slash-command-bypass-master.yml
 delete mode 100644 changelogs/unreleased/security-60551-fix-upload-scope.yml
 delete mode 100644 changelogs/unreleased/sh-add-cmaps-for-pdfjs.yml
 delete mode 100644 changelogs/unreleased/sh-add-gitaly-and-rugged-data-sidekiq.yml
 delete mode 100644 changelogs/unreleased/sh-add-index-extern-uid.yml
 delete mode 100644 changelogs/unreleased/sh-add-missing-csp-report-uri.yml
 delete mode 100644 changelogs/unreleased/sh-add-rugged-logs.yml
 delete mode 100644 changelogs/unreleased/sh-add-rugged-to-peek.yml
 delete mode 100644 changelogs/unreleased/sh-break-out-invited-group-members.yml
 delete mode 100644 changelogs/unreleased/sh-disable-redis-peek.yml
 delete mode 100644 changelogs/unreleased/sh-disable-registry-delete.yml
 delete mode 100644 changelogs/unreleased/sh-enable-bootsnap.yml
 delete mode 100644 changelogs/unreleased/sh-fix-discussions-api-perf.yml
 delete mode 100644 changelogs/unreleased/sh-fix-import-export-suggestions.yml
 delete mode 100644 changelogs/unreleased/sh-fix-pipelines-not-being-created.yml
 delete mode 100644 changelogs/unreleased/sh-fix-special-role-error-500.yml
 delete mode 100644 changelogs/unreleased/sh-ignore-git-errors-delete-project.yml
 delete mode 100644 changelogs/unreleased/sh-make-githost-json.yml
 delete mode 100644 changelogs/unreleased/sh-only-flush-tags-once-per-push.yml
 delete mode 100644 changelogs/unreleased/sh-optimize-commit-deltas-post-receive.yml
 delete mode 100644 changelogs/unreleased/sh-post-receive-cache-clear-once.yml
 delete mode 100644 changelogs/unreleased/sh-remove-pdfjs-deprecations.yml
 delete mode 100644 changelogs/unreleased/sh-rename-githost-to-gitjson.yml
 delete mode 100644 changelogs/unreleased/sh-support-csp-nonce.yml
 delete mode 100644 changelogs/unreleased/sh-update-mermaid.yml
 delete mode 100644 changelogs/unreleased/sh-update-rouge-3-7-0.yml
 delete mode 100644 changelogs/unreleased/sh-update-rugged-0-28-3.yml
 delete mode 100644 changelogs/unreleased/sh-use-redis-caching-store.yml
 delete mode 100644 changelogs/unreleased/sh-use-shared-state-cluster-pubsub.yml
 delete mode 100644 changelogs/unreleased/snowplow-ee-to-ce.yml
 delete mode 100644 changelogs/unreleased/speed-up-labels-api.yml
 delete mode 100644 changelogs/unreleased/tr-embed-metric-links.yml
 delete mode 100644 changelogs/unreleased/tr-remove-embed-metrics-flag.yml
 delete mode 100644 changelogs/unreleased/update-gitlab-runner-helm-chart-to-0-7-0.yml
 delete mode 100644 changelogs/unreleased/update-graphicsmagick-to-1-3-33.yml
 delete mode 100644 changelogs/unreleased/update-pipelines-minutes-expiry-banner-to-an-alert-component-type.yml
 delete mode 100644 changelogs/unreleased/visual-review-tools-constant-storage-keys.yml
 delete mode 100644 changelogs/unreleased/wiki-usage-pings.yml

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 267a1caafec..a6c8eccf0b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,246 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 12.2.0
+
+### Security (4 changes, 1 of them is from the community)
+
+- Update mini_magick to 4.9.5. !31505 (Takuya Noguchi)
+- Upgrade Rugged to 0.28.3. !31794
+- Queries for Upload should be scoped by model.
+- Restrict slash commands to users who can log in.
+
+### Removed (3 changes)
+
+- Remove Kubernetes service integration page. !31365
+- Remove line profiler from performance bar.
+- Remove GC metrics from performance bar.
+
+### Fixed (74 changes, 4 of them are from the community)
+
+- Resolve Incorrect empty state message on Explore projects. !25578
+- Search issuables by iids. !28302 (Riccardo Padovani)
+- Make it easier to find invited group members. !28436
+- fix: updates to include units for the y axis label. !30330
+- Align access permissions for wiki history to those of wiki pages. !30470
+- Add index for issues on relative position, project, and state for manual sorting. !30542
+- Fix suggestion on lines that are not part of an MR. !30606
+- Add empty chart component. !30682
+- Remove blank block from job sidebar. !30754
+- Remove duplicate buttons in diff discussion. !30757
+- Order projects in 'Move issue' dropdown by name. !30778
+- Fix bug in dashboard display of closed milestones. !30820
+- Fixes alignment issues with reports. !30839
+- Ensure visibility icons in group/project listings are grey. !30858
+- Fix admin labels page when there are invalid records. !30885
+- Extra logging for new live trace architecture. !30892
+- Fix pipeline emails not respecting group notification email setting. !30907
+- Handle trailing slashes when generating Jira issue URLs. !30911
+- Optimize relative re-positioning when moving issues. !30938
+- Better support clickable tasklists inside blockquotes. !30952
+- Add space to "merged by" widget. !30972
+- Remove duplicated mapping key in config/locales/en.yml. !30980 (Peter Dave Hello)
+- Update Mermaid to v8.2.3. !30985
+- Use persistent Redis cluster for Workhorse pub/sub notifications. !30990
+- Remove :livesum from RubySampler metrics. !31047
+- Fix pid discovery for Unicorn processes in `PidProvider`. !31056
+- Respect group notification email when sending group access notifications. !31089
+- Default dependency job stage index to Infinity, and correctly report it as undefined in prior stages. !31116
+- Fix incorrect use of message interpolation. !31121
+- Moved labels out of fields on Search page. !31137
+- Ensure Warden triggers after_authentication callback. !31138
+- Fix admin area user access level radio button labels. !31154
+- Ignore Gitaly errors if cache flushing fails on project destruction. !31164
+- Prevent double slash in review apps path. !31212
+- Make pdf.js render CJK characters. !31220
+- Prevent discussion filter from persisting to `Show all activity` when opening links to notes. !31229
+- Improve layout of dropdowns in the metrics dashboard page. !31239
+- Remove pdf.js deprecation warnings. !31253
+- Fix GC::Profiler metrics fetching. !31331
+- Jupyter fixes. !31332 (Amit Rathi)
+- Fix first-time contributor notes not rendering. !31340
+- Fix inline rendering of relative paths to SVGs from the current repository. !31352
+- Make `bin/web_puma` consider RAILS_ENV. !31378
+- Removed extrenal dashboard legend border. !31407
+- Fix visual review app storage keys. !31427
+- Fix flashing conflict warning when editing issues. !31469
+- Fix broken issue links and possible 500 error on cycle analytics page when project name and path are different. !31471
+- Prevent turning plain links into embedded when moving issues. !31489
+- Add a field for released_at to GH importer. !31496
+- Adjust size and align MR-widget loading icon. !31503
+- Fix an issue where clicking outside the MR/branch search box in WebIDE closed the dropdown. !31523
+- Don't attempt to contact registry if it is disabled. !31553
+- Fix IDE new files icon in tree. !31560
+- Fix missing author line (`Created by: <user>`) in MRs/issues/comments of imported Bitbucket Cloud project. !31579
+- Add missing report-uri to CSP config. !31593
+- Fixed display of some sections and externalized all text in the shortcuts modal overlay. !31594
+- Remove extra padding from disabled comment box. !31603
+- Allow CI to clone public projects when HTTP protocol is disabled. !31632
+- error message for general settings. !31636 (Mesut Güneş)
+- Invalidate branches cache on PostReceive. !31653
+- Fix active metric files being wiped after the app starts. !31668
+- Fix :wiki_can_not_be_created_total counter. !31673
+- Fix job logs where style changes were broken down into separate lines. !31674
+- Properly save suggestions in project exports. !31690
+- Fix project avatar image in Slack pipeline notifications. !31788
+- Fix empty error flash message on profile:account page when updating username with username that has already been taken. !31809
+- Fix starrers counts after searching. !31823
+- Fix pipelines not always being created after a push. !31927
+- Fix 500 errors in commits api caused by empty ref_name parameter.
+- Center loading icon in CI action component.
+- Prevents showing 2 tooltips in pipelines table.
+- Fix tag page layout.
+- Prevent duplicated trigger action button.
+- Hides loading spinner in pipelines actions after request has been fullfiled.
+
+### Changed (31 changes, 5 of them are from the community)
+
+- Update cluster page automatically when cluster is created. !27189
+- Add branch/tags/commits dropdown filter on the search page for searching codes. !28282 (minghuan lei)
+- Add support for start_sha to commits API. !29598
+- Maintainers can create subgroups. !29718 (Fabio Papa)
+- Extract Auto DevOps deploy functions into a base image. !30404
+- Add MR form to Visual Review (EE) runtime configuration. !30481
+- Adjust redis cache metrics. !30572
+- Add DS_PIP_DEPENDENCY_PATH option to configure Dependency Scanning for projects using pip. !30762
+- Bring scoped environment variables to core. !30779
+- Add Web IDE Usage Ping for Create SMAU. !30800
+- Update the container scanning CI template to use v12 of the clair scanner. !30809
+- Multiple pipeline support for Commit status. !30828 (Gaetan Semet)
+- Add support for exporting repository type data for LFS objects. !30830
+- Avoid increasing redis counters when usage_ping is disabled. !30949
+- Added navbar searches usage ping counter. !30953
+- Convert githost.log to JSON format. !30967
+- Adjusted the clickable area of collapsed sidebar elements. !30974 (Michel Engelen)
+- Mark push mirrors as failed after 1 hour. !30999
+- Allows masking @ and : characters. !31065
+- Remove incorrect fallback when determining which cluster to use when retrieving MR performance metrics. !31126
+- Retry push mirrors faster when running concurrently, improve error handling when push mirrors fail. !31247
+- Make issue boards importable. !31434 (Jason Colyer)
+- Allow users to resend a confirmation link when the grace period has expired. !31476
+- Remove counts from default labels API responses. !31543
+- Upgrade to Gitaly v1.57.0. !31568
+- Rename githost.log -> git_json.log. !31634
+- Load search result counts asynchronously. !31663
+- feat: adds a download to csv functionality to the dropdown in prometheus metrics. !31679
+- Adjust copy for adding additional members. !31726
+- Upgrade to Gitaly v1.59.0. !31743
+- Filter title, description, and body parameters from logs.
+
+### Performance (17 changes, 1 of them is from the community)
+
+- Add partial index on identities table to speed up LDAP lookups. !26710
+- Improve MembersFinder query performance using UNION. !30451 (Jacopo Beschi @jacopo-beschi)
+- Rake task to cleanup expired ActiveSession lookup keys. !30668
+- Update usage ping cron behavior. !30842
+- Make Bootsnap available via ENABLE_BOOTSNAP=1. !30963
+- Batch processing of commit refs in markdown processing. !31037
+- Use tablesample approximate counting by default. !31048
+- Create index on environments by state. !31231
+- Split MR widget into etag-cached and non-cached serializers. !31354
+- Speed up loading and filtering deploy keys and their projects. !31384
+- Only track Redis calls if Peek is enabled. !31438
+- Only expire tag cache once per push. !31641
+- Reduce Gitaly calls in PostReceive. !31741
+- Eliminate many Gitaly calls in discussions API. !31834
+- Optimize DB indexes for ES indexing of notes. !31846
+- Expire project caches once per push instead of once per ref. !31876
+- Look up upstream commits once before queuing ProcessCommitWorkers.
+
+### Added (51 changes, 11 of them are from the community)
+
+- Make starred projects and starrers of a project publicly visible. !24690
+- Make quick action commands applied banner more useful. !26672 (Jacopo Beschi @jacopo-beschi)
+- Allow Helm to be uninstalled from the UI. !27359
+- Improve pipeline status Slack notifications. !27683
+- Add links to relevant configuration areas in admin area overview. !29306
+- Display project id on project admin page. !29734 (Zsolt Kovari)
+- Display group id on group admin page. !29735 (Zsolt Kovari)
+- Resolve Keyboard shortcut for jump to NEXT unresolved discussion. !30144
+- Personal access tokens are accepted using OAuth2 header format. !30277
+- Add Outbound requests whitelist for local networks. !30350 (Istvan Szalai)
+- Allow multiple Auto DevOps projects to deploy to a single namespace within a k8s cluster. !30360 (James Keogh)
+- Allow Knative to be uninstalled from the UI. !30458
+- Add admin-configurable "Support page URL" link to top Help dropdown menu. !30459 (Diego Louzán)
+- Allow specifying variables when running manual jobs. !30485
+- Use predictable environment slugs. !30551
+- Return an ETag header for the archive endpoint. !30581
+- Add Rate Request Limiter to RawController#show endpoint. !30635
+- Add git blame to GitLab API. !30675 (Oleg Zubchenko)
+- Use separate Kubernetes namespaces per environment. !30711
+- Support remove source branch on merge w/ push options. !30728
+- Deploy serverless apps with gitlabktl. !30740
+- Adjust group level analytics to accept multiple ids. !30744
+- Adds event enum column to DesignsVersions join table. !30745
+- Allow email notifications to be disabled for all members of a group or project. !30755 (Dustin Spicuzza)
+- Export and download CSV from metrics charts. !30760
+- Add API endpoints to return container repositories and tags from the group level. !30817
+- Add support for deferred links in persistent user callouts. !30818
+- Add system notes for when a Zoom call was added/removed from an issue. !30857 (Jacopo Beschi @jacopo-beschi)
+- Count wiki creation, update and delete events. !30864
+- Add new expansion options for merge request diffs. !30927
+- Count snippet creation, update and comment events. !30930
+- Update namespace label for GitLab-managed clusters. !30935
+- UI for disabling group/project email notifications. !30961 (Dustin Spicuzza)
+- Support setting of merge request title and description using git push options. !31068
+- Add new table to store email domain per group. !31071
+- Redirect from a project wiki git route to the project wiki home. !31085
+- Link and embed metrics in GitLab Flavored Markdown. !31106
+- Moves snowplow tracking from ee to ce. !31160 (jejacks0n)
+- Allow Cert-Manager to be uninstalled. !31166
+- Add new outbound network requests application setting for system hooks. !31177
+- Allow links to metrics dashboard at a specific time. !31283
+- Enable embedding of specific metrics charts in GFM. !31304
+- Support creating DAGs in CI config through the `needs` key. !31328
+- Generate shareable link for specific metric charts. !31339
+- Add support for Content-Security-Policy. !31402
+- Add BitBucketServer project import filtering. !31420
+- Embed specific metrics chart in issue. !31644
+- Track page views for cycle analytics show page. !31717
+- Add usage pings for source code pushes. !31734
+- Makes collapsible title clickable in job log.
+- Adds highlight to the collapsible section.
+
+### Other (36 changes, 9 of them are from the community)
+
+- Rewrite `if:` argument in before_action and alike when `only:` is also used. !24412 (George Thomas @thegeorgeous)
+- Create rake tasks for migrating legacy uploads out of deprecated paths. !29409
+- Remove the warning style from the U2F device message in user settings > account. !30119 (matejlatin)
+- Set visibility level 'Private' for restricted 'Internal' imported projects when 'Internal' visibility setting is restricted in admin settings. !30522
+- Change BoardService in favor of boardsStore on board blank state of the component board. !30546 (eduarmreyes)
+- Adds Sidekiq scheduling latency structured logging field. !30784
+- Adds chaos endpoints to Sidekiq. !30814
+- Added multi-select deletion of container registry images. !30837
+- When GitLab import fails during importer user mapping step, add an explicit error message mentioning importer. !30838
+- Add Rugged calls and duration to API and Rails logs. !30871
+- Fixed distorted avatars when resource not reachable. !30904 (Marc Schwede)
+- Update GitLab Runner Helm Chart to 0.7.0. !30950
+- Use Rails 5.2 Redis caching store. !30966
+- Add Rugged calls to performance bar. !30983
+- add color selector to broadcast messages form. !30988
+- Harmonize selections in user settings. !31110 (Marc Schwede)
+- Update rouge to v3.7.0. !31254
+- Update 'Ruby on Rails' project template. !31310
+- Fix mirroring help text. !31348 (jramsay)
+- Enhance style of the shared runners limit. !31386
+- Enables storage statistics for root namespaces on database. !31392
+- Improve quick action error messages. !31451
+- Enable authenticated cookie encryption. !31463
+- Update karma to 4.2.0. !31495 (Takuya Noguchi)
+- Add max_replication_slots to PG HA documentation. !31534
+- Create database tables for the new cycle analytics backend. !31621
+- Updated the detached pipeline badge tooltip text to offer a better explanation. !31626
+- Add Gitaly and Rugged call timing in Sidekiq logs. !31651
+- Fix the style-lint errors and warnings for `app/assets/stylesheets/pages/wiki.scss`. !31656
+- Update GraphicsMagick from 1.3.29 to 1.3.33 for CI tests. !31692 (Takuya Noguchi)
+- Migrate remaining users with null private_profile. !31708
+- Bump Helm to 2.14.3 and kubectl to 1.11.10 for Kubernetes integration. !31716
+- Updated the personal access token api scope description to reflect the permissions it grants. !31759
+- Add finished_at to the internal API Deployment entity. !31808
+- Remove Security Dashboard feature flag. !31820
+- Update Packer.gitlab-ci.yml to use latest image. (Kelly Hair)
+
+
 ## 12.1.5
 
 ### Security (2 changes)
diff --git a/changelogs/unreleased/10-adjust-copy-for-adding-additional-members.yml b/changelogs/unreleased/10-adjust-copy-for-adding-additional-members.yml
deleted file mode 100644
index f249eff572c..00000000000
--- a/changelogs/unreleased/10-adjust-copy-for-adding-additional-members.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Adjust copy for adding additional members
-merge_request: 31726
-author:
-type: changed
diff --git a/changelogs/unreleased/10972-be-allow-restricting-group-members-by-a-domain-whitelist-ce.yml b/changelogs/unreleased/10972-be-allow-restricting-group-members-by-a-domain-whitelist-ce.yml
deleted file mode 100644
index d93e7634ae5..00000000000
--- a/changelogs/unreleased/10972-be-allow-restricting-group-members-by-a-domain-whitelist-ce.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add new table to store email domain per group
-merge_request: 31071
-author:
-type: added
diff --git a/changelogs/unreleased/11090-export-design-management-lfs-data.yml b/changelogs/unreleased/11090-export-design-management-lfs-data.yml
deleted file mode 100644
index 36b773124d7..00000000000
--- a/changelogs/unreleased/11090-export-design-management-lfs-data.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add support for exporting repository type data for LFS objects
-merge_request: 30830
-author:
-type: changed
diff --git a/changelogs/unreleased/12502-add-view-stats-to-cycle-analytics.yml b/changelogs/unreleased/12502-add-view-stats-to-cycle-analytics.yml
deleted file mode 100644
index ccfd929b6ba..00000000000
--- a/changelogs/unreleased/12502-add-view-stats-to-cycle-analytics.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Track page views for cycle analytics show page
-merge_request: 31717
-author:
-type: added
diff --git a/changelogs/unreleased/17276-breakage-in-displaying-svg-in-the-same-repository.yml b/changelogs/unreleased/17276-breakage-in-displaying-svg-in-the-same-repository.yml
deleted file mode 100644
index 93936d441e7..00000000000
--- a/changelogs/unreleased/17276-breakage-in-displaying-svg-in-the-same-repository.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix inline rendering of relative paths to SVGs from the current repository
-merge_request: 31352
-author:
-type: fixed
diff --git a/changelogs/unreleased/19186-redirect-wiki-git-route-to-wiki.yml b/changelogs/unreleased/19186-redirect-wiki-git-route-to-wiki.yml
deleted file mode 100644
index 705621d06f7..00000000000
--- a/changelogs/unreleased/19186-redirect-wiki-git-route-to-wiki.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Redirect from a project wiki git route to the project wiki home
-merge_request: 31085
-author:
-type: added
diff --git a/changelogs/unreleased/20137-starrers.yml b/changelogs/unreleased/20137-starrers.yml
deleted file mode 100644
index d597b06f224..00000000000
--- a/changelogs/unreleased/20137-starrers.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Make starred projects and starrers of a project publicly visible
-merge_request: 24690
-author:
-type: added
diff --git a/changelogs/unreleased/21671-multiple-pipeline-status-api.yml b/changelogs/unreleased/21671-multiple-pipeline-status-api.yml
deleted file mode 100644
index b7b0f5fa0c7..00000000000
--- a/changelogs/unreleased/21671-multiple-pipeline-status-api.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Multiple pipeline support for Commit status
-merge_request: 30828
-author: Gaetan Semet
-type: changed
diff --git a/changelogs/unreleased/24705-multi-selection-for-delete-on-registry-page.yml b/changelogs/unreleased/24705-multi-selection-for-delete-on-registry-page.yml
deleted file mode 100644
index 5254bd36b9c..00000000000
--- a/changelogs/unreleased/24705-multi-selection-for-delete-on-registry-page.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Added multi-select deletion of container registry images
-merge_request: 30837
-author:
-type: other
diff --git a/changelogs/unreleased/26866-api-endpoint-to-list-the-docker-images-tags-of-a-group.yml b/changelogs/unreleased/26866-api-endpoint-to-list-the-docker-images-tags-of-a-group.yml
deleted file mode 100644
index adbd7971a14..00000000000
--- a/changelogs/unreleased/26866-api-endpoint-to-list-the-docker-images-tags-of-a-group.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Add API endpoints to return container repositories and tags from the group
-  level
-merge_request: 30817
-author:
-type: added
diff --git a/changelogs/unreleased/30974-issue-search-by-number.yml b/changelogs/unreleased/30974-issue-search-by-number.yml
deleted file mode 100644
index da50ee32c83..00000000000
--- a/changelogs/unreleased/30974-issue-search-by-number.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: "Search issuables by iids"
-merge_request: 28302
-author: Riccardo Padovani
-type: fixed
diff --git a/changelogs/unreleased/31434-make-issue-boards-importable.yml b/changelogs/unreleased/31434-make-issue-boards-importable.yml
deleted file mode 100644
index fd270a236dc..00000000000
--- a/changelogs/unreleased/31434-make-issue-boards-importable.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Make issue boards importable
-merge_request: 31434
-author: Jason Colyer
-type: changed
diff --git a/changelogs/unreleased/32495-improve-slack-notification-on-pipeline-status.yml b/changelogs/unreleased/32495-improve-slack-notification-on-pipeline-status.yml
deleted file mode 100644
index b7b39303c2e..00000000000
--- a/changelogs/unreleased/32495-improve-slack-notification-on-pipeline-status.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Improve pipeline status Slack notifications
-merge_request: 27683
-author:
-type: added
diff --git a/changelogs/unreleased/34414-update-personal-access-token-scope-descriptions-to-reflect-registry-permissions.yml b/changelogs/unreleased/34414-update-personal-access-token-scope-descriptions-to-reflect-registry-permissions.yml
deleted file mode 100644
index f0cc7fe9b6d..00000000000
--- a/changelogs/unreleased/34414-update-personal-access-token-scope-descriptions-to-reflect-registry-permissions.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Updated the personal access token api scope description to reflect the permissions
-  it grants
-merge_request: 31759
-author:
-type: other
diff --git a/changelogs/unreleased/39217-remove-kubernetes-service-integration.yml b/changelogs/unreleased/39217-remove-kubernetes-service-integration.yml
deleted file mode 100644
index e13e3e86a37..00000000000
--- a/changelogs/unreleased/39217-remove-kubernetes-service-integration.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove Kubernetes service integration page
-merge_request: 31365
-author:
-type: removed
diff --git a/changelogs/unreleased/43080-speed-up-deploy-keys.yml b/changelogs/unreleased/43080-speed-up-deploy-keys.yml
deleted file mode 100644
index 73c9a9e5f82..00000000000
--- a/changelogs/unreleased/43080-speed-up-deploy-keys.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Speed up loading and filtering deploy keys and their projects
-merge_request: 31384
-author:
-type: performance
diff --git a/changelogs/unreleased/44036-fix-someone-edited-the-issue-at-the-same-time-false-warning.yml b/changelogs/unreleased/44036-fix-someone-edited-the-issue-at-the-same-time-false-warning.yml
deleted file mode 100644
index 674d53286e6..00000000000
--- a/changelogs/unreleased/44036-fix-someone-edited-the-issue-at-the-same-time-false-warning.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix flashing conflict warning when editing issues
-merge_request: 31469
-author:
-type: fixed
diff --git a/changelogs/unreleased/47814-search-view-labels.yml b/changelogs/unreleased/47814-search-view-labels.yml
deleted file mode 100644
index b4f10150d13..00000000000
--- a/changelogs/unreleased/47814-search-view-labels.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Moved labels out of fields on Search page
-merge_request: 31137
-author:
-type: fixed
diff --git a/changelogs/unreleased/48717-rate-limit-raw-controller-show.yml b/changelogs/unreleased/48717-rate-limit-raw-controller-show.yml
deleted file mode 100644
index 38ee95a7553..00000000000
--- a/changelogs/unreleased/48717-rate-limit-raw-controller-show.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add Rate Request Limiter to RawController#show endpoint
-merge_request: 30635
-author:
-type: added
diff --git a/changelogs/unreleased/50020-allow-email-notifications-to-be-disabled-for-all-users-of-a-group.yml b/changelogs/unreleased/50020-allow-email-notifications-to-be-disabled-for-all-users-of-a-group.yml
deleted file mode 100644
index 9137e9339aa..00000000000
--- a/changelogs/unreleased/50020-allow-email-notifications-to-be-disabled-for-all-users-of-a-group.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Allow email notifications to be disabled for all members of a group or project
-merge_request: 30755
-author: Dustin Spicuzza
-type: added
diff --git a/changelogs/unreleased/50020-fe-allow-email-notifications-to-be-disabled-for-all-users-of-a-group.yml b/changelogs/unreleased/50020-fe-allow-email-notifications-to-be-disabled-for-all-users-of-a-group.yml
deleted file mode 100644
index a5fe7b1d18e..00000000000
--- a/changelogs/unreleased/50020-fe-allow-email-notifications-to-be-disabled-for-all-users-of-a-group.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: UI for disabling group/project email notifications
-merge_request: 30961
-author: Dustin Spicuzza
-type: added
diff --git a/changelogs/unreleased/50070-legacy-attachments.yml b/changelogs/unreleased/50070-legacy-attachments.yml
deleted file mode 100644
index 03f1cec0f67..00000000000
--- a/changelogs/unreleased/50070-legacy-attachments.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Create rake tasks for migrating legacy uploads out of deprecated paths
-merge_request: 29409
-author:
-type: other
diff --git a/changelogs/unreleased/50130-cluster-cluster-details-update-automatically-after-cluster-is-created.yml b/changelogs/unreleased/50130-cluster-cluster-details-update-automatically-after-cluster-is-created.yml
deleted file mode 100644
index dc718572cfb..00000000000
--- a/changelogs/unreleased/50130-cluster-cluster-details-update-automatically-after-cluster-is-created.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update cluster page automatically when cluster is created
-merge_request: 27189
-author:
-type: changed
diff --git a/changelogs/unreleased/52494-separate-namespace-per-project-environment-slug.yml b/changelogs/unreleased/52494-separate-namespace-per-project-environment-slug.yml
deleted file mode 100644
index 645c92127a3..00000000000
--- a/changelogs/unreleased/52494-separate-namespace-per-project-environment-slug.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Use separate Kubernetes namespaces per environment
-merge_request: 30711
-author:
-type: added
diff --git a/changelogs/unreleased/55564-remove-if-in-before-after-action.yml b/changelogs/unreleased/55564-remove-if-in-before-after-action.yml
deleted file mode 100644
index a787faa8a9c..00000000000
--- a/changelogs/unreleased/55564-remove-if-in-before-after-action.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Rewrite `if:` argument in before_action and alike when `only:` is also used
-merge_request: 24412
-author: George Thomas @thegeorgeous
-type: other
diff --git a/changelogs/unreleased/56100-make-quick-action-commands-applied-banner-more-useful.yml b/changelogs/unreleased/56100-make-quick-action-commands-applied-banner-more-useful.yml
deleted file mode 100644
index a2fa07c6ed2..00000000000
--- a/changelogs/unreleased/56100-make-quick-action-commands-applied-banner-more-useful.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Make quick action commands applied banner more useful
-merge_request: 26672
-author: Jacopo Beschi @jacopo-beschi
-type: added
diff --git a/changelogs/unreleased/56130-deployment-date.yml b/changelogs/unreleased/56130-deployment-date.yml
deleted file mode 100644
index 7d1e84bbaa4..00000000000
--- a/changelogs/unreleased/56130-deployment-date.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add finished_at to the internal API Deployment entity
-merge_request: 31808
-author:
-type: other
diff --git a/changelogs/unreleased/57953-fix-unfolded-diff-suggestions.yml b/changelogs/unreleased/57953-fix-unfolded-diff-suggestions.yml
deleted file mode 100644
index f634c0cd98a..00000000000
--- a/changelogs/unreleased/57953-fix-unfolded-diff-suggestions.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix suggestion on lines that are not part of an MR
-merge_request: 30606
-author:
-type: fixed
diff --git a/changelogs/unreleased/58035-expand-mr-diff.yml b/changelogs/unreleased/58035-expand-mr-diff.yml
deleted file mode 100644
index 7163cce29f2..00000000000
--- a/changelogs/unreleased/58035-expand-mr-diff.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add new expansion options for merge request diffs
-merge_request: 30927
-author:
-type: added
diff --git a/changelogs/unreleased/58256-incorrect-empty-state-message-displayed-on-explore-projects-tab.yml b/changelogs/unreleased/58256-incorrect-empty-state-message-displayed-on-explore-projects-tab.yml
deleted file mode 100644
index f719338b9cb..00000000000
--- a/changelogs/unreleased/58256-incorrect-empty-state-message-displayed-on-explore-projects-tab.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Resolve Incorrect empty state message on Explore projects
-merge_request: 25578
-author:
-type: fixed
diff --git a/changelogs/unreleased/59325-units-are-not-shown-on-the-performance-dashboard-2.yml b/changelogs/unreleased/59325-units-are-not-shown-on-the-performance-dashboard-2.yml
deleted file mode 100644
index 38cfa0f273e..00000000000
--- a/changelogs/unreleased/59325-units-are-not-shown-on-the-performance-dashboard-2.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: 'fix: updates to include units for the y axis label'
-merge_request: 30330
-author:
-type: fixed
diff --git a/changelogs/unreleased/59521-job-sidebar-has-a-blank-block.yml b/changelogs/unreleased/59521-job-sidebar-has-a-blank-block.yml
deleted file mode 100644
index 4c93a108f2b..00000000000
--- a/changelogs/unreleased/59521-job-sidebar-has-a-blank-block.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove blank block from job sidebar
-merge_request: 30754
-author:
-type: fixed
diff --git a/changelogs/unreleased/59590-keyboard-shortcut-for-jump-to-next-unresolved-discussion.yml b/changelogs/unreleased/59590-keyboard-shortcut-for-jump-to-next-unresolved-discussion.yml
deleted file mode 100644
index 02e81c7fc87..00000000000
--- a/changelogs/unreleased/59590-keyboard-shortcut-for-jump-to-next-unresolved-discussion.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Resolve Keyboard shortcut for jump to NEXT unresolved discussion
-merge_request: 30144
-author:
-type: added
diff --git a/changelogs/unreleased/59712-resolve-the-search-problem-issue.yml b/changelogs/unreleased/59712-resolve-the-search-problem-issue.yml
deleted file mode 100644
index 964962cb817..00000000000
--- a/changelogs/unreleased/59712-resolve-the-search-problem-issue.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add branch/tags/commits dropdown filter on the search page for searching codes
-merge_request: 28282
-author: minghuan lei
-type: changed
diff --git a/changelogs/unreleased/59829-fix-style-lint-wiki.yml b/changelogs/unreleased/59829-fix-style-lint-wiki.yml
deleted file mode 100644
index 48242a77c6b..00000000000
--- a/changelogs/unreleased/59829-fix-style-lint-wiki.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix the style-lint errors and warnings for `app/assets/stylesheets/pages/wiki.scss`
-merge_request: 31656
-author:
-type: other
diff --git a/changelogs/unreleased/60449-reduce-gitaly-calls-when-rendering-commits-in-md.yml b/changelogs/unreleased/60449-reduce-gitaly-calls-when-rendering-commits-in-md.yml
deleted file mode 100644
index ef11e8743f6..00000000000
--- a/changelogs/unreleased/60449-reduce-gitaly-calls-when-rendering-commits-in-md.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Batch processing of commit refs in markdown processing
-merge_request: 31037
-author:
-type: performance
diff --git a/changelogs/unreleased/60516-uninstall-tiller.yml b/changelogs/unreleased/60516-uninstall-tiller.yml
deleted file mode 100644
index db25e7b3338..00000000000
--- a/changelogs/unreleased/60516-uninstall-tiller.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Allow Helm to be uninstalled from the UI
-merge_request: 27359
-author:
-type: added
diff --git a/changelogs/unreleased/60664-kubernetes-applications-uninstall-cert-manager.yml b/changelogs/unreleased/60664-kubernetes-applications-uninstall-cert-manager.yml
deleted file mode 100644
index efc3ec241e2..00000000000
--- a/changelogs/unreleased/60664-kubernetes-applications-uninstall-cert-manager.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Allow Cert-Manager to be uninstalled
-merge_request: 31166
-author:
-type: added
diff --git a/changelogs/unreleased/60668-kubernetes-applications-uninstall-knative.yml b/changelogs/unreleased/60668-kubernetes-applications-uninstall-knative.yml
deleted file mode 100644
index c33dc0f50cd..00000000000
--- a/changelogs/unreleased/60668-kubernetes-applications-uninstall-knative.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Allow Knative to be uninstalled from the UI
-merge_request: 30458
-author:
-type: added
diff --git a/changelogs/unreleased/60948-display-groupid-on-group-admin-page.yml b/changelogs/unreleased/60948-display-groupid-on-group-admin-page.yml
deleted file mode 100644
index 17763b4c69e..00000000000
--- a/changelogs/unreleased/60948-display-groupid-on-group-admin-page.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Display group id on group admin page
-merge_request: 29735
-author: Zsolt Kovari
-type: added
diff --git a/changelogs/unreleased/60949-display-projectid-on-project-admin-page.yml b/changelogs/unreleased/60949-display-projectid-on-project-admin-page.yml
deleted file mode 100644
index 3ff83ede2fa..00000000000
--- a/changelogs/unreleased/60949-display-projectid-on-project-admin-page.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Display project id on project admin page
-merge_request: 29734
-author: Zsolt Kovari
-type: added
diff --git a/changelogs/unreleased/61207-adjusted-hoverable-area-in-sidebar.yml b/changelogs/unreleased/61207-adjusted-hoverable-area-in-sidebar.yml
deleted file mode 100644
index 99fc817d703..00000000000
--- a/changelogs/unreleased/61207-adjusted-hoverable-area-in-sidebar.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: "Adjusted the clickable area of collapsed sidebar elements"
-merge_request: 30974
-author: Michel Engelen
-type: changed
diff --git a/changelogs/unreleased/61332-web-ide-mr-branch-dropdown-closes-unexpectedly.yml b/changelogs/unreleased/61332-web-ide-mr-branch-dropdown-closes-unexpectedly.yml
deleted file mode 100644
index 1f5e507d48d..00000000000
--- a/changelogs/unreleased/61332-web-ide-mr-branch-dropdown-closes-unexpectedly.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix an issue where clicking outside the MR/branch search box in WebIDE closed the dropdown.
-merge_request: 31523
-author:
-type: fixed
diff --git a/changelogs/unreleased/61335-fix-file-icon-status.yml b/changelogs/unreleased/61335-fix-file-icon-status.yml
deleted file mode 100644
index d524d91b246..00000000000
--- a/changelogs/unreleased/61335-fix-file-icon-status.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix IDE new files icon in tree
-merge_request: 31560
-author:
-type: fixed
diff --git a/changelogs/unreleased/61445-prevent-persisting-auto-switch-discussion-filter.yml b/changelogs/unreleased/61445-prevent-persisting-auto-switch-discussion-filter.yml
deleted file mode 100644
index 58e29212462..00000000000
--- a/changelogs/unreleased/61445-prevent-persisting-auto-switch-discussion-filter.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Prevent discussion filter from persisting to `Show all activity` when opening
-  links to notes
-merge_request: 31229
-author:
-type: fixed
diff --git a/changelogs/unreleased/61776-fixing-the-U2F-warning-message-text-colour.yml b/changelogs/unreleased/61776-fixing-the-U2F-warning-message-text-colour.yml
deleted file mode 100644
index 988eb77db12..00000000000
--- a/changelogs/unreleased/61776-fixing-the-U2F-warning-message-text-colour.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove the warning style from the U2F device message in user settings > account
-merge_request: 30119
-author: matejlatin
-type: other
diff --git a/changelogs/unreleased/61787-broadcast-messages-colour-selector-provide-default-options-with-descriptive-labels.yml b/changelogs/unreleased/61787-broadcast-messages-colour-selector-provide-default-options-with-descriptive-labels.yml
deleted file mode 100644
index ec6e9c5aff8..00000000000
--- a/changelogs/unreleased/61787-broadcast-messages-colour-selector-provide-default-options-with-descriptive-labels.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: add color selector to broadcast messages form
-merge_request: 30988
-author:
-type: other
diff --git a/changelogs/unreleased/62137-add-tooltip-to-improve-clarity-of-detached-label-state-in-the-merge-request-pipeline.yml b/changelogs/unreleased/62137-add-tooltip-to-improve-clarity-of-detached-label-state-in-the-merge-request-pipeline.yml
deleted file mode 100644
index ccc3195e6ae..00000000000
--- a/changelogs/unreleased/62137-add-tooltip-to-improve-clarity-of-detached-label-state-in-the-merge-request-pipeline.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Updated the detached pipeline badge tooltip text to offer a better explanation
-merge_request: 31626
-author:
-type: other
diff --git a/changelogs/unreleased/62286-Consistent-selection-elements-in-user-settings-preferences.yml b/changelogs/unreleased/62286-Consistent-selection-elements-in-user-settings-preferences.yml
deleted file mode 100644
index 10f2b7eaed5..00000000000
--- a/changelogs/unreleased/62286-Consistent-selection-elements-in-user-settings-preferences.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Harmonize selections in user settings
-merge_request: 31110
-author: Marc Schwede
-type: other
diff --git a/changelogs/unreleased/62609-test-summary-loading-spinner-is-too-large.yml b/changelogs/unreleased/62609-test-summary-loading-spinner-is-too-large.yml
deleted file mode 100644
index f8e4a26dad8..00000000000
--- a/changelogs/unreleased/62609-test-summary-loading-spinner-is-too-large.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Adjust size and align MR-widget loading icon
-merge_request: 31503
-author:
-type: fixed
diff --git a/changelogs/unreleased/62971-embed-specific-metrics-chart-in-issue.yml b/changelogs/unreleased/62971-embed-specific-metrics-chart-in-issue.yml
deleted file mode 100644
index b6bc03f4003..00000000000
--- a/changelogs/unreleased/62971-embed-specific-metrics-chart-in-issue.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Embed specific metrics chart in issue
-merge_request: 31644
-author:
-type: added
diff --git a/changelogs/unreleased/62973-specify-time-frame-in-shareable-link-for-embedding-metrics.yml b/changelogs/unreleased/62973-specify-time-frame-in-shareable-link-for-embedding-metrics.yml
deleted file mode 100644
index aaf0ddfa48d..00000000000
--- a/changelogs/unreleased/62973-specify-time-frame-in-shareable-link-for-embedding-metrics.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Allow links to metrics dashboard at a specific time
-merge_request: 31283
-author:
-type: added
diff --git a/changelogs/unreleased/63181-collapsible-line.yml b/changelogs/unreleased/63181-collapsible-line.yml
deleted file mode 100644
index c13d4eeab6c..00000000000
--- a/changelogs/unreleased/63181-collapsible-line.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Makes collapsible title clickable in job log
-merge_request:
-author:
-type: added
diff --git a/changelogs/unreleased/63438-oauth2-support-with-gitlab-personal-access-token.yml b/changelogs/unreleased/63438-oauth2-support-with-gitlab-personal-access-token.yml
deleted file mode 100644
index 815010e15ae..00000000000
--- a/changelogs/unreleased/63438-oauth2-support-with-gitlab-personal-access-token.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Personal access tokens are accepted using OAuth2 header format
-merge_request: 30277
-author:
-type: added
diff --git a/changelogs/unreleased/63485-fix-pipeline-emails-to-use-group-setting.yml b/changelogs/unreleased/63485-fix-pipeline-emails-to-use-group-setting.yml
deleted file mode 100644
index c3ee3108216..00000000000
--- a/changelogs/unreleased/63485-fix-pipeline-emails-to-use-group-setting.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix pipeline emails not respecting group notification email setting
-merge_request: 30907
-author:
-type: fixed
diff --git a/changelogs/unreleased/63547-add-system-notes-for-when-a-zoom-call-was-added-removed-from-an-issue.yml b/changelogs/unreleased/63547-add-system-notes-for-when-a-zoom-call-was-added-removed-from-an-issue.yml
deleted file mode 100644
index 387c01dc135..00000000000
--- a/changelogs/unreleased/63547-add-system-notes-for-when-a-zoom-call-was-added-removed-from-an-issue.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add system notes for when a Zoom call was added/removed from an issue
-merge_request: 30857
-author: Jacopo Beschi @jacopo-beschi
-type: added
diff --git a/changelogs/unreleased/63568-access-email-notifications-custom-email.yml b/changelogs/unreleased/63568-access-email-notifications-custom-email.yml
deleted file mode 100644
index ece6442d7cf..00000000000
--- a/changelogs/unreleased/63568-access-email-notifications-custom-email.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Respect group notification email when sending group access notifications
-merge_request: 31089
-author:
-type: fixed
diff --git a/changelogs/unreleased/63571-fix-gc-profiler-data-being-wiped.yml b/changelogs/unreleased/63571-fix-gc-profiler-data-being-wiped.yml
deleted file mode 100644
index 7943d9573f3..00000000000
--- a/changelogs/unreleased/63571-fix-gc-profiler-data-being-wiped.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix GC::Profiler metrics fetching
-merge_request: 31331
-author:
-type: fixed
diff --git a/changelogs/unreleased/63671-remove-extra-padding-from-the-disabled-comment-area.yml b/changelogs/unreleased/63671-remove-extra-padding-from-the-disabled-comment-area.yml
deleted file mode 100644
index ab116674ced..00000000000
--- a/changelogs/unreleased/63671-remove-extra-padding-from-the-disabled-comment-area.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove extra padding from disabled comment box
-merge_request: 31603
-author:
-type: fixed
diff --git a/changelogs/unreleased/63730-fix-500-status-labels-pd.yml b/changelogs/unreleased/63730-fix-500-status-labels-pd.yml
deleted file mode 100644
index a1e2ae0e5df..00000000000
--- a/changelogs/unreleased/63730-fix-500-status-labels-pd.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix admin labels page when there are invalid records
-merge_request: 30885
-author:
-type: fixed
diff --git a/changelogs/unreleased/63833-fix-jira-issues-url.yml b/changelogs/unreleased/63833-fix-jira-issues-url.yml
deleted file mode 100644
index 24d6bca3842..00000000000
--- a/changelogs/unreleased/63833-fix-jira-issues-url.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Handle trailing slashes when generating Jira issue URLs
-merge_request: 30911
-author:
-type: fixed
diff --git a/changelogs/unreleased/63888-snippets-usage-ping-for-create-smau.yml b/changelogs/unreleased/63888-snippets-usage-ping-for-create-smau.yml
deleted file mode 100644
index 1a5a552b120..00000000000
--- a/changelogs/unreleased/63888-snippets-usage-ping-for-create-smau.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Count snippet creation, update and comment events
-merge_request: 30930
-author:
-type: added
diff --git a/changelogs/unreleased/63942-remove-config-action_dispatch-use_authenticated_cookie_encryption-configuration.yml b/changelogs/unreleased/63942-remove-config-action_dispatch-use_authenticated_cookie_encryption-configuration.yml
deleted file mode 100644
index 741763403a5..00000000000
--- a/changelogs/unreleased/63942-remove-config-action_dispatch-use_authenticated_cookie_encryption-configuration.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Enable authenticated cookie encryption
-merge_request: 31463
-author:
-type: other
diff --git a/changelogs/unreleased/64081-override-helm-release-name.yml b/changelogs/unreleased/64081-override-helm-release-name.yml
deleted file mode 100644
index 2bf39b17c03..00000000000
--- a/changelogs/unreleased/64081-override-helm-release-name.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Allow multiple Auto DevOps projects to deploy to a single namespace within a k8s cluster
-merge_request: 30360
-author: James Keogh
-type: added
diff --git a/changelogs/unreleased/64092-removes-update-statistics-namespace-feature-flag.yml b/changelogs/unreleased/64092-removes-update-statistics-namespace-feature-flag.yml
deleted file mode 100644
index 272c830a914..00000000000
--- a/changelogs/unreleased/64092-removes-update-statistics-namespace-feature-flag.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Enables storage statistics for root namespaces on database
-merge_request: 31392
-author:
-type: other
diff --git a/changelogs/unreleased/64160-fix-duplicate-buttons.yml b/changelogs/unreleased/64160-fix-duplicate-buttons.yml
deleted file mode 100644
index 12416a611ed..00000000000
--- a/changelogs/unreleased/64160-fix-duplicate-buttons.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove duplicate buttons in diff discussion
-merge_request: 30757
-author:
-type: fixed
diff --git a/changelogs/unreleased/64180-membersfinder-contains-slow-database-query-with-or-conditions.yml b/changelogs/unreleased/64180-membersfinder-contains-slow-database-query-with-or-conditions.yml
deleted file mode 100644
index f86c63a15b6..00000000000
--- a/changelogs/unreleased/64180-membersfinder-contains-slow-database-query-with-or-conditions.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Improve MembersFinder query performance using UNION
-merge_request: 30451
-author: Jacopo Beschi @jacopo-beschi
-type: performance
diff --git a/changelogs/unreleased/64190-add-mr-form.yml b/changelogs/unreleased/64190-add-mr-form.yml
deleted file mode 100644
index 08340d01fd8..00000000000
--- a/changelogs/unreleased/64190-add-mr-form.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add MR form to Visual Review (EE) runtime configuration
-merge_request: 30481
-author:
-type: changed
diff --git a/changelogs/unreleased/64257-active_session_lookup_key_cleanup.yml b/changelogs/unreleased/64257-active_session_lookup_key_cleanup.yml
deleted file mode 100644
index df3cd98830e..00000000000
--- a/changelogs/unreleased/64257-active_session_lookup_key_cleanup.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Rake task to cleanup expired ActiveSession lookup keys
-merge_request: 30668
-author:
-type: performance
diff --git a/changelogs/unreleased/64257-warden_set_user_fix.yml b/changelogs/unreleased/64257-warden_set_user_fix.yml
deleted file mode 100644
index 7b6818876fb..00000000000
--- a/changelogs/unreleased/64257-warden_set_user_fix.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Ensure Warden triggers after_authentication callback
-merge_request: 31138
-author:
-type: fixed
diff --git a/changelogs/unreleased/64265-center-loading-icon.yml b/changelogs/unreleased/64265-center-loading-icon.yml
deleted file mode 100644
index cd4253b63c6..00000000000
--- a/changelogs/unreleased/64265-center-loading-icon.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Center loading icon in CI action component
-merge_request:
-author:
-type: fixed
diff --git a/changelogs/unreleased/64295-predictable-environment-slugs.yml b/changelogs/unreleased/64295-predictable-environment-slugs.yml
deleted file mode 100644
index de581b2b8e1..00000000000
--- a/changelogs/unreleased/64295-predictable-environment-slugs.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Use predictable environment slugs
-merge_request: 30551
-author:
-type: added
diff --git a/changelogs/unreleased/64341-user-callout-deferred-link-support.yml b/changelogs/unreleased/64341-user-callout-deferred-link-support.yml
deleted file mode 100644
index 05230ddc124..00000000000
--- a/changelogs/unreleased/64341-user-callout-deferred-link-support.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add support for deferred links in persistent user callouts.
-merge_request: 30818
-author:
-type: added
diff --git a/changelogs/unreleased/64608-double-tooltips.yml b/changelogs/unreleased/64608-double-tooltips.yml
deleted file mode 100644
index f6cb1944d26..00000000000
--- a/changelogs/unreleased/64608-double-tooltips.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Prevents showing 2 tooltips in pipelines table
-merge_request:
-author:
-type: fixed
diff --git a/changelogs/unreleased/64675-Dashboard-URL-legend-border.yml b/changelogs/unreleased/64675-Dashboard-URL-legend-border.yml
deleted file mode 100644
index f35261fcd6c..00000000000
--- a/changelogs/unreleased/64675-Dashboard-URL-legend-border.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Removed extrenal dashboard legend border
-merge_request: 31407
-author:
-type: fixed
diff --git a/changelogs/unreleased/64697-markdown-issues-checkbox-inside-blockquote-status-won-t-be-saved.yml b/changelogs/unreleased/64697-markdown-issues-checkbox-inside-blockquote-status-won-t-be-saved.yml
deleted file mode 100644
index 00664d64050..00000000000
--- a/changelogs/unreleased/64697-markdown-issues-checkbox-inside-blockquote-status-won-t-be-saved.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Better support clickable tasklists inside blockquotes
-merge_request: 30952
-author:
-type: fixed
diff --git a/changelogs/unreleased/64700-fix-the-color-of-the-visibility-icon-on-project-lists.yml b/changelogs/unreleased/64700-fix-the-color-of-the-visibility-icon-on-project-lists.yml
deleted file mode 100644
index 0d2fbaf01ed..00000000000
--- a/changelogs/unreleased/64700-fix-the-color-of-the-visibility-icon-on-project-lists.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Ensure visibility icons in group/project listings are grey
-merge_request: 30858
-author:
-type: fixed
diff --git a/changelogs/unreleased/64730-metrics-dashboard-menu-is-cramped-with-new-features-enabled.yml b/changelogs/unreleased/64730-metrics-dashboard-menu-is-cramped-with-new-features-enabled.yml
deleted file mode 100644
index c564b98bb41..00000000000
--- a/changelogs/unreleased/64730-metrics-dashboard-menu-is-cramped-with-new-features-enabled.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Improve layout of dropdowns in the metrics dashboard page
-merge_request: 31239
-author:
-type: fixed
diff --git a/changelogs/unreleased/64746-Commit-authors-avatar-sretched-in-commit-view-if-no-image-is-loaded.yml b/changelogs/unreleased/64746-Commit-authors-avatar-sretched-in-commit-view-if-no-image-is-loaded.yml
deleted file mode 100644
index fb0f4cedc62..00000000000
--- a/changelogs/unreleased/64746-Commit-authors-avatar-sretched-in-commit-view-if-no-image-is-loaded.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fixed distorted avatars when resource not reachable
-merge_request: 30904
-author: Marc Schwede
-type: other
diff --git a/changelogs/unreleased/64763-fix-tags-page-layout.yml b/changelogs/unreleased/64763-fix-tags-page-layout.yml
deleted file mode 100644
index db6b1f31506..00000000000
--- a/changelogs/unreleased/64763-fix-tags-page-layout.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix tag page layout
-merge_request:
-author:
-type: fixed
diff --git a/changelogs/unreleased/64831-add-padding-to-merged-by-widget.yml b/changelogs/unreleased/64831-add-padding-to-merged-by-widget.yml
deleted file mode 100644
index 2a45eec78ef..00000000000
--- a/changelogs/unreleased/64831-add-padding-to-merged-by-widget.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add space to "merged by" widget
-merge_request: 30972
-author:
-type: fixed
diff --git a/changelogs/unreleased/64950-move-download-csv-button-functionality-in-metrics-dashboard-cards-i.yml b/changelogs/unreleased/64950-move-download-csv-button-functionality-in-metrics-dashboard-cards-i.yml
deleted file mode 100644
index 21771c76873..00000000000
--- a/changelogs/unreleased/64950-move-download-csv-button-functionality-in-metrics-dashboard-cards-i.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: 'feat: adds a download to csv functionality to the dropdown in prometheus metrics'
-merge_request: 31679
-author:
-type: changed
diff --git a/changelogs/unreleased/64972-fix-unicorn-workers-metric.yml b/changelogs/unreleased/64972-fix-unicorn-workers-metric.yml
deleted file mode 100644
index f80111f0bd9..00000000000
--- a/changelogs/unreleased/64972-fix-unicorn-workers-metric.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix pid discovery for Unicorn processes in `PidProvider`
-merge_request: 31056
-author:
-type: fixed
diff --git a/changelogs/unreleased/64974-remove-livesum-from-ruby-sampler-metrics.yml b/changelogs/unreleased/64974-remove-livesum-from-ruby-sampler-metrics.yml
deleted file mode 100644
index 4fa3b7783c5..00000000000
--- a/changelogs/unreleased/64974-remove-livesum-from-ruby-sampler-metrics.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove :livesum from RubySampler metrics
-merge_request: 31047
-author:
-type: fixed
diff --git a/changelogs/unreleased/65088-incorrect-message-interpolation-on-project-listing.yml b/changelogs/unreleased/65088-incorrect-message-interpolation-on-project-listing.yml
deleted file mode 100644
index dd74b8443bc..00000000000
--- a/changelogs/unreleased/65088-incorrect-message-interpolation-on-project-listing.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix incorrect use of message interpolation
-merge_request: 31121
-author:
-type: fixed
diff --git a/changelogs/unreleased/65263-manual-action.yml b/changelogs/unreleased/65263-manual-action.yml
deleted file mode 100644
index 47b2a2ed329..00000000000
--- a/changelogs/unreleased/65263-manual-action.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Hides loading spinner in pipelines actions after request has been fullfiled
-merge_request:
-author:
-type: fixed
diff --git a/changelogs/unreleased/65278-fix-puma-master-counter-wipe.yml b/changelogs/unreleased/65278-fix-puma-master-counter-wipe.yml
deleted file mode 100644
index fb9d6fa251d..00000000000
--- a/changelogs/unreleased/65278-fix-puma-master-counter-wipe.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix active metric files being wiped after the app starts
-merge_request: 31668
-author:
-type: fixed
diff --git a/changelogs/unreleased/65483-add-a-resend-confirmation-link.yml b/changelogs/unreleased/65483-add-a-resend-confirmation-link.yml
deleted file mode 100644
index a5f62dbcd56..00000000000
--- a/changelogs/unreleased/65483-add-a-resend-confirmation-link.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Allow users to resend a confirmation link when the grace period has expired
-merge_request: 31476
-author:
-type: changed
diff --git a/changelogs/unreleased/65530-add-externalization-and-fix-regression-in-shortcuts-helper-modal.yml b/changelogs/unreleased/65530-add-externalization-and-fix-regression-in-shortcuts-helper-modal.yml
deleted file mode 100644
index fc29a514c42..00000000000
--- a/changelogs/unreleased/65530-add-externalization-and-fix-regression-in-shortcuts-helper-modal.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Fixed display of some sections and externalized all text in the shortcuts modal
-  overlay
-merge_request: 31594
-author:
-type: fixed
diff --git a/changelogs/unreleased/65660-update-karma-to-4-2-0.yml b/changelogs/unreleased/65660-update-karma-to-4-2-0.yml
deleted file mode 100644
index c0cb40ce169..00000000000
--- a/changelogs/unreleased/65660-update-karma-to-4-2-0.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update karma to 4.2.0
-merge_request: 31495
-author: Takuya Noguchi
-type: other
diff --git a/changelogs/unreleased/65671-update-mini_magick-to-4-9-5.yml b/changelogs/unreleased/65671-update-mini_magick-to-4-9-5.yml
deleted file mode 100644
index a6f8576ae0b..00000000000
--- a/changelogs/unreleased/65671-update-mini_magick-to-4-9-5.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update mini_magick to 4.9.5
-merge_request: 31505
-author: Takuya Noguchi
-type: security
diff --git a/changelogs/unreleased/65700-document-max-replication-slots-pg-ha.yml b/changelogs/unreleased/65700-document-max-replication-slots-pg-ha.yml
deleted file mode 100644
index bacc3f5fc11..00000000000
--- a/changelogs/unreleased/65700-document-max-replication-slots-pg-ha.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add max_replication_slots to PG HA documentation
-merge_request: 31534
-author:
-type: other
diff --git a/changelogs/unreleased/65705-two-buttons.yml b/changelogs/unreleased/65705-two-buttons.yml
deleted file mode 100644
index b92e28f9d68..00000000000
--- a/changelogs/unreleased/65705-two-buttons.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Prevent duplicated trigger action button
-merge_request:
-author:
-type: fixed
diff --git a/changelogs/unreleased/65790-highlight.yml b/changelogs/unreleased/65790-highlight.yml
deleted file mode 100644
index 2531a3730ed..00000000000
--- a/changelogs/unreleased/65790-highlight.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Adds highlight to the collapsible section
-merge_request:
-author:
-type: added
diff --git a/changelogs/unreleased/65803-invalidate-branches-cache-on-refresh.yml b/changelogs/unreleased/65803-invalidate-branches-cache-on-refresh.yml
deleted file mode 100644
index 217db8aa05a..00000000000
--- a/changelogs/unreleased/65803-invalidate-branches-cache-on-refresh.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Invalidate branches cache on PostReceive
-merge_request: 31653
-author:
-type: fixed
diff --git a/changelogs/unreleased/66008-fix-project-image-in-slack-notifications.yml b/changelogs/unreleased/66008-fix-project-image-in-slack-notifications.yml
deleted file mode 100644
index df0ac649ac1..00000000000
--- a/changelogs/unreleased/66008-fix-project-image-in-slack-notifications.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix project avatar image in Slack pipeline notifications
-merge_request: 31788
-author:
-type: fixed
diff --git a/changelogs/unreleased/66023-starrers-count-do-not-match-after-searching.yml b/changelogs/unreleased/66023-starrers-count-do-not-match-after-searching.yml
deleted file mode 100644
index 1caa5fa84ce..00000000000
--- a/changelogs/unreleased/66023-starrers-count-do-not-match-after-searching.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix starrers counts after searching
-merge_request: 31823
-author:
-type: fixed
diff --git a/changelogs/unreleased/FixLocaleEN.yml b/changelogs/unreleased/FixLocaleEN.yml
deleted file mode 100644
index 49738a6d127..00000000000
--- a/changelogs/unreleased/FixLocaleEN.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove duplicated mapping key in config/locales/en.yml
-merge_request: 30980
-author: Peter Dave Hello
-type: fixed
diff --git a/changelogs/unreleased/GL-12412.yml b/changelogs/unreleased/GL-12412.yml
deleted file mode 100644
index 304bd63d150..00000000000
--- a/changelogs/unreleased/GL-12412.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add DS_PIP_DEPENDENCY_PATH option to configure Dependency Scanning for projects using pip.
-merge_request: 30762
-author:
-type: changed
diff --git a/changelogs/unreleased/GL-12757.yml b/changelogs/unreleased/GL-12757.yml
deleted file mode 100644
index e58ecf9259f..00000000000
--- a/changelogs/unreleased/GL-12757.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update the container scanning CI template to use v12 of the clair scanner.
-merge_request: 30809
-author:
-type: changed
diff --git a/changelogs/unreleased/ab-add-index-on-environments.yml b/changelogs/unreleased/ab-add-index-on-environments.yml
deleted file mode 100644
index 6c7641912f4..00000000000
--- a/changelogs/unreleased/ab-add-index-on-environments.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Create index on environments by state
-merge_request: 31231
-author:
-type: performance
diff --git a/changelogs/unreleased/ab-count-strategies.yml b/changelogs/unreleased/ab-count-strategies.yml
deleted file mode 100644
index bd95ff45d6f..00000000000
--- a/changelogs/unreleased/ab-count-strategies.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Use tablesample approximate counting by default.
-merge_request: 31048
-author:
-type: performance
diff --git a/changelogs/unreleased/add-caching-to-archive-endpoint.yml b/changelogs/unreleased/add-caching-to-archive-endpoint.yml
deleted file mode 100644
index 770ec16e804..00000000000
--- a/changelogs/unreleased/add-caching-to-archive-endpoint.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Return an ETag header for the archive endpoint
-merge_request: 30581
-author:
-type: added
diff --git a/changelogs/unreleased/add-git-blame-api.yml b/changelogs/unreleased/add-git-blame-api.yml
deleted file mode 100644
index cdb77041433..00000000000
--- a/changelogs/unreleased/add-git-blame-api.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add git blame to GitLab API
-merge_request: 30675
-author: Oleg Zubchenko
-type: added
diff --git a/changelogs/unreleased/add-outbound-requests-whitelist-for-local-networks.yml b/changelogs/unreleased/add-outbound-requests-whitelist-for-local-networks.yml
deleted file mode 100644
index 9b50175f536..00000000000
--- a/changelogs/unreleased/add-outbound-requests-whitelist-for-local-networks.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add Outbound requests whitelist for local networks
-merge_request: 30350
-author: Istvan Szalai
-type: added
diff --git a/changelogs/unreleased/add-release-to-github-importer.yml b/changelogs/unreleased/add-release-to-github-importer.yml
deleted file mode 100644
index d11e7c725f7..00000000000
--- a/changelogs/unreleased/add-release-to-github-importer.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add a field for released_at to GH importer
-merge_request: 31496
-author:
-type: fixed
diff --git a/changelogs/unreleased/add-support-for-start-sha-to-commits-api.yml b/changelogs/unreleased/add-support-for-start-sha-to-commits-api.yml
deleted file mode 100644
index f810c2c5ada..00000000000
--- a/changelogs/unreleased/add-support-for-start-sha-to-commits-api.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add support for start_sha to commits API
-merge_request: 29598
-author:
-type: changed
diff --git a/changelogs/unreleased/adjust-group-level-analytics-to-accept-multiple-ids.yml b/changelogs/unreleased/adjust-group-level-analytics-to-accept-multiple-ids.yml
deleted file mode 100644
index 5e138e1059c..00000000000
--- a/changelogs/unreleased/adjust-group-level-analytics-to-accept-multiple-ids.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Adjust group level analytics to accept multiple ids
-merge_request: 30744
-author:
-type: added
diff --git a/changelogs/unreleased/alipniagov-fix-wiki_can_not_be_created_total-counter.yml b/changelogs/unreleased/alipniagov-fix-wiki_can_not_be_created_total-counter.yml
deleted file mode 100644
index 58f969ed742..00000000000
--- a/changelogs/unreleased/alipniagov-fix-wiki_can_not_be_created_total-counter.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix :wiki_can_not_be_created_total counter
-merge_request: 31673
-author:
-type: fixed
diff --git a/changelogs/unreleased/allow-all-users-to-see-history.yml b/changelogs/unreleased/allow-all-users-to-see-history.yml
deleted file mode 100644
index 7423fa079cc..00000000000
--- a/changelogs/unreleased/allow-all-users-to-see-history.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Align access permissions for wiki history to those of wiki pages
-merge_request: 30470
-type: fixed
diff --git a/changelogs/unreleased/an-sidekiq-chaos.yml b/changelogs/unreleased/an-sidekiq-chaos.yml
deleted file mode 100644
index cede35c95cc..00000000000
--- a/changelogs/unreleased/an-sidekiq-chaos.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Adds chaos endpoints to Sidekiq
-merge_request: 30814
-author:
-type: other
diff --git a/changelogs/unreleased/an-sidekiq-scheduling_latency.yml b/changelogs/unreleased/an-sidekiq-scheduling_latency.yml
deleted file mode 100644
index 2d6f462745e..00000000000
--- a/changelogs/unreleased/an-sidekiq-scheduling_latency.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Adds Sidekiq scheduling latency structured logging field
-merge_request: 30784
-author:
-type: other
diff --git a/changelogs/unreleased/bjk-64064_cache_metrics.yml b/changelogs/unreleased/bjk-64064_cache_metrics.yml
deleted file mode 100644
index c9baff7cb7b..00000000000
--- a/changelogs/unreleased/bjk-64064_cache_metrics.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Adjust redis cache metrics
-merge_request: 30572
-author:
-type: changed
diff --git a/changelogs/unreleased/bjk-usage_ping.yml b/changelogs/unreleased/bjk-usage_ping.yml
deleted file mode 100644
index dee6c1ad291..00000000000
--- a/changelogs/unreleased/bjk-usage_ping.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update usage ping cron behavior
-merge_request: 30842
-author:
-type: performance
diff --git a/changelogs/unreleased/bring-scoped-environment-variables-to-core.yml b/changelogs/unreleased/bring-scoped-environment-variables-to-core.yml
deleted file mode 100644
index 48dfe662206..00000000000
--- a/changelogs/unreleased/bring-scoped-environment-variables-to-core.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Bring scoped environment variables to core
-merge_request: 30779
-author:
-type: changed
diff --git a/changelogs/unreleased/bump_helm_kubectl_gitlab.yml b/changelogs/unreleased/bump_helm_kubectl_gitlab.yml
deleted file mode 100644
index d768462e130..00000000000
--- a/changelogs/unreleased/bump_helm_kubectl_gitlab.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Bump Helm to 2.14.3 and kubectl to 1.11.10 for Kubernetes integration
-merge_request: 31716
-author:
-type: other
diff --git a/changelogs/unreleased/bvl-mark-remote-mirrors-as-failed-sooner.yml b/changelogs/unreleased/bvl-mark-remote-mirrors-as-failed-sooner.yml
deleted file mode 100644
index 1db0a4952b2..00000000000
--- a/changelogs/unreleased/bvl-mark-remote-mirrors-as-failed-sooner.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Mark push mirrors as failed after 1 hour
-merge_request: 30999
-author:
-type: changed
diff --git a/changelogs/unreleased/bvl-remote-mirror-exception-handling.yml b/changelogs/unreleased/bvl-remote-mirror-exception-handling.yml
deleted file mode 100644
index 962376086b0..00000000000
--- a/changelogs/unreleased/bvl-remote-mirror-exception-handling.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Retry push mirrors faster when running concurrently, improve error handling
-  when push mirrors fail
-merge_request: 31247
-author:
-type: changed
diff --git a/changelogs/unreleased/bw-add-index-for-relative-position.yml b/changelogs/unreleased/bw-add-index-for-relative-position.yml
deleted file mode 100644
index 80ca20992e6..00000000000
--- a/changelogs/unreleased/bw-add-index-for-relative-position.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add index for issues on relative position, project, and state for manual sorting
-merge_request: 30542
-author:
-type: fixed
diff --git a/changelogs/unreleased/ce-xanf-add-links-to-admin-area.yml b/changelogs/unreleased/ce-xanf-add-links-to-admin-area.yml
deleted file mode 100644
index 9eb692c948b..00000000000
--- a/changelogs/unreleased/ce-xanf-add-links-to-admin-area.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add links to relevant configuration areas in admin area overview
-merge_request: 29306
-author:
-type: added
diff --git a/changelogs/unreleased/dblessing-fix-admin-user-radio-labels.yml b/changelogs/unreleased/dblessing-fix-admin-user-radio-labels.yml
deleted file mode 100644
index 4f119d46a1f..00000000000
--- a/changelogs/unreleased/dblessing-fix-admin-user-radio-labels.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix admin area user access level radio button labels
-merge_request: 31154
-author:
-type: fixed
diff --git a/changelogs/unreleased/dblessing-fix-public-project-ssh-only-ci-failure.yml b/changelogs/unreleased/dblessing-fix-public-project-ssh-only-ci-failure.yml
deleted file mode 100644
index 615a1571e95..00000000000
--- a/changelogs/unreleased/dblessing-fix-public-project-ssh-only-ci-failure.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Allow CI to clone public projects when HTTP protocol is disabled
-merge_request: 31632
-author:
-type: fixed
diff --git a/changelogs/unreleased/delete-designs-v2.yml b/changelogs/unreleased/delete-designs-v2.yml
deleted file mode 100644
index a678e4f93b9..00000000000
--- a/changelogs/unreleased/delete-designs-v2.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Adds event enum column to DesignsVersions join table
-merge_request: 30745
-type: added
diff --git a/changelogs/unreleased/dm-process-commit-worker-n-1.yml b/changelogs/unreleased/dm-process-commit-worker-n-1.yml
deleted file mode 100644
index 0bd7de6730a..00000000000
--- a/changelogs/unreleased/dm-process-commit-worker-n-1.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Look up upstream commits once before queuing ProcessCommitWorkers
-merge_request:
-author:
-type: performance
diff --git a/changelogs/unreleased/double-slash-64592.yml b/changelogs/unreleased/double-slash-64592.yml
deleted file mode 100644
index e3b5b197ac5..00000000000
--- a/changelogs/unreleased/double-slash-64592.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Prevent double slash in review apps path
-merge_request: 31212
-author:
-type: fixed
diff --git a/changelogs/unreleased/enable-specific-embeds.yml b/changelogs/unreleased/enable-specific-embeds.yml
deleted file mode 100644
index f2e591621a8..00000000000
--- a/changelogs/unreleased/enable-specific-embeds.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Enable embedding of specific metrics charts in GFM
-merge_request: 31304
-author:
-type: added
diff --git a/changelogs/unreleased/extract_auto_deploy_into_base_image.yml b/changelogs/unreleased/extract_auto_deploy_into_base_image.yml
deleted file mode 100644
index ff0d1f3bd71..00000000000
--- a/changelogs/unreleased/extract_auto_deploy_into_base_image.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Extract Auto DevOps deploy functions into a base image
-merge_request: 30404
-author:
-type: changed
diff --git a/changelogs/unreleased/fe-delete-old-boardservice.yml b/changelogs/unreleased/fe-delete-old-boardservice.yml
deleted file mode 100644
index bb06bfe80d5..00000000000
--- a/changelogs/unreleased/fe-delete-old-boardservice.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Change BoardService in favor of boardsStore on board blank state of the component
-  board
-merge_request: 30546
-author: eduarmreyes
-type: other
diff --git a/changelogs/unreleased/feat-add-support-page-link-in-help-menu.yml b/changelogs/unreleased/feat-add-support-page-link-in-help-menu.yml
deleted file mode 100644
index 2cddd52212e..00000000000
--- a/changelogs/unreleased/feat-add-support-page-link-in-help-menu.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add admin-configurable "Support page URL" link to top Help dropdown menu
-merge_request: 30459
-author: Diego Louzán
-type: added
diff --git a/changelogs/unreleased/feature-gb-serverless-app-deployment-template.yml b/changelogs/unreleased/feature-gb-serverless-app-deployment-template.yml
deleted file mode 100644
index bd9001bd671..00000000000
--- a/changelogs/unreleased/feature-gb-serverless-app-deployment-template.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Deploy serverless apps with gitlabktl
-merge_request: 30740
-author:
-type: added
diff --git a/changelogs/unreleased/filter-title-description-and-body-from-logs.yml b/changelogs/unreleased/filter-title-description-and-body-from-logs.yml
deleted file mode 100644
index 8b592790629..00000000000
--- a/changelogs/unreleased/filter-title-description-and-body-from-logs.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Filter title, description, and body parameters from logs
-merge_request:
-author:
-type: changed
diff --git a/changelogs/unreleased/fix-alignment-on-security-reports.yml b/changelogs/unreleased/fix-alignment-on-security-reports.yml
deleted file mode 100644
index 5339b6d764d..00000000000
--- a/changelogs/unreleased/fix-alignment-on-security-reports.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fixes alignment issues with reports
-merge_request: 30839
-author:
-type: fixed
diff --git a/changelogs/unreleased/fix-bin-web-puma-script-to-consider-rails-env.yml b/changelogs/unreleased/fix-bin-web-puma-script-to-consider-rails-env.yml
deleted file mode 100644
index a0564369b02..00000000000
--- a/changelogs/unreleased/fix-bin-web-puma-script-to-consider-rails-env.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Make `bin/web_puma` consider RAILS_ENV
-merge_request: 31378
-author:
-type: fixed
diff --git a/changelogs/unreleased/fix-commits-api-empty-refname.yml b/changelogs/unreleased/fix-commits-api-empty-refname.yml
deleted file mode 100644
index efdb950e45d..00000000000
--- a/changelogs/unreleased/fix-commits-api-empty-refname.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix 500 errors in commits api caused by empty ref_name parameter
-merge_request:
-author:
-type: fixed
diff --git a/changelogs/unreleased/fix-job-log-formatting.yml b/changelogs/unreleased/fix-job-log-formatting.yml
deleted file mode 100644
index 0dd545aaecc..00000000000
--- a/changelogs/unreleased/fix-job-log-formatting.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix job logs where style changes were broken down into separate lines
-merge_request: 31674
-author:
-type: fixed
diff --git a/changelogs/unreleased/fix-name-vs-path-problem-for-cycle-analytics.yml b/changelogs/unreleased/fix-name-vs-path-problem-for-cycle-analytics.yml
deleted file mode 100644
index 7d171c2cf5b..00000000000
--- a/changelogs/unreleased/fix-name-vs-path-problem-for-cycle-analytics.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix broken issue links and possible 500 error on cycle analytics page when project name and path are different
-merge_request: 31471
-author:
-type: fixed
diff --git a/changelogs/unreleased/fj-avoid-incresaing-usage-ping-when-not-enabled.yml b/changelogs/unreleased/fj-avoid-incresaing-usage-ping-when-not-enabled.yml
deleted file mode 100644
index f1077f2d56d..00000000000
--- a/changelogs/unreleased/fj-avoid-incresaing-usage-ping-when-not-enabled.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Avoid increasing redis counters when usage_ping is disabled
-merge_request: 30949
-author:
-type: changed
diff --git a/changelogs/unreleased/fj-count-web-ide-merge-requests.yml b/changelogs/unreleased/fj-count-web-ide-merge-requests.yml
deleted file mode 100644
index adcd0af37e8..00000000000
--- a/changelogs/unreleased/fj-count-web-ide-merge-requests.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add Web IDE Usage Ping for Create SMAU
-merge_request: 30800
-author:
-type: changed
diff --git a/changelogs/unreleased/fj-navbar-searches-usage-ping-counter.yml b/changelogs/unreleased/fj-navbar-searches-usage-ping-counter.yml
deleted file mode 100644
index ab7c1697fd6..00000000000
--- a/changelogs/unreleased/fj-navbar-searches-usage-ping-counter.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Added navbar searches usage ping counter
-merge_request: 30953
-author:
-type: changed
diff --git a/changelogs/unreleased/georgekoltsov-48854-fix-empty-flash-message.yml b/changelogs/unreleased/georgekoltsov-48854-fix-empty-flash-message.yml
deleted file mode 100644
index e28dbd6f0c4..00000000000
--- a/changelogs/unreleased/georgekoltsov-48854-fix-empty-flash-message.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Fix empty error flash message on profile:account page when updating username
-  with username that has already been taken
-merge_request: 31809
-author:
-type: fixed
diff --git a/changelogs/unreleased/georgekoltsov-51260-add-filtering-to-bitbucket-server-import.yml b/changelogs/unreleased/georgekoltsov-51260-add-filtering-to-bitbucket-server-import.yml
deleted file mode 100644
index c455b4cf642..00000000000
--- a/changelogs/unreleased/georgekoltsov-51260-add-filtering-to-bitbucket-server-import.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add BitBucketServer project import filtering
-merge_request: 31420
-author:
-type: added
diff --git a/changelogs/unreleased/georgekoltsov-55474-outbound-setting-system-hooks.yml b/changelogs/unreleased/georgekoltsov-55474-outbound-setting-system-hooks.yml
deleted file mode 100644
index fb1acb1e9f5..00000000000
--- a/changelogs/unreleased/georgekoltsov-55474-outbound-setting-system-hooks.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add new outbound network requests application setting for system hooks
-merge_request: 31177
-author:
-type: added
diff --git a/changelogs/unreleased/georgekoltsov-63408-user-mapping.yml b/changelogs/unreleased/georgekoltsov-63408-user-mapping.yml
deleted file mode 100644
index 451aac9c2e3..00000000000
--- a/changelogs/unreleased/georgekoltsov-63408-user-mapping.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: 'Fix missing author line (`Created by: <user>`) in MRs/issues/comments of imported Bitbucket Cloud project'
-merge_request: 31579
-author:
-type: fixed
diff --git a/changelogs/unreleased/georgekoltsov-64311-set-visibility-private-if-internal-restricted.yml b/changelogs/unreleased/georgekoltsov-64311-set-visibility-private-if-internal-restricted.yml
deleted file mode 100644
index 18af16e5216..00000000000
--- a/changelogs/unreleased/georgekoltsov-64311-set-visibility-private-if-internal-restricted.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Set visibility level 'Private' for restricted 'Internal' imported projects when 'Internal' visibility setting is restricted in admin settings
-merge_request: 30522
-author:
-type: other
diff --git a/changelogs/unreleased/georgekoltsov-64377-add-better-log-msg-to-members-mapper.yml b/changelogs/unreleased/georgekoltsov-64377-add-better-log-msg-to-members-mapper.yml
deleted file mode 100644
index 9557e633f76..00000000000
--- a/changelogs/unreleased/georgekoltsov-64377-add-better-log-msg-to-members-mapper.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: When GitLab import fails during importer user mapping step, add an explicit
-  error message mentioning importer
-merge_request: 30838
-author:
-type: other
diff --git a/changelogs/unreleased/gitaly-version-v1.57.0.yml b/changelogs/unreleased/gitaly-version-v1.57.0.yml
deleted file mode 100644
index 65596199e16..00000000000
--- a/changelogs/unreleased/gitaly-version-v1.57.0.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Upgrade to Gitaly v1.57.0
-merge_request: 31568
-author:
-type: changed
diff --git a/changelogs/unreleased/gitaly-version-v1.59.0.yml b/changelogs/unreleased/gitaly-version-v1.59.0.yml
deleted file mode 100644
index d103f6b248e..00000000000
--- a/changelogs/unreleased/gitaly-version-v1.59.0.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Upgrade to Gitaly v1.59.0
-merge_request: 31743
-author:
-type: changed
diff --git a/changelogs/unreleased/group-milestones-dashboard-blunceford.yml b/changelogs/unreleased/group-milestones-dashboard-blunceford.yml
deleted file mode 100644
index a6ded27cb8c..00000000000
--- a/changelogs/unreleased/group-milestones-dashboard-blunceford.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix bug in dashboard display of closed milestones
-merge_request: 30820
-author:
-type: fixed
diff --git a/changelogs/unreleased/id-mr-widget-etag-caching.yml b/changelogs/unreleased/id-mr-widget-etag-caching.yml
deleted file mode 100644
index 69bf89991d4..00000000000
--- a/changelogs/unreleased/id-mr-widget-etag-caching.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Split MR widget into etag-cached and non-cached serializers
-merge_request: 31354
-author:
-type: performance
diff --git a/changelogs/unreleased/id-source-code-smau.yml b/changelogs/unreleased/id-source-code-smau.yml
deleted file mode 100644
index 6ba5068544e..00000000000
--- a/changelogs/unreleased/id-source-code-smau.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add usage pings for source code pushes
-merge_request: 31734
-author:
-type: added
diff --git a/changelogs/unreleased/implement-dag.yml b/changelogs/unreleased/implement-dag.yml
deleted file mode 100644
index 72f3f9a510c..00000000000
--- a/changelogs/unreleased/implement-dag.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: "Support creating DAGs in CI config through the `needs` key"
-merge_request: 31328
-author:
-type: added
diff --git a/changelogs/unreleased/improve-quick-action-messages.yml b/changelogs/unreleased/improve-quick-action-messages.yml
deleted file mode 100644
index 86f8c251860..00000000000
--- a/changelogs/unreleased/improve-quick-action-messages.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Improve quick action error messages
-merge_request: 31451
-author:
-type: other
diff --git a/changelogs/unreleased/issue-61873-no-error-message-for-general-settings.yml b/changelogs/unreleased/issue-61873-no-error-message-for-general-settings.yml
deleted file mode 100644
index 606c60721b8..00000000000
--- a/changelogs/unreleased/issue-61873-no-error-message-for-general-settings.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: error message for general settings
-merge_request: 31636
-author: Mesut Güneş
-type: fixed
diff --git a/changelogs/unreleased/issue_58494.yml b/changelogs/unreleased/issue_58494.yml
deleted file mode 100644
index c74768fc020..00000000000
--- a/changelogs/unreleased/issue_58494.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Prevent turning plain links into embedded when moving issues
-merge_request: 31489
-author:
-type: fixed
diff --git a/changelogs/unreleased/je-separate-namespace-fe.yml b/changelogs/unreleased/je-separate-namespace-fe.yml
deleted file mode 100644
index fb6be071eb6..00000000000
--- a/changelogs/unreleased/je-separate-namespace-fe.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update namespace label for GitLab-managed clusters
-merge_request: 30935
-author:
-type: added
diff --git a/changelogs/unreleased/jivanvl-add-chart-empty-state.yml b/changelogs/unreleased/jivanvl-add-chart-empty-state.yml
deleted file mode 100644
index 7b81ee82582..00000000000
--- a/changelogs/unreleased/jivanvl-add-chart-empty-state.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add empty chart component
-merge_request: 30682
-author:
-type: fixed
diff --git a/changelogs/unreleased/jprovazn-fix-positioning.yml b/changelogs/unreleased/jprovazn-fix-positioning.yml
deleted file mode 100644
index 5d703008bba..00000000000
--- a/changelogs/unreleased/jprovazn-fix-positioning.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Optimize relative re-positioning when moving issues.
-merge_request: 30938
-author:
-type: fixed
diff --git a/changelogs/unreleased/jprovazn-project-search.yml b/changelogs/unreleased/jprovazn-project-search.yml
deleted file mode 100644
index f76d4858924..00000000000
--- a/changelogs/unreleased/jprovazn-project-search.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Order projects in 'Move issue' dropdown by name.
-merge_request: 30778
-author:
-type: fixed
diff --git a/changelogs/unreleased/jramsay-fix-mirroring-help-text-typo.yml b/changelogs/unreleased/jramsay-fix-mirroring-help-text-typo.yml
deleted file mode 100644
index 4c049dffc58..00000000000
--- a/changelogs/unreleased/jramsay-fix-mirroring-help-text-typo.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix mirroring help text
-merge_request: 31348
-author: jramsay
-type: other
diff --git a/changelogs/unreleased/jupyter-fixes-v1.yml b/changelogs/unreleased/jupyter-fixes-v1.yml
deleted file mode 100644
index 7a34f273c90..00000000000
--- a/changelogs/unreleased/jupyter-fixes-v1.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Jupyter fixes
-merge_request: 31332
-author: Amit Rathi
-type: fixed
diff --git a/changelogs/unreleased/khair1-master-patch-79459.yml b/changelogs/unreleased/khair1-master-patch-79459.yml
deleted file mode 100644
index 22b0877336d..00000000000
--- a/changelogs/unreleased/khair1-master-patch-79459.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update Packer.gitlab-ci.yml to use latest image
-merge_request:
-author: Kelly Hair
-type: other
diff --git a/changelogs/unreleased/label-descr-push-opts.yml b/changelogs/unreleased/label-descr-push-opts.yml
deleted file mode 100644
index 9b01cfdaed2..00000000000
--- a/changelogs/unreleased/label-descr-push-opts.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Support setting of merge request title and description using git push options
-merge_request: 31068
-author:
-type: added
diff --git a/changelogs/unreleased/lm-download-csv-of-charts-from-metrics-dashboard.yml b/changelogs/unreleased/lm-download-csv-of-charts-from-metrics-dashboard.yml
deleted file mode 100644
index 59f12fca1f1..00000000000
--- a/changelogs/unreleased/lm-download-csv-of-charts-from-metrics-dashboard.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Export and download CSV from metrics charts
-merge_request: 30760
-author:
-type: added
diff --git a/changelogs/unreleased/load-search-counts-async.yml b/changelogs/unreleased/load-search-counts-async.yml
deleted file mode 100644
index 1f466450e76..00000000000
--- a/changelogs/unreleased/load-search-counts-async.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Load search result counts asynchronously
-merge_request: 31663
-author:
-type: changed
diff --git a/changelogs/unreleased/maintainers-can-create-subgroup.yml b/changelogs/unreleased/maintainers-can-create-subgroup.yml
deleted file mode 100644
index 180f0f7247f..00000000000
--- a/changelogs/unreleased/maintainers-can-create-subgroup.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Maintainers can create subgroups
-merge_request: 29718
-author: Fabio Papa
-type: changed
diff --git a/changelogs/unreleased/mc-feature-add-at-colon-variable-masking.yml b/changelogs/unreleased/mc-feature-add-at-colon-variable-masking.yml
deleted file mode 100644
index 9b8eff8e043..00000000000
--- a/changelogs/unreleased/mc-feature-add-at-colon-variable-masking.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: 'Allows masking @ and : characters.'
-merge_request: 31065
-author:
-type: changed
diff --git a/changelogs/unreleased/mc-feature-manual-job-variables.yml b/changelogs/unreleased/mc-feature-manual-job-variables.yml
deleted file mode 100644
index a71cabfe303..00000000000
--- a/changelogs/unreleased/mc-feature-manual-job-variables.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Allow specifying variables when running manual jobs
-merge_request: 30485
-author:
-type: added
diff --git a/changelogs/unreleased/new-cycle-analytics-backend-migrations.yml b/changelogs/unreleased/new-cycle-analytics-backend-migrations.yml
deleted file mode 100644
index d56a07fe569..00000000000
--- a/changelogs/unreleased/new-cycle-analytics-backend-migrations.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Create database tables for the new cycle analytics backend
-merge_request: 31621
-author:
-type: other
diff --git a/changelogs/unreleased/optimize-note-indexes.yml b/changelogs/unreleased/optimize-note-indexes.yml
deleted file mode 100644
index bfb84779abf..00000000000
--- a/changelogs/unreleased/optimize-note-indexes.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Optimize DB indexes for ES indexing of notes
-merge_request: 31846
-author:
-type: performance
diff --git a/changelogs/unreleased/post-migrate-private-profile.yml b/changelogs/unreleased/post-migrate-private-profile.yml
deleted file mode 100644
index 53a55661aa0..00000000000
--- a/changelogs/unreleased/post-migrate-private-profile.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Migrate remaining users with null private_profile
-merge_request: 31708
-author:
-type: other
diff --git a/changelogs/unreleased/rails-template-update.yml b/changelogs/unreleased/rails-template-update.yml
deleted file mode 100644
index 53eb57c84ff..00000000000
--- a/changelogs/unreleased/rails-template-update.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update 'Ruby on Rails' project template
-merge_request: 31310
-author:
-type: other
diff --git a/changelogs/unreleased/remove-line-profile-from-performance-bar.yml b/changelogs/unreleased/remove-line-profile-from-performance-bar.yml
deleted file mode 100644
index c1c7450fbbd..00000000000
--- a/changelogs/unreleased/remove-line-profile-from-performance-bar.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove line profiler from performance bar
-merge_request:
-author:
-type: removed
diff --git a/changelogs/unreleased/remove-peek-gc.yml b/changelogs/unreleased/remove-peek-gc.yml
deleted file mode 100644
index 9412cd7c9a6..00000000000
--- a/changelogs/unreleased/remove-peek-gc.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove GC metrics from performance bar
-merge_request:
-author:
-type: removed
diff --git a/changelogs/unreleased/remove_deployment_metrics_deployment_platform_fallback.yml b/changelogs/unreleased/remove_deployment_metrics_deployment_platform_fallback.yml
deleted file mode 100644
index d32cbd1d8e0..00000000000
--- a/changelogs/unreleased/remove_deployment_metrics_deployment_platform_fallback.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Remove incorrect fallback when determining which cluster to use when retrieving
-  MR performance metrics
-merge_request: 31126
-author:
-type: changed
diff --git a/changelogs/unreleased/report-missing-job-dependency.yml b/changelogs/unreleased/report-missing-job-dependency.yml
deleted file mode 100644
index 660cdfc856e..00000000000
--- a/changelogs/unreleased/report-missing-job-dependency.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Default dependency job stage index to Infinity, and correctly report it as
-  undefined in prior stages
-merge_request: 31116
-author:
-type: fixed
diff --git a/changelogs/unreleased/rf-remove-group-overview-security-dashboard-feature-flag.yml b/changelogs/unreleased/rf-remove-group-overview-security-dashboard-feature-flag.yml
deleted file mode 100644
index f412ba11b91..00000000000
--- a/changelogs/unreleased/rf-remove-group-overview-security-dashboard-feature-flag.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove Security Dashboard feature flag
-merge_request: 31820
-author:
-type: other
diff --git a/changelogs/unreleased/rm-src-branch.yml b/changelogs/unreleased/rm-src-branch.yml
deleted file mode 100644
index 03b91d0c7db..00000000000
--- a/changelogs/unreleased/rm-src-branch.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Support remove source branch on merge w/ push options
-merge_request: 30728
-author:
-type: added
diff --git a/changelogs/unreleased/safe-archiving-for-traces.yml b/changelogs/unreleased/safe-archiving-for-traces.yml
deleted file mode 100644
index 2b9070bacfe..00000000000
--- a/changelogs/unreleased/safe-archiving-for-traces.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Extra logging for new live trace architecture
-merge_request: 30892
-author:
-type: fixed
diff --git a/changelogs/unreleased/security-2873-blocked-user-slash-command-bypass-master.yml b/changelogs/unreleased/security-2873-blocked-user-slash-command-bypass-master.yml
deleted file mode 100644
index cd31fe0f35c..00000000000
--- a/changelogs/unreleased/security-2873-blocked-user-slash-command-bypass-master.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Restrict slash commands to users who can log in
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/security-60551-fix-upload-scope.yml b/changelogs/unreleased/security-60551-fix-upload-scope.yml
deleted file mode 100644
index 7d7096833a7..00000000000
--- a/changelogs/unreleased/security-60551-fix-upload-scope.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Queries for Upload should be scoped by model
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/sh-add-cmaps-for-pdfjs.yml b/changelogs/unreleased/sh-add-cmaps-for-pdfjs.yml
deleted file mode 100644
index f4686484e33..00000000000
--- a/changelogs/unreleased/sh-add-cmaps-for-pdfjs.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Make pdf.js render CJK characters
-merge_request: 31220
-author:
-type: fixed
diff --git a/changelogs/unreleased/sh-add-gitaly-and-rugged-data-sidekiq.yml b/changelogs/unreleased/sh-add-gitaly-and-rugged-data-sidekiq.yml
deleted file mode 100644
index d2143e83045..00000000000
--- a/changelogs/unreleased/sh-add-gitaly-and-rugged-data-sidekiq.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add Gitaly and Rugged call timing in Sidekiq logs
-merge_request: 31651
-author:
-type: other
diff --git a/changelogs/unreleased/sh-add-index-extern-uid.yml b/changelogs/unreleased/sh-add-index-extern-uid.yml
deleted file mode 100644
index 531770237a8..00000000000
--- a/changelogs/unreleased/sh-add-index-extern-uid.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add partial index on identities table to speed up LDAP lookups
-merge_request: 26710
-author:
-type: performance
diff --git a/changelogs/unreleased/sh-add-missing-csp-report-uri.yml b/changelogs/unreleased/sh-add-missing-csp-report-uri.yml
deleted file mode 100644
index 656eb8e9c37..00000000000
--- a/changelogs/unreleased/sh-add-missing-csp-report-uri.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add missing report-uri to CSP config
-merge_request: 31593
-author:
-type: fixed
diff --git a/changelogs/unreleased/sh-add-rugged-logs.yml b/changelogs/unreleased/sh-add-rugged-logs.yml
deleted file mode 100644
index 1f464dd92ff..00000000000
--- a/changelogs/unreleased/sh-add-rugged-logs.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add Rugged calls and duration to API and Rails logs
-merge_request: 30871
-author:
-type: other
diff --git a/changelogs/unreleased/sh-add-rugged-to-peek.yml b/changelogs/unreleased/sh-add-rugged-to-peek.yml
deleted file mode 100644
index 8a030f3daf2..00000000000
--- a/changelogs/unreleased/sh-add-rugged-to-peek.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add Rugged calls to performance bar
-merge_request: 30983
-author:
-type: other
diff --git a/changelogs/unreleased/sh-break-out-invited-group-members.yml b/changelogs/unreleased/sh-break-out-invited-group-members.yml
deleted file mode 100644
index 091f1d48843..00000000000
--- a/changelogs/unreleased/sh-break-out-invited-group-members.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Make it easier to find invited group members
-merge_request: 28436
-author:
-type: fixed
diff --git a/changelogs/unreleased/sh-disable-redis-peek.yml b/changelogs/unreleased/sh-disable-redis-peek.yml
deleted file mode 100644
index de86c0031c7..00000000000
--- a/changelogs/unreleased/sh-disable-redis-peek.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Only track Redis calls if Peek is enabled
-merge_request: 31438
-author:
-type: performance
diff --git a/changelogs/unreleased/sh-disable-registry-delete.yml b/changelogs/unreleased/sh-disable-registry-delete.yml
deleted file mode 100644
index 180b983e07c..00000000000
--- a/changelogs/unreleased/sh-disable-registry-delete.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Don't attempt to contact registry if it is disabled
-merge_request: 31553
-author:
-type: fixed
diff --git a/changelogs/unreleased/sh-enable-bootsnap.yml b/changelogs/unreleased/sh-enable-bootsnap.yml
deleted file mode 100644
index 674a900ee01..00000000000
--- a/changelogs/unreleased/sh-enable-bootsnap.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Make Bootsnap available via ENABLE_BOOTSNAP=1
-merge_request: 30963
-author:
-type: performance
diff --git a/changelogs/unreleased/sh-fix-discussions-api-perf.yml b/changelogs/unreleased/sh-fix-discussions-api-perf.yml
deleted file mode 100644
index 8cdbbf03dab..00000000000
--- a/changelogs/unreleased/sh-fix-discussions-api-perf.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Eliminate many Gitaly calls in discussions API
-merge_request: 31834
-author:
-type: performance
diff --git a/changelogs/unreleased/sh-fix-import-export-suggestions.yml b/changelogs/unreleased/sh-fix-import-export-suggestions.yml
deleted file mode 100644
index 4b15fc3858f..00000000000
--- a/changelogs/unreleased/sh-fix-import-export-suggestions.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Properly save suggestions in project exports
-merge_request: 31690
-author:
-type: fixed
diff --git a/changelogs/unreleased/sh-fix-pipelines-not-being-created.yml b/changelogs/unreleased/sh-fix-pipelines-not-being-created.yml
deleted file mode 100644
index a6937eae588..00000000000
--- a/changelogs/unreleased/sh-fix-pipelines-not-being-created.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix pipelines not always being created after a push
-merge_request: 31927
-author:
-type: fixed
diff --git a/changelogs/unreleased/sh-fix-special-role-error-500.yml b/changelogs/unreleased/sh-fix-special-role-error-500.yml
deleted file mode 100644
index 9aed0710da3..00000000000
--- a/changelogs/unreleased/sh-fix-special-role-error-500.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix first-time contributor notes not rendering
-merge_request: 31340
-author:
-type: fixed
diff --git a/changelogs/unreleased/sh-ignore-git-errors-delete-project.yml b/changelogs/unreleased/sh-ignore-git-errors-delete-project.yml
deleted file mode 100644
index f5e2147f00e..00000000000
--- a/changelogs/unreleased/sh-ignore-git-errors-delete-project.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Ignore Gitaly errors if cache flushing fails on project destruction
-merge_request: 31164
-author:
-type: fixed
diff --git a/changelogs/unreleased/sh-make-githost-json.yml b/changelogs/unreleased/sh-make-githost-json.yml
deleted file mode 100644
index f4113a693cc..00000000000
--- a/changelogs/unreleased/sh-make-githost-json.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Convert githost.log to JSON format
-merge_request: 30967
-author:
-type: changed
diff --git a/changelogs/unreleased/sh-only-flush-tags-once-per-push.yml b/changelogs/unreleased/sh-only-flush-tags-once-per-push.yml
deleted file mode 100644
index 502fc22ebbd..00000000000
--- a/changelogs/unreleased/sh-only-flush-tags-once-per-push.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Only expire tag cache once per push
-merge_request: 31641
-author:
-type: performance
diff --git a/changelogs/unreleased/sh-optimize-commit-deltas-post-receive.yml b/changelogs/unreleased/sh-optimize-commit-deltas-post-receive.yml
deleted file mode 100644
index cd63b9bf425..00000000000
--- a/changelogs/unreleased/sh-optimize-commit-deltas-post-receive.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Reduce Gitaly calls in PostReceive
-merge_request: 31741
-author:
-type: performance
diff --git a/changelogs/unreleased/sh-post-receive-cache-clear-once.yml b/changelogs/unreleased/sh-post-receive-cache-clear-once.yml
deleted file mode 100644
index b677adf78d9..00000000000
--- a/changelogs/unreleased/sh-post-receive-cache-clear-once.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Expire project caches once per push instead of once per ref
-merge_request: 31876
-author:
-type: performance
diff --git a/changelogs/unreleased/sh-remove-pdfjs-deprecations.yml b/changelogs/unreleased/sh-remove-pdfjs-deprecations.yml
deleted file mode 100644
index a00ceedf3f4..00000000000
--- a/changelogs/unreleased/sh-remove-pdfjs-deprecations.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove pdf.js deprecation warnings
-merge_request: 31253
-author:
-type: fixed
diff --git a/changelogs/unreleased/sh-rename-githost-to-gitjson.yml b/changelogs/unreleased/sh-rename-githost-to-gitjson.yml
deleted file mode 100644
index 24fcd1e9781..00000000000
--- a/changelogs/unreleased/sh-rename-githost-to-gitjson.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Rename githost.log -> git_json.log
-merge_request: 31634
-author:
-type: changed
diff --git a/changelogs/unreleased/sh-support-csp-nonce.yml b/changelogs/unreleased/sh-support-csp-nonce.yml
deleted file mode 100644
index 3e6ac1e4a32..00000000000
--- a/changelogs/unreleased/sh-support-csp-nonce.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add support for Content-Security-Policy
-merge_request: 31402
-author:
-type: added
diff --git a/changelogs/unreleased/sh-update-mermaid.yml b/changelogs/unreleased/sh-update-mermaid.yml
deleted file mode 100644
index 58d94ec6235..00000000000
--- a/changelogs/unreleased/sh-update-mermaid.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update Mermaid to v8.2.3
-merge_request: 30985
-author:
-type: fixed
diff --git a/changelogs/unreleased/sh-update-rouge-3-7-0.yml b/changelogs/unreleased/sh-update-rouge-3-7-0.yml
deleted file mode 100644
index 6828f48863c..00000000000
--- a/changelogs/unreleased/sh-update-rouge-3-7-0.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update rouge to v3.7.0
-merge_request: 31254
-author:
-type: other
diff --git a/changelogs/unreleased/sh-update-rugged-0-28-3.yml b/changelogs/unreleased/sh-update-rugged-0-28-3.yml
deleted file mode 100644
index 86446564e12..00000000000
--- a/changelogs/unreleased/sh-update-rugged-0-28-3.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Upgrade Rugged to 0.28.3
-merge_request: 31794
-author:
-type: security
diff --git a/changelogs/unreleased/sh-use-redis-caching-store.yml b/changelogs/unreleased/sh-use-redis-caching-store.yml
deleted file mode 100644
index e61bdb490bc..00000000000
--- a/changelogs/unreleased/sh-use-redis-caching-store.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Use Rails 5.2 Redis caching store
-merge_request: 30966
-author:
-type: other
diff --git a/changelogs/unreleased/sh-use-shared-state-cluster-pubsub.yml b/changelogs/unreleased/sh-use-shared-state-cluster-pubsub.yml
deleted file mode 100644
index 5e72f23d7ad..00000000000
--- a/changelogs/unreleased/sh-use-shared-state-cluster-pubsub.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Use persistent Redis cluster for Workhorse pub/sub notifications
-merge_request: 30990
-author:
-type: fixed
diff --git a/changelogs/unreleased/snowplow-ee-to-ce.yml b/changelogs/unreleased/snowplow-ee-to-ce.yml
deleted file mode 100644
index 85c959f0510..00000000000
--- a/changelogs/unreleased/snowplow-ee-to-ce.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Moves snowplow tracking from ee to ce
-merge_request: 31160
-author: jejacks0n
-type: added
diff --git a/changelogs/unreleased/speed-up-labels-api.yml b/changelogs/unreleased/speed-up-labels-api.yml
deleted file mode 100644
index d5ac4313414..00000000000
--- a/changelogs/unreleased/speed-up-labels-api.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Remove counts from default labels API responses
-merge_request: 31543
-author:
-type: changed
diff --git a/changelogs/unreleased/tr-embed-metric-links.yml b/changelogs/unreleased/tr-embed-metric-links.yml
deleted file mode 100644
index 6918114a4ae..00000000000
--- a/changelogs/unreleased/tr-embed-metric-links.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Generate shareable link for specific metric charts
-merge_request: 31339
-author:
-type: added
diff --git a/changelogs/unreleased/tr-remove-embed-metrics-flag.yml b/changelogs/unreleased/tr-remove-embed-metrics-flag.yml
deleted file mode 100644
index a327a6868d3..00000000000
--- a/changelogs/unreleased/tr-remove-embed-metrics-flag.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Link and embed metrics in GitLab Flavored Markdown
-merge_request: 31106
-author:
-type: added
diff --git a/changelogs/unreleased/update-gitlab-runner-helm-chart-to-0-7-0.yml b/changelogs/unreleased/update-gitlab-runner-helm-chart-to-0-7-0.yml
deleted file mode 100644
index ab1e7d77520..00000000000
--- a/changelogs/unreleased/update-gitlab-runner-helm-chart-to-0-7-0.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update GitLab Runner Helm Chart to 0.7.0
-merge_request: 30950
-author:
-type: other
diff --git a/changelogs/unreleased/update-graphicsmagick-to-1-3-33.yml b/changelogs/unreleased/update-graphicsmagick-to-1-3-33.yml
deleted file mode 100644
index 898fdef830a..00000000000
--- a/changelogs/unreleased/update-graphicsmagick-to-1-3-33.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Update GraphicsMagick from 1.3.29 to 1.3.33 for CI tests
-merge_request: 31692
-author: Takuya Noguchi
-type: other
diff --git a/changelogs/unreleased/update-pipelines-minutes-expiry-banner-to-an-alert-component-type.yml b/changelogs/unreleased/update-pipelines-minutes-expiry-banner-to-an-alert-component-type.yml
deleted file mode 100644
index 8c1a033dd29..00000000000
--- a/changelogs/unreleased/update-pipelines-minutes-expiry-banner-to-an-alert-component-type.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Enhance style of the shared runners limit
-merge_request: 31386
-author:
-type: other
diff --git a/changelogs/unreleased/visual-review-tools-constant-storage-keys.yml b/changelogs/unreleased/visual-review-tools-constant-storage-keys.yml
deleted file mode 100644
index 4c9b048aaa3..00000000000
--- a/changelogs/unreleased/visual-review-tools-constant-storage-keys.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix visual review app storage keys
-merge_request: 31427
-author:
-type: fixed
diff --git a/changelogs/unreleased/wiki-usage-pings.yml b/changelogs/unreleased/wiki-usage-pings.yml
deleted file mode 100644
index c3d084228c3..00000000000
--- a/changelogs/unreleased/wiki-usage-pings.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Count wiki creation, update and delete events
-merge_request: 30864
-author:
-type: added
-- 
cgit v1.2.1


From f04cc4d23378680979f6b90264613893117e2957 Mon Sep 17 00:00:00 2001
From: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Date: Wed, 21 Aug 2019 20:40:24 +0000
Subject: Update VERSION to 12.3.0-pre

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 4dd919b3b06..80212c6e1f0 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-12.2.0-pre
+12.3.0-pre
-- 
cgit v1.2.1


From 954c3c18320d7dcb66c4c15035594cf5e59a496e Mon Sep 17 00:00:00 2001
From: Christiaan Conover <cconover@gitlab.com>
Date: Wed, 21 Aug 2019 17:49:04 -0400
Subject: Document how GitLab stores passwords

Provide details on how GitLab stores passwords, including hashing,
stretching, and salting. This was driven by a customer asking for this
information for a security compliance audit report.
---
 doc/security/README.md           |  1 +
 doc/security/password_storage.md | 13 +++++++++++++
 2 files changed, 14 insertions(+)
 create mode 100644 doc/security/password_storage.md

diff --git a/doc/security/README.md b/doc/security/README.md
index 5d498ac7602..e3fb07c69c2 100644
--- a/doc/security/README.md
+++ b/doc/security/README.md
@@ -5,6 +5,7 @@ type: index
 
 # Security
 
+- [Password storage](password_storage.md)
 - [Password length limits](password_length_limits.md)
 - [Restrict SSH key technologies and minimum length](ssh_keys_restrictions.md)
 - [Rate limits](rate_limits.md)
diff --git a/doc/security/password_storage.md b/doc/security/password_storage.md
new file mode 100644
index 00000000000..a44fafcca14
--- /dev/null
+++ b/doc/security/password_storage.md
@@ -0,0 +1,13 @@
+---
+type: reference
+---
+
+# Password Storage
+
+GitLab stores user passwords in a hashed format, to prevent passwords from being visible.
+
+GitLab uses the [Devise](https://github.com/plataformatec/devise) authentication library, which handles the hashing of user passwords. Password hashes are created with the following attributes:
+
+- **Hashing**: the [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) hashing function is used to generate the hash of the provided password. This is a strong, industry-standard cryptographic hashing function.
+- **Stretching**: Password hashes are [stretched](https://en.wikipedia.org/wiki/Key_stretching) to harden against brute-force attacks. GitLab uses a streching factor of 10 by default.
+- **Salting**: A [cryptographic salt](https://en.wikipedia.org/wiki/Salt_(cryptography) is added to each password to harden against pre-computed hash and dictionary attacks. Each salt is randomly generated for each password, so that no two passwords share a salt to further increase security.
\ No newline at end of file
-- 
cgit v1.2.1


From b316fb6fd798cac32938560d78349c21d8920ddf Mon Sep 17 00:00:00 2001
From: Christiaan Conover <cconover@gitlab.com>
Date: Wed, 21 Aug 2019 18:01:13 -0400
Subject: Fix link syntax typo

Fix a missing parentheses in the markdown for a link caused by the URL
containing parentheses.
---
 doc/security/password_storage.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/security/password_storage.md b/doc/security/password_storage.md
index a44fafcca14..b5c021bf5de 100644
--- a/doc/security/password_storage.md
+++ b/doc/security/password_storage.md
@@ -10,4 +10,4 @@ GitLab uses the [Devise](https://github.com/plataformatec/devise) authentication
 
 - **Hashing**: the [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) hashing function is used to generate the hash of the provided password. This is a strong, industry-standard cryptographic hashing function.
 - **Stretching**: Password hashes are [stretched](https://en.wikipedia.org/wiki/Key_stretching) to harden against brute-force attacks. GitLab uses a streching factor of 10 by default.
-- **Salting**: A [cryptographic salt](https://en.wikipedia.org/wiki/Salt_(cryptography) is added to each password to harden against pre-computed hash and dictionary attacks. Each salt is randomly generated for each password, so that no two passwords share a salt to further increase security.
\ No newline at end of file
+- **Salting**: A [cryptographic salt](https://en.wikipedia.org/wiki/Salt_(cryptography)) is added to each password to harden against pre-computed hash and dictionary attacks. Each salt is randomly generated for each password, so that no two passwords share a salt to further increase security.
\ No newline at end of file
-- 
cgit v1.2.1


From 29f1ab6b526f35308dc320ce342f6bdb2e331e55 Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Thu, 15 Aug 2019 14:42:01 +0800
Subject: Add CSP nonce when handling JS views

Prevents errors when we have CSP enabled
---
 app/assets/javascripts/main.js | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/main.js b/app/assets/javascripts/main.js
index ba33d72b1f3..39f2097c174 100644
--- a/app/assets/javascripts/main.js
+++ b/app/assets/javascripts/main.js
@@ -9,7 +9,11 @@ import './commons';
 import './behaviors';
 
 // lib/utils
-import { handleLocationHash, addSelectOnFocusBehaviour } from './lib/utils/common_utils';
+import {
+  handleLocationHash,
+  addSelectOnFocusBehaviour,
+  getCspNonceValue,
+} from './lib/utils/common_utils';
 import { localTimeAgo } from './lib/utils/datetime_utility';
 import { getLocationHash, visitUrl } from './lib/utils/url_utility';
 
@@ -39,6 +43,17 @@ import 'ee_else_ce/main_ee';
 window.jQuery = jQuery;
 window.$ = jQuery;
 
+// Add nonce to jQuery script handler
+jQuery.ajaxSetup({
+  converters: {
+    // eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings, func-names
+    'text script': function(text) {
+      jQuery.globalEval(text, { nonce: getCspNonceValue() });
+      return text;
+    },
+  },
+});
+
 // inject test utilities if necessary
 if (process.env.NODE_ENV !== 'production' && gon && gon.test_env) {
   $.fx.off = true;
-- 
cgit v1.2.1


From d78f0724d9cc3dd7c1f22cef54ad59f8d2b579c4 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Thu, 1 Aug 2019 19:05:02 +0700
Subject: Avoid conflicts between ArchiveTraceWorkers

This commits avoiding conflicts between ArchiveTraceWorker
and ArchiveTracesCronWorker by changing the target of the
latter worker.
---
 app/models/ci/build.rb                             |  2 +
 app/workers/ci/archive_traces_cron_worker.rb       |  2 +-
 ...race-condition-of-archive-trace-cron-worker.yml |  5 +++
 spec/models/ci/build_spec.rb                       | 50 ++++++++++++++++++++++
 spec/workers/ci/archive_traces_cron_worker_spec.rb | 16 +++++--
 5 files changed, 70 insertions(+), 5 deletions(-)
 create mode 100644 changelogs/unreleased/avoid-race-condition-of-archive-trace-cron-worker.yml

diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index 3c0efca31db..7930bef5cf2 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -121,6 +121,8 @@ module Ci
     scope :scheduled_actions, ->() { where(when: :delayed, status: COMPLETED_STATUSES + %i[scheduled]) }
     scope :ref_protected, -> { where(protected: true) }
     scope :with_live_trace, -> { where('EXISTS (?)', Ci::BuildTraceChunk.where('ci_builds.id = ci_build_trace_chunks.build_id').select(1)) }
+    scope :with_stale_live_trace, -> { with_live_trace.finished_before(12.hours.ago) }
+    scope :finished_before, -> (date) { finished.where('finished_at < ?', date) }
 
     scope :matches_tag_ids, -> (tag_ids) do
       matcher = ::ActsAsTaggableOn::Tagging
diff --git a/app/workers/ci/archive_traces_cron_worker.rb b/app/workers/ci/archive_traces_cron_worker.rb
index 75e68d0233a..ef2da729705 100644
--- a/app/workers/ci/archive_traces_cron_worker.rb
+++ b/app/workers/ci/archive_traces_cron_worker.rb
@@ -10,7 +10,7 @@ module Ci
       # Archive stale live traces which still resides in redis or database
       # This could happen when ArchiveTraceWorker sidekiq jobs were lost by receiving SIGKILL
       # More details in https://gitlab.com/gitlab-org/gitlab-ce/issues/36791
-      Ci::Build.finished.with_live_trace.find_each(batch_size: 100) do |build|
+      Ci::Build.with_stale_live_trace.find_each(batch_size: 100) do |build|
         Ci::ArchiveTraceService.new.execute(build, worker_name: self.class.name)
       end
     end
diff --git a/changelogs/unreleased/avoid-race-condition-of-archive-trace-cron-worker.yml b/changelogs/unreleased/avoid-race-condition-of-archive-trace-cron-worker.yml
new file mode 100644
index 00000000000..b3f84ec32d2
--- /dev/null
+++ b/changelogs/unreleased/avoid-race-condition-of-archive-trace-cron-worker.yml
@@ -0,0 +1,5 @@
+---
+title: Avoid conflicts between ArchiveTracesCronWorker and ArchiveTraceWorker
+merge_request: 31376
+author:
+type: fixed
diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb
index 4aac4b640f4..bc853d45085 100644
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@@ -149,6 +149,56 @@ describe Ci::Build do
     end
   end
 
+  describe '.with_stale_live_trace' do
+    subject { described_class.with_stale_live_trace }
+
+    context 'when build has a stale live trace' do
+      let!(:build) { create(:ci_build, :success, :trace_live, finished_at: 1.day.ago) }
+
+      it 'selects the build' do
+        is_expected.to eq([build])
+      end
+    end
+
+    context 'when build does not have a stale live trace' do
+      let!(:build) { create(:ci_build, :success, :trace_live, finished_at: 1.hour.ago) }
+
+      it 'does not select the build' do
+        is_expected.to be_empty
+      end
+    end
+  end
+
+  describe '.finished_before' do
+    subject { described_class.finished_before(date) }
+
+    let(:date) { 1.hour.ago }
+
+    context 'when build has finished one day ago' do
+      let!(:build) { create(:ci_build, :success, finished_at: 1.day.ago) }
+
+      it 'selects the build' do
+        is_expected.to eq([build])
+      end
+    end
+
+    context 'when build has finished 30 minutes ago' do
+      let!(:build) { create(:ci_build, :success, finished_at: 30.minutes.ago) }
+
+      it 'returns an empty array' do
+        is_expected.to be_empty
+      end
+    end
+
+    context 'when build is still running' do
+      let!(:build) { create(:ci_build, :running) }
+
+      it 'returns an empty array' do
+        is_expected.to be_empty
+      end
+    end
+  end
+
   describe '.with_reports' do
     subject { described_class.with_reports(Ci::JobArtifact.test_reports) }
 
diff --git a/spec/workers/ci/archive_traces_cron_worker_spec.rb b/spec/workers/ci/archive_traces_cron_worker_spec.rb
index 28381fdc3be..01232e2a58b 100644
--- a/spec/workers/ci/archive_traces_cron_worker_spec.rb
+++ b/spec/workers/ci/archive_traces_cron_worker_spec.rb
@@ -5,6 +5,8 @@ require 'spec_helper'
 describe Ci::ArchiveTracesCronWorker do
   subject { described_class.new.perform }
 
+  let(:finished_at) { 1.day.ago }
+
   before do
     stub_feature_flags(ci_enable_live_trace: true)
   end
@@ -28,7 +30,7 @@ describe Ci::ArchiveTracesCronWorker do
   end
 
   context 'when a job succeeded' do
-    let!(:build) { create(:ci_build, :success, :trace_live) }
+    let!(:build) { create(:ci_build, :success, :trace_live, finished_at: finished_at) }
 
     it_behaves_like 'archives trace'
 
@@ -39,9 +41,15 @@ describe Ci::ArchiveTracesCronWorker do
       subject
     end
 
+    context 'when the job finished recently' do
+      let(:finished_at) { 1.hour.ago }
+
+      it_behaves_like 'does not archive trace'
+    end
+
     context 'when a trace had already been archived' do
       let!(:build) { create(:ci_build, :success, :trace_live, :trace_artifact) }
-      let!(:build2) { create(:ci_build, :success, :trace_live) }
+      let!(:build2) { create(:ci_build, :success, :trace_live, finished_at: finished_at) }
 
       it 'continues to archive live traces' do
         subject
@@ -52,7 +60,7 @@ describe Ci::ArchiveTracesCronWorker do
     end
 
     context 'when an unexpected exception happened during archiving' do
-      let!(:build) { create(:ci_build, :success, :trace_live) }
+      let!(:build) { create(:ci_build, :success, :trace_live, finished_at: finished_at) }
 
       before do
         allow(Gitlab::Sentry).to receive(:track_exception)
@@ -71,7 +79,7 @@ describe Ci::ArchiveTracesCronWorker do
   end
 
   context 'when a job was cancelled' do
-    let!(:build) { create(:ci_build, :canceled, :trace_live) }
+    let!(:build) { create(:ci_build, :canceled, :trace_live, finished_at: finished_at) }
 
     it_behaves_like 'archives trace'
   end
-- 
cgit v1.2.1


From b0231f48676c84b26fab26a5c43b996c66c1924d Mon Sep 17 00:00:00 2001
From: Boris Krylov <krylovbv@mail.ru>
Date: Thu, 22 Aug 2019 03:39:03 +0000
Subject: Reduce dedup calls to gc only

---
 app/workers/git_garbage_collect_worker.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/workers/git_garbage_collect_worker.rb b/app/workers/git_garbage_collect_worker.rb
index 489d6215774..5499e12e49b 100644
--- a/app/workers/git_garbage_collect_worker.rb
+++ b/app/workers/git_garbage_collect_worker.rb
@@ -24,7 +24,7 @@ class GitGarbageCollectWorker
 
     task = task.to_sym
 
-    ::Projects::GitDeduplicationService.new(project).execute
+    ::Projects::GitDeduplicationService.new(project).execute if task == :gc
 
     gitaly_call(task, project.repository.raw_repository)
 
-- 
cgit v1.2.1


From 0e274dfca07ced0458db69b4dfc86a57c39620e5 Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Thu, 22 Aug 2019 14:14:51 +0800
Subject: Remove unneeded check for merge_request.project

---
 app/services/merge_requests/base_service.rb | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/app/services/merge_requests/base_service.rb b/app/services/merge_requests/base_service.rb
index 067510a8a0a..c6aae4c28f2 100644
--- a/app/services/merge_requests/base_service.rb
+++ b/app/services/merge_requests/base_service.rb
@@ -17,11 +17,9 @@ module MergeRequests
     end
 
     def execute_hooks(merge_request, action = 'open', old_rev: nil, old_associations: {})
-      if merge_request.project
-        merge_data = hook_data(merge_request, action, old_rev: old_rev, old_associations: old_associations)
-        merge_request.project.execute_hooks(merge_data, :merge_request_hooks)
-        merge_request.project.execute_services(merge_data, :merge_request_hooks)
-      end
+      merge_data = hook_data(merge_request, action, old_rev: old_rev, old_associations: old_associations)
+      merge_request.project.execute_hooks(merge_data, :merge_request_hooks)
+      merge_request.project.execute_services(merge_data, :merge_request_hooks)
     end
 
     def cleanup_environments(merge_request)
-- 
cgit v1.2.1


From 095768be4fd5aad0f46d7e57c3c97ab347277253 Mon Sep 17 00:00:00 2001
From: Mark Lapierre <mlapierre@gitlab.com>
Date: Thu, 22 Aug 2019 16:42:53 +1000
Subject: Fix failing test

Optionally check for quotes and escape the name
---
 .../browser_ui/3_create/repository/user_views_commit_diff_patch_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qa/qa/specs/features/browser_ui/3_create/repository/user_views_commit_diff_patch_spec.rb b/qa/qa/specs/features/browser_ui/3_create/repository/user_views_commit_diff_patch_spec.rb
index f915d412bf3..21785ca3ed3 100644
--- a/qa/qa/specs/features/browser_ui/3_create/repository/user_views_commit_diff_patch_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/repository/user_views_commit_diff_patch_spec.rb
@@ -49,7 +49,7 @@ module QA
 
         Page::Project::Commit::Show.perform(&:select_email_patches)
 
-        expect(page).to have_content("From: #{@user.name} <#{@user.public_email}>")
+        expect(page).to have_content(/From: "?#{Regexp.escape(@user.name)}"? <#{@user.public_email}>/)
         expect(page).to have_content('Subject: [PATCH] Add second file')
         expect(page).to have_content('diff --git a/second b/second')
       end
-- 
cgit v1.2.1


From d7ae3efb87873425bce19dfa3ff1cce9e6acc8c0 Mon Sep 17 00:00:00 2001
From: Paul Okstad <pokstad@gitlab.com>
Date: Thu, 22 Aug 2019 06:53:14 +0000
Subject: Add Gitaly info-ref cache feature flags

---
 lib/feature/gitaly.rb | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/feature/gitaly.rb b/lib/feature/gitaly.rb
index edfd2fb17f3..be397a478cd 100644
--- a/lib/feature/gitaly.rb
+++ b/lib/feature/gitaly.rb
@@ -6,8 +6,10 @@ class Feature
   class Gitaly
     # Server feature flags should use '_' to separate words.
     SERVER_FEATURE_FLAGS =
-      [
-        'get_commit_signatures'.freeze
+      %w[
+        get_commit_signatures
+        cache_invalidator
+        inforef_uploadpack_cache
       ].freeze
 
     DEFAULT_ON_FLAGS = Set.new([]).freeze
-- 
cgit v1.2.1


From f7fbf49929e24e2f9bfec0a68fd450c3547f7a78 Mon Sep 17 00:00:00 2001
From: drew cimino <dcimino@gitlab.com>
Date: Wed, 21 Aug 2019 01:42:28 -0400
Subject: Restrict MergeRequests#test_reports to authenticated users with
 read-access on Builds

---
 .../projects/merge_requests_controller.rb          |  6 +++
 .../unreleased/security-ci-metrics-permissions.yml |  6 +++
 .../projects/merge_requests_controller_spec.rb     | 60 +++++++++++++++++++---
 3 files changed, 64 insertions(+), 8 deletions(-)
 create mode 100644 changelogs/unreleased/security-ci-metrics-permissions.yml

diff --git a/app/controllers/projects/merge_requests_controller.rb b/app/controllers/projects/merge_requests_controller.rb
index f4d381244d9..c9a1f28f87e 100644
--- a/app/controllers/projects/merge_requests_controller.rb
+++ b/app/controllers/projects/merge_requests_controller.rb
@@ -12,6 +12,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
   skip_before_action :merge_request, only: [:index, :bulk_update]
   before_action :whitelist_query_limiting, only: [:assign_related_issues, :update]
   before_action :authorize_update_issuable!, only: [:close, :edit, :update, :remove_wip, :sort]
+  before_action :authorize_test_reports!, only: [:test_reports]
   before_action :set_issuables_index, only: [:index]
   before_action :authenticate_user!, only: [:assign_related_issues]
   before_action :check_user_can_push_to_source_branch!, only: [:rebase]
@@ -336,4 +337,9 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
       render json: { status_reason: 'Unknown error' }, status: :internal_server_error
     end
   end
+
+  def authorize_test_reports!
+    # MergeRequest#actual_head_pipeline is the pipeline accessed in MergeRequest#compare_reports.
+    return render_404 unless can?(current_user, :read_build, merge_request.actual_head_pipeline)
+  end
 end
diff --git a/changelogs/unreleased/security-ci-metrics-permissions.yml b/changelogs/unreleased/security-ci-metrics-permissions.yml
new file mode 100644
index 00000000000..51c6493442a
--- /dev/null
+++ b/changelogs/unreleased/security-ci-metrics-permissions.yml
@@ -0,0 +1,6 @@
+---
+title: Restrict MergeRequests#test_reports to authenticated users with read-access
+  on Builds
+merge_request:
+author:
+type: security
diff --git a/spec/controllers/projects/merge_requests_controller_spec.rb b/spec/controllers/projects/merge_requests_controller_spec.rb
index 11b1eaf11b7..9cc76eb8c28 100644
--- a/spec/controllers/projects/merge_requests_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests_controller_spec.rb
@@ -719,19 +719,63 @@ describe Projects::MergeRequestsController do
   end
 
   describe 'GET test_reports' do
+    let(:merge_request) do
+      create(:merge_request,
+        :with_diffs,
+        :with_merge_request_pipeline,
+        target_project: project,
+        source_project: project
+      )
+    end
+
     subject do
-      get :test_reports,
-          params: {
-            namespace_id: project.namespace.to_param,
-            project_id: project,
-            id: merge_request.iid
-          },
-          format: :json
+      get :test_reports, params: {
+        namespace_id: project.namespace.to_param,
+        project_id: project,
+        id: merge_request.iid
+      },
+      format: :json
     end
 
     before do
       allow_any_instance_of(MergeRequest)
-        .to receive(:compare_test_reports).and_return(comparison_status)
+        .to receive(:compare_test_reports)
+        .and_return(comparison_status)
+
+      allow_any_instance_of(MergeRequest)
+        .to receive(:actual_head_pipeline)
+        .and_return(merge_request.all_pipelines.take)
+    end
+
+    describe 'permissions on a public project with private CI/CD' do
+      let(:project) { create :project, :repository, :public, :builds_private }
+      let(:comparison_status) { { status: :parsed, data: { summary: 1 } } }
+
+      context 'while signed out' do
+        before do
+          sign_out(user)
+        end
+
+        it 'responds with a 404' do
+          subject
+
+          expect(response).to have_gitlab_http_status(404)
+          expect(response.body).to be_blank
+        end
+      end
+
+      context 'while signed in as an unrelated user' do
+        before do
+          sign_in(create(:user))
+        end
+
+        it 'responds with a 404' do
+          subject
+
+          expect(response).to have_gitlab_http_status(404)
+          expect(response.body).to be_blank
+        end
+      end
     end
 
     context 'when comparison is being processed' do
-- 
cgit v1.2.1


From 5af535d919c50951513f5859730afd924a01c29b Mon Sep 17 00:00:00 2001
From: Alexandru Croitor <acroitor@gitlab.com>
Date: Wed, 17 Jul 2019 12:54:40 +0300
Subject: Limit the size of issuable description and comments

Limiting the size of issuable description and comments to 1_000_000,
which is close to ~1MB of ASCII characters, which represents 99.9% of
all descriptions and comments we have in DB at the moment. This should
help prevent DoS attacks when comments contain refference strings.

Also this change updates regexp matching the namespaces paths by
limiting the namespaces paths to Namespace::NUMBER_OF_ANCESTORS_ALLOWED,
as we allow 20 levels deep groups.

see https://gitlab.com/gitlab-org/gitlab-ce/issues/61974#note_191274234
---
 app/models/concerns/issuable.rb                    |  1 +
 app/models/note.rb                                 |  1 +
 .../security-61974-limit-issue-comment-size-2.yml  |  5 +++++
 .../security-61974-limit-issue-comment-size.yml    |  5 +++++
 doc/api/epics.md                                   |  4 ++--
 doc/api/issues.md                                  |  4 ++--
 doc/api/merge_requests.md                          |  4 ++--
 doc/api/notes.md                                   | 16 ++++++-------
 lib/gitlab/database.rb                             |  4 ++++
 lib/gitlab/path_regex.rb                           |  2 +-
 .../banzai/filter/project_reference_filter_spec.rb | 16 +++++++++----
 spec/models/concerns/issuable_spec.rb              | 26 ++++++++++++++++++++++
 spec/models/note_spec.rb                           |  1 +
 .../models/concern/issuable_shared_examples.rb     |  8 +++++++
 14 files changed, 78 insertions(+), 19 deletions(-)
 create mode 100644 changelogs/unreleased/security-61974-limit-issue-comment-size-2.yml
 create mode 100644 changelogs/unreleased/security-61974-limit-issue-comment-size.yml
 create mode 100644 spec/support/shared_examples/models/concern/issuable_shared_examples.rb

diff --git a/app/models/concerns/issuable.rb b/app/models/concerns/issuable.rb
index e60b6497cb7..a9e2f2be980 100644
--- a/app/models/concerns/issuable.rb
+++ b/app/models/concerns/issuable.rb
@@ -73,6 +73,7 @@ module Issuable
 
     validates :author, presence: true
     validates :title, presence: true, length: { maximum: 255 }
+    validates :description, length: { maximum: Gitlab::Database::MAX_TEXT_SIZE_LIMIT }, allow_blank: true
     validate :milestone_is_valid
 
     scope :authored, ->(user) { where(author_id: user) }
diff --git a/app/models/note.rb b/app/models/note.rb
index a12d1eb7243..79aad5cbff9 100644
--- a/app/models/note.rb
+++ b/app/models/note.rb
@@ -89,6 +89,7 @@ class Note < ApplicationRecord
   delegate :title, to: :noteable, allow_nil: true
 
   validates :note, presence: true
+  validates :note, length: { maximum: Gitlab::Database::MAX_TEXT_SIZE_LIMIT }
   validates :project, presence: true, if: :for_project_noteable?
 
   # Attachments are deprecated and are handled by Markdown uploader
diff --git a/changelogs/unreleased/security-61974-limit-issue-comment-size-2.yml b/changelogs/unreleased/security-61974-limit-issue-comment-size-2.yml
new file mode 100644
index 00000000000..962171dc6f8
--- /dev/null
+++ b/changelogs/unreleased/security-61974-limit-issue-comment-size-2.yml
@@ -0,0 +1,5 @@
+---
+title: Speed up regexp in namespace format by failing fast after reaching maximum namespace depth
+merge_request:
+author:
+type: security
diff --git a/changelogs/unreleased/security-61974-limit-issue-comment-size.yml b/changelogs/unreleased/security-61974-limit-issue-comment-size.yml
new file mode 100644
index 00000000000..6d5ef057d83
--- /dev/null
+++ b/changelogs/unreleased/security-61974-limit-issue-comment-size.yml
@@ -0,0 +1,5 @@
+---
+title: Limit the size of issuable description and comments
+merge_request:
+author:
+type: security
diff --git a/doc/api/epics.md b/doc/api/epics.md
index 3036b3c2364..aa7909917d9 100644
--- a/doc/api/epics.md
+++ b/doc/api/epics.md
@@ -161,7 +161,7 @@ POST /groups/:id/epics
 | `id`                | integer/string   | yes        | The ID or [URL-encoded path of the group](README.md#namespaced-path-encoding) owned by the authenticated user                |
 | `title`             | string           | yes        | The title of the epic |
 | `labels`            | string           | no         | The comma separated list of labels |
-| `description`       | string           | no         | The description of the epic  |
+| `description`       | string           | no         | The description of the epic. Limited to 1 000 000 characters.  |
 | `start_date_is_fixed` | boolean        | no         | Whether start date should be sourced from `start_date_fixed` or from milestones (since 11.3) |
 | `start_date_fixed`  | string           | no         | The fixed start date of an epic (since 11.3) |
 | `due_date_is_fixed` | boolean          | no         | Whether due date should be sourced from `due_date_fixed` or from milestones (since 11.3) |
@@ -225,7 +225,7 @@ PUT /groups/:id/epics/:epic_iid
 | `id`                | integer/string   | yes        | The ID or [URL-encoded path of the group](README.md#namespaced-path-encoding) owned by the authenticated user                |
 | `epic_iid`          | integer/string   | yes        | The internal ID  of the epic  |
 | `title`             | string           | no         | The title of an epic |
-| `description`       | string           | no         | The description of an epic  |
+| `description`       | string           | no         | The description of an epic. Limited to 1 000 000 characters. |
 | `labels`            | string           | no         | The comma separated list of labels |
 | `start_date_is_fixed` | boolean        | no         | Whether start date should be sourced from `start_date_fixed` or from milestones (since 11.3) |
 | `start_date_fixed`  | string           | no         | The fixed start date of an epic (since 11.3) |
diff --git a/doc/api/issues.md b/doc/api/issues.md
index 96a547551f1..ef479bc9829 100644
--- a/doc/api/issues.md
+++ b/doc/api/issues.md
@@ -593,7 +593,7 @@ POST /projects/:id/issues
 | `id`                                      | integer/string | yes      | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
 | `iid`                                     | integer/string | no       | The internal ID of the project's issue (requires admin or project owner rights) |
 | `title`                                   | string         | yes      | The title of an issue |
-| `description`                             | string         | no       | The description of an issue  |
+| `description`                             | string         | no       | The description of an issue. Limited to 1 000 000 characters. |
 | `confidential`                            | boolean        | no       | Set an issue to be confidential. Default is `false`.  |
 | `assignee_ids`                            | integer array  | no       | The ID of a user to assign issue |
 | `milestone_id`                            | integer        | no       | The global ID of a milestone to assign issue  |
@@ -694,7 +694,7 @@ PUT /projects/:id/issues/:issue_iid
 | `id`           | integer/string | yes | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
 | `issue_iid`    | integer | yes      | The internal ID of a project's issue                                                                       |
 | `title`        | string  | no       | The title of an issue                                                                                      |
-| `description`  | string  | no       | The description of an issue                                                                                |
+| `description`  | string  | no       | The description of an issue. Limited to 1 000 000 characters.        |
 | `confidential` | boolean | no       | Updates an issue to be confidential                                                                        |
 | `assignee_ids` | integer array | no | The ID of the user(s) to assign the issue to. Set to `0` or provide an empty value to unassign all assignees. |
 | `milestone_id` | integer | no       | The global ID of a milestone to assign the issue to. Set to `0` or provide an empty value to unassign a milestone.|
diff --git a/doc/api/merge_requests.md b/doc/api/merge_requests.md
index 1ade46efb1c..fd8216b0fbd 100644
--- a/doc/api/merge_requests.md
+++ b/doc/api/merge_requests.md
@@ -837,7 +837,7 @@ POST /projects/:id/merge_requests
 | `title`                    | string  | yes      | Title of MR                                                                     |
 | `assignee_id`              | integer | no       | Assignee user ID                                                                |
 | `assignee_ids`             | integer array | no | The ID of the user(s) to assign the MR to. Set to `0` or provide an empty value to unassign all assignees.  |
-| `description`              | string  | no       | Description of MR                                                               |
+| `description`              | string  | no       | Description of MR. Limited to 1 000 000 characters. |
 | `target_project_id`        | integer | no       | The target project (numeric id)                                                 |
 | `labels`                   | string  | no       | Labels for MR as a comma-separated list                                         |
 | `milestone_id`             | integer | no       | The global ID of a milestone                                                           |
@@ -990,7 +990,7 @@ PUT /projects/:id/merge_requests/:merge_request_iid
 | `assignee_ids`             | integer array | no | The ID of the user(s) to assign the MR to. Set to `0` or provide an empty value to unassign all assignees.  |
 | `milestone_id`             | integer | no       | The global ID of a milestone to assign the merge request to. Set to `0` or provide an empty value to unassign a milestone.|
 | `labels`                   | string  | no       | Comma-separated label names for a merge request. Set to an empty string to unassign all labels.                    |
-| `description`              | string  | no       | Description of MR                                                               |
+| `description`              | string  | no       | Description of MR. Limited to 1 000 000 characters. |
 | `state_event`              | string  | no       | New state (close/reopen)                                                        |
 | `remove_source_branch`     | boolean | no       | Flag indicating if a merge request should remove the source branch when merging |
 | `squash`                   | boolean | no       | Squash commits into a single commit when merging |
diff --git a/doc/api/notes.md b/doc/api/notes.md
index acbf0334563..d7183df1387 100644
--- a/doc/api/notes.md
+++ b/doc/api/notes.md
@@ -113,7 +113,7 @@ Parameters:
 
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `issue_iid` (required) - The IID of an issue
-- `body` (required) - The content of a note
+- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
 - `created_at` (optional) - Date time string, ISO 8601 formatted, e.g. 2016-03-11T03:45:40Z (requires admin or project/group owner rights)
 
 ```bash
@@ -133,7 +133,7 @@ Parameters:
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `issue_iid` (required) - The IID of an issue
 - `note_id` (required) - The ID of a note
-- `body` (required) - The content of a note
+- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
 
 ```bash
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/projects/5/issues/11/notes?body=note
@@ -231,7 +231,7 @@ Parameters:
 
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `snippet_id` (required) - The ID of a snippet
-- `body` (required) - The content of a note
+- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
 - `created_at` (optional) - Date time string, ISO 8601 formatted, e.g. 2016-03-11T03:45:40Z
 
 ```bash
@@ -251,7 +251,7 @@ Parameters:
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `snippet_id` (required) - The ID of a snippet
 - `note_id` (required) - The ID of a note
-- `body` (required) - The content of a note
+- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
 
 ```bash
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/projects/5/snippets/11/notes?body=note
@@ -354,7 +354,7 @@ Parameters:
 
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `merge_request_iid` (required) - The IID of a merge request
-- `body` (required) - The content of a note
+- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
 - `created_at` (optional) - Date time string, ISO 8601 formatted, e.g. 2016-03-11T03:45:40Z
 
 ### Modify existing merge request note
@@ -370,7 +370,7 @@ Parameters:
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `merge_request_iid` (required) - The IID of a merge request
 - `note_id` (required) - The ID of a note
-- `body` (required) - The content of a note
+- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
 
 ```bash
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/projects/5/merge_requests/11/notes?body=note
@@ -472,7 +472,7 @@ Parameters:
 | --------- | -------------- | -------- | ----------- |
 | `id`      | integer/string | yes | The ID or [URL-encoded path of the group](README.md#namespaced-path-encoding) |
 | `epic_id` | integer | yes  | The ID of an epic |
-| `body`    | string  | yes  | The content of a note |
+| `body`    | string  | yes  | The content of a note. Limited to 1 000 000 characters. |
 
 ```bash
 curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/projects/5/snippet/11/notes?body=note
@@ -493,7 +493,7 @@ Parameters:
 | `id`      | integer/string | yes | The ID or [URL-encoded path of the group](README.md#namespaced-path-encoding) |
 | `epic_id` | integer | yes  | The ID of an epic |
 | `note_id` | integer | yes  | The ID of a note |
-| `body`    | string  | yes  | The content of a note |
+| `body`    | string  | yes  | The content of a note. Limited to 1 000 000 characters. |
 
 ```bash
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/projects/5/snippet/11/notes?body=note
diff --git a/lib/gitlab/database.rb b/lib/gitlab/database.rb
index cbdff0ab060..707466426db 100644
--- a/lib/gitlab/database.rb
+++ b/lib/gitlab/database.rb
@@ -13,6 +13,10 @@ module Gitlab
     # FIXME: this should just be the max value of timestampz
     MAX_TIMESTAMP_VALUE = Time.at((1 << 31) - 1).freeze
 
+    # The maximum number of characters for text fields, to avoid DoS attacks via parsing huge text fields
+    # https://gitlab.com/gitlab-org/gitlab-ce/issues/61974
+    MAX_TEXT_SIZE_LIMIT = 1_000_000
+
     # Minimum schema version from which migrations are supported
     # Migrations before this version may have been removed
     MIN_SCHEMA_VERSION = 20190506135400
diff --git a/lib/gitlab/path_regex.rb b/lib/gitlab/path_regex.rb
index f96466b2b00..d9c28ff1181 100644
--- a/lib/gitlab/path_regex.rb
+++ b/lib/gitlab/path_regex.rb
@@ -132,7 +132,7 @@ module Gitlab
     NO_SUFFIX_REGEX = /(?<!\.git|\.atom)/.freeze
     NAMESPACE_FORMAT_REGEX = /(?:#{NAMESPACE_FORMAT_REGEX_JS})#{NO_SUFFIX_REGEX}/.freeze
     PROJECT_PATH_FORMAT_REGEX = /(?:#{PATH_REGEX_STR})#{NO_SUFFIX_REGEX}/.freeze
-    FULL_NAMESPACE_FORMAT_REGEX = %r{(#{NAMESPACE_FORMAT_REGEX}/)*#{NAMESPACE_FORMAT_REGEX}}.freeze
+    FULL_NAMESPACE_FORMAT_REGEX = %r{(#{NAMESPACE_FORMAT_REGEX}/){,#{Namespace::NUMBER_OF_ANCESTORS_ALLOWED}}#{NAMESPACE_FORMAT_REGEX}}.freeze
 
     def root_namespace_route_regex
       @root_namespace_route_regex ||= begin
diff --git a/spec/lib/banzai/filter/project_reference_filter_spec.rb b/spec/lib/banzai/filter/project_reference_filter_spec.rb
index 69f9c1ae829..927d226c400 100644
--- a/spec/lib/banzai/filter/project_reference_filter_spec.rb
+++ b/spec/lib/banzai/filter/project_reference_filter_spec.rb
@@ -26,10 +26,18 @@ describe Banzai::Filter::ProjectReferenceFilter do
     expect(reference_filter(act).to_html).to eq(CGI.escapeHTML(exp))
   end
 
-  it 'fails fast for long invalid string' do
-    expect do
-      Timeout.timeout(5.seconds) { reference_filter("A" * 50000).to_html }
-    end.not_to raise_error
+  context 'when invalid reference strings are very long' do
+    shared_examples_for 'fails fast' do |ref_string|
+      it 'fails fast for long strings' do
+        # took well under 1 second in CI https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/3267#note_172824
+        expect do
+          Timeout.timeout(3.seconds) { reference_filter(ref_string).to_html }
+        end.not_to raise_error
+      end
+    end
+
+    it_behaves_like 'fails fast', 'A' * 50000
+    it_behaves_like 'fails fast', '/a' * 50000
   end
 
   it 'allows references with text after the > character' do
diff --git a/spec/models/concerns/issuable_spec.rb b/spec/models/concerns/issuable_spec.rb
index 39680c0e51a..65d41edc035 100644
--- a/spec/models/concerns/issuable_spec.rb
+++ b/spec/models/concerns/issuable_spec.rb
@@ -46,6 +46,7 @@ describe Issuable do
       it { is_expected.to validate_presence_of(:author) }
       it { is_expected.to validate_presence_of(:title) }
       it { is_expected.to validate_length_of(:title).is_at_most(255) }
+      it { is_expected.to validate_length_of(:description).is_at_most(1_000_000) }
     end
 
     describe 'milestone' do
@@ -795,4 +796,29 @@ describe Issuable do
       end
     end
   end
+
+  describe '#matches_cross_reference_regex?' do
+    context "issue description with long path string" do
+      let(:mentionable) { build(:issue, description: "/a" * 50000) }
+
+      it_behaves_like 'matches_cross_reference_regex? fails fast'
+    end
+
+    context "note with long path string" do
+      let(:mentionable) { build(:note, note: "/a" * 50000) }
+
+      it_behaves_like 'matches_cross_reference_regex? fails fast'
+    end
+
+    context "note with long path string" do
+      let(:project) { create(:project, :public, :repository) }
+      let(:mentionable) { project.commit }
+
+      before do
+        expect(mentionable.raw).to receive(:message).and_return("/a" * 50000)
+      end
+
+      it_behaves_like 'matches_cross_reference_regex? fails fast'
+    end
+  end
 end
diff --git a/spec/models/note_spec.rb b/spec/models/note_spec.rb
index bfd0e5f0558..927fbdb93d8 100644
--- a/spec/models/note_spec.rb
+++ b/spec/models/note_spec.rb
@@ -22,6 +22,7 @@ describe Note do
   end
 
   describe 'validation' do
+    it { is_expected.to validate_length_of(:note).is_at_most(1_000_000) }
     it { is_expected.to validate_presence_of(:note) }
     it { is_expected.to validate_presence_of(:project) }
 
diff --git a/spec/support/shared_examples/models/concern/issuable_shared_examples.rb b/spec/support/shared_examples/models/concern/issuable_shared_examples.rb
new file mode 100644
index 00000000000..9604555c57d
--- /dev/null
+++ b/spec/support/shared_examples/models/concern/issuable_shared_examples.rb
@@ -0,0 +1,8 @@
+shared_examples_for 'matches_cross_reference_regex? fails fast' do
+  it 'fails fast for long strings' do
+    # took well under 1 second in CI https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/3267#note_172823
+    expect do
+      Timeout.timeout(3.seconds) { mentionable.matches_cross_reference_regex? }
+    end.not_to raise_error
+  end
+end
-- 
cgit v1.2.1


From 450d84ff83b5ccfa285ca749fdf164d5039ec79e Mon Sep 17 00:00:00 2001
From: Achilleas Pipinellis <axil@gitlab.com>
Date: Thu, 22 Aug 2019 07:44:58 +0000
Subject: Rename License Management to License Compliance

As part of https://gitlab.com/gitlab-org/gitlab-ee/issues/8910,
all occurrences of License Management are replace with
License Compliance.
---
 doc/README.md                                      |  2 +-
 doc/ci/README.md                                   |  2 +-
 doc/ci/yaml/README.md                              |  2 +-
 doc/topics/autodevops/index.md                     | 12 +++---
 doc/topics/autodevops/quick_start_guide.md         |  2 +-
 doc/user/application_security/index.md             |  2 +-
 .../license_management/index.md                    | 48 +++++++++++-----------
 doc/user/permissions.md                            |  2 +-
 doc/user/project/index.md                          |  2 +-
 doc/user/project/merge_requests/index.md           |  4 +-
 10 files changed, 39 insertions(+), 39 deletions(-)

diff --git a/doc/README.md b/doc/README.md
index 8ce5d2e240a..f12c06199c2 100644
--- a/doc/README.md
+++ b/doc/README.md
@@ -358,7 +358,7 @@ The following documentation relates to the DevOps **Secure** stage:
 | [Dependency Scanning](user/application_security/dependency_scanning/index.md) **(ULTIMATE)**          | Analyze your dependencies for known vulnerabilities.                   |
 | [Dynamic Application Security Testing (DAST)](user/application_security/dast/index.md) **(ULTIMATE)** | Analyze running web applications for known vulnerabilities.            |
 | [Group Security Dashboard](user/application_security/security_dashboard/index.md) **(ULTIMATE)**      | View vulnerabilities in all the projects in a group and its subgroups. |
-| [License Management](user/application_security/license_management/index.md) **(ULTIMATE)**            | Search your project's dependencies for their licenses.                 |
+| [License Compliance](user/application_security/license_management/index.md) **(ULTIMATE)**            | Search your project's dependencies for their licenses.                 |
 | [Project Security Dashboard](user/application_security/security_dashboard/index.md) **(ULTIMATE)**    | View the latest security reports for your project.                     |
 | [Static Application Security Testing (SAST)](user/application_security/sast/index.md) **(ULTIMATE)**  | Analyze source code for known vulnerabilities.                         |
 
diff --git a/doc/ci/README.md b/doc/ci/README.md
index ca9d0aa61bd..94da8354f0b 100644
--- a/doc/ci/README.md
+++ b/doc/ci/README.md
@@ -131,7 +131,7 @@ Its feature set is listed on the table below according to DevOps stages.
 | **Secure** ||
 | [Container Scanning](../user/application_security/container_scanning/index.md) **(ULTIMATE)** | Check your Docker containers for known vulnerabilities.|
 | [Dependency Scanning](../user/application_security/dependency_scanning/index.md) **(ULTIMATE)** | Analyze your dependencies for known vulnerabilities. |
-| [License Management](../user/application_security/license_management/index.md) **(ULTIMATE)** | Search your project dependencies for their licenses. |
+| [License Compliance](../user/application_security/license_management/index.md) **(ULTIMATE)** | Search your project dependencies for their licenses. |
 | [Security Test reports](../user/project/merge_requests/index.md#security-reports-ultimate) **(ULTIMATE)** | Check for app vulnerabilities. |
 
 ## Examples
diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md
index f7a67931793..89a61b2a9e3 100644
--- a/doc/ci/yaml/README.md
+++ b/doc/ci/yaml/README.md
@@ -1582,7 +1582,7 @@ dashboards.
 The `license_management` report collects [Licenses](../../user/project/merge_requests/license_management.md)
 as artifacts.
 
-The collected License Management report will be uploaded to GitLab as an artifact and will
+The collected License Compliance report will be uploaded to GitLab as an artifact and will
 be automatically shown in merge requests, pipeline view and provide data for security
 dashboards.
 
diff --git a/doc/topics/autodevops/index.md b/doc/topics/autodevops/index.md
index b8ad552accc..26d5221acc5 100644
--- a/doc/topics/autodevops/index.md
+++ b/doc/topics/autodevops/index.md
@@ -65,7 +65,7 @@ project in a simple and automatic way:
 1. [Auto Code Quality](#auto-code-quality-starter) **(STARTER)**
 1. [Auto SAST (Static Application Security Testing)](#auto-sast-ultimate) **(ULTIMATE)**
 1. [Auto Dependency Scanning](#auto-dependency-scanning-ultimate) **(ULTIMATE)**
-1. [Auto License Management](#auto-license-management-ultimate) **(ULTIMATE)**
+1. [Auto License Compliance](#auto-license-compliance-ultimate) **(ULTIMATE)**
 1. [Auto Container Scanning](#auto-container-scanning-ultimate) **(ULTIMATE)**
 1. [Auto Review Apps](#auto-review-apps)
 1. [Auto DAST (Dynamic Application Security Testing)](#auto-dast-ultimate) **(ULTIMATE)**
@@ -401,13 +401,13 @@ check out.
 Any security warnings are also shown in the merge request widget. Read more about
 [Dependency Scanning](../../user/application_security/dependency_scanning/index.md).
 
-### Auto License Management **(ULTIMATE)**
+### Auto License Compliance **(ULTIMATE)**
 
 > Introduced in [GitLab Ultimate][ee] 11.0.
 
-License Management uses the
-[License Management Docker image](https://gitlab.com/gitlab-org/security-products/license-management)
-to search the project dependencies for their license. The Auto License Management stage
+License Compliance uses the
+[License Compliance Docker image](https://gitlab.com/gitlab-org/security-products/license-management)
+to search the project dependencies for their license. The Auto License Compliance stage
 will be skipped on licenses other than Ultimate.
 
 Once the
@@ -415,7 +415,7 @@ report is created, it's uploaded as an artifact which you can later download and
 check out.
 
 Any licenses are also shown in the merge request widget. Read more how
-[License Management works](../../user/application_security/license_management/index.md).
+[License Compliance works](../../user/application_security/license_management/index.md).
 
 ### Auto Container Scanning **(ULTIMATE)**
 
diff --git a/doc/topics/autodevops/quick_start_guide.md b/doc/topics/autodevops/quick_start_guide.md
index 7ab59b80374..35a5aff6a60 100644
--- a/doc/topics/autodevops/quick_start_guide.md
+++ b/doc/topics/autodevops/quick_start_guide.md
@@ -167,7 +167,7 @@ In the **test** stage, GitLab runs various checks on the application:
 - The `sast` job runs static analysis on the current code to check for potential
   security issues and is allowed to fail([Auto SAST](index.md#auto-sast-ultimate)) **(ULTIMATE)**
 - The `license_management` job searches the application's dependencies to determine each of their
-  licenses and is allowed to fail ([Auto License Management](index.md#auto-license-management-ultimate)) **(ULTIMATE)**
+  licenses and is allowed to fail ([Auto License Compliance](index.md#auto-license-compliance-ultimate)) **(ULTIMATE)**
 
 NOTE: **Note:**
 As you might have noticed, all jobs except `test` are allowed to fail in the
diff --git a/doc/user/application_security/index.md b/doc/user/application_security/index.md
index 83ea0ea3386..fcd683ca2db 100644
--- a/doc/user/application_security/index.md
+++ b/doc/user/application_security/index.md
@@ -28,7 +28,7 @@ GitLab can scan and report any vulnerabilities found in your project.
 | [Dependency List](dependency_list/index.md) **(ULTIMATE)**                   | View your project's dependencies and their known vulnerabilities.      |
 | [Dependency Scanning](dependency_scanning/index.md) **(ULTIMATE)**           | Analyze your dependencies for known vulnerabilities.                   |
 | [Dynamic Application Security Testing (DAST)](dast/index.md) **(ULTIMATE)**  | Analyze running web applications for known vulnerabilities.            |
-| [License Management](license_management/index.md) **(ULTIMATE)**             | Search your project's dependencies for their licenses.                 |
+| [License Compliance](license_management/index.md) **(ULTIMATE)**             | Search your project's dependencies for their licenses.                 |
 | [Security Dashboard](security_dashboard/index.md) **(ULTIMATE)**             | View vulnerabilities in all your projects and groups.                  |
 | [Static Application Security Testing (SAST)](sast/index.md) **(ULTIMATE)**   | Analyze source code for known vulnerabilities.                         |
 
diff --git a/doc/user/application_security/license_management/index.md b/doc/user/application_security/license_management/index.md
index c324848c703..912f2f0e209 100644
--- a/doc/user/application_security/license_management/index.md
+++ b/doc/user/application_security/license_management/index.md
@@ -2,7 +2,7 @@
 type: reference, howto
 ---
 
-# License Management **(ULTIMATE)**
+# License Compliance **(ULTIMATE)**
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5483)
 in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.0.
@@ -10,18 +10,18 @@ in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.0.
 ## Overview
 
 If you are using [GitLab CI/CD](../../../ci/README.md), you can search your project dependencies for their licenses
-using License Management.
+using License Compliance.
 
-You can take advantage of License Management by either [including the job](#configuration)
+You can take advantage of License Compliance by either [including the job](#configuration)
 in your existing `.gitlab-ci.yml` file or by implicitly using
-[Auto License Management](../../../topics/autodevops/index.md#auto-license-management-ultimate)
+[Auto License Compliance](../../../topics/autodevops/index.md#auto-license-compliance-ultimate)
 that is provided by [Auto DevOps](../../../topics/autodevops/index.md).
 
-GitLab checks the License Management report, compares the licenses between the
+GitLab checks the License Compliance report, compares the licenses between the
 source and target branches, and shows the information right on the merge request.
 Blacklisted licenses will be clearly visible with an `x` red icon next to them
 as well as new licenses which need a decision from you. In addition, you can
-[manually approve or blacklist](#project-policies-for-license-management)
+[manually approve or blacklist](#project-policies-for-license-compliance)
 licenses in your project's settings.
 
 NOTE: **Note:**
@@ -31,7 +31,7 @@ will be displayed in the merge request area. That is the case when you add the
 Consecutive merge requests will have something to compare to and the license
 management report will be shown properly.
 
-![License Management Widget](img/license_management.png)
+![License Compliance Widget](img/license_management.png)
 
 If you are a project or group Maintainer, you can click on a license to be given
 the choice to approve it or blacklist it.
@@ -66,12 +66,12 @@ The following languages and package managers are supported.
 
 ## Requirements
 
-To run a License Management scanning job, you need GitLab Runner with the
+To run a License Compliance scanning job, you need GitLab Runner with the
 [`docker` executor](https://docs.gitlab.com/runner/executors/docker.html).
 
 ## Configuration
 
-For GitLab 11.9 and later, to enable License Management, you must
+For GitLab 11.9 and later, to enable License Compliance, you must
 [include](../../../ci/yaml/README.md#includetemplate) the
 [`License-Management.gitlab-ci.yml` template](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/lib/gitlab/ci/templates/Security/License-Management.gitlab-ci.yml)
 that's provided as a part of your GitLab installation.
@@ -89,14 +89,14 @@ The included template will create a `license_management` job in your CI/CD pipel
 and scan your dependencies to find their licenses.
 
 The results will be saved as a
-[License Management report artifact](../../../ci/yaml/README.md#artifactsreportslicense_management-ultimate)
+[License Compliance report artifact](../../../ci/yaml/README.md#artifactsreportslicense_management-ultimate)
 that you can later download and analyze. Due to implementation limitations, we
-always take the latest License Management artifact available. Behind the scenes, the
-[GitLab License Management Docker image](https://gitlab.com/gitlab-org/security-products/license-management)
+always take the latest License Compliance artifact available. Behind the scenes, the
+[GitLab License Compliance Docker image](https://gitlab.com/gitlab-org/security-products/license-management)
 is used to detect the languages/frameworks and in turn analyzes the licenses.
 
-The License Management settings can be changed through environment variables by using the
-[`variables`](../../../ci/yaml/README.md#variables) parameter in `.gitlab-ci.yml`. These variables are documented in the [License Management documentation](https://gitlab.com/gitlab-org/security-products/license-management#settings).
+The License Compliance settings can be changed through environment variables by using the
+[`variables`](../../../ci/yaml/README.md#variables) parameter in `.gitlab-ci.yml`. These variables are documented in the [License Compliance documentation](https://gitlab.com/gitlab-org/security-products/license-management#settings).
 
 ### Installing custom dependencies
 
@@ -143,7 +143,7 @@ license_management:
 
 ### Configuring Maven projects
 
-The License Management tool provides a `MAVEN_CLI_OPTS` environment variable which can hold
+The License Compliance tool provides a `MAVEN_CLI_OPTS` environment variable which can hold
 the command line arguments to pass to the `mvn install` command which is executed under the hood.
 Feel free to use it for the customization of Maven execution. For example:
 
@@ -169,7 +169,7 @@ If you still need to run tests during `mvn install`, add `-DskipTests=false` to
 
 > [Introduced](https://gitlab.com/gitlab-org/security-products/license-management/merge_requests/36) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.0.
 
-License Management uses Python 2.7 and pip 10.0 by default.
+License Compliance uses Python 2.7 and pip 10.0 by default.
 If your project requires Python 3, you can switch to Python 3.5 and pip 19.1
 by setting the `LM_PYTHON_VERSION` environment variable to `3`.
 
@@ -182,7 +182,7 @@ license_management:
     LM_PYTHON_VERSION: 3
 ```
 
-## Project policies for License Management
+## Project policies for License Compliance
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5940)
 in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.4.
@@ -196,10 +196,10 @@ To approve or blacklist a license:
 
 1. Either use the **Manage licenses** button in the merge request widget, or
    navigate to the project's **Settings > CI/CD** and expand the
-   **License Management** section.
+   **License Compliance** section.
 1. Click the **Add a license** button.
 
-   ![License Management Add License](img/license_management_add_license.png)
+   ![License Compliance Add License](img/license_management_add_license.png)
 
 1. In the **License name** dropdown, either:
    - Select one of the available licenses. You can search for licenses in the field
@@ -211,17 +211,17 @@ To approve or blacklist a license:
 
 To modify an existing license:
 
-1. In the **License Management** list, click the **Approved/Declined** dropdown to change it to the desired status.
+1. In the **License Compliance** list, click the **Approved/Declined** dropdown to change it to the desired status.
 
-   ![License Management Settings](img/license_management_settings.png)
+   ![License Compliance Settings](img/license_management_settings.png)
 
 Searching for Licenses:
 
 1. Use the **Search** box to search for a specific license.
 
-   ![License Management Search](img/license_management_search.png)
+   ![License Compliance Search](img/license_management_search.png)
 
-## License Management report under pipelines
+## License Compliance report under pipelines
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5491)
 in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.2.
@@ -230,7 +230,7 @@ From your project's left sidebar, navigate to **CI/CD > Pipelines** and click on
 pipeline ID that has a `license_management` job to see the Licenses tab with the listed
 licenses (if any).
 
-![License Management Pipeline Tab](img/license_management_pipeline_tab.png)
+![License Compliance Pipeline Tab](img/license_management_pipeline_tab.png)
 
 <!-- ## Troubleshooting
 
diff --git a/doc/user/permissions.md b/doc/user/permissions.md
index 9ecc8a80b3a..80d1bf992ec 100644
--- a/doc/user/permissions.md
+++ b/doc/user/permissions.md
@@ -45,7 +45,7 @@ The following table depicts the various user permission levels in a project.
 | Leave comments                                    | ✓ (*1*) | ✓          | ✓           | ✓        | ✓      |
 | View Insights charts **(ULTIMATE)**               | ✓       | ✓          | ✓           | ✓        | ✓      |
 | View approved/blacklisted licenses **(ULTIMATE)** | ✓       | ✓          | ✓           | ✓        | ✓      |
-| View license management reports **(ULTIMATE)**    | ✓ (*1*) | ✓          | ✓           | ✓        | ✓      |
+| View License Compliance reports **(ULTIMATE)**    | ✓ (*1*) | ✓          | ✓           | ✓        | ✓      |
 | View Security reports **(ULTIMATE)**              | ✓ (*1*) | ✓          | ✓           | ✓        | ✓      |
 | View Dependency list **(ULTIMATE)**               | ✓ (*1*) | ✓          | ✓           | ✓        | ✓      |
 | View [Design Management](project/issues/design_management.md) pages **(PREMIUM)** | ✓ (*1*) | ✓          | ✓           | ✓        | ✓      |
diff --git a/doc/user/project/index.md b/doc/user/project/index.md
index 30ff0e9ff07..932e7fd10b2 100644
--- a/doc/user/project/index.md
+++ b/doc/user/project/index.md
@@ -98,7 +98,7 @@ When you create a project in GitLab, you'll have access to a large number of
 - [Maven packages](packages/maven_repository.md): your private Maven repository in GitLab. **(PREMIUM)**
 - [NPM packages](packages/npm_registry.md): your private NPM package registry in GitLab. **(PREMIUM)**
 - [Code owners](code_owners.md): specify code owners for certain files **(STARTER)**
-- [License Management](../application_security/license_management/index.md): approve and blacklist licenses for projects. **(ULTIMATE)**
+- [License Compliance](../application_security/license_management/index.md): approve and blacklist licenses for projects. **(ULTIMATE)**
 - [Dependency List](../application_security/dependency_list/index.md): view project dependencies. **(ULTIMATE)**
 
 ### Project integrations
diff --git a/doc/user/project/merge_requests/index.md b/doc/user/project/merge_requests/index.md
index 2794cbc0f39..04db54872d3 100644
--- a/doc/user/project/merge_requests/index.md
+++ b/doc/user/project/merge_requests/index.md
@@ -41,7 +41,7 @@ With **[GitLab Enterprise Edition][ee]**, you can also:
 - View the deployment process across projects with [Multi-Project Pipelines](../../../ci/multi_project_pipelines.md) **(PREMIUM)**
 - Request [approvals](merge_request_approvals.md) from your managers **(STARTER)**
 - Analyze the impact of your changes with [Code Quality reports](code_quality.md) **(STARTER)**
-- Manage the licenses of your dependencies with [License Management](../../application_security/license_management/index.md) **(ULTIMATE)**
+- Manage the licenses of your dependencies with [License Compliance](../../application_security/license_management/index.md) **(ULTIMATE)**
 - Analyze your source code for vulnerabilities with [Static Application Security Testing](../../application_security/sast/index.md) **(ULTIMATE)**
 - Analyze your running web applications for vulnerabilities with [Dynamic Application Security Testing](../../application_security/dast/index.md) **(ULTIMATE)**
 - Analyze your dependencies for vulnerabilities with [Dependency Scanning](../../application_security/dependency_scanning/index.md) **(ULTIMATE)**
@@ -57,7 +57,7 @@ A. Consider you are a software developer working in a team:
 1. You gather feedback from your team
 1. You work on the implementation optimizing code with [Code Quality reports](code_quality.md) **(STARTER)**
 1. You verify your changes with [JUnit test reports](../../../ci/junit_test_reports.md) in GitLab CI/CD
-1. You avoid using dependencies whose license is not compatible with your project with [License Management reports](license_management.md) **(ULTIMATE)**
+1. You avoid using dependencies whose license is not compatible with your project with [License Compliance reports](license_management.md) **(ULTIMATE)**
 1. You request the [approval](#merge-request-approvals-starter) from your manager
 1. Your manager pushes a commit with their final review, [approves the merge request](merge_request_approvals.md), and set it to [merge when pipeline succeeds](#merge-when-pipeline-succeeds) (Merge Request Approvals are available in GitLab Starter)
 1. Your changes get deployed to production with [manual actions](../../../ci/yaml/README.md#whenmanual) for GitLab CI/CD
-- 
cgit v1.2.1


From d2cb8f785edb6fbc9ce00c39d485423d45c0c219 Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Thu, 22 Aug 2019 08:50:31 +0000
Subject: Update docs to pass new markdownlint

Deletes extra spaces and line, makes lists consistent, and
fixes links.
---
 .mdlrc.style                                       |  2 +-
 doc/administration/instance_review.md              |  1 -
 doc/administration/job_artifacts.md                |  2 +-
 doc/administration/merge_request_diffs.md          |  2 +-
 doc/administration/plugins.md                      |  2 +-
 doc/administration/reply_by_email_postfix_setup.md |  2 +-
 doc/administration/uploads.md                      |  4 +--
 doc/api/README.md                                  |  4 +--
 doc/api/dependencies.md                            |  8 +++---
 doc/api/deploy_keys.md                             |  1 +
 doc/api/discussions.md                             |  2 +-
 doc/api/protected_branches.md                      | 32 +++++++++++-----------
 doc/api/settings.md                                |  2 +-
 doc/development/README.md                          |  2 +-
 doc/development/api_styleguide.md                  |  4 +--
 doc/development/automatic_ce_ee_merge.md           |  8 +++---
 doc/development/distributed_tracing.md             |  1 -
 doc/development/ee_features.md                     |  4 +--
 doc/development/lfs.md                             |  2 +-
 doc/development/rake_tasks.md                      |  1 -
 doc/development/repository_mirroring.md            |  2 +-
 doc/install/installation.md                        |  2 +-
 doc/integration/jenkins.md                         |  2 +-
 doc/integration/oauth2_generic.md                  |  2 +-
 doc/migrate_ci_to_ce/README.md                     |  2 +-
 doc/public_access/public_access.md                 |  2 +-
 doc/raketasks/backup_restore.md                    |  1 -
 doc/raketasks/cleanup.md                           |  6 +++-
 doc/raketasks/import.md                            |  6 ++--
 doc/raketasks/web_hooks.md                         | 12 ++++----
 doc/security/rate_limits.md                        |  1 -
 doc/university/README.md                           |  2 +-
 doc/update/patch_versions.md                       |  2 +-
 doc/update/upgrading_from_ce_to_ee.md              |  2 +-
 doc/update/upgrading_from_source.md                |  2 +-
 doc/user/markdown.md                               | 21 +-------------
 doc/workflow/git_annex.md                          |  2 +-
 doc/workflow/notifications.md                      |  4 +--
 38 files changed, 70 insertions(+), 89 deletions(-)

diff --git a/.mdlrc.style b/.mdlrc.style
index b315c99e3fc..85bc3aaa99b 100644
--- a/.mdlrc.style
+++ b/.mdlrc.style
@@ -18,7 +18,7 @@ rule "MD025"
 rule "MD028"
 rule "MD029", :style => :one
 rule "MD030"
-rule "MD032"
+# rule "MD032"
 rule "MD034"
 rule "MD037"
 rule "MD038"
diff --git a/doc/administration/instance_review.md b/doc/administration/instance_review.md
index ab6a4646a71..825435deff9 100644
--- a/doc/administration/instance_review.md
+++ b/doc/administration/instance_review.md
@@ -14,4 +14,3 @@ Additionally you will be contacted by our team for further review which should h
 
 [6995]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/6995
 [ee]: https://about.gitlab.com/pricing/
-
diff --git a/doc/administration/job_artifacts.md b/doc/administration/job_artifacts.md
index 2b624f8de77..60921ca791f 100644
--- a/doc/administration/job_artifacts.md
+++ b/doc/administration/job_artifacts.md
@@ -115,7 +115,7 @@ The connection settings match those provided by [Fog](https://github.com/fog), a
 | `aws_access_key_id` | AWS credentials, or compatible | |
 | `aws_secret_access_key` | AWS credentials, or compatible | |
 | `aws_signature_version` | AWS signature version to use. 2 or 4 are valid options. Digital Ocean Spaces and other providers may need 2. | 4 |
-| `enable_signature_v4_streaming` | Set to true to enable HTTP chunked transfers with AWS v4 signatures (https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html). Oracle Cloud S3 needs this to be false | true
+| `enable_signature_v4_streaming` | Set to true to enable HTTP chunked transfers with [AWS v4 signatures](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html). Oracle Cloud S3 needs this to be false | true |
 | `region` | AWS region | us-east-1 |
 | `host` | S3 compatible host for when not using AWS, e.g. `localhost` or `storage.example.com` | s3.amazonaws.com |
 | `endpoint` | Can be used when configuring an S3 compatible service such as [Minio](https://www.minio.io), by entering a URL such as `http://127.0.0.1:9000` | (optional) |
diff --git a/doc/administration/merge_request_diffs.md b/doc/administration/merge_request_diffs.md
index 0b065082ded..d52d865cec5 100644
--- a/doc/administration/merge_request_diffs.md
+++ b/doc/administration/merge_request_diffs.md
@@ -90,7 +90,7 @@ The connection settings match those provided by [Fog](https://github.com/fog), a
 | `aws_access_key_id` | AWS credentials, or compatible | |
 | `aws_secret_access_key` | AWS credentials, or compatible | |
 | `aws_signature_version` | AWS signature version to use. 2 or 4 are valid options. Digital Ocean Spaces and other providers may need 2. | 4 |
-| `enable_signature_v4_streaming` | Set to true to enable HTTP chunked transfers with AWS v4 signatures (https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html). Oracle Cloud S3 needs this to be false | true
+| `enable_signature_v4_streaming` | Set to true to enable HTTP chunked transfers with [AWS v4 signatures](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html). Oracle Cloud S3 needs this to be false | true |
 | `region` | AWS region | us-east-1 |
 | `host` | S3 compatible host for when not using AWS, e.g. `localhost` or `storage.example.com` | s3.amazonaws.com |
 | `endpoint` | Can be used when configuring an S3 compatible service such as [Minio](https://www.minio.io), by entering a URL such as `http://127.0.0.1:9000` | (optional) |
diff --git a/doc/administration/plugins.md b/doc/administration/plugins.md
index 4cf3c607dae..52f1e7cde28 100644
--- a/doc/administration/plugins.md
+++ b/doc/administration/plugins.md
@@ -112,4 +112,4 @@ Validating plugins from /plugins directory
 
 [system hooks]: ../system_hooks/system_hooks.md
 [webhooks]: ../user/project/integrations/webhooks.md
-[highly available]: ./high_availability/README.md
\ No newline at end of file
+[highly available]: ./high_availability/README.md
diff --git a/doc/administration/reply_by_email_postfix_setup.md b/doc/administration/reply_by_email_postfix_setup.md
index 406f7e8a034..6d1ffbffefb 100644
--- a/doc/administration/reply_by_email_postfix_setup.md
+++ b/doc/administration/reply_by_email_postfix_setup.md
@@ -331,7 +331,7 @@ Courier, which we will install later to add IMAP authentication, requires mailbo
       a logout
       ```
 
-## Done!
+## Done
 
 If all the tests were successful, Postfix is all set up and ready to receive email! Continue with the [incoming email] guide to configure GitLab.
 
diff --git a/doc/administration/uploads.md b/doc/administration/uploads.md
index 99f1c386183..9e9d12f23bb 100644
--- a/doc/administration/uploads.md
+++ b/doc/administration/uploads.md
@@ -78,7 +78,7 @@ The connection settings match those provided by [Fog](https://github.com/fog), a
 | `aws_access_key_id` | AWS credentials, or compatible | |
 | `aws_secret_access_key` | AWS credentials, or compatible | |
 | `aws_signature_version` | AWS signature version to use. 2 or 4 are valid options. Digital Ocean Spaces and other providers may need 2. | 4 |
-| `enable_signature_v4_streaming` | Set to true to enable HTTP chunked transfers with AWS v4 signatures (https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html). Oracle Cloud S3 needs this to be false | true
+| `enable_signature_v4_streaming` | Set to true to enable HTTP chunked transfers with [AWS v4 signatures](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html). Oracle Cloud S3 needs this to be false | true |
 | `region` | AWS region | us-east-1 |
 | `host` | S3 compatible host for when not using AWS, e.g. `localhost` or `storage.example.com` | s3.amazonaws.com |
 | `endpoint` | Can be used when configuring an S3 compatible service such as [Minio](https://www.minio.io), by entering a URL such as `http://127.0.0.1:9000` | (optional) |
@@ -220,7 +220,7 @@ _The uploads are stored by default in
          openstack_temp_url_key: OPENSTACK_TEMP_URL_KEY
          openstack_auth_url: 'https://auth.cloud.ovh.net/v2.0/'
          openstack_region: DE1
-         openstack_tenant: 'TENANT_ID' 
+         openstack_tenant: 'TENANT_ID'
    ```
 
 1. Save the file and [reconfigure GitLab][] for the changes to take effect.
diff --git a/doc/api/README.md b/doc/api/README.md
index 9156d719e11..33394d46a2d 100644
--- a/doc/api/README.md
+++ b/doc/api/README.md
@@ -157,8 +157,8 @@ for example, without needing to explicitly pass an access token.
 With a few API endpoints you can use a [GitLab CI job token](../user/project/new_ci_build_permissions_model.md#job-token)
 to authenticate with the API:
 
-* [Get job artifacts](jobs.md#get-job-artifacts)
-* [Pipeline triggers](pipeline_triggers.md)
+- [Get job artifacts](jobs.md#get-job-artifacts)
+- [Pipeline triggers](pipeline_triggers.md)
 
 ### Impersonation tokens
 
diff --git a/doc/api/dependencies.md b/doc/api/dependencies.md
index 015ffbe60f6..5767d3572dd 100644
--- a/doc/api/dependencies.md
+++ b/doc/api/dependencies.md
@@ -5,15 +5,15 @@ This API is in an alpha stage and considered unstable.
 The response payload may be subject to change or breakage
 across GitLab releases.
 
-Every call to this endpoint requires authentication. To perform this call, user should be authorized to read 
-[Project Security Dashboard](../user/application_security/security_dashboard/index.md#project-security-dashboard). 
+Every call to this endpoint requires authentication. To perform this call, user should be authorized to read
+[Project Security Dashboard](../user/application_security/security_dashboard/index.md#project-security-dashboard).
 
 ## List project dependencies
 
-Get a list of project dependencies. This API partially mirroring 
+Get a list of project dependencies. This API partially mirroring
 [Dependency List](../user/application_security/dependency_list/index.md) feature.
 This list can be generated only for [languages and package managers](../user/application_security/dependency_scanning/index.md#supported-languages-and-package-managers)
-supported by Gemnasium. 
+supported by Gemnasium.
 
 ```
 GET /projects/:id/dependencies
diff --git a/doc/api/deploy_keys.md b/doc/api/deploy_keys.md
index 94351e1a300..df8cf06fc4a 100644
--- a/doc/api/deploy_keys.md
+++ b/doc/api/deploy_keys.md
@@ -203,6 +203,7 @@ Example response:
    "created_at" : "2015-08-29T12:44:31.550Z"
 }
 ```
+
 ## Adding deploy keys to multiple projects
 
 If you want to easily add the same deploy key to multiple projects in the same
diff --git a/doc/api/discussions.md b/doc/api/discussions.md
index b4a2d0b15f6..12dbba78291 100644
--- a/doc/api/discussions.md
+++ b/doc/api/discussions.md
@@ -160,7 +160,7 @@ curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab
 Adds a new note to the thread. This can also [create a thread from a single comment](../user/discussions/#start-a-thread-by-replying-to-a-standard-comment).
 
 **WARNING**
-Notes can be added to other items than comments (system notes, etc.) making them threads. 
+Notes can be added to other items than comments (system notes, etc.) making them threads.
 
 ```
 POST /projects/:id/issues/:issue_iid/discussions/:discussion_id/notes
diff --git a/doc/api/protected_branches.md b/doc/api/protected_branches.md
index 9309306ba05..ffb4a70168b 100644
--- a/doc/api/protected_branches.md
+++ b/doc/api/protected_branches.md
@@ -185,6 +185,7 @@ Example response:
     {
       "access_level": 30,
       "access_level_description": "Developers + Maintainers"
+    }
   ],
   "unprotect_access_levels": [
     {
@@ -217,6 +218,7 @@ Example response:
       "user_id": null,
       "group_id": null,
       "access_level_description": "Developers + Maintainers"
+    }
   ],
   "unprotect_access_levels": [
     {
@@ -232,7 +234,7 @@ Example response:
 ### Example with user / group level access **(STARTER)**
 
 Elements in the `allowed_to_push` / `allowed_to_merge` / `allowed_to_unprotect` array should take the
-form `{user_id: integer}`, `{group_id: integer}` or `{access_level: integer}`. Each user must have access to the project and each group must [have this project shared](../user/project/members/share_project_with_groups.md). These access levels allow [more granular control over protected branch access](../user/project/protected_branches.md#restricting-push-and-merge-access-to-certain-users-starter) and were [added to the API in ][ee-3516] in GitLab 10.3 EE.
+form `{user_id: integer}`, `{group_id: integer}` or `{access_level: integer}`. Each user must have access to the project and each group must [have this project shared](../user/project/members/share_project_with_groups.md). These access levels allow [more granular control over protected branch access](../user/project/protected_branches.md#restricting-push-and-merge-access-to-certain-users-starter) and were [added to the API in](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/3516) in GitLab 10.3 EE.
 
 ```bash
 curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" 'https://gitlab.example.com/api/v4/projects/5/protected_branches?name=*-stable&allowed_to_push%5B%5D%5Buser_id%5D=1'
@@ -242,29 +244,29 @@ Example response:
 
 ```json
 {
-  "name":"*-stable",
+  "name": "*-stable",
   "push_access_levels": [
     {
-      "access_level":null,
-      "user_id":1,
-      "group_id":null,
-      "access_level_description":"Administrator"
+      "access_level": null,
+      "user_id": 1,
+      "group_id": null,
+      "access_level_description": "Administrator"
     }
   ],
   "merge_access_levels": [
     {
-      "access_level":40,
-      "user_id":null,
-      "group_id":null,
-      "access_level_description":"Maintainers"
+      "access_level": 40,
+      "user_id": null,
+      "group_id": null,
+      "access_level_description": "Maintainers"
     }
   ],
   "unprotect_access_levels": [
     {
-      "access_level":40,
-      "user_id":null,
-      "group_id":null,
-      "access_level_description":"Maintainers"
+      "access_level": 40,
+      "user_id": null,
+      "group_id": null,
+      "access_level_description": "Maintainers"
     }
   ]
 }
@@ -286,5 +288,3 @@ curl --request DELETE --header "PRIVATE-TOKEN: <your_access_token>" 'https://git
 | --------- | ---- | -------- | ----------- |
 | `id` | integer/string | yes | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
 | `name` | string | yes | The name of the branch |
-
-[ee-3516]: https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/3516 "ProtectedBranches API handles per user/group granularity"
diff --git a/doc/api/settings.md b/doc/api/settings.md
index 248d19461f6..4b5b2b924d7 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -322,7 +322,7 @@ are listed in the descriptions of the relevant settings.
 | `version_check_enabled`                  | boolean          | no                                   | Let GitLab inform you when an update is available. |
 | `local_markdown_version`                 | integer          | no                                   | Increase this value when any cached markdown should be invalidated. |
 | `snowplow_enabled`                       | boolean          | no                                   | Enable snowplow tracking. |
-| `snowplow_collector_hostname`            | string           | required by: `snowplow_enabled`      | The Snowplow collector hostname. (e.g. `snowplow.trx.gitlab.net`) | 
+| `snowplow_collector_hostname`            | string           | required by: `snowplow_enabled`      | The Snowplow collector hostname. (e.g. `snowplow.trx.gitlab.net`) |
 | `snowplow_site_id`                       | string           | no                                   | The Snowplow site name / application id. (e.g. `gitlab`) |
 | `snowplow_cookie_domain`                 | string           | no                                   | The Snowplow cookie domain. (e.g. `.gitlab.com`) |
 | `geo_node_allowed_ips`                   | string           | yes                                  | **(PREMIUM)** Comma-separated list of IPs and CIDRs of allowed secondary nodes. For example, `1.1.1.1, 2.2.2.0/24`. |
diff --git a/doc/development/README.md b/doc/development/README.md
index 6281bb809ff..09aa64a7bf1 100644
--- a/doc/development/README.md
+++ b/doc/development/README.md
@@ -5,7 +5,7 @@ description: 'Learn how to contribute to GitLab.'
 
 # Contributor and Development Docs
 
-## Get started!
+## Get started
 
 - Set up GitLab's development environment with [GitLab Development Kit (GDK)](https://gitlab.com/gitlab-org/gitlab-development-kit/blob/master/doc/howto/README.md)
 - [GitLab contributing guide](contributing/index.md)
diff --git a/doc/development/api_styleguide.md b/doc/development/api_styleguide.md
index 0866d3baeeb..61576236c96 100644
--- a/doc/development/api_styleguide.md
+++ b/doc/development/api_styleguide.md
@@ -51,7 +51,7 @@ allowed.
 
 – <https://github.com/ruby-grape/grape#declared>
 
-### Exclude params from parent namespaces!
+### Exclude params from parent namespaces
 
 > By default `declared(params)`includes parameters that were defined in all
 parent namespaces.
@@ -64,7 +64,7 @@ In most cases you will want to exclude params from the parent namespaces:
 declared(params, include_parent_namespaces: false)
 ```
 
-### When to use `declared(params)`?
+### When to use `declared(params)`
 
 You should always use `declared(params)` when you pass the params hash as
 arguments to a method call.
diff --git a/doc/development/automatic_ce_ee_merge.md b/doc/development/automatic_ce_ee_merge.md
index 001a92790e1..158606aa6a2 100644
--- a/doc/development/automatic_ce_ee_merge.md
+++ b/doc/development/automatic_ce_ee_merge.md
@@ -173,13 +173,13 @@ Now, every time you create an MR for CE and EE:
 
 ## How we run the Automatic CE->EE merge at GitLab
 
-At GitLab, we use the [Merge Train](https://gitlab.com/gitlab-org/merge-train) 
-project to keep our [gitlab-ee](https://gitlab.com/gitlab-org/gitlab-ee) 
-repository updated with commits from 
+At GitLab, we use the [Merge Train](https://gitlab.com/gitlab-org/merge-train)
+project to keep our [gitlab-ee](https://gitlab.com/gitlab-org/gitlab-ee)
+repository updated with commits from
 [gitlab-ce](https://gitlab.com/gitlab-org/gitlab-ce).
 
 We have a mirror of the [Merge Train](https://gitlab.com/gitlab-org/merge-train)
-project [configured](https://ops.gitlab.net/gitlab-org/merge-train) to run an 
+project [configured](https://ops.gitlab.net/gitlab-org/merge-train) to run an
 automatic CE->EE merge job every twenty minutes as a scheduled CI job.  The
 [configured](https://ops.gitlab.net/gitlab-org/merge-train) Merge Train project
 is only accessible to authorized GitLab staff.
diff --git a/doc/development/distributed_tracing.md b/doc/development/distributed_tracing.md
index bfce7488a8d..4776c8348d4 100644
--- a/doc/development/distributed_tracing.md
+++ b/doc/development/distributed_tracing.md
@@ -179,4 +179,3 @@ By default, the Jaeger search UI is available at <http://localhost:16686/search>
 TIP: **Tip:**
 Don't forget that you will need to generate traces by using the application before
 they appear in the Jaeger UI.
-
diff --git a/doc/development/ee_features.md b/doc/development/ee_features.md
index 2217dedccd3..a732a94b7c4 100644
--- a/doc/development/ee_features.md
+++ b/doc/development/ee_features.md
@@ -945,7 +945,7 @@ export default {
 - Since we [can't async load a mixin](https://github.com/vuejs/vue-loader/issues/418#issuecomment-254032223) we will use the [`ee_else_ce`](../development/ee_features.md#javascript-code-in-assetsjavascripts) alias we already have for webpack.
   - This means all the EE specific props, computed properties, methods, etc that are EE only should be in a mixin in the `ee/` folder and we need to create a CE counterpart of the mixin
 
-##### Example:
+##### Example
 
 ```javascript
 import mixin from 'ee_else_ce/path/mixin';
@@ -976,7 +976,7 @@ For regular JS files, the approach is similar.
    1. An EE file should be created with the EE only code, and it should extend the CE counterpart.
    1. For code inside functions that can't be extended, the code should be moved into a new file and we should use `ee_else_ce` helper:
 
-#### Example:
+#### Example
 
 ```javascript
   import eeCode from 'ee_else_ce/ee_code';
diff --git a/doc/development/lfs.md b/doc/development/lfs.md
index 8c3408eb6e2..cb4c2d8967b 100644
--- a/doc/development/lfs.md
+++ b/doc/development/lfs.md
@@ -8,4 +8,4 @@ In April 2019, Francisco Javier López hosted a [Deep Dive] on GitLab's [Git LFS
 [Git LFS]: ../workflow/lfs/manage_large_binaries_with_git_lfs.html
 [recording on YouTube]: https://www.youtube.com/watch?v=Yyxwcksr0Qc
 [Google Slides]: https://docs.google.com/presentation/d/1E-aw6-z0rYd0346YhIWE7E9A65zISL9iIMAOq2zaw9E/edit
-[PDF]: https://gitlab.com/gitlab-org/create-stage/uploads/07a89257a140db067bdfb484aecd35e1/Git_LFS_Deep_Dive__Create_.pdf
\ No newline at end of file
+[PDF]: https://gitlab.com/gitlab-org/create-stage/uploads/07a89257a140db067bdfb484aecd35e1/Git_LFS_Deep_Dive__Create_.pdf
diff --git a/doc/development/rake_tasks.md b/doc/development/rake_tasks.md
index fc96820c555..e9d6cfe00b2 100644
--- a/doc/development/rake_tasks.md
+++ b/doc/development/rake_tasks.md
@@ -216,4 +216,3 @@ bundle exec rake routes
 
 Since these take some time to create, it's often helpful to save the output to
 a file for quick reference.
-
diff --git a/doc/development/repository_mirroring.md b/doc/development/repository_mirroring.md
index f8c33ff2b85..dc51bf80e92 100644
--- a/doc/development/repository_mirroring.md
+++ b/doc/development/repository_mirroring.md
@@ -8,4 +8,4 @@ In December 2018, Tiago Botelho hosted a [Deep Dive] on GitLab's [Pull Repositor
 [Pull Repository Mirroring functionality]: ../workflow/repository_mirroring.md#pulling-from-a-remote-repository-starter
 [recording on YouTube]: https://www.youtube.com/watch?v=sSZq0fpdY-Y
 [Google Slides]: https://docs.google.com/presentation/d/17BTT6M6RyNRckV4wTt-dr07nIfBvD325_xVBoLtSoPM/edit?usp=sharing
-[PDF]: https://gitlab.com/gitlab-org/create-stage/uploads/8693404888a941fd851f8a8ecdec9675/Gitlab_Create_-_Pull_Mirroring_Deep_Dive.pdf
\ No newline at end of file
+[PDF]: https://gitlab.com/gitlab-org/create-stage/uploads/8693404888a941fd851f8a8ecdec9675/Gitlab_Create_-_Pull_Mirroring_Deep_Dive.pdf
diff --git a/doc/install/installation.md b/doc/install/installation.md
index 295d9804497..6d64b8a4936 100644
--- a/doc/install/installation.md
+++ b/doc/install/installation.md
@@ -789,7 +789,7 @@ nginx: configuration file /etc/nginx/nginx.conf test failed`
 sudo service nginx restart
 ```
 
-## Done!
+## Post-install
 
 ### Double-check Application Status
 
diff --git a/doc/integration/jenkins.md b/doc/integration/jenkins.md
index 6755640d39c..d865f977799 100644
--- a/doc/integration/jenkins.md
+++ b/doc/integration/jenkins.md
@@ -35,7 +35,7 @@ and [Migrating from Jenkins to GitLab](https://www.youtube.com/watch?v=RlEVGOpYF
 
 For a real use case, read the blog post [Continuous integration: From Jenkins to GitLab using Docker](https://about.gitlab.com/2017/07/27/docker-my-precious/).
 
-NOTE: **Moving from a traditional CI plug-in to a single application for the entire software development lifecycle can decrease hours spent on maintaining toolchains by 10% or more.** 
+NOTE: **Moving from a traditional CI plug-in to a single application for the entire software development lifecycle can decrease hours spent on maintaining toolchains by 10% or more.**
 Visit the ['GitLab vs. Jenkins' comparison page](https://about.gitlab.com/devops-tools/jenkins-vs-gitlab.html) to learn how our built-in CI compares to Jenkins.
 
 ## Requirements
diff --git a/doc/integration/oauth2_generic.md b/doc/integration/oauth2_generic.md
index f4119b1d1ce..ad59592c45f 100644
--- a/doc/integration/oauth2_generic.md
+++ b/doc/integration/oauth2_generic.md
@@ -12,7 +12,7 @@ This strategy is designed to allow configuration of the simple OmniAuth SSO proc
 1. Strategy parses user information from the response, using a **configurable** format
 1. GitLab finds or creates the returned user and logs them in
 
-## Limitations of this Strategy:
+## Limitations of this Strategy
 
 - It can only be used for Single Sign on, and will not provide any other access granted by any OAuth provider
   (importing projects or users, etc)
diff --git a/doc/migrate_ci_to_ce/README.md b/doc/migrate_ci_to_ce/README.md
index 9947c19a667..2b8379141c3 100644
--- a/doc/migrate_ci_to_ce/README.md
+++ b/doc/migrate_ci_to_ce/README.md
@@ -227,7 +227,7 @@ sudo mv /path/to/12345_gitlab_ci_backup.tar /var/opt/gitlab/backups/
 sudo mv /path/to/12345_gitlab_ci_backup.tar /home/git/gitlab/tmp/backups/
 ```
 
-### 5. Import the CI data into GitLab.
+### 5. Import the CI data into GitLab
 
 This step will delete any existing CI data on your GitLab server. There should
 be no CI data yet because you turned CI on the GitLab server off earlier.
diff --git a/doc/public_access/public_access.md b/doc/public_access/public_access.md
index 0142e5075cc..dc6ee9b2503 100644
--- a/doc/public_access/public_access.md
+++ b/doc/public_access/public_access.md
@@ -6,7 +6,7 @@ type: reference
 
 GitLab allows [Owners](../user/permissions.md) to set a projects' visibility as **public**, **internal**
 or **private**. These visibility levels affect who can see the project in the
-public access directory (`/public` under your GitLab instance), like at [https://gitlab.com/public]().
+public access directory (`/public` under your GitLab instance), like at <https://gitlab.com/public>
 
 ## Visibility of projects
 
diff --git a/doc/raketasks/backup_restore.md b/doc/raketasks/backup_restore.md
index 51f04df27c7..b4b7d711d5a 100644
--- a/doc/raketasks/backup_restore.md
+++ b/doc/raketasks/backup_restore.md
@@ -978,4 +978,3 @@ If this happens, check the following:
 
 1. Confirm there is sufficent diskspace for the gzip operation.
 1. If NFS is being used, check if the mount option `timeo` is set. The default is `600`, and changing this to smaller values have resulted in this error.
-
diff --git a/doc/raketasks/cleanup.md b/doc/raketasks/cleanup.md
index 832078d23cb..f84d29cca9a 100644
--- a/doc/raketasks/cleanup.md
+++ b/doc/raketasks/cleanup.md
@@ -1,6 +1,10 @@
 # Cleanup
 
-## Remove garbage from filesystem. Important! Data loss!
+## Remove garbage from filesystem
+
+DANGER: **Danger:**
+The commands below will remove data permanently from your GitLab instance. Only use
+these commands if you are 100% certain that it is safe to delete this data.
 
 Remove namespaces(dirs) from all repository storage paths if they don't exist in GitLab database.
 
diff --git a/doc/raketasks/import.md b/doc/raketasks/import.md
index 8f65fab366e..c76180a242e 100644
--- a/doc/raketasks/import.md
+++ b/doc/raketasks/import.md
@@ -11,7 +11,7 @@
 
 ## How to use
 
-### Create a new folder to import your Git repositories from.
+### Create a new folder to import your Git repositories from
 
 The new folder needs to have git user ownership and read/write/execute access for git user and its group:
 
@@ -19,7 +19,7 @@ The new folder needs to have git user ownership and read/write/execute access fo
 sudo -u git mkdir -p /var/opt/gitlab/git-data/repository-import-<date>/new_group
 ```
 
-### Copy your bare repositories inside this newly created folder:
+### Copy your bare repositories inside this newly created folder
 
 - Any .git repositories found on any of the subfolders will be imported as projects
 - Groups will be created as needed, these could be nested folders. Example:
@@ -38,7 +38,7 @@ sudo chown -R git:git /var/opt/gitlab/git-data/repository-import-<date>
 
 If you are using an installation from source, replace `/var/opt/gitlab/` with `/home/git`.
 
-### Run the command below depending on your type of installation:
+### Run the command below depending on your type of installation
 
 #### Omnibus Installation
 
diff --git a/doc/raketasks/web_hooks.md b/doc/raketasks/web_hooks.md
index cc1166a04cc..d9a042ec8fe 100644
--- a/doc/raketasks/web_hooks.md
+++ b/doc/raketasks/web_hooks.md
@@ -1,6 +1,6 @@
 # Webhooks administration **(CORE ONLY)**
 
-## Add a webhook for **ALL** projects:
+## Add a webhook for **ALL** projects
 
 ```sh
 # omnibus-gitlab
@@ -9,7 +9,7 @@ sudo gitlab-rake gitlab:web_hook:add URL="http://example.com/hook"
 bundle exec rake gitlab:web_hook:add URL="http://example.com/hook" RAILS_ENV=production
 ```
 
-## Add a webhook for projects in a given **NAMESPACE**:
+## Add a webhook for projects in a given **NAMESPACE**
 
 ```sh
 # omnibus-gitlab
@@ -18,7 +18,7 @@ sudo gitlab-rake gitlab:web_hook:add URL="http://example.com/hook" NAMESPACE=acm
 bundle exec rake gitlab:web_hook:add URL="http://example.com/hook" NAMESPACE=acme RAILS_ENV=production
 ```
 
-## Remove a webhook from **ALL** projects using:
+## Remove a webhook from **ALL** projects using
 
 ```sh
 # omnibus-gitlab
@@ -27,7 +27,7 @@ sudo gitlab-rake gitlab:web_hook:rm URL="http://example.com/hook"
 bundle exec rake gitlab:web_hook:rm URL="http://example.com/hook" RAILS_ENV=production
 ```
 
-## Remove a webhook from projects in a given **NAMESPACE**:
+## Remove a webhook from projects in a given **NAMESPACE**
 
 ```sh
 # omnibus-gitlab
@@ -36,7 +36,7 @@ sudo gitlab-rake gitlab:web_hook:rm URL="http://example.com/hook" NAMESPACE=acme
 bundle exec rake gitlab:web_hook:rm URL="http://example.com/hook" NAMESPACE=acme RAILS_ENV=production
 ```
 
-## List **ALL** webhooks:
+## List **ALL** webhooks
 
 ```sh
 # omnibus-gitlab
@@ -45,7 +45,7 @@ sudo gitlab-rake gitlab:web_hook:list
 bundle exec rake gitlab:web_hook:list RAILS_ENV=production
 ```
 
-## List the webhooks from projects in a given **NAMESPACE**:
+## List the webhooks from projects in a given **NAMESPACE**
 
 ```sh
 # omnibus-gitlab
diff --git a/doc/security/rate_limits.md b/doc/security/rate_limits.md
index c80f2f264b2..80088da77a0 100644
--- a/doc/security/rate_limits.md
+++ b/doc/security/rate_limits.md
@@ -30,4 +30,3 @@ similarly mitigated by a rate limit.
 This method of rate limiting is cumbersome, but has some advantages. It allows
 throttling of specific paths, and is also integrated into Git and container
 registry requests. See [Rack Attack initializer](rack_attack.md).
-
diff --git a/doc/university/README.md b/doc/university/README.md
index b17f40b91a5..25f77906e68 100644
--- a/doc/university/README.md
+++ b/doc/university/README.md
@@ -57,7 +57,7 @@ The GitLab University curriculum is composed of GitLab videos, screencasts, pres
 1. [Migrating from SVN](../user/project/import/svn.md)
 1. [Migrating from Fogbugz](../user/project/import/fogbugz.md)
 
-### 1.6. GitLab Inc.
+### 1.6. The GitLab team
 
 1. [About GitLab](https://about.gitlab.com/about/)
 1. [GitLab Direction](https://about.gitlab.com/direction/)
diff --git a/doc/update/patch_versions.md b/doc/update/patch_versions.md
index 0506d992d4b..6a41c6aec32 100644
--- a/doc/update/patch_versions.md
+++ b/doc/update/patch_versions.md
@@ -41,7 +41,7 @@ sudo -u git -H git checkout -- Gemfile.lock db/schema.rb locale
 sudo -u git -H git checkout LATEST_TAG -b LATEST_TAG
 ```
 
-### 3. Install libs, migrations, etc.
+### 3. Install libs, migrations, etc
 
 ```bash
 cd /home/git/gitlab
diff --git a/doc/update/upgrading_from_ce_to_ee.md b/doc/update/upgrading_from_ce_to_ee.md
index bea5bcd9dd7..49e2fb2568e 100644
--- a/doc/update/upgrading_from_ce_to_ee.md
+++ b/doc/update/upgrading_from_ce_to_ee.md
@@ -54,7 +54,7 @@ sudo -u git -H git remote add -f ee https://gitlab.com/gitlab-org/gitlab-ee.git
 sudo -u git -H git checkout EE_BRANCH
 ```
 
-### 3. Install libs, migrations, etc.
+### 3. Install libs, migrations, etc
 
 ```sh
 cd /home/git/gitlab
diff --git a/doc/update/upgrading_from_source.md b/doc/update/upgrading_from_source.md
index df35638cba2..f6b64dcf694 100644
--- a/doc/update/upgrading_from_source.md
+++ b/doc/update/upgrading_from_source.md
@@ -313,7 +313,7 @@ For Ubuntu 16.04.1 LTS:
 sudo systemctl daemon-reload
 ```
 
-### 13. Install libs, migrations, etc.
+### 13. Install libs, migrations, etc
 
 ```bash
 cd /home/git/gitlab
diff --git a/doc/user/markdown.md b/doc/user/markdown.md
index 6cfc8b6429b..17bbed2945d 100644
--- a/doc/user/markdown.md
+++ b/doc/user/markdown.md
@@ -57,12 +57,6 @@ render incorrectly:
   - milk
 ```
 
-1. Chocolate
-  - dark
-  - milk
-
----
-
 Simply add a space to each nested item to align the `-` with the first character of
 the top list item (`C` in this case):
 
@@ -265,8 +259,7 @@ this font installed by default.
 
 ### Front matter
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/23331)
-  in GitLab 11.6.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/23331) in GitLab 11.6.
 
 Front matter is metadata included at the beginning of a markdown document, preceding
 its content. This data can be used by static site generators such as [Jekyll](https://jekyllrb.com/docs/front-matter/),
@@ -866,18 +859,6 @@ or underscores
 ___
 ```
 
-Three or more hyphens,
-
----
-
-asterisks,
-
-***
-
-or underscores
-
-___
-
 ### Images
 
 Examples:
diff --git a/doc/workflow/git_annex.md b/doc/workflow/git_annex.md
index 9543859f86f..cdc38a5b7eb 100644
--- a/doc/workflow/git_annex.md
+++ b/doc/workflow/git_annex.md
@@ -200,7 +200,7 @@ searching for your distribution.
 Although there is no general guide for `git-annex` errors, there are a few tips
 on how to go around the warnings.
 
-### git-annex-shell: Not a git-annex or gcrypt repository.
+### git-annex-shell: Not a git-annex or gcrypt repository
 
 This warning can appear on the initial `git annex sync --content` and is caused
 by differences in `git-annex-shell`. You can read more about it
diff --git a/doc/workflow/notifications.md b/doc/workflow/notifications.md
index ccb8844aea3..5abae929355 100644
--- a/doc/workflow/notifications.md
+++ b/doc/workflow/notifications.md
@@ -53,7 +53,7 @@ These settings can be configured on group page under the name of the group. It w
 
 The group owner can disable email notifications for a group, which also includes
 it's subgroups and projects.  If this is the case, you will not receive any corresponding notifications,
-and the notification button will be disabled with an explanatory tooltip. 
+and the notification button will be disabled with an explanatory tooltip.
 
 ### Project Settings
 
@@ -66,7 +66,7 @@ These settings can be configured on project page under the name of the project.
 
 The project owner (or it's group owner) can disable email notifications for the project.
 If this is the case, you will not receive any corresponding notifications, and the notification
-button will be disabled with an explanatory tooltip. 
+button will be disabled with an explanatory tooltip.
 
 ## Notification events
 
-- 
cgit v1.2.1


From b9e21ad86fd176b5388c7b37d250d5ec60bc9abe Mon Sep 17 00:00:00 2001
From: Dimitrie Hoekstra <dimitrie@gitlab.com>
Date: Thu, 22 Aug 2019 10:20:26 +0000
Subject: Updated latest pipeline tag tooltip to be more descriptive

---
 app/assets/javascripts/pipelines/components/pipeline_url.vue | 2 +-
 app/views/projects/pipelines/_info.html.haml                 | 2 +-
 changelogs/unreleased/latest-pipeline.yml                    | 5 +++++
 locale/gitlab.pot                                            | 2 +-
 4 files changed, 8 insertions(+), 3 deletions(-)
 create mode 100644 changelogs/unreleased/latest-pipeline.yml

diff --git a/app/assets/javascripts/pipelines/components/pipeline_url.vue b/app/assets/javascripts/pipelines/components/pipeline_url.vue
index 4efc1d2408a..a08f732dda7 100644
--- a/app/assets/javascripts/pipelines/components/pipeline_url.vue
+++ b/app/assets/javascripts/pipelines/components/pipeline_url.vue
@@ -67,7 +67,7 @@ export default {
       <span
         v-if="pipeline.flags.latest"
         v-gl-tooltip
-        :title="__('Latest pipeline for this branch')"
+        :title="__('Latest pipeline for the most recent commit on this branch')"
         class="js-pipeline-url-latest badge badge-success"
       >
         {{ __('latest') }}
diff --git a/app/views/projects/pipelines/_info.html.haml b/app/views/projects/pipelines/_info.html.haml
index 9614f33fe2f..53bb3c7487d 100644
--- a/app/views/projects/pipelines/_info.html.haml
+++ b/app/views/projects/pipelines/_info.html.haml
@@ -21,7 +21,7 @@
     .icon-container
       = sprite_icon('flag')
     - if @pipeline.latest?
-      %span.js-pipeline-url-latest.badge.badge-success.has-tooltip{ title: _("Latest pipeline for this branch") }
+      %span.js-pipeline-url-latest.badge.badge-success.has-tooltip{ title: _("Latest pipeline for the most recent commit on this branch") }
         latest
     - if @pipeline.has_yaml_errors?
       %span.js-pipeline-url-yaml.badge.badge-danger.has-tooltip{ title: @pipeline.yaml_errors }
diff --git a/changelogs/unreleased/latest-pipeline.yml b/changelogs/unreleased/latest-pipeline.yml
new file mode 100644
index 00000000000..1177bb57121
--- /dev/null
+++ b/changelogs/unreleased/latest-pipeline.yml
@@ -0,0 +1,5 @@
+---
+title: Updated latest pipeline tag tooltip to be more descriptive
+merge_request: 31624
+author:
+type: changed
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 1c1a3a51932..0568bdbdfca 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -6502,7 +6502,7 @@ msgstr ""
 msgid "Latest changes"
 msgstr ""
 
-msgid "Latest pipeline for this branch"
+msgid "Latest pipeline for the most recent commit on this branch"
 msgstr ""
 
 msgid "Lead"
-- 
cgit v1.2.1


From b1cb426663da265485191e34b3b552f9f06c6cda Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Thu, 22 Aug 2019 10:41:14 +0000
Subject: Remove mention of Kubernetes service templates

This has since been removed
---
 doc/topics/autodevops/index.md | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/doc/topics/autodevops/index.md b/doc/topics/autodevops/index.md
index 26d5221acc5..6021e8cff1d 100644
--- a/doc/topics/autodevops/index.md
+++ b/doc/topics/autodevops/index.md
@@ -111,9 +111,8 @@ To make full use of Auto DevOps, you will need:
   a domain configured with wildcard DNS which is going to be used by all of your
   Auto DevOps applications. [Read the specifics](#auto-devops-base-domain).
 - **Kubernetes** (needed for Auto Review Apps, Auto Deploy, and Auto Monitoring) -
-  To enable deployments, you will need Kubernetes 1.5+. You need a [Kubernetes cluster][kubernetes-clusters]
-  for the project, or a Kubernetes [default service template](../../user/project/integrations/services_templates.md)
-  for the entire GitLab installation.
+  To enable deployments, you will need Kubernetes 1.5+. You will need a [Kubernetes cluster][kubernetes-clusters]
+  for the project.
   - **A load balancer** - You can use NGINX ingress by deploying it to your
     Kubernetes cluster using the
     [`nginx-ingress`](https://github.com/kubernetes/charts/tree/master/stable/nginx-ingress)
-- 
cgit v1.2.1


From d20209733a0af224e17b823db8dd69055306ef1e Mon Sep 17 00:00:00 2001
From: Lukas Eipert <leipert@gitlab.com>
Date: Thu, 22 Aug 2019 11:23:37 +0000
Subject: Update dependency @gitlab/ui to v5.18.0

---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 97ea872ee61..df5f758fa20 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "@babel/preset-env": "^7.5.5",
     "@gitlab/csslab": "^1.9.0",
     "@gitlab/svgs": "^1.68.0",
-    "@gitlab/ui": "5.15.0",
+    "@gitlab/ui": "5.18.0",
     "apollo-cache-inmemory": "^1.5.1",
     "apollo-client": "^2.5.1",
     "apollo-link": "^1.2.11",
diff --git a/yarn.lock b/yarn.lock
index 525c77e41d2..4489b10815a 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1003,10 +1003,10 @@
   resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.68.0.tgz#d631bd84ea7907592240d8417e82ba66d6a54c0c"
   integrity sha512-3JmIq0bHg4InjLooM+kQFPfg3d7B1Pye67pN9+12kZXIa0nRGuwKEq3WSbcS+ACdg5jcVPNPYqStItEO4teHdw==
 
-"@gitlab/ui@5.15.0":
-  version "5.15.0"
-  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-5.15.0.tgz#1ce92cfed77dcd63a90d751043b42b19e64431c9"
-  integrity sha512-YrYgERcmTxC+oP4GaY7onqvYgvTsyGCiiegQbZbXdNRLGGAmvfxWPzQRz8Ci9yIYkLvi0X2AV7BT8RTVOPQgXg==
+"@gitlab/ui@5.18.0":
+  version "5.18.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-5.18.0.tgz#f7f93ad41673f5ae081cd2246dda5456d3c956a2"
+  integrity sha512-umB7JCKVDZOajed0N563JBYSpiyK+VDL2eCdkinW+twWhMct8onoW4CLTpkgBi6Z9Y1Bq47aqnFtGf+1IKNIGw==
   dependencies:
     "@babel/standalone" "^7.0.0"
     "@gitlab/vue-toasted" "^1.2.1"
-- 
cgit v1.2.1


From e9169333fe9bbca1628a0f51a09515f83b588419 Mon Sep 17 00:00:00 2001
From: Olivier Gonzalez <ogonzalez@gitlab.com>
Date: Thu, 22 Aug 2019 11:25:27 +0000
Subject: Improve doc about bridge job limitations

---
 doc/ci/multi_project_pipelines.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/ci/multi_project_pipelines.md b/doc/ci/multi_project_pipelines.md
index cb8d383f7d9..61f260cb70d 100644
--- a/doc/ci/multi_project_pipelines.md
+++ b/doc/ci/multi_project_pipelines.md
@@ -205,5 +205,5 @@ Some features are not implemented yet. For example, support for environments.
 - `stage`
 - `allow_failure`
 - `only` and `except`
-- `when`
+- `when` (only with `on_success`, `on_failure`, and `always` values)
 - `extends`
-- 
cgit v1.2.1


From a5f6182753502a5e74b06836c9bb70d287bf6fe6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kamil=20Trzci=C5=84ski?= <ayufan@ayufan.eu>
Date: Thu, 22 Aug 2019 13:08:46 +0200
Subject: Optimise build queue service

This makes BuildQueueService to force refresh runners
that are considered to have recent queue.

Such runners are the ones that connected within online
interval + time to expire runner cache.
---
 app/models/ci/runner.rb                            |  28 ++++--
 app/services/ci/update_build_queue_service.rb      |   4 +
 .../unreleased/optimise-build-queue-service.yml    |   5 +
 spec/models/ci/runner_spec.rb                      |   7 ++
 .../services/ci/update_build_queue_service_spec.rb | 110 +++++++++++++--------
 5 files changed, 103 insertions(+), 51 deletions(-)
 create mode 100644 changelogs/unreleased/optimise-build-queue-service.yml

diff --git a/app/models/ci/runner.rb b/app/models/ci/runner.rb
index 43ff874ac23..1c1c7a5ae7a 100644
--- a/app/models/ci/runner.rb
+++ b/app/models/ci/runner.rb
@@ -23,13 +23,17 @@ module Ci
       project_type: 3
     }
 
-    RUNNER_QUEUE_EXPIRY_TIME = 60.minutes
     ONLINE_CONTACT_TIMEOUT = 1.hour
-    UPDATE_DB_RUNNER_INFO_EVERY = 40.minutes
+    RUNNER_QUEUE_EXPIRY_TIME = 1.hour
+
+    # This needs to be less than `ONLINE_CONTACT_TIMEOUT`
+    UPDATE_CONTACT_COLUMN_EVERY = (40.minutes..55.minutes).freeze
+
     AVAILABLE_TYPES_LEGACY = %w[specific shared].freeze
     AVAILABLE_TYPES = runner_types.keys.freeze
     AVAILABLE_STATUSES = %w[active paused online offline].freeze
     AVAILABLE_SCOPES = (AVAILABLE_TYPES_LEGACY + AVAILABLE_TYPES + AVAILABLE_STATUSES).freeze
+
     FORM_EDITABLE = %i[description tag_list active run_untagged locked access_level maximum_timeout_human_readable].freeze
 
     ignore_column :is_shared
@@ -46,7 +50,7 @@ module Ci
 
     scope :active, -> { where(active: true) }
     scope :paused, -> { where(active: false) }
-    scope :online, -> { where('contacted_at > ?', contact_time_deadline) }
+    scope :online, -> { where('contacted_at > ?', online_contact_time_deadline) }
     # The following query using negation is cheaper than using `contacted_at <= ?`
     # because there are less runners online than have been created. The
     # resulting query is quickly finding online ones and then uses the regular
@@ -56,6 +60,8 @@ module Ci
     scope :offline, -> { where.not(id: online) }
     scope :ordered, -> { order(id: :desc) }
 
+    scope :with_recent_runner_queue, -> { where('contacted_at > ?', recent_queue_deadline) }
+
     # BACKWARD COMPATIBILITY: There are needed to maintain compatibility with `AVAILABLE_SCOPES` used by `lib/api/runners.rb`
     scope :deprecated_shared, -> { instance_type }
     scope :deprecated_specific, -> { project_type.or(group_type) }
@@ -137,10 +143,18 @@ module Ci
       fuzzy_search(query, [:token, :description])
     end
 
-    def self.contact_time_deadline
+    def self.online_contact_time_deadline
       ONLINE_CONTACT_TIMEOUT.ago
     end
 
+    def self.recent_queue_deadline
+      # we add queue expiry + online
+      # - contacted_at can be updated at any time within this interval
+      #   we have always accurate `contacted_at` but it is stored in Redis
+      #   and not persisted in database
+      (ONLINE_CONTACT_TIMEOUT + RUNNER_QUEUE_EXPIRY_TIME).ago
+    end
+
     def self.order_by(order)
       if order == 'contacted_asc'
         order_contacted_at_asc
@@ -174,7 +188,7 @@ module Ci
     end
 
     def online?
-      contacted_at && contacted_at > self.class.contact_time_deadline
+      contacted_at && contacted_at > self.class.online_contact_time_deadline
     end
 
     def status
@@ -275,9 +289,7 @@ module Ci
 
     def persist_cached_data?
       # Use a random threshold to prevent beating DB updates.
-      # It generates a distribution between [40m, 80m].
-
-      contacted_at_max_age = UPDATE_DB_RUNNER_INFO_EVERY + Random.rand(UPDATE_DB_RUNNER_INFO_EVERY)
+      contacted_at_max_age = Random.rand(UPDATE_CONTACT_COLUMN_EVERY)
 
       real_contacted_at = read_attribute(:contacted_at)
       real_contacted_at.nil? ||
diff --git a/app/services/ci/update_build_queue_service.rb b/app/services/ci/update_build_queue_service.rb
index 9c589d910eb..31c7178c9e7 100644
--- a/app/services/ci/update_build_queue_service.rb
+++ b/app/services/ci/update_build_queue_service.rb
@@ -9,6 +9,10 @@ module Ci
     private
 
     def tick_for(build, runners)
+      if Feature.enabled?(:ci_update_queues_for_online_runners, build.project, default_enabled: true)
+        runners = runners.with_recent_runner_queue
+      end
+
       runners.each do |runner|
         runner.pick_build!(build)
       end
diff --git a/changelogs/unreleased/optimise-build-queue-service.yml b/changelogs/unreleased/optimise-build-queue-service.yml
new file mode 100644
index 00000000000..8ffaa3bfbdc
--- /dev/null
+++ b/changelogs/unreleased/optimise-build-queue-service.yml
@@ -0,0 +1,5 @@
+---
+title: Optimise UpdateBuildQueueService
+merge_request: 32095
+author:
+type: performance
diff --git a/spec/models/ci/runner_spec.rb b/spec/models/ci/runner_spec.rb
index 78b151631c1..70ff3cf5dc4 100644
--- a/spec/models/ci/runner_spec.rb
+++ b/spec/models/ci/runner_spec.rb
@@ -80,6 +80,13 @@ describe Ci::Runner do
     end
   end
 
+  describe 'constraints' do
+    it '.UPDATE_CONTACT_COLUMN_EVERY' do
+      expect(described_class::UPDATE_CONTACT_COLUMN_EVERY.max)
+        .to be <= described_class::ONLINE_CONTACT_TIMEOUT
+    end
+  end
+
   describe '#access_level' do
     context 'when creating new runner and access_level is nil' do
       let(:runner) do
diff --git a/spec/services/ci/update_build_queue_service_spec.rb b/spec/services/ci/update_build_queue_service_spec.rb
index 4b869385128..522dd1ba1c2 100644
--- a/spec/services/ci/update_build_queue_service_spec.rb
+++ b/spec/services/ci/update_build_queue_service_spec.rb
@@ -7,84 +7,108 @@ describe Ci::UpdateBuildQueueService do
   let(:build) { create(:ci_build, pipeline: pipeline) }
   let(:pipeline) { create(:ci_pipeline, project: project) }
 
-  context 'when updating specific runners' do
-    let(:runner) { create(:ci_runner, :project, projects: [project]) }
-
-    context 'when there is a runner that can pick build' do
-      it 'ticks runner queue value' do
-        expect { subject.execute(build) }.to change { runner.ensure_runner_queue_value }
-      end
+  shared_examples 'refreshes runner' do
+    it 'ticks runner queue value' do
+      expect { subject.execute(build) }.to change { runner.ensure_runner_queue_value }
     end
+  end
 
-    context 'when there is no runner that can pick build' do
-      let(:another_project) { create(:project) }
-      let(:runner) { create(:ci_runner, :project, projects: [another_project]) }
-
-      it 'does not tick runner queue value' do
-        expect { subject.execute(build) }.not_to change { runner.ensure_runner_queue_value }
-      end
+  shared_examples 'does not refresh runner' do
+    it 'ticks runner queue value' do
+      expect { subject.execute(build) }.not_to change { runner.ensure_runner_queue_value }
     end
   end
 
-  context 'when updating shared runners' do
-    let(:runner) { create(:ci_runner, :instance) }
-
-    context 'when there is no runner that can pick build' do
-      it 'ticks runner queue value' do
-        expect { subject.execute(build) }.to change { runner.ensure_runner_queue_value }
+  shared_examples 'matching build' do
+    context 'when there is a online runner that can pick build' do
+      before do
+        runner.update!(contacted_at: 30.minutes.ago)
       end
+
+      it_behaves_like 'refreshes runner'
     end
+  end
 
+  shared_examples 'mismatching tags' do
     context 'when there is no runner that can pick build due to tag mismatch' do
       before do
         build.tag_list = [:docker]
       end
 
-      it 'does not tick runner queue value' do
-        expect { subject.execute(build) }.not_to change { runner.ensure_runner_queue_value }
-      end
+      it_behaves_like 'does not refresh runner'
     end
+  end
 
-    context 'when there is no runner that can pick build due to being disabled on project' do
+  shared_examples 'recent runner queue' do
+    context 'when there is runner with expired cache' do
       before do
-        build.project.shared_runners_enabled = false
+        runner.update!(contacted_at: Ci::Runner.recent_queue_deadline)
       end
 
-      it 'does not tick runner queue value' do
-        expect { subject.execute(build) }.not_to change { runner.ensure_runner_queue_value }
+      context 'when ci_update_queues_for_online_runners is enabled' do
+        before do
+          stub_feature_flags(ci_update_queues_for_online_runners: true)
+        end
+
+        it_behaves_like 'does not refresh runner'
+      end
+
+      context 'when ci_update_queues_for_online_runners is disabled' do
+        before do
+          stub_feature_flags(ci_update_queues_for_online_runners: false)
+        end
+
+        it_behaves_like 'refreshes runner'
       end
     end
   end
 
-  context 'when updating group runners' do
-    let(:group) { create(:group) }
-    let(:project) { create(:project, group: group) }
-    let(:runner) { create(:ci_runner, :group, groups: [group]) }
+  context 'when updating specific runners' do
+    let(:runner) { create(:ci_runner, :project, projects: [project]) }
 
-    context 'when there is a runner that can pick build' do
-      it 'ticks runner queue value' do
-        expect { subject.execute(build) }.to change { runner.ensure_runner_queue_value }
-      end
+    it_behaves_like 'matching build'
+    it_behaves_like 'mismatching tags'
+    it_behaves_like 'recent runner queue'
+
+    context 'when the runner is assigned to another project' do
+      let(:another_project) { create(:project) }
+      let(:runner) { create(:ci_runner, :project, projects: [another_project]) }
+
+      it_behaves_like 'does not refresh runner'
     end
+  end
 
-    context 'when there is no runner that can pick build due to tag mismatch' do
+  context 'when updating shared runners' do
+    let(:runner) { create(:ci_runner, :instance) }
+
+    it_behaves_like 'matching build'
+    it_behaves_like 'mismatching tags'
+    it_behaves_like 'recent runner queue'
+
+    context 'when there is no runner that can pick build due to being disabled on project' do
       before do
-        build.tag_list = [:docker]
+        build.project.shared_runners_enabled = false
       end
 
-      it 'does not tick runner queue value' do
-        expect { subject.execute(build) }.not_to change { runner.ensure_runner_queue_value }
-      end
+      it_behaves_like 'does not refresh runner'
     end
+  end
+
+  context 'when updating group runners' do
+    let(:group) { create(:group) }
+    let(:project) { create(:project, group: group) }
+    let(:runner) { create(:ci_runner, :group, groups: [group]) }
+
+    it_behaves_like 'matching build'
+    it_behaves_like 'mismatching tags'
+    it_behaves_like 'recent runner queue'
 
     context 'when there is no runner that can pick build due to being disabled on project' do
       before do
         build.project.group_runners_enabled = false
       end
 
-      it 'does not tick runner queue value' do
-        expect { subject.execute(build) }.not_to change { runner.ensure_runner_queue_value }
-      end
+      it_behaves_like 'does not refresh runner'
     end
   end
 end
-- 
cgit v1.2.1


From d936e8644c0e6c46fdc0123baa325a3607617757 Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Thu, 22 Aug 2019 11:56:14 +0000
Subject: Add docs exceptions to two pipeline jobs

---
 .gitlab/ci/qa.gitlab-ci.yml                              | 10 +++++-----
 .gitlab/ci/review.gitlab-ci.yml                          |  4 +++-
 doc/development/testing_guide/end_to_end/index.md        |  8 ++++----
 doc/development/testing_guide/end_to_end/page_objects.md |  2 +-
 qa/README.md                                             |  2 +-
 5 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/.gitlab/ci/qa.gitlab-ci.yml b/.gitlab/ci/qa.gitlab-ci.yml
index dcc681294d2..144e5392e55 100644
--- a/.gitlab/ci/qa.gitlab-ci.yml
+++ b/.gitlab/ci/qa.gitlab-ci.yml
@@ -15,13 +15,13 @@
     - branches@gitlab-org/gitlab-ce
     - branches@gitlab-org/gitlab-ee
 
-package-and-qa:
-  extends: .package-and-qa-base
+package-and-qa-manual:
+  extends:
+    - .package-and-qa-base
+    - .no-docs-and-no-qa
   when: manual
-  except:
-    - /(^qa[\/-].*|.*-qa$)/
 
-package-and-qa-always:
+package-and-qa:
   extends: .package-and-qa-base
   allow_failure: true
   only:
diff --git a/.gitlab/ci/review.gitlab-ci.yml b/.gitlab/ci/review.gitlab-ci.yml
index 78431e3d842..beb049c0b3b 100644
--- a/.gitlab/ci/review.gitlab-ci.yml
+++ b/.gitlab/ci/review.gitlab-ci.yml
@@ -171,7 +171,9 @@ review-qa-all:
     - gitlab-qa Test::Instance::Any "${QA_IMAGE}" "${CI_ENVIRONMENT_URL}" -- --format RspecJunitFormatter --out tmp/rspec-${CI_JOB_ID}.xml --format html --out tmp/rspec.htm --color --format documentation
 
 parallel-spec-reports:
-  extends: .dedicated-runner
+  extends:
+    - .dedicated-runner
+    - .no-docs
   dependencies:
     - review-qa-all
   image: ruby:2.6-alpine
diff --git a/doc/development/testing_guide/end_to_end/index.md b/doc/development/testing_guide/end_to_end/index.md
index d6b944a3e74..3ae3ce183d9 100644
--- a/doc/development/testing_guide/end_to_end/index.md
+++ b/doc/development/testing_guide/end_to_end/index.md
@@ -45,11 +45,11 @@ Results are reported in the `#qa-staging` Slack channel.
 
 ### Testing code in merge requests
 
-#### Using the `package-and-qa` job
+#### Using the `package-and-qa-manual` job
 
 It is possible to run end-to-end tests for a merge request, eventually being run in
 a pipeline in the [`gitlab-qa`](https://gitlab.com/gitlab-org/gitlab-qa/) project,
-by triggering the `package-and-qa` manual action in the `test` stage (not
+by triggering the `package-and-qa-manual` manual action in the `test` stage (not
 available for forks).
 
 **This runs end-to-end tests against a custom Omnibus package built from your
@@ -71,7 +71,7 @@ graph LR
     B2[`Trigger-qa` stage<br>`Trigger:qa-test` job] -.->|2. Triggers a gitlab-qa pipeline and wait for it to be done| A3
 
 subgraph "gitlab-ce/ee pipeline"
-    A1[`test` stage<br>`package-and-qa` job]
+    A1[`test` stage<br>`package-and-qa-manual` job]
     end
 
 subgraph "omnibus-gitlab pipeline"
@@ -79,7 +79,7 @@ subgraph "omnibus-gitlab pipeline"
     end
 
 subgraph "gitlab-qa pipeline"
-    A3>QA jobs run] -.->|3. Reports back the pipeline result to the `package-and-qa` job<br>and post the result  on the original commit tested| A1
+    A3>QA jobs run] -.->|3. Reports back the pipeline result to the `package-and-qa-manual` job<br>and post the result  on the original commit tested| A1
     end
 ```
 
diff --git a/doc/development/testing_guide/end_to_end/page_objects.md b/doc/development/testing_guide/end_to_end/page_objects.md
index 47e58a425fd..850ea6b60ac 100644
--- a/doc/development/testing_guide/end_to_end/page_objects.md
+++ b/doc/development/testing_guide/end_to_end/page_objects.md
@@ -40,7 +40,7 @@ the time it would take to build packages and test everything.
 That is why when someone changes `t.text_field :login` to
 `t.text_field :username` in the _new session_ view we won't know about this
 change until our GitLab QA nightly pipeline fails, or until someone triggers
-`package-and-qa` action in their merge request.
+`package-and-qa-manual` action in their merge request.
 
 Obviously such a change would break all tests. We call this problem a _fragile
 tests problem_.
diff --git a/qa/README.md b/qa/README.md
index 97555f8d0c2..27e11c04b3e 100644
--- a/qa/README.md
+++ b/qa/README.md
@@ -30,7 +30,7 @@ and corresponding views / partials / selectors in CE / EE.
 
 Whenever `qa:selectors` job fails in your merge request, you are supposed to
 fix [page objects](../doc/development/testing_guide/end_to_end/page_objects.md). You should also trigger end-to-end tests
-using `package-and-qa` manual action, to test if everything works fine.
+using `package-and-qa-manual` manual action, to test if everything works fine.
 
 ## How can I use it?
 
-- 
cgit v1.2.1


From bf5797d0006875262373d335794ac6ec4dc4ac88 Mon Sep 17 00:00:00 2001
From: Mayra Cabrera <mcabrera@gitlab.com>
Date: Thu, 22 Aug 2019 12:12:28 +0000
Subject: Adds new DB case study for namespaces statistics

Includes a new database case study about all the approaches taken to
store and update the namespace statistics in a performan manner
performant approach to store and update the namespaces statistics
---
 doc/development/README.md                        |   1 +
 doc/development/namespaces_storage_statistics.md | 178 +++++++++++++++++++++++
 2 files changed, 179 insertions(+)
 create mode 100644 doc/development/namespaces_storage_statistics.md

diff --git a/doc/development/README.md b/doc/development/README.md
index 09aa64a7bf1..5e35d4c7437 100644
--- a/doc/development/README.md
+++ b/doc/development/README.md
@@ -116,6 +116,7 @@ description: 'Learn how to contribute to GitLab.'
 ## Case studies
 
 - [Database case study: Filtering by label](filtering_by_label.md)
+- [Database case study: Namespaces storage statistics](namespaces_storage_statistics.md)
 
 ## Integration guides
 
diff --git a/doc/development/namespaces_storage_statistics.md b/doc/development/namespaces_storage_statistics.md
new file mode 100644
index 00000000000..b3285de4705
--- /dev/null
+++ b/doc/development/namespaces_storage_statistics.md
@@ -0,0 +1,178 @@
+# Database case study: Namespaces storage statistics
+
+## Introduction
+
+On [Storage and limits management for groups](https://gitlab.com/groups/gitlab-org/-/epics/886),
+we want to facilitate a method for easily viewing the amount of
+storage consumed by a group, and allow easy management.
+
+## Proposal
+
+1. Create a new ActiveRecord model to hold the namespaces' statistics in an aggregated form (only for root namespaces).
+1. Refresh the statistics in this model every time a project belonging to this namespace is changed.
+
+## Problem
+
+In GitLab, we update the project storage statistics through a
+[callback](https://gitlab.com/gitlab-org/gitlab-ce/blob/v12.2.0.pre/app/models/project.rb#L90)
+every time the project is saved.
+
+The summary of those statistics per namespace is then retrieved
+by [`Namespaces#with_statistics`](https://gitlab.com/gitlab-org/gitlab-ce/blob/v12.2.0.pre/app/models/namespace.rb#L70) scope. Analyzing this query we noticed that:
+
+* It takes up to `1.2` seconds for namespaces with over `15k` projects.
+* It can't be analyzed with [ChatOps](chatops_on_gitlabcom.md), as it times out.
+
+Additionally, the pattern that is currently used to update the project statistics
+(the callback) doesn't scale adequately. It is currently one of the largest
+[database queries transactions on production](https://gitlab.com/gitlab-org/gitlab-ce/issues/62488)
+that takes the most time overall.  We can't add one more query to it as
+it will increase the transaction's length.
+
+Because of all of the above, we can't apply the same pattern to store
+and update the namespaces statistics, as the `namespaces` table is one
+of the largest tables on GitLab.com. Therefore we needed to find a performant and
+alternative method.
+
+## Attempts
+
+### Attempt A: PostgreSQL materialized view
+
+Model can be updated through a refresh strategy based on a project routes SQL and a [materialized view](https://www.postgresql.org/docs/9.6/rules-materializedviews.html):
+
+```sql
+SELECT split_part("rs".path, '/', 1) as root_path,
+        COALESCE(SUM(ps.storage_size), 0) AS storage_size,
+        COALESCE(SUM(ps.repository_size), 0) AS repository_size,
+        COALESCE(SUM(ps.wiki_size), 0) AS wiki_size,
+        COALESCE(SUM(ps.lfs_objects_size), 0) AS lfs_objects_size,
+        COALESCE(SUM(ps.build_artifacts_size), 0) AS build_artifacts_size,
+        COALESCE(SUM(ps.packages_size), 0) AS packages_size
+FROM "projects"
+    INNER JOIN routes rs ON rs.source_id = projects.id AND rs.source_type = 'Project'
+    INNER JOIN project_statistics ps ON ps.project_id  = projects.id
+GROUP BY root_path
+```
+
+We could then execute the query with:
+
+```sql
+REFRESH MATERIALIZED VIEW root_namespace_storage_statistics;
+```
+
+While this implied a single query update (and probably a fast one), it has some downsides:
+
+* Materialized views syntax varies from PostgreSQL and MySQL. While this feature was worked on, MySQL was still supported by GitLab.
+* Rails does not have native support for materialized views. We'd need to use a specialized gem to take care of the management of the database views, which implies additional work.
+
+### Attempt B: An update through a CTE
+
+Similar to Attempt A: Model update done through a refresh strategy with a [Common Table Expression](https://www.postgresql.org/docs/9.1/queries-with.html)
+
+```sql
+WITH refresh AS (
+  SELECT split_part("rs".path, '/', 1) as root_path,
+        COALESCE(SUM(ps.storage_size), 0) AS storage_size,
+        COALESCE(SUM(ps.repository_size), 0) AS repository_size,
+        COALESCE(SUM(ps.wiki_size), 0) AS wiki_size,
+        COALESCE(SUM(ps.lfs_objects_size), 0) AS lfs_objects_size,
+        COALESCE(SUM(ps.build_artifacts_size), 0) AS build_artifacts_size,
+        COALESCE(SUM(ps.packages_size), 0) AS packages_size
+  FROM "projects"
+        INNER JOIN routes rs ON rs.source_id = projects.id AND rs.source_type = 'Project'
+        INNER JOIN project_statistics ps ON ps.project_id  = projects.id
+  GROUP BY root_path)
+UPDATE namespace_storage_statistics
+SET storage_size = refresh.storage_size,
+    repository_size = refresh.repository_size,
+    wiki_size = refresh.wiki_size,
+    lfs_objects_size = refresh.lfs_objects_size,
+    build_artifacts_size = refresh.build_artifacts_size,
+    packages_size  = refresh.packages_size
+FROM refresh
+    INNER JOIN routes rs ON rs.path = refresh.root_path AND rs.source_type = 'Namespace'
+WHERE namespace_storage_statistics.namespace_id = rs.source_id
+```
+
+Same benefits and downsides as attempt A.
+
+### Attempt C: Get rid of the model and store the statistics on Redis
+
+We could get rid of the model that stores the statistics in aggregated form and instead use a Redis Set.
+This would be the [boring solution](https://about.gitlab.com/handbook/values/#boring-solutions) and the fastest one
+to implement, as GitLab already includes Redis as part of its [Architecture](architecture.md#redis).
+
+The downside of this approach is that Redis does not provide the same persistence/consistency guarantees as PostgreSQL,
+and this is information we can't afford to lose in a Redis failure.
+
+### Attempt D: Tag the root namespace and its child namespaces
+
+Directly relate the root namespace to its child namespaces, so
+whenever a namespace is created without a parent, this one is tagged
+with the root namespace ID:
+
+| id | root_id | parent_id
+|:---|:--------|:----------
+| 1  | 1       | NULL
+| 2  | 1       | 1
+| 3  | 1       | 2
+
+To aggregate the statistics inside a namespace we'd execute something like:
+
+```sql
+SELECT COUNT(...)
+FROM projects
+WHERE namespace_id IN (
+  SELECT id
+  FROM namespaces
+  WHERE root_id = X
+)
+```
+
+Even though this approach would make aggregating much easier, it has some major downsides:
+
+* We'd have to migrate **all namespaces** by adding and filling a new column. Because of the size of the table, dealing with time/cost will not be great. The background migration will take approximately `153h`, see <https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/29772>.
+* Background migration has to be shipped one release before, delaying the functionality by another milestone.
+
+### Attempt E (final): Update the namespace storage statistics in async way
+
+This approach consists of keep using the incremental statistics updates we currently already have,
+but we refresh them through Sidekiq jobs and in different transactions:
+
+1. Create a second table (`namespace_aggregation_schedules`) with two columns `id` and `namespace_id`.
+1. Whenever the statistics of a project changes, insert a row into `namespace_aggregation_schedules`
+   - We don't insert a new row if there's already one related to the root namespace.
+   - Keeping in mind the length of the transaction that involves updating `project_statistics`(<https://gitlab.com/gitlab-org/gitlab-ce/issues/62488>), the insertion should be done in a different transaction and through a Sidekiq Job.
+1. After inserting the row, we schedule another worker to be executed async at two different moments:
+   - One enqueued for immediate execution and another one scheduled in `1.5h` hours.
+   - We only schedule the jobs, if we can obtain a `1.5h` lease on Redis on a key based on the root namespace ID.
+   - If we can't obtain the lease, it indicates there's another aggregation already in progress, or scheduled in no more than `1.5h`.
+1. This worker will:
+   - Update the root namespace storage statistics by querying all the namespaces through a service.
+   - Delete the related `namespace_aggregation_schedules` after the update.
+1. Another Sidekiq job is also included to traverse any remaining rows on the `namespace_aggregation_schedules` table and schedule jobs for every pending row.
+   - This job is scheduled with cron to run every night (UTC).
+
+This implementation has the following benefits:
+
+* All the updates are done async, so we're not increasing the length of the transactions for `project_statistics`.
+* We're doing the update in a single SQL query.
+* It is compatible with PostgreSQL and MySQL.
+* No background migration required.
+
+The only downside of this approach is that namespaces' statistics are updated up to `1.5` hours after the change is done,
+which means there's a time window in which the statistics are inaccurate. Because we're still not
+[enforcing storage limits](https://gitlab.com/gitlab-org/gitlab-ce/issues/30421), this is not a major problem.
+
+## Conclusion
+
+Updating the storage statistics asynchronously, was the less problematic and
+performant approach of aggregating the root namespaces.
+
+All the details regarding this use case can be found on:
+
+* <https://gitlab.com/gitlab-org/gitlab-ce/issues/62214>
+* Merge Request with the implementation: <https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/28996>
+
+Performance of the namespace storage statistics were measured in staging and production (GitLab.com). All results were posted
+on <https://gitlab.com/gitlab-org/gitlab-ce/issues/64092>: No problem has been reported so far.
-- 
cgit v1.2.1


From 8c42a0eac09cb349789c963d38ee4e3ff5ecc0a8 Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Thu, 22 Aug 2019 22:57:44 +1200
Subject: Add frozen_string_literal to lib part 2

Using the sed script from
https://gitlab.com/gitlab-org/gitlab-ce/issues/59758
---
 spec/lib/gitlab/legacy_github_import/release_formatter_spec.rb          | 2 ++
 spec/lib/gitlab/legacy_github_import/user_formatter_spec.rb             | 2 ++
 spec/lib/gitlab/legacy_github_import/wiki_formatter_spec.rb             | 2 ++
 spec/lib/gitlab/loop_helpers_spec.rb                                    | 2 ++
 spec/lib/gitlab/manifest_import/manifest_spec.rb                        | 2 ++
 spec/lib/gitlab/manifest_import/project_creator_spec.rb                 | 2 ++
 spec/lib/gitlab/markup_helper_spec.rb                                   | 2 ++
 spec/lib/gitlab/metrics/background_transaction_spec.rb                  | 2 ++
 spec/lib/gitlab/metrics/delta_spec.rb                                   | 2 ++
 spec/lib/gitlab/metrics/instrumentation_spec.rb                         | 2 ++
 spec/lib/gitlab/metrics/method_call_spec.rb                             | 2 ++
 spec/lib/gitlab/metrics/methods_spec.rb                                 | 2 ++
 spec/lib/gitlab/metrics/metric_spec.rb                                  | 2 ++
 spec/lib/gitlab/metrics/prometheus_spec.rb                              | 2 ++
 spec/lib/gitlab/metrics/rack_middleware_spec.rb                         | 2 ++
 spec/lib/gitlab/metrics/requests_rack_middleware_spec.rb                | 2 ++
 spec/lib/gitlab/metrics/samplers/influx_sampler_spec.rb                 | 2 ++
 spec/lib/gitlab/metrics/samplers/ruby_sampler_spec.rb                   | 2 ++
 spec/lib/gitlab/metrics/samplers/unicorn_sampler_spec.rb                | 2 ++
 spec/lib/gitlab/metrics/sidekiq_metrics_exporter_spec.rb                | 2 ++
 spec/lib/gitlab/metrics/sidekiq_middleware_spec.rb                      | 2 ++
 spec/lib/gitlab/metrics/subscribers/action_view_spec.rb                 | 2 ++
 spec/lib/gitlab/metrics/subscribers/active_record_spec.rb               | 2 ++
 spec/lib/gitlab/metrics/subscribers/rails_cache_spec.rb                 | 2 ++
 spec/lib/gitlab/metrics/system_spec.rb                                  | 2 ++
 spec/lib/gitlab/metrics/web_transaction_spec.rb                         | 2 ++
 spec/lib/gitlab/metrics_spec.rb                                         | 2 ++
 spec/lib/gitlab/middleware/basic_health_check_spec.rb                   | 2 ++
 spec/lib/gitlab/middleware/multipart_spec.rb                            | 2 ++
 spec/lib/gitlab/middleware/rails_queue_duration_spec.rb                 | 2 ++
 spec/lib/gitlab/middleware/read_only_spec.rb                            | 2 ++
 spec/lib/gitlab/middleware/release_env_spec.rb                          | 2 ++
 spec/lib/gitlab/multi_collection_paginator_spec.rb                      | 2 ++
 spec/lib/gitlab/object_hierarchy_spec.rb                                | 2 ++
 spec/lib/gitlab/octokit/middleware_spec.rb                              | 2 ++
 spec/lib/gitlab/omniauth_initializer_spec.rb                            | 2 ++
 spec/lib/gitlab/optimistic_locking_spec.rb                              | 2 ++
 spec/lib/gitlab/other_markup_spec.rb                                    | 2 ++
 spec/lib/gitlab/otp_key_rotator_spec.rb                                 | 2 ++
 spec/lib/gitlab/pages_client_spec.rb                                    | 2 ++
 spec/lib/gitlab/path_regex_spec.rb                                      | 2 ++
 spec/lib/gitlab/performance_bar_spec.rb                                 | 2 ++
 spec/lib/gitlab/phabricator_import/importer_spec.rb                     | 2 ++
 spec/lib/gitlab/phabricator_import/user_finder_spec.rb                  | 2 ++
 spec/lib/gitlab/phabricator_import/worker_state_spec.rb                 | 2 ++
 spec/lib/gitlab/plugin_spec.rb                                          | 2 ++
 spec/lib/gitlab/polling_interval_spec.rb                                | 2 ++
 spec/lib/gitlab/popen/runner_spec.rb                                    | 2 ++
 spec/lib/gitlab/popen_spec.rb                                           | 2 ++
 spec/lib/gitlab/profiler_spec.rb                                        | 2 ++
 spec/lib/gitlab/project_authorizations_spec.rb                          | 2 ++
 spec/lib/gitlab/project_search_results_spec.rb                          | 2 ++
 spec/lib/gitlab/project_template_spec.rb                                | 2 ++
 spec/lib/gitlab/project_transfer_spec.rb                                | 2 ++
 spec/lib/gitlab/prometheus/additional_metrics_parser_spec.rb            | 2 ++
 .../prometheus/queries/additional_metrics_deployment_query_spec.rb      | 2 ++
 .../prometheus/queries/additional_metrics_environment_query_spec.rb     | 2 ++
 spec/lib/gitlab/prometheus/queries/deployment_query_spec.rb             | 2 ++
 spec/lib/gitlab/prometheus/queries/matched_metric_query_spec.rb         | 2 ++
 spec/lib/gitlab/prometheus_client_spec.rb                               | 2 ++
 spec/lib/gitlab/query_limiting/active_support_subscriber_spec.rb        | 2 ++
 spec/lib/gitlab/query_limiting/middleware_spec.rb                       | 2 ++
 spec/lib/gitlab/query_limiting/transaction_spec.rb                      | 2 ++
 spec/lib/gitlab/query_limiting_spec.rb                                  | 2 ++
 spec/lib/gitlab/quick_actions/command_definition_spec.rb                | 2 ++
 spec/lib/gitlab/quick_actions/dsl_spec.rb                               | 2 ++
 spec/lib/gitlab/quick_actions/extractor_spec.rb                         | 2 ++
 spec/lib/gitlab/quick_actions/spend_time_and_date_separator_spec.rb     | 2 ++
 spec/lib/gitlab/quick_actions/substitution_definition_spec.rb           | 2 ++
 spec/lib/gitlab/redis/cache_spec.rb                                     | 2 ++
 spec/lib/gitlab/redis/queues_spec.rb                                    | 2 ++
 spec/lib/gitlab/redis/shared_state_spec.rb                              | 2 ++
 spec/lib/gitlab/redis/wrapper_spec.rb                                   | 2 ++
 spec/lib/gitlab/reference_counter_spec.rb                               | 2 ++
 spec/lib/gitlab/regex_spec.rb                                           | 2 ++
 spec/lib/gitlab/repo_path_spec.rb                                       | 2 ++
 spec/lib/gitlab/repository_cache_adapter_spec.rb                        | 2 ++
 spec/lib/gitlab/repository_cache_spec.rb                                | 2 ++
 spec/lib/gitlab/repository_set_cache_spec.rb                            | 2 ++
 spec/lib/gitlab/request_context_spec.rb                                 | 2 ++
 spec/lib/gitlab/request_forgery_protection_spec.rb                      | 2 ++
 spec/lib/gitlab/request_profiler/profile_spec.rb                        | 2 ++
 spec/lib/gitlab/request_profiler_spec.rb                                | 2 ++
 spec/lib/gitlab/route_map_spec.rb                                       | 2 ++
 spec/lib/gitlab/routing_spec.rb                                         | 2 ++
 spec/lib/gitlab/sanitizers/exif_spec.rb                                 | 2 ++
 spec/lib/gitlab/sanitizers/svg_spec.rb                                  | 2 ++
 spec/lib/gitlab/search/found_blob_spec.rb                               | 1 +
 spec/lib/gitlab/search/query_spec.rb                                    | 2 ++
 spec/lib/gitlab/search_results_spec.rb                                  | 2 ++
 spec/lib/gitlab/sentry_spec.rb                                          | 2 ++
 spec/lib/gitlab/serializer/ci/variables_spec.rb                         | 2 ++
 spec/lib/gitlab/serializer/pagination_spec.rb                           | 2 ++
 spec/lib/gitlab/shard_health_cache_spec.rb                              | 2 ++
 spec/lib/gitlab/shell_spec.rb                                           | 2 ++
 spec/lib/gitlab/sherlock/collection_spec.rb                             | 2 ++
 spec/lib/gitlab/sherlock/file_sample_spec.rb                            | 2 ++
 spec/lib/gitlab/sherlock/line_profiler_spec.rb                          | 2 ++
 spec/lib/gitlab/sherlock/line_sample_spec.rb                            | 2 ++
 spec/lib/gitlab/sherlock/location_spec.rb                               | 2 ++
 spec/lib/gitlab/sherlock/middleware_spec.rb                             | 2 ++
 spec/lib/gitlab/sherlock/query_spec.rb                                  | 2 ++
 spec/lib/gitlab/sherlock/transaction_spec.rb                            | 2 ++
 spec/lib/gitlab/sidekiq_config_spec.rb                                  | 2 ++
 spec/lib/gitlab/sidekiq_logging/json_formatter_spec.rb                  | 2 ++
 spec/lib/gitlab/sidekiq_logging/structured_logger_spec.rb               | 2 ++
 spec/lib/gitlab/sidekiq_middleware/memory_killer_spec.rb                | 2 ++
 spec/lib/gitlab/sidekiq_signals_spec.rb                                 | 2 ++
 spec/lib/gitlab/sidekiq_status/client_middleware_spec.rb                | 2 ++
 spec/lib/gitlab/sidekiq_status/server_middleware_spec.rb                | 2 ++
 spec/lib/gitlab/sidekiq_status_spec.rb                                  | 2 ++
 spec/lib/gitlab/sidekiq_versioning/manager_spec.rb                      | 2 ++
 spec/lib/gitlab/sidekiq_versioning_spec.rb                              | 2 ++
 spec/lib/gitlab/slash_commands/command_spec.rb                          | 2 ++
 spec/lib/gitlab/slash_commands/deploy_spec.rb                           | 2 ++
 spec/lib/gitlab/slash_commands/issue_move_spec.rb                       | 2 ++
 spec/lib/gitlab/slash_commands/issue_new_spec.rb                        | 2 ++
 spec/lib/gitlab/slash_commands/issue_search_spec.rb                     | 2 ++
 spec/lib/gitlab/slash_commands/issue_show_spec.rb                       | 2 ++
 spec/lib/gitlab/slash_commands/presenters/access_spec.rb                | 2 ++
 spec/lib/gitlab/slash_commands/presenters/deploy_spec.rb                | 2 ++
 spec/lib/gitlab/slash_commands/presenters/issue_move_spec.rb            | 2 ++
 spec/lib/gitlab/slash_commands/presenters/issue_new_spec.rb             | 2 ++
 spec/lib/gitlab/slash_commands/presenters/issue_search_spec.rb          | 2 ++
 spec/lib/gitlab/slash_commands/presenters/issue_show_spec.rb            | 2 ++
 spec/lib/gitlab/snippet_search_results_spec.rb                          | 2 ++
 spec/lib/gitlab/sql/cte_spec.rb                                         | 2 ++
 spec/lib/gitlab/sql/glob_spec.rb                                        | 2 ++
 spec/lib/gitlab/sql/pattern_spec.rb                                     | 2 ++
 spec/lib/gitlab/sql/recursive_cte_spec.rb                               | 2 ++
 spec/lib/gitlab/sql/union_spec.rb                                       | 2 ++
 spec/lib/gitlab/ssh_public_key_spec.rb                                  | 2 ++
 spec/lib/gitlab/string_placeholder_replacer_spec.rb                     | 2 ++
 spec/lib/gitlab/string_range_marker_spec.rb                             | 2 ++
 spec/lib/gitlab/string_regex_marker_spec.rb                             | 2 ++
 spec/lib/gitlab/tcp_checker_spec.rb                                     | 2 ++
 spec/lib/gitlab/template/finders/global_template_finder_spec.rb         | 2 ++
 spec/lib/gitlab/template/finders/repo_template_finders_spec.rb          | 2 ++
 spec/lib/gitlab/template/gitignore_template_spec.rb                     | 2 ++
 spec/lib/gitlab/template/gitlab_ci_yml_template_spec.rb                 | 2 ++
 spec/lib/gitlab/template/issue_template_spec.rb                         | 2 ++
 spec/lib/gitlab/template/merge_request_template_spec.rb                 | 2 ++
 spec/lib/gitlab/themes_spec.rb                                          | 2 ++
 spec/lib/gitlab/tree_summary_spec.rb                                    | 2 ++
 spec/lib/gitlab/untrusted_regexp/ruby_syntax_spec.rb                    | 2 ++
 spec/lib/gitlab/untrusted_regexp_spec.rb                                | 2 ++
 spec/lib/gitlab/uploads_transfer_spec.rb                                | 2 ++
 spec/lib/gitlab/url_blocker_spec.rb                                     | 2 ++
 spec/lib/gitlab/url_builder_spec.rb                                     | 2 ++
 spec/lib/gitlab/url_sanitizer_spec.rb                                   | 2 ++
 spec/lib/gitlab/user_access_spec.rb                                     | 2 ++
 spec/lib/gitlab/utils/deep_size_spec.rb                                 | 2 ++
 spec/lib/gitlab/utils/merge_hash_spec.rb                                | 2 ++
 spec/lib/gitlab/utils/override_spec.rb                                  | 2 ++
 spec/lib/gitlab/utils/sanitize_node_link_spec.rb                        | 2 ++
 spec/lib/gitlab/utils/strong_memoize_spec.rb                            | 2 ++
 spec/lib/gitlab/utils_spec.rb                                           | 2 ++
 spec/lib/gitlab/verify/job_artifacts_spec.rb                            | 2 ++
 spec/lib/gitlab/verify/lfs_objects_spec.rb                              | 2 ++
 spec/lib/gitlab/verify/uploads_spec.rb                                  | 2 ++
 spec/lib/gitlab/version_info_spec.rb                                    | 2 ++
 spec/lib/gitlab/view/presenter/base_spec.rb                             | 2 ++
 spec/lib/gitlab/view/presenter/delegated_spec.rb                        | 2 ++
 spec/lib/gitlab/view/presenter/factory_spec.rb                          | 2 ++
 spec/lib/gitlab/view/presenter/simple_spec.rb                           | 2 ++
 spec/lib/gitlab/visibility_level_spec.rb                                | 2 ++
 spec/lib/gitlab/wiki_file_finder_spec.rb                                | 2 ++
 spec/lib/gitlab/workhorse_spec.rb                                       | 2 ++
 spec/lib/gitlab_spec.rb                                                 | 2 ++
 spec/lib/google_api/auth_spec.rb                                        | 2 ++
 spec/lib/google_api/cloud_platform/client_spec.rb                       | 2 ++
 spec/lib/json_web_token/rsa_token_spec.rb                               | 2 ++
 spec/lib/json_web_token/token_spec.rb                                   | 2 ++
 spec/lib/mattermost/client_spec.rb                                      | 2 ++
 spec/lib/mattermost/command_spec.rb                                     | 2 ++
 spec/lib/mattermost/session_spec.rb                                     | 2 ++
 spec/lib/mattermost/team_spec.rb                                        | 2 ++
 spec/lib/microsoft_teams/activity_spec.rb                               | 2 ++
 spec/lib/microsoft_teams/notifier_spec.rb                               | 2 ++
 spec/lib/milestone_array_spec.rb                                        | 2 ++
 spec/lib/object_storage/direct_upload_spec.rb                           | 2 ++
 spec/lib/omni_auth/strategies/jwt_spec.rb                               | 2 ++
 spec/lib/rspec_flaky/config_spec.rb                                     | 2 ++
 spec/lib/rspec_flaky/example_spec.rb                                    | 2 ++
 spec/lib/rspec_flaky/flaky_example_spec.rb                              | 2 ++
 spec/lib/rspec_flaky/flaky_examples_collection_spec.rb                  | 2 ++
 spec/lib/rspec_flaky/listener_spec.rb                                   | 2 ++
 spec/lib/rspec_flaky/report_spec.rb                                     | 2 ++
 spec/lib/safe_zip/entry_spec.rb                                         | 2 ++
 spec/lib/safe_zip/extract_params_spec.rb                                | 2 ++
 spec/lib/safe_zip/extract_spec.rb                                       | 2 ++
 spec/lib/serializers/json_spec.rb                                       | 2 ++
 spec/lib/system_check/app/git_user_default_ssh_config_check_spec.rb     | 2 ++
 spec/lib/system_check/base_check_spec.rb                                | 2 ++
 spec/lib/system_check/orphans/namespace_check_spec.rb                   | 2 ++
 spec/lib/system_check/orphans/repository_check_spec.rb                  | 2 ++
 spec/lib/system_check/simple_executor_spec.rb                           | 2 ++
 spec/lib/system_check_spec.rb                                           | 2 ++
 spec/lib/uploaded_file_spec.rb                                          | 2 ++
 199 files changed, 397 insertions(+)

diff --git a/spec/lib/gitlab/legacy_github_import/release_formatter_spec.rb b/spec/lib/gitlab/legacy_github_import/release_formatter_spec.rb
index 534cf219520..2cf4b367c0b 100644
--- a/spec/lib/gitlab/legacy_github_import/release_formatter_spec.rb
+++ b/spec/lib/gitlab/legacy_github_import/release_formatter_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::LegacyGithubImport::ReleaseFormatter do
diff --git a/spec/lib/gitlab/legacy_github_import/user_formatter_spec.rb b/spec/lib/gitlab/legacy_github_import/user_formatter_spec.rb
index 3cd096eb0ad..919847fe061 100644
--- a/spec/lib/gitlab/legacy_github_import/user_formatter_spec.rb
+++ b/spec/lib/gitlab/legacy_github_import/user_formatter_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::LegacyGithubImport::UserFormatter do
diff --git a/spec/lib/gitlab/legacy_github_import/wiki_formatter_spec.rb b/spec/lib/gitlab/legacy_github_import/wiki_formatter_spec.rb
index 7519707293c..639fb9d80eb 100644
--- a/spec/lib/gitlab/legacy_github_import/wiki_formatter_spec.rb
+++ b/spec/lib/gitlab/legacy_github_import/wiki_formatter_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::LegacyGithubImport::WikiFormatter do
diff --git a/spec/lib/gitlab/loop_helpers_spec.rb b/spec/lib/gitlab/loop_helpers_spec.rb
index e17a0342d64..7e59b41d5b9 100644
--- a/spec/lib/gitlab/loop_helpers_spec.rb
+++ b/spec/lib/gitlab/loop_helpers_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::LoopHelpers do
diff --git a/spec/lib/gitlab/manifest_import/manifest_spec.rb b/spec/lib/gitlab/manifest_import/manifest_spec.rb
index ded93e23c08..c1135f710ea 100644
--- a/spec/lib/gitlab/manifest_import/manifest_spec.rb
+++ b/spec/lib/gitlab/manifest_import/manifest_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::ManifestImport::Manifest do
diff --git a/spec/lib/gitlab/manifest_import/project_creator_spec.rb b/spec/lib/gitlab/manifest_import/project_creator_spec.rb
index a7487972f51..a8cfcfb41d3 100644
--- a/spec/lib/gitlab/manifest_import/project_creator_spec.rb
+++ b/spec/lib/gitlab/manifest_import/project_creator_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::ManifestImport::ProjectCreator do
diff --git a/spec/lib/gitlab/markup_helper_spec.rb b/spec/lib/gitlab/markup_helper_spec.rb
index 09e518ff989..b93538cae5a 100644
--- a/spec/lib/gitlab/markup_helper_spec.rb
+++ b/spec/lib/gitlab/markup_helper_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::MarkupHelper do
diff --git a/spec/lib/gitlab/metrics/background_transaction_spec.rb b/spec/lib/gitlab/metrics/background_transaction_spec.rb
index 17445fe6de5..d87d2c839ad 100644
--- a/spec/lib/gitlab/metrics/background_transaction_spec.rb
+++ b/spec/lib/gitlab/metrics/background_transaction_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::BackgroundTransaction do
diff --git a/spec/lib/gitlab/metrics/delta_spec.rb b/spec/lib/gitlab/metrics/delta_spec.rb
index 718387cdee1..9bb011dc8fc 100644
--- a/spec/lib/gitlab/metrics/delta_spec.rb
+++ b/spec/lib/gitlab/metrics/delta_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::Delta do
diff --git a/spec/lib/gitlab/metrics/instrumentation_spec.rb b/spec/lib/gitlab/metrics/instrumentation_spec.rb
index 977bc250049..0e2f274f157 100644
--- a/spec/lib/gitlab/metrics/instrumentation_spec.rb
+++ b/spec/lib/gitlab/metrics/instrumentation_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::Instrumentation do
diff --git a/spec/lib/gitlab/metrics/method_call_spec.rb b/spec/lib/gitlab/metrics/method_call_spec.rb
index d9379cfe674..3b5e04e2df5 100644
--- a/spec/lib/gitlab/metrics/method_call_spec.rb
+++ b/spec/lib/gitlab/metrics/method_call_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::MethodCall do
diff --git a/spec/lib/gitlab/metrics/methods_spec.rb b/spec/lib/gitlab/metrics/methods_spec.rb
index 9d41ed2442b..bca94deb1d8 100644
--- a/spec/lib/gitlab/metrics/methods_spec.rb
+++ b/spec/lib/gitlab/metrics/methods_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::Methods do
diff --git a/spec/lib/gitlab/metrics/metric_spec.rb b/spec/lib/gitlab/metrics/metric_spec.rb
index d240b8a01fd..611b59231ba 100644
--- a/spec/lib/gitlab/metrics/metric_spec.rb
+++ b/spec/lib/gitlab/metrics/metric_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::Metric do
diff --git a/spec/lib/gitlab/metrics/prometheus_spec.rb b/spec/lib/gitlab/metrics/prometheus_spec.rb
index 3d4dd5fdf01..b37624982e2 100644
--- a/spec/lib/gitlab/metrics/prometheus_spec.rb
+++ b/spec/lib/gitlab/metrics/prometheus_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::Prometheus, :prometheus do
diff --git a/spec/lib/gitlab/metrics/rack_middleware_spec.rb b/spec/lib/gitlab/metrics/rack_middleware_spec.rb
index b84387204ee..1c1681cc5ab 100644
--- a/spec/lib/gitlab/metrics/rack_middleware_spec.rb
+++ b/spec/lib/gitlab/metrics/rack_middleware_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::RackMiddleware do
diff --git a/spec/lib/gitlab/metrics/requests_rack_middleware_spec.rb b/spec/lib/gitlab/metrics/requests_rack_middleware_spec.rb
index ebe66948a91..c29db3a93ec 100644
--- a/spec/lib/gitlab/metrics/requests_rack_middleware_spec.rb
+++ b/spec/lib/gitlab/metrics/requests_rack_middleware_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::RequestsRackMiddleware do
diff --git a/spec/lib/gitlab/metrics/samplers/influx_sampler_spec.rb b/spec/lib/gitlab/metrics/samplers/influx_sampler_spec.rb
index 2923048f742..2d4b27a6ac1 100644
--- a/spec/lib/gitlab/metrics/samplers/influx_sampler_spec.rb
+++ b/spec/lib/gitlab/metrics/samplers/influx_sampler_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::Samplers::InfluxSampler do
diff --git a/spec/lib/gitlab/metrics/samplers/ruby_sampler_spec.rb b/spec/lib/gitlab/metrics/samplers/ruby_sampler_spec.rb
index 5005a5d9ebc..8c4071a7ed1 100644
--- a/spec/lib/gitlab/metrics/samplers/ruby_sampler_spec.rb
+++ b/spec/lib/gitlab/metrics/samplers/ruby_sampler_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::Samplers::RubySampler do
diff --git a/spec/lib/gitlab/metrics/samplers/unicorn_sampler_spec.rb b/spec/lib/gitlab/metrics/samplers/unicorn_sampler_spec.rb
index 4b697b2ba0f..cdfd95e3885 100644
--- a/spec/lib/gitlab/metrics/samplers/unicorn_sampler_spec.rb
+++ b/spec/lib/gitlab/metrics/samplers/unicorn_sampler_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::Samplers::UnicornSampler do
diff --git a/spec/lib/gitlab/metrics/sidekiq_metrics_exporter_spec.rb b/spec/lib/gitlab/metrics/sidekiq_metrics_exporter_spec.rb
index 61eb059a731..9eea3eb79dc 100644
--- a/spec/lib/gitlab/metrics/sidekiq_metrics_exporter_spec.rb
+++ b/spec/lib/gitlab/metrics/sidekiq_metrics_exporter_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::SidekiqMetricsExporter do
diff --git a/spec/lib/gitlab/metrics/sidekiq_middleware_spec.rb b/spec/lib/gitlab/metrics/sidekiq_middleware_spec.rb
index ae1d8b47fe9..bb95d5ab2ad 100644
--- a/spec/lib/gitlab/metrics/sidekiq_middleware_spec.rb
+++ b/spec/lib/gitlab/metrics/sidekiq_middleware_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::SidekiqMiddleware do
diff --git a/spec/lib/gitlab/metrics/subscribers/action_view_spec.rb b/spec/lib/gitlab/metrics/subscribers/action_view_spec.rb
index 9f3af1acef7..25c0e7b695a 100644
--- a/spec/lib/gitlab/metrics/subscribers/action_view_spec.rb
+++ b/spec/lib/gitlab/metrics/subscribers/action_view_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::Subscribers::ActionView do
diff --git a/spec/lib/gitlab/metrics/subscribers/active_record_spec.rb b/spec/lib/gitlab/metrics/subscribers/active_record_spec.rb
index ee6d6fc961f..1624cea8bda 100644
--- a/spec/lib/gitlab/metrics/subscribers/active_record_spec.rb
+++ b/spec/lib/gitlab/metrics/subscribers/active_record_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::Subscribers::ActiveRecord do
diff --git a/spec/lib/gitlab/metrics/subscribers/rails_cache_spec.rb b/spec/lib/gitlab/metrics/subscribers/rails_cache_spec.rb
index e04056b3450..ab0d89b2683 100644
--- a/spec/lib/gitlab/metrics/subscribers/rails_cache_spec.rb
+++ b/spec/lib/gitlab/metrics/subscribers/rails_cache_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::Subscribers::RailsCache do
diff --git a/spec/lib/gitlab/metrics/system_spec.rb b/spec/lib/gitlab/metrics/system_spec.rb
index 3b434a02f63..6d2764a06f2 100644
--- a/spec/lib/gitlab/metrics/system_spec.rb
+++ b/spec/lib/gitlab/metrics/system_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::System do
diff --git a/spec/lib/gitlab/metrics/web_transaction_spec.rb b/spec/lib/gitlab/metrics/web_transaction_spec.rb
index 0b3b23e930f..2b35f07cc0d 100644
--- a/spec/lib/gitlab/metrics/web_transaction_spec.rb
+++ b/spec/lib/gitlab/metrics/web_transaction_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics::WebTransaction do
diff --git a/spec/lib/gitlab/metrics_spec.rb b/spec/lib/gitlab/metrics_spec.rb
index 03c185ddc07..f0ba12c1cd0 100644
--- a/spec/lib/gitlab/metrics_spec.rb
+++ b/spec/lib/gitlab/metrics_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Metrics do
diff --git a/spec/lib/gitlab/middleware/basic_health_check_spec.rb b/spec/lib/gitlab/middleware/basic_health_check_spec.rb
index 86bdc479b66..07fda691ac8 100644
--- a/spec/lib/gitlab/middleware/basic_health_check_spec.rb
+++ b/spec/lib/gitlab/middleware/basic_health_check_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Middleware::BasicHealthCheck do
diff --git a/spec/lib/gitlab/middleware/multipart_spec.rb b/spec/lib/gitlab/middleware/multipart_spec.rb
index 3f6ada6832a..33797817578 100644
--- a/spec/lib/gitlab/middleware/multipart_spec.rb
+++ b/spec/lib/gitlab/middleware/multipart_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 require 'tempfile'
diff --git a/spec/lib/gitlab/middleware/rails_queue_duration_spec.rb b/spec/lib/gitlab/middleware/rails_queue_duration_spec.rb
index 14f2c3cb86f..31359abdce3 100644
--- a/spec/lib/gitlab/middleware/rails_queue_duration_spec.rb
+++ b/spec/lib/gitlab/middleware/rails_queue_duration_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Middleware::RailsQueueDuration do
diff --git a/spec/lib/gitlab/middleware/read_only_spec.rb b/spec/lib/gitlab/middleware/read_only_spec.rb
index 24d49a049b6..d2c8f4ab0bd 100644
--- a/spec/lib/gitlab/middleware/read_only_spec.rb
+++ b/spec/lib/gitlab/middleware/read_only_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Middleware::ReadOnly do
diff --git a/spec/lib/gitlab/middleware/release_env_spec.rb b/spec/lib/gitlab/middleware/release_env_spec.rb
index 5e3aa877409..3ca40f4ebd0 100644
--- a/spec/lib/gitlab/middleware/release_env_spec.rb
+++ b/spec/lib/gitlab/middleware/release_env_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Middleware::ReleaseEnv do
diff --git a/spec/lib/gitlab/multi_collection_paginator_spec.rb b/spec/lib/gitlab/multi_collection_paginator_spec.rb
index 28cd704b05a..f2049884b83 100644
--- a/spec/lib/gitlab/multi_collection_paginator_spec.rb
+++ b/spec/lib/gitlab/multi_collection_paginator_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::MultiCollectionPaginator do
diff --git a/spec/lib/gitlab/object_hierarchy_spec.rb b/spec/lib/gitlab/object_hierarchy_spec.rb
index bfd456cdd7e..b16eccbcb2c 100644
--- a/spec/lib/gitlab/object_hierarchy_spec.rb
+++ b/spec/lib/gitlab/object_hierarchy_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::ObjectHierarchy do
diff --git a/spec/lib/gitlab/octokit/middleware_spec.rb b/spec/lib/gitlab/octokit/middleware_spec.rb
index 43f6d13f7ba..8aa6d17ac9e 100644
--- a/spec/lib/gitlab/octokit/middleware_spec.rb
+++ b/spec/lib/gitlab/octokit/middleware_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Octokit::Middleware do
diff --git a/spec/lib/gitlab/omniauth_initializer_spec.rb b/spec/lib/gitlab/omniauth_initializer_spec.rb
index ef5c93e5c6b..99684bb2ab2 100644
--- a/spec/lib/gitlab/omniauth_initializer_spec.rb
+++ b/spec/lib/gitlab/omniauth_initializer_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::OmniauthInitializer do
diff --git a/spec/lib/gitlab/optimistic_locking_spec.rb b/spec/lib/gitlab/optimistic_locking_spec.rb
index 6fdf61ee0a7..9dfcb775dfa 100644
--- a/spec/lib/gitlab/optimistic_locking_spec.rb
+++ b/spec/lib/gitlab/optimistic_locking_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::OptimisticLocking do
diff --git a/spec/lib/gitlab/other_markup_spec.rb b/spec/lib/gitlab/other_markup_spec.rb
index e26f39e193e..b5cf5b0999d 100644
--- a/spec/lib/gitlab/other_markup_spec.rb
+++ b/spec/lib/gitlab/other_markup_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::OtherMarkup do
diff --git a/spec/lib/gitlab/otp_key_rotator_spec.rb b/spec/lib/gitlab/otp_key_rotator_spec.rb
index 6e6e9ce29ac..f5a567d5ea0 100644
--- a/spec/lib/gitlab/otp_key_rotator_spec.rb
+++ b/spec/lib/gitlab/otp_key_rotator_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::OtpKeyRotator do
diff --git a/spec/lib/gitlab/pages_client_spec.rb b/spec/lib/gitlab/pages_client_spec.rb
index da6d26f4aee..84381843221 100644
--- a/spec/lib/gitlab/pages_client_spec.rb
+++ b/spec/lib/gitlab/pages_client_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::PagesClient do
diff --git a/spec/lib/gitlab/path_regex_spec.rb b/spec/lib/gitlab/path_regex_spec.rb
index 84b2e2dc823..7dcdad7ff92 100644
--- a/spec/lib/gitlab/path_regex_spec.rb
+++ b/spec/lib/gitlab/path_regex_spec.rb
@@ -1,4 +1,6 @@
 # coding: utf-8
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::PathRegex do
diff --git a/spec/lib/gitlab/performance_bar_spec.rb b/spec/lib/gitlab/performance_bar_spec.rb
index 71c109db1f1..8d8ac2aebbe 100644
--- a/spec/lib/gitlab/performance_bar_spec.rb
+++ b/spec/lib/gitlab/performance_bar_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::PerformanceBar do
diff --git a/spec/lib/gitlab/phabricator_import/importer_spec.rb b/spec/lib/gitlab/phabricator_import/importer_spec.rb
index bf14010a187..99a6e4dad6b 100644
--- a/spec/lib/gitlab/phabricator_import/importer_spec.rb
+++ b/spec/lib/gitlab/phabricator_import/importer_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::PhabricatorImport::Importer do
diff --git a/spec/lib/gitlab/phabricator_import/user_finder_spec.rb b/spec/lib/gitlab/phabricator_import/user_finder_spec.rb
index 096321cda5f..918ff28c8f5 100644
--- a/spec/lib/gitlab/phabricator_import/user_finder_spec.rb
+++ b/spec/lib/gitlab/phabricator_import/user_finder_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::PhabricatorImport::UserFinder, :clean_gitlab_redis_cache do
diff --git a/spec/lib/gitlab/phabricator_import/worker_state_spec.rb b/spec/lib/gitlab/phabricator_import/worker_state_spec.rb
index a44947445c9..b6f2524a9d0 100644
--- a/spec/lib/gitlab/phabricator_import/worker_state_spec.rb
+++ b/spec/lib/gitlab/phabricator_import/worker_state_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::PhabricatorImport::WorkerState, :clean_gitlab_redis_shared_state do
diff --git a/spec/lib/gitlab/plugin_spec.rb b/spec/lib/gitlab/plugin_spec.rb
index 33dd4f79130..a8ddd774f3f 100644
--- a/spec/lib/gitlab/plugin_spec.rb
+++ b/spec/lib/gitlab/plugin_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Plugin do
diff --git a/spec/lib/gitlab/polling_interval_spec.rb b/spec/lib/gitlab/polling_interval_spec.rb
index eb8e618156b..979164269bd 100644
--- a/spec/lib/gitlab/polling_interval_spec.rb
+++ b/spec/lib/gitlab/polling_interval_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::PollingInterval do
diff --git a/spec/lib/gitlab/popen/runner_spec.rb b/spec/lib/gitlab/popen/runner_spec.rb
index 2e2cb4ca28f..de19106eaee 100644
--- a/spec/lib/gitlab/popen/runner_spec.rb
+++ b/spec/lib/gitlab/popen/runner_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Popen::Runner do
diff --git a/spec/lib/gitlab/popen_spec.rb b/spec/lib/gitlab/popen_spec.rb
index c1b84e9f077..29afd9df74e 100644
--- a/spec/lib/gitlab/popen_spec.rb
+++ b/spec/lib/gitlab/popen_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Popen do
diff --git a/spec/lib/gitlab/profiler_spec.rb b/spec/lib/gitlab/profiler_spec.rb
index 5af52db7a1f..a19392f4bcb 100644
--- a/spec/lib/gitlab/profiler_spec.rb
+++ b/spec/lib/gitlab/profiler_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Profiler do
diff --git a/spec/lib/gitlab/project_authorizations_spec.rb b/spec/lib/gitlab/project_authorizations_spec.rb
index 75e2d5e1319..82ccb42f8a6 100644
--- a/spec/lib/gitlab/project_authorizations_spec.rb
+++ b/spec/lib/gitlab/project_authorizations_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::ProjectAuthorizations do
diff --git a/spec/lib/gitlab/project_search_results_spec.rb b/spec/lib/gitlab/project_search_results_spec.rb
index c7462500c82..0dbfcf96124 100644
--- a/spec/lib/gitlab/project_search_results_spec.rb
+++ b/spec/lib/gitlab/project_search_results_spec.rb
@@ -1,4 +1,6 @@
 # coding: utf-8
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::ProjectSearchResults do
diff --git a/spec/lib/gitlab/project_template_spec.rb b/spec/lib/gitlab/project_template_spec.rb
index c7c82d07508..83acd979a80 100644
--- a/spec/lib/gitlab/project_template_spec.rb
+++ b/spec/lib/gitlab/project_template_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::ProjectTemplate do
diff --git a/spec/lib/gitlab/project_transfer_spec.rb b/spec/lib/gitlab/project_transfer_spec.rb
index 0b9b1f537b5..d54817ea02b 100644
--- a/spec/lib/gitlab/project_transfer_spec.rb
+++ b/spec/lib/gitlab/project_transfer_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::ProjectTransfer do
diff --git a/spec/lib/gitlab/prometheus/additional_metrics_parser_spec.rb b/spec/lib/gitlab/prometheus/additional_metrics_parser_spec.rb
index 1a108003bc2..3f97a69b5eb 100644
--- a/spec/lib/gitlab/prometheus/additional_metrics_parser_spec.rb
+++ b/spec/lib/gitlab/prometheus/additional_metrics_parser_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Prometheus::AdditionalMetricsParser do
diff --git a/spec/lib/gitlab/prometheus/queries/additional_metrics_deployment_query_spec.rb b/spec/lib/gitlab/prometheus/queries/additional_metrics_deployment_query_spec.rb
index c7169717fc1..4bdc57c8c04 100644
--- a/spec/lib/gitlab/prometheus/queries/additional_metrics_deployment_query_spec.rb
+++ b/spec/lib/gitlab/prometheus/queries/additional_metrics_deployment_query_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Prometheus::Queries::AdditionalMetricsDeploymentQuery do
diff --git a/spec/lib/gitlab/prometheus/queries/additional_metrics_environment_query_spec.rb b/spec/lib/gitlab/prometheus/queries/additional_metrics_environment_query_spec.rb
index a6589f0c0a3..35dbdd55cfa 100644
--- a/spec/lib/gitlab/prometheus/queries/additional_metrics_environment_query_spec.rb
+++ b/spec/lib/gitlab/prometheus/queries/additional_metrics_environment_query_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Prometheus::Queries::AdditionalMetricsEnvironmentQuery do
diff --git a/spec/lib/gitlab/prometheus/queries/deployment_query_spec.rb b/spec/lib/gitlab/prometheus/queries/deployment_query_spec.rb
index ffe3ad85baa..0ad2de218fe 100644
--- a/spec/lib/gitlab/prometheus/queries/deployment_query_spec.rb
+++ b/spec/lib/gitlab/prometheus/queries/deployment_query_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Prometheus::Queries::DeploymentQuery do
diff --git a/spec/lib/gitlab/prometheus/queries/matched_metric_query_spec.rb b/spec/lib/gitlab/prometheus/queries/matched_metric_query_spec.rb
index 936447b8474..35034d814bf 100644
--- a/spec/lib/gitlab/prometheus/queries/matched_metric_query_spec.rb
+++ b/spec/lib/gitlab/prometheus/queries/matched_metric_query_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Prometheus::Queries::MatchedMetricQuery do
diff --git a/spec/lib/gitlab/prometheus_client_spec.rb b/spec/lib/gitlab/prometheus_client_spec.rb
index 0a4e8dbced5..86a1c14ed3f 100644
--- a/spec/lib/gitlab/prometheus_client_spec.rb
+++ b/spec/lib/gitlab/prometheus_client_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::PrometheusClient do
diff --git a/spec/lib/gitlab/query_limiting/active_support_subscriber_spec.rb b/spec/lib/gitlab/query_limiting/active_support_subscriber_spec.rb
index f8faeffb935..2db6d2fb60f 100644
--- a/spec/lib/gitlab/query_limiting/active_support_subscriber_spec.rb
+++ b/spec/lib/gitlab/query_limiting/active_support_subscriber_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::QueryLimiting::ActiveSupportSubscriber do
diff --git a/spec/lib/gitlab/query_limiting/middleware_spec.rb b/spec/lib/gitlab/query_limiting/middleware_spec.rb
index a04bcdecb4b..fb1c30118c2 100644
--- a/spec/lib/gitlab/query_limiting/middleware_spec.rb
+++ b/spec/lib/gitlab/query_limiting/middleware_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::QueryLimiting::Middleware do
diff --git a/spec/lib/gitlab/query_limiting/transaction_spec.rb b/spec/lib/gitlab/query_limiting/transaction_spec.rb
index b72b8574174..39d5a575efc 100644
--- a/spec/lib/gitlab/query_limiting/transaction_spec.rb
+++ b/spec/lib/gitlab/query_limiting/transaction_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::QueryLimiting::Transaction do
diff --git a/spec/lib/gitlab/query_limiting_spec.rb b/spec/lib/gitlab/query_limiting_spec.rb
index 42877b1e2dd..f0d0340cd6e 100644
--- a/spec/lib/gitlab/query_limiting_spec.rb
+++ b/spec/lib/gitlab/query_limiting_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::QueryLimiting do
diff --git a/spec/lib/gitlab/quick_actions/command_definition_spec.rb b/spec/lib/gitlab/quick_actions/command_definition_spec.rb
index 21f2c87a755..45b710adf07 100644
--- a/spec/lib/gitlab/quick_actions/command_definition_spec.rb
+++ b/spec/lib/gitlab/quick_actions/command_definition_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::QuickActions::CommandDefinition do
diff --git a/spec/lib/gitlab/quick_actions/dsl_spec.rb b/spec/lib/gitlab/quick_actions/dsl_spec.rb
index 78b9b3804c3..c98c36622f5 100644
--- a/spec/lib/gitlab/quick_actions/dsl_spec.rb
+++ b/spec/lib/gitlab/quick_actions/dsl_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::QuickActions::Dsl do
diff --git a/spec/lib/gitlab/quick_actions/extractor_spec.rb b/spec/lib/gitlab/quick_actions/extractor_spec.rb
index 873bb359d6e..f1acb5b7049 100644
--- a/spec/lib/gitlab/quick_actions/extractor_spec.rb
+++ b/spec/lib/gitlab/quick_actions/extractor_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::QuickActions::Extractor do
diff --git a/spec/lib/gitlab/quick_actions/spend_time_and_date_separator_spec.rb b/spec/lib/gitlab/quick_actions/spend_time_and_date_separator_spec.rb
index 8b58f0b3725..fd149cd1114 100644
--- a/spec/lib/gitlab/quick_actions/spend_time_and_date_separator_spec.rb
+++ b/spec/lib/gitlab/quick_actions/spend_time_and_date_separator_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::QuickActions::SpendTimeAndDateSeparator do
diff --git a/spec/lib/gitlab/quick_actions/substitution_definition_spec.rb b/spec/lib/gitlab/quick_actions/substitution_definition_spec.rb
index 1bb8bc51c96..e4f25bc35a9 100644
--- a/spec/lib/gitlab/quick_actions/substitution_definition_spec.rb
+++ b/spec/lib/gitlab/quick_actions/substitution_definition_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::QuickActions::SubstitutionDefinition do
diff --git a/spec/lib/gitlab/redis/cache_spec.rb b/spec/lib/gitlab/redis/cache_spec.rb
index 5a4f17cfcf6..0718998f981 100644
--- a/spec/lib/gitlab/redis/cache_spec.rb
+++ b/spec/lib/gitlab/redis/cache_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Redis::Cache do
diff --git a/spec/lib/gitlab/redis/queues_spec.rb b/spec/lib/gitlab/redis/queues_spec.rb
index 01ca25635a9..93207b6f469 100644
--- a/spec/lib/gitlab/redis/queues_spec.rb
+++ b/spec/lib/gitlab/redis/queues_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Redis::Queues do
diff --git a/spec/lib/gitlab/redis/shared_state_spec.rb b/spec/lib/gitlab/redis/shared_state_spec.rb
index 24b73745dc5..aa61fd99eb5 100644
--- a/spec/lib/gitlab/redis/shared_state_spec.rb
+++ b/spec/lib/gitlab/redis/shared_state_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Redis::SharedState do
diff --git a/spec/lib/gitlab/redis/wrapper_spec.rb b/spec/lib/gitlab/redis/wrapper_spec.rb
index 0c22a0d62cc..e4cc42130db 100644
--- a/spec/lib/gitlab/redis/wrapper_spec.rb
+++ b/spec/lib/gitlab/redis/wrapper_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Redis::Wrapper do
diff --git a/spec/lib/gitlab/reference_counter_spec.rb b/spec/lib/gitlab/reference_counter_spec.rb
index b2344d1870a..f9361d08faf 100644
--- a/spec/lib/gitlab/reference_counter_spec.rb
+++ b/spec/lib/gitlab/reference_counter_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::ReferenceCounter do
diff --git a/spec/lib/gitlab/regex_spec.rb b/spec/lib/gitlab/regex_spec.rb
index ba295386a55..e19210d8fbf 100644
--- a/spec/lib/gitlab/regex_spec.rb
+++ b/spec/lib/gitlab/regex_spec.rb
@@ -1,4 +1,6 @@
 # coding: utf-8
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Regex do
diff --git a/spec/lib/gitlab/repo_path_spec.rb b/spec/lib/gitlab/repo_path_spec.rb
index 8fbda929064..cffd7cc89e7 100644
--- a/spec/lib/gitlab/repo_path_spec.rb
+++ b/spec/lib/gitlab/repo_path_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe ::Gitlab::RepoPath do
diff --git a/spec/lib/gitlab/repository_cache_adapter_spec.rb b/spec/lib/gitlab/repository_cache_adapter_spec.rb
index 04fc24b6205..fd1338b55a6 100644
--- a/spec/lib/gitlab/repository_cache_adapter_spec.rb
+++ b/spec/lib/gitlab/repository_cache_adapter_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::RepositoryCacheAdapter do
diff --git a/spec/lib/gitlab/repository_cache_spec.rb b/spec/lib/gitlab/repository_cache_spec.rb
index 741ee12633f..6a684595eb8 100644
--- a/spec/lib/gitlab/repository_cache_spec.rb
+++ b/spec/lib/gitlab/repository_cache_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::RepositoryCache do
diff --git a/spec/lib/gitlab/repository_set_cache_spec.rb b/spec/lib/gitlab/repository_set_cache_spec.rb
index 9695e13d842..87e51f801e5 100644
--- a/spec/lib/gitlab/repository_set_cache_spec.rb
+++ b/spec/lib/gitlab/repository_set_cache_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::RepositorySetCache, :clean_gitlab_redis_cache do
diff --git a/spec/lib/gitlab/request_context_spec.rb b/spec/lib/gitlab/request_context_spec.rb
index 23e45aff1c5..a744f48da1f 100644
--- a/spec/lib/gitlab/request_context_spec.rb
+++ b/spec/lib/gitlab/request_context_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::RequestContext do
diff --git a/spec/lib/gitlab/request_forgery_protection_spec.rb b/spec/lib/gitlab/request_forgery_protection_spec.rb
index 305de613866..b7a3dc16eff 100644
--- a/spec/lib/gitlab/request_forgery_protection_spec.rb
+++ b/spec/lib/gitlab/request_forgery_protection_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::RequestForgeryProtection, :allow_forgery_protection do
diff --git a/spec/lib/gitlab/request_profiler/profile_spec.rb b/spec/lib/gitlab/request_profiler/profile_spec.rb
index b37ee558e1a..a75f3c66156 100644
--- a/spec/lib/gitlab/request_profiler/profile_spec.rb
+++ b/spec/lib/gitlab/request_profiler/profile_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'fast_spec_helper'
 
 describe Gitlab::RequestProfiler::Profile do
diff --git a/spec/lib/gitlab/request_profiler_spec.rb b/spec/lib/gitlab/request_profiler_spec.rb
index 498c045b6cd..f157189a72d 100644
--- a/spec/lib/gitlab/request_profiler_spec.rb
+++ b/spec/lib/gitlab/request_profiler_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::RequestProfiler do
diff --git a/spec/lib/gitlab/route_map_spec.rb b/spec/lib/gitlab/route_map_spec.rb
index a39c774429e..d5e70b91fb4 100644
--- a/spec/lib/gitlab/route_map_spec.rb
+++ b/spec/lib/gitlab/route_map_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::RouteMap do
diff --git a/spec/lib/gitlab/routing_spec.rb b/spec/lib/gitlab/routing_spec.rb
index 01d5acfc15b..965564cb83b 100644
--- a/spec/lib/gitlab/routing_spec.rb
+++ b/spec/lib/gitlab/routing_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Routing do
diff --git a/spec/lib/gitlab/sanitizers/exif_spec.rb b/spec/lib/gitlab/sanitizers/exif_spec.rb
index bd5f330c7a1..22c5f27dc6d 100644
--- a/spec/lib/gitlab/sanitizers/exif_spec.rb
+++ b/spec/lib/gitlab/sanitizers/exif_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Sanitizers::Exif do
diff --git a/spec/lib/gitlab/sanitizers/svg_spec.rb b/spec/lib/gitlab/sanitizers/svg_spec.rb
index df46a874528..a8c7495376d 100644
--- a/spec/lib/gitlab/sanitizers/svg_spec.rb
+++ b/spec/lib/gitlab/sanitizers/svg_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Sanitizers::SVG do
diff --git a/spec/lib/gitlab/search/found_blob_spec.rb b/spec/lib/gitlab/search/found_blob_spec.rb
index da263bc7523..58784706c24 100644
--- a/spec/lib/gitlab/search/found_blob_spec.rb
+++ b/spec/lib/gitlab/search/found_blob_spec.rb
@@ -1,4 +1,5 @@
 # coding: utf-8
+# frozen_string_literal: true
 
 require 'spec_helper'
 
diff --git a/spec/lib/gitlab/search/query_spec.rb b/spec/lib/gitlab/search/query_spec.rb
index 2d00428fffa..112e9a59f04 100644
--- a/spec/lib/gitlab/search/query_spec.rb
+++ b/spec/lib/gitlab/search/query_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Search::Query do
diff --git a/spec/lib/gitlab/search_results_spec.rb b/spec/lib/gitlab/search_results_spec.rb
index c287da19343..5621c686b8a 100644
--- a/spec/lib/gitlab/search_results_spec.rb
+++ b/spec/lib/gitlab/search_results_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SearchResults do
diff --git a/spec/lib/gitlab/sentry_spec.rb b/spec/lib/gitlab/sentry_spec.rb
index a48cc0d128a..9c4f3b8f42e 100644
--- a/spec/lib/gitlab/sentry_spec.rb
+++ b/spec/lib/gitlab/sentry_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Sentry do
diff --git a/spec/lib/gitlab/serializer/ci/variables_spec.rb b/spec/lib/gitlab/serializer/ci/variables_spec.rb
index 1d1fd5b0763..900508420c9 100644
--- a/spec/lib/gitlab/serializer/ci/variables_spec.rb
+++ b/spec/lib/gitlab/serializer/ci/variables_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'fast_spec_helper'
 
 describe Gitlab::Serializer::Ci::Variables do
diff --git a/spec/lib/gitlab/serializer/pagination_spec.rb b/spec/lib/gitlab/serializer/pagination_spec.rb
index c54be78f050..1e7f441f258 100644
--- a/spec/lib/gitlab/serializer/pagination_spec.rb
+++ b/spec/lib/gitlab/serializer/pagination_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Serializer::Pagination do
diff --git a/spec/lib/gitlab/shard_health_cache_spec.rb b/spec/lib/gitlab/shard_health_cache_spec.rb
index e1a69261939..f747849b5e9 100644
--- a/spec/lib/gitlab/shard_health_cache_spec.rb
+++ b/spec/lib/gitlab/shard_health_cache_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::ShardHealthCache, :clean_gitlab_redis_cache do
diff --git a/spec/lib/gitlab/shell_spec.rb b/spec/lib/gitlab/shell_spec.rb
index bce2e754176..0ba16b93ee7 100644
--- a/spec/lib/gitlab/shell_spec.rb
+++ b/spec/lib/gitlab/shell_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 require 'stringio'
 
diff --git a/spec/lib/gitlab/sherlock/collection_spec.rb b/spec/lib/gitlab/sherlock/collection_spec.rb
index 873ed14f804..bdc89c3d3cf 100644
--- a/spec/lib/gitlab/sherlock/collection_spec.rb
+++ b/spec/lib/gitlab/sherlock/collection_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Sherlock::Collection do
diff --git a/spec/lib/gitlab/sherlock/file_sample_spec.rb b/spec/lib/gitlab/sherlock/file_sample_spec.rb
index 394421504e0..b09ba5c62dc 100644
--- a/spec/lib/gitlab/sherlock/file_sample_spec.rb
+++ b/spec/lib/gitlab/sherlock/file_sample_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Sherlock::FileSample do
diff --git a/spec/lib/gitlab/sherlock/line_profiler_spec.rb b/spec/lib/gitlab/sherlock/line_profiler_spec.rb
index f2f8040fa0b..c1997606839 100644
--- a/spec/lib/gitlab/sherlock/line_profiler_spec.rb
+++ b/spec/lib/gitlab/sherlock/line_profiler_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Sherlock::LineProfiler do
diff --git a/spec/lib/gitlab/sherlock/line_sample_spec.rb b/spec/lib/gitlab/sherlock/line_sample_spec.rb
index 5f02f6a3213..b68e8cc0266 100644
--- a/spec/lib/gitlab/sherlock/line_sample_spec.rb
+++ b/spec/lib/gitlab/sherlock/line_sample_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Sherlock::LineSample do
diff --git a/spec/lib/gitlab/sherlock/location_spec.rb b/spec/lib/gitlab/sherlock/location_spec.rb
index b295a624b35..7b40c84c2d1 100644
--- a/spec/lib/gitlab/sherlock/location_spec.rb
+++ b/spec/lib/gitlab/sherlock/location_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Sherlock::Location do
diff --git a/spec/lib/gitlab/sherlock/middleware_spec.rb b/spec/lib/gitlab/sherlock/middleware_spec.rb
index 2016023df06..8d6e362f622 100644
--- a/spec/lib/gitlab/sherlock/middleware_spec.rb
+++ b/spec/lib/gitlab/sherlock/middleware_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Sherlock::Middleware do
diff --git a/spec/lib/gitlab/sherlock/query_spec.rb b/spec/lib/gitlab/sherlock/query_spec.rb
index 426071c7f92..13c7e6f8f8b 100644
--- a/spec/lib/gitlab/sherlock/query_spec.rb
+++ b/spec/lib/gitlab/sherlock/query_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Sherlock::Query do
diff --git a/spec/lib/gitlab/sherlock/transaction_spec.rb b/spec/lib/gitlab/sherlock/transaction_spec.rb
index 4a14dfbec56..2245c3ee8e2 100644
--- a/spec/lib/gitlab/sherlock/transaction_spec.rb
+++ b/spec/lib/gitlab/sherlock/transaction_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Sherlock::Transaction do
diff --git a/spec/lib/gitlab/sidekiq_config_spec.rb b/spec/lib/gitlab/sidekiq_config_spec.rb
index 0c66d764851..1e8ccb447b1 100644
--- a/spec/lib/gitlab/sidekiq_config_spec.rb
+++ b/spec/lib/gitlab/sidekiq_config_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'rails_helper'
 
 describe Gitlab::SidekiqConfig do
diff --git a/spec/lib/gitlab/sidekiq_logging/json_formatter_spec.rb b/spec/lib/gitlab/sidekiq_logging/json_formatter_spec.rb
index fed9aeba30c..a2cb38ec5b1 100644
--- a/spec/lib/gitlab/sidekiq_logging/json_formatter_spec.rb
+++ b/spec/lib/gitlab/sidekiq_logging/json_formatter_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SidekiqLogging::JSONFormatter do
diff --git a/spec/lib/gitlab/sidekiq_logging/structured_logger_spec.rb b/spec/lib/gitlab/sidekiq_logging/structured_logger_spec.rb
index 5621d3d17d1..4ad8cdba47f 100644
--- a/spec/lib/gitlab/sidekiq_logging/structured_logger_spec.rb
+++ b/spec/lib/gitlab/sidekiq_logging/structured_logger_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SidekiqLogging::StructuredLogger do
diff --git a/spec/lib/gitlab/sidekiq_middleware/memory_killer_spec.rb b/spec/lib/gitlab/sidekiq_middleware/memory_killer_spec.rb
index 1de9a644610..bf3bc8e1add 100644
--- a/spec/lib/gitlab/sidekiq_middleware/memory_killer_spec.rb
+++ b/spec/lib/gitlab/sidekiq_middleware/memory_killer_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SidekiqMiddleware::MemoryKiller do
diff --git a/spec/lib/gitlab/sidekiq_signals_spec.rb b/spec/lib/gitlab/sidekiq_signals_spec.rb
index 77ecd1840d2..10f1bad32cd 100644
--- a/spec/lib/gitlab/sidekiq_signals_spec.rb
+++ b/spec/lib/gitlab/sidekiq_signals_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SidekiqSignals do
diff --git a/spec/lib/gitlab/sidekiq_status/client_middleware_spec.rb b/spec/lib/gitlab/sidekiq_status/client_middleware_spec.rb
index 37d9e1d3e6b..1ca8cea66fc 100644
--- a/spec/lib/gitlab/sidekiq_status/client_middleware_spec.rb
+++ b/spec/lib/gitlab/sidekiq_status/client_middleware_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SidekiqStatus::ClientMiddleware do
diff --git a/spec/lib/gitlab/sidekiq_status/server_middleware_spec.rb b/spec/lib/gitlab/sidekiq_status/server_middleware_spec.rb
index 04e09d3dec8..40bcb49d1d3 100644
--- a/spec/lib/gitlab/sidekiq_status/server_middleware_spec.rb
+++ b/spec/lib/gitlab/sidekiq_status/server_middleware_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SidekiqStatus::ServerMiddleware do
diff --git a/spec/lib/gitlab/sidekiq_status_spec.rb b/spec/lib/gitlab/sidekiq_status_spec.rb
index 884f27b212c..7b5c75b2f3b 100644
--- a/spec/lib/gitlab/sidekiq_status_spec.rb
+++ b/spec/lib/gitlab/sidekiq_status_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SidekiqStatus do
diff --git a/spec/lib/gitlab/sidekiq_versioning/manager_spec.rb b/spec/lib/gitlab/sidekiq_versioning/manager_spec.rb
index 7debf70a16f..2aa7d1fd6d8 100644
--- a/spec/lib/gitlab/sidekiq_versioning/manager_spec.rb
+++ b/spec/lib/gitlab/sidekiq_versioning/manager_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SidekiqVersioning::Manager do
diff --git a/spec/lib/gitlab/sidekiq_versioning_spec.rb b/spec/lib/gitlab/sidekiq_versioning_spec.rb
index fa6d42e730d..dade5961775 100644
--- a/spec/lib/gitlab/sidekiq_versioning_spec.rb
+++ b/spec/lib/gitlab/sidekiq_versioning_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SidekiqVersioning, :sidekiq, :redis do
diff --git a/spec/lib/gitlab/slash_commands/command_spec.rb b/spec/lib/gitlab/slash_commands/command_spec.rb
index eceacac58af..c4ea8cbf2b1 100644
--- a/spec/lib/gitlab/slash_commands/command_spec.rb
+++ b/spec/lib/gitlab/slash_commands/command_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::Command do
diff --git a/spec/lib/gitlab/slash_commands/deploy_spec.rb b/spec/lib/gitlab/slash_commands/deploy_spec.rb
index 25f3e8a0409..93a724d8e12 100644
--- a/spec/lib/gitlab/slash_commands/deploy_spec.rb
+++ b/spec/lib/gitlab/slash_commands/deploy_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::Deploy do
diff --git a/spec/lib/gitlab/slash_commands/issue_move_spec.rb b/spec/lib/gitlab/slash_commands/issue_move_spec.rb
index 9a990e1fad7..962ac3668bc 100644
--- a/spec/lib/gitlab/slash_commands/issue_move_spec.rb
+++ b/spec/lib/gitlab/slash_commands/issue_move_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::IssueMove, service: true do
diff --git a/spec/lib/gitlab/slash_commands/issue_new_spec.rb b/spec/lib/gitlab/slash_commands/issue_new_spec.rb
index 59de11766d8..90f0518a63e 100644
--- a/spec/lib/gitlab/slash_commands/issue_new_spec.rb
+++ b/spec/lib/gitlab/slash_commands/issue_new_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::IssueNew do
diff --git a/spec/lib/gitlab/slash_commands/issue_search_spec.rb b/spec/lib/gitlab/slash_commands/issue_search_spec.rb
index 47787307990..b766a9a1361 100644
--- a/spec/lib/gitlab/slash_commands/issue_search_spec.rb
+++ b/spec/lib/gitlab/slash_commands/issue_search_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::IssueSearch do
diff --git a/spec/lib/gitlab/slash_commands/issue_show_spec.rb b/spec/lib/gitlab/slash_commands/issue_show_spec.rb
index 5c4ba2736ba..e53f79dcd86 100644
--- a/spec/lib/gitlab/slash_commands/issue_show_spec.rb
+++ b/spec/lib/gitlab/slash_commands/issue_show_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::IssueShow do
diff --git a/spec/lib/gitlab/slash_commands/presenters/access_spec.rb b/spec/lib/gitlab/slash_commands/presenters/access_spec.rb
index ef3d217f7be..286fec892e6 100644
--- a/spec/lib/gitlab/slash_commands/presenters/access_spec.rb
+++ b/spec/lib/gitlab/slash_commands/presenters/access_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::Presenters::Access do
diff --git a/spec/lib/gitlab/slash_commands/presenters/deploy_spec.rb b/spec/lib/gitlab/slash_commands/presenters/deploy_spec.rb
index d16d122c64e..9c2e9ab982f 100644
--- a/spec/lib/gitlab/slash_commands/presenters/deploy_spec.rb
+++ b/spec/lib/gitlab/slash_commands/presenters/deploy_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::Presenters::Deploy do
diff --git a/spec/lib/gitlab/slash_commands/presenters/issue_move_spec.rb b/spec/lib/gitlab/slash_commands/presenters/issue_move_spec.rb
index 58c341a284e..56b64d32192 100644
--- a/spec/lib/gitlab/slash_commands/presenters/issue_move_spec.rb
+++ b/spec/lib/gitlab/slash_commands/presenters/issue_move_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::Presenters::IssueMove do
diff --git a/spec/lib/gitlab/slash_commands/presenters/issue_new_spec.rb b/spec/lib/gitlab/slash_commands/presenters/issue_new_spec.rb
index 76e4bad88fd..f926783fbea 100644
--- a/spec/lib/gitlab/slash_commands/presenters/issue_new_spec.rb
+++ b/spec/lib/gitlab/slash_commands/presenters/issue_new_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::Presenters::IssueNew do
diff --git a/spec/lib/gitlab/slash_commands/presenters/issue_search_spec.rb b/spec/lib/gitlab/slash_commands/presenters/issue_search_spec.rb
index 5a7ec0685fe..e1c011133c4 100644
--- a/spec/lib/gitlab/slash_commands/presenters/issue_search_spec.rb
+++ b/spec/lib/gitlab/slash_commands/presenters/issue_search_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::Presenters::IssueSearch do
diff --git a/spec/lib/gitlab/slash_commands/presenters/issue_show_spec.rb b/spec/lib/gitlab/slash_commands/presenters/issue_show_spec.rb
index 8f607d7a9c9..56d6bf1c788 100644
--- a/spec/lib/gitlab/slash_commands/presenters/issue_show_spec.rb
+++ b/spec/lib/gitlab/slash_commands/presenters/issue_show_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SlashCommands::Presenters::IssueShow do
diff --git a/spec/lib/gitlab/snippet_search_results_spec.rb b/spec/lib/gitlab/snippet_search_results_spec.rb
index 35df38f052b..89d290aaa81 100644
--- a/spec/lib/gitlab/snippet_search_results_spec.rb
+++ b/spec/lib/gitlab/snippet_search_results_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SnippetSearchResults do
diff --git a/spec/lib/gitlab/sql/cte_spec.rb b/spec/lib/gitlab/sql/cte_spec.rb
index 5d2164491b5..e6194924f5a 100644
--- a/spec/lib/gitlab/sql/cte_spec.rb
+++ b/spec/lib/gitlab/sql/cte_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SQL::CTE do
diff --git a/spec/lib/gitlab/sql/glob_spec.rb b/spec/lib/gitlab/sql/glob_spec.rb
index 3147b52dcc5..83eed309ecc 100644
--- a/spec/lib/gitlab/sql/glob_spec.rb
+++ b/spec/lib/gitlab/sql/glob_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SQL::Glob do
diff --git a/spec/lib/gitlab/sql/pattern_spec.rb b/spec/lib/gitlab/sql/pattern_spec.rb
index 98838712eae..31944d51b3c 100644
--- a/spec/lib/gitlab/sql/pattern_spec.rb
+++ b/spec/lib/gitlab/sql/pattern_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SQL::Pattern do
diff --git a/spec/lib/gitlab/sql/recursive_cte_spec.rb b/spec/lib/gitlab/sql/recursive_cte_spec.rb
index 407a4d8a247..20e36c224b0 100644
--- a/spec/lib/gitlab/sql/recursive_cte_spec.rb
+++ b/spec/lib/gitlab/sql/recursive_cte_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SQL::RecursiveCTE do
diff --git a/spec/lib/gitlab/sql/union_spec.rb b/spec/lib/gitlab/sql/union_spec.rb
index fe6422c32b6..f8f6da19fa5 100644
--- a/spec/lib/gitlab/sql/union_spec.rb
+++ b/spec/lib/gitlab/sql/union_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SQL::Union do
diff --git a/spec/lib/gitlab/ssh_public_key_spec.rb b/spec/lib/gitlab/ssh_public_key_spec.rb
index a6ea07e8b6d..f8becb0c796 100644
--- a/spec/lib/gitlab/ssh_public_key_spec.rb
+++ b/spec/lib/gitlab/ssh_public_key_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::SSHPublicKey, lib: true do
diff --git a/spec/lib/gitlab/string_placeholder_replacer_spec.rb b/spec/lib/gitlab/string_placeholder_replacer_spec.rb
index 7a03ea4154c..0295bf1265f 100644
--- a/spec/lib/gitlab/string_placeholder_replacer_spec.rb
+++ b/spec/lib/gitlab/string_placeholder_replacer_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::StringPlaceholderReplacer do
diff --git a/spec/lib/gitlab/string_range_marker_spec.rb b/spec/lib/gitlab/string_range_marker_spec.rb
index 6bc02459dbd..7ed43db3d10 100644
--- a/spec/lib/gitlab/string_range_marker_spec.rb
+++ b/spec/lib/gitlab/string_range_marker_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::StringRangeMarker do
diff --git a/spec/lib/gitlab/string_regex_marker_spec.rb b/spec/lib/gitlab/string_regex_marker_spec.rb
index 37b1298b962..2b19edbe7f9 100644
--- a/spec/lib/gitlab/string_regex_marker_spec.rb
+++ b/spec/lib/gitlab/string_regex_marker_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::StringRegexMarker do
diff --git a/spec/lib/gitlab/tcp_checker_spec.rb b/spec/lib/gitlab/tcp_checker_spec.rb
index 4acf0334496..49f04f269ae 100644
--- a/spec/lib/gitlab/tcp_checker_spec.rb
+++ b/spec/lib/gitlab/tcp_checker_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::TcpChecker do
diff --git a/spec/lib/gitlab/template/finders/global_template_finder_spec.rb b/spec/lib/gitlab/template/finders/global_template_finder_spec.rb
index c7f58fbd2a5..082ffa855b7 100644
--- a/spec/lib/gitlab/template/finders/global_template_finder_spec.rb
+++ b/spec/lib/gitlab/template/finders/global_template_finder_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Template::Finders::GlobalTemplateFinder do
diff --git a/spec/lib/gitlab/template/finders/repo_template_finders_spec.rb b/spec/lib/gitlab/template/finders/repo_template_finders_spec.rb
index e329d55d837..c8f2a37c5d6 100644
--- a/spec/lib/gitlab/template/finders/repo_template_finders_spec.rb
+++ b/spec/lib/gitlab/template/finders/repo_template_finders_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Template::Finders::RepoTemplateFinder do
diff --git a/spec/lib/gitlab/template/gitignore_template_spec.rb b/spec/lib/gitlab/template/gitignore_template_spec.rb
index 97797f42aaa..e8f632889ad 100644
--- a/spec/lib/gitlab/template/gitignore_template_spec.rb
+++ b/spec/lib/gitlab/template/gitignore_template_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Template::GitignoreTemplate do
diff --git a/spec/lib/gitlab/template/gitlab_ci_yml_template_spec.rb b/spec/lib/gitlab/template/gitlab_ci_yml_template_spec.rb
index 5f0a7e925ca..52e100768a7 100644
--- a/spec/lib/gitlab/template/gitlab_ci_yml_template_spec.rb
+++ b/spec/lib/gitlab/template/gitlab_ci_yml_template_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Template::GitlabCiYmlTemplate do
diff --git a/spec/lib/gitlab/template/issue_template_spec.rb b/spec/lib/gitlab/template/issue_template_spec.rb
index 7098499f996..54e46d3a9ec 100644
--- a/spec/lib/gitlab/template/issue_template_spec.rb
+++ b/spec/lib/gitlab/template/issue_template_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Template::IssueTemplate do
diff --git a/spec/lib/gitlab/template/merge_request_template_spec.rb b/spec/lib/gitlab/template/merge_request_template_spec.rb
index bd7ff64aa8a..bbc184d4dfc 100644
--- a/spec/lib/gitlab/template/merge_request_template_spec.rb
+++ b/spec/lib/gitlab/template/merge_request_template_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Template::MergeRequestTemplate do
diff --git a/spec/lib/gitlab/themes_spec.rb b/spec/lib/gitlab/themes_spec.rb
index a8213988f70..e0278eb9c7f 100644
--- a/spec/lib/gitlab/themes_spec.rb
+++ b/spec/lib/gitlab/themes_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Themes, lib: true do
diff --git a/spec/lib/gitlab/tree_summary_spec.rb b/spec/lib/gitlab/tree_summary_spec.rb
index e22f898dc4c..e15463ed0eb 100644
--- a/spec/lib/gitlab/tree_summary_spec.rb
+++ b/spec/lib/gitlab/tree_summary_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::TreeSummary do
diff --git a/spec/lib/gitlab/untrusted_regexp/ruby_syntax_spec.rb b/spec/lib/gitlab/untrusted_regexp/ruby_syntax_spec.rb
index f1882e03581..68402e64012 100644
--- a/spec/lib/gitlab/untrusted_regexp/ruby_syntax_spec.rb
+++ b/spec/lib/gitlab/untrusted_regexp/ruby_syntax_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'fast_spec_helper'
 require 'support/shared_examples/malicious_regexp_shared_examples'
 require 'support/helpers/stub_feature_flags'
diff --git a/spec/lib/gitlab/untrusted_regexp_spec.rb b/spec/lib/gitlab/untrusted_regexp_spec.rb
index 9d483f13a5e..4cc21e94a83 100644
--- a/spec/lib/gitlab/untrusted_regexp_spec.rb
+++ b/spec/lib/gitlab/untrusted_regexp_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'fast_spec_helper'
 require 'support/shared_examples/malicious_regexp_shared_examples'
 
diff --git a/spec/lib/gitlab/uploads_transfer_spec.rb b/spec/lib/gitlab/uploads_transfer_spec.rb
index 4275e7b015b..16560fc8f12 100644
--- a/spec/lib/gitlab/uploads_transfer_spec.rb
+++ b/spec/lib/gitlab/uploads_transfer_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::UploadsTransfer do
diff --git a/spec/lib/gitlab/url_blocker_spec.rb b/spec/lib/gitlab/url_blocker_spec.rb
index 45d9022abeb..df8a1f82f81 100644
--- a/spec/lib/gitlab/url_blocker_spec.rb
+++ b/spec/lib/gitlab/url_blocker_spec.rb
@@ -1,4 +1,6 @@
 # coding: utf-8
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::UrlBlocker do
diff --git a/spec/lib/gitlab/url_builder_spec.rb b/spec/lib/gitlab/url_builder_spec.rb
index bbcb92608d8..08d3c638f9e 100644
--- a/spec/lib/gitlab/url_builder_spec.rb
+++ b/spec/lib/gitlab/url_builder_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::UrlBuilder do
diff --git a/spec/lib/gitlab/url_sanitizer_spec.rb b/spec/lib/gitlab/url_sanitizer_spec.rb
index 7242255d535..b39609c594b 100644
--- a/spec/lib/gitlab/url_sanitizer_spec.rb
+++ b/spec/lib/gitlab/url_sanitizer_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::UrlSanitizer do
diff --git a/spec/lib/gitlab/user_access_spec.rb b/spec/lib/gitlab/user_access_spec.rb
index 9da06bb40f4..c25bd14fcba 100644
--- a/spec/lib/gitlab/user_access_spec.rb
+++ b/spec/lib/gitlab/user_access_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::UserAccess do
diff --git a/spec/lib/gitlab/utils/deep_size_spec.rb b/spec/lib/gitlab/utils/deep_size_spec.rb
index 1e619a15980..47dfc04f46f 100644
--- a/spec/lib/gitlab/utils/deep_size_spec.rb
+++ b/spec/lib/gitlab/utils/deep_size_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Utils::DeepSize do
diff --git a/spec/lib/gitlab/utils/merge_hash_spec.rb b/spec/lib/gitlab/utils/merge_hash_spec.rb
index 4fa7bb31301..72620e549a9 100644
--- a/spec/lib/gitlab/utils/merge_hash_spec.rb
+++ b/spec/lib/gitlab/utils/merge_hash_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 describe Gitlab::Utils::MergeHash do
   describe '.crush' do
diff --git a/spec/lib/gitlab/utils/override_spec.rb b/spec/lib/gitlab/utils/override_spec.rb
index 9e7c97f8095..5855c4374a9 100644
--- a/spec/lib/gitlab/utils/override_spec.rb
+++ b/spec/lib/gitlab/utils/override_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'fast_spec_helper'
 
 describe Gitlab::Utils::Override do
diff --git a/spec/lib/gitlab/utils/sanitize_node_link_spec.rb b/spec/lib/gitlab/utils/sanitize_node_link_spec.rb
index 064c2707d06..80b0935a7ed 100644
--- a/spec/lib/gitlab/utils/sanitize_node_link_spec.rb
+++ b/spec/lib/gitlab/utils/sanitize_node_link_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Utils::SanitizeNodeLink do
diff --git a/spec/lib/gitlab/utils/strong_memoize_spec.rb b/spec/lib/gitlab/utils/strong_memoize_spec.rb
index 473f8100771..26baaf873a8 100644
--- a/spec/lib/gitlab/utils/strong_memoize_spec.rb
+++ b/spec/lib/gitlab/utils/strong_memoize_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Utils::StrongMemoize do
diff --git a/spec/lib/gitlab/utils_spec.rb b/spec/lib/gitlab/utils_spec.rb
index 0c20b3aa4c8..890918d4a7c 100644
--- a/spec/lib/gitlab/utils_spec.rb
+++ b/spec/lib/gitlab/utils_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Utils do
diff --git a/spec/lib/gitlab/verify/job_artifacts_spec.rb b/spec/lib/gitlab/verify/job_artifacts_spec.rb
index 6e916a56564..b50ec1528d4 100644
--- a/spec/lib/gitlab/verify/job_artifacts_spec.rb
+++ b/spec/lib/gitlab/verify/job_artifacts_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Verify::JobArtifacts do
diff --git a/spec/lib/gitlab/verify/lfs_objects_spec.rb b/spec/lib/gitlab/verify/lfs_objects_spec.rb
index 2feaedd6f14..c27c9b6efa1 100644
--- a/spec/lib/gitlab/verify/lfs_objects_spec.rb
+++ b/spec/lib/gitlab/verify/lfs_objects_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Verify::LfsObjects do
diff --git a/spec/lib/gitlab/verify/uploads_spec.rb b/spec/lib/gitlab/verify/uploads_spec.rb
index 38c30fab1ba..a3d3f5d46f3 100644
--- a/spec/lib/gitlab/verify/uploads_spec.rb
+++ b/spec/lib/gitlab/verify/uploads_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Verify::Uploads do
diff --git a/spec/lib/gitlab/version_info_spec.rb b/spec/lib/gitlab/version_info_spec.rb
index 30035c79e58..8c14b187410 100644
--- a/spec/lib/gitlab/version_info_spec.rb
+++ b/spec/lib/gitlab/version_info_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'Gitlab::VersionInfo' do
diff --git a/spec/lib/gitlab/view/presenter/base_spec.rb b/spec/lib/gitlab/view/presenter/base_spec.rb
index 02c2fd47197..e196ab23482 100644
--- a/spec/lib/gitlab/view/presenter/base_spec.rb
+++ b/spec/lib/gitlab/view/presenter/base_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::View::Presenter::Base do
diff --git a/spec/lib/gitlab/view/presenter/delegated_spec.rb b/spec/lib/gitlab/view/presenter/delegated_spec.rb
index 940a2ce6ebd..0a21cd1358e 100644
--- a/spec/lib/gitlab/view/presenter/delegated_spec.rb
+++ b/spec/lib/gitlab/view/presenter/delegated_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::View::Presenter::Delegated do
diff --git a/spec/lib/gitlab/view/presenter/factory_spec.rb b/spec/lib/gitlab/view/presenter/factory_spec.rb
index 6120bafb2e3..515a1b0a8e4 100644
--- a/spec/lib/gitlab/view/presenter/factory_spec.rb
+++ b/spec/lib/gitlab/view/presenter/factory_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::View::Presenter::Factory do
diff --git a/spec/lib/gitlab/view/presenter/simple_spec.rb b/spec/lib/gitlab/view/presenter/simple_spec.rb
index 1795ed2405b..70e2b170a36 100644
--- a/spec/lib/gitlab/view/presenter/simple_spec.rb
+++ b/spec/lib/gitlab/view/presenter/simple_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::View::Presenter::Simple do
diff --git a/spec/lib/gitlab/visibility_level_spec.rb b/spec/lib/gitlab/visibility_level_spec.rb
index 0a170a157fe..75dc7d8e6d1 100644
--- a/spec/lib/gitlab/visibility_level_spec.rb
+++ b/spec/lib/gitlab/visibility_level_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::VisibilityLevel do
diff --git a/spec/lib/gitlab/wiki_file_finder_spec.rb b/spec/lib/gitlab/wiki_file_finder_spec.rb
index 025d1203dc5..fdd95d5e6e6 100644
--- a/spec/lib/gitlab/wiki_file_finder_spec.rb
+++ b/spec/lib/gitlab/wiki_file_finder_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::WikiFileFinder do
diff --git a/spec/lib/gitlab/workhorse_spec.rb b/spec/lib/gitlab/workhorse_spec.rb
index 451e18ed91b..5c5ff46112f 100644
--- a/spec/lib/gitlab/workhorse_spec.rb
+++ b/spec/lib/gitlab/workhorse_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Workhorse do
diff --git a/spec/lib/gitlab_spec.rb b/spec/lib/gitlab_spec.rb
index c293f58c9cb..cbc5649fc09 100644
--- a/spec/lib/gitlab_spec.rb
+++ b/spec/lib/gitlab_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'fast_spec_helper'
 
 require_dependency 'gitlab'
diff --git a/spec/lib/google_api/auth_spec.rb b/spec/lib/google_api/auth_spec.rb
index 87a3f43274f..a25004ac385 100644
--- a/spec/lib/google_api/auth_spec.rb
+++ b/spec/lib/google_api/auth_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe GoogleApi::Auth do
diff --git a/spec/lib/google_api/cloud_platform/client_spec.rb b/spec/lib/google_api/cloud_platform/client_spec.rb
index 1fefc947636..c24998d32f8 100644
--- a/spec/lib/google_api/cloud_platform/client_spec.rb
+++ b/spec/lib/google_api/cloud_platform/client_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe GoogleApi::CloudPlatform::Client do
diff --git a/spec/lib/json_web_token/rsa_token_spec.rb b/spec/lib/json_web_token/rsa_token_spec.rb
index a3c54651e80..a127c787e28 100644
--- a/spec/lib/json_web_token/rsa_token_spec.rb
+++ b/spec/lib/json_web_token/rsa_token_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 describe JSONWebToken::RSAToken do
   let(:rsa_key) do
     OpenSSL::PKey::RSA.new <<-eos.strip_heredoc
diff --git a/spec/lib/json_web_token/token_spec.rb b/spec/lib/json_web_token/token_spec.rb
index d7e7560d962..916d11ce0ed 100644
--- a/spec/lib/json_web_token/token_spec.rb
+++ b/spec/lib/json_web_token/token_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 describe JSONWebToken::Token do
   let(:token) { described_class.new }
 
diff --git a/spec/lib/mattermost/client_spec.rb b/spec/lib/mattermost/client_spec.rb
index dc11a414717..5fe35eb5f93 100644
--- a/spec/lib/mattermost/client_spec.rb
+++ b/spec/lib/mattermost/client_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Mattermost::Client do
diff --git a/spec/lib/mattermost/command_spec.rb b/spec/lib/mattermost/command_spec.rb
index 7c194749dfb..f8c451a1522 100644
--- a/spec/lib/mattermost/command_spec.rb
+++ b/spec/lib/mattermost/command_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Mattermost::Command do
diff --git a/spec/lib/mattermost/session_spec.rb b/spec/lib/mattermost/session_spec.rb
index 346455067a7..ea12bd76c8d 100644
--- a/spec/lib/mattermost/session_spec.rb
+++ b/spec/lib/mattermost/session_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Mattermost::Session, type: :request do
diff --git a/spec/lib/mattermost/team_spec.rb b/spec/lib/mattermost/team_spec.rb
index 030aa5d06a8..2823dab67c9 100644
--- a/spec/lib/mattermost/team_spec.rb
+++ b/spec/lib/mattermost/team_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Mattermost::Team do
diff --git a/spec/lib/microsoft_teams/activity_spec.rb b/spec/lib/microsoft_teams/activity_spec.rb
index 7890ae2e7b0..3fad2437f3e 100644
--- a/spec/lib/microsoft_teams/activity_spec.rb
+++ b/spec/lib/microsoft_teams/activity_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe MicrosoftTeams::Activity do
diff --git a/spec/lib/microsoft_teams/notifier_spec.rb b/spec/lib/microsoft_teams/notifier_spec.rb
index 2aaa7c24ad8..64ab8d85807 100644
--- a/spec/lib/microsoft_teams/notifier_spec.rb
+++ b/spec/lib/microsoft_teams/notifier_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe MicrosoftTeams::Notifier do
diff --git a/spec/lib/milestone_array_spec.rb b/spec/lib/milestone_array_spec.rb
index df91677b925..375cb87dde6 100644
--- a/spec/lib/milestone_array_spec.rb
+++ b/spec/lib/milestone_array_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe MilestoneArray do
diff --git a/spec/lib/object_storage/direct_upload_spec.rb b/spec/lib/object_storage/direct_upload_spec.rb
index 8ccbd90ddb8..fae0c636bdc 100644
--- a/spec/lib/object_storage/direct_upload_spec.rb
+++ b/spec/lib/object_storage/direct_upload_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe ObjectStorage::DirectUpload do
diff --git a/spec/lib/omni_auth/strategies/jwt_spec.rb b/spec/lib/omni_auth/strategies/jwt_spec.rb
index c1eaf0bb0bf..bdf3ea6be98 100644
--- a/spec/lib/omni_auth/strategies/jwt_spec.rb
+++ b/spec/lib/omni_auth/strategies/jwt_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe OmniAuth::Strategies::Jwt do
diff --git a/spec/lib/rspec_flaky/config_spec.rb b/spec/lib/rspec_flaky/config_spec.rb
index 4a71b1feebd..13b2219267b 100644
--- a/spec/lib/rspec_flaky/config_spec.rb
+++ b/spec/lib/rspec_flaky/config_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe RspecFlaky::Config, :aggregate_failures do
diff --git a/spec/lib/rspec_flaky/example_spec.rb b/spec/lib/rspec_flaky/example_spec.rb
index 5b4fd5ddf3e..4679dd818db 100644
--- a/spec/lib/rspec_flaky/example_spec.rb
+++ b/spec/lib/rspec_flaky/example_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe RspecFlaky::Example do
diff --git a/spec/lib/rspec_flaky/flaky_example_spec.rb b/spec/lib/rspec_flaky/flaky_example_spec.rb
index d19c34bebb3..092bbc781a5 100644
--- a/spec/lib/rspec_flaky/flaky_example_spec.rb
+++ b/spec/lib/rspec_flaky/flaky_example_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe RspecFlaky::FlakyExample, :aggregate_failures do
diff --git a/spec/lib/rspec_flaky/flaky_examples_collection_spec.rb b/spec/lib/rspec_flaky/flaky_examples_collection_spec.rb
index 6731a27ed17..2e224cda61b 100644
--- a/spec/lib/rspec_flaky/flaky_examples_collection_spec.rb
+++ b/spec/lib/rspec_flaky/flaky_examples_collection_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe RspecFlaky::FlakyExamplesCollection, :aggregate_failures do
diff --git a/spec/lib/rspec_flaky/listener_spec.rb b/spec/lib/rspec_flaky/listener_spec.rb
index ef085445081..44b8d99b74f 100644
--- a/spec/lib/rspec_flaky/listener_spec.rb
+++ b/spec/lib/rspec_flaky/listener_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe RspecFlaky::Listener, :aggregate_failures do
diff --git a/spec/lib/rspec_flaky/report_spec.rb b/spec/lib/rspec_flaky/report_spec.rb
index 7d57d99f7e5..6a98a7a4e6b 100644
--- a/spec/lib/rspec_flaky/report_spec.rb
+++ b/spec/lib/rspec_flaky/report_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe RspecFlaky::Report, :aggregate_failures do
diff --git a/spec/lib/safe_zip/entry_spec.rb b/spec/lib/safe_zip/entry_spec.rb
index 115e28c5994..0974f732188 100644
--- a/spec/lib/safe_zip/entry_spec.rb
+++ b/spec/lib/safe_zip/entry_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe SafeZip::Entry do
diff --git a/spec/lib/safe_zip/extract_params_spec.rb b/spec/lib/safe_zip/extract_params_spec.rb
index 85e22cfa495..f66d3de89ee 100644
--- a/spec/lib/safe_zip/extract_params_spec.rb
+++ b/spec/lib/safe_zip/extract_params_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe SafeZip::ExtractParams do
diff --git a/spec/lib/safe_zip/extract_spec.rb b/spec/lib/safe_zip/extract_spec.rb
index b75a8fede00..3b8c64c1c9f 100644
--- a/spec/lib/safe_zip/extract_spec.rb
+++ b/spec/lib/safe_zip/extract_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe SafeZip::Extract do
diff --git a/spec/lib/serializers/json_spec.rb b/spec/lib/serializers/json_spec.rb
index 847a01d186c..a8d82d70e89 100644
--- a/spec/lib/serializers/json_spec.rb
+++ b/spec/lib/serializers/json_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'fast_spec_helper'
 
 describe Serializers::JSON do
diff --git a/spec/lib/system_check/app/git_user_default_ssh_config_check_spec.rb b/spec/lib/system_check/app/git_user_default_ssh_config_check_spec.rb
index a0fb86345f3..f132f608ab6 100644
--- a/spec/lib/system_check/app/git_user_default_ssh_config_check_spec.rb
+++ b/spec/lib/system_check/app/git_user_default_ssh_config_check_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe SystemCheck::App::GitUserDefaultSSHConfigCheck do
diff --git a/spec/lib/system_check/base_check_spec.rb b/spec/lib/system_check/base_check_spec.rb
index faf8c99e772..ccb7b483bdc 100644
--- a/spec/lib/system_check/base_check_spec.rb
+++ b/spec/lib/system_check/base_check_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe SystemCheck::BaseCheck do
diff --git a/spec/lib/system_check/orphans/namespace_check_spec.rb b/spec/lib/system_check/orphans/namespace_check_spec.rb
index 2a61ff3ad65..f7491e40438 100644
--- a/spec/lib/system_check/orphans/namespace_check_spec.rb
+++ b/spec/lib/system_check/orphans/namespace_check_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 require 'rake_helper'
 
diff --git a/spec/lib/system_check/orphans/repository_check_spec.rb b/spec/lib/system_check/orphans/repository_check_spec.rb
index b0c2267d177..a5e06f30e75 100644
--- a/spec/lib/system_check/orphans/repository_check_spec.rb
+++ b/spec/lib/system_check/orphans/repository_check_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 require 'rake_helper'
 
diff --git a/spec/lib/system_check/simple_executor_spec.rb b/spec/lib/system_check/simple_executor_spec.rb
index e71e9da369d..94094343ec6 100644
--- a/spec/lib/system_check/simple_executor_spec.rb
+++ b/spec/lib/system_check/simple_executor_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 require 'rake_helper'
 
diff --git a/spec/lib/system_check_spec.rb b/spec/lib/system_check_spec.rb
index 4d9e17fa6ec..f3ed6ca31c9 100644
--- a/spec/lib/system_check_spec.rb
+++ b/spec/lib/system_check_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 require 'rake_helper'
 
diff --git a/spec/lib/uploaded_file_spec.rb b/spec/lib/uploaded_file_spec.rb
index a2f5c2e7121..2cb4727bd4b 100644
--- a/spec/lib/uploaded_file_spec.rb
+++ b/spec/lib/uploaded_file_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe UploadedFile do
-- 
cgit v1.2.1


From c5acf26e0609ec0c5e16b2fb232d7058e6c066cd Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Fri, 23 Aug 2019 00:17:11 +1200
Subject: Fix frozen string errors

---
 lib/gitlab/profiler.rb                    | 2 +-
 spec/lib/gitlab/search/found_blob_spec.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/gitlab/profiler.rb b/lib/gitlab/profiler.rb
index ec7671f9a8b..425c30d67fe 100644
--- a/lib/gitlab/profiler.rb
+++ b/lib/gitlab/profiler.rb
@@ -97,7 +97,7 @@ module Gitlab
           attr_reader :load_times_by_model, :private_token
 
           def debug(message, *)
-            message.gsub!(private_token, FILTERED_STRING) if private_token
+            message = message.gsub(private_token, FILTERED_STRING) if private_token
 
             _, type, time = *message.match(/(\w+) Load \(([0-9.]+)ms\)/)
 
diff --git a/spec/lib/gitlab/search/found_blob_spec.rb b/spec/lib/gitlab/search/found_blob_spec.rb
index 58784706c24..3496fb29836 100644
--- a/spec/lib/gitlab/search/found_blob_spec.rb
+++ b/spec/lib/gitlab/search/found_blob_spec.rb
@@ -109,7 +109,7 @@ describe Gitlab::Search::FoundBlob do
       end
 
       context 'with ISO-8859-1' do
-        let(:search_result) { "master:encoding/iso8859.txt\x001\x00\xC4\xFC\nmaster:encoding/iso8859.txt\x002\x00\nmaster:encoding/iso8859.txt\x003\x00foo\n".force_encoding(Encoding::ASCII_8BIT) }
+        let(:search_result) { (+"master:encoding/iso8859.txt\x001\x00\xC4\xFC\nmaster:encoding/iso8859.txt\x002\x00\nmaster:encoding/iso8859.txt\x003\x00foo\n").force_encoding(Encoding::ASCII_8BIT) }
 
         it 'returns results as UTF-8' do
           expect(subject.filename).to eq('encoding/iso8859.txt')
-- 
cgit v1.2.1


From 6044b3ed1eb81cb55d1b978e76f1c1f3ee4e3a70 Mon Sep 17 00:00:00 2001
From: Kushal Pandya <kushalspandya@gmail.com>
Date: Thu, 15 Aug 2019 21:49:25 +0530
Subject: Add `searchBy` helper & `SidebarItemEpicsSelect`

- Adds `searchBy` util in common utils
- Adds placeholder `SidebarItemEpicsSelect`
---
 .../javascripts/boards/components/board_sidebar.js |  2 +
 app/assets/javascripts/lib/utils/common_utils.js   | 60 ++++++++++++++++++++++
 doc/api/epics.md                                   |  8 +++
 spec/javascripts/lib/utils/common_utils_spec.js    | 39 ++++++++++++++
 4 files changed, 109 insertions(+)

diff --git a/app/assets/javascripts/boards/components/board_sidebar.js b/app/assets/javascripts/boards/components/board_sidebar.js
index 2ace0060c42..ba1fe9202fc 100644
--- a/app/assets/javascripts/boards/components/board_sidebar.js
+++ b/app/assets/javascripts/boards/components/board_sidebar.js
@@ -22,6 +22,8 @@ export default Vue.extend({
   components: {
     AssigneeTitle,
     Assignees,
+    SidebarEpicsSelect: () =>
+      import('ee_component/sidebar/components/sidebar_item_epics_select.vue'),
     RemoveBtn,
     Subscriptions,
     TimeTracker,
diff --git a/app/assets/javascripts/lib/utils/common_utils.js b/app/assets/javascripts/lib/utils/common_utils.js
index 31c4a920bbe..6e8f63a10a4 100644
--- a/app/assets/javascripts/lib/utils/common_utils.js
+++ b/app/assets/javascripts/lib/utils/common_utils.js
@@ -731,6 +731,66 @@ export const NavigationType = {
   TYPE_RESERVED: 255,
 };
 
+/**
+ * Method to perform case-insensitive search for a string
+ * within multiple properties and return object containing
+ * properties in case there are multiple matches or `null`
+ * if there's no match.
+ *
+ * Eg; Suppose we want to allow user to search using for a string
+ *     within `iid`, `title`, `url` or `reference` props of a target object;
+ *
+ *     const objectToSearch = {
+ *       "iid": 1,
+ *       "title": "Error omnis quos consequatur ullam a vitae sed omnis libero cupiditate. &3",
+ *       "url": "/groups/gitlab-org/-/epics/1",
+ *       "reference": "&1",
+ *     };
+ *
+ *    Following is how we call searchBy and the return values it will yield;
+ *
+ *    -  `searchBy('omnis', objectToSearch);`: This will return `{ title: ... }` as our
+ *        query was found within title prop we only return that.
+ *    -  `searchBy('1', objectToSearch);`: This will return `{ "iid": ..., "reference": ..., "url": ... }`.
+ *    -  `searchBy('https://gitlab.com/groups/gitlab-org/-/epics/1', objectToSearch);`:
+ *        This will return `{ "url": ... }`.
+ *    -  `searchBy('foo', objectToSearch);`: This will return `null` as no property value
+ *        matched with our query.
+ *
+ *    You can learn more about behaviour of this method by referring to tests
+ *    within `spec/javascripts/lib/utils/common_utils_spec.js`.
+ *
+ * @param {string} query String to search for
+ * @param {object} searchSpace Object containing properties to search in for `query`
+ */
+export const searchBy = (query = '', searchSpace = {}) => {
+  const targetKeys = searchSpace !== null ? Object.keys(searchSpace) : [];
+
+  if (!query || !targetKeys.length) {
+    return null;
+  }
+
+  const normalizedQuery = query.toLowerCase();
+  const matches = targetKeys
+    .filter(item => {
+      const searchItem = `${searchSpace[item]}`.toLowerCase();
+
+      return (
+        searchItem.indexOf(normalizedQuery) > -1 ||
+        normalizedQuery.indexOf(searchItem) > -1 ||
+        normalizedQuery === searchItem
+      );
+    })
+    .reduce((acc, prop) => {
+      const match = acc;
+      match[prop] = searchSpace[prop];
+
+      return acc;
+    }, {});
+
+  return Object.keys(matches).length ? matches : null;
+};
+
 /**
  * Checks if the given Label has a special syntax `::` in
  * it's title.
diff --git a/doc/api/epics.md b/doc/api/epics.md
index 3036b3c2364..87ae0c48199 100644
--- a/doc/api/epics.md
+++ b/doc/api/epics.md
@@ -65,6 +65,8 @@ Example response:
   "title": "Accusamus iste et ullam ratione voluptatem omnis debitis dolor est.",
   "description": "Molestias dolorem eos vitae expedita impedit necessitatibus quo voluptatum.",
   "state": "opened",
+  "web_edit_url": "http://localhost:3001/groups/test/-/epics/4",
+  "reference": "&4",
   "author": {
     "id": 10,
     "name": "Lu Mayer",
@@ -118,6 +120,8 @@ Example response:
   "title": "Ea cupiditate dolores ut vero consequatur quasi veniam voluptatem et non.",
   "description": "Molestias dolorem eos vitae expedita impedit necessitatibus quo voluptatum.",
   "state": "opened",
+  "web_edit_url": "http://localhost:3001/groups/test/-/epics/5",
+  "reference": "&5",
   "author":{
     "id": 7,
     "name": "Pamella Huel",
@@ -182,6 +186,8 @@ Example response:
   "title": "Epic",
   "description": "Epic description",
   "state": "opened",
+  "web_edit_url": "http://localhost:3001/groups/test/-/epics/6",
+  "reference": "&6",
   "author": {
     "name" : "Alexandra Bashirian",
     "avatar_url" : null,
@@ -247,6 +253,8 @@ Example response:
   "title": "New Title",
   "description": "Epic description",
   "state": "opened",
+  "web_edit_url": "http://localhost:3001/groups/test/-/epics/6",
+  "reference": "&6",
   "author": {
     "name" : "Alexandra Bashirian",
     "avatar_url" : null,
diff --git a/spec/javascripts/lib/utils/common_utils_spec.js b/spec/javascripts/lib/utils/common_utils_spec.js
index 296ee85089f..85949f2ae86 100644
--- a/spec/javascripts/lib/utils/common_utils_spec.js
+++ b/spec/javascripts/lib/utils/common_utils_spec.js
@@ -895,6 +895,45 @@ describe('common_utils', () => {
     });
   });
 
+  describe('searchBy', () => {
+    const searchSpace = {
+      iid: 1,
+      reference: '&1',
+      title: 'Error omnis quos consequatur ullam a vitae sed omnis libero cupiditate.',
+      url: '/groups/gitlab-org/-/epics/1',
+    };
+
+    it('returns null when `query` or `searchSpace` params are empty/undefined', () => {
+      expect(commonUtils.searchBy('omnis', null)).toBeNull();
+      expect(commonUtils.searchBy('', searchSpace)).toBeNull();
+      expect(commonUtils.searchBy()).toBeNull();
+    });
+
+    it('returns object with matching props based on `query` & `searchSpace` params', () => {
+      // String `omnis` is found only in `title` prop so return just that
+      expect(commonUtils.searchBy('omnis', searchSpace)).toEqual(
+        jasmine.objectContaining({
+          title: searchSpace.title,
+        }),
+      );
+
+      // String `1` is found in both `iid` and `reference` props so return both
+      expect(commonUtils.searchBy('1', searchSpace)).toEqual(
+        jasmine.objectContaining({
+          iid: searchSpace.iid,
+          reference: searchSpace.reference,
+        }),
+      );
+
+      // String `/epics/1` is found in `url` prop so return just that
+      expect(commonUtils.searchBy('/epics/1', searchSpace)).toEqual(
+        jasmine.objectContaining({
+          url: searchSpace.url,
+        }),
+      );
+    });
+  });
+
   describe('isScopedLabel', () => {
     it('returns true when `::` is present in title', () => {
       expect(commonUtils.isScopedLabel({ title: 'foo::bar' })).toBe(true);
-- 
cgit v1.2.1


From d86b77bf20474702631d5fd89177c54a9f928760 Mon Sep 17 00:00:00 2001
From: Krasimir Angelov <kangelov@gitlab.com>
Date: Tue, 20 Aug 2019 13:29:16 +0300
Subject: Extract logic who created deployment into Deployment#deployed_by

Prefer the deployable user over the deployment user.

Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/66037.
---
 app/models/deployment.rb                           |  8 +++++++
 app/serializers/deployment_entity.rb               |  2 +-
 .../projects/deployments/_deployment.html.haml     |  4 ++--
 changelogs/unreleased/66037-deployment-user.yml    |  5 +++++
 spec/models/deployment_spec.rb                     | 26 ++++++++++++++++++++++
 5 files changed, 42 insertions(+), 3 deletions(-)
 create mode 100644 changelogs/unreleased/66037-deployment-user.yml

diff --git a/app/models/deployment.rb b/app/models/deployment.rb
index 68586e7a1fd..bff5d348ca0 100644
--- a/app/models/deployment.rb
+++ b/app/models/deployment.rb
@@ -162,6 +162,14 @@ class Deployment < ApplicationRecord
     deployed_at&.to_time&.in_time_zone&.to_s(:medium)
   end
 
+  def deployed_by
+    # We use deployable's user if available because Ci::PlayBuildService
+    # does not update the deployment's user, just the one for the deployable.
+    # TODO: use deployment's user once https://gitlab.com/gitlab-org/gitlab-ce/issues/66442
+    # is completed.
+    deployable&.user || user
+  end
+
   private
 
   def ref_path
diff --git a/app/serializers/deployment_entity.rb b/app/serializers/deployment_entity.rb
index 6e91317eb20..7e91bcf18bc 100644
--- a/app/serializers/deployment_entity.rb
+++ b/app/serializers/deployment_entity.rb
@@ -21,7 +21,7 @@ class DeploymentEntity < Grape::Entity
   expose :finished_at
   expose :tag
   expose :last?
-  expose :user, using: UserEntity
+  expose :deployed_by, as: :user, using: UserEntity
 
   expose :deployable do |deployment, opts|
     deployment.deployable.yield_self do |deployable|
diff --git a/app/views/projects/deployments/_deployment.html.haml b/app/views/projects/deployments/_deployment.html.haml
index a11e23b6daa..752be02443c 100644
--- a/app/views/projects/deployments/_deployment.html.haml
+++ b/app/views/projects/deployments/_deployment.html.haml
@@ -15,10 +15,10 @@
           .flex-truncate-child
             = link_to [@project.namespace.becomes(Namespace), @project, deployment.deployable], class: 'build-link' do
               #{deployment.deployable.name} (##{deployment.deployable.id})
-        - if deployment.user
+        - if deployment.deployed_by
           %div
             by
-            = user_avatar(user: deployment.user, size: 20, css_class: "mr-0 float-none")
+            = user_avatar(user: deployment.deployed_by, size: 20, css_class: "mr-0 float-none")
 
   .table-section.section-15{ role: 'gridcell' }
     .table-mobile-header{ role: 'rowheader' }= _("Created")
diff --git a/changelogs/unreleased/66037-deployment-user.yml b/changelogs/unreleased/66037-deployment-user.yml
new file mode 100644
index 00000000000..8a61b8145af
--- /dev/null
+++ b/changelogs/unreleased/66037-deployment-user.yml
@@ -0,0 +1,5 @@
+---
+title: Return correct user for manual deployments
+merge_request: 32004
+author:
+type: fixed
diff --git a/spec/models/deployment_spec.rb b/spec/models/deployment_spec.rb
index d4e631f109b..51ed8e9421b 100644
--- a/spec/models/deployment_spec.rb
+++ b/spec/models/deployment_spec.rb
@@ -322,4 +322,30 @@ describe Deployment do
       end
     end
   end
+
+  describe '#deployed_by' do
+    it 'returns the deployment user if there is no deployable' do
+      deployment_user = create(:user)
+      deployment = create(:deployment, deployable: nil, user: deployment_user)
+
+      expect(deployment.deployed_by).to eq(deployment_user)
+    end
+
+    it 'returns the deployment user if the deployable have no user' do
+      deployment_user = create(:user)
+      build = create(:ci_build, user: nil)
+      deployment = create(:deployment, deployable: build, user: deployment_user)
+
+      expect(deployment.deployed_by).to eq(deployment_user)
+    end
+
+    it 'returns the deployable user if there is one' do
+      build_user = create(:user)
+      deployment_user = create(:user)
+      build = create(:ci_build, user: build_user)
+      deployment = create(:deployment, deployable: build, user: deployment_user)
+
+      expect(deployment.deployed_by).to eq(build_user)
+    end
+  end
 end
-- 
cgit v1.2.1


From 08d51490dd19147ebd9a998a221d3e7187c88a1e Mon Sep 17 00:00:00 2001
From: NeroBurner <pyro4hell@gmail.com>
Date: Thu, 22 Aug 2019 15:08:26 +0200
Subject: apps: remove the too big "Mirror a repository" header

fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/66445
---
 app/views/projects/mirrors/_mirror_repos.html.haml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/app/views/projects/mirrors/_mirror_repos.html.haml b/app/views/projects/mirrors/_mirror_repos.html.haml
index eb100e5cf47..6f8a93fbcf5 100644
--- a/app/views/projects/mirrors/_mirror_repos.html.haml
+++ b/app/views/projects/mirrors/_mirror_repos.html.haml
@@ -13,8 +13,6 @@
   .settings-content
     = form_for @project, url: project_mirror_path(@project), html: { class: 'gl-show-field-errors js-mirror-form', autocomplete: 'new-password', data: mirrors_form_data_attributes } do |f|
       .panel.panel-default
-        .panel-heading
-          %h3.panel-title= _('Mirror a repository')
         .panel-body
           %div= form_errors(@project)
 
-- 
cgit v1.2.1


From 3e2b45870ad7d6f356b58e0bdd8852b0ca39ff5a Mon Sep 17 00:00:00 2001
From: Alex Ives <alex@ives.mn>
Date: Thu, 26 Jul 2018 23:26:13 -0500
Subject: Issue #39099: Add links for latest pipelines

---
 app/controllers/projects/pipelines_controller.rb   | 33 +++++++++--
 app/views/projects/pipelines/_with_tabs.html.haml  |  2 +-
 .../unreleased/add_links_to_latest_pipelines.yml   |  5 ++
 config/routes/project.rb                           |  3 +
 doc/ci/pipelines.md                                |  4 ++
 .../projects/pipelines_controller_spec.rb          | 65 ++++++++++++++++++++++
 6 files changed, 106 insertions(+), 6 deletions(-)
 create mode 100644 changelogs/unreleased/add_links_to_latest_pipelines.yml

diff --git a/app/controllers/projects/pipelines_controller.rb b/app/controllers/projects/pipelines_controller.rb
index db3b7c8b177..e6e3a440925 100644
--- a/app/controllers/projects/pipelines_controller.rb
+++ b/app/controllers/projects/pipelines_controller.rb
@@ -3,6 +3,7 @@
 class Projects::PipelinesController < Projects::ApplicationController
   before_action :whitelist_query_limiting, only: [:create, :retry]
   before_action :pipeline, except: [:index, :new, :create, :charts]
+  before_action :set_pipeline_path, only: [:show]
   before_action :authorize_read_pipeline!
   before_action :authorize_read_build!, only: [:index]
   before_action :authorize_create_pipeline!, only: [:new, :create]
@@ -174,14 +175,36 @@ class Projects::PipelinesController < Projects::ApplicationController
 
   # rubocop: disable CodeReuse/ActiveRecord
   def pipeline
-    @pipeline ||= project
-                    .all_pipelines
-                    .includes(user: :status)
-                    .find_by!(id: params[:id])
-                    .present(current_user: current_user)
+    @pipeline ||= if params[:id].blank? && params[:latest]
+                    latest_pipeline
+                  else
+                    project
+                      .all_pipelines
+                      .includes(user: :status)
+                      .find_by!(id: params[:id])
+                      .present(current_user: current_user)
+                  end
   end
   # rubocop: enable CodeReuse/ActiveRecord
 
+  def set_pipeline_path
+    @pipeline_path ||= if params[:id].blank? && params[:latest]
+                         latest_project_pipelines_path(@project, params['ref'])
+                       else
+                         project_pipeline_path(@project, @pipeline)
+                       end
+  end
+
+  def latest_pipeline
+    ref = params['ref'].presence || @project.default_branch
+    sha = @project.commit(ref)&.sha
+
+    @project.ci_pipelines
+            .newest_first(ref: ref, sha: sha)
+            .first
+            &.present(current_user: current_user)
+  end
+
   def whitelist_query_limiting
     # Also see https://gitlab.com/gitlab-org/gitlab-ce/issues/42343
     Gitlab::QueryLimiting.whitelist('https://gitlab.com/gitlab-org/gitlab-ce/issues/42339')
diff --git a/app/views/projects/pipelines/_with_tabs.html.haml b/app/views/projects/pipelines/_with_tabs.html.haml
index c04f076a3ab..56995ffbcee 100644
--- a/app/views/projects/pipelines/_with_tabs.html.haml
+++ b/app/views/projects/pipelines/_with_tabs.html.haml
@@ -1,7 +1,7 @@
 .tabs-holder
   %ul.pipelines-tabs.nav-links.no-top.no-bottom.mobile-separator.nav.nav-tabs
     %li.js-pipeline-tab-link
-      = link_to project_pipeline_path(@project, @pipeline), data: { target: '#js-tab-pipeline', action: 'pipelines', toggle: 'tab' }, class: 'pipeline-tab' do
+      = link_to @pipeline_path, data: { target: '#js-tab-pipeline', action: 'pipelines', toggle: 'tab' }, class: 'pipeline-tab' do
         = _('Pipeline')
     %li.js-builds-tab-link
       = link_to builds_project_pipeline_path(@project, @pipeline), data: { target: '#js-tab-builds', action: 'builds', toggle: 'tab' }, class: 'builds-tab' do
diff --git a/changelogs/unreleased/add_links_to_latest_pipelines.yml b/changelogs/unreleased/add_links_to_latest_pipelines.yml
new file mode 100644
index 00000000000..333cd6c92b4
--- /dev/null
+++ b/changelogs/unreleased/add_links_to_latest_pipelines.yml
@@ -0,0 +1,5 @@
+---
+title: 'Add links for latest pipelines'
+merge_request: 20865
+author: Alex Ives
+type: added
diff --git a/config/routes/project.rb b/config/routes/project.rb
index 9a453d101a1..29e462f904d 100644
--- a/config/routes/project.rb
+++ b/config/routes/project.rb
@@ -359,6 +359,9 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
         collection do
           resource :pipelines_settings, path: 'settings', only: [:show, :update]
           get :charts
+          scope '(*ref)', constraints: { ref: Gitlab::PathRegex.git_reference_regex } do
+            get :latest, action: :show, defaults: { latest: true }
+          end
         end
 
         member do
diff --git a/doc/ci/pipelines.md b/doc/ci/pipelines.md
index ed8d0e3bc35..eaa6efc526d 100644
--- a/doc/ci/pipelines.md
+++ b/doc/ci/pipelines.md
@@ -377,6 +377,10 @@ This functionality is only available:
 - For users with at least Developer access.
 - If the the stage contains [manual actions](#manual-actions-from-pipeline-graphs).
 
+## Most Recent Pipeline
+
+There's a link to the latest pipeline for the last commit of a given branch at `/project/pipelines/[branch]/latest`. Also, `/project/pipelines/latest` will redirect you to the latest pipeline for the last commit on the project's default branch.
+
 ## Security on protected branches
 
 A strict security model is enforced when pipelines are executed on
diff --git a/spec/controllers/projects/pipelines_controller_spec.rb b/spec/controllers/projects/pipelines_controller_spec.rb
index 089d06e11eb..212d8b15252 100644
--- a/spec/controllers/projects/pipelines_controller_spec.rb
+++ b/spec/controllers/projects/pipelines_controller_spec.rb
@@ -397,4 +397,69 @@ describe Projects::PipelinesController do
       end
     end
   end
+
+  describe 'GET latest' do
+    let(:branch_main) { project.repository.branches[0] }
+    let(:branch_secondary) { project.repository.branches[1] }
+
+    let!(:pipeline_master) do
+      create(:ci_pipeline,
+             ref: branch_main.name,
+             sha: branch_main.target,
+             project: project)
+    end
+
+    let!(:pipeline_secondary) do
+      create(:ci_pipeline,
+             ref: branch_secondary.name,
+             sha: branch_secondary.target,
+             project: project)
+    end
+
+    before do
+      project.change_head(branch_main.name)
+      project.reload_default_branch
+    end
+
+    context 'no ref provided' do
+      it 'shows latest pipeline for the default project branch' do
+        get :show, params: { namespace_id: project.namespace, project_id: project, latest: true, ref: nil }
+
+        expect(response).to have_gitlab_http_status(200)
+        expect(assigns(:pipeline)).to have_attributes(id: pipeline_master.id)
+      end
+    end
+
+    context 'ref provided' do
+      before do
+        create(:ci_pipeline, ref: 'master', project: project)
+      end
+
+      it 'shows the latest pipeline for the provided ref' do
+        get :show, params: { namespace_id: project.namespace, project_id: project, latest: true, ref: branch_secondary.name }
+
+        expect(response).to have_gitlab_http_status(200)
+        expect(assigns(:pipeline)).to have_attributes(id: pipeline_secondary.id)
+      end
+
+      context 'newer pipeline exists for older sha' do
+        before do
+          create(:ci_pipeline, ref: branch_secondary.name, sha: project.commit(branch_secondary.name).parent, project: project)
+        end
+
+        it 'shows the provided ref with the last sha/pipeline combo' do
+          get :show, params: { namespace_id: project.namespace, project_id: project, latest: true, ref: branch_secondary.name }
+
+          expect(response).to have_gitlab_http_status(200)
+          expect(assigns(:pipeline)).to have_attributes(id: pipeline_secondary.id)
+        end
+      end
+    end
+
+    it 'renders a 404 if no pipeline is found for the ref' do
+      get :show, params: { namespace_id: project.namespace, project_id: project, ref: 'no-branch' }
+
+      expect(response).to have_gitlab_http_status(404)
+    end
+  end
 end
-- 
cgit v1.2.1


From 6a385b60f849d0ce086947771fb34a4bc66abe11 Mon Sep 17 00:00:00 2001
From: Igor <idrozdov@gitlab.com>
Date: Thu, 22 Aug 2019 13:50:19 +0000
Subject: Remove mergeTrain from FE since it's used only in EE

---
 .../stores/mr_widget_store.js                      |  3 --
 app/serializers/merge_request_widget_entity.rb     |  4 ++-
 .../vue_mr_widget/stores/mr_widget_store_spec.js   | 42 ----------------------
 3 files changed, 3 insertions(+), 46 deletions(-)

diff --git a/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js b/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
index 0f55bebd3fc..7843409f4a7 100644
--- a/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
+++ b/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
@@ -87,9 +87,6 @@ export default class MergeRequestStore {
     this.allowCollaboration = data.allow_collaboration;
     this.sourceProjectId = data.source_project_id;
     this.targetProjectId = data.target_project_id;
-    this.mergePipelinesEnabled = Boolean(data.merge_pipelines_enabled);
-    this.mergeTrainsCount = data.merge_trains_count || 0;
-    this.mergeTrainIndex = data.merge_train_index;
 
     // CI related
     this.hasCI = data.has_ci;
diff --git a/app/serializers/merge_request_widget_entity.rb b/app/serializers/merge_request_widget_entity.rb
index 554b307d4f8..c8088608cb0 100644
--- a/app/serializers/merge_request_widget_entity.rb
+++ b/app/serializers/merge_request_widget_entity.rb
@@ -84,8 +84,10 @@ class MergeRequestWidgetEntity < Grape::Entity
 
   private
 
+  delegate :current_user, to: :request
+
   def presenter(merge_request)
     @presenters ||= {}
-    @presenters[merge_request] ||= MergeRequestPresenter.new(merge_request, current_user: request.current_user) # rubocop: disable CodeReuse/Presenter
+    @presenters[merge_request] ||= MergeRequestPresenter.new(merge_request, current_user: current_user) # rubocop: disable CodeReuse/Presenter
   end
 end
diff --git a/spec/javascripts/vue_mr_widget/stores/mr_widget_store_spec.js b/spec/javascripts/vue_mr_widget/stores/mr_widget_store_spec.js
index e27a506f426..e2cd0f084fd 100644
--- a/spec/javascripts/vue_mr_widget/stores/mr_widget_store_spec.js
+++ b/spec/javascripts/vue_mr_widget/stores/mr_widget_store_spec.js
@@ -82,47 +82,5 @@ describe('MergeRequestStore', () => {
         expect(store.isNothingToMergeState).toEqual(false);
       });
     });
-
-    describe('mergePipelinesEnabled', () => {
-      it('should set mergePipelinesEnabled = true when merge_pipelines_enabled is true', () => {
-        store.setData({ ...mockData, merge_pipelines_enabled: true });
-
-        expect(store.mergePipelinesEnabled).toBe(true);
-      });
-
-      it('should set mergePipelinesEnabled = false when merge_pipelines_enabled is not provided', () => {
-        store.setData({ ...mockData, merge_pipelines_enabled: undefined });
-
-        expect(store.mergePipelinesEnabled).toBe(false);
-      });
-    });
-
-    describe('mergeTrainsCount', () => {
-      it('should set mergeTrainsCount when merge_trains_count is provided', () => {
-        store.setData({ ...mockData, merge_trains_count: 3 });
-
-        expect(store.mergeTrainsCount).toBe(3);
-      });
-
-      it('should set mergeTrainsCount = 0 when merge_trains_count is not provided', () => {
-        store.setData({ ...mockData, merge_trains_count: undefined });
-
-        expect(store.mergeTrainsCount).toBe(0);
-      });
-    });
-
-    describe('mergeTrainIndex', () => {
-      it('should set mergeTrainIndex when merge_train_index is provided', () => {
-        store.setData({ ...mockData, merge_train_index: 3 });
-
-        expect(store.mergeTrainIndex).toBe(3);
-      });
-
-      it('should not set mergeTrainIndex when merge_train_index is not provided', () => {
-        store.setData({ ...mockData, merge_train_index: undefined });
-
-        expect(store.mergeTrainIndex).toBeUndefined();
-      });
-    });
   });
 });
-- 
cgit v1.2.1


From 47c3abdfd0495a631e2f3f0ec850c6ed634b7fd7 Mon Sep 17 00:00:00 2001
From: J0WI <sjw@gmx.ch>
Date: Thu, 22 Aug 2019 14:18:10 +0000
Subject: Fix typo in Content Security Policy example

---
 config/gitlab.yml.example | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
index 2f6658594cc..efddbfcbb57 100644
--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
@@ -61,7 +61,7 @@ production: &base
         form_action:
         frame_ancestors: "'self'"
         frame_src: "'self' https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://content.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://content-cloudresourcemanager.googleapis.com"
-        img_src: "* data: blob"
+        img_src: "* data: blob:"
         manifest_src:
         media_src:
         object_src: "'self' http://localhost:3808 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.gstatic.com/recaptcha/ https://apis.google.com"
-- 
cgit v1.2.1


From 8ad3691b59dacc70f1c838fa08b4a3ce06c9ee39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Wed, 21 Aug 2019 19:26:46 +0200
Subject: Make it clear that it's ok to ignore Danger's 'no changelog' warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 danger/changelog/Dangerfile | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/danger/changelog/Dangerfile b/danger/changelog/Dangerfile
index 63b2f6f5c5c..2d1ca64a9e8 100644
--- a/danger/changelog/Dangerfile
+++ b/danger/changelog/Dangerfile
@@ -1,19 +1,18 @@
+# frozen_string_literal: true
 # rubocop:disable Style/SignalException
 
 require 'yaml'
 
-NO_CHANGELOG_LABELS = %w[backstage ci-build Documentation meta QA test].freeze
-SEE_DOC = "See [the documentation](https://docs.gitlab.com/ce/development/changelog.html).".freeze
-CREATE_CHANGELOG_MESSAGE = <<~MSG.freeze
+NO_CHANGELOG_LABELS = %w[backstage ci-build meta].freeze
+SEE_DOC = "See [the documentation](https://docs.gitlab.com/ce/development/changelog.html)."
+CREATE_CHANGELOG_MESSAGE = <<~MSG
 You can create one with:
 
 ```
 bin/changelog -m %<mr_iid>s "%<mr_title>s"
 ```
 
-If your merge request doesn't warrant a CHANGELOG entry,
-consider adding any of the %<labels>s labels.
-#{SEE_DOC}
+Note: Merge requests with %<labels>s do not trigger this check.
 MSG
 
 def ee_changelog?(changelog_path)
@@ -60,7 +59,7 @@ if changelog_needed
   if changelog_found
     check_changelog(changelog_found)
   else
-    warn "**[CHANGELOG missing](https://docs.gitlab.com/ce/development/changelog.html).**\n\n" +
+    message "**[CHANGELOG missing](https://docs.gitlab.com/ce/development/changelog.html)**: If this merge request [doesn't need a CHANGELOG entry](https://docs.gitlab.com/ee/development/changelog.html#what-warrants-a-changelog-entry), feel free to ignore this message.\n\n" +
       format(CREATE_CHANGELOG_MESSAGE, mr_iid: gitlab.mr_json["iid"], mr_title: mr_title, labels: presented_no_changelog_labels)
   end
 end
-- 
cgit v1.2.1


From a47db86e909ec237332b6836dd830d1a0d54fd39 Mon Sep 17 00:00:00 2001
From: Balakumar <sribalakumar@gmail.com>
Date: Thu, 22 Aug 2019 14:31:57 +0000
Subject: Log time spent on CPU to sidekiq.log

---
 lib/gitlab/sidekiq_logging/structured_logger.rb    | 46 +++++++++++++++++-----
 .../sidekiq_logging/structured_logger_spec.rb      | 37 ++++++++++++++++-
 2 files changed, 72 insertions(+), 11 deletions(-)

diff --git a/lib/gitlab/sidekiq_logging/structured_logger.rb b/lib/gitlab/sidekiq_logging/structured_logger.rb
index 60782306ade..48b1524f9c7 100644
--- a/lib/gitlab/sidekiq_logging/structured_logger.rb
+++ b/lib/gitlab/sidekiq_logging/structured_logger.rb
@@ -8,16 +8,16 @@ module Gitlab
       MAXIMUM_JOB_ARGUMENTS_LENGTH = 10.kilobytes
 
       def call(job, queue)
-        started_at = current_time
+        started_time = get_time
         base_payload = parse_job(job)
 
-        Sidekiq.logger.info log_job_start(started_at, base_payload)
+        Sidekiq.logger.info log_job_start(base_payload)
 
         yield
 
-        Sidekiq.logger.info log_job_done(job, started_at, base_payload)
+        Sidekiq.logger.info log_job_done(job, started_time, base_payload)
       rescue => job_exception
-        Sidekiq.logger.warn log_job_done(job, started_at, base_payload, job_exception)
+        Sidekiq.logger.warn log_job_done(job, started_time, base_payload, job_exception)
 
         raise
       end
@@ -32,7 +32,7 @@ module Gitlab
         output_payload.merge!(job.slice(*::Gitlab::InstrumentationHelper::KEYS))
       end
 
-      def log_job_start(started_at, payload)
+      def log_job_start(payload)
         payload['message'] = "#{base_message(payload)}: start"
         payload['job_status'] = 'start'
 
@@ -45,11 +45,12 @@ module Gitlab
         payload
       end
 
-      def log_job_done(job, started_at, payload, job_exception = nil)
+      def log_job_done(job, started_time, payload, job_exception = nil)
         payload = payload.dup
         add_instrumentation_keys!(job, payload)
-        payload['duration'] = elapsed(started_at)
-        payload['completed_at'] = Time.now.utc
+
+        elapsed_time = elapsed(started_time)
+        add_time_keys!(elapsed_time, payload)
 
         message = base_message(payload)
 
@@ -69,6 +70,14 @@ module Gitlab
         payload
       end
 
+      def add_time_keys!(time, payload)
+        payload['duration'] = time[:duration].round(3)
+        payload['system_s'] = time[:stime].round(3)
+        payload['user_s'] = time[:utime].round(3)
+        payload['child_s'] = time[:ctime].round(3) if time[:ctime] > 0
+        payload['completed_at'] = Time.now.utc
+      end
+
       def parse_job(job)
         job = job.dup
 
@@ -93,8 +102,25 @@ module Gitlab
         (Time.now.utc - start).to_f.round(3)
       end
 
-      def elapsed(start)
-        (current_time - start).round(3)
+      def elapsed(t0)
+        t1 = get_time
+        {
+          duration: t1[:now] - t0[:now],
+          stime: t1[:times][:stime] - t0[:times][:stime],
+          utime: t1[:times][:utime] - t0[:times][:utime],
+          ctime: ctime(t1[:times]) - ctime(t0[:times])
+        }
+      end
+
+      def get_time
+        {
+          now: current_time,
+          times: Process.times
+        }
+      end
+
+      def ctime(times)
+        times[:cstime] + times[:cutime]
       end
 
       def current_time
diff --git a/spec/lib/gitlab/sidekiq_logging/structured_logger_spec.rb b/spec/lib/gitlab/sidekiq_logging/structured_logger_spec.rb
index 5621d3d17d1..c09db4af8d8 100644
--- a/spec/lib/gitlab/sidekiq_logging/structured_logger_spec.rb
+++ b/spec/lib/gitlab/sidekiq_logging/structured_logger_spec.rb
@@ -36,7 +36,9 @@ describe Gitlab::SidekiqLogging::StructuredLogger do
         'message' => 'TestWorker JID-da883554ee4fe414012f5f42: done: 0.0 sec',
         'job_status' => 'done',
         'duration' => 0.0,
-        "completed_at" => timestamp.iso8601(3)
+        "completed_at" => timestamp.iso8601(3),
+        "system_s" => 0.0,
+        "user_s" => 0.0
       )
     end
     let(:exception_payload) do
@@ -52,6 +54,13 @@ describe Gitlab::SidekiqLogging::StructuredLogger do
       allow(Sidekiq).to receive(:logger).and_return(logger)
 
       allow(subject).to receive(:current_time).and_return(timestamp.to_f)
+
+      allow(Process).to receive(:times).and_return(
+        stime:  0.0,
+        utime:  0.0,
+        cutime: 0.0,
+        cstime: 0.0
+      )
     end
 
     subject { described_class.new }
@@ -177,5 +186,31 @@ describe Gitlab::SidekiqLogging::StructuredLogger do
         end
       end
     end
+
+    def ctime(times)
+      times[:cstime] + times[:cutime]
+    end
+
+    context 'with ctime value greater than 0' do
+      let(:times_start) { { stime: 0.04999, utime: 0.0483, cstime: 0.0188, cutime: 0.0188 } }
+      let(:times_end)   { { stime: 0.0699, utime: 0.0699, cstime: 0.0399, cutime: 0.0399 } }
+
+      before do
+        end_payload['system_s'] = 0.02
+        end_payload['user_s'] = 0.022
+        end_payload['child_s'] = 0.042
+
+        allow(Process).to receive(:times).and_return(times_start, times_end)
+      end
+
+      it 'logs with ctime data and other cpu data' do
+        Timecop.freeze(timestamp) do
+          expect(logger).to receive(:info).with(start_payload.except('args')).ordered
+          expect(logger).to receive(:info).with(end_payload.except('args')).ordered
+
+          subject.call(job, 'test_queue') { }
+        end
+      end
+    end
   end
 end
-- 
cgit v1.2.1


From 30f302d2beb78af896213850c570792ce3d88b97 Mon Sep 17 00:00:00 2001
From: Robert Schilling <rschilling@student.tugraz.at>
Date: Thu, 22 Aug 2019 15:50:50 +0200
Subject: Don't check external authorization when disabling the service

---
 app/services/application_settings/update_service.rb                  | 3 ++-
 ...443-unrecoverable-configuration-loop-in-external-auth-control.yml | 5 +++++
 2 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/66443-unrecoverable-configuration-loop-in-external-auth-control.yml

diff --git a/app/services/application_settings/update_service.rb b/app/services/application_settings/update_service.rb
index 471df6e2d0c..13718734844 100644
--- a/app/services/application_settings/update_service.rb
+++ b/app/services/application_settings/update_service.rb
@@ -7,7 +7,8 @@ module ApplicationSettings
     attr_reader :params, :application_setting
 
     def execute
-      validate_classification_label(application_setting, :external_authorization_service_default_label)
+      disable_ext_auth = params[:external_authorization_service_enabled].present? && !Gitlab::Utils.to_boolean(params[:external_authorization_service_enabled])
+      validate_classification_label(application_setting, :external_authorization_service_default_label) unless disable_ext_auth
 
       if application_setting.errors.any?
         return false
diff --git a/changelogs/unreleased/66443-unrecoverable-configuration-loop-in-external-auth-control.yml b/changelogs/unreleased/66443-unrecoverable-configuration-loop-in-external-auth-control.yml
new file mode 100644
index 00000000000..ab52e3e5a2c
--- /dev/null
+++ b/changelogs/unreleased/66443-unrecoverable-configuration-loop-in-external-auth-control.yml
@@ -0,0 +1,5 @@
+---
+title: Don't check external authorization when disabling the service
+merge_request: 32102
+author: Robert Schilling
+type: fixed
-- 
cgit v1.2.1


From e059b90480671d1577147b47734fa1c4c783cbf3 Mon Sep 17 00:00:00 2001
From: Achilleas Pipinellis <axil@gitlab.com>
Date: Thu, 22 Aug 2019 14:45:53 +0000
Subject: Make it clear that the artifacts count as uncompressed

---
 doc/user/gitlab_com/index.md | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/doc/user/gitlab_com/index.md b/doc/user/gitlab_com/index.md
index d21a325d401..af37cc896ad 100644
--- a/doc/user/gitlab_com/index.md
+++ b/doc/user/gitlab_com/index.md
@@ -43,13 +43,15 @@ Host gitlab.com
 
 Below are the settings for [GitLab Pages].
 
-| Setting                 | GitLab.com        | Default       |
-| ----------------------- | ----------------  | ------------- |
-| Domain name             | `gitlab.io`       | -             |
-| IP address              | `35.185.44.232`   | -             |
-| Custom domains support  | yes               | no            |
-| TLS certificates support| yes               | no            |
+| Setting                     | GitLab.com        | Default       |
+| --------------------------- | ----------------  | ------------- |
+| Domain name                 | `gitlab.io`       | -             |
+| IP address                  | `35.185.44.232`   | -             |
+| Custom domains support      | yes               | no            |
+| TLS certificates support    | yes               | no            |
+| Maximum size (uncompressed) | 1G                | 100M          |
 
+NOTE: **Note:**
 The maximum size of your Pages site is regulated by the artifacts maximum size
 which is part of [GitLab CI/CD](#gitlab-cicd).
 
@@ -59,7 +61,7 @@ Below are the current settings regarding [GitLab CI/CD](../../ci/README.md).
 
 | Setting                 | GitLab.com        | Default       |
 | -----------             | ----------------- | ------------- |
-| Artifacts maximum size  | 1G                | 100M          |
+| Artifacts maximum size (uncompressed) | 1G                | 100M          |
 | Artifacts [expiry time](../../ci/yaml/README.md#artifactsexpire_in)   | kept forever           | deleted after 30 days unless otherwise specified    |
 
 ## Repository size limit
-- 
cgit v1.2.1


From 3d405831be700c9b0d198d08fb6ade2ad6fd24ae Mon Sep 17 00:00:00 2001
From: Harish Ramachandran <harish@gitlab.com>
Date: Thu, 22 Aug 2019 15:09:10 +0000
Subject: Add missing content from debug's kubectl cheat sheet

---
 .../troubleshooting/kubernetes_cheat_sheet.md        | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/doc/administration/troubleshooting/kubernetes_cheat_sheet.md b/doc/administration/troubleshooting/kubernetes_cheat_sheet.md
index 238c522a0ee..260af333e8e 100644
--- a/doc/administration/troubleshooting/kubernetes_cheat_sheet.md
+++ b/doc/administration/troubleshooting/kubernetes_cheat_sheet.md
@@ -83,12 +83,22 @@ and they will assist you with any issues you are having.
   kubectl logs gitlab-unicorn-7656fdd6bf-jqzfs -c unicorn
   ```
 
-- It is not possible to get all the logs via Kubectl at once, like with `gitlab-ctl tail`,
-  but a number of third-party tools can be used to do it:
+- Tail and follow all pods that share a label (in this case, `unicorn`):
 
-  - [Kubetail](https://github.com/johanhaleby/kubetail)
-  - [kail: kubernetes tail](https://github.com/boz/kail)
-  - [stern](https://github.com/wercker/stern)
+  ```bash
+  # all containers in the unicorn pods
+  kubectl logs -f -l app=unicorn --all-containers=true --max-log-requests=50
+
+  # only the unicorn containers in all unicorn pods
+  kubectl logs -f -l app=unicorn -c unicorn --max-log-requests=50
+  ```
+
+- One can stream logs from all containers at once, similar to the Omnibus
+  command `gitlab-ctl tail`:
+
+  ```bash
+  kubectl logs -f -l release=gitlab --all-containers=true --max-log-requests=100
+  ```
 
 - Check all events in the `gitlab` namespace (the namespace name can be different if you
   specified a different one when deploying the helm chart):
-- 
cgit v1.2.1


From e00b07b978a9fb4f368f69aab99cfd105ab5b6b3 Mon Sep 17 00:00:00 2001
From: James Edwards-Jones <jedwardsjones@gitlab.com>
Date: Sat, 20 Jul 2019 14:30:26 +0100
Subject: JwtController avoids activating session checks

This used without a session and issues a sessionless token, so we
should avoid causing access checks based on the session.
---
 app/controllers/jwt_controller.rb    | 1 +
 spec/requests/jwt_controller_spec.rb | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/app/controllers/jwt_controller.rb b/app/controllers/jwt_controller.rb
index 5ecf4f114cf..da39d64c93d 100644
--- a/app/controllers/jwt_controller.rb
+++ b/app/controllers/jwt_controller.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 class JwtController < ApplicationController
+  skip_around_action :set_session_storage
   skip_before_action :authenticate_user!
   skip_before_action :verify_authenticity_token
   before_action :authenticate_project_or_user
diff --git a/spec/requests/jwt_controller_spec.rb b/spec/requests/jwt_controller_spec.rb
index bba473f1c20..8b2c698fee1 100644
--- a/spec/requests/jwt_controller_spec.rb
+++ b/spec/requests/jwt_controller_spec.rb
@@ -108,6 +108,14 @@ describe JwtController do
           end
         end
       end
+
+      it 'does not cause session based checks to be activated' do
+        expect(Gitlab::Session).not_to receive(:with_session)
+
+        get '/jwt/auth', params: parameters, headers: headers
+
+        expect(response).to have_gitlab_http_status(200)
+      end
     end
 
     context 'using invalid login' do
-- 
cgit v1.2.1


From d29ea1fa13c730abfb9ee1f88ec703e29b234970 Mon Sep 17 00:00:00 2001
From: drew cimino <dcimino@gitlab.com>
Date: Tue, 13 Aug 2019 19:03:05 -0400
Subject: admin_group authorization for Groups::RunnersController

- Use authorize_admin_group! instead of authorize_admin_pipeline!
- Added role-based permission specs for Groups::RunnersController
---
 app/controllers/groups/runners_controller.rb       |   6 +-
 .../security-group-runners-permissions.yml         |   5 +
 spec/controllers/groups/runners_controller_spec.rb | 205 +++++++++++++++++----
 3 files changed, 173 insertions(+), 43 deletions(-)
 create mode 100644 changelogs/unreleased/security-group-runners-permissions.yml

diff --git a/app/controllers/groups/runners_controller.rb b/app/controllers/groups/runners_controller.rb
index f8e32451b02..af2b2cbd1fd 100644
--- a/app/controllers/groups/runners_controller.rb
+++ b/app/controllers/groups/runners_controller.rb
@@ -3,7 +3,7 @@
 class Groups::RunnersController < Groups::ApplicationController
   # Proper policies should be implemented per
   # https://gitlab.com/gitlab-org/gitlab-ce/issues/45894
-  before_action :authorize_admin_pipeline!
+  before_action :authorize_admin_group!
 
   before_action :runner, only: [:edit, :update, :destroy, :pause, :resume, :show]
 
@@ -50,10 +50,6 @@ class Groups::RunnersController < Groups::ApplicationController
     @runner ||= @group.runners.find(params[:id])
   end
 
-  def authorize_admin_pipeline!
-    return render_404 unless can?(current_user, :admin_pipeline, group)
-  end
-
   def runner_params
     params.require(:runner).permit(Ci::Runner::FORM_EDITABLE)
   end
diff --git a/changelogs/unreleased/security-group-runners-permissions.yml b/changelogs/unreleased/security-group-runners-permissions.yml
new file mode 100644
index 00000000000..6c74be30b6d
--- /dev/null
+++ b/changelogs/unreleased/security-group-runners-permissions.yml
@@ -0,0 +1,5 @@
+---
+title: Use admin_group authorization in Groups::RunnersController
+merge_request:
+author:
+type: security
diff --git a/spec/controllers/groups/runners_controller_spec.rb b/spec/controllers/groups/runners_controller_spec.rb
index 91f9e2c7832..14b0cf959b3 100644
--- a/spec/controllers/groups/runners_controller_spec.rb
+++ b/spec/controllers/groups/runners_controller_spec.rb
@@ -3,73 +3,202 @@
 require 'spec_helper'
 
 describe Groups::RunnersController do
-  let(:user) { create(:user) }
-  let(:group) { create(:group) }
+  let(:user)   { create(:user) }
+  let(:group)  { create(:group) }
   let(:runner) { create(:ci_runner, :group, groups: [group]) }
-
-  let(:params) do
-    {
-      group_id: group,
-      id: runner
-    }
-  end
+  let(:params) { { group_id: group, id: runner } }
 
   before do
     sign_in(user)
-    group.add_maintainer(user)
+  end
+
+  describe '#show' do
+    context 'when user is owner' do
+      before do
+        group.add_owner(user)
+      end
+
+      it 'renders show with 200 status code' do
+        get :show, params: { group_id: group, id: runner }
+
+        expect(response).to have_gitlab_http_status(200)
+        expect(response).to render_template(:show)
+      end
+    end
+
+    context 'when user is not owner' do
+      before do
+        group.add_maintainer(user)
+      end
+
+      it 'renders a 404' do
+        get :show, params: { group_id: group, id: runner }
+
+        expect(response).to have_gitlab_http_status(404)
+      end
+    end
+  end
+
+  describe '#edit' do
+    context 'when user is owner' do
+      before do
+        group.add_owner(user)
+      end
+
+      it 'renders show with 200 status code' do
+        get :edit, params: { group_id: group, id: runner }
+
+        expect(response).to have_gitlab_http_status(200)
+        expect(response).to render_template(:edit)
+      end
+    end
+
+    context 'when user is not owner' do
+      before do
+        group.add_maintainer(user)
+      end
+
+      it 'renders a 404' do
+        get :edit, params: { group_id: group, id: runner }
+
+        expect(response).to have_gitlab_http_status(404)
+      end
+    end
   end
 
   describe '#update' do
-    it 'updates the runner and ticks the queue' do
-      new_desc = runner.description.swapcase
+    context 'when user is an owner' do
+      before do
+        group.add_owner(user)
+      end
 
-      expect do
-        post :update, params: params.merge(runner: { description: new_desc } )
-      end.to change { runner.ensure_runner_queue_value }
+      it 'updates the runner, ticks the queue, and redirects' do
+        new_desc = runner.description.swapcase
 
-      runner.reload
+        expect do
+          post :update, params: params.merge(runner: { description: new_desc } )
+        end.to change { runner.ensure_runner_queue_value }
 
-      expect(response).to have_gitlab_http_status(302)
-      expect(runner.description).to eq(new_desc)
+        expect(response).to have_gitlab_http_status(302)
+        expect(runner.reload.description).to eq(new_desc)
+      end
+    end
+
+    context 'when user is not an owner' do
+      before do
+        group.add_maintainer(user)
+      end
+
+      it 'rejects the update and responds 404' do
+        old_desc = runner.description
+
+        expect do
+          post :update, params: params.merge(runner: { description: old_desc.swapcase } )
+        end.not_to change { runner.ensure_runner_queue_value }
+
+        expect(response).to have_gitlab_http_status(404)
+        expect(runner.reload.description).to eq(old_desc)
+      end
     end
   end
 
   describe '#destroy' do
-    it 'destroys the runner' do
-      delete :destroy, params: params
+    context 'when user is an owner' do
+      before do
+        group.add_owner(user)
+      end
+
+      it 'destroys the runner and redirects' do
+        delete :destroy, params: params
+
+        expect(response).to have_gitlab_http_status(302)
+        expect(Ci::Runner.find_by(id: runner.id)).to be_nil
+      end
+    end
+
+    context 'when user is not an owner' do
+      before do
+        group.add_maintainer(user)
+      end
+
+      it 'responds 404 and does not destroy the runner' do
+        delete :destroy, params: params
 
-      expect(response).to have_gitlab_http_status(302)
-      expect(Ci::Runner.find_by(id: runner.id)).to be_nil
+        expect(response).to have_gitlab_http_status(404)
+        expect(Ci::Runner.find_by(id: runner.id)).to be_present
+      end
     end
   end
 
   describe '#resume' do
-    it 'marks the runner as active and ticks the queue' do
-      runner.update(active: false)
+    context 'when user is an owner' do
+      before do
+        group.add_owner(user)
+      end
 
-      expect do
-        post :resume, params: params
-      end.to change { runner.ensure_runner_queue_value }
+      it 'marks the runner as active, ticks the queue, and redirects' do
+        runner.update(active: false)
 
-      runner.reload
+        expect do
+          post :resume, params: params
+        end.to change { runner.ensure_runner_queue_value }
 
-      expect(response).to have_gitlab_http_status(302)
-      expect(runner.active).to eq(true)
+        expect(response).to have_gitlab_http_status(302)
+        expect(runner.reload.active).to eq(true)
+      end
+    end
+
+    context 'when user is not an owner' do
+      before do
+        group.add_maintainer(user)
+      end
+
+      it 'responds 404 and does not activate the runner' do
+        runner.update(active: false)
+
+        expect do
+          post :resume, params: params
+        end.not_to change { runner.ensure_runner_queue_value }
+
+        expect(response).to have_gitlab_http_status(404)
+        expect(runner.reload.active).to eq(false)
+      end
     end
   end
 
   describe '#pause' do
-    it 'marks the runner as inactive and ticks the queue' do
-      runner.update(active: true)
+    context 'when user is an owner' do
+      before do
+        group.add_owner(user)
+      end
+
+      it 'marks the runner as inactive, ticks the queue, and redirects' do
+        runner.update(active: true)
+
+        expect do
+          post :pause, params: params
+        end.to change { runner.ensure_runner_queue_value }
+
+        expect(response).to have_gitlab_http_status(302)
+        expect(runner.reload.active).to eq(false)
+      end
+    end
+
+    context 'when user is not an owner' do
+      before do
+        group.add_maintainer(user)
+      end
 
-      expect do
-        post :pause, params: params
-      end.to change { runner.ensure_runner_queue_value }
+      it 'responds 404 and does not update the runner or queue' do
+        runner.update(active: true)
 
-      runner.reload
+        expect do
+          post :pause, params: params
+        end.not_to change { runner.ensure_runner_queue_value }
 
-      expect(response).to have_gitlab_http_status(302)
-      expect(runner.active).to eq(false)
+        expect(response).to have_gitlab_http_status(404)
+        expect(runner.reload.active).to eq(true)
+      end
     end
   end
 end
-- 
cgit v1.2.1


From 2ed065885cbdc5ed5334f1adfbfe2b82895bd146 Mon Sep 17 00:00:00 2001
From: Christiaan Conover <cconover@gitlab.com>
Date: Wed, 21 Aug 2019 22:24:12 +0000
Subject: Fix a typo in the section on stretching

Correct a typo in the description of how passwords are stretched.
---
 doc/security/password_storage.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/security/password_storage.md b/doc/security/password_storage.md
index b5c021bf5de..f54e4022062 100644
--- a/doc/security/password_storage.md
+++ b/doc/security/password_storage.md
@@ -9,5 +9,5 @@ GitLab stores user passwords in a hashed format, to prevent passwords from being
 GitLab uses the [Devise](https://github.com/plataformatec/devise) authentication library, which handles the hashing of user passwords. Password hashes are created with the following attributes:
 
 - **Hashing**: the [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) hashing function is used to generate the hash of the provided password. This is a strong, industry-standard cryptographic hashing function.
-- **Stretching**: Password hashes are [stretched](https://en.wikipedia.org/wiki/Key_stretching) to harden against brute-force attacks. GitLab uses a streching factor of 10 by default.
-- **Salting**: A [cryptographic salt](https://en.wikipedia.org/wiki/Salt_(cryptography)) is added to each password to harden against pre-computed hash and dictionary attacks. Each salt is randomly generated for each password, so that no two passwords share a salt to further increase security.
\ No newline at end of file
+- **Stretching**: Password hashes are [stretched](https://en.wikipedia.org/wiki/Key_stretching) to harden against brute-force attacks. GitLab uses a stretching factor of 10 by default.
+- **Salting**: A [cryptographic salt](https://en.wikipedia.org/wiki/Salt_(cryptography)) is added to each password to harden against pre-computed hash and dictionary attacks. Each salt is randomly generated for each password, so that no two passwords share a salt to further increase security.
-- 
cgit v1.2.1


From a6d04d48697270b61b3a57e15a87c97c0fc6e355 Mon Sep 17 00:00:00 2001
From: Christiaan Conover <cconover@gitlab.com>
Date: Thu, 22 Aug 2019 12:07:19 -0400
Subject: Improve readability of salting description

Add a comma in the final sentence of the description of salting, to
improve the readability of what's being said.
---
 doc/security/password_storage.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/security/password_storage.md b/doc/security/password_storage.md
index f54e4022062..f4e32f96f7b 100644
--- a/doc/security/password_storage.md
+++ b/doc/security/password_storage.md
@@ -10,4 +10,4 @@ GitLab uses the [Devise](https://github.com/plataformatec/devise) authentication
 
 - **Hashing**: the [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) hashing function is used to generate the hash of the provided password. This is a strong, industry-standard cryptographic hashing function.
 - **Stretching**: Password hashes are [stretched](https://en.wikipedia.org/wiki/Key_stretching) to harden against brute-force attacks. GitLab uses a stretching factor of 10 by default.
-- **Salting**: A [cryptographic salt](https://en.wikipedia.org/wiki/Salt_(cryptography)) is added to each password to harden against pre-computed hash and dictionary attacks. Each salt is randomly generated for each password, so that no two passwords share a salt to further increase security.
+- **Salting**: A [cryptographic salt](https://en.wikipedia.org/wiki/Salt_(cryptography)) is added to each password to harden against pre-computed hash and dictionary attacks. Each salt is randomly generated for each password, so that no two passwords share a salt, to further increase security.
-- 
cgit v1.2.1


From 30db6e853c0d65b9086f3ba4ccd91a6cb9eb1b8f Mon Sep 17 00:00:00 2001
From: Christiaan Conover <cconover@gitlab.com>
Date: Thu, 22 Aug 2019 16:25:36 +0000
Subject: Document Gitaly CLI connection troubleshooting

Provide documentation around possible reasons and solutions to CLI tools
not being able to connect to Gitaly nodes.
---
 doc/administration/gitaly/index.md | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/doc/administration/gitaly/index.md b/doc/administration/gitaly/index.md
index 878f0ef842d..e0a06e71316 100644
--- a/doc/administration/gitaly/index.md
+++ b/doc/administration/gitaly/index.md
@@ -655,3 +655,33 @@ To fix this problem, confirm that your [`gitlab-secrets.json` file](#3-gitaly-se
 on the Gitaly node matches the one on all other nodes. If it doesn't match,
 update the secrets file on the Gitaly node to match the others, then
 [reconfigure the node](../restart_gitlab.md#omnibus-gitlab-reconfigure).
+
+### Command line tools cannot connect to Gitaly
+
+If you are having trouble connecting to a Gitaly node with command line (CLI) tools, and certain actions result in a `14: Connect Failed` error message, it means that gRPC cannot reach your Gitaly node.
+
+Verify that you can reach Gitaly via TCP:
+
+```bash
+sudo gitlab-rake gitlab:tcp_check[GITALY_SERVER_IP,GITALY_LISTEN_PORT]
+```
+
+If the TCP connection fails, check your network settings and your firewall rules. If the TCP connection succeeds, your networking and firewall rules are correct.
+
+If you use proxy servers in your command line environment, such as Bash, these can interfere with your gRPC traffic.
+
+If you use Bash or a compatible command line environment, run the following commands to determine whether you have proxy servers configured:
+
+```bash
+echo $http_proxy
+echo $https_proxy
+```
+
+If either of these variables have a value, your Gitaly CLI connections may be getting routed through a proxy which cannot connect to Gitaly.
+
+To remove the proxy setting, run the following commands (depending on which variables had values):
+
+```bash
+unset http_proxy
+unset https_proxy
+```
\ No newline at end of file
-- 
cgit v1.2.1


From 38890f3dee2d02a955b87ef6064ee3d6f499ac96 Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Thu, 22 Aug 2019 16:25:52 +0000
Subject: Add core badges to admin_area docs

Some admin_area docs were missing the Core Only badge
---
 doc/user/admin_area/abuse_reports.md                           | 2 +-
 doc/user/admin_area/broadcast_messages.md                      | 2 +-
 doc/user/admin_area/diff_limits.md                             | 2 +-
 doc/user/admin_area/monitoring/health_check.md                 | 2 +-
 doc/user/admin_area/settings/account_and_limit_settings.md     | 2 +-
 doc/user/admin_area/settings/email.md                          | 2 +-
 doc/user/admin_area/settings/sign_up_restrictions.md           | 2 +-
 doc/user/admin_area/settings/terms.md                          | 2 +-
 doc/user/admin_area/settings/third_party_offers.md             | 2 +-
 doc/user/admin_area/settings/usage_statistics.md               | 2 +-
 doc/user/admin_area/settings/user_and_ip_rate_limits.md        | 2 +-
 doc/user/admin_area/settings/visibility_and_access_controls.md | 2 +-
 12 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/doc/user/admin_area/abuse_reports.md b/doc/user/admin_area/abuse_reports.md
index 0c5d2f81e25..cd8dc7bcbf6 100644
--- a/doc/user/admin_area/abuse_reports.md
+++ b/doc/user/admin_area/abuse_reports.md
@@ -2,7 +2,7 @@
 type: reference, howto
 ---
 
-# Abuse reports
+# Abuse reports **(CORE ONLY)**
 
 View and resolve abuse reports from GitLab users.
 
diff --git a/doc/user/admin_area/broadcast_messages.md b/doc/user/admin_area/broadcast_messages.md
index 01b6558bdbe..b0491499f88 100644
--- a/doc/user/admin_area/broadcast_messages.md
+++ b/doc/user/admin_area/broadcast_messages.md
@@ -2,7 +2,7 @@
 type: reference, howto
 ---
 
-# Broadcast Messages
+# Broadcast Messages **(CORE ONLY)**
 
 GitLab can display messages to all users of a GitLab instance in a banner that appears in the UI.
 
diff --git a/doc/user/admin_area/diff_limits.md b/doc/user/admin_area/diff_limits.md
index 4063c40a751..9fe4b50a991 100644
--- a/doc/user/admin_area/diff_limits.md
+++ b/doc/user/admin_area/diff_limits.md
@@ -2,7 +2,7 @@
 type: reference
 ---
 
-# Diff limits administration
+# Diff limits administration **(CORE ONLY)**
 
 You can set a maximum size for display of diff files (patches).
 
diff --git a/doc/user/admin_area/monitoring/health_check.md b/doc/user/admin_area/monitoring/health_check.md
index 35e7b6fb541..333d2fb42b3 100644
--- a/doc/user/admin_area/monitoring/health_check.md
+++ b/doc/user/admin_area/monitoring/health_check.md
@@ -2,7 +2,7 @@
 type: concepts, howto
 ---
 
-# Health Check
+# Health Check **(CORE ONLY)**
 
 > - Liveness and readiness probes were [introduced][ce-10416] in GitLab 9.1.
 > - The `health_check` endpoint was [introduced][ce-3888] in GitLab 8.8 and was
diff --git a/doc/user/admin_area/settings/account_and_limit_settings.md b/doc/user/admin_area/settings/account_and_limit_settings.md
index 6faab685b26..5e385b7216d 100644
--- a/doc/user/admin_area/settings/account_and_limit_settings.md
+++ b/doc/user/admin_area/settings/account_and_limit_settings.md
@@ -2,7 +2,7 @@
 type: reference
 ---
 
-# Account and limit settings
+# Account and limit settings **(CORE ONLY)**
 
 ## Max attachment size
 
diff --git a/doc/user/admin_area/settings/email.md b/doc/user/admin_area/settings/email.md
index 490163c1816..ddf989d0181 100644
--- a/doc/user/admin_area/settings/email.md
+++ b/doc/user/admin_area/settings/email.md
@@ -2,7 +2,7 @@
 type: reference
 ---
 
-# Email
+# Email **(CORE ONLY)**
 
 You can customize some of the content in emails sent from your GitLab instance.
 
diff --git a/doc/user/admin_area/settings/sign_up_restrictions.md b/doc/user/admin_area/settings/sign_up_restrictions.md
index 1b1bcbcd6e8..aea717e806d 100644
--- a/doc/user/admin_area/settings/sign_up_restrictions.md
+++ b/doc/user/admin_area/settings/sign_up_restrictions.md
@@ -2,7 +2,7 @@
 type: reference
 ---
 
-# Sign-up restrictions
+# Sign-up restrictions **(CORE ONLY)**
 
 You can use sign-up restrictions to require user email confirmation, as well as
 to blacklist or whitelist email addresses belonging to specific domains.
diff --git a/doc/user/admin_area/settings/terms.md b/doc/user/admin_area/settings/terms.md
index a1bce5a6c69..baf219ac9c7 100644
--- a/doc/user/admin_area/settings/terms.md
+++ b/doc/user/admin_area/settings/terms.md
@@ -2,7 +2,7 @@
 type: reference
 ---
 
-# Enforce accepting Terms of Service
+# Enforce accepting Terms of Service **(CORE ONLY)**
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/18570)
 > in [GitLab Core](https://about.gitlab.com/pricing/) 10.8
diff --git a/doc/user/admin_area/settings/third_party_offers.md b/doc/user/admin_area/settings/third_party_offers.md
index d3c9cf7d8ff..ca26147b287 100644
--- a/doc/user/admin_area/settings/third_party_offers.md
+++ b/doc/user/admin_area/settings/third_party_offers.md
@@ -2,7 +2,7 @@
 type: reference
 ---
 
-# Third party offers
+# Third party offers **(CORE ONLY)**
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/20379)
 > in [GitLab Core](https://about.gitlab.com/pricing/) 11.1
diff --git a/doc/user/admin_area/settings/usage_statistics.md b/doc/user/admin_area/settings/usage_statistics.md
index 516600c9d99..efac7e699f3 100644
--- a/doc/user/admin_area/settings/usage_statistics.md
+++ b/doc/user/admin_area/settings/usage_statistics.md
@@ -2,7 +2,7 @@
 type: reference
 ---
 
-# Usage statistics
+# Usage statistics **(CORE ONLY)**
 
 GitLab Inc. will periodically collect information about your instance in order
 to perform various actions.
diff --git a/doc/user/admin_area/settings/user_and_ip_rate_limits.md b/doc/user/admin_area/settings/user_and_ip_rate_limits.md
index e3a495750f2..b9d93bf3671 100644
--- a/doc/user/admin_area/settings/user_and_ip_rate_limits.md
+++ b/doc/user/admin_area/settings/user_and_ip_rate_limits.md
@@ -2,7 +2,7 @@
 type: reference
 ---
 
-# User and IP rate limits
+# User and IP rate limits **(CORE ONLY)**
 
 Rate limiting is a common technique used to improve the security and durability
 of a web application. For more details, see
diff --git a/doc/user/admin_area/settings/visibility_and_access_controls.md b/doc/user/admin_area/settings/visibility_and_access_controls.md
index bf59f49b993..1e2f5705728 100644
--- a/doc/user/admin_area/settings/visibility_and_access_controls.md
+++ b/doc/user/admin_area/settings/visibility_and_access_controls.md
@@ -2,7 +2,7 @@
 type: reference
 ---
 
-# Visibility and access controls
+# Visibility and access controls **(CORE ONLY)**
 
 GitLab allows administrators to:
 
-- 
cgit v1.2.1


From cc18c332e0b99f7b674a56a5be59e8b118c81289 Mon Sep 17 00:00:00 2001
From: Robert Schilling <rschilling@student.tugraz.at>
Date: Thu, 22 Aug 2019 19:05:43 +0200
Subject: Add test, reduce complexity

---
 app/services/application_settings/update_service.rb       | 7 +++++--
 spec/services/application_settings/update_service_spec.rb | 6 ++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/app/services/application_settings/update_service.rb b/app/services/application_settings/update_service.rb
index 13718734844..8115585b7a8 100644
--- a/app/services/application_settings/update_service.rb
+++ b/app/services/application_settings/update_service.rb
@@ -7,8 +7,7 @@ module ApplicationSettings
     attr_reader :params, :application_setting
 
     def execute
-      disable_ext_auth = params[:external_authorization_service_enabled].present? && !Gitlab::Utils.to_boolean(params[:external_authorization_service_enabled])
-      validate_classification_label(application_setting, :external_authorization_service_default_label) unless disable_ext_auth
+      validate_classification_label(application_setting, :external_authorization_service_default_label) unless bypass_external_auth?
 
       if application_setting.errors.any?
         return false
@@ -60,5 +59,9 @@ module ApplicationSettings
 
       Group.find_by_full_path(group_full_path)&.id if group_full_path.present?
     end
+
+    def bypass_external_auth?
+      params.key?(:external_authorization_service_enabled) && !Gitlab::Utils.to_boolean(params[:external_authorization_service_enabled])
+    end
   end
 end
diff --git a/spec/services/application_settings/update_service_spec.rb b/spec/services/application_settings/update_service_spec.rb
index adb5219d691..235fce92fc8 100644
--- a/spec/services/application_settings/update_service_spec.rb
+++ b/spec/services/application_settings/update_service_spec.rb
@@ -201,6 +201,12 @@ describe ApplicationSettings::UpdateService do
       enable_external_authorization_service_check
     end
 
+    it 'does not validate labels if external authorization gets disabled' do
+      expect_any_instance_of(described_class).not_to receive(:validate_classification_label)
+
+      described_class.new(application_settings, admin, { external_authorization_service_enabled: false }).execute
+    end
+
     it 'does not save the settings with an error if the service denies access' do
       expect(::Gitlab::ExternalAuthorization)
         .to receive(:access_allowed?).with(admin, 'new-label') { false }
-- 
cgit v1.2.1


From 37e4f5140010d844164664a57b65c2b6c16e4d25 Mon Sep 17 00:00:00 2001
From: Nathan Friend <nathan@gitlab.com>
Date: Thu, 22 Aug 2019 14:53:14 -0300
Subject: Rename ATMTWPS to MTWPS (CE)

This commit does a find-and-replace from ATMTWPS -> MTWPS.
---
 app/assets/javascripts/vue_merge_request_widget/constants.js      | 8 ++------
 .../vue_merge_request_widget/stores/mr_widget_store.js            | 6 +++---
 .../components/states/mr_widget_ready_to_merge_spec.js            | 4 ++--
 3 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/app/assets/javascripts/vue_merge_request_widget/constants.js b/app/assets/javascripts/vue_merge_request_widget/constants.js
index 3e65bdf0cb0..6f6d145815e 100644
--- a/app/assets/javascripts/vue_merge_request_widget/constants.js
+++ b/app/assets/javascripts/vue_merge_request_widget/constants.js
@@ -5,11 +5,7 @@ export const WARNING_MESSAGE_CLASS = 'warning_message';
 export const DANGER_MESSAGE_CLASS = 'danger_message';
 
 export const MWPS_MERGE_STRATEGY = 'merge_when_pipeline_succeeds';
-export const ATMTWPS_MERGE_STRATEGY = 'add_to_merge_train_when_pipeline_succeeds';
+export const MTWPS_MERGE_STRATEGY = 'add_to_merge_train_when_pipeline_succeeds';
 export const MT_MERGE_STRATEGY = 'merge_train';
 
-export const AUTO_MERGE_STRATEGIES = [
-  MWPS_MERGE_STRATEGY,
-  ATMTWPS_MERGE_STRATEGY,
-  MT_MERGE_STRATEGY,
-];
+export const AUTO_MERGE_STRATEGIES = [MWPS_MERGE_STRATEGY, MTWPS_MERGE_STRATEGY, MT_MERGE_STRATEGY];
diff --git a/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js b/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
index 7843409f4a7..699d41494bf 100644
--- a/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
+++ b/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
@@ -3,7 +3,7 @@ import _ from 'underscore';
 import getStateKey from 'ee_else_ce/vue_merge_request_widget/stores/get_state_key';
 import { stateKey } from './state_maps';
 import { formatDate } from '../../lib/utils/datetime_utility';
-import { ATMTWPS_MERGE_STRATEGY, MT_MERGE_STRATEGY, MWPS_MERGE_STRATEGY } from '../constants';
+import { MTWPS_MERGE_STRATEGY, MT_MERGE_STRATEGY, MWPS_MERGE_STRATEGY } from '../constants';
 
 export default class MergeRequestStore {
   constructor(data) {
@@ -217,8 +217,8 @@ export default class MergeRequestStore {
   }
 
   static getPreferredAutoMergeStrategy(availableAutoMergeStrategies) {
-    if (_.includes(availableAutoMergeStrategies, ATMTWPS_MERGE_STRATEGY)) {
-      return ATMTWPS_MERGE_STRATEGY;
+    if (_.includes(availableAutoMergeStrategies, MTWPS_MERGE_STRATEGY)) {
+      return MTWPS_MERGE_STRATEGY;
     } else if (_.includes(availableAutoMergeStrategies, MT_MERGE_STRATEGY)) {
       return MT_MERGE_STRATEGY;
     } else if (_.includes(availableAutoMergeStrategies, MWPS_MERGE_STRATEGY)) {
diff --git a/spec/javascripts/vue_mr_widget/components/states/mr_widget_ready_to_merge_spec.js b/spec/javascripts/vue_mr_widget/components/states/mr_widget_ready_to_merge_spec.js
index 53e1f077610..2bb2319cc60 100644
--- a/spec/javascripts/vue_mr_widget/components/states/mr_widget_ready_to_merge_spec.js
+++ b/spec/javascripts/vue_mr_widget/components/states/mr_widget_ready_to_merge_spec.js
@@ -6,7 +6,7 @@ import CommitEdit from '~/vue_merge_request_widget/components/states/commit_edit
 import CommitMessageDropdown from '~/vue_merge_request_widget/components/states/commit_message_dropdown.vue';
 import eventHub from '~/vue_merge_request_widget/event_hub';
 import { createLocalVue, shallowMount } from '@vue/test-utils';
-import { MWPS_MERGE_STRATEGY, ATMTWPS_MERGE_STRATEGY } from '~/vue_merge_request_widget/constants';
+import { MWPS_MERGE_STRATEGY, MTWPS_MERGE_STRATEGY } from '~/vue_merge_request_widget/constants';
 
 const commitMessage = 'This is the commit message';
 const squashCommitMessage = 'This is the squash commit message';
@@ -164,7 +164,7 @@ describe('ReadyToMerge', () => {
       });
 
       it('returns info class for pending status', () => {
-        Vue.set(vm.mr, 'availableAutoMergeStrategies', [ATMTWPS_MERGE_STRATEGY]);
+        Vue.set(vm.mr, 'availableAutoMergeStrategies', [MTWPS_MERGE_STRATEGY]);
 
         expect(vm.mergeButtonClass).toEqual(inActionClass);
       });
-- 
cgit v1.2.1


From 92005fb70f38ee49396ae9e8123979f612827ada Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Wed, 14 Aug 2019 16:12:05 +0800
Subject: Enable CSP in gitlab.yml.example

This enables CSP in dev and CI
---
 config/gitlab.yml.example | 31 ++++++++++++++++++++++++++-----
 spec/support/capybara.rb  |  3 +++
 2 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
index efddbfcbb57..973c2747838 100644
--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
@@ -50,12 +50,12 @@ production: &base
     # Content Security Policy
     # See https://guides.rubyonrails.org/security.html#content-security-policy
     content_security_policy:
-      enabled: false
+      enabled: true
       report_only: false
       directives:
         base_uri:
         child_src:
-        connect_src: "'self' http://localhost:3808 ws://localhost:3808 wss://localhost:3000"
+        connect_src: "'self' http://localhost:* ws://localhost:* wss://localhost:*"
         default_src: "'self'"
         font_src:
         form_action:
@@ -64,10 +64,10 @@ production: &base
         img_src: "* data: blob:"
         manifest_src:
         media_src:
-        object_src: "'self' http://localhost:3808 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.gstatic.com/recaptcha/ https://apis.google.com"
-        script_src:
+        object_src: "'none'"
+        script_src: "'self' 'unsafe-eval' http://localhost:* https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.gstatic.com/recaptcha/ https://apis.google.com"
         style_src: "'self' 'unsafe-inline'"
-        worker_src: "http://localhost:3000 blob:"
+        worker_src: "'self' blob:"
         report_uri:
 
     # Trusted Proxies
@@ -1099,6 +1099,27 @@ test:
     host: localhost
     port: 80
 
+    content_security_policy:
+      enabled: true
+      report_only: false
+      directives:
+        base_uri:
+        child_src:
+        connect_src:
+        default_src: "'self'"
+        font_src:
+        form_action:
+        frame_ancestors: "'self'"
+        frame_src: "'self' https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://content.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://content-cloudresourcemanager.googleapis.com"
+        img_src: "* data: blob:"
+        manifest_src:
+        media_src:
+        object_src: "'none'"
+        script_src: "'self' 'unsafe-eval' http://localhost:* https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.gstatic.com/recaptcha/ https://apis.google.com"
+        style_src: "'self' 'unsafe-inline'"
+        worker_src: "'self' blob:"
+        report_uri:
+
     # When you run tests we clone and set up gitlab-shell
     # In order to set it up correctly you need to specify
     # your system username you use to run GitLab
diff --git a/spec/support/capybara.rb b/spec/support/capybara.rb
index 8accc5c1df5..4c688094352 100644
--- a/spec/support/capybara.rb
+++ b/spec/support/capybara.rb
@@ -47,6 +47,9 @@ Capybara.register_driver :chrome do |app|
   # Explicitly set user-data-dir to prevent crashes. See https://gitlab.com/gitlab-org/gitlab-ce/issues/58882#note_179811508
   options.add_argument("user-data-dir=/tmp/chrome") if ENV['CI'] || ENV['CI_SERVER']
 
+  # Chrome 75 defaults to W3C mode which doesn't allow console log access
+  options.add_option(:w3c, false)
+
   Capybara::Selenium::Driver.new(
     app,
     browser: :chrome,
-- 
cgit v1.2.1


From f56c2191a10667783d488eb3415ac2ba2b3f06a3 Mon Sep 17 00:00:00 2001
From: Robert Schilling <rschilling@student.tugraz.at>
Date: Thu, 22 Aug 2019 20:20:23 +0200
Subject: Add more tests to cover all cases

---
 spec/services/application_settings/update_service_spec.rb | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/spec/services/application_settings/update_service_spec.rb b/spec/services/application_settings/update_service_spec.rb
index 235fce92fc8..ab06c1a1209 100644
--- a/spec/services/application_settings/update_service_spec.rb
+++ b/spec/services/application_settings/update_service_spec.rb
@@ -207,6 +207,18 @@ describe ApplicationSettings::UpdateService do
       described_class.new(application_settings, admin, { external_authorization_service_enabled: false }).execute
     end
 
+    it 'does validate labels if external authorization gets enabled ' do
+      expect_any_instance_of(described_class).to receive(:validate_classification_label)
+
+      described_class.new(application_settings, admin, { external_authorization_service_enabled: true }).execute
+    end
+
+    it 'does validate labels if external authorization is left unchanged' do
+      expect_any_instance_of(described_class).to receive(:validate_classification_label)
+
+      described_class.new(application_settings, admin, { external_authorization_service_default_label: 'new-label' }).execute
+    end
+
     it 'does not save the settings with an error if the service denies access' do
       expect(::Gitlab::ExternalAuthorization)
         .to receive(:access_allowed?).with(admin, 'new-label') { false }
-- 
cgit v1.2.1


From 6bda359b5aaedfcdfb4b426d7428f65fee57217d Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Thu, 22 Aug 2019 13:34:19 -0700
Subject: Fix "ERR value is not an integer or out of range" errors

`ActiveSupport::Cache::RedisCacheStore` is not compatible with the
version of Rack Attack we are using (v4.4.1) per
https://github.com/kickstarter/rack-attack/issues/281. Users that had
rate limits enabled might see `Redis::CommandError: ERR value is not an
integer or out of range` because the `raw` parameter wasn't passed along
properly. As a result, the Rack Attack entry would be stored as an
`ActiveSupport::Cache::Entry` instead of a raw string holding an integer
value.

Let's partially revert the change in
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/30966 to use the
original cache store until we can update to Rack Attack v5.2.3 that has
support for `ActiveSupport::Cache::RedisCacheStore` via
https://github.com/kickstarter/rack-attack/pull/350.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66449
---
 changelogs/unreleased/sh-revert-redis-cache-store.yml | 5 +++++
 config/application.rb                                 | 5 +----
 2 files changed, 6 insertions(+), 4 deletions(-)
 create mode 100644 changelogs/unreleased/sh-revert-redis-cache-store.yml

diff --git a/changelogs/unreleased/sh-revert-redis-cache-store.yml b/changelogs/unreleased/sh-revert-redis-cache-store.yml
new file mode 100644
index 00000000000..710b6e7941d
--- /dev/null
+++ b/changelogs/unreleased/sh-revert-redis-cache-store.yml
@@ -0,0 +1,5 @@
+---
+title: Fix "ERR value is not an integer or out of range" errors
+merge_request: 32126
+author:
+type: fixed
diff --git a/config/application.rb b/config/application.rb
index 2554dd8cca2..294ed470298 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -241,10 +241,7 @@ module Gitlab
     end
 
     # Use caching across all environments
-    # Full list of options:
-    # https://api.rubyonrails.org/classes/ActiveSupport/Cache/RedisCacheStore.html#method-c-new
     caching_config_hash = Gitlab::Redis::Cache.params
-    caching_config_hash[:compress] = false
     caching_config_hash[:namespace] = Gitlab::Redis::Cache::CACHE_NAMESPACE
     caching_config_hash[:expires_in] = 2.weeks # Cache should not grow forever
     if Sidekiq.server? # threaded context
@@ -252,7 +249,7 @@ module Gitlab
       caching_config_hash[:pool_timeout] = 1
     end
 
-    config.cache_store = :redis_cache_store, caching_config_hash
+    config.cache_store = :redis_store, caching_config_hash
 
     config.active_job.queue_adapter = :sidekiq
 
-- 
cgit v1.2.1


From 606a1d2d31aff69ddabe7e3794f61f3e778da3e8 Mon Sep 17 00:00:00 2001
From: Alessio Caiazza <acaiazza@gitlab.com>
Date: Thu, 22 Aug 2019 22:08:28 +0000
Subject: Expose namespace storage statistics with GraphQL

Root namespaces have storage statistics.
This commit allows namespace owners to get those stats via GraphQL
queries like the following one

{
  namespace(fullPath: "a_namespace_path") {
    rootStorageStatistics {
      storageSize
      repositorySize
      lfsObjectsSize
      buildArtifactsSize
      packagesSize
      wikiSize
    }
  }
}
---
 app/graphql/types/namespace_type.rb                |  5 ++
 app/graphql/types/root_storage_statistics_type.rb  | 16 +++++
 app/models/namespace/root_storage_statistics.rb    |  2 +
 app/policies/group_policy.rb                       |  2 +
 .../namespace/root_storage_statistics_policy.rb    |  5 ++
 app/policies/namespace_policy.rb                   |  1 +
 .../unreleased/ac-graphql-root-namespace-stats.yml |  5 ++
 doc/api/graphql/reference/index.md                 | 12 ++++
 .../batch_root_storage_statistics_loader.rb        | 23 +++++++
 spec/graphql/types/namespace_type_spec.rb          |  2 +-
 .../types/root_storage_statistics_type_spec.rb     | 14 ++++
 .../batch_root_storage_statistics_loader_spec.rb   | 18 +++++
 .../namespace/root_storage_statistics_spec.rb      | 13 ++++
 .../root_storage_statistics_policy_spec.rb         | 80 ++++++++++++++++++++++
 spec/policies/namespace_policy_spec.rb             |  2 +-
 .../namespace/root_storage_statistics_spec.rb      | 55 +++++++++++++++
 .../api/graphql/project/project_statistics_spec.rb |  2 +-
 .../policies/group_policy_shared_context.rb        |  3 +-
 18 files changed, 256 insertions(+), 4 deletions(-)
 create mode 100644 app/graphql/types/root_storage_statistics_type.rb
 create mode 100644 app/policies/namespace/root_storage_statistics_policy.rb
 create mode 100644 changelogs/unreleased/ac-graphql-root-namespace-stats.yml
 create mode 100644 lib/gitlab/graphql/loaders/batch_root_storage_statistics_loader.rb
 create mode 100644 spec/graphql/types/root_storage_statistics_type_spec.rb
 create mode 100644 spec/lib/gitlab/graphql/loaders/batch_root_storage_statistics_loader_spec.rb
 create mode 100644 spec/policies/namespace/root_storage_statistics_policy_spec.rb
 create mode 100644 spec/requests/api/graphql/namespace/root_storage_statistics_spec.rb

diff --git a/app/graphql/types/namespace_type.rb b/app/graphql/types/namespace_type.rb
index f105e9e6e28..35a97b5ace0 100644
--- a/app/graphql/types/namespace_type.rb
+++ b/app/graphql/types/namespace_type.rb
@@ -19,6 +19,11 @@ module Types
     field :lfs_enabled, GraphQL::BOOLEAN_TYPE, null: true, method: :lfs_enabled?
     field :request_access_enabled, GraphQL::BOOLEAN_TYPE, null: true
 
+    field :root_storage_statistics, Types::RootStorageStatisticsType,
+          null: true,
+          description: 'The aggregated storage statistics. Only available for root namespaces',
+          resolve: -> (obj, _args, _ctx) { Gitlab::Graphql::Loaders::BatchRootStorageStatisticsLoader.new(obj.id).find }
+
     field :projects,
           Types::ProjectType.connection_type,
           null: false,
diff --git a/app/graphql/types/root_storage_statistics_type.rb b/app/graphql/types/root_storage_statistics_type.rb
new file mode 100644
index 00000000000..a7498ee0a2e
--- /dev/null
+++ b/app/graphql/types/root_storage_statistics_type.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Types
+  class RootStorageStatisticsType < BaseObject
+    graphql_name 'RootStorageStatistics'
+
+    authorize :read_statistics
+
+    field :storage_size, GraphQL::INT_TYPE, null: false, description: 'The total storage in bytes'
+    field :repository_size, GraphQL::INT_TYPE, null: false, description: 'The git repository size in bytes'
+    field :lfs_objects_size, GraphQL::INT_TYPE, null: false, description: 'The LFS objects size in bytes'
+    field :build_artifacts_size, GraphQL::INT_TYPE, null: false, description: 'The CI artifacts size in bytes'
+    field :packages_size, GraphQL::INT_TYPE, null: false, description: 'The packages size in bytes'
+    field :wiki_size, GraphQL::INT_TYPE, null: false, description: 'The wiki size in bytes'
+  end
+end
diff --git a/app/models/namespace/root_storage_statistics.rb b/app/models/namespace/root_storage_statistics.rb
index 56c430013ee..ae9b2f14343 100644
--- a/app/models/namespace/root_storage_statistics.rb
+++ b/app/models/namespace/root_storage_statistics.rb
@@ -8,6 +8,8 @@ class Namespace::RootStorageStatistics < ApplicationRecord
   belongs_to :namespace
   has_one :route, through: :namespace
 
+  scope :for_namespace_ids, ->(namespace_ids) { where(namespace_id: namespace_ids) }
+
   delegate :all_projects, to: :namespace
 
   def recalculate!
diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb
index c686e7763bb..5d2b74b17a2 100644
--- a/app/policies/group_policy.rb
+++ b/app/policies/group_policy.rb
@@ -124,6 +124,8 @@ class GroupPolicy < BasePolicy
   rule { developer & developer_maintainer_access }.enable :create_projects
   rule { create_projects_disabled }.prevent :create_projects
 
+  rule { owner | admin }.enable :read_statistics
+
   def access_level
     return GroupMember::NO_ACCESS if @user.nil?
 
diff --git a/app/policies/namespace/root_storage_statistics_policy.rb b/app/policies/namespace/root_storage_statistics_policy.rb
new file mode 100644
index 00000000000..63fcaf20dfe
--- /dev/null
+++ b/app/policies/namespace/root_storage_statistics_policy.rb
@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+class Namespace::RootStorageStatisticsPolicy < BasePolicy
+  delegate { @subject.namespace }
+end
diff --git a/app/policies/namespace_policy.rb b/app/policies/namespace_policy.rb
index 2babcb0a2d9..937666c7e54 100644
--- a/app/policies/namespace_policy.rb
+++ b/app/policies/namespace_policy.rb
@@ -11,6 +11,7 @@ class NamespacePolicy < BasePolicy
     enable :create_projects
     enable :admin_namespace
     enable :read_namespace
+    enable :read_statistics
   end
 
   rule { personal_project & ~can_create_personal_project }.prevent :create_projects
diff --git a/changelogs/unreleased/ac-graphql-root-namespace-stats.yml b/changelogs/unreleased/ac-graphql-root-namespace-stats.yml
new file mode 100644
index 00000000000..9784605ab2e
--- /dev/null
+++ b/changelogs/unreleased/ac-graphql-root-namespace-stats.yml
@@ -0,0 +1,5 @@
+---
+title: Expose namespace storage statistics with GraphQL
+merge_request: 32012
+author:
+type: added
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 2d3bec4ff67..d99a4c37d72 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -109,6 +109,7 @@ The API can be explored interactively using the [GraphiQL IDE](../index.md#graph
 | `visibility` | String |  |
 | `lfsEnabled` | Boolean |  |
 | `requestAccessEnabled` | Boolean |  |
+| `rootStorageStatistics` | RootStorageStatistics | The aggregated storage statistics. Only available if the namespace has no parent |
 | `userPermissions` | GroupPermissions! | Permissions for the current user on the resource |
 | `webUrl` | String! |  |
 | `avatarUrl` | String |  |
@@ -453,6 +454,17 @@ The API can be explored interactively using the [GraphiQL IDE](../index.md#graph
 | `exists` | Boolean! |  |
 | `tree` | Tree |  |
 
+### RootStorageStatistics
+
+| Name  | Type  | Description |
+| ---   |  ---- | ----------  |
+| `storageSize` | Int! | The total storage in Bytes |
+| `repositorySize` | Int! | The git repository size in Bytes |
+| `lfsObjectsSize` | Int! | The LFS objects size in Bytes |
+| `buildArtifactsSize` | Int! | The CI artifacts size in Bytes |
+| `packagesSize` | Int! | The packages size in Bytes |
+| `wikiSize` | Int! | The wiki size in Bytes |
+
 ### Submodule
 
 | Name  | Type  | Description |
diff --git a/lib/gitlab/graphql/loaders/batch_root_storage_statistics_loader.rb b/lib/gitlab/graphql/loaders/batch_root_storage_statistics_loader.rb
new file mode 100644
index 00000000000..a0312366d66
--- /dev/null
+++ b/lib/gitlab/graphql/loaders/batch_root_storage_statistics_loader.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Graphql
+    module Loaders
+      class BatchRootStorageStatisticsLoader
+        attr_reader :namespace_id
+
+        def initialize(namespace_id)
+          @namespace_id = namespace_id
+        end
+
+        def find
+          BatchLoader.for(namespace_id).batch do |namespace_ids, loader|
+            Namespace::RootStorageStatistics.for_namespace_ids(namespace_ids).each do |statistics|
+              loader.call(statistics.namespace_id, statistics)
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/spec/graphql/types/namespace_type_spec.rb b/spec/graphql/types/namespace_type_spec.rb
index e1153832cc9..f476dd7286f 100644
--- a/spec/graphql/types/namespace_type_spec.rb
+++ b/spec/graphql/types/namespace_type_spec.rb
@@ -8,7 +8,7 @@ describe GitlabSchema.types['Namespace'] do
   it 'has the expected fields' do
     expected_fields = %w[
       id name path full_name full_path description description_html visibility
-      lfs_enabled request_access_enabled projects
+      lfs_enabled request_access_enabled projects root_storage_statistics
     ]
 
     is_expected.to have_graphql_fields(*expected_fields)
diff --git a/spec/graphql/types/root_storage_statistics_type_spec.rb b/spec/graphql/types/root_storage_statistics_type_spec.rb
new file mode 100644
index 00000000000..8c69c13aa73
--- /dev/null
+++ b/spec/graphql/types/root_storage_statistics_type_spec.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe GitlabSchema.types['RootStorageStatistics'] do
+  it { expect(described_class.graphql_name).to eq('RootStorageStatistics') }
+
+  it 'has all the required fields' do
+    is_expected.to have_graphql_fields(:storage_size, :repository_size, :lfs_objects_size,
+                                       :build_artifacts_size, :packages_size, :wiki_size)
+  end
+
+  it { is_expected.to require_graphql_authorizations(:read_statistics) }
+end
diff --git a/spec/lib/gitlab/graphql/loaders/batch_root_storage_statistics_loader_spec.rb b/spec/lib/gitlab/graphql/loaders/batch_root_storage_statistics_loader_spec.rb
new file mode 100644
index 00000000000..38931f7ab5e
--- /dev/null
+++ b/spec/lib/gitlab/graphql/loaders/batch_root_storage_statistics_loader_spec.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::Graphql::Loaders::BatchRootStorageStatisticsLoader do
+  describe '#find' do
+    it 'only queries once for project statistics' do
+      stats = create_list(:namespace_root_storage_statistics, 2)
+      namespace1 = stats.first.namespace
+      namespace2 = stats.last.namespace
+
+      expect do
+        described_class.new(namespace1.id).find
+        described_class.new(namespace2.id).find
+      end.not_to exceed_query_limit(1)
+    end
+  end
+end
diff --git a/spec/models/namespace/root_storage_statistics_spec.rb b/spec/models/namespace/root_storage_statistics_spec.rb
index 5341278db7c..9e12831a704 100644
--- a/spec/models/namespace/root_storage_statistics_spec.rb
+++ b/spec/models/namespace/root_storage_statistics_spec.rb
@@ -8,6 +8,19 @@ RSpec.describe Namespace::RootStorageStatistics, type: :model do
 
   it { is_expected.to delegate_method(:all_projects).to(:namespace) }
 
+  context 'scopes' do
+    describe '.for_namespace_ids' do
+      it 'returns only requested namespaces' do
+        stats = create_list(:namespace_root_storage_statistics, 3)
+        namespace_ids = stats[0..1].map { |s| s.namespace_id }
+
+        requested_stats = described_class.for_namespace_ids(namespace_ids).pluck(:namespace_id)
+
+        expect(requested_stats).to eq(namespace_ids)
+      end
+    end
+  end
+
   describe '#recalculate!' do
     let(:namespace) { create(:group) }
     let(:root_storage_statistics) { create(:namespace_root_storage_statistics, namespace: namespace) }
diff --git a/spec/policies/namespace/root_storage_statistics_policy_spec.rb b/spec/policies/namespace/root_storage_statistics_policy_spec.rb
new file mode 100644
index 00000000000..8d53050fffb
--- /dev/null
+++ b/spec/policies/namespace/root_storage_statistics_policy_spec.rb
@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Namespace::RootStorageStatisticsPolicy do
+  using RSpec::Parameterized::TableSyntax
+
+  describe '#rules' do
+    let(:statistics) { create(:namespace_root_storage_statistics, namespace: namespace) }
+    let(:user) { create(:user) }
+
+    subject { Ability.allowed?(user, :read_statistics, statistics) }
+
+    shared_examples 'deny anonymous users' do
+      context 'when the users is anonymous' do
+        let(:user) { nil }
+
+        it { is_expected.to be_falsey }
+      end
+    end
+
+    context 'when the namespace is a personal namespace' do
+      let(:owner) { create(:user) }
+      let(:namespace) { owner.namespace }
+
+      include_examples 'deny anonymous users'
+
+      context 'when the user is not the owner' do
+        it { is_expected.to be_falsey }
+      end
+
+      context 'when the user is the owner' do
+        let(:user) { owner }
+
+        it { is_expected.to be_truthy }
+      end
+    end
+
+    context 'when the namespace is a group' do
+      let(:user)     { create(:user) }
+      let(:external) { create(:user, :external) }
+
+      shared_examples 'allows only owners' do |group_type|
+        let(:group) { create(:group, visibility_level: Gitlab::VisibilityLevel.level_value(group_type.to_s)) }
+        let(:namespace) { group }
+
+        include_examples 'deny anonymous users'
+
+        where(:user_type, :outcome) do
+          [
+            [:non_member, false],
+            [:guest, false],
+            [:reporter, false],
+            [:developer, false],
+            [:maintainer, false],
+            [:owner, true]
+          ]
+        end
+
+        with_them do
+          before do
+            group.add_user(user, user_type) unless user_type == :non_member
+          end
+
+          it { is_expected.to eq(outcome) }
+
+          context 'when the user is external' do
+            let(:user) { external }
+
+            it { is_expected.to eq(outcome) }
+          end
+        end
+      end
+
+      include_examples 'allows only owners', :public
+      include_examples 'allows only owners', :private
+      include_examples 'allows only owners', :internal
+    end
+  end
+end
diff --git a/spec/policies/namespace_policy_spec.rb b/spec/policies/namespace_policy_spec.rb
index 99fa8b1fe44..216aaae70ee 100644
--- a/spec/policies/namespace_policy_spec.rb
+++ b/spec/policies/namespace_policy_spec.rb
@@ -6,7 +6,7 @@ describe NamespacePolicy do
   let(:admin) { create(:admin) }
   let(:namespace) { create(:namespace, owner: owner) }
 
-  let(:owner_permissions) { [:create_projects, :admin_namespace, :read_namespace] }
+  let(:owner_permissions) { [:create_projects, :admin_namespace, :read_namespace, :read_statistics] }
 
   subject { described_class.new(current_user, namespace) }
 
diff --git a/spec/requests/api/graphql/namespace/root_storage_statistics_spec.rb b/spec/requests/api/graphql/namespace/root_storage_statistics_spec.rb
new file mode 100644
index 00000000000..ac76d991bd4
--- /dev/null
+++ b/spec/requests/api/graphql/namespace/root_storage_statistics_spec.rb
@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'rendering namespace statistics' do
+  include GraphqlHelpers
+
+  let(:namespace) { user.namespace }
+  let!(:statistics) { create(:namespace_root_storage_statistics, namespace: namespace, packages_size: 5.megabytes) }
+  let(:user) { create(:user) }
+
+  let(:query) do
+    graphql_query_for('namespace',
+                      { 'fullPath' => namespace.full_path },
+                      "rootStorageStatistics { #{all_graphql_fields_for('RootStorageStatistics')} }")
+  end
+
+  shared_examples 'a working namespace with storage statistics query' do
+    it_behaves_like 'a working graphql query' do
+      before do
+        post_graphql(query, current_user: user)
+      end
+    end
+
+    it 'includes the packages size if the user can read the statistics' do
+      post_graphql(query, current_user: user)
+
+      expect(graphql_data['namespace']['rootStorageStatistics']).not_to be_blank
+      expect(graphql_data['namespace']['rootStorageStatistics']['packagesSize']).to eq(5.megabytes)
+    end
+  end
+
+  it_behaves_like 'a working namespace with storage statistics query'
+
+  context 'when the namespace is a group' do
+    let(:group) { create(:group) }
+    let(:namespace) { group }
+
+    before do
+      group.add_owner(user)
+    end
+
+    it_behaves_like 'a working namespace with storage statistics query'
+
+    context 'when the namespace is public' do
+      let(:group) { create(:group, :public)}
+
+      it 'hides statistics for unauthenticated requests' do
+        post_graphql(query, current_user: nil)
+
+        expect(graphql_data['namespace']).to be_blank
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/project/project_statistics_spec.rb b/spec/requests/api/graphql/project/project_statistics_spec.rb
index 14a3f37b779..ddee8537454 100644
--- a/spec/requests/api/graphql/project/project_statistics_spec.rb
+++ b/spec/requests/api/graphql/project/project_statistics_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'rendering namespace statistics' do
+describe 'rendering project statistics' do
   include GraphqlHelpers
 
   let(:project) { create(:project) }
diff --git a/spec/support/shared_contexts/policies/group_policy_shared_context.rb b/spec/support/shared_contexts/policies/group_policy_shared_context.rb
index fd24c443288..b89723b1e1a 100644
--- a/spec/support/shared_contexts/policies/group_policy_shared_context.rb
+++ b/spec/support/shared_contexts/policies/group_policy_shared_context.rb
@@ -31,7 +31,8 @@ RSpec.shared_context 'GroupPolicy context' do
       :admin_group_member,
       :change_visibility_level,
       :set_note_created_at,
-      :create_subgroup
+      :create_subgroup,
+      :read_statistics
     ].compact
   end
 
-- 
cgit v1.2.1


From 31490c6d1daa13d05febb14561f08dcc46414522 Mon Sep 17 00:00:00 2001
From: Mark Lapierre <mlapierre@gitlab.com>
Date: Thu, 22 Aug 2019 22:57:24 +0000
Subject: Update QA readme to note that Chrome/Chromium is required

---
 qa/README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/qa/README.md b/qa/README.md
index 27e11c04b3e..16e5e730a6b 100644
--- a/qa/README.md
+++ b/qa/README.md
@@ -39,6 +39,11 @@ have an instance available you can follow the instructions below to use
 the [GitLab Development Kit (GDK)][GDK].
 This is the recommended option if you would like to contribute to the tests.
 
+Note: GitLab QA uses [Selenium WebDriver](https://www.seleniumhq.org/) via
+[Cabybara](http://teamcapybara.github.io/capybara/), and by default it targets Chrome as
+the browser to use. You will need to have Chrome (or Chromium) and
+[chromedriver](https://chromedriver.chromium.org/) installed / in your `$PATH`.
+
 ### Run the end-to-end tests in a local development environment
 
 Follow the GDK instructions to [prepare](https://gitlab.com/gitlab-org/gitlab-development-kit/blob/master/doc/prepare.md)
-- 
cgit v1.2.1


From 56294b4ea9b0a2054423c895b9a7667118cda0ad Mon Sep 17 00:00:00 2001
From: Scott Hampton <shampton@gitlab.com>
Date: Thu, 22 Aug 2019 23:20:19 +0000
Subject: Update GitHub CI/CD import page to use PAT only

Oauth2 tokens are causing issues with mirroring
repos, because it effectively limits the number
of repos you can mirror. Personal Access
Tokens do not have this problem.

This change removes the OAuth2 option from
the import page for CI/CD only, and only
provides the personal access token form.
---
 app/helpers/import_helper.rb                       | 11 +++----
 app/views/import/github/new.html.haml              | 34 ++++++++++++----------
 .../59053-no-oauth-for-cicd-github-fe.yml          |  5 ++++
 locale/gitlab.pot                                  | 27 +++++++++--------
 qa/qa/page/project/import/github.rb                |  2 +-
 spec/features/projects/new_project_spec.rb         |  2 +-
 6 files changed, 44 insertions(+), 37 deletions(-)
 create mode 100644 changelogs/unreleased/59053-no-oauth-for-cicd-github-fe.yml

diff --git a/app/helpers/import_helper.rb b/app/helpers/import_helper.rb
index 3d494c3de6a..9122ad5b35a 100644
--- a/app/helpers/import_helper.rb
+++ b/app/helpers/import_helper.rb
@@ -45,17 +45,14 @@ module ImportHelper
   end
 
   def import_github_authorize_message
-    _('To import GitHub repositories, you first need to authorize GitLab to access the list of your GitHub repositories:')
+    _('To connect GitHub repositories, you first need to authorize GitLab to access the list of your GitHub repositories.')
   end
 
   def import_github_personal_access_token_message
-    personal_access_token_link = link_to _('Personal Access Token'), 'https://github.com/settings/tokens'
+    link_url = 'https://github.com/settings/tokens'
+    link_start = '<a href="%{url}" target="_blank" rel="noopener noreferrer">'.html_safe % { url: link_url }
 
-    if github_import_configured?
-      _('Alternatively, you can use a %{personal_access_token_link}. When you create your Personal Access Token, you will need to select the <code>repo</code> scope, so we can display a list of your public and private repositories which are available to import.').html_safe % { personal_access_token_link: personal_access_token_link }
-    else
-      _('To import GitHub repositories, you can use a %{personal_access_token_link}. When you create your Personal Access Token, you will need to select the <code>repo</code> scope, so we can display a list of your public and private repositories which are available to import.').html_safe % { personal_access_token_link: personal_access_token_link }
-    end
+    _('Create and provide your GitHub %{link_start}Personal Access Token%{link_end}. You will need to select the <code>repo</code> scope, so we can display a list of your public and private repositories which are available to import.').html_safe % { link_start: link_start, link_end: '</a>'.html_safe }
   end
 
   def import_configure_github_admin_message
diff --git a/app/views/import/github/new.html.haml b/app/views/import/github/new.html.haml
index 72e5934574a..518c44cc687 100644
--- a/app/views/import/github/new.html.haml
+++ b/app/views/import/github/new.html.haml
@@ -1,30 +1,32 @@
-- title = has_ci_cd_only_params? ? _('Connect repositories from GitHub') : _('GitHub import')
+- title = _('Authenticate with GitHub')
 - page_title title
 - breadcrumb_title title
 - header_title _("Projects"), root_path
 
-%h3.page-title
-  = icon 'github', text: _('Import repositories from GitHub')
+%h2.page-title
+  = title
 
-- if github_import_configured?
-  %p
-    = import_github_authorize_message
+%p
+  = import_github_authorize_message
 
-  = link_to _('List your GitHub repositories'), status_import_github_path(ci_cd_only: params[:ci_cd_only]), class: 'btn btn-success'
+- if github_import_configured? && !has_ci_cd_only_params?
+  = link_to icon('github', text: title), status_import_github_path, class: 'btn btn-success'
 
   %hr
 
-%p
-  = import_github_personal_access_token_message
+- unless github_import_configured? || has_ci_cd_only_params?
+  .bs-callout.bs-callout-info
+    = import_configure_github_admin_message
 
-= form_tag personal_access_token_import_github_path, method: :post, class: 'form-inline' do
+= form_tag personal_access_token_import_github_path, method: :post do
   .form-group
-    = text_field_tag :personal_access_token, '', class: 'form-control append-right-8', placeholder: _('Personal Access Token'), size: 40
-    = submit_tag _('List your GitHub repositories'), class: 'btn btn-success'
+    %label.label-bold= _('Personal Access Token')
+    = text_field_tag :personal_access_token, '', class: 'form-control', placeholder: _('e.g. %{token}') % { token: '8d3f016698e...' }
+    %span.form-text.text-muted
+      = import_github_personal_access_token_message
 
   = render_if_exists 'import/github/ci_cd_only'
 
-- unless github_import_configured?
-  %hr
-  %p
-    = import_configure_github_admin_message
+  .form-actions.d-flex.justify-content-end
+    = link_to _('Cancel'), new_project_path, class: 'btn'
+    = submit_tag _('Authenticate'), class: 'btn btn-success ml-2'
diff --git a/changelogs/unreleased/59053-no-oauth-for-cicd-github-fe.yml b/changelogs/unreleased/59053-no-oauth-for-cicd-github-fe.yml
new file mode 100644
index 00000000000..221e8408dad
--- /dev/null
+++ b/changelogs/unreleased/59053-no-oauth-for-cicd-github-fe.yml
@@ -0,0 +1,5 @@
+---
+title: Remove oauth form from GitHub CI/CD only import authentication
+merge_request: 31488
+author:
+type: changed
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 0568bdbdfca..4f3c8e8046d 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -996,9 +996,6 @@ msgstr ""
 msgid "Alternate support URL for help page and help dropdown"
 msgstr ""
 
-msgid "Alternatively, you can use a %{personal_access_token_link}. When you create your Personal Access Token, you will need to select the <code>repo</code> scope, so we can display a list of your public and private repositories which are available to import."
-msgstr ""
-
 msgid "Amount of time (in hours) that users are allowed to skip forced configuration of two-factor authentication"
 msgstr ""
 
@@ -1435,6 +1432,12 @@ msgstr ""
 msgid "August"
 msgstr ""
 
+msgid "Authenticate"
+msgstr ""
+
+msgid "Authenticate with GitHub"
+msgstr ""
+
 msgid "Authentication Log"
 msgstr ""
 
@@ -3431,6 +3434,9 @@ msgstr ""
 msgid "Create a personal access token on your account to pull or push via %{protocol}."
 msgstr ""
 
+msgid "Create and provide your GitHub %{link_start}Personal Access Token%{link_end}. You will need to select the <code>repo</code> scope, so we can display a list of your public and private repositories which are available to import."
+msgstr ""
+
 msgid "Create board"
 msgstr ""
 
@@ -6588,9 +6594,6 @@ msgstr ""
 msgid "List your Bitbucket Server repositories"
 msgstr ""
 
-msgid "List your GitHub repositories"
-msgstr ""
-
 msgid "Live preview"
 msgstr ""
 
@@ -11941,6 +11944,9 @@ msgstr ""
 msgid "To add the entry manually, provide the following details to the application on your phone."
 msgstr ""
 
+msgid "To connect GitHub repositories, you first need to authorize GitLab to access the list of your GitHub repositories."
+msgstr ""
+
 msgid "To define internal users, first enable new users set to external"
 msgstr ""
 
@@ -11959,12 +11965,6 @@ msgstr ""
 msgid "To help improve GitLab, we would like to periodically collect usage information. This can be changed at any time in %{settings_link_start}Settings%{link_end}. %{info_link_start}More Information%{link_end}"
 msgstr ""
 
-msgid "To import GitHub repositories, you can use a %{personal_access_token_link}. When you create your Personal Access Token, you will need to select the <code>repo</code> scope, so we can display a list of your public and private repositories which are available to import."
-msgstr ""
-
-msgid "To import GitHub repositories, you first need to authorize GitLab to access the list of your GitHub repositories:"
-msgstr ""
-
 msgid "To import an SVN repository, check out %{svn_link}."
 msgstr ""
 
@@ -13496,6 +13496,9 @@ msgstr ""
 msgid "done"
 msgstr ""
 
+msgid "e.g. %{token}"
+msgstr ""
+
 msgid "element is not a hierarchy"
 msgstr ""
 
diff --git a/qa/qa/page/project/import/github.rb b/qa/qa/page/project/import/github.rb
index 5973a5a958e..cc0c4e1e835 100644
--- a/qa/qa/page/project/import/github.rb
+++ b/qa/qa/page/project/import/github.rb
@@ -9,7 +9,7 @@ module QA
 
           view 'app/views/import/github/new.html.haml' do
             element :personal_access_token_field, 'text_field_tag :personal_access_token' # rubocop:disable QA/ElementWithPattern
-            element :list_repos_button, "submit_tag _('List your GitHub repositories')" # rubocop:disable QA/ElementWithPattern
+            element :authenticate_button, "submit_tag _('Authenticate')" # rubocop:disable QA/ElementWithPattern
           end
 
           view 'app/assets/javascripts/import_projects/components/provider_repo_table_row.vue' do
diff --git a/spec/features/projects/new_project_spec.rb b/spec/features/projects/new_project_spec.rb
index 010a5de6930..22a0d268243 100644
--- a/spec/features/projects/new_project_spec.rb
+++ b/spec/features/projects/new_project_spec.rb
@@ -280,7 +280,7 @@ describe 'New project' do
         end
 
         it 'shows import instructions' do
-          expect(page).to have_content('Import repositories from GitHub')
+          expect(page).to have_content('Authenticate with GitHub')
           expect(current_path).to eq new_import_github_path
         end
       end
-- 
cgit v1.2.1


From 371e1ed3716d25f48c6458373e64ea81e0a45946 Mon Sep 17 00:00:00 2001
From: Denys Mishunov <dmishunov@gitlab.com>
Date: Thu, 22 Aug 2019 23:23:06 +0000
Subject: Always pre-select "Start a new merge request"

One exception: there is an existing MR for the current branch and the
branch is non-default and non-protected.

Extended mock_data for ide/stores to have different types of branches:
default, protected and regular

Cleaned new MR checkbox view
---
 .../ide/components/commit_sidebar/actions.vue      |  12 +-
 .../commit_sidebar/new_merge_request_option.vue    |  33 ++--
 app/assets/javascripts/ide/stores/getters.js       |   3 +
 .../ide/stores/modules/commit/actions.js           |  23 +--
 .../ide/stores/modules/commit/getters.js           |  12 +-
 .../ide/stores/modules/commit/mutation_types.js    |   1 -
 .../ide/stores/modules/commit/mutations.js         |   3 -
 .../javascripts/ide/stores/modules/commit/state.js |   3 +-
 .../unreleased/51470-webide-default-commit.yml     |   5 +
 qa/qa/page/project/web_ide/edit.rb                 |   5 +
 .../projects/tree/create_directory_spec.rb         |  13 +-
 spec/features/projects/tree/create_file_spec.rb    |   7 +-
 .../ide/stores/modules/commit/mutations_spec.js    |   8 -
 .../ide/components/commit_sidebar/actions_spec.js  | 188 +++++++++++++++++++--
 .../new_merge_request_option_spec.js               | 160 +++++++++++++++---
 spec/javascripts/ide/mock_data.js                  |  34 +++-
 spec/javascripts/ide/stores/getters_spec.js        |  32 ++++
 .../ide/stores/modules/commit/actions_spec.js      | 177 +++++--------------
 .../ide/stores/modules/commit/getters_spec.js      | 162 +++++++++++++++++-
 19 files changed, 619 insertions(+), 262 deletions(-)
 create mode 100644 changelogs/unreleased/51470-webide-default-commit.yml

diff --git a/app/assets/javascripts/ide/components/commit_sidebar/actions.vue b/app/assets/javascripts/ide/components/commit_sidebar/actions.vue
index 685d8a6b245..8b356ee6e97 100644
--- a/app/assets/javascripts/ide/components/commit_sidebar/actions.vue
+++ b/app/assets/javascripts/ide/components/commit_sidebar/actions.vue
@@ -41,10 +41,16 @@ export default {
   methods: {
     ...mapCommitActions(['updateCommitAction']),
     updateSelectedCommitAction() {
-      if (this.currentBranch && !this.currentBranch.can_push) {
-        this.updateCommitAction(consts.COMMIT_TO_NEW_BRANCH);
-      } else if (this.containsStagedChanges) {
+      if (!this.currentBranch) {
+        return;
+      }
+
+      const { can_push: canPush = false, default: isDefault = false } = this.currentBranch;
+
+      if (canPush && !isDefault) {
         this.updateCommitAction(consts.COMMIT_TO_CURRENT_BRANCH);
+      } else {
+        this.updateCommitAction(consts.COMMIT_TO_NEW_BRANCH);
       }
     },
   },
diff --git a/app/assets/javascripts/ide/components/commit_sidebar/new_merge_request_option.vue b/app/assets/javascripts/ide/components/commit_sidebar/new_merge_request_option.vue
index b2e7b15089c..daa44a42765 100644
--- a/app/assets/javascripts/ide/components/commit_sidebar/new_merge_request_option.vue
+++ b/app/assets/javascripts/ide/components/commit_sidebar/new_merge_request_option.vue
@@ -1,43 +1,36 @@
 <script>
-import { mapGetters, createNamespacedHelpers } from 'vuex';
+import { createNamespacedHelpers } from 'vuex';
 
 const {
   mapState: mapCommitState,
-  mapGetters: mapCommitGetters,
   mapActions: mapCommitActions,
+  mapGetters: mapCommitGetters,
 } = createNamespacedHelpers('commit');
 
 export default {
   computed: {
     ...mapCommitState(['shouldCreateMR']),
-    ...mapCommitGetters(['isCommittingToCurrentBranch', 'isCommittingToDefaultBranch']),
-    ...mapGetters(['hasMergeRequest', 'isOnDefaultBranch']),
-    currentBranchHasMr() {
-      return this.hasMergeRequest && this.isCommittingToCurrentBranch;
-    },
-    showNewMrOption() {
-      return (
-        this.isCommittingToDefaultBranch || !this.currentBranchHasMr || this.isCommittingToNewBranch
-      );
-    },
-  },
-  mounted() {
-    this.setShouldCreateMR();
+    ...mapCommitGetters(['shouldHideNewMrOption']),
   },
   methods: {
-    ...mapCommitActions(['toggleShouldCreateMR', 'setShouldCreateMR']),
+    ...mapCommitActions(['toggleShouldCreateMR']),
   },
 };
 </script>
 
 <template>
-  <div v-if="showNewMrOption">
+  <fieldset v-if="!shouldHideNewMrOption">
     <hr class="my-2" />
-    <label class="mb-0">
-      <input :checked="shouldCreateMR" type="checkbox" @change="toggleShouldCreateMR" />
+    <label class="mb-0 js-ide-commit-new-mr">
+      <input
+        :checked="shouldCreateMR"
+        type="checkbox"
+        data-qa-selector="start_new_mr_checkbox"
+        @change="toggleShouldCreateMR"
+      />
       <span class="prepend-left-10">
         {{ __('Start a new merge request') }}
       </span>
     </label>
-  </div>
+  </fieldset>
 </template>
diff --git a/app/assets/javascripts/ide/stores/getters.js b/app/assets/javascripts/ide/stores/getters.js
index 406903129db..85fd45358be 100644
--- a/app/assets/javascripts/ide/stores/getters.js
+++ b/app/assets/javascripts/ide/stores/getters.js
@@ -104,5 +104,8 @@ export const packageJson = state => state.entries[packageJsonPath];
 export const isOnDefaultBranch = (_state, getters) =>
   getters.currentProject && getters.currentProject.default_branch === getters.branchName;
 
+export const canPushToBranch = (_state, getters) =>
+  getters.currentBranch && getters.currentBranch.can_push;
+
 // prevent babel-plugin-rewire from generating an invalid default during karma tests
 export default () => {};
diff --git a/app/assets/javascripts/ide/stores/modules/commit/actions.js b/app/assets/javascripts/ide/stores/modules/commit/actions.js
index ac34491c1ad..23caf2d48ed 100644
--- a/app/assets/javascripts/ide/stores/modules/commit/actions.js
+++ b/app/assets/javascripts/ide/stores/modules/commit/actions.js
@@ -18,34 +18,15 @@ export const discardDraft = ({ commit }) => {
   commit(types.UPDATE_COMMIT_MESSAGE, '');
 };
 
-export const updateCommitAction = ({ commit, dispatch }, commitAction) => {
+export const updateCommitAction = ({ commit, getters }, commitAction) => {
   commit(types.UPDATE_COMMIT_ACTION, {
     commitAction,
   });
-  dispatch('setShouldCreateMR');
+  commit(types.TOGGLE_SHOULD_CREATE_MR, !getters.shouldHideNewMrOption);
 };
 
 export const toggleShouldCreateMR = ({ commit }) => {
   commit(types.TOGGLE_SHOULD_CREATE_MR);
-  commit(types.INTERACT_WITH_NEW_MR);
-};
-
-export const setShouldCreateMR = ({
-  commit,
-  getters,
-  rootGetters,
-  state: { interactedWithNewMR },
-}) => {
-  const committingToExistingMR =
-    getters.isCommittingToCurrentBranch &&
-    rootGetters.hasMergeRequest &&
-    !rootGetters.isOnDefaultBranch;
-
-  if ((getters.isCommittingToDefaultBranch && !interactedWithNewMR) || committingToExistingMR) {
-    commit(types.TOGGLE_SHOULD_CREATE_MR, false);
-  } else if (!interactedWithNewMR) {
-    commit(types.TOGGLE_SHOULD_CREATE_MR, true);
-  }
 };
 
 export const updateBranchName = ({ commit }, branchName) => {
diff --git a/app/assets/javascripts/ide/stores/modules/commit/getters.js b/app/assets/javascripts/ide/stores/modules/commit/getters.js
index 64779e9e4df..de289e27199 100644
--- a/app/assets/javascripts/ide/stores/modules/commit/getters.js
+++ b/app/assets/javascripts/ide/stores/modules/commit/getters.js
@@ -20,7 +20,7 @@ export const placeholderBranchName = (state, _, rootState) =>
   )}`;
 
 export const branchName = (state, getters, rootState) => {
-  if (state.commitAction === consts.COMMIT_TO_NEW_BRANCH) {
+  if (getters.isCreatingNewBranch) {
     if (state.newBranchName === '') {
       return getters.placeholderBranchName;
     }
@@ -48,11 +48,11 @@ export const preBuiltCommitMessage = (state, _, rootState) => {
 
 export const isCreatingNewBranch = state => state.commitAction === consts.COMMIT_TO_NEW_BRANCH;
 
-export const isCommittingToCurrentBranch = state =>
-  state.commitAction === consts.COMMIT_TO_CURRENT_BRANCH;
-
-export const isCommittingToDefaultBranch = (_state, getters, _rootState, rootGetters) =>
-  getters.isCommittingToCurrentBranch && rootGetters.isOnDefaultBranch;
+export const shouldHideNewMrOption = (_state, getters, _rootState, rootGetters) =>
+  !getters.isCreatingNewBranch &&
+  (rootGetters.hasMergeRequest ||
+    (!rootGetters.hasMergeRequest && rootGetters.isOnDefaultBranch)) &&
+  rootGetters.canPushToBranch;
 
 // prevent babel-plugin-rewire from generating an invalid default during karma tests
 export default () => {};
diff --git a/app/assets/javascripts/ide/stores/modules/commit/mutation_types.js b/app/assets/javascripts/ide/stores/modules/commit/mutation_types.js
index b81918156b0..7ad8f3570b7 100644
--- a/app/assets/javascripts/ide/stores/modules/commit/mutation_types.js
+++ b/app/assets/javascripts/ide/stores/modules/commit/mutation_types.js
@@ -3,4 +3,3 @@ export const UPDATE_COMMIT_ACTION = 'UPDATE_COMMIT_ACTION';
 export const UPDATE_NEW_BRANCH_NAME = 'UPDATE_NEW_BRANCH_NAME';
 export const UPDATE_LOADING = 'UPDATE_LOADING';
 export const TOGGLE_SHOULD_CREATE_MR = 'TOGGLE_SHOULD_CREATE_MR';
-export const INTERACT_WITH_NEW_MR = 'INTERACT_WITH_NEW_MR';
diff --git a/app/assets/javascripts/ide/stores/modules/commit/mutations.js b/app/assets/javascripts/ide/stores/modules/commit/mutations.js
index 14957d283bb..73b618e250f 100644
--- a/app/assets/javascripts/ide/stores/modules/commit/mutations.js
+++ b/app/assets/javascripts/ide/stores/modules/commit/mutations.js
@@ -24,7 +24,4 @@ export default {
       shouldCreateMR: shouldCreateMR === undefined ? !state.shouldCreateMR : shouldCreateMR,
     });
   },
-  [types.INTERACT_WITH_NEW_MR](state) {
-    Object.assign(state, { interactedWithNewMR: true });
-  },
 };
diff --git a/app/assets/javascripts/ide/stores/modules/commit/state.js b/app/assets/javascripts/ide/stores/modules/commit/state.js
index 53647a7e3e3..259577e48e0 100644
--- a/app/assets/javascripts/ide/stores/modules/commit/state.js
+++ b/app/assets/javascripts/ide/stores/modules/commit/state.js
@@ -3,6 +3,5 @@ export default () => ({
   commitAction: '1',
   newBranchName: '',
   submitCommitLoading: false,
-  shouldCreateMR: false,
-  interactedWithNewMR: false,
+  shouldCreateMR: true,
 });
diff --git a/changelogs/unreleased/51470-webide-default-commit.yml b/changelogs/unreleased/51470-webide-default-commit.yml
new file mode 100644
index 00000000000..d64111e7ec3
--- /dev/null
+++ b/changelogs/unreleased/51470-webide-default-commit.yml
@@ -0,0 +1,5 @@
+---
+title: Updated WebIDE default commit options
+merge_request: 31449
+author:
+type: changed
diff --git a/qa/qa/page/project/web_ide/edit.rb b/qa/qa/page/project/web_ide/edit.rb
index b5a36862389..37bca97fec7 100644
--- a/qa/qa/page/project/web_ide/edit.rb
+++ b/qa/qa/page/project/web_ide/edit.rb
@@ -39,6 +39,10 @@ module QA
             element :commit_button
           end
 
+          view 'app/assets/javascripts/ide/components/commit_sidebar/new_merge_request_option.vue' do
+            element :start_new_mr_checkbox
+          end
+
           def has_file?(file_name)
             within_element(:file_list) do
               page.has_content? file_name
@@ -100,6 +104,7 @@ module QA
             # animation is still in process even when the buttons have the
             # expected visibility.
             commit_success_msg_shown = retry_until do
+              uncheck_element :start_new_mr_checkbox
               click_element :commit_button
 
               wait(reload: false) do
diff --git a/spec/features/projects/tree/create_directory_spec.rb b/spec/features/projects/tree/create_directory_spec.rb
index 7ac5da86702..99285011405 100644
--- a/spec/features/projects/tree/create_directory_spec.rb
+++ b/spec/features/projects/tree/create_directory_spec.rb
@@ -32,10 +32,12 @@ describe 'Multi-file editor new directory', :js do
       click_button('Create directory')
     end
 
+    expect(page).to have_content('folder name')
+
     first('.ide-tree-actions button').click
 
-    page.within('.modal-dialog') do
-      find('.form-control').set('file name')
+    page.within('.modal') do
+      find('.form-control').set('folder name/file name')
 
       click_button('Create file')
     end
@@ -44,13 +46,18 @@ describe 'Multi-file editor new directory', :js do
 
     find('.js-ide-commit-mode').click
 
-    find('.multi-file-commit-list-item').hover
     click_button 'Stage'
 
     fill_in('commit-message', with: 'commit message ide')
 
+    find(:css, ".js-ide-commit-new-mr input").set(false)
+
+    wait_for_requests
+
     page.within '.multi-file-commit-form' do
       click_button('Commit')
+
+      wait_for_requests
     end
 
     find('.js-ide-edit-mode').click
diff --git a/spec/features/projects/tree/create_file_spec.rb b/spec/features/projects/tree/create_file_spec.rb
index 00eefe9db42..780575a5975 100644
--- a/spec/features/projects/tree/create_file_spec.rb
+++ b/spec/features/projects/tree/create_file_spec.rb
@@ -36,15 +36,20 @@ describe 'Multi-file editor new file', :js do
 
     find('.js-ide-commit-mode').click
 
-    find('.multi-file-commit-list-item').hover
     click_button 'Stage'
 
     fill_in('commit-message', with: 'commit message ide')
 
+    find(:css, ".js-ide-commit-new-mr input").set(false)
+
     page.within '.multi-file-commit-form' do
       click_button('Commit')
+
+      wait_for_requests
     end
 
+    find('.js-ide-edit-mode').click
+
     expect(page).to have_content('file name')
   end
 end
diff --git a/spec/frontend/ide/stores/modules/commit/mutations_spec.js b/spec/frontend/ide/stores/modules/commit/mutations_spec.js
index 246500a2f34..45ac1a86ab3 100644
--- a/spec/frontend/ide/stores/modules/commit/mutations_spec.js
+++ b/spec/frontend/ide/stores/modules/commit/mutations_spec.js
@@ -62,12 +62,4 @@ describe('IDE commit module mutations', () => {
       expect(state.shouldCreateMR).toBe(false);
     });
   });
-
-  describe('INTERACT_WITH_NEW_MR', () => {
-    it('sets interactedWithNewMR to true', () => {
-      mutations.INTERACT_WITH_NEW_MR(state);
-
-      expect(state.interactedWithNewMR).toBe(true);
-    });
-  });
 });
diff --git a/spec/javascripts/ide/components/commit_sidebar/actions_spec.js b/spec/javascripts/ide/components/commit_sidebar/actions_spec.js
index b903abe63fc..a3db3ee1b18 100644
--- a/spec/javascripts/ide/components/commit_sidebar/actions_spec.js
+++ b/spec/javascripts/ide/components/commit_sidebar/actions_spec.js
@@ -1,30 +1,28 @@
 import Vue from 'vue';
-import store from '~/ide/stores';
-import consts from '~/ide/stores/modules/commit/constants';
+import { createStore } from '~/ide/stores';
 import commitActions from '~/ide/components/commit_sidebar/actions.vue';
+import consts from '~/ide/stores/modules/commit/constants';
 import { createComponentWithStore } from 'spec/helpers/vue_mount_component_helper';
-import { resetStore } from 'spec/ide/helpers';
-import { projectData } from 'spec/ide/mock_data';
+import { projectData, branches } from 'spec/ide/mock_data';
+
+const ACTION_UPDATE_COMMIT_ACTION = 'commit/updateCommitAction';
 
 describe('IDE commit sidebar actions', () => {
+  let store;
   let vm;
-  const createComponent = ({
-    hasMR = false,
-    commitAction = consts.COMMIT_TO_NEW_BRANCH,
-    mergeRequestsEnabled = true,
-    currentBranchId = 'master',
-    shouldCreateMR = false,
-  } = {}) => {
+
+  const createComponent = ({ hasMR = false, currentBranchId = 'master' } = {}) => {
     const Component = Vue.extend(commitActions);
 
     vm = createComponentWithStore(Component, store);
 
     vm.$store.state.currentBranchId = currentBranchId;
     vm.$store.state.currentProjectId = 'abcproject';
-    vm.$store.state.commit.commitAction = commitAction;
-    Vue.set(vm.$store.state.projects, 'abcproject', { ...projectData });
-    vm.$store.state.projects.abcproject.merge_requests_enabled = mergeRequestsEnabled;
-    vm.$store.state.commit.shouldCreateMR = shouldCreateMR;
+
+    const proj = { ...projectData };
+    proj.branches[currentBranchId] = branches.find(branch => branch.name === currentBranchId);
+
+    Vue.set(vm.$store.state.projects, 'abcproject', proj);
 
     if (hasMR) {
       vm.$store.state.currentMergeRequestId = '1';
@@ -33,13 +31,19 @@ describe('IDE commit sidebar actions', () => {
       ] = { foo: 'bar' };
     }
 
-    return vm.$mount();
+    vm.$mount();
+
+    return vm;
   };
 
+  beforeEach(() => {
+    store = createStore();
+    spyOn(store, 'dispatch');
+  });
+
   afterEach(() => {
     vm.$destroy();
-
-    resetStore(vm.$store);
+    vm = null;
   });
 
   it('renders 2 groups', () => {
@@ -73,4 +77,152 @@ describe('IDE commit sidebar actions', () => {
       expect(vm.commitToCurrentBranchText).not.toContain(injectedSrc);
     });
   });
+
+  describe('updateSelectedCommitAction', () => {
+    it('does not return anything if currentBranch does not exist', () => {
+      createComponent({ currentBranchId: null });
+
+      expect(vm.$store.dispatch).not.toHaveBeenCalled();
+    });
+
+    it('calls again after staged changes', done => {
+      createComponent({ currentBranchId: null });
+
+      vm.$store.state.currentBranchId = 'master';
+      vm.$store.state.changedFiles.push({});
+      vm.$store.state.stagedFiles.push({});
+
+      vm.$nextTick()
+        .then(() => {
+          expect(vm.$store.dispatch).toHaveBeenCalledWith(
+            ACTION_UPDATE_COMMIT_ACTION,
+            jasmine.anything(),
+          );
+        })
+        .then(done)
+        .catch(done.fail);
+    });
+
+    describe('default branch', () => {
+      it('dispatches correct action for default branch', () => {
+        createComponent({
+          currentBranchId: 'master',
+        });
+
+        expect(vm.$store.dispatch).toHaveBeenCalledTimes(1);
+        expect(vm.$store.dispatch).toHaveBeenCalledWith(
+          ACTION_UPDATE_COMMIT_ACTION,
+          consts.COMMIT_TO_NEW_BRANCH,
+        );
+      });
+    });
+
+    describe('protected branch', () => {
+      describe('with write access', () => {
+        it('dispatches correct action when MR exists', () => {
+          createComponent({
+            hasMR: true,
+            currentBranchId: 'protected/access',
+          });
+
+          expect(vm.$store.dispatch).toHaveBeenCalledWith(
+            ACTION_UPDATE_COMMIT_ACTION,
+            consts.COMMIT_TO_CURRENT_BRANCH,
+          );
+        });
+
+        it('dispatches correct action when MR does not exists', () => {
+          createComponent({
+            hasMR: false,
+            currentBranchId: 'protected/access',
+          });
+
+          expect(vm.$store.dispatch).toHaveBeenCalledWith(
+            ACTION_UPDATE_COMMIT_ACTION,
+            consts.COMMIT_TO_CURRENT_BRANCH,
+          );
+        });
+      });
+
+      describe('without write access', () => {
+        it('dispatches correct action when MR exists', () => {
+          createComponent({
+            hasMR: true,
+            currentBranchId: 'protected/no-access',
+          });
+
+          expect(vm.$store.dispatch).toHaveBeenCalledWith(
+            ACTION_UPDATE_COMMIT_ACTION,
+            consts.COMMIT_TO_NEW_BRANCH,
+          );
+        });
+
+        it('dispatches correct action when MR does not exists', () => {
+          createComponent({
+            hasMR: false,
+            currentBranchId: 'protected/no-access',
+          });
+
+          expect(vm.$store.dispatch).toHaveBeenCalledWith(
+            ACTION_UPDATE_COMMIT_ACTION,
+            consts.COMMIT_TO_NEW_BRANCH,
+          );
+        });
+      });
+    });
+
+    describe('regular branch', () => {
+      describe('with write access', () => {
+        it('dispatches correct action when MR exists', () => {
+          createComponent({
+            hasMR: true,
+            currentBranchId: 'regular',
+          });
+
+          expect(vm.$store.dispatch).toHaveBeenCalledWith(
+            ACTION_UPDATE_COMMIT_ACTION,
+            consts.COMMIT_TO_CURRENT_BRANCH,
+          );
+        });
+
+        it('dispatches correct action when MR does not exists', () => {
+          createComponent({
+            hasMR: false,
+            currentBranchId: 'regular',
+          });
+
+          expect(vm.$store.dispatch).toHaveBeenCalledWith(
+            ACTION_UPDATE_COMMIT_ACTION,
+            consts.COMMIT_TO_CURRENT_BRANCH,
+          );
+        });
+      });
+
+      describe('without write access', () => {
+        it('dispatches correct action when MR exists', () => {
+          createComponent({
+            hasMR: true,
+            currentBranchId: 'regular/no-access',
+          });
+
+          expect(vm.$store.dispatch).toHaveBeenCalledWith(
+            ACTION_UPDATE_COMMIT_ACTION,
+            consts.COMMIT_TO_NEW_BRANCH,
+          );
+        });
+
+        it('dispatches correct action when MR does not exists', () => {
+          createComponent({
+            hasMR: false,
+            currentBranchId: 'regular/no-access',
+          });
+
+          expect(vm.$store.dispatch).toHaveBeenCalledWith(
+            ACTION_UPDATE_COMMIT_ACTION,
+            consts.COMMIT_TO_NEW_BRANCH,
+          );
+        });
+      });
+    });
+  });
 });
diff --git a/spec/javascripts/ide/components/commit_sidebar/new_merge_request_option_spec.js b/spec/javascripts/ide/components/commit_sidebar/new_merge_request_option_spec.js
index 7017bfcd6a6..5f2db695241 100644
--- a/spec/javascripts/ide/components/commit_sidebar/new_merge_request_option_spec.js
+++ b/spec/javascripts/ide/components/commit_sidebar/new_merge_request_option_spec.js
@@ -1,33 +1,36 @@
 import Vue from 'vue';
 import store from '~/ide/stores';
-import consts from '~/ide/stores/modules/commit/constants';
 import NewMergeRequestOption from '~/ide/components/commit_sidebar/new_merge_request_option.vue';
 import { createComponentWithStore } from 'spec/helpers/vue_mount_component_helper';
-import { projectData } from 'spec/ide/mock_data';
+import { projectData, branches } from 'spec/ide/mock_data';
 import { resetStore } from 'spec/ide/helpers';
+import consts from '../../../../../app/assets/javascripts/ide/stores/modules/commit/constants';
 
 describe('create new MR checkbox', () => {
   let vm;
-  const createComponent = ({
-    hasMR = false,
-    commitAction = consts.COMMIT_TO_NEW_BRANCH,
-    currentBranchId = 'master',
-  } = {}) => {
+  const setMR = () => {
+    vm.$store.state.currentMergeRequestId = '1';
+    vm.$store.state.projects[store.state.currentProjectId].mergeRequests[
+      store.state.currentMergeRequestId
+    ] = { foo: 'bar' };
+  };
+
+  const createComponent = ({ currentBranchId = 'master', createNewBranch = false } = {}) => {
     const Component = Vue.extend(NewMergeRequestOption);
 
     vm = createComponentWithStore(Component, store);
 
+    vm.$store.state.commit.commitAction = createNewBranch
+      ? consts.COMMIT_TO_NEW_BRANCH
+      : consts.COMMIT_TO_CURRENT_BRANCH;
+
     vm.$store.state.currentBranchId = currentBranchId;
     vm.$store.state.currentProjectId = 'abcproject';
-    vm.$store.state.commit.commitAction = commitAction;
-    Vue.set(vm.$store.state.projects, 'abcproject', { ...projectData });
 
-    if (hasMR) {
-      vm.$store.state.currentMergeRequestId = '1';
-      vm.$store.state.projects[store.state.currentProjectId].mergeRequests[
-        store.state.currentMergeRequestId
-      ] = { foo: 'bar' };
-    }
+    const proj = JSON.parse(JSON.stringify(projectData));
+    proj.branches[currentBranchId] = branches.find(branch => branch.name === currentBranchId);
+
+    Vue.set(vm.$store.state.projects, 'abcproject', proj);
 
     return vm.$mount();
   };
@@ -38,30 +41,131 @@ describe('create new MR checkbox', () => {
     resetStore(vm.$store);
   });
 
-  it('is hidden when an MR already exists and committing to current branch', () => {
-    createComponent({
-      hasMR: true,
-      commitAction: consts.COMMIT_TO_CURRENT_BRANCH,
-      currentBranchId: 'feature',
+  describe('for default branch', () => {
+    describe('is rendered when pushing to a new branch', () => {
+      beforeEach(() => {
+        createComponent({
+          currentBranchId: 'master',
+          createNewBranch: true,
+        });
+      });
+
+      it('has NO new MR', () => {
+        expect(vm.$el.textContent).not.toBe('');
+      });
+
+      it('has new MR', done => {
+        setMR();
+
+        vm.$nextTick()
+          .then(() => {
+            expect(vm.$el.textContent).not.toBe('');
+          })
+          .then(done)
+          .catch(done.fail);
+      });
     });
 
-    expect(vm.$el.textContent).toBe('');
+    describe('is NOT rendered when pushing to the same branch', () => {
+      beforeEach(() => {
+        createComponent({
+          currentBranchId: 'master',
+          createNewBranch: false,
+        });
+      });
+
+      it('has NO new MR', () => {
+        expect(vm.$el.textContent).toBe('');
+      });
+
+      it('has new MR', done => {
+        setMR();
+
+        vm.$nextTick()
+          .then(() => {
+            expect(vm.$el.textContent).toBe('');
+          })
+          .then(done)
+          .catch(done.fail);
+      });
+    });
   });
 
-  it('does not hide checkbox if MR does not exist', () => {
-    createComponent({ hasMR: false });
+  describe('for protected branch', () => {
+    describe('when user does not have the write access', () => {
+      beforeEach(() => {
+        createComponent({
+          currentBranchId: 'protected/no-access',
+        });
+      });
+
+      it('is rendered if MR does not exists', () => {
+        expect(vm.$el.textContent).not.toBe('');
+      });
+
+      it('is rendered if MR exists', done => {
+        setMR();
 
-    expect(vm.$el.querySelector('input[type="checkbox"]').hidden).toBe(false);
+        vm.$nextTick()
+          .then(() => {
+            expect(vm.$el.textContent).not.toBe('');
+          })
+          .then(done)
+          .catch(done.fail);
+      });
+    });
+
+    describe('when user has the write access', () => {
+      beforeEach(() => {
+        createComponent({
+          currentBranchId: 'protected/access',
+        });
+      });
+
+      it('is rendered if MR does not exist', () => {
+        expect(vm.$el.textContent).not.toBe('');
+      });
+
+      it('is hidden if MR exists', done => {
+        setMR();
+
+        vm.$nextTick()
+          .then(() => {
+            expect(vm.$el.textContent).toBe('');
+          })
+          .then(done)
+          .catch(done.fail);
+      });
+    });
   });
 
-  it('does not hide checkbox when creating a new branch', () => {
-    createComponent({ commitAction: consts.COMMIT_TO_NEW_BRANCH });
+  describe('for regular branch', () => {
+    beforeEach(() => {
+      createComponent({
+        currentBranchId: 'regular',
+      });
+    });
 
-    expect(vm.$el.querySelector('input[type="checkbox"]').hidden).toBe(false);
+    it('is rendered if no MR exists', () => {
+      expect(vm.$el.textContent).not.toBe('');
+    });
+
+    it('is hidden if MR exists', done => {
+      setMR();
+
+      vm.$nextTick()
+        .then(() => {
+          expect(vm.$el.textContent).toBe('');
+        })
+        .then(done)
+        .catch(done.fail);
+    });
   });
 
   it('dispatches toggleShouldCreateMR when clicking checkbox', () => {
-    createComponent();
+    createComponent({
+      currentBranchId: 'regular',
+    });
     const el = vm.$el.querySelector('input[type="checkbox"]');
     spyOn(vm.$store, 'dispatch');
     el.dispatchEvent(new Event('change'));
diff --git a/spec/javascripts/ide/mock_data.js b/spec/javascripts/ide/mock_data.js
index 570a396c5e3..c02c7e5d45e 100644
--- a/spec/javascripts/ide/mock_data.js
+++ b/spec/javascripts/ide/mock_data.js
@@ -176,23 +176,51 @@ export const branches = [
       committed_date: '2018-08-01T00:20:05Z',
     },
     can_push: true,
+    protected: true,
+    default: true,
   },
   {
     id: 2,
-    name: 'feature/lorem-ipsum',
+    name: 'protected/no-access',
     commit: {
       message: 'Update some stuff',
       committed_date: '2018-08-02T00:00:05Z',
     },
-    can_push: true,
+    can_push: false,
+    protected: true,
+    default: false,
   },
   {
     id: 3,
-    name: 'feature/dolar-amit',
+    name: 'protected/access',
+    commit: {
+      message: 'Update some stuff',
+      committed_date: '2018-08-02T00:00:05Z',
+    },
+    can_push: true,
+    protected: true,
+    default: false,
+  },
+  {
+    id: 4,
+    name: 'regular',
     commit: {
       message: 'Update some more stuff',
       committed_date: '2018-06-30T00:20:05Z',
     },
     can_push: true,
+    protected: false,
+    default: false,
+  },
+  {
+    id: 5,
+    name: 'regular/no-access',
+    commit: {
+      message: 'Update some more stuff',
+      committed_date: '2018-06-30T00:20:05Z',
+    },
+    can_push: false,
+    protected: false,
+    default: false,
   },
 ];
diff --git a/spec/javascripts/ide/stores/getters_spec.js b/spec/javascripts/ide/stores/getters_spec.js
index 735bbd47f55..73a8d993a13 100644
--- a/spec/javascripts/ide/stores/getters_spec.js
+++ b/spec/javascripts/ide/stores/getters_spec.js
@@ -221,4 +221,36 @@ describe('IDE store getters', () => {
       });
     });
   });
+
+  describe('canPushToBranch', () => {
+    it('returns false when no currentBranch exists', () => {
+      const localGetters = {
+        currentProject: undefined,
+      };
+
+      expect(getters.canPushToBranch({}, localGetters)).toBeFalsy();
+    });
+
+    it('returns true when can_push to currentBranch', () => {
+      const localGetters = {
+        currentProject: {
+          default_branch: 'master',
+        },
+        currentBranch: { can_push: true },
+      };
+
+      expect(getters.canPushToBranch({}, localGetters)).toBeTruthy();
+    });
+
+    it('returns false when !can_push to currentBranch', () => {
+      const localGetters = {
+        currentProject: {
+          default_branch: 'master',
+        },
+        currentBranch: { can_push: false },
+      };
+
+      expect(getters.canPushToBranch({}, localGetters)).toBeFalsy();
+    });
+  });
 });
diff --git a/spec/javascripts/ide/stores/modules/commit/actions_spec.js b/spec/javascripts/ide/stores/modules/commit/actions_spec.js
index 14d861f21d2..091b454c0d2 100644
--- a/spec/javascripts/ide/stores/modules/commit/actions_spec.js
+++ b/spec/javascripts/ide/stores/modules/commit/actions_spec.js
@@ -57,6 +57,44 @@ describe('IDE commit module actions', () => {
         .then(done)
         .catch(done.fail);
     });
+
+    it('sets shouldCreateMR to true if "Create new MR" option is visible', done => {
+      store.state.shouldHideNewMrOption = false;
+
+      testAction(
+        actions.updateCommitAction,
+        {},
+        store.state,
+        [
+          {
+            type: mutationTypes.UPDATE_COMMIT_ACTION,
+            payload: { commitAction: jasmine.anything() },
+          },
+          { type: mutationTypes.TOGGLE_SHOULD_CREATE_MR, payload: true },
+        ],
+        [],
+        done,
+      );
+    });
+
+    it('sets shouldCreateMR to false if "Create new MR" option is hidden', done => {
+      store.state.shouldHideNewMrOption = true;
+
+      testAction(
+        actions.updateCommitAction,
+        {},
+        store.state,
+        [
+          {
+            type: mutationTypes.UPDATE_COMMIT_ACTION,
+            payload: { commitAction: jasmine.anything() },
+          },
+          { type: mutationTypes.TOGGLE_SHOULD_CREATE_MR, payload: false },
+        ],
+        [],
+        done,
+      );
+    });
   });
 
   describe('updateBranchName', () => {
@@ -541,147 +579,10 @@ describe('IDE commit module actions', () => {
         actions.toggleShouldCreateMR,
         {},
         store.state,
-        [
-          { type: mutationTypes.TOGGLE_SHOULD_CREATE_MR },
-          { type: mutationTypes.INTERACT_WITH_NEW_MR },
-        ],
+        [{ type: mutationTypes.TOGGLE_SHOULD_CREATE_MR }],
         [],
         done,
       );
     });
   });
-
-  describe('setShouldCreateMR', () => {
-    beforeEach(() => {
-      store.state.projects = {
-        project: {
-          default_branch: 'master',
-          branches: {
-            master: {
-              name: 'master',
-            },
-            feature: {
-              name: 'feature',
-            },
-          },
-        },
-      };
-
-      store.state.currentProjectId = 'project';
-    });
-
-    it('sets to false when the current branch already has an MR', done => {
-      store.state.commit.currentMergeRequestId = 1;
-      store.state.commit.commitAction = consts.COMMIT_TO_CURRENT_BRANCH;
-      store.state.currentMergeRequestId = '1';
-      store.state.currentBranchId = 'feature';
-      spyOn(store, 'commit').and.callThrough();
-
-      store
-        .dispatch('commit/setShouldCreateMR')
-        .then(() => {
-          expect(store.commit.calls.allArgs()[0]).toEqual(
-            jasmine.arrayContaining([`commit/${mutationTypes.TOGGLE_SHOULD_CREATE_MR}`, false]),
-          );
-          done();
-        })
-        .catch(done.fail);
-    });
-
-    it('changes to false when current branch is the default branch and user has not interacted', done => {
-      store.state.commit.interactedWithNewMR = false;
-      store.state.currentBranchId = 'master';
-      store.state.commit.commitAction = consts.COMMIT_TO_CURRENT_BRANCH;
-      spyOn(store, 'commit').and.callThrough();
-
-      store
-        .dispatch('commit/setShouldCreateMR')
-        .then(() => {
-          expect(store.commit.calls.allArgs()[0]).toEqual(
-            jasmine.arrayContaining([`commit/${mutationTypes.TOGGLE_SHOULD_CREATE_MR}`, false]),
-          );
-          done();
-        })
-        .catch(done.fail);
-    });
-
-    it('changes to true when "create new branch" is selected and user has not interacted', done => {
-      store.state.commit.commitAction = consts.COMMIT_TO_NEW_BRANCH;
-      store.state.commit.interactedWithNewMR = false;
-      spyOn(store, 'commit').and.callThrough();
-
-      store
-        .dispatch('commit/setShouldCreateMR')
-        .then(() => {
-          expect(store.commit.calls.allArgs()[0]).toEqual(
-            jasmine.arrayContaining([`commit/${mutationTypes.TOGGLE_SHOULD_CREATE_MR}`, true]),
-          );
-          done();
-        })
-        .catch(done.fail);
-    });
-
-    it('does not change anything if user has interacted and comitting to new branch', done => {
-      store.state.commit.commitAction = consts.COMMIT_TO_NEW_BRANCH;
-      store.state.commit.interactedWithNewMR = true;
-      spyOn(store, 'commit').and.callThrough();
-
-      store
-        .dispatch('commit/setShouldCreateMR')
-        .then(() => {
-          expect(store.commit).not.toHaveBeenCalled();
-          done();
-        })
-        .catch(done.fail);
-    });
-
-    it('does not change anything if user has interacted and comitting to branch without MR', done => {
-      store.state.commit.commitAction = consts.COMMIT_TO_CURRENT_BRANCH;
-      store.state.commit.currentMergeRequestId = null;
-      store.state.commit.interactedWithNewMR = true;
-      spyOn(store, 'commit').and.callThrough();
-
-      store
-        .dispatch('commit/setShouldCreateMR')
-        .then(() => {
-          expect(store.commit).not.toHaveBeenCalled();
-          done();
-        })
-        .catch(done.fail);
-    });
-
-    it('still changes to false if hiding the checkbox', done => {
-      store.state.currentBranchId = 'feature';
-      store.state.commit.commitAction = consts.COMMIT_TO_CURRENT_BRANCH;
-      store.state.currentMergeRequestId = '1';
-      store.state.commit.interactedWithNewMR = true;
-      spyOn(store, 'commit').and.callThrough();
-
-      store
-        .dispatch('commit/setShouldCreateMR')
-        .then(() => {
-          expect(store.commit.calls.allArgs()[0]).toEqual(
-            jasmine.arrayContaining([`commit/${mutationTypes.TOGGLE_SHOULD_CREATE_MR}`, false]),
-          );
-          done();
-        })
-        .catch(done.fail);
-    });
-
-    it('does not change to false when on master and user has interacted even if MR exists', done => {
-      store.state.currentBranchId = 'master';
-      store.state.commit.commitAction = consts.COMMIT_TO_CURRENT_BRANCH;
-      store.state.currentMergeRequestId = '1';
-      store.state.commit.interactedWithNewMR = true;
-      spyOn(store, 'commit').and.callThrough();
-
-      store
-        .dispatch('commit/setShouldCreateMR')
-        .then(() => {
-          expect(store.commit).not.toHaveBeenCalled();
-          done();
-        })
-        .catch(done.fail);
-    });
-  });
 });
diff --git a/spec/javascripts/ide/stores/modules/commit/getters_spec.js b/spec/javascripts/ide/stores/modules/commit/getters_spec.js
index 6e71a790deb..07445c22917 100644
--- a/spec/javascripts/ide/stores/modules/commit/getters_spec.js
+++ b/spec/javascripts/ide/stores/modules/commit/getters_spec.js
@@ -1,6 +1,6 @@
 import commitState from '~/ide/stores/modules/commit/state';
-import consts from '~/ide/stores/modules/commit/constants';
 import * as getters from '~/ide/stores/modules/commit/getters';
+import consts from '~/ide/stores/modules/commit/constants';
 
 describe('IDE commit module getters', () => {
   let state;
@@ -55,15 +55,15 @@ describe('IDE commit module getters', () => {
       });
     });
 
-    it('defualts to currentBranchId', () => {
-      expect(getters.branchName(state, null, rootState)).toBe('master');
+    it('defaults to currentBranchId when not committing to a new branch', () => {
+      localGetters.isCreatingNewBranch = false;
+
+      expect(getters.branchName(state, localGetters, rootState)).toBe('master');
     });
 
-    describe('COMMIT_TO_NEW_BRANCH', () => {
+    describe('commit to a new branch', () => {
       beforeEach(() => {
-        Object.assign(state, {
-          commitAction: consts.COMMIT_TO_NEW_BRANCH,
-        });
+        localGetters.isCreatingNewBranch = true;
       });
 
       it('uses newBranchName when not empty', () => {
@@ -144,4 +144,152 @@ describe('IDE commit module getters', () => {
       });
     });
   });
+
+  describe('isCreatingNewBranch', () => {
+    it('returns false if NOT creating a new branch', () => {
+      state.commitAction = consts.COMMIT_TO_CURRENT_BRANCH;
+
+      expect(getters.isCreatingNewBranch(state)).toBeFalsy();
+    });
+
+    it('returns true if creating a new branch', () => {
+      state.commitAction = consts.COMMIT_TO_NEW_BRANCH;
+
+      expect(getters.isCreatingNewBranch(state)).toBeTruthy();
+    });
+  });
+
+  describe('shouldHideNewMrOption', () => {
+    let localGetters = {};
+    let rootGetters = {};
+
+    beforeEach(() => {
+      localGetters = {
+        isCreatingNewBranch: null,
+      };
+      rootGetters = {
+        isOnDefaultBranch: null,
+        hasMergeRequest: null,
+        canPushToBranch: null,
+      };
+    });
+
+    describe('NO existing MR for the branch', () => {
+      beforeEach(() => {
+        rootGetters.hasMergeRequest = false;
+      });
+
+      it('should never hide "New MR" option', () => {
+        expect(getters.shouldHideNewMrOption(state, localGetters, null, rootGetters)).toBeFalsy();
+      });
+    });
+
+    describe('existing MR for the branch', () => {
+      beforeEach(() => {
+        rootGetters.hasMergeRequest = true;
+      });
+
+      it('should NOT hide "New MR" option if user can NOT push to the current branch', () => {
+        rootGetters.canPushToBranch = false;
+
+        expect(getters.shouldHideNewMrOption(state, localGetters, null, rootGetters)).toBeFalsy();
+      });
+
+      it('should hide "New MR" option if user can push to the current branch', () => {
+        rootGetters.canPushToBranch = true;
+
+        expect(getters.shouldHideNewMrOption(state, localGetters, null, rootGetters)).toBeTruthy();
+      });
+    });
+
+    describe('user can NOT push the branch', () => {
+      beforeEach(() => {
+        rootGetters.canPushToBranch = false;
+      });
+
+      it('should never hide "New MR" option', () => {
+        expect(getters.shouldHideNewMrOption(state, localGetters, null, rootGetters)).toBeFalsy();
+      });
+    });
+
+    describe('user can push to the branch', () => {
+      beforeEach(() => {
+        rootGetters.canPushToBranch = true;
+      });
+
+      it('should NOT hide "New MR" option if there is NO existing MR for the current branch', () => {
+        rootGetters.hasMergeRequest = false;
+
+        expect(getters.shouldHideNewMrOption(state, localGetters, null, rootGetters)).toBeFalsy();
+      });
+
+      it('should hide "New MR" option if there is existing MR for the current branch', () => {
+        rootGetters.hasMergeRequest = true;
+
+        expect(getters.shouldHideNewMrOption(state, localGetters, null, rootGetters)).toBeTruthy();
+      });
+    });
+
+    describe('default branch', () => {
+      beforeEach(() => {
+        rootGetters.isOnDefaultBranch = true;
+      });
+
+      describe('committing to the same branch', () => {
+        beforeEach(() => {
+          localGetters.isCreatingNewBranch = false;
+          rootGetters.canPushToBranch = true;
+        });
+
+        it('should hide "New MR" when there is an existing MR', () => {
+          rootGetters.hasMergeRequest = true;
+
+          expect(
+            getters.shouldHideNewMrOption(state, localGetters, null, rootGetters),
+          ).toBeTruthy();
+        });
+
+        it('should hide "New MR" when there is no existing MR', () => {
+          rootGetters.hasMergeRequest = false;
+
+          expect(
+            getters.shouldHideNewMrOption(state, localGetters, null, rootGetters),
+          ).toBeTruthy();
+        });
+      });
+
+      describe('creating a new branch', () => {
+        beforeEach(() => {
+          localGetters.isCreatingNewBranch = true;
+        });
+
+        it('should NOT hide "New MR" option no matter existence of an MR or write access', () => {
+          rootGetters.hasMergeRequest = false;
+          rootGetters.canPushToBranch = true;
+
+          expect(getters.shouldHideNewMrOption(state, localGetters, null, rootGetters)).toBeFalsy();
+
+          rootGetters.hasMergeRequest = true;
+          rootGetters.canPushToBranch = true;
+
+          expect(getters.shouldHideNewMrOption(state, localGetters, null, rootGetters)).toBeFalsy();
+
+          rootGetters.hasMergeRequest = false;
+          rootGetters.canPushToBranch = false;
+
+          expect(getters.shouldHideNewMrOption(state, localGetters, null, rootGetters)).toBeFalsy();
+        });
+      });
+    });
+
+    it('should never hide "New MR" option when creating a new branch', () => {
+      localGetters.isCreatingNewBranch = true;
+
+      rootGetters.isOnDefaultBranch = false;
+      rootGetters.hasMergeRequest = true;
+      rootGetters.canPushToBranch = true;
+
+      expect(getters.shouldHideNewMrOption(state, localGetters, null, rootGetters)).toBeFalsy();
+    });
+  });
 });
-- 
cgit v1.2.1


From a50703f1e630d811a828b1c1f4834a687208d0d5 Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Fri, 23 Aug 2019 12:52:35 +1200
Subject: Fix frozen string error

---
 lib/gitlab/quick_actions/substitution_definition.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/gitlab/quick_actions/substitution_definition.rb b/lib/gitlab/quick_actions/substitution_definition.rb
index 2f78ea05cf0..0fda056a4fe 100644
--- a/lib/gitlab/quick_actions/substitution_definition.rb
+++ b/lib/gitlab/quick_actions/substitution_definition.rb
@@ -17,8 +17,9 @@ module Gitlab
         return unless content
 
         all_names.each do |a_name|
-          content.gsub!(%r{/#{a_name} ?(.*)$}i, execute_block(action_block, context, '\1'))
+          content = content.gsub(%r{/#{a_name} ?(.*)$}i, execute_block(action_block, context, '\1'))
         end
+
         content
       end
     end
-- 
cgit v1.2.1


From 08fcb2379e8e39408a3c2457b036fd6a8c28d5f8 Mon Sep 17 00:00:00 2001
From: Tiger <twatson@gitlab.com>
Date: Fri, 23 Aug 2019 14:19:51 +1000
Subject: CE port: allow SRV records in DB service discovery

---
 doc/administration/database_load_balancing.md |  7 ++++++-
 lib/gitlab/database.rb                        |  3 ++-
 spec/lib/gitlab/database_spec.rb              | 11 +++++++++++
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/doc/administration/database_load_balancing.md b/doc/administration/database_load_balancing.md
index dc4cc401fca..64eca0b00f6 100644
--- a/doc/administration/database_load_balancing.md
+++ b/doc/administration/database_load_balancing.md
@@ -122,6 +122,7 @@ production:
     discover:
       nameserver: localhost
       record: secondary.postgresql.service.consul
+      record_type: A
       port: 8600
       interval: 60
       disconnect_timeout: 120
@@ -137,12 +138,16 @@ The following options can be set:
 | Option               | Description                                                                                       | Default   |
 |----------------------|---------------------------------------------------------------------------------------------------|-----------|
 | `nameserver`         | The nameserver to use for looking up the DNS record.                                              | localhost |
-| `record`             | The A record to look up. This option is required for service discovery to work.                   |           |
+| `record`             | The record to look up. This option is required for service discovery to work.                     |           |
+| `record_type`        | Optional record type to look up, this can be either A or SRV (since GitLab 12.3)                  | A         |
 | `port`               | The port of the nameserver.                                                                       | 8600      |
 | `interval`           | The minimum time in seconds between checking the DNS record.                                      | 60        |
 | `disconnect_timeout` | The time in seconds after which an old connection is closed, after the list of hosts was updated. | 120       |
 | `use_tcp`            | Lookup DNS resources using TCP instead of UDP                                                     | false     |
 
+If `record_type` is set to `SRV`, GitLab will continue to use a round-robin algorithm
+and will ignore the `weight` and `priority` in the record.
+
 The `interval` value specifies the _minimum_ time between checks. If the A
 record has a TTL greater than this value, then service discovery will honor said
 TTL. For example, if the TTL of the A record is 90 seconds, then service
diff --git a/lib/gitlab/database.rb b/lib/gitlab/database.rb
index cbdff0ab060..a12bbededc4 100644
--- a/lib/gitlab/database.rb
+++ b/lib/gitlab/database.rb
@@ -195,13 +195,14 @@ module Gitlab
 
     # pool_size - The size of the DB pool.
     # host - An optional host name to use instead of the default one.
-    def self.create_connection_pool(pool_size, host = nil)
+    def self.create_connection_pool(pool_size, host = nil, port = nil)
       # See activerecord-4.2.7.1/lib/active_record/connection_adapters/connection_specification.rb
       env = Rails.env
       original_config = ActiveRecord::Base.configurations
 
       env_config = original_config[env].merge('pool' => pool_size)
       env_config['host'] = host if host
+      env_config['port'] = port if port
 
       config = original_config.merge(env => env_config)
 
diff --git a/spec/lib/gitlab/database_spec.rb b/spec/lib/gitlab/database_spec.rb
index 77e58b6d5c7..8d37de32179 100644
--- a/spec/lib/gitlab/database_spec.rb
+++ b/spec/lib/gitlab/database_spec.rb
@@ -347,6 +347,17 @@ describe Gitlab::Database do
         pool.disconnect!
       end
     end
+
+    it 'allows setting of a custom hostname and port' do
+      pool = described_class.create_connection_pool(5, '127.0.0.1', 5432)
+
+      begin
+        expect(pool.spec.config[:host]).to eq('127.0.0.1')
+        expect(pool.spec.config[:port]).to eq(5432)
+      ensure
+        pool.disconnect!
+      end
+    end
   end
 
   describe '.cached_column_exists?' do
-- 
cgit v1.2.1


From 529564406378490786f8aafb040d03b60aafb998 Mon Sep 17 00:00:00 2001
From: Alexander Tanayno <atanayno@gitlab.com>
Date: Fri, 23 Aug 2019 05:02:37 +0000
Subject: Update syntax of needs example

---
 doc/ci/yaml/README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md
index 89a61b2a9e3..73960cb176c 100644
--- a/doc/ci/yaml/README.md
+++ b/doc/ci/yaml/README.md
@@ -1700,19 +1700,19 @@ mac:build:
 
 linux:rspec:
   stage: test
-  needs: [linux:build]
+  needs: ["linux:build"]
 
 linux:rubocop:
   stage: test
-  needs: [linux:build]
+  needs: ["linux:build"]
 
 mac:rspec:
   stage: test
-  needs: [mac:build]
+  needs: ["mac:build"]
 
 mac:rubocop:
   stage: test
-  needs: [mac:build]
+  needs: ["mac:build"]
 
 production:
   stage: deploy
-- 
cgit v1.2.1


From e24b9c2502613cc0df5b2a676236d1c36c02bca4 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Thu, 22 Aug 2019 00:19:44 -0700
Subject: Eliminate Gitaly N+1 queries with notes API

Similar to https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/31834,
we see that in https://gitlab.com/gitlab-org/gitlab-ce/issues/65957
there can be hundreds, even thousands, of Gitaly requests in the
`/api/:version/projects/:id/merge_requests/:noteable_id/notes` endpoint.

Previously, the API to retrieve notes generated hundreds of Gitaly calls
to determine whether a system note should be shown to the user. It did
this by:

1. Rendering the Markdown
2. Extracting cross-references from the Markdown
3. Issuing a Gitaly `FindCommit` RPC for every reference to validate
that the commit exists.

The last step is unnecessary because we don't need to display a commit
if the user doesn't have access to the project in the first place.
`RendersNotes#prepare_notes_for_rendering` is already used in
`MergeRequestsController`, which is why we don't see N+1 Gitaly calls
there. We use it here to optimize the note redaction process.
---
 .../sh-eliminate-gitaly-nplus-one-notes.yml        |  5 ++
 lib/api/helpers/notes_helpers.rb                   |  2 +
 lib/api/notes.rb                                   | 13 +++---
 spec/requests/api/discussions_spec.rb              | 54 ++--------------------
 spec/requests/api/notes_spec.rb                    |  7 +++
 .../shared_examples/requests/api/discussions.rb    | 54 ++++++++++++++++++++++
 6 files changed, 78 insertions(+), 57 deletions(-)
 create mode 100644 changelogs/unreleased/sh-eliminate-gitaly-nplus-one-notes.yml

diff --git a/changelogs/unreleased/sh-eliminate-gitaly-nplus-one-notes.yml b/changelogs/unreleased/sh-eliminate-gitaly-nplus-one-notes.yml
new file mode 100644
index 00000000000..00523f53dd7
--- /dev/null
+++ b/changelogs/unreleased/sh-eliminate-gitaly-nplus-one-notes.yml
@@ -0,0 +1,5 @@
+---
+title: Eliminate Gitaly N+1 queries with notes API
+merge_request: 32089
+author:
+type: performance
diff --git a/lib/api/helpers/notes_helpers.rb b/lib/api/helpers/notes_helpers.rb
index 6bf9057fad7..b2bf6bf7417 100644
--- a/lib/api/helpers/notes_helpers.rb
+++ b/lib/api/helpers/notes_helpers.rb
@@ -3,6 +3,8 @@
 module API
   module Helpers
     module NotesHelpers
+      include ::RendersNotes
+
       def self.noteable_types
         # This is a method instead of a constant, allowing EE to more easily
         # extend it.
diff --git a/lib/api/notes.rb b/lib/api/notes.rb
index 9381f045144..84563d66ee8 100644
--- a/lib/api/notes.rb
+++ b/lib/api/notes.rb
@@ -36,12 +36,13 @@ module API
           # page can have less elements than :per_page even if
           # there's more than one page.
           raw_notes = noteable.notes.with_metadata.reorder(order_options_with_tie_breaker)
-          notes =
-            # paginate() only works with a relation. This could lead to a
-            # mismatch between the pagination headers info and the actual notes
-            # array returned, but this is really a edge-case.
-            paginate(raw_notes)
-            .reject { |n| n.cross_reference_not_visible_for?(current_user) }
+
+          # paginate() only works with a relation. This could lead to a
+          # mismatch between the pagination headers info and the actual notes
+          # array returned, but this is really a edge-case.
+          notes = paginate(raw_notes)
+          notes = prepare_notes_for_rendering(notes)
+          notes = notes.reject { |n| n.cross_reference_not_visible_for?(current_user) }
           present notes, with: Entities::Note
         end
         # rubocop: enable CodeReuse/ActiveRecord
diff --git a/spec/requests/api/discussions_spec.rb b/spec/requests/api/discussions_spec.rb
index ef09c6effbb..0420201efe3 100644
--- a/spec/requests/api/discussions_spec.rb
+++ b/spec/requests/api/discussions_spec.rb
@@ -9,59 +9,11 @@ describe API::Discussions do
     project.add_developer(user)
   end
 
-  context 'with cross-reference system notes', :request_store do
-    let(:merge_request) { create(:merge_request) }
-    let(:project) { merge_request.project }
-    let(:new_merge_request) { create(:merge_request) }
-    let(:commit) { new_merge_request.project.commit }
-    let!(:note) { create(:system_note, noteable: merge_request, project: project, note: cross_reference) }
-    let!(:note_metadata) { create(:system_note_metadata, note: note, action: 'cross_reference') }
-    let(:cross_reference) { "test commit #{commit.to_reference(project)}" }
-    let(:pat) { create(:personal_access_token, user: user) }
-
+  context 'when discussions have cross-reference system notes' do
     let(:url) { "/projects/#{project.id}/merge_requests/#{merge_request.iid}/discussions" }
+    let(:notes_in_response) { json_response.first['notes'] }
 
-    before do
-      project.add_developer(user)
-      new_merge_request.project.add_developer(user)
-    end
-
-    it 'returns only the note that the user should see' do
-      hidden_merge_request = create(:merge_request)
-      new_cross_reference = "test commit #{hidden_merge_request.project.commit}"
-      new_note = create(:system_note, noteable: merge_request, project: project, note: new_cross_reference)
-      create(:system_note_metadata, note: new_note, action: 'cross_reference')
-
-      get api(url, user, personal_access_token: pat)
-      expect(response).to have_gitlab_http_status(200)
-      expect(json_response.count).to eq(1)
-      expect(json_response.first['notes'].count).to eq(1)
-
-      parsed_note = json_response.first['notes'].first
-      expect(parsed_note['id']).to eq(note.id)
-      expect(parsed_note['body']).to eq(cross_reference)
-      expect(parsed_note['system']).to be true
-    end
-
-    it 'avoids Git calls and N+1 SQL queries' do
-      expect_any_instance_of(Repository).not_to receive(:find_commit).with(commit.id)
-
-      control = ActiveRecord::QueryRecorder.new do
-        get api(url, user, personal_access_token: pat)
-      end
-
-      expect(response).to have_gitlab_http_status(200)
-
-      RequestStore.clear!
-
-      new_note = create(:system_note, noteable: merge_request, project: project, note: cross_reference)
-      create(:system_note_metadata, note: new_note, action: 'cross_reference')
-
-      RequestStore.clear!
-
-      expect { get api(url, user, personal_access_token: pat) }.not_to exceed_query_limit(control)
-      expect(response).to have_gitlab_http_status(200)
-    end
+    it_behaves_like 'with cross-reference system notes'
   end
 
   context 'when noteable is an Issue' do
diff --git a/spec/requests/api/notes_spec.rb b/spec/requests/api/notes_spec.rb
index 424f0a82e43..6c1e30791d2 100644
--- a/spec/requests/api/notes_spec.rb
+++ b/spec/requests/api/notes_spec.rb
@@ -9,6 +9,13 @@ describe API::Notes do
     project.add_reporter(user)
   end
 
+  context 'when there are cross-reference system notes' do
+    let(:url) { "/projects/#{project.id}/merge_requests/#{merge_request.iid}/notes" }
+    let(:notes_in_response) { json_response }
+
+    it_behaves_like 'with cross-reference system notes'
+  end
+
   context "when noteable is an Issue" do
     let!(:issue) { create(:issue, project: project, author: user) }
     let!(:issue_note) { create(:note, noteable: issue, project: project, author: user) }
diff --git a/spec/support/shared_examples/requests/api/discussions.rb b/spec/support/shared_examples/requests/api/discussions.rb
index fc72287f265..a36bc2dc9b5 100644
--- a/spec/support/shared_examples/requests/api/discussions.rb
+++ b/spec/support/shared_examples/requests/api/discussions.rb
@@ -1,5 +1,59 @@
 # frozen_string_literal: true
 
+shared_examples 'with cross-reference system notes' do
+  let(:merge_request) { create(:merge_request) }
+  let(:project) { merge_request.project }
+  let(:new_merge_request) { create(:merge_request) }
+  let(:commit) { new_merge_request.project.commit }
+  let!(:note) { create(:system_note, noteable: merge_request, project: project, note: cross_reference) }
+  let!(:note_metadata) { create(:system_note_metadata, note: note, action: 'cross_reference') }
+  let(:cross_reference) { "test commit #{commit.to_reference(project)}" }
+  let(:pat) { create(:personal_access_token, user: user) }
+
+  before do
+    project.add_developer(user)
+    new_merge_request.project.add_developer(user)
+
+    hidden_merge_request = create(:merge_request)
+    new_cross_reference = "test commit #{hidden_merge_request.project.commit}"
+    new_note = create(:system_note, noteable: merge_request, project: project, note: new_cross_reference)
+    create(:system_note_metadata, note: new_note, action: 'cross_reference')
+  end
+
+  it 'returns only the note that the user should see' do
+    get api(url, user, personal_access_token: pat)
+
+    expect(response).to have_gitlab_http_status(200)
+    expect(json_response.count).to eq(1)
+    expect(notes_in_response.count).to eq(1)
+
+    parsed_note = notes_in_response.first
+    expect(parsed_note['id']).to eq(note.id)
+    expect(parsed_note['body']).to eq(cross_reference)
+    expect(parsed_note['system']).to be true
+  end
+
+  it 'avoids Git calls and N+1 SQL queries', :request_store do
+    expect_any_instance_of(Repository).not_to receive(:find_commit).with(commit.id)
+
+    control = ActiveRecord::QueryRecorder.new do
+      get api(url, user, personal_access_token: pat)
+    end
+
+    expect(response).to have_gitlab_http_status(200)
+
+    RequestStore.clear!
+
+    new_note = create(:system_note, noteable: merge_request, project: project, note: cross_reference)
+    create(:system_note_metadata, note: new_note, action: 'cross_reference')
+
+    RequestStore.clear!
+
+    expect { get api(url, user, personal_access_token: pat) }.not_to exceed_query_limit(control)
+    expect(response).to have_gitlab_http_status(200)
+  end
+end
+
 shared_examples 'discussions API' do |parent_type, noteable_type, id_name, can_reply_to_individual_notes: false|
   describe "GET /#{parent_type}/:id/#{noteable_type}/:noteable_id/discussions" do
     it "returns an array of discussions" do
-- 
cgit v1.2.1


From 57a7309ed4e2f65120a862c8b153b4370eae4f7f Mon Sep 17 00:00:00 2001
From: NeroBurner <pyro4hell@gmail.com>
Date: Fri, 23 Aug 2019 08:29:18 +0200
Subject: locale: remove unused "Mirror a repository" entry

---
 locale/gitlab.pot | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 1c1a3a51932..6b4dd267121 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -7068,9 +7068,6 @@ msgstr ""
 msgid "Minimum length is %{minimum_password_length} characters."
 msgstr ""
 
-msgid "Mirror a repository"
-msgstr ""
-
 msgid "Mirror direction"
 msgstr ""
 
-- 
cgit v1.2.1


From ca9598c1fb9bc408a26793d419b19f39314efe3f Mon Sep 17 00:00:00 2001
From: Jeremy Jackson <jjackson@gitlab.com>
Date: Fri, 23 Aug 2019 07:11:26 +0000
Subject: Add logic for respecting browser DNT setting

---
 app/assets/javascripts/tracking.js |  8 +++++++-
 spec/frontend/tracking_spec.js     | 27 +++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/tracking.js b/app/assets/javascripts/tracking.js
index 2d0b099cf0b..a852f937eec 100644
--- a/app/assets/javascripts/tracking.js
+++ b/app/assets/javascripts/tracking.js
@@ -15,8 +15,14 @@ const extractData = (el, opts = {}) => {
 };
 
 export default class Tracking {
+  static trackable() {
+    return !['1', 'yes'].includes(
+      window.doNotTrack || navigator.doNotTrack || navigator.msDoNotTrack,
+    );
+  }
+
   static enabled() {
-    return typeof window.snowplow === 'function';
+    return typeof window.snowplow === 'function' && this.trackable();
   }
 
   static event(category = document.body.dataset.page, event = 'generic', data = {}) {
diff --git a/spec/frontend/tracking_spec.js b/spec/frontend/tracking_spec.js
index cd0bf50f8e9..0e862c683d3 100644
--- a/spec/frontend/tracking_spec.js
+++ b/spec/frontend/tracking_spec.js
@@ -15,6 +15,12 @@ describe('Tracking', () => {
       snowplowSpy = jest.spyOn(window, 'snowplow');
     });
 
+    afterEach(() => {
+      window.doNotTrack = undefined;
+      navigator.doNotTrack = undefined;
+      navigator.msDoNotTrack = undefined;
+    });
+
     it('tracks to snowplow (our current tracking system)', () => {
       Tracking.event('_category_', '_eventName_', { label: '_label_' });
 
@@ -31,6 +37,27 @@ describe('Tracking', () => {
 
       expect(snowplowSpy).not.toHaveBeenCalled();
     });
+
+    it('skips tracking if the user does not want to be tracked (general spec)', () => {
+      window.doNotTrack = '1';
+      Tracking.event('_category_', '_eventName_');
+
+      expect(snowplowSpy).not.toHaveBeenCalled();
+    });
+
+    it('skips tracking if the user does not want to be tracked (firefox legacy)', () => {
+      navigator.doNotTrack = 'yes';
+      Tracking.event('_category_', '_eventName_');
+
+      expect(snowplowSpy).not.toHaveBeenCalled();
+    });
+
+    it('skips tracking if the user does not want to be tracked (IE legacy)', () => {
+      navigator.msDoNotTrack = '1';
+      Tracking.event('_category_', '_eventName_');
+
+      expect(snowplowSpy).not.toHaveBeenCalled();
+    });
   });
 
   describe('tracking interface events', () => {
-- 
cgit v1.2.1


From d51365efe7378eed087d9d925dec1624cb933ae6 Mon Sep 17 00:00:00 2001
From: Marius Bobin <mbobin@gitlab.com>
Date: Fri, 23 Aug 2019 08:05:48 +0000
Subject: Exempt `jwt/auth` for user `gitlab-ci-token` from rate limiting

---
 ...-exempt-jwt-auth-for-user-gitlab-ci-token-from-rate-limiting.yml | 5 +++++
 lib/gitlab/auth.rb                                                  | 6 +++++-
 spec/lib/gitlab/auth_spec.rb                                        | 4 ++--
 3 files changed, 12 insertions(+), 3 deletions(-)
 create mode 100644 changelogs/unreleased/49392-exempt-jwt-auth-for-user-gitlab-ci-token-from-rate-limiting.yml

diff --git a/changelogs/unreleased/49392-exempt-jwt-auth-for-user-gitlab-ci-token-from-rate-limiting.yml b/changelogs/unreleased/49392-exempt-jwt-auth-for-user-gitlab-ci-token-from-rate-limiting.yml
new file mode 100644
index 00000000000..3ce96e64736
--- /dev/null
+++ b/changelogs/unreleased/49392-exempt-jwt-auth-for-user-gitlab-ci-token-from-rate-limiting.yml
@@ -0,0 +1,5 @@
+---
+title: Exempt user gitlab-ci-token from rate limiting
+merge_request: 31909
+author:
+type: fixed
diff --git a/lib/gitlab/auth.rb b/lib/gitlab/auth.rb
index 82e0c7ceeaa..e17a096ef19 100644
--- a/lib/gitlab/auth.rb
+++ b/lib/gitlab/auth.rb
@@ -46,7 +46,7 @@ module Gitlab
           user_with_password_for_git(login, password) ||
           Gitlab::Auth::Result.new
 
-        rate_limit!(ip, success: result.success?, login: login)
+        rate_limit!(ip, success: result.success?, login: login) unless skip_rate_limit?(login: login)
         Gitlab::Auth::UniqueIpsLimiter.limit_user!(result.actor)
 
         return result if result.success? || authenticate_using_internal_or_ldap_password?
@@ -119,6 +119,10 @@ module Gitlab
 
       private
 
+      def skip_rate_limit?(login:)
+        ::Ci::Build::CI_REGISTRY_USER == login
+      end
+
       def authenticate_using_internal_or_ldap_password?
         Gitlab::CurrentSettings.password_authentication_enabled_for_git? || Gitlab::Auth::LDAP::Config.enabled?
       end
diff --git a/spec/lib/gitlab/auth_spec.rb b/spec/lib/gitlab/auth_spec.rb
index edff38f05ec..098c33f9cb1 100644
--- a/spec/lib/gitlab/auth_spec.rb
+++ b/spec/lib/gitlab/auth_spec.rb
@@ -86,7 +86,7 @@ describe Gitlab::Auth do
         let(:project) { build.project }
 
         before do
-          expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'gitlab-ci-token')
+          expect(gl_auth).not_to receive(:rate_limit!).with('ip', success: true, login: 'gitlab-ci-token')
         end
 
         it 'recognises user-less build' do
@@ -106,7 +106,7 @@ describe Gitlab::Auth do
           let(:project) { build.project }
 
           before do
-            expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'gitlab-ci-token')
+            expect(gl_auth).not_to receive(:rate_limit!).with('ip', success: false, login: 'gitlab-ci-token')
           end
 
           it 'denies authentication' do
-- 
cgit v1.2.1


From f5b855546ed9b2c304b72e349af3f23c4eca549d Mon Sep 17 00:00:00 2001
From: Alexandru Croitor <acroitor@gitlab.com>
Date: Thu, 15 Aug 2019 13:56:33 +0300
Subject: Update sort options for issues list

Increase sort options for issues list from updated_at and create_at,
to include more options close to what is required in actual issue list
UI.

This helps us to use REST API for issues list with sorting capabilities

https://gitlab.com/gitlab-org/gitlab-ce/issues/57402
---
 app/models/concerns/issuable.rb                       | 19 +++++++++----------
 app/models/concerns/sortable.rb                       |  6 +++++-
 app/models/issue.rb                                   |  9 ++++-----
 .../57402-upate-issues-list-sort-options.yml          |  5 +++++
 doc/api/issues.md                                     |  6 +++---
 lib/api/helpers/issues_helpers.rb                     |  9 ++++++---
 lib/api/issues.rb                                     |  2 +-
 spec/requests/api/issues/issues_spec.rb               | 16 ++++++++++++++++
 8 files changed, 49 insertions(+), 23 deletions(-)
 create mode 100644 changelogs/unreleased/57402-upate-issues-list-sort-options.yml

diff --git a/app/models/concerns/issuable.rb b/app/models/concerns/issuable.rb
index e60b6497cb7..db46d7afbb9 100644
--- a/app/models/concerns/issuable.rb
+++ b/app/models/concerns/issuable.rb
@@ -186,16 +186,15 @@ module Issuable
     def sort_by_attribute(method, excluded_labels: [])
       sorted =
         case method.to_s
-        when 'downvotes_desc'                       then order_downvotes_desc
-        when 'label_priority'                       then order_labels_priority(excluded_labels: excluded_labels)
-        when 'label_priority_desc'                  then order_labels_priority('DESC', excluded_labels: excluded_labels)
-        when 'milestone', 'milestone_due_asc'       then order_milestone_due_asc
-        when 'milestone_due_desc'                   then order_milestone_due_desc
-        when 'popularity', 'popularity_desc'        then order_upvotes_desc
-        when 'popularity_asc'                       then order_upvotes_asc
-        when 'priority', 'priority_asc'             then order_due_date_and_labels_priority(excluded_labels: excluded_labels)
-        when 'priority_desc'                        then order_due_date_and_labels_priority('DESC', excluded_labels: excluded_labels)
-        when 'upvotes_desc'                         then order_upvotes_desc
+        when 'downvotes_desc'                                 then order_downvotes_desc
+        when 'label_priority', 'label_priority_asc'           then order_labels_priority(excluded_labels: excluded_labels)
+        when 'label_priority_desc'                            then order_labels_priority('DESC', excluded_labels: excluded_labels)
+        when 'milestone', 'milestone_due_asc'                 then order_milestone_due_asc
+        when 'milestone_due_desc'                             then order_milestone_due_desc
+        when 'popularity_asc'                                 then order_upvotes_asc
+        when 'popularity', 'popularity_desc', 'upvotes_desc'  then order_upvotes_desc
+        when 'priority', 'priority_asc'                       then order_due_date_and_labels_priority(excluded_labels: excluded_labels)
+        when 'priority_desc'                                  then order_due_date_and_labels_priority('DESC', excluded_labels: excluded_labels)
         else order_by(method)
         end
 
diff --git a/app/models/concerns/sortable.rb b/app/models/concerns/sortable.rb
index df1a9e3fe6e..c4af1b1fab2 100644
--- a/app/models/concerns/sortable.rb
+++ b/app/models/concerns/sortable.rb
@@ -27,14 +27,18 @@ module Sortable
     def simple_sorts
       {
         'created_asc' => -> { order_created_asc },
+        'created_at_asc' => -> { order_created_asc },
         'created_date' => -> { order_created_desc },
         'created_desc' => -> { order_created_desc },
+        'created_at_desc' => -> { order_created_desc },
         'id_asc' => -> { order_id_asc },
         'id_desc' => -> { order_id_desc },
         'name_asc' => -> { order_name_asc },
         'name_desc' => -> { order_name_desc },
         'updated_asc' => -> { order_updated_asc },
-        'updated_desc' => -> { order_updated_desc }
+        'updated_at_asc' => -> { order_updated_asc },
+        'updated_desc' => -> { order_updated_desc },
+        'updated_at_desc' => -> { order_updated_desc }
       }
     end
 
diff --git a/app/models/issue.rb b/app/models/issue.rb
index c5a18f0af0f..caea8eadd18 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -128,11 +128,10 @@ class Issue < ApplicationRecord
 
   def self.sort_by_attribute(method, excluded_labels: [])
     case method.to_s
-    when 'closest_future_date' then order_closest_future_date
-    when 'due_date'            then order_due_date_asc
-    when 'due_date_asc'        then order_due_date_asc
-    when 'due_date_desc'       then order_due_date_desc
-    when 'relative_position'   then order_relative_position_asc.with_order_id_desc
+    when 'closest_future_date', 'closest_future_date_asc' then order_closest_future_date
+    when 'due_date', 'due_date_asc'                       then order_due_date_asc
+    when 'due_date_desc'                                  then order_due_date_desc
+    when 'relative_position', 'relative_position_asc'     then order_relative_position_asc.with_order_id_desc
     else
       super
     end
diff --git a/changelogs/unreleased/57402-upate-issues-list-sort-options.yml b/changelogs/unreleased/57402-upate-issues-list-sort-options.yml
new file mode 100644
index 00000000000..900e71e3204
--- /dev/null
+++ b/changelogs/unreleased/57402-upate-issues-list-sort-options.yml
@@ -0,0 +1,5 @@
+---
+title: Updates issues REST API to allow extended sort options
+merge_request: 31849
+author:
+type: changed
diff --git a/doc/api/issues.md b/doc/api/issues.md
index 4f2b4a966c9..8313dd2c3bd 100644
--- a/doc/api/issues.md
+++ b/doc/api/issues.md
@@ -49,7 +49,7 @@ GET /issues?confidential=true
 | `my_reaction_emoji` | string           | no         | Return issues reacted by the authenticated user by the given `emoji`. `None` returns issues not given a reaction. `Any` returns issues given at least one reaction. _([Introduced][ce-14016] in GitLab 10.0)_ |
 | `weight` **(STARTER)** | integer       | no         | Return issues with the specified `weight`. `None` returns issues with no weight assigned. `Any` returns issues with a weight assigned.              |
 | `iids[]`            | integer array    | no         | Return only the issues having the given `iid`                                                                                                       |
-| `order_by`          | string           | no         | Return issues ordered by `created_at` or `updated_at` fields. Default is `created_at`                                                               |
+| `order_by`          | string           | no         | Return issues ordered by `created_at`, `updated_at`, `priority`, `due_date`, `relative_position`, `label_priority`, `milestone_due`, `popularity`, `weight` fields. Default is `created_at`                                                               |
 | `sort`              | string           | no         | Return issues sorted in `asc` or `desc` order. Default is `desc`                                                                                    |
 | `search`            | string           | no         | Search issues against their `title` and `description`                                                                                               |
 | `in`                | string           | no         | Modify the scope of the `search` attribute. `title`, `description`, or a string joining them with comma. Default is `title,description`             |
@@ -198,7 +198,7 @@ GET /groups/:id/issues?confidential=true
 | `assignee_username` | string array     | no         | Return issues assigned to the given `username`. Similar to `assignee_id` and mutually exclusive with `assignee_id`. In CE version `assignee_username` array should only contain a single value or an invalid param error will be returned otherwise. |
 | `my_reaction_emoji` | string           | no         | Return issues reacted by the authenticated user by the given `emoji`. `None` returns issues not given a reaction. `Any` returns issues given at least one reaction. _([Introduced][ce-14016] in GitLab 10.0)_ |
 | `weight` **(STARTER)** | integer       | no         | Return issues with the specified `weight`. `None` returns issues with no weight assigned. `Any` returns issues with a weight assigned. |
-| `order_by`          | string           | no         | Return issues ordered by `created_at` or `updated_at` fields. Default is `created_at`                                         |
+| `order_by`          | string           | no         | Return issues ordered by `created_at`, `updated_at`, `priority`, `due_date`, `relative_position`, `label_priority`, `milestone_due`, `popularity`, `weight` fields. Default is `created_at`                                                               |
 | `sort`              | string           | no         | Return issues sorted in `asc` or `desc` order. Default is `desc`                                                              |
 | `search`            | string           | no         | Search group issues against their `title` and `description`                                                                   |
 | `created_after`     | datetime         | no         | Return issues created on or after the given time                                                                              |
@@ -347,7 +347,7 @@ GET /projects/:id/issues?confidential=true
 | `assignee_username` | string array     | no         | Return issues assigned to the given `username`. Similar to `assignee_id` and mutually exclusive with `assignee_id`. In CE version `assignee_username` array should only contain a single value or an invalid param error will be returned otherwise. |
 | `my_reaction_emoji` | string           | no         | Return issues reacted by the authenticated user by the given `emoji`. `None` returns issues not given a reaction. `Any` returns issues given at least one reaction. _([Introduced][ce-14016] in GitLab 10.0)_ |
 | `weight` **(STARTER)** | integer       | no         | Return issues with the specified `weight`. `None` returns issues with no weight assigned. `Any` returns issues with a weight assigned. |
-| `order_by`          | string           | no         | Return issues ordered by `created_at` or `updated_at` fields. Default is `created_at`                                         |
+| `order_by`          | string           | no         | Return issues ordered by `created_at`, `updated_at`, `priority`, `due_date`, `relative_position`, `label_priority`, `milestone_due`, `popularity`, `weight` fields. Default is `created_at`                                                               |
 | `sort`              | string           | no         | Return issues sorted in `asc` or `desc` order. Default is `desc`                                                              |
 | `search`            | string           | no         | Search project issues against their `title` and `description`                                                                 |
 | `created_after`     | datetime         | no         | Return issues created on or after the given time                                                                              |
diff --git a/lib/api/helpers/issues_helpers.rb b/lib/api/helpers/issues_helpers.rb
index 5b7199fddb0..a8480bb9339 100644
--- a/lib/api/helpers/issues_helpers.rb
+++ b/lib/api/helpers/issues_helpers.rb
@@ -27,6 +27,10 @@ module API
         ]
       end
 
+      def self.sort_options
+        %w[created_at updated_at priority due_date relative_position label_priority milestone_due popularity]
+      end
+
       def issue_finder(args = {})
         args = declared_params.merge(args)
 
@@ -34,15 +38,14 @@ module API
         args[:milestone_title] ||= args.delete(:milestone)
         args[:label_name] ||= args.delete(:labels)
         args[:scope] = args[:scope].underscore if args[:scope]
+        args[:sort] = "#{args[:order_by]}_#{args[:sort]}"
 
         IssuesFinder.new(current_user, args)
       end
 
       def find_issues(args = {})
         finder = issue_finder(args)
-        issues = finder.execute.with_api_entity_associations
-
-        issues.reorder(order_options_with_tie_breaker) # rubocop: disable CodeReuse/ActiveRecord
+        finder.execute.with_api_entity_associations
       end
 
       def issues_statistics(args = {})
diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index 7819c2de515..e16eeef202c 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -44,7 +44,7 @@ module API
         optional :with_labels_details, type: Boolean, desc: 'Return more label data than just lable title', default: false
         optional :state, type: String, values: %w[opened closed all], default: 'all',
                  desc: 'Return opened, closed, or all issues'
-        optional :order_by, type: String, values: %w[created_at updated_at], default: 'created_at',
+        optional :order_by, type: String, values: Helpers::IssuesHelpers.sort_options, default: 'created_at',
                  desc: 'Return issues ordered by `created_at` or `updated_at` fields.'
         optional :sort, type: String, values: %w[asc desc], default: 'desc',
                  desc: 'Return issues sorted in `asc` or `desc` order.'
diff --git a/spec/requests/api/issues/issues_spec.rb b/spec/requests/api/issues/issues_spec.rb
index 27cf66629fe..f19c2dcc6fe 100644
--- a/spec/requests/api/issues/issues_spec.rb
+++ b/spec/requests/api/issues/issues_spec.rb
@@ -607,6 +607,22 @@ describe API::Issues do
         expect_paginated_array_response([closed_issue.id, issue.id])
       end
 
+      context 'with issues list sort options' do
+        it 'accepts only predefined order by params' do
+          API::Helpers::IssuesHelpers.sort_options.each do |sort_opt|
+            get api('/issues', user), params: { order_by: sort_opt, sort: 'asc' }
+            expect(response).to have_gitlab_http_status(200)
+          end
+        end
+
+        it 'fails to sort with non predefined options' do
+          %w(milestone title abracadabra).each do |sort_opt|
+            get api('/issues', user), params: { order_by: sort_opt, sort: 'asc' }
+            expect(response).to have_gitlab_http_status(400)
+          end
+        end
+      end
+
       it 'matches V4 response schema' do
         get api('/issues', user)
 
-- 
cgit v1.2.1


From a98b89e9bcb56b9adc3a4b0bef3e9844bf93bfd0 Mon Sep 17 00:00:00 2001
From: Jan Provaznik <jprovaznik@gitlab.com>
Date: Fri, 16 Aug 2019 10:22:57 +0200
Subject: Re-escape whole HTML content instead of only match

When we un-escape HTML text to find references in it, we should then
re-escape the whole text again, not only found matches.

Because we replace matches with milestone/label links (which contain
HTML tags we don't want to escape again), we re-escape HTML text
with placeholders instead of these links and then replace placeholders
in the escaped text.
---
 .../unreleased/security-fix-markdown-xss.yml       |  5 +++++
 lib/banzai/filter/abstract_reference_filter.rb     | 16 +++++++++++++++
 lib/banzai/filter/label_reference_filter.rb        | 18 ++++++++---------
 lib/banzai/filter/milestone_reference_filter.rb    | 12 ++++++++---
 lib/gitlab/markdown_cache.rb                       |  2 +-
 .../banzai/filter/label_reference_filter_spec.rb   |  5 +++++
 .../filter/milestone_reference_filter_spec.rb      |  8 ++++++++
 .../filters/reference_filter_shared_examples.rb    | 23 ++++++++++++++++++++++
 8 files changed, 76 insertions(+), 13 deletions(-)
 create mode 100644 changelogs/unreleased/security-fix-markdown-xss.yml
 create mode 100644 spec/support/shared_examples/lib/banzai/filters/reference_filter_shared_examples.rb

diff --git a/changelogs/unreleased/security-fix-markdown-xss.yml b/changelogs/unreleased/security-fix-markdown-xss.yml
new file mode 100644
index 00000000000..7ef19f13fd5
--- /dev/null
+++ b/changelogs/unreleased/security-fix-markdown-xss.yml
@@ -0,0 +1,5 @@
+---
+title: Make sure HTML text is always escaped when replacing label/milestone references.
+merge_request:
+author:
+type: security
diff --git a/lib/banzai/filter/abstract_reference_filter.rb b/lib/banzai/filter/abstract_reference_filter.rb
index 52af28ce8ec..a0439089879 100644
--- a/lib/banzai/filter/abstract_reference_filter.rb
+++ b/lib/banzai/filter/abstract_reference_filter.rb
@@ -7,6 +7,14 @@ module Banzai
     class AbstractReferenceFilter < ReferenceFilter
       include CrossProjectReference
 
+      # REFERENCE_PLACEHOLDER is used for re-escaping HTML text except found
+      # reference (which we replace with placeholder during re-scaping).  The
+      # random number helps ensure it's pretty close to unique. Since it's a
+      # transitory value (it never gets saved) we can initialize once, and it
+      # doesn't matter if it changes on a restart.
+      REFERENCE_PLACEHOLDER = "_reference_#{SecureRandom.hex(16)}_"
+      REFERENCE_PLACEHOLDER_PATTERN = %r{#{REFERENCE_PLACEHOLDER}(\d+)}.freeze
+
       def self.object_class
         # Implement in child class
         # Example: MergeRequest
@@ -389,6 +397,14 @@ module Banzai
       def escape_html_entities(text)
         CGI.escapeHTML(text.to_s)
       end
+
+      def escape_with_placeholders(text, placeholder_data)
+        escaped = escape_html_entities(text)
+
+        escaped.gsub(REFERENCE_PLACEHOLDER_PATTERN) do |match|
+          placeholder_data[$1.to_i]
+        end
+      end
     end
   end
 end
diff --git a/lib/banzai/filter/label_reference_filter.rb b/lib/banzai/filter/label_reference_filter.rb
index 4892668fc22..a0789b7ca06 100644
--- a/lib/banzai/filter/label_reference_filter.rb
+++ b/lib/banzai/filter/label_reference_filter.rb
@@ -14,24 +14,24 @@ module Banzai
         find_labels(parent_object).find(id)
       end
 
-      def self.references_in(text, pattern = Label.reference_pattern)
-        unescape_html_entities(text).gsub(pattern) do |match|
-          yield match, $~[:label_id].to_i, $~[:label_name], $~[:project], $~[:namespace], $~
-        end
-      end
-
       def references_in(text, pattern = Label.reference_pattern)
-        unescape_html_entities(text).gsub(pattern) do |match|
+        labels = {}
+        unescaped_html = unescape_html_entities(text).gsub(pattern) do |match|
           namespace, project = $~[:namespace], $~[:project]
           project_path = full_project_path(namespace, project)
           label = find_label(project_path, $~[:label_id], $~[:label_name])
 
           if label
-            yield match, label.id, project, namespace, $~
+            labels[label.id] = yield match, label.id, project, namespace, $~
+            "#{REFERENCE_PLACEHOLDER}#{label.id}"
           else
-            escape_html_entities(match)
+            match
           end
         end
+
+        return text if labels.empty?
+
+        escape_with_placeholders(unescaped_html, labels)
       end
 
       def find_label(parent_ref, label_id, label_name)
diff --git a/lib/banzai/filter/milestone_reference_filter.rb b/lib/banzai/filter/milestone_reference_filter.rb
index 08969753d75..4c47ee4dba1 100644
--- a/lib/banzai/filter/milestone_reference_filter.rb
+++ b/lib/banzai/filter/milestone_reference_filter.rb
@@ -51,15 +51,21 @@ module Banzai
         # default implementation.
         return super(text, pattern) if pattern != Milestone.reference_pattern
 
-        unescape_html_entities(text).gsub(pattern) do |match|
+        milestones = {}
+        unescaped_html = unescape_html_entities(text).gsub(pattern) do |match|
           milestone = find_milestone($~[:project], $~[:namespace], $~[:milestone_iid], $~[:milestone_name])
 
           if milestone
-            yield match, milestone.id, $~[:project], $~[:namespace], $~
+            milestones[milestone.id] = yield match, milestone.id, $~[:project], $~[:namespace], $~
+            "#{REFERENCE_PLACEHOLDER}#{milestone.id}"
           else
-            escape_html_entities(match)
+            match
           end
         end
+
+        return text if milestones.empty?
+
+        escape_with_placeholders(unescaped_html, milestones)
       end
 
       def find_milestone(project_ref, namespace_ref, milestone_id, milestone_name)
diff --git a/lib/gitlab/markdown_cache.rb b/lib/gitlab/markdown_cache.rb
index 0354c710a3f..03a2f62cbd9 100644
--- a/lib/gitlab/markdown_cache.rb
+++ b/lib/gitlab/markdown_cache.rb
@@ -3,8 +3,8 @@
 module Gitlab
   module MarkdownCache
     # Increment this number every time the renderer changes its output
+    CACHE_COMMONMARK_VERSION        = 17
     CACHE_COMMONMARK_VERSION_START  = 10
-    CACHE_COMMONMARK_VERSION        = 16
 
     BaseError = Class.new(StandardError)
     UnsupportedClassError = Class.new(BaseError)
diff --git a/spec/lib/banzai/filter/label_reference_filter_spec.rb b/spec/lib/banzai/filter/label_reference_filter_spec.rb
index 213a5459118..35e99d2586e 100644
--- a/spec/lib/banzai/filter/label_reference_filter_spec.rb
+++ b/spec/lib/banzai/filter/label_reference_filter_spec.rb
@@ -10,6 +10,11 @@ describe Banzai::Filter::LabelReferenceFilter do
   let(:label)     { create(:label, project: project) }
   let(:reference) { label.to_reference }
 
+  it_behaves_like 'HTML text with references' do
+    let(:resource) { label }
+    let(:resource_text) { resource.title }
+  end
+
   it 'requires project context' do
     expect { described_class.call('') }.to raise_error(ArgumentError, /:project/)
   end
diff --git a/spec/lib/banzai/filter/milestone_reference_filter_spec.rb b/spec/lib/banzai/filter/milestone_reference_filter_spec.rb
index 3f021adc756..ab0c2c383c5 100644
--- a/spec/lib/banzai/filter/milestone_reference_filter_spec.rb
+++ b/spec/lib/banzai/filter/milestone_reference_filter_spec.rb
@@ -329,6 +329,10 @@ describe Banzai::Filter::MilestoneReferenceFilter do
     it_behaves_like 'cross-project / same-namespace complete reference'
     it_behaves_like 'cross project shorthand reference'
     it_behaves_like 'references with HTML entities'
+    it_behaves_like 'HTML text with references' do
+      let(:resource) { milestone }
+      let(:resource_text) { "#{resource.class.reference_prefix}#{resource.title}" }
+    end
   end
 
   shared_context 'group milestones' do
@@ -340,6 +344,10 @@ describe Banzai::Filter::MilestoneReferenceFilter do
     it_behaves_like 'String-based multi-word references in quotes'
     it_behaves_like 'referencing a milestone in a link href'
     it_behaves_like 'references with HTML entities'
+    it_behaves_like 'HTML text with references' do
+      let(:resource) { milestone }
+      let(:resource_text) { "#{resource.class.reference_prefix}#{resource.title}" }
+    end
 
     it 'does not support references by IID' do
       doc = reference_filter("See #{Milestone.reference_prefix}#{milestone.iid}")
diff --git a/spec/support/shared_examples/lib/banzai/filters/reference_filter_shared_examples.rb b/spec/support/shared_examples/lib/banzai/filters/reference_filter_shared_examples.rb
new file mode 100644
index 00000000000..b1ecd4fd007
--- /dev/null
+++ b/spec/support/shared_examples/lib/banzai/filters/reference_filter_shared_examples.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'HTML text with references' do
+  let(:markdown_prepend) { "&lt;img src=\"\" onerror=alert(`bug`)&gt;" }
+
+  it 'preserves escaped HTML text and adds valid references' do
+    reference = resource.to_reference(format: :name)
+
+    doc = reference_filter("#{markdown_prepend}#{reference}")
+
+    expect(doc.to_html).to start_with(markdown_prepend)
+    expect(doc.text).to eq %(<img src="" onerror=alert(`bug`)>#{resource_text})
+  end
+
+  it 'preserves escaped HTML text if there are no valid references' do
+    reference = "#{resource.class.reference_prefix}invalid"
+    text = "#{markdown_prepend}#{reference}"
+
+    doc = reference_filter(text)
+
+    expect(doc.to_html).to eq text
+  end
+end
-- 
cgit v1.2.1


From 7e4a6f57a98218828b2f4438d691a4b4cb8f0fce Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Fri, 23 Aug 2019 08:50:24 +0000
Subject: Update capitalization in admin, api, others

Update capitalization in /administration, /api, /ci
and /customization
---
 doc/administration/container_registry.md             |  4 ++--
 doc/administration/custom_hooks.md                   | 20 ++++++++++----------
 doc/administration/dependency_proxy.md               |  2 +-
 doc/administration/git_protocol.md                   |  2 +-
 doc/administration/incoming_email.md                 |  4 ++--
 doc/administration/index.md                          |  2 +-
 doc/administration/issue_closing_pattern.md          |  2 +-
 doc/administration/job_artifacts.md                  |  2 +-
 doc/administration/packages.md                       |  2 +-
 doc/administration/plugins.md                        |  2 +-
 doc/administration/reply_by_email_postfix_setup.md   |  2 +-
 doc/administration/repository_checks.md              |  2 +-
 doc/administration/repository_storage_types.md       |  6 +++---
 doc/administration/uploads.md                        |  2 +-
 doc/api/features.md                                  |  4 ++--
 doc/api/geo_nodes.md                                 |  2 +-
 doc/api/lint.md                                      |  4 ++--
 doc/api/projects.md                                  |  4 ++--
 doc/api/repository_files.md                          |  2 +-
 doc/api/settings.md                                  |  4 ++--
 doc/api/tags.md                                      |  4 ++--
 doc/ci/README.md                                     |  2 +-
 doc/customization/libravatar.md                      |  4 ++--
 .../system_header_and_footer_messages.md             |  2 +-
 24 files changed, 43 insertions(+), 43 deletions(-)

diff --git a/doc/administration/container_registry.md b/doc/administration/container_registry.md
index d43b3718bf9..f5d58db0133 100644
--- a/doc/administration/container_registry.md
+++ b/doc/administration/container_registry.md
@@ -471,7 +471,7 @@ You can use GitLab as an auth endpoint and use a non-bundled Container Registry.
    ```
 
 1. A certificate keypair is required for GitLab and the Container Registry to
-   communicate securely.  By default omnibus-gitlab will generate one keypair,
+   communicate securely.  By default Omnibus GitLab will generate one keypair,
    which is saved to `/var/opt/gitlab/gitlab-rails/etc/gitlab-registry.key`.
    When using a non-bundled Container Registry, you will need to supply a
    custom certificate key. To do that, add the following to
@@ -487,7 +487,7 @@ You can use GitLab as an auth endpoint and use a non-bundled Container Registry.
 
    **Note:** The file specified at `registry_key_path` gets populated with the
    content specified by `internal_key`, each time reconfigure is executed. If
-   no file is specified, omnibus-gitlab will default it to
+   no file is specified, Omnibus GitLab will default it to
    `/var/opt/gitlab/gitlab-rails/etc/gitlab-registry.key` and will populate
    it.
 
diff --git a/doc/administration/custom_hooks.md b/doc/administration/custom_hooks.md
index 32462a95a1a..7238d08ab09 100644
--- a/doc/administration/custom_hooks.md
+++ b/doc/administration/custom_hooks.md
@@ -12,17 +12,17 @@ NOTE: **Note:**
 Custom Git hooks won't be replicated to secondary nodes if you use [GitLab Geo](geo/replication/index.md)
 
 Git natively supports hooks that are executed on different actions.
-Examples of server-side git hooks include pre-receive, post-receive, and update.
+Examples of server-side Git hooks include pre-receive, post-receive, and update.
 See [Git SCM Server-Side Hooks][hooks] for more information about each hook type.
 
-As of gitlab-shell version 2.2.0 (which requires GitLab 7.5+), GitLab
-administrators can add custom git hooks to any GitLab project.
+As of GitLab Shell version 2.2.0 (which requires GitLab 7.5+), GitLab
+administrators can add custom Git hooks to any GitLab project.
 
 ## Create a custom Git hook for a repository
 
 Server-side Git hooks are typically placed in the repository's `hooks`
-subdirectory. In GitLab, hook directories are symlinked to the gitlab-shell
-`hooks` directory for ease of maintenance between gitlab-shell upgrades.
+subdirectory. In GitLab, hook directories are symlinked to the GitLab Shell
+`hooks` directory for ease of maintenance between GitLab Shell upgrades.
 Custom hooks are implemented differently, but the behavior is exactly the same
 once the hook is created. Follow the steps below to set up a custom hook for a
 repository:
@@ -36,7 +36,7 @@ repository:
 1. Inside the new `custom_hooks` directory, create a file with a name matching
    the hook type. For a pre-receive hook the file name should be `pre-receive`
    with no extension.
-1. Make the hook file executable and make sure it's owned by git.
+1. Make the hook file executable and make sure it's owned by Git.
 1. Write the code to make the Git hook function as expected. Hooks can be
    in any language. Ensure the 'shebang' at the top properly reflects the language
    type. For example, if the script is in Ruby the shebang will probably be
@@ -49,17 +49,17 @@ as appropriate.
 
 To create a Git hook that applies to all of your repositories in
 your instance, set a global Git hook. Since all the repositories' `hooks`
-directories are symlinked to gitlab-shell's `hooks` directory, adding any hook
-to the gitlab-shell `hooks` directory will also apply it to all repositories. Follow
+directories are symlinked to GitLab Shell's `hooks` directory, adding any hook
+to the GitLab Shell `hooks` directory will also apply it to all repositories. Follow
 the steps below to properly set up a custom hook for all repositories:
 
 1. On the GitLab server, navigate to the configured custom hook directory. The
-   default is in the gitlab-shell directory. The gitlab-shell `hook` directory
+   default is in the GitLab Shell directory. The GitLab Shell `hook` directory
    for an installation from source the path is usually
    `/home/git/gitlab-shell/hooks`. For Omnibus installs the path is usually
     `/opt/gitlab/embedded/service/gitlab-shell/hooks`.
    To look in a different directory for the global custom hooks,
-   set `custom_hooks_dir` in the gitlab-shell config. For
+   set `custom_hooks_dir` in the GitLab Shell config. For
    Omnibus installations, this can be set in `gitlab.rb`; and in source
    installations, this can be set in `gitlab-shell/config.yml`.
 1. Create a new directory in this location. Depending on your hook, it will be
diff --git a/doc/administration/dependency_proxy.md b/doc/administration/dependency_proxy.md
index d2c52b67e67..5153666705f 100644
--- a/doc/administration/dependency_proxy.md
+++ b/doc/administration/dependency_proxy.md
@@ -48,7 +48,7 @@ local location or even use object storage.
 
 The dependency proxy files for Omnibus GitLab installations are stored under
 `/var/opt/gitlab/gitlab-rails/shared/dependency_proxy/` and for source
-installations under `shared/dependency_proxy/` (relative to the git home directory).
+installations under `shared/dependency_proxy/` (relative to the Git home directory).
 To change the local storage path:
 
 **Omnibus GitLab installations**
diff --git a/doc/administration/git_protocol.md b/doc/administration/git_protocol.md
index 1780e1babe9..9d653d4e09e 100644
--- a/doc/administration/git_protocol.md
+++ b/doc/administration/git_protocol.md
@@ -53,7 +53,7 @@ sudo service ssh restart
 ## Instructions
 
 In order to use the new protocol, clients need to either pass the configuration
-`-c protocol.version=2` to the git command, or set it globally:
+`-c protocol.version=2` to the Git command, or set it globally:
 
 ```sh
 git config --global protocol.version 2
diff --git a/doc/administration/incoming_email.md b/doc/administration/incoming_email.md
index 73a39a6dd35..29915cb3a99 100644
--- a/doc/administration/incoming_email.md
+++ b/doc/administration/incoming_email.md
@@ -151,7 +151,7 @@ Reply by email should now be working.
 
 #### Postfix
 
-Example configuration for Postfix mail server. Assumes mailbox incoming@gitlab.example.com.
+Example configuration for Postfix mail server. Assumes mailbox `incoming@gitlab.example.com`.
 
 Example for Omnibus installs:
 
@@ -218,7 +218,7 @@ incoming_email:
 
 #### Gmail
 
-Example configuration for Gmail/G Suite. Assumes mailbox gitlab-incoming@gmail.com.
+Example configuration for Gmail/G Suite. Assumes mailbox `gitlab-incoming@gmail.com`.
 
 Example for Omnibus installs:
 
diff --git a/doc/administration/index.md b/doc/administration/index.md
index 9dbd90ecea3..650cb10a64a 100644
--- a/doc/administration/index.md
+++ b/doc/administration/index.md
@@ -193,6 +193,6 @@ Learn how to install, configure, update, and maintain your GitLab instance.
   for troubleshooting Kubernetes-related issues.
 - Useful links from the Support Team:
   - [GitLab Developer Docs](https://docs.gitlab.com/ee/development/README.html).
-  - [Repairing and recovering broken git repositories](https://git.seveas.net/repairing-and-recovering-broken-git-repositories.html).
+  - [Repairing and recovering broken Git repositories](https://git.seveas.net/repairing-and-recovering-broken-git-repositories.html).
   - [Testing with OpenSSL](https://www.feistyduck.com/library/openssl-cookbook/online/ch-testing-with-openssl.html).
   - [Strace zine](https://wizardzines.com/zines/strace/).
diff --git a/doc/administration/issue_closing_pattern.md b/doc/administration/issue_closing_pattern.md
index e1bbabb2878..66ab3ef8d81 100644
--- a/doc/administration/issue_closing_pattern.md
+++ b/doc/administration/issue_closing_pattern.md
@@ -13,7 +13,7 @@ in the project's default branch.
 In order to change the pattern you need to have access to the server that GitLab
 is installed on.
 
-The default pattern can be located in [gitlab.yml.example] under the
+The default pattern can be located in [`gitlab.yml.example`] under the
 "Automatic issue closing" section.
 
 > **Tip:**
diff --git a/doc/administration/job_artifacts.md b/doc/administration/job_artifacts.md
index 60921ca791f..350cd5b7992 100644
--- a/doc/administration/job_artifacts.md
+++ b/doc/administration/job_artifacts.md
@@ -94,7 +94,7 @@ If you're enabling S3 in [GitLab HA](high_availability/README.md), you will need
 
 ### Object Storage Settings
 
-For source installations the following settings are nested under `artifacts:` and then `object_store:`. On omnibus installs they are prefixed by `artifacts_object_store_`.
+For source installations the following settings are nested under `artifacts:` and then `object_store:`. On Omnibus GitLab installs they are prefixed by `artifacts_object_store_`.
 
 | Setting | Description | Default |
 |---------|-------------|---------|
diff --git a/doc/administration/packages.md b/doc/administration/packages.md
index c0f8777a8c0..1628b6d6f91 100644
--- a/doc/administration/packages.md
+++ b/doc/administration/packages.md
@@ -55,7 +55,7 @@ local location or even use object storage.
 
 The packages for Omnibus GitLab installations are stored under
 `/var/opt/gitlab/gitlab-rails/shared/packages/` and for source
-installations under `shared/packages/` (relative to the git homedir).
+installations under `shared/packages/` (relative to the Git homedir).
 To change the local storage path:
 
 **Omnibus GitLab installations**
diff --git a/doc/administration/plugins.md b/doc/administration/plugins.md
index 52f1e7cde28..92a4d56ca63 100644
--- a/doc/administration/plugins.md
+++ b/doc/administration/plugins.md
@@ -39,7 +39,7 @@ Follow the steps below to set up a custom hook:
 
 1. Inside the `plugins` directory, create a file with a name of your choice,
    without spaces or special characters.
-1. Make the hook file executable and make sure it's owned by the git user.
+1. Make the hook file executable and make sure it's owned by the Git user.
 1. Write the code to make the plugin function as expected. That can be
    in any language, and ensure the 'shebang' at the top properly reflects the
    language type. For example, if the script is in Ruby the shebang will
diff --git a/doc/administration/reply_by_email_postfix_setup.md b/doc/administration/reply_by_email_postfix_setup.md
index 6d1ffbffefb..56cd23b2eb8 100644
--- a/doc/administration/reply_by_email_postfix_setup.md
+++ b/doc/administration/reply_by_email_postfix_setup.md
@@ -18,7 +18,7 @@ The instructions make the assumption that you will be using the email address `i
    sudo apt-get install postfix
    ```
 
-   When asked about the environment, select 'Internet Site'. When asked to confirm the hostname, make sure it matches gitlab.example.com`.
+   When asked about the environment, select 'Internet Site'. When asked to confirm the hostname, make sure it matches `gitlab.example.com`.
 
 1. Install the `mailutils` package.
 
diff --git a/doc/administration/repository_checks.md b/doc/administration/repository_checks.md
index 05a7cb006a3..ab911c1cf0e 100644
--- a/doc/administration/repository_checks.md
+++ b/doc/administration/repository_checks.md
@@ -3,7 +3,7 @@
 > [Introduced][ce-3232] in GitLab 8.7. It is OFF by default because it still
 causes too many false alarms.
 
-Git has a built-in mechanism, [git fsck][git-fsck], to verify the
+Git has a built-in mechanism, [`git fsck`][git-fsck], to verify the
 integrity of all data committed to a repository. GitLab administrators
 can trigger such a check for a project via the project page under the
 admin panel. The checks run asynchronously so it may take a few minutes
diff --git a/doc/administration/repository_storage_types.md b/doc/administration/repository_storage_types.md
index 1669f8b128c..142bcc65561 100644
--- a/doc/administration/repository_storage_types.md
+++ b/doc/administration/repository_storage_types.md
@@ -118,7 +118,7 @@ If you do have any existing integration, you may want to do a small rollout firs
 to validate. You can do so by specifying a range with the operation.
 
 This is an example of how to limit the rollout to Project IDs 50 to 100, running in
-an Omnibus Gitlab installation:
+an Omnibus GitLab installation:
 
 ```bash
 sudo gitlab-rake gitlab:storage:migrate_to_hashed ID_FROM=50 ID_TO=100
@@ -139,7 +139,7 @@ To schedule a complete rollback, see the
 [rake task documentation for storage rollback](raketasks/storage.md#rollback-from-hashed-storage-to-legacy-storage) for instructions.
 
 The rollback task also supports specifying a range of Project IDs. Here is an example
-of limiting the rollout to Project IDs 50 to 100, in an Omnibus Gitlab installation:
+of limiting the rollout to Project IDs 50 to 100, in an Omnibus GitLab installation:
 
 ```bash
 sudo gitlab-rake gitlab:storage:rollback_to_legacy ID_FROM=50 ID_TO=100
@@ -185,7 +185,7 @@ CI Artifacts are S3 compatible since **9.4** (GitLab Premium), and available in
 
 ##### LFS Objects
 
-LFS Objects implements a similar storage pattern using 2 chars, 2 level folders, following git own implementation:
+LFS Objects implements a similar storage pattern using 2 chars, 2 level folders, following Git own implementation:
 
 ```ruby
 "shared/lfs-objects/#{oid[0..1}/#{oid[2..3]}/#{oid[4..-1]}"
diff --git a/doc/administration/uploads.md b/doc/administration/uploads.md
index 9e9d12f23bb..a4bed72b965 100644
--- a/doc/administration/uploads.md
+++ b/doc/administration/uploads.md
@@ -57,7 +57,7 @@ This configuration relies on valid AWS credentials to be configured already.
 
 ## Object Storage Settings
 
-For source installations the following settings are nested under `uploads:` and then `object_store:`. On omnibus installs they are prefixed by `uploads_object_store_`.
+For source installations the following settings are nested under `uploads:` and then `object_store:`. On Omnibus GitLab installs they are prefixed by `uploads_object_store_`.
 
 | Setting | Description | Default |
 |---------|-------------|---------|
diff --git a/doc/api/features.md b/doc/api/features.md
index 6ecd4ec14b9..e8d0c7c942b 100644
--- a/doc/api/features.md
+++ b/doc/api/features.md
@@ -60,8 +60,8 @@ POST /features/:name
 | `value` | integer/string | yes | `true` or `false` to enable/disable, or an integer for percentage of time |
 | `feature_group` | string | no | A Feature group name |
 | `user` | string | no | A GitLab username |
-| `group` | string | no | A GitLab group's path, for example 'gitlab-org' |
-| `project` | string | no | A projects path, for example 'gitlab-org/gitlab-ce' |
+| `group` | string | no | A GitLab group's path, for example `gitlab-org` |
+| `project` | string | no | A projects path, for example `gitlab-org/gitlab-ce` |
 
 Note that you can enable or disable a feature for a `feature_group`, a `user`,
 a `group`, and a `project` in a single API call.
diff --git a/doc/api/geo_nodes.md b/doc/api/geo_nodes.md
index d0b33ab467f..5eba7f038ed 100644
--- a/doc/api/geo_nodes.md
+++ b/doc/api/geo_nodes.md
@@ -111,7 +111,7 @@ PUT /geo_nodes/:id
 |-----------------------------|---------|-----------|---------------------------------------------------------------------------|
 | `id`                        | integer | yes       | The ID of the Geo node.                                                   |
 | `enabled`                   | boolean | no        | Flag indicating if the Geo node is enabled.                               |
-| `name`                      | string  | yes       | The unique identifier for the Geo node. Must match `geo_node_name` if it is set in gitlab.rb, otherwise it must match `external_url`. |
+| `name`                      | string  | yes       | The unique identifier for the Geo node. Must match `geo_node_name` if it is set in `gitlab.rb`, otherwise it must match `external_url`. |
 | `url`                       | string  | yes       | The user-facing URL of the Geo node. |
 | `internal_url`              | string  | no        | The URL defined on the primary node that secondary nodes should use to contact it. Returns `url` if not set.|
 | `files_max_capacity`        | integer | no        | Control the maximum concurrency of LFS/attachment backfill for this secondary node. |
diff --git a/doc/api/lint.md b/doc/api/lint.md
index 79f5e629c7f..dacd3f4c493 100644
--- a/doc/api/lint.md
+++ b/doc/api/lint.md
@@ -1,4 +1,4 @@
-# Validate the .gitlab-ci.yml (API)
+# Validate the `.gitlab-ci.yml` (API)
 
 > [Introduced][ce-5953] in GitLab 8.12.
 
@@ -10,7 +10,7 @@ POST /ci/lint
 
 | Attribute  | Type    | Required | Description |
 | ---------- | ------- | -------- | -------- |
-| `content`  | string    | yes      | the .gitlab-ci.yaml content|
+| `content`  | string    | yes      | the `.gitlab-ci.yaml` content|
 
 ```bash
 curl --header "Content-Type: application/json" https://gitlab.example.com/api/v4/ci/lint --data '{"content": "{ \"image\": \"ruby:2.6\", \"services\": [\"postgres\"], \"before_script\": [\"bundle install\", \"bundle exec rake db:create\"], \"variables\": {\"DB_NAME\": \"postgres\"}, \"types\": [\"test\", \"deploy\", \"notify\"], \"rspec\": { \"script\": \"rake spec\", \"tags\": [\"ruby\", \"postgres\"], \"only\": [\"branches\"]}}"}'
diff --git a/doc/api/projects.md b/doc/api/projects.md
index 373607f8f4b..9f392418153 100644
--- a/doc/api/projects.md
+++ b/doc/api/projects.md
@@ -2037,13 +2037,13 @@ Read more in the [Project Badges](project_badges.md) documentation.
 
 The non-default [issue and merge request description templates](../user/project/description_templates.md) are managed inside the project's repository. So you can manage them via the API through the [Repositories API](repositories.md) and the [Repository Files API](repository_files.md).
 
-## Download snapshot of a git repository
+## Download snapshot of a Git repository
 
 > Introduced in GitLab 10.7
 
 This endpoint may only be accessed by an administrative user.
 
-Download a snapshot of the project (or wiki, if requested) git repository. This
+Download a snapshot of the project (or wiki, if requested) Git repository. This
 snapshot is always in uncompressed [tar](https://en.wikipedia.org/wiki/Tar_(computing))
 format.
 
diff --git a/doc/api/repository_files.md b/doc/api/repository_files.md
index b292c9dd7de..513dc996c91 100644
--- a/doc/api/repository_files.md
+++ b/doc/api/repository_files.md
@@ -246,7 +246,7 @@ error message. Possible causes for a failed commit include:
   user tried to make an empty commit;
 - the branch was updated by a Git push while the file edit was in progress.
 
-Currently gitlab-shell has a boolean return code, preventing GitLab from specifying the error.
+Currently GitLab Shell has a boolean return code, preventing GitLab from specifying the error.
 
 ## Delete existing file in repository
 
diff --git a/doc/api/settings.md b/doc/api/settings.md
index 4b5b2b924d7..710b63c9a2f 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -232,7 +232,7 @@ are listed in the descriptions of the relevant settings.
 | `file_template_project_id`               | integer          | no                                   | **(PREMIUM)** The ID of a project to load custom file templates from |
 | `first_day_of_week`                      | integer          | no                                   | Start day of the week for calendar views and date pickers. Valid values are `0` (default) for Sunday, `1` for Monday, and `6` for Saturday. |
 | `geo_status_timeout`                     | integer          | no                                   | **(PREMIUM)** The amount of seconds after which a request to get a secondary node status will time out. |
-| `gitaly_timeout_default`                 | integer          | no                                   | Default Gitaly timeout, in seconds. This timeout is not enforced for git fetch/push operations or Sidekiq jobs. Set to `0` to disable timeouts. |
+| `gitaly_timeout_default`                 | integer          | no                                   | Default Gitaly timeout, in seconds. This timeout is not enforced for Git fetch/push operations or Sidekiq jobs. Set to `0` to disable timeouts. |
 | `gitaly_timeout_fast`                    | integer          | no                                   | Gitaly fast operation timeout, in seconds. Some Gitaly operations are expected to be fast. If they exceed this threshold, there may be a problem with a storage shard and 'failing fast' can help maintain the stability of the GitLab instance. Set to `0` to disable timeouts. |
 | `gitaly_timeout_medium`                  | integer          | no                                   | Medium Gitaly timeout, in seconds. This should be a value between the Fast and the Default timeout. Set to `0` to disable timeouts. |
 | `gravatar_enabled`                       | boolean          | no                                   | Enable Gravatar. |
@@ -244,7 +244,7 @@ are listed in the descriptions of the relevant settings.
 | `hide_third_party_offers`                | boolean          | no                                   | Do not display offers from third parties within GitLab. |
 | `home_page_url`                          | string           | no                                   | Redirect to this URL when not logged in. |
 | `housekeeping_bitmaps_enabled`           | boolean          | required by: `housekeeping_enabled`  | Enable Git pack file bitmap creation. |
-| `housekeeping_enabled`                   | boolean          | no                                   | (**If enabled, requires:** `housekeeping_bitmaps_enabled`, `housekeeping_full_repack_period`, `housekeeping_gc_period`, and `housekeeping_incremental_repack_period`) Enable or disable git housekeeping. |
+| `housekeeping_enabled`                   | boolean          | no                                   | (**If enabled, requires:** `housekeeping_bitmaps_enabled`, `housekeeping_full_repack_period`, `housekeeping_gc_period`, and `housekeeping_incremental_repack_period`) Enable or disable Git housekeeping. |
 | `housekeeping_full_repack_period`        | integer          | required by: `housekeeping_enabled`  | Number of Git pushes after which an incremental `git repack` is run. |
 | `housekeeping_gc_period`                 | integer          | required by: `housekeeping_enabled`  | Number of Git pushes after which `git gc` is run. |
 | `housekeeping_incremental_repack_period` | integer          | required by: `housekeeping_enabled`  | Number of Git pushes after which an incremental `git repack` is run. |
diff --git a/doc/api/tags.md b/doc/api/tags.md
index af86ba961f4..1d874fea1f8 100644
--- a/doc/api/tags.md
+++ b/doc/api/tags.md
@@ -112,7 +112,7 @@ Parameters:
 - `tag_name` (required) - The name of a tag
 - `ref` (required) - Create tag using commit SHA, another tag name, or branch name.
 - `message` (optional) - Creates annotated tag.
-- `release_description` (optional) - Add release notes to the git tag and store it in the GitLab database.
+- `release_description` (optional) - Add release notes to the Git tag and store it in the GitLab database.
 
 ```json
 {
@@ -166,7 +166,7 @@ Parameters:
 
 ## Create a new release
 
-Add release notes to the existing git tag. If there
+Add release notes to the existing Git tag. If there
 already exists a release for the given tag, status code `409` is returned.
 
 ```
diff --git a/doc/ci/README.md b/doc/ci/README.md
index 94da8354f0b..4be13204227 100644
--- a/doc/ci/README.md
+++ b/doc/ci/README.md
@@ -174,7 +174,7 @@ been necessary. These are:
 
 #### 12.0
 
-- [Use refspec to clone/fetch git
+- [Use refspec to clone/fetch Git
   repository](https://gitlab.com/gitlab-org/gitlab-runner/issues/4069).
 - [Old cache
   configuration](https://gitlab.com/gitlab-org/gitlab-runner/issues/4070).
diff --git a/doc/customization/libravatar.md b/doc/customization/libravatar.md
index 1c3bf877fa1..6d96528f760 100644
--- a/doc/customization/libravatar.md
+++ b/doc/customization/libravatar.md
@@ -14,7 +14,7 @@ server.
 
 ## Configuration
 
-In the [gitlab.yml gravatar section](https://gitlab.com/gitlab-org/gitlab-ce/blob/672bd3902d86b78d730cea809fce312ec49d39d7/config/gitlab.yml.example#L122), set
+In the [`gitlab.yml` gravatar section](https://gitlab.com/gitlab-org/gitlab-ce/blob/672bd3902d86b78d730cea809fce312ec49d39d7/config/gitlab.yml.example#L122), set
 the configuration options as follows:
 
 ### For HTTP
@@ -46,7 +46,7 @@ For example, you host a service on `http://libravatar.example.com` and the
 
 `http://libravatar.example.com/avatar/%{hash}?s=%{size}&d=identicon`
 
-### Omnibus-gitlab example
+### Omnibus GitLab example
 
 In `/etc/gitlab/gitlab.rb`:
 
diff --git a/doc/customization/system_header_and_footer_messages.md b/doc/customization/system_header_and_footer_messages.md
index 15830be4e8a..bd2de3e201c 100644
--- a/doc/customization/system_header_and_footer_messages.md
+++ b/doc/customization/system_header_and_footer_messages.md
@@ -8,7 +8,7 @@ Navigate to the **Admin** area and go to the **Appearance** page.
 Under **System header and footer** insert your header message and/or footer message.
 Both background and font color of the header and footer are customizable.
 
-You can also apply the header and footer messages to gitlab emails,
+You can also apply the header and footer messages to GitLab emails,
 by checking the **Enable header and footer in emails** checkbox.
 Note that color settings will only be applied within the app interface and not to emails
 
-- 
cgit v1.2.1


From dbbcdfb5beaa735e020d6dbd8516665ae846f01a Mon Sep 17 00:00:00 2001
From: Greg Myers <gmyers@gitlab.com>
Date: Fri, 23 Aug 2019 09:19:08 +0000
Subject: Add version 12 upgrade recommendations

Updates doc/policy/maintenance.md, adds upgrade path from 11 -> 12
---
 doc/policy/maintenance.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/policy/maintenance.md b/doc/policy/maintenance.md
index 018c273c51a..f7ba7c16a9e 100644
--- a/doc/policy/maintenance.md
+++ b/doc/policy/maintenance.md
@@ -86,6 +86,7 @@ Please see the table below for some examples:
 | 9.4.5                 | 8.13.4       | `8.13.4` -> `8.17.7` -> `9.4.5`                          | `8.17.7` is the last version in version `8` |
 | 10.1.4                | 8.13.4       | `8.13.4 -> 8.17.7 -> 9.5.10 -> 10.1.4`                   | `8.17.7` is the last version in version `8`, `9.5.10` is the last version in version `9` |
 | 11.3.4                | 8.13.4       | `8.13.4` -> `8.17.7` -> `9.5.10` -> `10.8.7` -> `11.3.4` | `8.17.7` is the last version in version `8`, `9.5.10` is the last version in version `9`, `10.8.7` is the last version in version `10` |
+| 12.0.2                | 11.3.4       | `11.3.4` -> `11.11.x` -> `12.0.2`                        | `11.11.x` is the last version in version `11`
 
 More information about the release procedures can be found in our
 [release documentation](https://gitlab.com/gitlab-org/release/docs). You may also want to read our
-- 
cgit v1.2.1


From 41d52bbfe9725a93013ea6b072efcdc16e591b14 Mon Sep 17 00:00:00 2001
From: Jan Provaznik <jprovaznik@gitlab.com>
Date: Tue, 9 Jul 2019 20:51:42 +0200
Subject: Add direct upload support for personal snippets

---
 GITLAB_WORKHORSE_VERSION                               |  2 +-
 app/controllers/concerns/uploads_actions.rb            |  4 ++++
 app/controllers/uploads_controller.rb                  |  6 ++++--
 app/uploaders/personal_file_uploader.rb                |  4 ++++
 changelogs/unreleased/security-personal-snippets.yml   |  5 +++++
 config/routes/uploads.rb                               |  4 ++++
 doc/administration/raketasks/uploads/sanitize.md       |  2 ++
 lib/gitlab/sanitizers/exif.rb                          |  7 +++++--
 lib/tasks/gitlab/uploads/sanitize.rake                 |  6 ++++--
 spec/controllers/uploads_controller_spec.rb            | 18 ++++++++++++++++++
 spec/lib/gitlab/sanitizers/exif_spec.rb                | 18 ++++++++++++++++--
 .../controllers/uploads_actions_shared_examples.rb     | 11 ++++++++++-
 12 files changed, 77 insertions(+), 10 deletions(-)
 create mode 100644 changelogs/unreleased/security-personal-snippets.yml

diff --git a/GITLAB_WORKHORSE_VERSION b/GITLAB_WORKHORSE_VERSION
index 3b6825376ad..eec6dacbd48 100644
--- a/GITLAB_WORKHORSE_VERSION
+++ b/GITLAB_WORKHORSE_VERSION
@@ -1 +1 @@
-8.8.0
+8.8.1
diff --git a/app/controllers/concerns/uploads_actions.rb b/app/controllers/concerns/uploads_actions.rb
index f5d35379e10..60a68cec3c3 100644
--- a/app/controllers/concerns/uploads_actions.rb
+++ b/app/controllers/concerns/uploads_actions.rb
@@ -127,4 +127,8 @@ module UploadsActions
   def model
     strong_memoize(:model) { find_model }
   end
+
+  def workhorse_authorize_request?
+    action_name == 'authorize'
+  end
 end
diff --git a/app/controllers/uploads_controller.rb b/app/controllers/uploads_controller.rb
index 94bd18f70d4..2adfeab182e 100644
--- a/app/controllers/uploads_controller.rb
+++ b/app/controllers/uploads_controller.rb
@@ -2,6 +2,7 @@
 
 class UploadsController < ApplicationController
   include UploadsActions
+  include WorkhorseRequest
 
   UnknownUploadModelError = Class.new(StandardError)
 
@@ -21,7 +22,8 @@ class UploadsController < ApplicationController
   before_action :upload_mount_satisfied?
   before_action :find_model
   before_action :authorize_access!, only: [:show]
-  before_action :authorize_create_access!, only: [:create]
+  before_action :authorize_create_access!, only: [:create, :authorize]
+  before_action :verify_workhorse_api!, only: [:authorize]
 
   def uploader_class
     PersonalFileUploader
@@ -72,7 +74,7 @@ class UploadsController < ApplicationController
   end
 
   def render_unauthorized
-    if current_user
+    if current_user || workhorse_authorize_request?
       render_404
     else
       authenticate_user!
diff --git a/app/uploaders/personal_file_uploader.rb b/app/uploaders/personal_file_uploader.rb
index 1ac69601d18..3efdd0aa1d9 100644
--- a/app/uploaders/personal_file_uploader.rb
+++ b/app/uploaders/personal_file_uploader.rb
@@ -6,6 +6,10 @@ class PersonalFileUploader < FileUploader
     options.storage_path
   end
 
+  def self.workhorse_local_upload_path
+    File.join(options.storage_path, 'uploads', TMP_UPLOAD_PATH)
+  end
+
   def self.base_dir(model, _store = nil)
     # base_dir is the path seen by the user when rendering Markdown, so
     # it should be the same for both local and object storage. It is
diff --git a/changelogs/unreleased/security-personal-snippets.yml b/changelogs/unreleased/security-personal-snippets.yml
new file mode 100644
index 00000000000..95f61993b98
--- /dev/null
+++ b/changelogs/unreleased/security-personal-snippets.yml
@@ -0,0 +1,5 @@
+---
+title: Remove EXIF from users/personal snippet uploads.
+merge_request:
+author:
+type: security
diff --git a/config/routes/uploads.rb b/config/routes/uploads.rb
index 920f8454ce2..096ef146e07 100644
--- a/config/routes/uploads.rb
+++ b/config/routes/uploads.rb
@@ -30,6 +30,10 @@ scope path: :uploads do
     to: 'uploads#create',
     constraints: { model: /personal_snippet|user/, id: /\d+/ },
     as: 'upload'
+
+  post ':model/authorize',
+    to: 'uploads#authorize',
+    constraints: { model: /personal_snippet|user/ }
 end
 
 # Redirect old note attachments path to new uploads path.
diff --git a/doc/administration/raketasks/uploads/sanitize.md b/doc/administration/raketasks/uploads/sanitize.md
index ae5ccfb9e37..7574660d848 100644
--- a/doc/administration/raketasks/uploads/sanitize.md
+++ b/doc/administration/raketasks/uploads/sanitize.md
@@ -37,6 +37,8 @@ Parameter | Type | Description
 `stop_id` | integer | Only uploads with equal or smaller ID will be processed
 `dry_run` | boolean | Do not remove EXIF data, only check if EXIF data are present or not, default: true
 `sleep_time` | float | Pause for number of seconds after processing each image, default: 0.3 seconds
+`uploader` | string | Run sanitization only for uploads of the given uploader (`FileUploader`, `PersonalFileUploader`, `NamespaceFileUploader`)
+`since` | date | Run sanitization only for uploads newer than given date (e.g. `2019-05-01`)
 
 If you have too many uploads, you can speed up sanitization by setting
 `sleep_time` to a lower value or by running multiple rake tasks in parallel,
diff --git a/lib/gitlab/sanitizers/exif.rb b/lib/gitlab/sanitizers/exif.rb
index bb4e4ce7bbc..2f3d14ecebd 100644
--- a/lib/gitlab/sanitizers/exif.rb
+++ b/lib/gitlab/sanitizers/exif.rb
@@ -53,15 +53,18 @@ module Gitlab
       end
 
       # rubocop: disable CodeReuse/ActiveRecord
-      def batch_clean(start_id: nil, stop_id: nil, dry_run: true, sleep_time: nil)
+      def batch_clean(start_id: nil, stop_id: nil, dry_run: true, sleep_time: nil, uploader: nil, since: nil)
         relation = Upload.where('lower(path) like ? or lower(path) like ? or lower(path) like ?',
                                 '%.jpg', '%.jpeg', '%.tiff')
+        relation = relation.where(uploader: uploader) if uploader
+        relation = relation.where('created_at > ?', since) if since
 
         logger.info "running in dry run mode, no images will be rewritten" if dry_run
 
         find_params = {
           start: start_id.present? ? start_id.to_i : nil,
-          finish: stop_id.present? ? stop_id.to_i : Upload.last&.id
+          finish: stop_id.present? ? stop_id.to_i : Upload.last&.id,
+          batch_size: 1000
         }
 
         relation.find_each(find_params) do |upload|
diff --git a/lib/tasks/gitlab/uploads/sanitize.rake b/lib/tasks/gitlab/uploads/sanitize.rake
index 12cf5302555..4f23a0a5d82 100644
--- a/lib/tasks/gitlab/uploads/sanitize.rake
+++ b/lib/tasks/gitlab/uploads/sanitize.rake
@@ -2,7 +2,7 @@ namespace :gitlab do
   namespace :uploads do
     namespace :sanitize do
       desc 'GitLab | Uploads | Remove EXIF from images.'
-      task :remove_exif, [:start_id, :stop_id, :dry_run, :sleep_time] => :environment do |task, args|
+      task :remove_exif, [:start_id, :stop_id, :dry_run, :sleep_time, :uploader, :since] => :environment do |task, args|
         args.with_defaults(dry_run: 'true')
         args.with_defaults(sleep_time: 0.3)
 
@@ -11,7 +11,9 @@ namespace :gitlab do
         sanitizer = Gitlab::Sanitizers::Exif.new(logger: logger)
         sanitizer.batch_clean(start_id: args.start_id, stop_id: args.stop_id,
                               dry_run: args.dry_run != 'false',
-                              sleep_time: args.sleep_time.to_f)
+                              sleep_time: args.sleep_time.to_f,
+                              uploader: args.uploader,
+                              since: args.since)
       end
     end
   end
diff --git a/spec/controllers/uploads_controller_spec.rb b/spec/controllers/uploads_controller_spec.rb
index 0876502a899..5f4a6bf8ee7 100644
--- a/spec/controllers/uploads_controller_spec.rb
+++ b/spec/controllers/uploads_controller_spec.rb
@@ -21,8 +21,20 @@ shared_examples 'content publicly cached' do
 end
 
 describe UploadsController do
+  include WorkhorseHelpers
+
   let!(:user) { create(:user, avatar: fixture_file_upload("spec/fixtures/dk.png", "image/png")) }
 
+  describe 'POST #authorize' do
+    it_behaves_like 'handle uploads authorize' do
+      let(:uploader_class) { PersonalFileUploader }
+      let(:model) { create(:personal_snippet, :public) }
+      let(:params) do
+        { model: 'personal_snippet', id: model.id }
+      end
+    end
+  end
+
   describe 'POST create' do
     let(:jpg)     { fixture_file_upload('spec/fixtures/rails_sample.jpg', 'image/jpg') }
     let(:txt)     { fixture_file_upload('spec/fixtures/doc_sample.txt', 'text/plain') }
@@ -636,4 +648,10 @@ describe UploadsController do
       end
     end
   end
+
+  def post_authorize(verified: true)
+    request.headers.merge!(workhorse_internal_api_request_header) if verified
+
+    post :authorize, params: { model: 'personal_snippet', id: model.id }, format: :json
+  end
 end
diff --git a/spec/lib/gitlab/sanitizers/exif_spec.rb b/spec/lib/gitlab/sanitizers/exif_spec.rb
index bd5f330c7a1..0a4bc1bbdbb 100644
--- a/spec/lib/gitlab/sanitizers/exif_spec.rb
+++ b/spec/lib/gitlab/sanitizers/exif_spec.rb
@@ -5,7 +5,9 @@ describe Gitlab::Sanitizers::Exif do
 
   describe '#batch_clean' do
     context 'with image uploads' do
-      let!(:uploads) { create_list(:upload, 3, :with_file, :issuable_upload) }
+      set(:upload1) { create(:upload, :with_file, :issuable_upload) }
+      set(:upload2) { create(:upload, :with_file, :personal_snippet_upload) }
+      set(:upload3) { create(:upload, :with_file, created_at: 3.days.ago) }
 
       it 'processes all uploads if range ID is not set' do
         expect(sanitizer).to receive(:clean).exactly(3).times
@@ -16,7 +18,19 @@ describe Gitlab::Sanitizers::Exif do
       it 'processes only uploads in the selected range' do
         expect(sanitizer).to receive(:clean).once
 
-        sanitizer.batch_clean(start_id: uploads[1].id, stop_id: uploads[1].id)
+        sanitizer.batch_clean(start_id: upload1.id, stop_id: upload1.id)
+      end
+
+      it 'processes only uploads for the selected uploader' do
+        expect(sanitizer).to receive(:clean).once
+
+        sanitizer.batch_clean(uploader: 'PersonalFileUploader')
+      end
+
+      it 'processes only uploads created since specified date' do
+        expect(sanitizer).to receive(:clean).exactly(2).times
+
+        sanitizer.batch_clean(since: 2.days.ago)
       end
 
       it 'pauses if sleep_time is set' do
diff --git a/spec/support/shared_examples/controllers/uploads_actions_shared_examples.rb b/spec/support/shared_examples/controllers/uploads_actions_shared_examples.rb
index 39d13cccb13..4bc22861d58 100644
--- a/spec/support/shared_examples/controllers/uploads_actions_shared_examples.rb
+++ b/spec/support/shared_examples/controllers/uploads_actions_shared_examples.rb
@@ -7,6 +7,8 @@ shared_examples 'handle uploads' do
   let(:secret) { FileUploader.generate_secret }
   let(:uploader_class) { FileUploader }
 
+  it_behaves_like 'handle uploads authorize'
+
   describe "POST #create" do
     context 'when a user is not authorized to upload a file' do
       it 'returns 404 status' do
@@ -271,7 +273,9 @@ shared_examples 'handle uploads' do
       end
     end
   end
+end
 
+shared_examples 'handle uploads authorize' do
   describe "POST #authorize" do
     context 'when a user is not authorized to upload a file' do
       it 'returns 404 status' do
@@ -284,7 +288,12 @@ shared_examples 'handle uploads' do
     context 'when a user can upload a file' do
       before do
         sign_in(user)
-        model.add_developer(user)
+
+        if model.is_a?(PersonalSnippet)
+          model.update!(author: user)
+        else
+          model.add_developer(user)
+        end
       end
 
       context 'and the request bypassed workhorse' do
-- 
cgit v1.2.1


From bf7cf785fecd6e89fe619777e8fd19c5a85098e4 Mon Sep 17 00:00:00 2001
From: Samantha Ming <sming@gitlab.com>
Date: Fri, 23 Aug 2019 09:20:29 +0000
Subject: Update documentation screenshot

---
 .../img/approvals_premium_project_edit.png              | Bin 14507 -> 0 bytes
 .../img/approvals_premium_project_edit_v12_3.png        | Bin 0 -> 24542 bytes
 .../project/merge_requests/merge_request_approvals.md   |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)
 delete mode 100644 doc/user/project/merge_requests/img/approvals_premium_project_edit.png
 create mode 100644 doc/user/project/merge_requests/img/approvals_premium_project_edit_v12_3.png

diff --git a/doc/user/project/merge_requests/img/approvals_premium_project_edit.png b/doc/user/project/merge_requests/img/approvals_premium_project_edit.png
deleted file mode 100644
index 6a09412533f..00000000000
Binary files a/doc/user/project/merge_requests/img/approvals_premium_project_edit.png and /dev/null differ
diff --git a/doc/user/project/merge_requests/img/approvals_premium_project_edit_v12_3.png b/doc/user/project/merge_requests/img/approvals_premium_project_edit_v12_3.png
new file mode 100644
index 00000000000..32b9a3b9ce4
Binary files /dev/null and b/doc/user/project/merge_requests/img/approvals_premium_project_edit_v12_3.png differ
diff --git a/doc/user/project/merge_requests/merge_request_approvals.md b/doc/user/project/merge_requests/merge_request_approvals.md
index 5161b25de99..a0432414bcf 100644
--- a/doc/user/project/merge_requests/merge_request_approvals.md
+++ b/doc/user/project/merge_requests/merge_request_approvals.md
@@ -83,7 +83,7 @@ request approval rules:
 1. Give the approval rule a name that describes the set of approvers selected.
 1. Click **Add approvers** to submit the new rule.
 
-   ![Approvals premium project edit](img/approvals_premium_project_edit.png)
+   ![Approvals premium project edit](img/approvals_premium_project_edit_v12_3.png)
 
 ## Multiple approval rules **(PREMIUM)**
 
-- 
cgit v1.2.1


From 3956e7bb8695ebea0038d529162127fd514ea8f1 Mon Sep 17 00:00:00 2001
From: Andrew Newdigate <andrew@gitlab.com>
Date: Fri, 23 Aug 2019 10:11:19 +0000
Subject: Add cache tracing and Redis tracing

This change adds Distributed Tracing support for two new types of events

1. Redis Calls
1. ActiveSupport (Rails) Caching Operations

The intention is to help application developers and infrastructure
SREs to understand the pressure that caching operations can have on
the application when running at scale.

The Redis and Caching spans can be viewed in the Jaeger UI by clicking
the "Trace" link in the performance bar when running on GDK.
---
 Gemfile                                        | 2 +-
 Gemfile.lock                                   | 7 ++++---
 changelogs/unreleased/labkit-cache-tracing.yml | 5 +++++
 config/initializers/tracing.rb                 | 4 ++++
 4 files changed, 14 insertions(+), 4 deletions(-)
 create mode 100644 changelogs/unreleased/labkit-cache-tracing.yml

diff --git a/Gemfile b/Gemfile
index 116c94bdaf8..e5023a6f67d 100644
--- a/Gemfile
+++ b/Gemfile
@@ -283,7 +283,7 @@ gem 'sentry-raven', '~> 2.9'
 gem 'premailer-rails', '~> 1.9.7'
 
 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.4.2'
+gem 'gitlab-labkit', '~> 0.5'
 
 # I18n
 gem 'ruby_parser', '~> 3.8', require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 0ecf3aa2840..d9a32027f3c 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -311,12 +311,13 @@ GEM
     gitaly (1.58.0)
       grpc (~> 1.0)
     github-markup (1.7.0)
-    gitlab-labkit (0.4.2)
+    gitlab-labkit (0.5.2)
       actionpack (~> 5)
       activesupport (~> 5)
       grpc (~> 1.19)
       jaeger-client (~> 0.10)
       opentracing (~> 0.4)
+      redis (> 3.0.0, < 5.0.0)
     gitlab-markup (1.7.0)
     gitlab-sidekiq-fetcher (0.5.1)
       sidekiq (~> 5)
@@ -712,7 +713,7 @@ GEM
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.0.4)
+    rails-html-sanitizer (1.2.0)
       loofah (~> 2.2, >= 2.2.2)
     rails-i18n (5.1.1)
       i18n (>= 0.7, < 2)
@@ -1100,7 +1101,7 @@ DEPENDENCIES
   gettext_i18n_rails_js (~> 1.3)
   gitaly (~> 1.58.0)
   github-markup (~> 1.7.0)
-  gitlab-labkit (~> 0.4.2)
+  gitlab-labkit (~> 0.5)
   gitlab-markup (~> 1.7.0)
   gitlab-sidekiq-fetcher (= 0.5.1)
   gitlab-styles (~> 2.7)
diff --git a/changelogs/unreleased/labkit-cache-tracing.yml b/changelogs/unreleased/labkit-cache-tracing.yml
new file mode 100644
index 00000000000..7e58e1b88dd
--- /dev/null
+++ b/changelogs/unreleased/labkit-cache-tracing.yml
@@ -0,0 +1,5 @@
+---
+title: Add Redis interceptor tracing
+merge_request: 30238
+author:
+type: other
diff --git a/config/initializers/tracing.rb b/config/initializers/tracing.rb
index 3c8779f238f..5b55a06692e 100644
--- a/config/initializers/tracing.rb
+++ b/config/initializers/tracing.rb
@@ -21,9 +21,13 @@ if Labkit::Tracing.enabled?
     end
   end
 
+  # Instrument Redis
+  Labkit::Tracing::Redis.instrument
+
   # Instrument Rails
   Labkit::Tracing::Rails::ActiveRecordSubscriber.instrument
   Labkit::Tracing::Rails::ActionViewSubscriber.instrument
+  Labkit::Tracing::Rails::ActiveSupportSubscriber.instrument
 
   # In multi-processed clustered architectures (puma, unicorn) don't
   # start tracing until the worker processes are spawned. This works
-- 
cgit v1.2.1


From 3e5946335d430c50726a2bfddaf50e0fc43192e2 Mon Sep 17 00:00:00 2001
From: Laura Montemayor <lmontemayor@gitlab.com>
Date: Fri, 23 Aug 2019 10:12:18 +0000
Subject: fix charts scroll handle icon

---
 app/assets/javascripts/monitoring/components/charts/area.vue      | 2 +-
 .../64385-charts-scroll-handle-icon-has-disappeared.yml           | 5 +++++
 spec/javascripts/monitoring/charts/area_spec.js                   | 8 ++++++++
 3 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/64385-charts-scroll-handle-icon-has-disappeared.yml

diff --git a/app/assets/javascripts/monitoring/components/charts/area.vue b/app/assets/javascripts/monitoring/components/charts/area.vue
index 78d97a3c122..cac10474d06 100644
--- a/app/assets/javascripts/monitoring/components/charts/area.vue
+++ b/app/assets/javascripts/monitoring/components/charts/area.vue
@@ -126,7 +126,7 @@ export default {
           },
         },
         series: this.scatterSeries,
-        dataZoom: this.dataZoomConfig,
+        dataZoom: [this.dataZoomConfig],
       };
     },
     dataZoomConfig() {
diff --git a/changelogs/unreleased/64385-charts-scroll-handle-icon-has-disappeared.yml b/changelogs/unreleased/64385-charts-scroll-handle-icon-has-disappeared.yml
new file mode 100644
index 00000000000..93ed2ff4619
--- /dev/null
+++ b/changelogs/unreleased/64385-charts-scroll-handle-icon-has-disappeared.yml
@@ -0,0 +1,5 @@
+---
+title: fix charts scroll handle icon to use gitlab svg
+merge_request: 31825
+author:
+type: fixed
diff --git a/spec/javascripts/monitoring/charts/area_spec.js b/spec/javascripts/monitoring/charts/area_spec.js
index 57f99a09002..1e49a955815 100644
--- a/spec/javascripts/monitoring/charts/area_spec.js
+++ b/spec/javascripts/monitoring/charts/area_spec.js
@@ -225,6 +225,14 @@ describe('Area component', () => {
     });
 
     describe('chartOptions', () => {
+      describe('dataZoom', () => {
+        it('contains an svg object within an array to properly render icon', () => {
+          const dataZoomObject = [{}];
+
+          expect(areaChart.vm.chartOptions.dataZoom).toEqual(dataZoomObject);
+        });
+      });
+
       describe('yAxis formatter', () => {
         let format;
 
-- 
cgit v1.2.1


From 29955caeeb90b0805cf639337e29fbf50cbd4afe Mon Sep 17 00:00:00 2001
From: Himanshu Kapoor <info@fleon.org>
Date: Fri, 23 Aug 2019 10:21:05 +0000
Subject: Fix broken git clone box on wiki git access page

Some CSS fixes to fix the position of the git clone box on the
wiki git access page. This fix also includes fixes for various
responsive states.
---
 app/assets/stylesheets/framework/variables.scss    |  1 +
 app/assets/stylesheets/pages/wiki.scss             | 29 +++++-----------------
 app/views/projects/wikis/_sidebar.html.haml        |  6 ++---
 app/views/projects/wikis/edit.html.haml            |  4 +--
 app/views/projects/wikis/git_access.html.haml      | 12 +++++----
 app/views/projects/wikis/history.html.haml         |  2 +-
 app/views/projects/wikis/pages.html.haml           |  4 +--
 app/views/projects/wikis/show.html.haml            |  4 +--
 ...e-url-box-on-wiki-git-access-page-is-broken.yml |  5 ++++
 9 files changed, 29 insertions(+), 38 deletions(-)
 create mode 100644 changelogs/unreleased/66022-git-clone-url-box-on-wiki-git-access-page-is-broken.yml

diff --git a/app/assets/stylesheets/framework/variables.scss b/app/assets/stylesheets/framework/variables.scss
index 92190f8979e..9871771542d 100644
--- a/app/assets/stylesheets/framework/variables.scss
+++ b/app/assets/stylesheets/framework/variables.scss
@@ -469,6 +469,7 @@ $link-active-background: rgba(0, 0, 0, 0.04);
 $link-hover-background: rgba(0, 0, 0, 0.06);
 $inactive-badge-background: rgba(0, 0, 0, 0.08);
 $sidebar-toggle-height: 60px;
+$sidebar-toggle-width: 40px;
 $sidebar-milestone-toggle-bottom-margin: 10px;
 
 /*
diff --git a/app/assets/stylesheets/pages/wiki.scss b/app/assets/stylesheets/pages/wiki.scss
index 379df1c4db1..0b65b915abf 100644
--- a/app/assets/stylesheets/pages/wiki.scss
+++ b/app/assets/stylesheets/pages/wiki.scss
@@ -32,13 +32,11 @@
     color: $gl-text-color-secondary;
   }
 
-  .git-access-header {
-    padding: $gl-padding 0 $gl-padding-top;
-  }
-
   .git-clone-holder {
-    width: 100%;
-    padding-bottom: 40px;
+    .input-group-prepend,
+    .input-group-append {
+      background-color: transparent;
+    }
   }
 
   button.sidebar-toggle {
@@ -48,19 +46,8 @@
     display: block;
   }
 
-  @include media-breakpoint-up(sm) {
-    &.has-sidebar-toggle {
-      padding-right: 40px;
-    }
-
-    .git-clone-holder {
-      width: 480px;
-      padding-bottom: $gl-padding;
-    }
-
-    .nav-controls {
-      width: auto;
-    }
+  &.has-sidebar-toggle .git-access-header {
+    padding-right: $sidebar-toggle-width;
   }
 
   @include media-breakpoint-up(md) {
@@ -105,10 +92,6 @@
     padding: 0 $gl-padding;
   }
 
-  .block {
-    width: 100%;
-  }
-
   a {
     color: $layout-link-gray;
 
diff --git a/app/views/projects/wikis/_sidebar.html.haml b/app/views/projects/wikis/_sidebar.html.haml
index a9d21470944..83d145444d8 100644
--- a/app/views/projects/wikis/_sidebar.html.haml
+++ b/app/views/projects/wikis/_sidebar.html.haml
@@ -1,6 +1,6 @@
 %aside.right-sidebar.right-sidebar-expanded.wiki-sidebar.js-wiki-sidebar.js-right-sidebar{ data: { "offset-top" => "50", "spy" => "affix" } }
   .sidebar-container
-    .block.wiki-sidebar-header.append-bottom-default
+    .block.wiki-sidebar-header.append-bottom-default.w-100
       %a.gutter-toggle.float-right.d-block.d-sm-block.d-md-none.js-sidebar-wiki-toggle{ href: "#" }
         = icon('angle-double-right')
 
@@ -10,12 +10,12 @@
         %span= _("Clone repository")
 
     .blocks-container
-      .block.block-first
+      .block.block-first.w-100
         - if @sidebar_page
           = render_wiki_content(@sidebar_page)
         - else
           %ul.wiki-pages
             = render @sidebar_wiki_entries, context: 'sidebar'
-      .block
+      .block.w-100
         = link_to project_wikis_pages_path(@project), class: 'btn btn-block' do
           = s_("Wiki|More Pages")
diff --git a/app/views/projects/wikis/edit.html.haml b/app/views/projects/wikis/edit.html.haml
index 815b4a51261..9ccf5acfefc 100644
--- a/app/views/projects/wikis/edit.html.haml
+++ b/app/views/projects/wikis/edit.html.haml
@@ -5,7 +5,7 @@
 
 = wiki_page_errors(@error)
 
-.wiki-page-header.top-area.has-sidebar-toggle
+.wiki-page-header.top-area.has-sidebar-toggle.flex-column.flex-lg-row
   %button.btn.btn-default.sidebar-toggle.js-sidebar-wiki-toggle{ role: "button", type: "button" }
     = icon('angle-double-left')
 
@@ -19,7 +19,7 @@
       - else
         = s_("Wiki|Create New Page")
 
-  .nav-controls
+  .nav-controls.pb-md-3.pb-lg-0
     - if @page.persisted?
       = link_to project_wiki_history_path(@project, @page), class: "btn" do
         = s_("Wiki|Page history")
diff --git a/app/views/projects/wikis/git_access.html.haml b/app/views/projects/wikis/git_access.html.haml
index 009133be117..6972eda9bb7 100644
--- a/app/views/projects/wikis/git_access.html.haml
+++ b/app/views/projects/wikis/git_access.html.haml
@@ -1,15 +1,17 @@
 - @content_class = "limit-container-width" unless fluid_layout
 - page_title s_("WikiClone|Git Access"), _("Wiki")
 
-.wiki-page-header.top-area.has-sidebar-toggle
+.wiki-page-header.top-area.has-sidebar-toggle.py-3.flex-column.flex-lg-row
   %button.btn.btn-default.d-block.d-sm-block.d-md-none.float-right.sidebar-toggle.js-sidebar-wiki-toggle{ role: "button", type: "button" }
     = icon('angle-double-left')
 
-  .git-access-header
-    = _("Clone repository")
-    %strong= @project_wiki.full_path
+  .git-access-header.w-100.d-flex.flex-column.justify-content-center
+    %span
+      = _("Clone repository")
+      %strong= @project_wiki.full_path
 
-  = render "shared/clone_panel", project: @project_wiki
+  .pt-3.pt-lg-0.w-100
+    = render "shared/clone_panel", project: @project_wiki
 
 .wiki-git-access
   %h3= s_("WikiClone|Install Gollum")
diff --git a/app/views/projects/wikis/history.html.haml b/app/views/projects/wikis/history.html.haml
index f8468ef9a78..d3a55c53649 100644
--- a/app/views/projects/wikis/history.html.haml
+++ b/app/views/projects/wikis/history.html.haml
@@ -1,6 +1,6 @@
 - page_title _("History"), @page.human_title, _("Wiki")
 
-.wiki-page-header.top-area.has-sidebar-toggle
+.wiki-page-header.top-area.has-sidebar-toggle.flex-column.flex-lg-row
   %button.btn.btn-default.sidebar-toggle.js-sidebar-wiki-toggle{ role: "button", type: "button" }
     = icon('angle-double-left')
 
diff --git a/app/views/projects/wikis/pages.html.haml b/app/views/projects/wikis/pages.html.haml
index f7999c3f1bd..275dc5dbd23 100644
--- a/app/views/projects/wikis/pages.html.haml
+++ b/app/views/projects/wikis/pages.html.haml
@@ -5,13 +5,13 @@
 - sort_title = wiki_sort_title(params[:sort])
 
 %div{ class: container_class }
-  .wiki-page-header.top-area
+  .wiki-page-header.top-area.flex-column.flex-lg-row
 
     .nav-text.flex-fill
       %h2.wiki-page-title
         = s_("Wiki|Wiki Pages")
 
-    .nav-controls
+    .nav-controls.pb-md-3.pb-lg-0
       = link_to project_wikis_git_access_path(@project), class: 'btn' do
         = icon('cloud-download')
         = _("Clone repository")
diff --git a/app/views/projects/wikis/show.html.haml b/app/views/projects/wikis/show.html.haml
index 1d649886331..c6197fe576e 100644
--- a/app/views/projects/wikis/show.html.haml
+++ b/app/views/projects/wikis/show.html.haml
@@ -4,7 +4,7 @@
 - page_title @page.human_title, _("Wiki")
 - add_to_breadcrumbs _("Wiki"), project_wiki_path(@project, :home)
 
-.wiki-page-header.top-area.has-sidebar-toggle
+.wiki-page-header.top-area.has-sidebar-toggle.flex-column.flex-lg-row
   %button.btn.btn-default.sidebar-toggle.js-sidebar-wiki-toggle{ role: "button", type: "button" }
     = icon('angle-double-left')
 
@@ -15,7 +15,7 @@
         = (_("Last edited by %{name}") % { name: "<strong>#{@page.last_version.author_name}</strong>" }).html_safe
         #{time_ago_with_tooltip(@page.last_version.authored_date)}
 
-  .nav-controls
+  .nav-controls.pb-md-3.pb-lg-0
     = render 'main_links'
 
 - if @page.historical?
diff --git a/changelogs/unreleased/66022-git-clone-url-box-on-wiki-git-access-page-is-broken.yml b/changelogs/unreleased/66022-git-clone-url-box-on-wiki-git-access-page-is-broken.yml
new file mode 100644
index 00000000000..931e947f8ed
--- /dev/null
+++ b/changelogs/unreleased/66022-git-clone-url-box-on-wiki-git-access-page-is-broken.yml
@@ -0,0 +1,5 @@
+---
+title: Fix broken git clone box on wiki git access page
+merge_request: 31898
+author:
+type: fixed
-- 
cgit v1.2.1


From b86d3f28763f76f5012423851decc5b1211f4fc3 Mon Sep 17 00:00:00 2001
From: Alessio Caiazza <acaiazza@gitlab.com>
Date: Fri, 23 Aug 2019 10:40:04 +0000
Subject: Document uploads development guidelines

Explain Workhorse acceleration features
---
 doc/development/README.md       |   1 +
 doc/development/file_storage.md |   2 +
 doc/development/uploads.md      | 271 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 274 insertions(+)
 create mode 100644 doc/development/uploads.md

diff --git a/doc/development/README.md b/doc/development/README.md
index 5e35d4c7437..3912a828dec 100644
--- a/doc/development/README.md
+++ b/doc/development/README.md
@@ -65,6 +65,7 @@ description: 'Learn how to contribute to GitLab.'
 - [Repository mirroring](repository_mirroring.md)
 - [Git LFS](lfs.md)
 - [Developing against interacting components or features](interacting_components.md)
+- [File uploads](uploads.md)
 
 ## Performance guides
 
diff --git a/doc/development/file_storage.md b/doc/development/file_storage.md
index 475d1c1611e..44af2b020a4 100644
--- a/doc/development/file_storage.md
+++ b/doc/development/file_storage.md
@@ -2,6 +2,8 @@
 
 We use the [CarrierWave] gem to handle file upload, store and retrieval.
 
+File uploads should be accelerated by workhorse, for details please refer to [uploads development documentation](uploads.md).
+
 There are many places where file uploading is used, according to contexts:
 
 - System
diff --git a/doc/development/uploads.md b/doc/development/uploads.md
new file mode 100644
index 00000000000..234539bb673
--- /dev/null
+++ b/doc/development/uploads.md
@@ -0,0 +1,271 @@
+# Uploads development documentation
+
+[GitLab Workhorse](https://gitlab.com/gitlab-org/gitlab-workhorse) has special rules for handling uploads.
+To prevent occupying a ruby process on I/O operations, we process the upload in workhorse, where is cheaper.
+This process can also directly upload to object storage.
+
+## The problem description
+
+The following graph explains machine boundaries in a scalable GitLab installation. Without any workhorse optimization in place, we can expect incoming requests to follow the numbers on the arrows.
+
+```mermaid
+graph TB
+    subgraph "load balancers"
+      LB(HA Proxy)
+    end
+
+    subgraph "Shared storage"
+       nfs(NFS)
+    end
+
+    subgraph "redis cluster"
+       r(persisted redis)
+    end
+    LB-- 1 -->workhorse
+
+    subgraph "web or API fleet"
+      workhorse-- 2 -->rails
+    end
+    rails-- "3 (write files)" -->nfs
+    rails-- "4 (schedule a job)" -->r
+
+    subgraph sidekiq
+      s(sidekiq)
+    end
+    s-- "5 (fetch a job)" -->r
+    s-- "6 (read files)" -->nfs
+```
+
+We have three challenges here: performance, availability, and scalability.
+
+### Performance
+
+Rails process are expensive in terms of both CPU and memory. Ruby [global interpreter lock](https://en.wikipedia.org/wiki/Global_interpreter_lock) adds to cost too because the ruby process will spend time on I/O operations on step 3 causing incoming requests to pile up.
+
+In order to improve this, [workhorse disk acceleration](#workhorse-disk-acceleration) was implemented. With this, Rails no longer deals with writing uploaded files to disk.
+
+```mermaid
+graph TB
+    subgraph "load balancers"
+      LB(HA Proxy)
+    end
+
+    subgraph "Shared storage"
+       nfs(NFS)
+    end
+
+    subgraph "redis cluster"
+       r(persisted redis)
+    end
+    LB-- 1 -->workhorse
+
+    subgraph "web or API fleet"
+      workhorse-- "3 (without files)" -->rails
+    end
+    workhorse -- "2 (write files)" -->nfs
+    rails-- "4 (schedule a job)" -->r
+
+    subgraph sidekiq
+      s(sidekiq)
+    end
+    s-- "5 (fetch a job)" -->r
+    s-- "6 (read files)" -->nfs
+```
+
+### Availability
+
+There's also an availability problem in this setup, NFS is a [single point of failure](https://en.wikipedia.org/wiki/Single_point_of_failure).
+
+To address this problem an HA object storage can be used and it's supported by [workhorse object storage acceleration](#workhorse-object-storage-acceleration)
+
+### Scalability
+
+Scaling NFS is outside of our support scope, and NFS is not a part of cloud native installations.
+
+All features that require sidekiq and do not use object storage acceleration won't work without NFS. In Kubernetes, machine boundaries translate to PODs, and in this case the uploaded file will be written into the POD private disk. Since sidekiq POD cannot reach into other pods, the operation will fail to read it.
+
+## How to select the proper level of acceleration?
+
+Selecting the proper acceleration is a tradeoff between speed of development and operational costs.
+
+We can identify three major use-cases for an upload:
+
+1. **storage:** if we are uploading for storing a file (i.e. artifacts, packages, discussion attachments). In this case [object storage acceleration](#workhorse-object-storage-acceleration) is the proper level as it's the less resource-intensive operation. Additional information can be found on [File Storage in GitLab](file_storage.md).
+1. **in-controller/synchronous processing:** if we allow processing **small files** synchronously, using [disk acceleration](#workhorse-disk-acceleration) may speed up development.
+1. **sidekiq/asynchronous processing:** Async processing must implement [object storage acceleration](#workhorse-object-storage-acceleration), the reason being that it's the only way to support Cloud Native deployments without a shared NFS.
+
+For more details about currently broken feature see [epic &1802](https://gitlab.com/groups/gitlab-org/-/epics/1802).
+
+### Handling repository uploads
+
+Some features involves git repository uploads without using a regular git client.
+Some examples are uploading a repository file from the web interface and [design management](../user/project/issues/design_management.md).
+
+Those uploads requires the rails controller to act as a git client in lieu of the user.
+Those operation falls into _in-controller/synchronous processing_ category, but we have no warranties on the file size.
+
+In case of a LFS upload, the file pointer is committed synchronously, but file upload to object storage is performed asynchronously with sidekiq.
+
+## Upload encodings
+
+By upload encoding we mean how the file is included within the incoming request.
+
+We have three kinds of file encoding in our uploads:
+
+1. <i class="fa fa-check-circle"></i> **multipart**: `multipart/form-data` is the most common, a file is encoded as a part of a multipart encoded request.
+1. <i class="fa fa-check-circle"></i> **body**: some APIs uploads files as the whole request body.
+1. <i class="fa fa-times-circle"></i> **JSON**: some JSON API uploads files as base64 encoded strings. This requires [gitlab-workhorse#226](https://gitlab.com/gitlab-org/gitlab-workhorse/issues/226) to be implemented.
+
+## Uploading technologies
+
+By uploading technologies we mean how all the involved services interact with each other.
+
+GitLab supports 3 kinds of uploading technologies, here follows a brief description with a sequence diagram for each one. Diagrams are not meant to be exhaustive.
+
+### Regular rails upload
+
+This is the default kind of upload, and it's most expensive in terms of resources.
+
+In this case, workhorse is unaware of files being uploaded and acts as a regular proxy.
+
+When a multipart request reaches the rails application, `Rack::Multipart` leaves behind tempfiles in `/tmp` and uses valuable Ruby process time to copy files around.
+
+```mermaid
+sequenceDiagram
+    participant c as Client
+    participant w as Workhorse
+    participant r as Rails
+
+    activate c
+    c ->>+w: POST /some/url/upload
+    w->>+r:  POST /some/url/upload
+
+    r->>r: save the incoming file on /tmp
+    r->>r: read the file for processing
+
+    r-->>-c: request result
+    deactivate c
+    deactivate w
+```
+
+### Workhorse disk acceleration
+
+This kind of upload avoids wasting resources caused by handling upload writes to `/tmp` in rails.
+
+This optimization is not active by default on REST API requests.
+
+When enabled, Workhorse looks for files in multipart MIME requests, uploading
+any it finds to a temporary file on shared storage. The MIME data in the request
+is replaced with the path to the corresponding file before it is forwarded to
+Rails.
+
+To prevent abuse of this feature, Workhorse signs the modified request with a
+special header, stating which entries it modified. Rails will ignore any
+unsigned path entries.
+
+```mermaid
+sequenceDiagram
+    participant c as Client
+    participant w as Workhorse
+    participant r as Rails
+    participant s as NFS
+
+    activate c
+    c ->>+w: POST /some/url/upload
+
+    w->>+s: save the incoming file on a temporary location
+    s-->>-w: 
+
+    w->>+r:  POST /some/url/upload
+    Note over w,r: file was replaced with its location<br>and other metadata
+
+    opt requires async processing
+      r->>+redis: schedule a job
+      redis-->>-r: 
+    end
+
+    r-->>-c: request result
+    deactivate c
+    w->>-w: cleanup
+
+    opt requires async processing
+      activate sidekiq
+      sidekiq->>+redis: fetch a job
+      redis-->>-sidekiq: job
+
+      sidekiq->>+s: read file
+      s-->>-sidekiq: file
+
+      sidekiq->>sidekiq: process file
+
+      deactivate sidekiq
+    end
+```
+
+### Workhorse object storage acceleration
+
+This is the more advanced acceleration technique we have in place.
+
+Workhorse asks rails for temporary pre-signed object storage URLs and directly uploads to object storage.
+
+In this setup an extra rails route needs to be implemented in order to handle authorization,
+you can see an example of this in [`Projects::LfsStorageController`](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/controllers/projects/lfs_storage_controller.rb)
+and [its routes](https://gitlab.com/gitlab-org/gitlab-ce/blob/v12.2.0/config/routes/git_http.rb#L31-32).
+
+**note:** this will fallback to _Workhorse disk acceleration_ when object storage is not enabled in the gitlab instance. The answer to the `/authorize` call will only contain a file system path.
+
+```mermaid
+sequenceDiagram
+    participant c as Client
+    participant w as Workhorse
+    participant r as Rails
+    participant os as Object Storage
+
+    activate c
+    c ->>+w: POST /some/url/upload
+
+    w ->>+r: POST /some/url/upload/authorize
+    Note over w,r: this request has an empty body
+    r-->>-w: presigned OS URL
+
+    w->>+os: PUT file
+    Note over w,os: file is stored on a temporary location. Rails select the destination
+    os-->>-w: 
+
+    w->>+r:  POST /some/url/upload
+    Note over w,r: file was replaced with its location<br>and other metadata
+
+    r->>+os: move object to final destination
+    os-->>-r: 
+
+    opt requires async processing
+      r->>+redis: schedule a job
+      redis-->>-r: 
+    end
+
+    r-->>-c: request result
+    deactivate c
+    w->>-w: cleanup
+
+    opt requires async processing
+      activate sidekiq
+      sidekiq->>+redis: fetch a job
+      redis-->>-sidekiq: job
+
+      sidekiq->>+os: get object
+      os-->>-sidekiq: file
+
+      sidekiq->>sidekiq: process file
+
+      deactivate sidekiq
+    end
+```
+
+## What does the `direct_upload` setting mean?
+
+[Object storage setting](../administration/uploads.md#object-storage-settings) allows instance administators to enable `direct_upload`, this in an option that only affects the behavior of [workhorse object storage acceleration](#workhorse-object-storage-acceleration).
+
+This option affect the response to the `/authorize` call. When not enabled, the API response will not contain presigned URLs and workhorse will write the file the shared disk, on the path is provided by rails, acting like object storage was disabled.
+
+Once the request reachs rails, it will schedule an object storage upload as a sidekiq job.
+
-- 
cgit v1.2.1


From 6642d5471d65086d5a28f55205dd350bc1244aff Mon Sep 17 00:00:00 2001
From: Tetiana Chupryna <tchupryna@gitlab.com>
Date: Fri, 23 Aug 2019 11:34:05 +0000
Subject: Update dependencies api doc

---
 doc/api/dependencies.md | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/doc/api/dependencies.md b/doc/api/dependencies.md
index 5767d3572dd..5296d4e316f 100644
--- a/doc/api/dependencies.md
+++ b/doc/api/dependencies.md
@@ -5,7 +5,8 @@ This API is in an alpha stage and considered unstable.
 The response payload may be subject to change or breakage
 across GitLab releases.
 
-Every call to this endpoint requires authentication. To perform this call, user should be authorized to read
+Every call to this endpoint requires authentication. To perform this call, user should be authorized to read repository.
+To see vulnerabilities in response, user should be authorized to read
 [Project Security Dashboard](../user/application_security/security_dashboard/index.md#project-security-dashboard).
 
 ## List project dependencies
@@ -17,8 +18,8 @@ supported by Gemnasium.
 
 ```
 GET /projects/:id/dependencies
-GET /projects/:id/vulnerabilities?package_manager=maven
-GET /projects/:id/vulnerabilities?package_manager=yarn,bundler
+GET /projects/:id/dependencies?package_manager=maven
+GET /projects/:id/dependencies?package_manager=yarn,bundler
 ```
 
 | Attribute     | Type           | Required | Description                                                                                                                                                                 |
@@ -38,13 +39,18 @@ Example response:
     "name": "rails",
     "version": "5.0.1",
     "package_manager": "bundler",
-    "dependency_file_path": "Gemfile.lock"
+    "dependency_file_path": "Gemfile.lock",
+    "vulnerabilities": [{
+      "name": "DDoS",
+      "severity": "unknown"
+    }]
   },
   {
       "name": "hanami",
       "version": "1.3.1",
       "package_manager": "bundler",
-      "dependency_file_path": "Gemfile.lock"
+      "dependency_file_path": "Gemfile.lock",
+      "vulnerabilities": []
     }
 ]
 ```
-- 
cgit v1.2.1


From 8d5fac4f56bb6c0d6625ea5f6364796a80196933 Mon Sep 17 00:00:00 2001
From: Winnie Hellmann <winnie@gitlab.com>
Date: Fri, 23 Aug 2019 11:40:56 +0000
Subject: Hide duplicate board list while dragging

---
 app/assets/javascripts/test_utils/simulate_drag.js    |  6 +++++-
 app/assets/stylesheets/pages/boards.scss              |  3 +++
 app/views/shared/boards/components/_board.html.haml   |  2 +-
 .../unreleased/winh-deduplicate-board-headers.yml     |  5 +++++
 spec/features/boards/boards_spec.rb                   | 14 ++++++++++++--
 spec/support/helpers/drag_to_helper.rb                | 19 +++++++++++++++++--
 6 files changed, 43 insertions(+), 6 deletions(-)
 create mode 100644 changelogs/unreleased/winh-deduplicate-board-headers.yml

diff --git a/app/assets/javascripts/test_utils/simulate_drag.js b/app/assets/javascripts/test_utils/simulate_drag.js
index be9ebc81c6b..c9bf234fcce 100644
--- a/app/assets/javascripts/test_utils/simulate_drag.js
+++ b/app/assets/javascripts/test_utils/simulate_drag.js
@@ -153,7 +153,11 @@ export default function simulateDrag(options) {
 
     if (progress >= 1) {
       if (options.ondragend) options.ondragend();
-      simulateEvent(toEl, 'mouseup');
+
+      if (options.performDrop) {
+        simulateEvent(toEl, 'mouseup');
+      }
+
       clearInterval(dragInterval);
       window.SIMULATE_DRAG_ACTIVE = 0;
     }
diff --git a/app/assets/stylesheets/pages/boards.scss b/app/assets/stylesheets/pages/boards.scss
index 343cca96851..e77a2d1e333 100644
--- a/app/assets/stylesheets/pages/boards.scss
+++ b/app/assets/stylesheets/pages/boards.scss
@@ -86,6 +86,9 @@
 }
 
 .board {
+  // the next line cannot be replaced with .d-inline-block because it breaks display: none of SortableJS
+  // see https://gitlab.com/gitlab-org/gitlab-ce/issues/64828
+  display: inline-block;
   width: calc(85vw - 15px);
 
   @include media-breakpoint-up(sm) {
diff --git a/app/views/shared/boards/components/_board.html.haml b/app/views/shared/boards/components/_board.html.haml
index 5abd4ce0fb9..ffa24d1c041 100644
--- a/app/views/shared/boards/components/_board.html.haml
+++ b/app/views/shared/boards/components/_board.html.haml
@@ -1,4 +1,4 @@
-.board.d-inline-block.h-100.px-2.align-top.ws-normal{ ":class" => '{ "is-draggable": !list.preset, "is-expandable": list.isExpandable, "is-collapsed": !list.isExpanded, "board-type-assignee": list.type === "assignee" }',
+.board.h-100.px-2.align-top.ws-normal{ ":class" => '{ "is-draggable": !list.preset, "is-expandable": list.isExpandable, "is-collapsed": !list.isExpanded, "board-type-assignee": list.type === "assignee" }',
   ":data-id" => "list.id", data: { qa_selector: "board_list" } }
   .board-inner.d-flex.flex-column.position-relative.h-100.rounded
     %header.board-header{ ":class" => '{ "has-border": list.label && list.label.color, "position-relative": list.isExpanded, "position-absolute position-top-0 position-left-0 w-100 h-100": !list.isExpanded }', ":style" => "{ borderTopColor: (list.label && list.label.color ? list.label.color : null) }", data: { qa_selector: "board_list_header" } }
diff --git a/changelogs/unreleased/winh-deduplicate-board-headers.yml b/changelogs/unreleased/winh-deduplicate-board-headers.yml
new file mode 100644
index 00000000000..009ce59b6bc
--- /dev/null
+++ b/changelogs/unreleased/winh-deduplicate-board-headers.yml
@@ -0,0 +1,5 @@
+---
+title: Hide duplicate board list while dragging
+merge_request: 32099
+author:
+type: fixed
diff --git a/spec/features/boards/boards_spec.rb b/spec/features/boards/boards_spec.rb
index 4e7b25115d7..902ecdcd3e8 100644
--- a/spec/features/boards/boards_spec.rb
+++ b/spec/features/boards/boards_spec.rb
@@ -236,6 +236,15 @@ describe 'Issue Boards', :js do
         expect(find('.board:nth-child(2)')).to have_content(planning.title)
       end
 
+      it 'dragging does not duplicate list' do
+        selector = '.board:not(.is-ghost) .board-header'
+        expect(page).to have_selector(selector, text: development.title, count: 1)
+
+        drag(list_from_index: 2, list_to_index: 1, selector: '.board-header', perform_drop: false)
+
+        expect(page).to have_selector(selector, text: development.title, count: 1)
+      end
+
       it 'issue moves between lists' do
         drag(list_from_index: 1, from_index: 1, list_to_index: 2)
 
@@ -576,7 +585,7 @@ describe 'Issue Boards', :js do
     end
   end
 
-  def drag(selector: '.board-list', list_from_index: 0, from_index: 0, to_index: 0, list_to_index: 0)
+  def drag(selector: '.board-list', list_from_index: 0, from_index: 0, to_index: 0, list_to_index: 0, perform_drop: true)
     # ensure there is enough horizontal space for four boards
     resize_window(2000, 800)
 
@@ -585,7 +594,8 @@ describe 'Issue Boards', :js do
             list_from_index: list_from_index,
             from_index: from_index,
             to_index: to_index,
-            list_to_index: list_to_index)
+            list_to_index: list_to_index,
+            perform_drop: perform_drop)
   end
 
   def wait_for_board_cards(board_number, expected_cards)
diff --git a/spec/support/helpers/drag_to_helper.rb b/spec/support/helpers/drag_to_helper.rb
index 6099f87323f..2e9932f2e8a 100644
--- a/spec/support/helpers/drag_to_helper.rb
+++ b/spec/support/helpers/drag_to_helper.rb
@@ -1,8 +1,23 @@
 # frozen_string_literal: true
 
 module DragTo
-  def drag_to(list_from_index: 0, from_index: 0, to_index: 0, list_to_index: 0, selector: '', scrollable: 'body', duration: 1000)
-    evaluate_script("simulateDrag({scrollable: $('#{scrollable}').get(0), duration: #{duration}, from: {el: $('#{selector}').eq(#{list_from_index}).get(0), index: #{from_index}}, to: {el: $('#{selector}').eq(#{list_to_index}).get(0), index: #{to_index}}});")
+  def drag_to(list_from_index: 0, from_index: 0, to_index: 0, list_to_index: 0, selector: '', scrollable: 'body', duration: 1000, perform_drop: true)
+    js = <<~JS
+      simulateDrag({
+        scrollable: document.querySelector('#{scrollable}'),
+        duration: #{duration},
+        from: {
+          el: document.querySelectorAll('#{selector}')[#{list_from_index}],
+          index: #{from_index}
+        },
+        to: {
+          el: document.querySelectorAll('#{selector}')[#{list_to_index}],
+          index: #{to_index}
+        },
+        performDrop: #{perform_drop}
+      });
+    JS
+    evaluate_script(js)
 
     Timeout.timeout(Capybara.default_max_wait_time) do
       loop while drag_active?
-- 
cgit v1.2.1


From 642f6b38169c5805676f061708d25137f4cc986e Mon Sep 17 00:00:00 2001
From: Nick Thomas <nick@gitlab.com>
Date: Thu, 22 Aug 2019 16:05:07 +0100
Subject: Send TODOs for comments on commits correctly

At present, the TodoService uses the `:read_project` ability to decide
whether a user can read a note on a commit. However, commits can have a
visibility level that is more restricted than the project, so this is a
security issue.

This commit changes the code to use the `:read_commit` ability in this
case instead, which ensures TODOs are only generated for commit notes
if the users can see the commit.
---
 app/services/todo_service.rb                       |   6 +-
 .../unreleased/security-64711-fix-commit-todos.yml |   5 +
 spec/services/todo_service_spec.rb                 | 121 ++++++++++++++++++---
 3 files changed, 112 insertions(+), 20 deletions(-)
 create mode 100644 changelogs/unreleased/security-64711-fix-commit-todos.yml

diff --git a/app/services/todo_service.rb b/app/services/todo_service.rb
index 0ea230a44a1..b1256df35d6 100644
--- a/app/services/todo_service.rb
+++ b/app/services/todo_service.rb
@@ -314,11 +314,9 @@ class TodoService
   end
 
   def reject_users_without_access(users, parent, target)
-    if target.is_a?(Note) && target.for_issuable?
-      target = target.noteable
-    end
+    target = target.noteable if target.is_a?(Note)
 
-    if target.is_a?(Issuable)
+    if target.respond_to?(:to_ability_name)
       select_users(users, :"read_#{target.to_ability_name}", target)
     else
       select_users(users, :read_project, parent)
diff --git a/changelogs/unreleased/security-64711-fix-commit-todos.yml b/changelogs/unreleased/security-64711-fix-commit-todos.yml
new file mode 100644
index 00000000000..ce4b3cdeeaf
--- /dev/null
+++ b/changelogs/unreleased/security-64711-fix-commit-todos.yml
@@ -0,0 +1,5 @@
+---
+title: Send TODOs for comments on commits correctly
+merge_request:
+author:
+type: security
diff --git a/spec/services/todo_service_spec.rb b/spec/services/todo_service_spec.rb
index 9ee23f3eb48..bdf2f59704c 100644
--- a/spec/services/todo_service_spec.rb
+++ b/spec/services/todo_service_spec.rb
@@ -436,25 +436,114 @@ describe TodoService do
         should_create_todo(user: john_doe, target: confidential_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_confidential_issue)
       end
 
-      context 'on commit' do
-        let(:project) { create(:project, :repository) }
-
-        it 'creates a todo for each valid mentioned user when leaving a note on commit' do
-          service.new_note(note_on_commit, john_doe)
-
-          should_create_todo(user: member, target_id: nil, target_type: 'Commit', commit_id: note_on_commit.commit_id, author: john_doe, action: Todo::MENTIONED, note: note_on_commit)
-          should_create_todo(user: author, target_id: nil, target_type: 'Commit', commit_id: note_on_commit.commit_id, author: john_doe, action: Todo::MENTIONED, note: note_on_commit)
-          should_create_todo(user: john_doe, target_id: nil, target_type: 'Commit', commit_id: note_on_commit.commit_id, author: john_doe, action: Todo::MENTIONED, note: note_on_commit)
-          should_not_create_todo(user: non_member, target_id: nil, target_type: 'Commit', commit_id: note_on_commit.commit_id, author: john_doe, action: Todo::MENTIONED, note: note_on_commit)
+      context 'commits' do
+        let(:base_commit_todo_attrs) { { target_id: nil, target_type: 'Commit', author: john_doe } }
+
+        context 'leaving a note on a commit in a public project' do
+          let(:project) { create(:project, :repository, :public) }
+          it 'creates a todo for each valid mentioned user' do
+            expected_todo = base_commit_todo_attrs.merge(
+              action: Todo::MENTIONED,
+              note: note_on_commit,
+              commit_id: note_on_commit.commit_id
+            )
+
+            service.new_note(note_on_commit, john_doe)
+
+            should_create_todo(expected_todo.merge(user: member))
+            should_create_todo(expected_todo.merge(user: author))
+            should_create_todo(expected_todo.merge(user: john_doe))
+            should_create_todo(expected_todo.merge(user: guest))
+            should_create_todo(expected_todo.merge(user: non_member))
+          end
+
+          it 'creates a directly addressed todo for each valid mentioned user' do
+            expected_todo = base_commit_todo_attrs.merge(
+              action: Todo::DIRECTLY_ADDRESSED,
+              note: addressed_note_on_commit,
+              commit_id: addressed_note_on_commit.commit_id
+            )
+
+            service.new_note(addressed_note_on_commit, john_doe)
+
+            should_create_todo(expected_todo.merge(user: member))
+            should_create_todo(expected_todo.merge(user: author))
+            should_create_todo(expected_todo.merge(user: john_doe))
+            should_create_todo(expected_todo.merge(user: guest))
+            should_create_todo(expected_todo.merge(user: non_member))
+          end
         end
 
-        it 'creates a directly addressed todo for each valid mentioned user when leaving a note on commit' do
-          service.new_note(addressed_note_on_commit, john_doe)
+        context 'leaving a note on a commit in a public project with private code' do
+          let(:project) { create(:project, :repository, :public, :repository_private) }
+
+          it 'creates a todo for each valid mentioned user' do
+            expected_todo = base_commit_todo_attrs.merge(
+              action: Todo::MENTIONED,
+              note: note_on_commit,
+              commit_id: note_on_commit.commit_id
+            )
+
+            service.new_note(note_on_commit, john_doe)
+
+            should_create_todo(expected_todo.merge(user: member))
+            should_create_todo(expected_todo.merge(user: author))
+            should_create_todo(expected_todo.merge(user: john_doe))
+            should_create_todo(expected_todo.merge(user: guest))
+            should_not_create_todo(expected_todo.merge(user: non_member))
+          end
+
+          it 'creates a directly addressed todo for each valid mentioned user' do
+            expected_todo = base_commit_todo_attrs.merge(
+              action: Todo::DIRECTLY_ADDRESSED,
+              note: addressed_note_on_commit,
+              commit_id: addressed_note_on_commit.commit_id
+            )
+
+            service.new_note(addressed_note_on_commit, john_doe)
+
+            should_create_todo(expected_todo.merge(user: member))
+            should_create_todo(expected_todo.merge(user: author))
+            should_create_todo(expected_todo.merge(user: john_doe))
+            should_create_todo(expected_todo.merge(user: guest))
+            should_not_create_todo(expected_todo.merge(user: non_member))
+          end
+        end
 
-          should_create_todo(user: member, target_id: nil, target_type: 'Commit', commit_id: addressed_note_on_commit.commit_id, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_commit)
-          should_create_todo(user: author, target_id: nil, target_type: 'Commit', commit_id: addressed_note_on_commit.commit_id, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_commit)
-          should_create_todo(user: john_doe, target_id: nil, target_type: 'Commit', commit_id: addressed_note_on_commit.commit_id, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_commit)
-          should_not_create_todo(user: non_member, target_id: nil, target_type: 'Commit', commit_id: addressed_note_on_commit.commit_id, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_commit)
+        context 'leaving a note on a commit in a private project' do
+          let(:project) { create(:project, :repository, :private) }
+
+          it 'creates a todo for each valid mentioned user' do
+            expected_todo = base_commit_todo_attrs.merge(
+              action: Todo::MENTIONED,
+              note: note_on_commit,
+              commit_id: note_on_commit.commit_id
+            )
+
+            service.new_note(note_on_commit, john_doe)
+
+            should_create_todo(expected_todo.merge(user: member))
+            should_create_todo(expected_todo.merge(user: author))
+            should_create_todo(expected_todo.merge(user: john_doe))
+            should_not_create_todo(expected_todo.merge(user: guest))
+            should_not_create_todo(expected_todo.merge(user: non_member))
+          end
+
+          it 'creates a directly addressed todo for each valid mentioned user' do
+            expected_todo = base_commit_todo_attrs.merge(
+              action: Todo::DIRECTLY_ADDRESSED,
+              note: addressed_note_on_commit,
+              commit_id: addressed_note_on_commit.commit_id
+            )
+
+            service.new_note(addressed_note_on_commit, john_doe)
+
+            should_create_todo(expected_todo.merge(user: member))
+            should_create_todo(expected_todo.merge(user: author))
+            should_create_todo(expected_todo.merge(user: john_doe))
+            should_not_create_todo(expected_todo.merge(user: guest))
+            should_not_create_todo(expected_todo.merge(user: non_member))
+          end
         end
       end
 
-- 
cgit v1.2.1


From 21024065c586e64e802e838c1efe1cb21a3c3a37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matija=20=C4=8Cupi=C4=87?= <matteeyah@gmail.com>
Date: Fri, 23 Aug 2019 14:49:52 +0200
Subject: Preload tags when loading Ci::Pipeline

---
 app/controllers/projects/pipelines_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/projects/pipelines_controller.rb b/app/controllers/projects/pipelines_controller.rb
index e6e3a440925..499d4918899 100644
--- a/app/controllers/projects/pipelines_controller.rb
+++ b/app/controllers/projects/pipelines_controller.rb
@@ -180,7 +180,7 @@ class Projects::PipelinesController < Projects::ApplicationController
                   else
                     project
                       .all_pipelines
-                      .includes(user: :status)
+                      .includes(builds: :tags, user: :status)
                       .find_by!(id: params[:id])
                       .present(current_user: current_user)
                   end
-- 
cgit v1.2.1


From 7b917bf9b6f107b16d45ed600df2878f79d03575 Mon Sep 17 00:00:00 2001
From: David Wilkins <dwilkins@gitlab.com>
Date: Fri, 23 Aug 2019 13:10:39 +0000
Subject: 62514 - update prometheus metrics docs

- Strikeout for metrics that aren't reported anymore

- added :thumbsup: for all the metrics that appear to be still
  available

- Added :new: for the new metrics.

- Determine Release when the new metrics appeared

- Add descriptions for the new metrics

- remove the adornments :new: and :thumbsup:

- removce the lines with strikeout
---
 .../monitoring/prometheus/gitlab_metrics.md        | 143 ++++++++++++++++-----
 1 file changed, 110 insertions(+), 33 deletions(-)

diff --git a/doc/administration/monitoring/prometheus/gitlab_metrics.md b/doc/administration/monitoring/prometheus/gitlab_metrics.md
index ec26c0b2e7e..0605fb76e2f 100644
--- a/doc/administration/monitoring/prometheus/gitlab_metrics.md
+++ b/doc/administration/monitoring/prometheus/gitlab_metrics.md
@@ -19,38 +19,106 @@ it, the client IP needs to be [included in a whitelist][whitelist].
 
 For Omnibus and Chart installations, these metrics are automatically enabled and collected as of [GitLab 9.4](https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests/1702). For source installations or earlier versions, these metrics will need to be enabled manually and collected by a Prometheus server.
 
-## Unicorn Metrics available
+## Metrics available
 
 The following metrics are available:
 
-| Metric                            | Type      | Since | Description |
-|:--------------------------------- |:--------- |:----- |:----------- |
-| db_ping_timeout                   | Gauge     | 9.4   | Whether or not the last database ping timed out |
-| db_ping_success                   | Gauge     | 9.4   | Whether or not the last database ping succeeded |
-| db_ping_latency_seconds           | Gauge     | 9.4   | Round trip time of the database ping |
-| filesystem_access_latency_seconds | Gauge     | 9.4   | Latency in accessing a specific filesystem |
-| filesystem_accessible             | Gauge     | 9.4   | Whether or not a specific filesystem is accessible |
-| filesystem_write_latency_seconds  | Gauge     | 9.4   | Write latency of a specific filesystem |
-| filesystem_writable               | Gauge     | 9.4   | Whether or not the filesystem is writable |
-| filesystem_read_latency_seconds   | Gauge     | 9.4   | Read latency of a specific filesystem |
-| filesystem_readable               | Gauge     | 9.4   | Whether or not the filesystem is readable |
-| gitlab_cache_misses_total         | Counter   | 10.2  | Cache read miss |
-| gitlab_cache_operation_duration_seconds | Histogram   | 10.2  | Cache access time |
-| gitlab_cache_operations_total     | Counter   | 12.2  | Cache operations by controller/action |
-| http_requests_total               | Counter   | 9.4   | Rack request count |
-| http_request_duration_seconds     | Histogram | 9.4   | HTTP response time from rack middleware |
-| pipelines_created_total           | Counter   | 9.4   | Counter of pipelines created |
-| rack_uncaught_errors_total        | Counter   | 9.4   | Rack connections handling uncaught errors count |
-| redis_ping_timeout                | Gauge     | 9.4   | Whether or not the last redis ping timed out |
-| redis_ping_success                | Gauge     | 9.4   | Whether or not the last redis ping succeeded |
-| redis_ping_latency_seconds        | Gauge     | 9.4   | Round trip time of the redis ping |
-| user_session_logins_total         | Counter   | 9.4   | Counter of how many users have logged in |
-| upload_file_does_not_exist        | Counter   | 10.7 in EE, 11.5 in CE  | Number of times an upload record could not find its file |
-| failed_login_captcha_total        | Gauge     | 11.0  | Counter of failed CAPTCHA attempts during login |
-| successful_login_captcha_total    | Gauge     | 11.0  | Counter of successful CAPTCHA attempts during login |
-| unicorn_active_connections        | Gauge     | 11.0  | The number of active Unicorn connections (workers) |
-| unicorn_queued_connections        | Gauge     | 11.0  | The number of queued Unicorn connections |
-| unicorn_workers                   | Gauge     | 12.0  | The number of Unicorn workers |
+| Metric                                                       | Type      |                  Since | Description                                                                                         | Labels                                              |
+|:-------------------------------------------------------------|:----------|-----------------------:|:----------------------------------------------------------------------------------------------------|:----------------------------------------------------|
+| gitlab_banzai_cached_render_real_duration_seconds            | Histogram |                    9.4 | Duration of rendering markdown into HTML when cached output exists                                  | controller, action                                  |
+| gitlab_banzai_cacheless_render_real_duration_seconds         | Histogram |                    9.4 | Duration of rendering markdown into HTML when cached outupt does not exist                          | controller, action                                  |
+| gitlab_cache_misses_total                                    | Counter   |                   10.2 | Cache read miss                                                                                     | controller, action                                  |
+| gitlab_cache_operation_duration_seconds                      | Histogram |                   10.2 | Cache access time                                                                                   |                                                     |
+| gitlab_cache_operations_total                                | Counter   |                   12.2 | Cache operations by controller/action                                                               | controller, action, operation                       |
+| gitlab_database_transaction_seconds                          | Histogram |                   12.1 | Time spent in database transactions, in seconds                                                     |                                                     |
+| gitlab_method_call_duration_seconds                          | Histogram |                   10.2 | Method calls real duration                                                                          | controller, action, module, method                  |
+| gitlab_rails_queue_duration_seconds                          | Histogram |                    9.4 | Measures latency between gitlab-workhorse forwarding a request to Rails                             |                                                     |
+| gitlab_sql_duration_seconds                                  | Histogram |                   10.2 | SQL execution time, excluding SCHEMA operations and BEGIN / COMMIT                                  |                                                     |
+| gitlab_transaction_allocated_memory_bytes                    | Histogram |                   10.2 | Allocated memory for all transactions (gitlab_transaction_* metrics)                                |                                                     |
+| gitlab_transaction_cache_<key>_count_total                   | Counter   |                   10.2 | Counter for total Rails cache calls (per key)                                                       |                                                     |
+| gitlab_transaction_cache_<key>_duration_total                | Counter   |                   10.2 | Counter for total time (seconds) spent in Rails cache calls (per key)                               |                                                     |
+| gitlab_transaction_cache_count_total                         | Counter   |                   10.2 | Counter for total Rails cache calls (aggregate)                                                     |                                                     |
+| gitlab_transaction_cache_duration_total                      | Counter   |                   10.2 | Counter for total time (seconds) spent in Rails cache calls (aggregate)                             |                                                     |
+| gitlab_transaction_cache_read_hit_count_total                | Counter   |                   10.2 | Counter for cache hits for Rails cache calls                                                        | controller, action                                  |
+| gitlab_transaction_cache_read_miss_count_total               | Counter   |                   10.2 | Counter for cache misses for Rails cache calls                                                      | controller, action                                  |
+| gitlab_transaction_duration_seconds                          | Histogram |                   10.2 | Duration for all transactions (gitlab_transaction_* metrics)                                        | controller, action                                  |
+| gitlab_transaction_event_build_found_total                   | Counter   |                    9.4 | Counter for build found for api /jobs/request                                                       |                                                     |
+| gitlab_transaction_event_build_invalid_total                 | Counter   |                    9.4 | Counter for build invalid due to concurrency conflict for api /jobs/request                         |                                                     |
+| gitlab_transaction_event_build_not_found_cached_total        | Counter   |                    9.4 | Counter for cached response of build not found for api /jobs/request                                |                                                     |
+| gitlab_transaction_event_build_not_found_total               | Counter   |                    9.4 | Counter for build not found for api /jobs/request                                                   |                                                     |
+| gitlab_transaction_event_change_default_branch_total         | Counter   |                    9.4 | Counter when default branch is changed for any repository                                           |                                                     |
+| gitlab_transaction_event_create_repository_total             | Counter   |                    9.4 | Counter when any repository is created                                                              |                                                     |
+| gitlab_transaction_event_etag_caching_cache_hit_total        | Counter   |                    9.4 | Counter for etag cache hit.                                                                         | endpoint                                            |
+| gitlab_transaction_event_etag_caching_header_missing_total   | Counter   |                    9.4 | Counter for etag cache miss - header missing                                                        | endpoint                                            |
+| gitlab_transaction_event_etag_caching_key_not_found_total    | Counter   |                    9.4 | Counter for etag cache miss - key not found                                                         | endpoint                                            |
+| gitlab_transaction_event_etag_caching_middleware_used_total  | Counter   |                    9.4 | Counter for etag middleware accessed                                                                | endpoint                                            |
+| gitlab_transaction_event_etag_caching_resource_changed_total | Counter   |                    9.4 | Counter for etag cache miss - resource changed                                                      | endpoint                                            |
+| gitlab_transaction_event_fork_repository_total               | Counter   |                    9.4 | Counter for repository forks (RepositoryForkWorker). Only incremented when source repository exists |                                                     |
+| gitlab_transaction_event_import_repository_total             | Counter   |                    9.4 | Counter for repository imports (RepositoryImportWorker)                                             |                                                     |
+| gitlab_transaction_event_push_branch_total                   | Counter   |                    9.4 | Counter for all branch pushes                                                                       |                                                     |
+| gitlab_transaction_event_push_commit_total                   | Counter   |                    9.4 | Counter for commits                                                                                 | branch                                              |
+| gitlab_transaction_event_push_tag_total                      | Counter   |                    9.4 | Counter for tag pushes                                                                              |                                                     |
+| gitlab_transaction_event_rails_exception_total               | Counter   |                    9.4 | Counter for number of rails exceptions                                                              |                                                     |
+| gitlab_transaction_event_receive_email_total                 | Counter   |                    9.4 | Counter for recieved emails                                                                         | handler                                             |
+| gitlab_transaction_event_remote_mirrors_failed_total         | Counter   |                   10.8 | Counter for failed remote mirrors                                                                   |                                                     |
+| gitlab_transaction_event_remote_mirrors_finished_total       | Counter   |                   10.8 | Counter for finished remote mirrors                                                                 |                                                     |
+| gitlab_transaction_event_remote_mirrors_running_total        | Counter   |                   10.8 | Counter for running remote mirrors                                                                  |                                                     |
+| gitlab_transaction_event_remove_branch_total                 | Counter   |                    9.4 | Counter when a branch is removed for any repository                                                 |                                                     |
+| gitlab_transaction_event_remove_repository_total             | Counter   |                    9.4 | Counter when a repository is removed                                                                |                                                     |
+| gitlab_transaction_event_remove_tag_total                    | Counter   |                    9.4 | Counter when a tag is remove for any repository                                                     |                                                     |
+| gitlab_transaction_event_sidekiq_exception_total             | Counter   |                    9.4 | Counter of sidekiq exceptions                                                                       |                                                     |
+| gitlab_transaction_event_stuck_import_jobs_total             | Counter   |                    9.4 | Count of stuck import jobs                                                                          | projects_without_jid_count, projects_with_jid_count |
+| gitlab_transaction_event_update_build_total                  | Counter   |                    9.4 | Counter for update build for api /jobs/request/:id                                                  |                                                     |
+| gitlab_transaction_new_redis_connections_total               | Counter   |                    9.4 | Counter for new redis connections                                                                   |                                                     |
+| gitlab_transaction_queue_duration_total                      | Counter   |                    9.4 | Duration jobs were enqueued before processing                                                       |                                                     |
+| gitlab_transaction_rails_queue_duration_total                | Counter   |                    9.4 | Measures latency between gitlab-workhorse forwarding a request to Rails                             | controller, action                                  |
+| gitlab_transaction_view_duration_total                       | Counter   |                    9.4 | Duration for views                                                                                  | controller, action, view                            |
+| gitlab_view_rendering_duration_seconds                       | Histogram |                   10.2 | Duration for views (histogram)                                                                      | controller, action, view                            |
+| http_requests_total                                          | Counter   |                    9.4 | Rack request count                                                                                  | method                                              |
+| http_request_duration_seconds                                | Histogram |                    9.4 | HTTP response time from rack middleware                                                             | method, status                                      |
+| pipelines_created_total                                      | Counter   |                    9.4 | Counter of pipelines created                                                                        |                                                     |
+| rack_uncaught_errors_total                                   | Counter   |                    9.4 | Rack connections handling uncaught errors count                                                     |                                                     |
+| user_session_logins_total                                    | Counter   |                    9.4 | Counter of how many users have logged in                                                            |                                                     |
+| upload_file_does_not_exist                                   | Counter   | 10.7 in EE, 11.5 in CE | Number of times an upload record could not find its file                                            |                                                     |
+| failed_login_captcha_total                                   | Gauge     |                   11.0 | Counter of failed CAPTCHA attempts during login                                                     |                                                     |
+| successful_login_captcha_total                               | Gauge     |                   11.0 | Counter of successful CAPTCHA attempts during login                                                 |                                                     |
+
+## Metrics controlled by a feature flag
+
+The following metrics can be controlled by feature flags:
+
+| Metric                                                       | Feature Flag                                                     |
+|:-------------------------------------------------------------|:-----------------------------------------------------------------|
+| gitlab_method_call_duration_seconds                          | prometheus_metrics_method_instrumentation                        |
+| gitlab_transaction_allocated_memory_bytes                    | prometheus_metrics_transaction_allocated_memory                  |
+| gitlab_transaction_event_build_found_total                   | prometheus_transaction_event_build_found_total                   |
+| gitlab_transaction_event_build_invalid_total                 | prometheus_transaction_event_build_invalid_total                 |
+| gitlab_transaction_event_build_not_found_cached_total        | prometheus_transaction_event_build_not_found_cached_total        |
+| gitlab_transaction_event_build_not_found_total               | prometheus_transaction_event_build_not_found_total               |
+| gitlab_transaction_event_change_default_branch_total         | prometheus_transaction_event_change_default_branch_total         |
+| gitlab_transaction_event_create_repository_total             | prometheus_transaction_event_create_repository_total             |
+| gitlab_transaction_event_etag_caching_cache_hit_total        | prometheus_transaction_event_etag_caching_cache_hit_total        |
+| gitlab_transaction_event_etag_caching_header_missing_total   | prometheus_transaction_event_etag_caching_header_missing_total   |
+| gitlab_transaction_event_etag_caching_key_not_found_total    | prometheus_transaction_event_etag_caching_key_not_found_total    |
+| gitlab_transaction_event_etag_caching_middleware_used_total  | prometheus_transaction_event_etag_caching_middleware_used_total  |
+| gitlab_transaction_event_etag_caching_resource_changed_total | prometheus_transaction_event_etag_caching_resource_changed_total |
+| gitlab_transaction_event_fork_repository_total               | prometheus_transaction_event_fork_repository_total               |
+| gitlab_transaction_event_import_repository_total             | prometheus_transaction_event_import_repository_total             |
+| gitlab_transaction_event_push_branch_total                   | prometheus_transaction_event_push_branch_total                   |
+| gitlab_transaction_event_push_commit_total                   | prometheus_transaction_event_push_commit_total                   |
+| gitlab_transaction_event_push_tag_total                      | prometheus_transaction_event_push_tag_total                      |
+| gitlab_transaction_event_rails_exception_total               | prometheus_transaction_event_rails_exception_total               |
+| gitlab_transaction_event_receive_email_total                 | prometheus_transaction_event_receive_email_total                 |
+| gitlab_transaction_event_remote_mirrors_failed_total         | prometheus_transaction_event_remote_mirrors_failed_total         |
+| gitlab_transaction_event_remote_mirrors_finished_total       | prometheus_transaction_event_remote_mirrors_finished_total       |
+| gitlab_transaction_event_remote_mirrors_running_total        | prometheus_transaction_event_remote_mirrors_running_total        |
+| gitlab_transaction_event_remove_branch_total                 | prometheus_transaction_event_remove_branch_total                 |
+| gitlab_transaction_event_remove_repository_total             | prometheus_transaction_event_remove_repository_total             |
+| gitlab_transaction_event_remove_tag_total                    | prometheus_transaction_event_remove_tag_total                    |
+| gitlab_transaction_event_sidekiq_exception_total             | prometheus_transaction_event_sidekiq_exception_total             |
+| gitlab_transaction_event_stuck_import_jobs_total             | prometheus_transaction_event_stuck_import_jobs_total             |
+| gitlab_transaction_event_update_build_total                  | prometheus_transaction_event_update_build_total                  |
+| gitlab_view_rendering_duration_seconds                       | prometheus_metrics_view_instrumentation                          |
 
 ## Sidekiq Metrics available for Geo **(PREMIUM)**
 
@@ -99,17 +167,27 @@ Some basic Ruby runtime metrics are available:
 
 | Metric                                 | Type      | Since | Description |
 |:-------------------------------------- |:--------- |:----- |:----------- |
-| ruby_gc_duration_seconds_total         | Counter   | 11.1  | Time spent by Ruby in GC |
+| ruby_gc_duration_seconds               | Counter   | 11.1  | Time spent by Ruby in GC |
 | ruby_gc_stat_...                       | Gauge     | 11.1  | Various metrics from [GC.stat] |
 | ruby_file_descriptors                  | Gauge     | 11.1  | File descriptors per process |
 | ruby_memory_bytes                      | Gauge     | 11.1  | Memory usage by process |
-| ruby_sampler_duration_seconds_total    | Counter   | 11.1  | Time spent collecting stats |
+| ruby_sampler_duration_seconds          | Counter   | 11.1  | Time spent collecting stats |
 | ruby_process_cpu_seconds_total         | Gauge     | 12.0  | Total amount of CPU time per process |
 | ruby_process_max_fds                   | Gauge     | 12.0  | Maximum number of open file descriptors per process |
 | ruby_process_resident_memory_bytes     | Gauge     | 12.0  | Memory usage by process, measured in bytes |
 | ruby_process_start_time_seconds        | Gauge     | 12.0  | UNIX timestamp of process start time |
 
-[GC.stat]: https://ruby-doc.org/core-2.3.0/GC.html#method-c-stat
+[GC.stat]: https://ruby-doc.org/core-2.6.3/GC.html#method-c-stat
+
+## Unicorn Metrics
+
+Unicorn specific metrics, when Unicorn is used.
+
+| Metric                     | Type  | Since | Description                                        |
+|:---------------------------|:------|:------|:---------------------------------------------------|
+| unicorn_active_connections | Gauge | 11.0  | The number of active Unicorn connections (workers) |
+| unicorn_queued_connections | Gauge | 11.0  | The number of queued Unicorn connections           |
+| unicorn_workers            | Gauge | 12.0  | The number of Unicorn workers                      |
 
 ## Puma Metrics **(EXPERIMENTAL)**
 
@@ -126,7 +204,6 @@ When Puma is used instead of Unicorn, following metrics are available:
 | puma_pool_capacity                           | Gauge   | 12.0  | Number of requests the worker is capable of taking right now |
 | puma_max_threads                             | Gauge   | 12.0  | Maximum number of worker threads |
 | puma_idle_threads                            | Gauge   | 12.0  | Number of spawned threads which are not processing a request |
-| rack_state_total                             | Gauge   | 12.0  | Number of requests in a given rack state |
 | puma_killer_terminations_total               | Gauge   | 12.0  | Number of workers terminated by PumaWorkerKiller |
 
 ## Metrics shared directory
-- 
cgit v1.2.1


From 6d1800aa9437ed5c6ea1c9fca8d02eaa0e266f54 Mon Sep 17 00:00:00 2001
From: Walmyr Lima <walmyr@gitlab.com>
Date: Fri, 23 Aug 2019 15:31:03 +0200
Subject: Quarantine filter issue comments test

---
 .../features/browser_ui/2_plan/issue/filter_issue_comments_spec.rb     | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/qa/qa/specs/features/browser_ui/2_plan/issue/filter_issue_comments_spec.rb b/qa/qa/specs/features/browser_ui/2_plan/issue/filter_issue_comments_spec.rb
index 317e31feea8..cdb85902758 100644
--- a/qa/qa/specs/features/browser_ui/2_plan/issue/filter_issue_comments_spec.rb
+++ b/qa/qa/specs/features/browser_ui/2_plan/issue/filter_issue_comments_spec.rb
@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
 module QA
-  context 'Plan' do
+  # Failure issue https://gitlab.com/gitlab-org/quality/staging/issues/68
+  context 'Plan', :quarantine do
     describe 'filter issue comments activities' do
       let(:issue_title) { 'issue title' }
 
-- 
cgit v1.2.1


From 99327de207965fe85e6c7759ebb2ef014b3574e8 Mon Sep 17 00:00:00 2001
From: Mark Lapierre <mlapierre@gitlab.com>
Date: Fri, 23 Aug 2019 14:06:22 +0000
Subject: Fail E2E tests early if template not found via API

---
 qa/qa/runtime/api/request.rb |  4 ++++
 qa/qa/runtime/fixtures.rb    | 13 +++++++++++--
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/qa/qa/runtime/api/request.rb b/qa/qa/runtime/api/request.rb
index 310c1dfeeb4..724b499d32f 100644
--- a/qa/qa/runtime/api/request.rb
+++ b/qa/qa/runtime/api/request.rb
@@ -12,6 +12,10 @@ module QA
           @session_address = Runtime::Address.new(api_client.address, request_path)
         end
 
+        def mask_url
+          @session_address.address.sub(/private_token=.*/, "private_token=[****]")
+        end
+
         def url
           @session_address.address
         end
diff --git a/qa/qa/runtime/fixtures.rb b/qa/qa/runtime/fixtures.rb
index 72004d5b00a..02cecffd4df 100644
--- a/qa/qa/runtime/fixtures.rb
+++ b/qa/qa/runtime/fixtures.rb
@@ -3,10 +3,19 @@
 module QA
   module Runtime
     module Fixtures
+      include Support::Api
+
+      TemplateNotFoundError = Class.new(RuntimeError)
+
       def fetch_template_from_api(api_path, key)
         request = Runtime::API::Request.new(api_client, "/templates/#{api_path}/#{key}")
-        get request.url
-        json_body[:content]
+        response = get(request.url)
+
+        unless response.code == HTTP_STATUS_OK
+          raise TemplateNotFoundError, "Template at #{request.mask_url} could not be found (#{response.code}): `#{response}`."
+        end
+
+        parse_body(response)[:content]
       end
 
       private
-- 
cgit v1.2.1


From 3d460a51a24141ed4cb390c56aedc7b13df5f81b Mon Sep 17 00:00:00 2001
From: Sean Arnold <sarnold@gitlab.com>
Date: Fri, 23 Aug 2019 15:12:16 +0000
Subject: Docs health check failure examples

---
 doc/user/admin_area/monitoring/health_check.md | 82 ++++++++++++++++++++++----
 1 file changed, 69 insertions(+), 13 deletions(-)

diff --git a/doc/user/admin_area/monitoring/health_check.md b/doc/user/admin_area/monitoring/health_check.md
index 333d2fb42b3..a3f4bc774ce 100644
--- a/doc/user/admin_area/monitoring/health_check.md
+++ b/doc/user/admin_area/monitoring/health_check.md
@@ -21,28 +21,71 @@ traffic until the system is ready or restart the container as needed.
 To access monitoring resources, the requesting client IP needs to be included in a whitelist.
 For details, see [how to add IPs to a whitelist for the monitoring endpoints](../../../administration/monitoring/ip_whitelist.md).
 
-## Using the endpoints
+## Using the endpoints locally
 
 With default whitelist settings, the probes can be accessed from localhost using the following URLs:
 
-- `http://localhost/-/health`
-- `http://localhost/-/readiness`
-- `http://localhost/-/liveness`
+```text
+GET http://localhost/-/health
+```
+```text
+GET http://localhost/-/readiness
+```
+```text
+GET http://localhost/-/liveness
+```text
+GET http://localhost/-/health
+```
+
+```text
+GET http://localhost/-/readiness
+```
 
-The first endpoint, `health`, only checks whether the application server is running. It does not verify the database or other services are running. A successful response will return a 200 status code with the following message:
+```text
+GET http://localhost/-/liveness
+```
+
+## Health
+
+Checks whether the application server is running. It does not verify the database or other services are running.
+
+```text
+GET /-/health
+```
+
+Example request:
+
+```sh
+curl 'https://gitlab.example.com/-/health'
+```
+
+Example response:
 
 ```text
 GitLab OK
 ```
 
-The readiness and liveness probes will provide a report of system health in JSON format.
+## Readiness
+
+The readiness probe checks whether the Gitlab instance is ready to use. It checks the dependent services (Database, Redis, Gitaly etc.) and gives a status for each.
+
+```text
+GET /-/readiness
+```
+
+Example request:
+
+```sh
+curl 'https://gitlab.example.com/-/readiness'
+```
 
-`readiness` probe example output:
+Example response:
 
 ```json
 {
    "db_check":{
-      "status":"ok"
+      "status":"failed",
+      "message": "unexpected Db check result: 0"
    },
    "redis_check":{
       "status":"ok"
@@ -65,7 +108,23 @@ The readiness and liveness probes will provide a report of system health in JSON
    }
 ```
 
-`liveness` probe example output:
+## Liveness
+
+The liveness probe checks whether the application server is alive. Unlike the [`health`](#health) check, this check hits the database.
+
+```text
+GET /-/liveness
+```
+
+Example request:
+
+```sh
+curl 'https://gitlab.example.com/-/liveness'
+```
+
+Example response:
+
+On success, the endpoint will return a valid successful HTTP status code, and a response like below.
 
 ```json
 {
@@ -90,10 +149,7 @@ The readiness and liveness probes will provide a report of system health in JSON
 }
 ```
 
-## Status
-
-On failure, the endpoint will return a `500` HTTP status code. On success, the endpoint
-will return a valid successful HTTP status code, and a `success` message.
+On failure, the endpoint will return a `500` HTTP status code.
 
 ## Access token (Deprecated)
 
-- 
cgit v1.2.1


From ebbd2aeb5f56bc2cacc5d95d41da370d8c29069d Mon Sep 17 00:00:00 2001
From: John Cai <jcai@gitlab.com>
Date: Mon, 19 Aug 2019 15:14:15 -0700
Subject: Handle when server info doesn't have the storage in question

---
 lib/gitlab/gitaly_client.rb           |  3 ++-
 spec/lib/gitlab/gitaly_client_spec.rb | 10 ++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/gitlab/gitaly_client.rb b/lib/gitlab/gitaly_client.rb
index e6cbfb00f60..201db9fec26 100644
--- a/lib/gitlab/gitaly_client.rb
+++ b/lib/gitlab/gitaly_client.rb
@@ -406,7 +406,8 @@ module Gitlab
     def self.filesystem_id(storage)
       response = Gitlab::GitalyClient::ServerService.new(storage).info
       storage_status = response.storage_statuses.find { |status| status.storage_name == storage }
-      storage_status.filesystem_id
+
+      storage_status&.filesystem_id
     end
 
     def self.filesystem_id_from_disk(storage)
diff --git a/spec/lib/gitlab/gitaly_client_spec.rb b/spec/lib/gitlab/gitaly_client_spec.rb
index e9fb6c0125c..99d563e03ec 100644
--- a/spec/lib/gitlab/gitaly_client_spec.rb
+++ b/spec/lib/gitlab/gitaly_client_spec.rb
@@ -27,6 +27,16 @@ describe Gitlab::GitalyClient do
     end
   end
 
+  describe '.filesystem_id' do
+    it 'returns an empty string when the storage is not found in the response' do
+      response = double("response")
+      allow(response).to receive(:storage_statuses).and_return([])
+      allow_any_instance_of(Gitlab::GitalyClient::ServerService).to receive(:info).and_return(response)
+
+      expect(described_class.filesystem_id('default')).to eq(nil)
+    end
+  end
+
   describe '.stub_class' do
     it 'returns the gRPC health check stub' do
       expect(described_class.stub_class(:health_check)).to eq(::Grpc::Health::V1::Health::Stub)
-- 
cgit v1.2.1


From 15ea614765ce88a93c91a3b055a7c4fb96fd1ccb Mon Sep 17 00:00:00 2001
From: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Date: Fri, 23 Aug 2019 17:22:49 +0000
Subject: Update CHANGELOG.md for 12.2.1

[ci skip]
---
 CHANGELOG.md                                                | 13 +++++++++++++
 changelogs/unreleased/sh-fix-issues-api-gitaly-nplusone.yml |  5 -----
 changelogs/unreleased/sh-revert-redis-cache-store.yml       |  5 -----
 changelogs/unreleased/tr-param-undefined-fix.yml            |  5 -----
 4 files changed, 13 insertions(+), 15 deletions(-)
 delete mode 100644 changelogs/unreleased/sh-fix-issues-api-gitaly-nplusone.yml
 delete mode 100644 changelogs/unreleased/sh-revert-redis-cache-store.yml
 delete mode 100644 changelogs/unreleased/tr-param-undefined-fix.yml

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6c8eccf0b2..ffca09a92e7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,19 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 12.2.1
+
+### Fixed (3 changes)
+
+- Fix for embedded metrics undefined params. !31975
+- Fix "ERR value is not an integer or out of range" errors. !32126
+- Prevent duplicated trigger action button.
+
+### Performance (1 change)
+
+- Fix Gitaly N+1 calls with listing issues/MRs via API. !31938
+
+
 ## 12.2.0
 
 ### Security (4 changes, 1 of them is from the community)
diff --git a/changelogs/unreleased/sh-fix-issues-api-gitaly-nplusone.yml b/changelogs/unreleased/sh-fix-issues-api-gitaly-nplusone.yml
deleted file mode 100644
index 3177cb8d18c..00000000000
--- a/changelogs/unreleased/sh-fix-issues-api-gitaly-nplusone.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix Gitaly N+1 calls with listing issues/MRs via API
-merge_request: 31938
-author:
-type: performance
diff --git a/changelogs/unreleased/sh-revert-redis-cache-store.yml b/changelogs/unreleased/sh-revert-redis-cache-store.yml
deleted file mode 100644
index 710b6e7941d..00000000000
--- a/changelogs/unreleased/sh-revert-redis-cache-store.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix "ERR value is not an integer or out of range" errors
-merge_request: 32126
-author:
-type: fixed
diff --git a/changelogs/unreleased/tr-param-undefined-fix.yml b/changelogs/unreleased/tr-param-undefined-fix.yml
deleted file mode 100644
index 0a9051485bd..00000000000
--- a/changelogs/unreleased/tr-param-undefined-fix.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix for embedded metrics undefined params
-merge_request: 31975
-author:
-type: fixed
-- 
cgit v1.2.1


From f1e24d4d31776f675cd4a7cdc21ddc9d496400cf Mon Sep 17 00:00:00 2001
From: Patrick Derichs <pderichs@gitlab.com>
Date: Fri, 23 Aug 2019 17:45:42 +0000
Subject: Add label_id parameter to label API for PUT and DELETE

Add specs for new parameter and updated documentation as well.
---
 ...-add-optional-id-to-label-api-put-delete-pd.yml |   5 +
 doc/api/labels.md                                  |   8 +-
 lib/api/helpers/label_helpers.rb                   |  32 +-
 lib/api/labels.rb                                  |   8 +-
 spec/lib/api/helpers/label_helpers_spec.rb         |  33 ++
 spec/requests/api/labels_spec.rb                   | 336 +++++++++++++--------
 6 files changed, 285 insertions(+), 137 deletions(-)
 create mode 100644 changelogs/unreleased/62322-add-optional-id-to-label-api-put-delete-pd.yml
 create mode 100644 spec/lib/api/helpers/label_helpers_spec.rb

diff --git a/changelogs/unreleased/62322-add-optional-id-to-label-api-put-delete-pd.yml b/changelogs/unreleased/62322-add-optional-id-to-label-api-put-delete-pd.yml
new file mode 100644
index 00000000000..7e1eeddef32
--- /dev/null
+++ b/changelogs/unreleased/62322-add-optional-id-to-label-api-put-delete-pd.yml
@@ -0,0 +1,5 @@
+---
+title: Add optional label_id parameter to label API for PUT and DELETE
+merge_request: 31804
+author:
+type: changed
diff --git a/doc/api/labels.md b/doc/api/labels.md
index 5db0edcf14d..fde1d861cf6 100644
--- a/doc/api/labels.md
+++ b/doc/api/labels.md
@@ -137,8 +137,9 @@ DELETE /projects/:id/labels
 
 | Attribute | Type    | Required | Description           |
 | --------- | ------- | -------- | --------------------- |
-| `id`      | integer/string    | yes      | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
-| `name`    | string  | yes      | The name of the label |
+| `id`            | integer/string | yes | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
+| `label_id`      | integer        | yes (or `name`)                   | The id of the existing label     |
+| `name`          | string         | yes (or `label_id`)               | The name of the existing label   |
 
 ```bash
 curl --request DELETE --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/labels?name=bug"
@@ -156,7 +157,8 @@ PUT /projects/:id/labels
 | Attribute       | Type    | Required                          | Description                      |
 | --------------- | ------- | --------------------------------- | -------------------------------  |
 | `id`      | integer/string    | yes      | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
-| `name`          | string  | yes                               | The name of the existing label   |
+| `label_id`      | integer | yes (or `name`)                   | The id of the existing label     |
+| `name`          | string  | yes (or `label_id`)               | The name of the existing label   |
 | `new_name`      | string  | yes if `color` is not provided    | The new name of the label        |
 | `color`         | string  | yes if `new_name` is not provided | The color of the label given in 6-digit hex notation with leading '#' sign (e.g. #FFAABB) or one of the [CSS color names](https://developer.mozilla.org/en-US/docs/Web/CSS/color_value#Color_keywords) |
 | `description`   | string  | no                                | The new description of the label |
diff --git a/lib/api/helpers/label_helpers.rb b/lib/api/helpers/label_helpers.rb
index 896b0aba52b..ec5b688dd1c 100644
--- a/lib/api/helpers/label_helpers.rb
+++ b/lib/api/helpers/label_helpers.rb
@@ -11,9 +11,9 @@ module API
         optional :description, type: String, desc: 'The description of label to be created'
       end
 
-      def find_label(parent, id, include_ancestor_groups: true)
+      def find_label(parent, id_or_title, include_ancestor_groups: true)
         labels = available_labels_for(parent, include_ancestor_groups: include_ancestor_groups)
-        label = labels.find_by_id(id) || labels.find_by_title(id)
+        label = labels.find_by_id(id_or_title) || labels.find_by_title(id_or_title)
 
         label || not_found!('Label')
       end
@@ -35,12 +35,7 @@ module API
         priority = params.delete(:priority)
         label_params = declared_params(include_missing: false)
 
-        label =
-          if parent.is_a?(Project)
-            ::Labels::CreateService.new(label_params).execute(project: parent)
-          else
-            ::Labels::CreateService.new(label_params).execute(group: parent)
-          end
+        label = ::Labels::CreateService.new(label_params).execute(create_service_params(parent))
 
         if label.persisted?
           if parent.is_a?(Project)
@@ -56,10 +51,13 @@ module API
       def update_label(parent, entity)
         authorize! :admin_label, parent
 
-        label = find_label(parent, params[:name], include_ancestor_groups: false)
+        label = find_label(parent, params_id_or_title, include_ancestor_groups: false)
         update_priority = params.key?(:priority)
         priority = params.delete(:priority)
 
+        # params is used to update the label so we need to remove this field here
+        params.delete(:label_id)
+
         label = ::Labels::UpdateService.new(declared_params(include_missing: false)).execute(label)
         render_validation_error!(label) unless label.valid?
 
@@ -77,10 +75,24 @@ module API
       def delete_label(parent)
         authorize! :admin_label, parent
 
-        label = find_label(parent, params[:name], include_ancestor_groups: false)
+        label = find_label(parent, params_id_or_title, include_ancestor_groups: false)
 
         destroy_conditionally!(label)
       end
+
+      def params_id_or_title
+        @params_id_or_title ||= params[:label_id] || params[:name]
+      end
+
+      def create_service_params(parent)
+        if parent.is_a?(Project)
+          { project: parent }
+        elsif parent.is_a?(Group)
+          { group: parent }
+        else
+          raise TypeError, 'Parent type is not supported'
+        end
+      end
     end
   end
 end
diff --git a/lib/api/labels.rb b/lib/api/labels.rb
index c183198d3c6..83d645ca07a 100644
--- a/lib/api/labels.rb
+++ b/lib/api/labels.rb
@@ -38,11 +38,13 @@ module API
         success Entities::ProjectLabel
       end
       params do
-        requires :name, type: String, desc: 'The name of the label to be updated'
+        optional :label_id, type: Integer, desc: 'The id of the label to be updated'
+        optional :name, type: String, desc: 'The name of the label to be updated'
         optional :new_name, type: String, desc: 'The new name of the label'
         optional :color, type: String, desc: "The new color of the label given in 6-digit hex notation with leading '#' sign (e.g. #FFAABB) or one of the allowed CSS color names"
         optional :description, type: String, desc: 'The new description of label'
         optional :priority, type: Integer, desc: 'The priority of the label', allow_blank: true
+        exactly_one_of :label_id, :name
         at_least_one_of :new_name, :color, :description, :priority
       end
       put ':id/labels' do
@@ -53,7 +55,9 @@ module API
         success Entities::ProjectLabel
       end
       params do
-        requires :name, type: String, desc: 'The name of the label to be deleted'
+        optional :label_id, type: Integer, desc: 'The id of the label to be deleted'
+        optional :name, type: String, desc: 'The name of the label to be deleted'
+        exactly_one_of :label_id, :name
       end
       delete ':id/labels' do
         delete_label(user_project)
diff --git a/spec/lib/api/helpers/label_helpers_spec.rb b/spec/lib/api/helpers/label_helpers_spec.rb
new file mode 100644
index 00000000000..138e9a22d70
--- /dev/null
+++ b/spec/lib/api/helpers/label_helpers_spec.rb
@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe API::Helpers::LabelHelpers do
+  describe 'create_service_params' do
+    let(:label_helper) do
+      Class.new do
+        include API::Helpers::LabelHelpers
+      end.new
+    end
+
+    context 'when a project is given' do
+      it 'returns the expected params' do
+        project = create(:project)
+        expect(label_helper.create_service_params(project)).to eq({ project: project })
+      end
+    end
+
+    context 'when a group is given' do
+      it 'returns the expected params' do
+        group = create(:group)
+        expect(label_helper.create_service_params(group)).to eq({ group: group })
+      end
+    end
+
+    context 'when something else is given' do
+      it 'raises a type error' do
+        expect { label_helper.create_service_params(Class.new) }.to raise_error(TypeError)
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/labels_spec.rb b/spec/requests/api/labels_spec.rb
index ad0974f55a3..f6640fe41d0 100644
--- a/spec/requests/api/labels_spec.rb
+++ b/spec/requests/api/labels_spec.rb
@@ -6,6 +6,180 @@ describe API::Labels do
   let!(:label1) { create(:label, title: 'label1', project: project) }
   let!(:priority_label) { create(:label, title: 'bug', project: project, priority: 3) }
 
+  shared_examples 'label update API' do
+    it 'returns 200 if name is changed' do
+      request_params = {
+        new_name: 'New Label'
+      }.merge(spec_params)
+
+      put api("/projects/#{project.id}/labels", user),
+          params: request_params
+
+      expect(response).to have_gitlab_http_status(200)
+      expect(json_response['name']).to eq('New Label')
+      expect(json_response['color']).to eq(label1.color)
+    end
+
+    it 'returns 200 if colors is changed' do
+      request_params = {
+        color: '#FFFFFF'
+      }.merge(spec_params)
+
+      put api("/projects/#{project.id}/labels", user),
+          params: request_params
+
+      expect(response).to have_gitlab_http_status(200)
+      expect(json_response['name']).to eq(label1.name)
+      expect(json_response['color']).to eq('#FFFFFF')
+    end
+
+    it 'returns 200 if a priority is added' do
+      request_params = {
+        priority: 3
+      }.merge(spec_params)
+
+      put api("/projects/#{project.id}/labels", user),
+          params: request_params
+
+      expect(response.status).to eq(200)
+      expect(json_response['name']).to eq(label1.name)
+      expect(json_response['priority']).to eq(3)
+    end
+
+    it 'returns 400 if no new parameters given' do
+      put api("/projects/#{project.id}/labels", user), params: spec_params
+
+      expect(response).to have_gitlab_http_status(400)
+      expect(json_response['error']).to eq('new_name, color, description, priority are missing, '\
+                                           'at least one parameter must be provided')
+    end
+
+    it 'returns 400 when color code is too short' do
+      request_params = {
+        color: '#FF'
+      }.merge(spec_params)
+
+      put api("/projects/#{project.id}/labels", user),
+          params: request_params
+
+      expect(response).to have_gitlab_http_status(400)
+      expect(json_response['message']['color']).to eq(['must be a valid color code'])
+    end
+
+    it 'returns 400 for too long color code' do
+      request_params = {
+        color: '#FFAAFFFF'
+      }.merge(spec_params)
+
+      put api("/projects/#{project.id}/labels", user),
+          params: request_params
+
+      expect(response).to have_gitlab_http_status(400)
+      expect(json_response['message']['color']).to eq(['must be a valid color code'])
+    end
+
+    it 'returns 400 for invalid priority' do
+      request_params = {
+        priority: 'foo'
+      }.merge(spec_params)
+
+      put api("/projects/#{project.id}/labels", user),
+          params: request_params
+
+      expect(response).to have_gitlab_http_status(400)
+    end
+
+    it 'returns 200 if name and colors and description are changed' do
+      request_params = {
+        new_name: 'New Label',
+        color: '#FFFFFF',
+        description: 'test'
+      }.merge(spec_params)
+
+      put api("/projects/#{project.id}/labels", user),
+          params: request_params
+
+      expect(response).to have_gitlab_http_status(200)
+      expect(json_response['name']).to eq('New Label')
+      expect(json_response['color']).to eq('#FFFFFF')
+      expect(json_response['description']).to eq('test')
+    end
+
+    it 'returns 400 for invalid name' do
+      request_params = {
+        new_name: ',',
+        color: '#FFFFFF'
+      }.merge(spec_params)
+
+      put api("/projects/#{project.id}/labels", user),
+          params: request_params
+
+      expect(response).to have_gitlab_http_status(400)
+      expect(json_response['message']['title']).to eq(['is invalid'])
+    end
+
+    it 'returns 200 if description is changed' do
+      request_params = {
+        description: 'test'
+      }.merge(spec_params)
+
+      put api("/projects/#{project.id}/labels", user),
+          params: request_params
+
+      expect(response).to have_gitlab_http_status(200)
+      expect(json_response['id']).to eq(expected_response_label_id)
+      expect(json_response['description']).to eq('test')
+    end
+
+    it 'returns 200 if priority is changed' do
+      request_params = {
+        priority: 10
+      }.merge(spec_params)
+
+      put api("/projects/#{project.id}/labels", user),
+          params: request_params
+
+      expect(response.status).to eq(200)
+      expect(json_response['id']).to eq(expected_response_label_id)
+      expect(json_response['priority']).to eq(10)
+    end
+
+    it 'returns 200 if a priority is removed' do
+      label = find_by_spec_params(spec_params)
+      expect(label).not_to be_nil
+
+      label.priorities.create(project: label.project, priority: 1)
+      label.save!
+
+      request_params = {
+        priority: nil
+      }.merge(spec_params)
+
+      put api("/projects/#{project.id}/labels", user),
+          params: request_params
+
+      expect(response.status).to eq(200)
+      expect(json_response['id']).to eq(expected_response_label_id)
+      expect(json_response['priority']).to be_nil
+    end
+
+    def find_by_spec_params(params)
+      if params.key?(:label_id)
+        Label.find(params[:label_id])
+      else
+        Label.find_by(name: params[:name])
+      end
+    end
+  end
+
+  shared_examples 'label delete API' do
+    it 'returns 204 for existing label' do
+      delete api("/projects/#{project.id}/labels", user), params: spec_params
+
+      expect(response).to have_gitlab_http_status(204)
+    end
+  end
+
   before do
     project.add_maintainer(user)
   end
@@ -208,174 +382,92 @@ describe API::Labels do
   end
 
   describe 'DELETE /projects/:id/labels' do
-    it 'returns 204 for existing label' do
-      delete api("/projects/#{project.id}/labels", user), params: { name: 'label1' }
+    it_behaves_like 'label delete API' do
+      let(:spec_params) { { name: 'label1' } }
+    end
 
-      expect(response).to have_gitlab_http_status(204)
+    it_behaves_like 'label delete API' do
+      let(:spec_params) { { label_id: label1.id } }
     end
 
     it 'returns 404 for non existing label' do
       delete api("/projects/#{project.id}/labels", user), params: { name: 'label2' }
+
       expect(response).to have_gitlab_http_status(404)
       expect(json_response['message']).to eq('404 Label Not Found')
     end
 
     it 'returns 400 for wrong parameters' do
       delete api("/projects/#{project.id}/labels", user)
-      expect(response).to have_gitlab_http_status(400)
-    end
-
-    it_behaves_like '412 response' do
-      let(:request) { api("/projects/#{project.id}/labels", user) }
-      let(:params) { { name: 'label1' } }
-    end
-  end
 
-  describe 'PUT /projects/:id/labels' do
-    it 'returns 200 if name and colors and description are changed' do
-      put api("/projects/#{project.id}/labels", user),
-          params: {
-            name: 'label1',
-            new_name: 'New Label',
-            color: '#FFFFFF',
-            description: 'test'
-          }
-      expect(response).to have_gitlab_http_status(200)
-      expect(json_response['name']).to eq('New Label')
-      expect(json_response['color']).to eq('#FFFFFF')
-      expect(json_response['description']).to eq('test')
+      expect(response).to have_gitlab_http_status(400)
     end
 
-    it 'returns 200 if name is changed' do
-      put api("/projects/#{project.id}/labels", user),
+    it 'fails if label_id and name are given in params' do
+      delete api("/projects/#{project.id}/labels", user),
           params: {
-            name: 'label1',
-            new_name: 'New Label'
+            label_id: label1.id,
+            name: priority_label.name
           }
-      expect(response).to have_gitlab_http_status(200)
-      expect(json_response['name']).to eq('New Label')
-      expect(json_response['color']).to eq(label1.color)
-    end
 
-    it 'returns 200 if colors is changed' do
-      put api("/projects/#{project.id}/labels", user),
-          params: {
-            name: 'label1',
-            color: '#FFFFFF'
-          }
-      expect(response).to have_gitlab_http_status(200)
-      expect(json_response['name']).to eq(label1.name)
-      expect(json_response['color']).to eq('#FFFFFF')
+      expect(response).to have_gitlab_http_status(400)
     end
 
-    it 'returns 200 if description is changed' do
-      put api("/projects/#{project.id}/labels", user),
-          params: {
-            name: 'bug',
-            description: 'test'
-          }
-
-      expect(response).to have_gitlab_http_status(200)
-      expect(json_response['name']).to eq(priority_label.name)
-      expect(json_response['description']).to eq('test')
-      expect(json_response['priority']).to eq(3)
+    it_behaves_like '412 response' do
+      let(:request) { api("/projects/#{project.id}/labels", user) }
+      let(:params) { { name: 'label1' } }
     end
+  end
 
-    it 'returns 200 if priority is changed' do
-      put api("/projects/#{project.id}/labels", user),
-           params: {
-             name: 'bug',
-             priority: 10
-           }
-
-      expect(response.status).to eq(200)
-      expect(json_response['name']).to eq(priority_label.name)
-      expect(json_response['priority']).to eq(10)
+  describe 'PUT /projects/:id/labels' do
+    context 'when using name' do
+      it_behaves_like 'label update API' do
+        let(:spec_params) { { name: 'label1' } }
+        let(:expected_response_label_id) { label1.id }
+      end
     end
 
-    it 'returns 200 if a priority is added' do
-      put api("/projects/#{project.id}/labels", user),
-           params: {
-             name: 'label1',
-             priority: 3
-           }
-
-      expect(response.status).to eq(200)
-      expect(json_response['name']).to eq(label1.name)
-      expect(json_response['priority']).to eq(3)
+    context 'when using label_id' do
+      it_behaves_like 'label update API' do
+        let(:spec_params) { { label_id: label1.id } }
+        let(:expected_response_label_id) { label1.id }
+      end
     end
 
-    it 'returns 200 if the priority is removed' do
+    it 'returns 404 if label does not exist' do
       put api("/projects/#{project.id}/labels", user),
           params: {
-            name: priority_label.name,
-            priority: nil
+            name: 'label2',
+            new_name: 'label3'
           }
 
-      expect(response.status).to eq(200)
-      expect(json_response['name']).to eq(priority_label.name)
-      expect(json_response['priority']).to be_nil
+      expect(response).to have_gitlab_http_status(404)
     end
 
-    it 'returns 404 if label does not exist' do
+    it 'returns 404 if label by id does not exist' do
       put api("/projects/#{project.id}/labels", user),
           params: {
-            name: 'label2',
+            label_id: 0,
             new_name: 'label3'
           }
+
       expect(response).to have_gitlab_http_status(404)
     end
 
-    it 'returns 400 if no label name given' do
+    it 'returns 400 if no label name and id is given' do
       put api("/projects/#{project.id}/labels", user), params: { new_name: 'label2' }
-      expect(response).to have_gitlab_http_status(400)
-      expect(json_response['error']).to eq('name is missing')
-    end
-
-    it 'returns 400 if no new parameters given' do
-      put api("/projects/#{project.id}/labels", user), params: { name: 'label1' }
-      expect(response).to have_gitlab_http_status(400)
-      expect(json_response['error']).to eq('new_name, color, description, priority are missing, '\
-                                           'at least one parameter must be provided')
-    end
 
-    it 'returns 400 for invalid name' do
-      put api("/projects/#{project.id}/labels", user),
-          params: {
-            name: 'label1',
-            new_name: ',',
-            color: '#FFFFFF'
-          }
       expect(response).to have_gitlab_http_status(400)
-      expect(json_response['message']['title']).to eq(['is invalid'])
+      expect(json_response['error']).to eq('label_id, name are missing, exactly one parameter must be provided')
     end
 
-    it 'returns 400 when color code is too short' do
+    it 'fails if label_id and name are given in params' do
       put api("/projects/#{project.id}/labels", user),
           params: {
-            name: 'label1',
-            color: '#FF'
+            label_id: label1.id,
+            name: priority_label.name,
+            new_name: 'New Label'
           }
-      expect(response).to have_gitlab_http_status(400)
-      expect(json_response['message']['color']).to eq(['must be a valid color code'])
-    end
-
-    it 'returns 400 for too long color code' do
-      put api("/projects/#{project.id}/labels", user),
-           params: {
-             name: 'label1',
-             color: '#FFAAFFFF'
-           }
-      expect(response).to have_gitlab_http_status(400)
-      expect(json_response['message']['color']).to eq(['must be a valid color code'])
-    end
-
-    it 'returns 400 for invalid priority' do
-      put api("/projects/#{project.id}/labels", user),
-           params: {
-             name: 'label1',
-             priority: 'foo'
-           }
 
       expect(response).to have_gitlab_http_status(400)
     end
-- 
cgit v1.2.1


From e39ef6c798a697280a160d759bb3400ede4754e6 Mon Sep 17 00:00:00 2001
From: Lukas Eipert <leipert@gitlab.com>
Date: Fri, 23 Aug 2019 18:01:00 +0000
Subject: Update dependency @gitlab/svgs to ^1.70.0

---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index df5f758fa20..b21b448e741 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "@babel/plugin-syntax-import-meta": "^7.2.0",
     "@babel/preset-env": "^7.5.5",
     "@gitlab/csslab": "^1.9.0",
-    "@gitlab/svgs": "^1.68.0",
+    "@gitlab/svgs": "^1.70.0",
     "@gitlab/ui": "5.18.0",
     "apollo-cache-inmemory": "^1.5.1",
     "apollo-client": "^2.5.1",
diff --git a/yarn.lock b/yarn.lock
index 4489b10815a..f1b819eb52f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -998,10 +998,10 @@
   dependencies:
     vue-eslint-parser "^6.0.4"
 
-"@gitlab/svgs@^1.68.0":
-  version "1.68.0"
-  resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.68.0.tgz#d631bd84ea7907592240d8417e82ba66d6a54c0c"
-  integrity sha512-3JmIq0bHg4InjLooM+kQFPfg3d7B1Pye67pN9+12kZXIa0nRGuwKEq3WSbcS+ACdg5jcVPNPYqStItEO4teHdw==
+"@gitlab/svgs@^1.70.0":
+  version "1.70.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.70.0.tgz#bdae478148c15d955fc06e69fd5d5ecae8298943"
+  integrity sha512-0uV9fgTwe17Fyy0hTcrsGX2jJuCrz3uRIe8yffuqc6pbQrSfYJyN66mfCCB45wq8lKTgOB5q0qcUyJx3RQEcKg==
 
 "@gitlab/ui@5.18.0":
   version "5.18.0"
-- 
cgit v1.2.1


From 0eb03f47f4f4d14867738cb433f2350dc2aba3a0 Mon Sep 17 00:00:00 2001
From: Lucas Charles <me@lucascharles.me>
Date: Thu, 22 Aug 2019 09:56:25 -0700
Subject: Add headers to missing SAST doc tables

---
 doc/user/application_security/sast/index.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/user/application_security/sast/index.md b/doc/user/application_security/sast/index.md
index 2f15d997b5b..31027210cbc 100644
--- a/doc/user/application_security/sast/index.md
+++ b/doc/user/application_security/sast/index.md
@@ -160,6 +160,8 @@ The following are Docker image-related variables.
 
 Some analyzers make it possible to filter out vulnerabilities under a given threshold.
 
+| Environment variable | Default value | Description |
+|----------------------|---------------|-------------|
 | `SAST_BANDIT_EXCLUDED_PATHS`  | -   | comma-separated list of paths to exclude from scan. Uses Python's [`fnmatch` syntax](https://docs.python.org/2/library/fnmatch.html) |
 | `SAST_BRAKEMAN_LEVEL`   |         1 | Ignore Brakeman vulnerabilities under given confidence level. Integer, 1=Low 3=High. |
 | `SAST_FLAWFINDER_LEVEL` |         1 | Ignore Flawfinder vulnerabilities under given risk level. Integer, 0=No risk, 5=High risk. |
@@ -171,6 +173,8 @@ Some analyzers make it possible to filter out vulnerabilities under a given thre
 
 The following variables configure timeouts.
 
+| Environment variable | Default value | Description |
+|----------------------|---------------|-------------|
 | `SAST_DOCKER_CLIENT_NEGOTIATION_TIMEOUT` |      2m | Time limit for Docker client negotiation. Timeouts are parsed using Go's [`ParseDuration`](https://golang.org/pkg/time/#ParseDuration). Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". For example, "300ms", "1.5h" or "2h45m". |
 | `SAST_PULL_ANALYZER_IMAGE_TIMEOUT`       |      5m | Time limit when pulling the image of an analyzer. Timeouts are parsed using Go's [`ParseDuration`](https://golang.org/pkg/time/#ParseDuration). Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". For example, "300ms", "1.5h" or "2h45m". |
 | `SAST_RUN_ANALYZER_TIMEOUT`              |     20m | Time limit when running an analyzer. Timeouts are parsed using Go's [`ParseDuration`](https://golang.org/pkg/time/#ParseDuration). Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". For example, "300ms", "1.5h" or "2h45m".|
-- 
cgit v1.2.1


From 1fc212903700bc0d46701fb46b0bea469e21677c Mon Sep 17 00:00:00 2001
From: Lucas Charles <me@lucascharles.me>
Date: Thu, 22 Aug 2019 09:56:49 -0700
Subject: Use common terminology for SAT/DS table headers

---
 doc/user/application_security/dependency_scanning/index.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/user/application_security/dependency_scanning/index.md b/doc/user/application_security/dependency_scanning/index.md
index 3148ec63c79..0a559440d3c 100644
--- a/doc/user/application_security/dependency_scanning/index.md
+++ b/doc/user/application_security/dependency_scanning/index.md
@@ -141,7 +141,7 @@ dependency_scanning:
 Dependency Scanning can be [configured](#customizing-the-dependency-scanning-settings)
 using environment variables.
 
-| Environment variable                    | Function |
+| Environment variable                    | Description |
 |--------------------------------         |----------|
 | `DS_ANALYZER_IMAGES`                    | Comma separated list of custom images. The official default images are still enabled. Read more about [customizing analyzers](analyzers.md). |
 | `DS_ANALYZER_IMAGE_PREFIX`              | Override the name of the Docker registry providing the official default images (proxy). Read more about [customizing analyzers](analyzers.md). |
@@ -276,7 +276,7 @@ it highlighted:
 Here is the description of the report file structure nodes and their meaning. All fields are mandatory to be present in
 the report JSON unless stated otherwise. Presence of optional fields depends on the underlying analyzers being used.
 
-| Report JSON node                                     | Function |
+| Report JSON node                                     | Description |
 |------------------------------------------------------|----------|
 | `version`                                            | Report syntax version used to generate this JSON. |
 | `vulnerabilities`                                    | Array of vulnerability objects. |
-- 
cgit v1.2.1


From 05bf353355459bb2fbacc7be708368117d772ea3 Mon Sep 17 00:00:00 2001
From: Lucas Charles <me@lucascharles.me>
Date: Thu, 22 Aug 2019 11:31:14 -0700
Subject: Add example usage to SAST/DS docs for file exclusion

---
 .../dependency_scanning/index.md                   | 34 +++++++++++-----------
 doc/user/application_security/sast/index.md        | 16 +++++-----
 2 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/doc/user/application_security/dependency_scanning/index.md b/doc/user/application_security/dependency_scanning/index.md
index 0a559440d3c..b40392e12d5 100644
--- a/doc/user/application_security/dependency_scanning/index.md
+++ b/doc/user/application_security/dependency_scanning/index.md
@@ -141,22 +141,22 @@ dependency_scanning:
 Dependency Scanning can be [configured](#customizing-the-dependency-scanning-settings)
 using environment variables.
 
-| Environment variable                    | Description |
-|--------------------------------         |----------|
-| `DS_ANALYZER_IMAGES`                    | Comma separated list of custom images. The official default images are still enabled. Read more about [customizing analyzers](analyzers.md). |
-| `DS_ANALYZER_IMAGE_PREFIX`              | Override the name of the Docker registry providing the official default images (proxy). Read more about [customizing analyzers](analyzers.md). |
-| `DS_ANALYZER_IMAGE_TAG`                 | Override the Docker tag of the official default images. Read more about [customizing analyzers](analyzers.md). |
-| `DS_PYTHON_VERSION`                     | Version of Python. If set to 2, dependencies are installed using Python 2.7 instead of Python 3.6. ([Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/12296) in GitLab 12.1)|
-| `DS_PIP_DEPENDENCY_PATH`                | Path to load Python pip dependencies from. ([Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/12412) in GitLab 12.2) |
-| `DS_DEFAULT_ANALYZERS`                  | Override the names of the official default images. Read more about [customizing analyzers](analyzers.md). |
-| `DS_DISABLE_REMOTE_CHECKS`              | Do not send any data to GitLab. Used in the [Gemnasium analyzer](#remote-checks). |
-| `DS_PULL_ANALYZER_IMAGES`               | Pull the images from the Docker registry (set to `0` to disable). |
-| `DS_EXCLUDED_PATHS`                     | Exclude vulnerabilities from output based on the paths. A comma-separated list of patterns. Patterns can be globs, file or folder paths. Parent directories will also match patterns. |
-| `DS_DOCKER_CLIENT_NEGOTIATION_TIMEOUT`  | Time limit for Docker client negotiation. Timeouts are parsed using Go's [`ParseDuration`](https://golang.org/pkg/time/#ParseDuration). Valid time units are `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`. For example, `300ms`, `1.5h`, or `2h45m`. |
-| `DS_PULL_ANALYZER_IMAGE_TIMEOUT`        | Time limit when pulling the image of an analyzer. Timeouts are parsed using Go's [`ParseDuration`](https://golang.org/pkg/time/#ParseDuration). Valid time units are `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`. For example, `300ms`, `1.5h`, or `2h45m`. |
-| `DS_RUN_ANALYZER_TIMEOUT`               | Time limit when running an analyzer. Timeouts are parsed using Go's [`ParseDuration`](https://golang.org/pkg/time/#ParseDuration). Valid time units are `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`. For example, `300ms`, `1.5h`, or `2h45m`. |
-| `PIP_INDEX_URL`                         | Base URL of Python Package Index (default `https://pypi.org/simple`). |
-| `PIP_EXTRA_INDEX_URL`                   | Array of [extra URLs](https://pip.pypa.io/en/stable/reference/pip_install/#cmdoption-extra-index-url) of package indexes to use in addition to `PIP_INDEX_URL`. Comma separated. |
+| Environment variable                    | Description | Example usage |
+|--------------------------------         |-------------| |
+| `DS_ANALYZER_IMAGES`                    | Comma separated list of custom images. The official default images are still enabled. Read more about [customizing analyzers](analyzers.md). | |
+| `DS_ANALYZER_IMAGE_PREFIX`              | Override the name of the Docker registry providing the official default images (proxy). Read more about [customizing analyzers](analyzers.md). | |
+| `DS_ANALYZER_IMAGE_TAG`                 | Override the Docker tag of the official default images. Read more about [customizing analyzers](analyzers.md). | |
+| `DS_PYTHON_VERSION`                     | Version of Python. If set to 2, dependencies are installed using Python 2.7 instead of Python 3.6. ([Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/12296) in GitLab 12.1)| |
+| `DS_PIP_DEPENDENCY_PATH`                | Path to load Python pip dependencies from. ([Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/12412) in GitLab 12.2) | |
+| `DS_DEFAULT_ANALYZERS`                  | Override the names of the official default images. Read more about [customizing analyzers](analyzers.md). | |
+| `DS_DISABLE_REMOTE_CHECKS`              | Do not send any data to GitLab. Used in the [Gemnasium analyzer](#remote-checks). | |
+| `DS_PULL_ANALYZER_IMAGES`               | Pull the images from the Docker registry (set to `0` to disable). | |
+| `DS_EXCLUDED_PATHS`                     | Exclude vulnerabilities from output based on the paths. A comma-separated list of patterns. Patterns can be globs, file or folder paths. Parent directories will also match patterns. | `DS_EXCLUDED_PATHS=doc,spec` |
+| `DS_DOCKER_CLIENT_NEGOTIATION_TIMEOUT`  | Time limit for Docker client negotiation. Timeouts are parsed using Go's [`ParseDuration`](https://golang.org/pkg/time/#ParseDuration). Valid time units are `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`. For example, `300ms`, `1.5h`, or `2h45m`. | |
+| `DS_PULL_ANALYZER_IMAGE_TIMEOUT`        | Time limit when pulling the image of an analyzer. Timeouts are parsed using Go's [`ParseDuration`](https://golang.org/pkg/time/#ParseDuration). Valid time units are `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`. For example, `300ms`, `1.5h`, or `2h45m`. | |
+| `DS_RUN_ANALYZER_TIMEOUT`               | Time limit when running an analyzer. Timeouts are parsed using Go's [`ParseDuration`](https://golang.org/pkg/time/#ParseDuration). Valid time units are `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`. For example, `300ms`, `1.5h`, or `2h45m`. | |
+| `PIP_INDEX_URL`                         | Base URL of Python Package Index (default `https://pypi.org/simple`). | |
+| `PIP_EXTRA_INDEX_URL`                   | Array of [extra URLs](https://pip.pypa.io/en/stable/reference/pip_install/#cmdoption-extra-index-url) of package indexes to use in addition to `PIP_INDEX_URL`. Comma separated. | |
 
 ## Reports JSON format
 
@@ -277,7 +277,7 @@ Here is the description of the report file structure nodes and their meaning. Al
 the report JSON unless stated otherwise. Presence of optional fields depends on the underlying analyzers being used.
 
 | Report JSON node                                     | Description |
-|------------------------------------------------------|----------|
+|------------------------------------------------------|-------------|
 | `version`                                            | Report syntax version used to generate this JSON. |
 | `vulnerabilities`                                    | Array of vulnerability objects. |
 | `vulnerabilities[].category`                         | Where this vulnerability belongs (SAST, Dependency Scanning etc.). For Dependency Scanning, it will always be `dependency_scanning`. |
diff --git a/doc/user/application_security/sast/index.md b/doc/user/application_security/sast/index.md
index 31027210cbc..3eead6ccd3f 100644
--- a/doc/user/application_security/sast/index.md
+++ b/doc/user/application_security/sast/index.md
@@ -160,14 +160,14 @@ The following are Docker image-related variables.
 
 Some analyzers make it possible to filter out vulnerabilities under a given threshold.
 
-| Environment variable | Default value | Description |
-|----------------------|---------------|-------------|
-| `SAST_BANDIT_EXCLUDED_PATHS`  | -   | comma-separated list of paths to exclude from scan. Uses Python's [`fnmatch` syntax](https://docs.python.org/2/library/fnmatch.html) |
-| `SAST_BRAKEMAN_LEVEL`   |         1 | Ignore Brakeman vulnerabilities under given confidence level. Integer, 1=Low 3=High. |
-| `SAST_FLAWFINDER_LEVEL` |         1 | Ignore Flawfinder vulnerabilities under given risk level. Integer, 0=No risk, 5=High risk. |
-| `SAST_GITLEAKS_ENTROPY_LEVEL` | 8.0 | Minimum entropy for secret detection. Float, 0.0 = low, 8.0 = high. |
-| `SAST_GOSEC_LEVEL`      |         0 | Ignore gosec vulnerabilities under given confidence level. Integer, 0=Undefined, 1=Low, 2=Medium, 3=High. |
-| `SAST_EXCLUDED_PATHS`   |   -        | Exclude vulnerabilities from output based on the paths. This is a comma-separated list of patterns. Patterns can be globs, file or folder paths. Parent directories will also match patterns. |
+| Environment variable | Default value | Description | Example usage |
+|----------------------|---------------|-------------|---|
+| `SAST_BANDIT_EXCLUDED_PATHS`  | -   | comma-separated list of paths to exclude from scan. Uses Python's [`fnmatch` syntax](https://docs.python.org/2/library/fnmatch.html) | |
+| `SAST_BRAKEMAN_LEVEL`   |         1 | Ignore Brakeman vulnerabilities under given confidence level. Integer, 1=Low 3=High. | |
+| `SAST_FLAWFINDER_LEVEL` |         1 | Ignore Flawfinder vulnerabilities under given risk level. Integer, 0=No risk, 5=High risk. | |
+| `SAST_GITLEAKS_ENTROPY_LEVEL` | 8.0 | Minimum entropy for secret detection. Float, 0.0 = low, 8.0 = high. | |
+| `SAST_GOSEC_LEVEL`      |         0 | Ignore gosec vulnerabilities under given confidence level. Integer, 0=Undefined, 1=Low, 2=Medium, 3=High. | |
+| `SAST_EXCLUDED_PATHS`   |   -        | Exclude vulnerabilities from output based on the paths. This is a comma-separated list of patterns. Patterns can be globs, file or folder paths. Parent directories will also match patterns. | `SAST_EXCLUDED_PATHS=doc,spec` |
 
 ### Timeouts
 
-- 
cgit v1.2.1


From 47dff5edd80a31c82d525a47ff12f81cb0d3f3bc Mon Sep 17 00:00:00 2001
From: Nourdin el Bacha <nelbacha@gitlab.com>
Date: Fri, 23 Aug 2019 18:15:10 +0000
Subject: Improve grammar and correct syntax in curl example

---
 doc/api/README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/api/README.md b/doc/api/README.md
index 33394d46a2d..036b46da6e5 100644
--- a/doc/api/README.md
+++ b/doc/api/README.md
@@ -396,7 +396,7 @@ GET /api/v4/projects/diaspora%2Fdiaspora
 
 NOTE: **Note:**
 A project's **path** is not necessarily the same as its **name**.  A
-project's path can found in the project's URL or in the project's settings
+project's path can be found in the project's URL or in the project's settings
 under **General > Advanced > Change path**.
 
 ## Branches and tags name encoding
@@ -422,7 +422,7 @@ We can call the API with `array` and `hash` types parameters as shown below:
 curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" \
 -d "import_sources[]=github" \
 -d "import_sources[]=bitbucket" \
-"https://gitlab.example.com/api/v4/some_endpoint
+https://gitlab.example.com/api/v4/some_endpoint
 ```
 
 ### `hash`
-- 
cgit v1.2.1


From 15227e633fa1b57d4b8eaa564614c2402b24adbe Mon Sep 17 00:00:00 2001
From: John Cai <jcai@gitlab.com>
Date: Sat, 10 Aug 2019 09:38:26 -0700
Subject: Adding gitaly feature flag for go implementation of get all lfs
 pointers

---
 lib/feature/gitaly.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/feature/gitaly.rb b/lib/feature/gitaly.rb
index be397a478cd..656becbffd3 100644
--- a/lib/feature/gitaly.rb
+++ b/lib/feature/gitaly.rb
@@ -10,6 +10,7 @@ class Feature
         get_commit_signatures
         cache_invalidator
         inforef_uploadpack_cache
+        get_all_lfs_pointers_go
       ].freeze
 
     DEFAULT_ON_FLAGS = Set.new([]).freeze
-- 
cgit v1.2.1


From 37b333e4e6cf7d421abda28f6deb1c4ee95c2be0 Mon Sep 17 00:00:00 2001
From: Lucas Charles <me@lucascharles.me>
Date: Fri, 23 Aug 2019 18:26:23 +0000
Subject: Update docs - SAST golang analyzer URLs are partially reliable

With https://gitlab.com/gitlab-org/security-products/analyzers/gosec/merge_requests/18
we have added some basic URLs to our gosec analyzer, upgrading data from none to partially reliable
---
 doc/user/application_security/sast/analyzers.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/user/application_security/sast/analyzers.md b/doc/user/application_security/sast/analyzers.md
index f730a25a9fc..a1bd00f34e3 100644
--- a/doc/user/application_security/sast/analyzers.md
+++ b/doc/user/application_security/sast/analyzers.md
@@ -128,7 +128,7 @@ custom analyzer can scan the source code.
 | Start column                            | ✓   | 𐄂                  | 𐄂                  | ✓   | ✓   | ✓   | ✓   | 𐄂                  | ✓      | ✓          | ✓ | 𐄂                |
 | End column                              | ✓   | 𐄂                  | 𐄂                  | ✓   | ✓   | 𐄂                  | 𐄂                  | 𐄂                  | 𐄂                     | 𐄂                         | ✓ | 𐄂                |
 | External id (e.g. CVE)                  | 𐄂   | 𐄂                  | ⚠            | 𐄂                  | ⚠            | ✓   | 𐄂                  | 𐄂                  | 𐄂                     | 𐄂                         | 𐄂                | 𐄂                |
-| URLs                                    | ✓   | 𐄂                  | ✓   | 𐄂                  | ⚠            | 𐄂                  | 𐄂                  | 𐄂                  | 𐄂                     | 𐄂                         | 𐄂                | 𐄂                |
+| URLs                                    | ✓   | 𐄂                  | ✓   | 𐄂                  | ⚠            | 𐄂                 | ⚠       | 𐄂                  | 𐄂                  | 𐄂                     | 𐄂                         | 𐄂                | 𐄂                |
 | Internal doc/explanation                | ✓   | ⚠            | ✓   | 𐄂                  | ✓   | 𐄂                  | 𐄂                  | 𐄂                  | 𐄂                     | 𐄂                         | 𐄂                | ✓ |
 | Solution                                | ✓   | 𐄂                  | 𐄂                  | 𐄂                  | ⚠            | ✓   | 𐄂                  | 𐄂                  | 𐄂                     | 𐄂                         | 𐄂                | 𐄂                |
 | Confidence                              | 𐄂   | ✓   | ✓   | 𐄂                  | ✓   | ✓   | ✓   | 𐄂                  | 𐄂                     | 𐄂                         | 𐄂                | ✓ |
-- 
cgit v1.2.1


From 68ae21d6115172252d8efec2305faa9a965b18b3 Mon Sep 17 00:00:00 2001
From: Sean Carroll <scarroll@gitlab.com>
Date: Fri, 23 Aug 2019 19:46:02 +0000
Subject: Remove redundant index

---
 ...360-redundant-index-in-the-releases-table_v2.yml |  5 +++++
 ...5140353_remove_rendundant_index_from_releases.rb | 21 +++++++++++++++++++++
 db/schema.rb                                        |  1 -
 3 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/55360-redundant-index-in-the-releases-table_v2.yml
 create mode 100644 db/migrate/20190805140353_remove_rendundant_index_from_releases.rb

diff --git a/changelogs/unreleased/55360-redundant-index-in-the-releases-table_v2.yml b/changelogs/unreleased/55360-redundant-index-in-the-releases-table_v2.yml
new file mode 100644
index 00000000000..91a1fb5e6c9
--- /dev/null
+++ b/changelogs/unreleased/55360-redundant-index-in-the-releases-table_v2.yml
@@ -0,0 +1,5 @@
+---
+title: Removed redundant index on releases table
+merge_request: 31487
+author:
+type: removed
diff --git a/db/migrate/20190805140353_remove_rendundant_index_from_releases.rb b/db/migrate/20190805140353_remove_rendundant_index_from_releases.rb
new file mode 100644
index 00000000000..fc4bc1a423b
--- /dev/null
+++ b/db/migrate/20190805140353_remove_rendundant_index_from_releases.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class RemoveRendundantIndexFromReleases < ActiveRecord::Migration[5.2]
+  include Gitlab::Database::MigrationHelpers
+
+  # Set this constant to true if this migration requires downtime.
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    remove_concurrent_index :releases, :project_id
+  end
+
+  def down
+    add_concurrent_index :releases, :project_id
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 3f7917654cf..944d23e5365 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -3015,7 +3015,6 @@ ActiveRecord::Schema.define(version: 2019_08_15_093949) do
     t.datetime_with_timezone "released_at", null: false
     t.index ["author_id"], name: "index_releases_on_author_id"
     t.index ["project_id", "tag"], name: "index_releases_on_project_id_and_tag"
-    t.index ["project_id"], name: "index_releases_on_project_id"
   end
 
   create_table "remote_mirrors", id: :serial, force: :cascade do |t|
-- 
cgit v1.2.1


From 9ad0a8ad6259fb44876443d8bbf692e291165376 Mon Sep 17 00:00:00 2001
From: Paul Slaughter <pslaughter@gitlab.com>
Date: Thu, 22 Aug 2019 21:39:34 -0500
Subject: Fix issuable sidebar icon of notification disabled

by adding the proper notification icon
---
 app/helpers/notifications_helper.rb                                  | 4 ++--
 app/views/shared/issuable/_sidebar.html.haml                         | 4 +++-
 .../fe-fix-issuable-sidebar-icon-of-notification-disabled.yml        | 5 +++++
 3 files changed, 10 insertions(+), 3 deletions(-)
 create mode 100644 changelogs/unreleased/fe-fix-issuable-sidebar-icon-of-notification-disabled.yml

diff --git a/app/helpers/notifications_helper.rb b/app/helpers/notifications_helper.rb
index 5678304ffcf..8855e0cdd70 100644
--- a/app/helpers/notifications_helper.rb
+++ b/app/helpers/notifications_helper.rb
@@ -106,9 +106,9 @@ module NotificationsHelper
     end
   end
 
-  def notification_setting_icon(notification_setting)
+  def notification_setting_icon(notification_setting = nil)
     sprite_icon(
-      notification_setting.disabled? ? "notifications-off" : "notifications",
+      !notification_setting.present? || notification_setting.disabled? ? "notifications-off" : "notifications",
       css_class: "icon notifications-icon js-notifications-icon"
     )
   end
diff --git a/app/views/shared/issuable/_sidebar.html.haml b/app/views/shared/issuable/_sidebar.html.haml
index 825088a58e7..245886f495c 100644
--- a/app/views/shared/issuable/_sidebar.html.haml
+++ b/app/views/shared/issuable/_sidebar.html.haml
@@ -139,7 +139,9 @@
       - if signed_in
         - if issuable_sidebar[:project_emails_disabled]
           .block.js-emails-disabled
-            = notification_description(:owner_disabled)
+            .sidebar-collapsed-icon.has-tooltip{ title: notification_description(:owner_disabled), data: { placement: "left", container: "body", boundary: 'viewport' } }
+              = notification_setting_icon
+            .hide-collapsed= notification_description(:owner_disabled)
         - else
           .js-sidebar-subscriptions-entry-point
 
diff --git a/changelogs/unreleased/fe-fix-issuable-sidebar-icon-of-notification-disabled.yml b/changelogs/unreleased/fe-fix-issuable-sidebar-icon-of-notification-disabled.yml
new file mode 100644
index 00000000000..736e12ff694
--- /dev/null
+++ b/changelogs/unreleased/fe-fix-issuable-sidebar-icon-of-notification-disabled.yml
@@ -0,0 +1,5 @@
+---
+title: Fix issuable sidebar icon on notification disabled
+merge_request: 32134
+author:
+type: fixed
-- 
cgit v1.2.1


From 8af8da09d0d25d25b5977b7c74da364e6fbec5fa Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Fri, 23 Aug 2019 12:52:53 -0700
Subject: Note some JWT requests aren't rate limited

---
 doc/security/rack_attack.md  | 2 ++
 doc/user/gitlab_com/index.md | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/doc/security/rack_attack.md b/doc/security/rack_attack.md
index b99bfb16829..4ad5fd0d16c 100644
--- a/doc/security/rack_attack.md
+++ b/doc/security/rack_attack.md
@@ -81,6 +81,8 @@ This limit is reset by requests that authenticate successfully. For example, 29
 failed authentication requests followed by 1 successful request, followed by 29
 more failed authentication requests would not trigger a ban.
 
+JWT requests authenticated by gitlab-ci-token are excluded from this limit.
+
 No response headers are provided.
 
 ## Settings
diff --git a/doc/user/gitlab_com/index.md b/doc/user/gitlab_com/index.md
index af37cc896ad..8f1048260f2 100644
--- a/doc/user/gitlab_com/index.md
+++ b/doc/user/gitlab_com/index.md
@@ -314,7 +314,7 @@ Source:
 
 #### Git and container registry failed authentication ban
 
-GitLab.com responds with HTTP status code 403 for 1 hour, if 30 failed
+GitLab.com responds with HTTP status code `403` for 1 hour, if 30 failed
 authentication requests were received in a 3-minute period from a single IP address.
 
 This applies only to Git requests and container registry (`/jwt/auth`) requests
@@ -324,6 +324,8 @@ This limit is reset by requests that authenticate successfully. For example, 29
 failed authentication requests followed by 1 successful request, followed by 29
 more failed authentication requests would not trigger a ban.
 
+JWT requests authenticated by gitlab-ci-token are excluded from this limit.
+
 No response headers are provided.
 
 ### Admin Area settings
-- 
cgit v1.2.1


From c96adfcd6c9d303f3f7f86e441e57cb3ce8a286e Mon Sep 17 00:00:00 2001
From: shampton <shampton@gitlab.com>
Date: Fri, 23 Aug 2019 12:57:21 -0700
Subject: Move visual review toolbar to NPM

Remove the visual review toolbar code
in favor of using the NPM package.
---
 .../visual_review_toolbar/components/comment.js    |  39 -----
 .../components/comment_mr_note.js                  |  31 ----
 .../components/comment_post.js                     | 145 ----------------
 .../components/comment_storage.js                  |  20 ---
 .../components/form_elements.js                    |  17 --
 .../visual_review_toolbar/components/index.js      |  23 ---
 .../visual_review_toolbar/components/login.js      |  47 ------
 .../visual_review_toolbar/components/mr_id.js      |  63 -------
 .../visual_review_toolbar/components/note.js       |  35 ----
 .../visual_review_toolbar/components/utils.js      |  51 ------
 .../visual_review_toolbar/components/wrapper.js    |  79 ---------
 .../components/wrapper_icons.js                    |  15 --
 .../javascripts/visual_review_toolbar/index.js     |  51 ------
 .../visual_review_toolbar/shared/constants.js      |  56 ------
 .../visual_review_toolbar/shared/index.js          |  55 ------
 .../visual_review_toolbar/shared/storage_utils.js  |  42 -----
 .../visual_review_toolbar/store/events.js          |  73 --------
 .../visual_review_toolbar/store/index.js           |  11 --
 .../visual_review_toolbar/store/state.js           |  95 -----------
 .../visual_review_toolbar/store/utils.js           |  15 --
 .../visual_review_toolbar/styles/toolbar.css       | 188 ---------------------
 .../66402-use-visual-review-tools-npm-package.yml  |   5 +
 config/webpack.config.js                           |   7 +
 config/webpack.config.review_toolbar.js            |  58 -------
 lib/tasks/gitlab/assets.rake                       |   6 -
 package.json                                       |   4 +-
 yarn.lock                                          |   5 +
 27 files changed, 19 insertions(+), 1217 deletions(-)
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/comment.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/comment_mr_note.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/comment_post.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/comment_storage.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/form_elements.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/index.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/login.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/mr_id.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/note.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/utils.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/wrapper.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/components/wrapper_icons.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/index.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/shared/constants.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/shared/index.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/shared/storage_utils.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/store/events.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/store/index.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/store/state.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/store/utils.js
 delete mode 100644 app/assets/javascripts/visual_review_toolbar/styles/toolbar.css
 create mode 100644 changelogs/unreleased/66402-use-visual-review-tools-npm-package.yml
 delete mode 100644 config/webpack.config.review_toolbar.js

diff --git a/app/assets/javascripts/visual_review_toolbar/components/comment.js b/app/assets/javascripts/visual_review_toolbar/components/comment.js
deleted file mode 100644
index a03dc14b319..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/comment.js
+++ /dev/null
@@ -1,39 +0,0 @@
-import { nextView } from '../store';
-import { localStorage, COMMENT_BOX, LOGOUT, STORAGE_MR_ID, STORAGE_TOKEN } from '../shared';
-import { clearNote } from './note';
-import { buttonClearStyles } from './utils';
-import { addForm } from './wrapper';
-import { changeSelectedMr, selectedMrNote } from './comment_mr_note';
-import postComment from './comment_post';
-import { saveComment, getSavedComment } from './comment_storage';
-
-const comment = state => {
-  const savedComment = getSavedComment();
-
-  return `
-    <div>
-      <textarea id="${COMMENT_BOX}" name="${COMMENT_BOX}" rows="3" placeholder="Enter your feedback or idea" class="gitlab-input" aria-required="true">${savedComment}</textarea>
-      ${selectedMrNote(state)}
-      <p class="gitlab-metadata-note">Additional metadata will be included: browser, OS, current page, user agent, and viewport dimensions.</p>
-    </div>
-    <div class="gitlab-button-wrapper">
-      <button class="gitlab-button gitlab-button-success" style="${buttonClearStyles}" type="button" id="gitlab-comment-button"> Send feedback </button>
-      <button class="gitlab-button gitlab-button-secondary" style="${buttonClearStyles}" type="button" id="${LOGOUT}"> Log out </button>
-    </div>
-  `;
-};
-
-// This function is here becaause it is called only from the comment view
-// If we reach a design where we can logout from multiple views, promote this
-// to it's own package
-const logoutUser = state => {
-  localStorage.removeItem(STORAGE_TOKEN);
-  localStorage.removeItem(STORAGE_MR_ID);
-  state.token = '';
-  state.mergeRequestId = '';
-
-  clearNote();
-  addForm(nextView(state, COMMENT_BOX));
-};
-
-export { changeSelectedMr, comment, logoutUser, postComment, saveComment };
diff --git a/app/assets/javascripts/visual_review_toolbar/components/comment_mr_note.js b/app/assets/javascripts/visual_review_toolbar/components/comment_mr_note.js
deleted file mode 100644
index da67763261c..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/comment_mr_note.js
+++ /dev/null
@@ -1,31 +0,0 @@
-import { nextView } from '../store';
-import { localStorage, CHANGE_MR_ID_BUTTON, COMMENT_BOX, STORAGE_MR_ID } from '../shared';
-import { clearNote } from './note';
-import { buttonClearStyles } from './utils';
-import { addForm } from './wrapper';
-
-const selectedMrNote = state => {
-  const { mrUrl, projectPath, mergeRequestId } = state;
-
-  const mrLink = `${mrUrl}/${projectPath}/merge_requests/${mergeRequestId}`;
-
-  return `
-    <p class="gitlab-metadata-note">
-      This posts to merge request <a class="gitlab-link" href="${mrLink}">!${mergeRequestId}</a>.
-      <button style="${buttonClearStyles}" type="button" id="${CHANGE_MR_ID_BUTTON}" class="gitlab-link gitlab-link-button">Change</button>
-    </p>
-  `;
-};
-
-const clearMrId = state => {
-  localStorage.removeItem(STORAGE_MR_ID);
-  state.mergeRequestId = '';
-};
-
-const changeSelectedMr = state => {
-  clearMrId(state);
-  clearNote();
-  addForm(nextView(state, COMMENT_BOX));
-};
-
-export { changeSelectedMr, selectedMrNote };
diff --git a/app/assets/javascripts/visual_review_toolbar/components/comment_post.js b/app/assets/javascripts/visual_review_toolbar/components/comment_post.js
deleted file mode 100644
index ee5f2b62425..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/comment_post.js
+++ /dev/null
@@ -1,145 +0,0 @@
-import { BLACK, COMMENT_BOX, MUTED } from '../shared';
-import { clearSavedComment } from './comment_storage';
-import { clearNote, postError } from './note';
-import { selectCommentBox, selectCommentButton, selectNote, selectNoteContainer } from './utils';
-
-const resetCommentButton = () => {
-  const commentButton = selectCommentButton();
-
-  /* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-  commentButton.innerText = 'Send feedback';
-  commentButton.classList.replace('gitlab-button-secondary', 'gitlab-button-success');
-  commentButton.style.opacity = 1;
-};
-
-const resetCommentBox = () => {
-  const commentBox = selectCommentBox();
-  commentBox.style.pointerEvents = 'auto';
-  commentBox.style.color = BLACK;
-};
-
-const resetCommentText = () => {
-  const commentBox = selectCommentBox();
-  commentBox.value = '';
-  clearSavedComment();
-};
-
-const resetComment = () => {
-  resetCommentButton();
-  resetCommentBox();
-  resetCommentText();
-};
-
-const confirmAndClear = feedbackInfo => {
-  const commentButton = selectCommentButton();
-  const currentNote = selectNote();
-  const noteContainer = selectNoteContainer();
-
-  /* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-  commentButton.innerText = 'Feedback sent';
-  noteContainer.style.visibility = 'visible';
-  currentNote.insertAdjacentHTML('beforeend', feedbackInfo);
-
-  setTimeout(resetComment, 1000);
-  setTimeout(clearNote, 6000);
-};
-
-const setInProgressState = () => {
-  const commentButton = selectCommentButton();
-  const commentBox = selectCommentBox();
-
-  /* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-  commentButton.innerText = 'Sending feedback';
-  commentButton.classList.replace('gitlab-button-success', 'gitlab-button-secondary');
-  commentButton.style.opacity = 0.5;
-  commentBox.style.color = MUTED;
-  commentBox.style.pointerEvents = 'none';
-};
-
-const commentErrors = error => {
-  switch (error.status) {
-    case 401:
-      /* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-      return 'Unauthorized. You may have entered an incorrect authentication token.';
-    case 404:
-      /* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-      return 'Not found. You may have entered an incorrect merge request ID.';
-    default:
-      /* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-      return `Your comment could not be sent. Please try again. Error: ${error.message}`;
-  }
-};
-
-const postComment = ({
-  platform,
-  browser,
-  userAgent,
-  innerWidth,
-  innerHeight,
-  projectId,
-  projectPath,
-  mergeRequestId,
-  mrUrl,
-  token,
-}) => {
-  // Clear any old errors
-  clearNote(COMMENT_BOX);
-
-  setInProgressState();
-
-  const commentText = selectCommentBox().value.trim();
-  // Get the href at the last moment to support SPAs
-  const { href } = window.location;
-
-  if (!commentText) {
-    /* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-    postError('Your comment appears to be empty.', COMMENT_BOX);
-    resetCommentBox();
-    resetCommentButton();
-    return;
-  }
-
-  const detailText = `
- \n
-<details>
-  <summary>Metadata</summary>
-  Posted from ${href} | ${platform} | ${browser} | ${innerWidth} x ${innerHeight}.
-  <br /><br />
-  <em>User agent: ${userAgent}</em>
-</details>
-  `;
-
-  const url = `
-    ${mrUrl}/api/v4/projects/${projectId}/merge_requests/${mergeRequestId}/discussions`;
-
-  const body = `${commentText} ${detailText}`;
-
-  fetch(url, {
-    method: 'POST',
-    headers: {
-      'PRIVATE-TOKEN': token,
-      'Content-Type': 'application/json',
-    },
-    body: JSON.stringify({ body }),
-  })
-    .then(response => {
-      if (response.ok) {
-        return response.json();
-      }
-
-      throw response;
-    })
-    .then(data => {
-      const commentId = data.notes[0].id;
-      const feedbackLink = `${mrUrl}/${projectPath}/merge_requests/${mergeRequestId}#note_${commentId}`;
-      const feedbackInfo = `Feedback sent. View at <a class="gitlab-link" href="${feedbackLink}">${projectPath} !${mergeRequestId} (comment ${commentId})</a>`;
-      confirmAndClear(feedbackInfo);
-    })
-    .catch(err => {
-      postError(commentErrors(err), COMMENT_BOX);
-      resetCommentBox();
-      resetCommentButton();
-    });
-};
-
-export default postComment;
diff --git a/app/assets/javascripts/visual_review_toolbar/components/comment_storage.js b/app/assets/javascripts/visual_review_toolbar/components/comment_storage.js
deleted file mode 100644
index 49c9400437e..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/comment_storage.js
+++ /dev/null
@@ -1,20 +0,0 @@
-import { selectCommentBox } from './utils';
-import { sessionStorage, STORAGE_COMMENT } from '../shared';
-
-const getSavedComment = () => sessionStorage.getItem(STORAGE_COMMENT) || '';
-
-const saveComment = () => {
-  const currentComment = selectCommentBox();
-
-  // This may be added to any view via top-level beforeunload listener
-  // so let's skip if it does not apply
-  if (currentComment && currentComment.value) {
-    sessionStorage.setItem(STORAGE_COMMENT, currentComment.value);
-  }
-};
-
-const clearSavedComment = () => {
-  sessionStorage.removeItem(STORAGE_COMMENT);
-};
-
-export { getSavedComment, saveComment, clearSavedComment };
diff --git a/app/assets/javascripts/visual_review_toolbar/components/form_elements.js b/app/assets/javascripts/visual_review_toolbar/components/form_elements.js
deleted file mode 100644
index 608488a6fea..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/form_elements.js
+++ /dev/null
@@ -1,17 +0,0 @@
-import { REMEMBER_ITEM } from '../shared';
-import { buttonClearStyles } from './utils';
-
-/* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-const rememberBox = (rememberText = 'Remember me') => `
-  <div class="gitlab-checkbox-wrapper">
-    <input type="checkbox" id="${REMEMBER_ITEM}" name="${REMEMBER_ITEM}" value="remember">
-    <label for="${REMEMBER_ITEM}" class="gitlab-checkbox-label">${rememberText}</label>
-  </div>
-`;
-
-const submitButton = buttonId => `
-  <div class="gitlab-button-wrapper">
-    <button class="gitlab-button-wide gitlab-button gitlab-button-success" style="${buttonClearStyles}" type="button" id="${buttonId}"> Submit </button>
-  </div>
-`;
-export { rememberBox, submitButton };
diff --git a/app/assets/javascripts/visual_review_toolbar/components/index.js b/app/assets/javascripts/visual_review_toolbar/components/index.js
deleted file mode 100644
index e88b3637ad8..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/index.js
+++ /dev/null
@@ -1,23 +0,0 @@
-import { changeSelectedMr, comment, logoutUser, postComment, saveComment } from './comment';
-import { authorizeUser, login } from './login';
-import { addMr, mrForm } from './mr_id';
-import { note } from './note';
-import { selectContainer, selectForm } from './utils';
-import { buttonAndForm, toggleForm } from './wrapper';
-
-export {
-  addMr,
-  authorizeUser,
-  buttonAndForm,
-  changeSelectedMr,
-  comment,
-  login,
-  logoutUser,
-  mrForm,
-  note,
-  postComment,
-  saveComment,
-  selectContainer,
-  selectForm,
-  toggleForm,
-};
diff --git a/app/assets/javascripts/visual_review_toolbar/components/login.js b/app/assets/javascripts/visual_review_toolbar/components/login.js
deleted file mode 100644
index 20ab01bc690..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/login.js
+++ /dev/null
@@ -1,47 +0,0 @@
-import { nextView } from '../store';
-import { localStorage, LOGIN, TOKEN_BOX, STORAGE_TOKEN } from '../shared';
-import { clearNote, postError } from './note';
-import { rememberBox, submitButton } from './form_elements';
-import { selectRemember, selectToken } from './utils';
-import { addForm } from './wrapper';
-
-const labelText = `
-  Enter your <a class="gitlab-link" href="https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html">personal access token</a>
-`;
-
-const login = `
-    <div>
-      <label for="${TOKEN_BOX}" class="gitlab-label">${labelText}</label>
-      <input class="gitlab-input" type="password" id="${TOKEN_BOX}" name="${TOKEN_BOX}" autocomplete="current-password" aria-required="true">
-    </div>
-    ${rememberBox()}
-    ${submitButton(LOGIN)}
-`;
-
-const storeToken = (token, state) => {
-  const rememberMe = selectRemember().checked;
-
-  if (rememberMe) {
-    localStorage.setItem(STORAGE_TOKEN, token);
-  }
-
-  state.token = token;
-};
-
-const authorizeUser = state => {
-  // Clear any old errors
-  clearNote(TOKEN_BOX);
-
-  const token = selectToken().value;
-
-  if (!token) {
-    /* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-    postError('Please enter your token.', TOKEN_BOX);
-    return;
-  }
-
-  storeToken(token, state);
-  addForm(nextView(state, LOGIN));
-};
-
-export { authorizeUser, login, storeToken };
diff --git a/app/assets/javascripts/visual_review_toolbar/components/mr_id.js b/app/assets/javascripts/visual_review_toolbar/components/mr_id.js
deleted file mode 100644
index 695b3af8aa0..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/mr_id.js
+++ /dev/null
@@ -1,63 +0,0 @@
-import { nextView } from '../store';
-import { MR_ID, MR_ID_BUTTON, STORAGE_MR_ID, localStorage } from '../shared';
-import { clearNote, postError } from './note';
-import { rememberBox, submitButton } from './form_elements';
-import { selectForm, selectMrBox, selectRemember } from './utils';
-import { addForm } from './wrapper';
-
-/* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-const mrLabel = `Enter your merge request ID`;
-/* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-const mrRememberText = `Remember this number`;
-
-const mrForm = `
-    <div>
-      <label for="${MR_ID}" class="gitlab-label">${mrLabel}</label>
-      <input class="gitlab-input" type="text" pattern="[1-9][0-9]*" id="${MR_ID}" name="${MR_ID}" placeholder="e.g., 321" aria-required="true">
-    </div>
-    ${rememberBox(mrRememberText)}
-    ${submitButton(MR_ID_BUTTON)}
-`;
-
-const storeMR = (id, state) => {
-  const rememberMe = selectRemember().checked;
-
-  if (rememberMe) {
-    localStorage.setItem(STORAGE_MR_ID, id);
-  }
-
-  state.mergeRequestId = id;
-};
-
-const getFormError = (mrNumber, form) => {
-  if (!mrNumber) {
-    /* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-    return 'Please enter your merge request ID number.';
-  }
-
-  if (!form.checkValidity()) {
-    /* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-    return 'Please remove any non-number values from the field.';
-  }
-
-  return null;
-};
-
-const addMr = state => {
-  // Clear any old errors
-  clearNote(MR_ID);
-
-  const mrNumber = selectMrBox().value;
-  const form = selectForm();
-  const formError = getFormError(mrNumber, form);
-
-  if (formError) {
-    postError(formError, MR_ID);
-    return;
-  }
-
-  storeMR(mrNumber, state);
-  addForm(nextView(state, MR_ID));
-};
-
-export { addMr, mrForm, storeMR };
diff --git a/app/assets/javascripts/visual_review_toolbar/components/note.js b/app/assets/javascripts/visual_review_toolbar/components/note.js
deleted file mode 100644
index 9cddcb710f2..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/note.js
+++ /dev/null
@@ -1,35 +0,0 @@
-import { NOTE, NOTE_CONTAINER, RED } from '../shared';
-import { selectById, selectNote, selectNoteContainer } from './utils';
-
-const note = `
-  <div id="${NOTE_CONTAINER}" style="visibility: hidden;">
-    <p id="${NOTE}" class="gitlab-message"></p>
-  </div>
-`;
-
-const clearNote = inputId => {
-  const currentNote = selectNote();
-  const noteContainer = selectNoteContainer();
-
-  currentNote.innerText = '';
-  currentNote.style.color = '';
-  noteContainer.style.visibility = 'hidden';
-
-  if (inputId) {
-    const field = document.getElementById(inputId);
-    field.style.borderColor = '';
-  }
-};
-
-const postError = (message, inputId) => {
-  const currentNote = selectNote();
-  const noteContainer = selectNoteContainer();
-  const field = selectById(inputId);
-  field.style.borderColor = RED;
-  currentNote.style.color = RED;
-  currentNote.innerText = message;
-  noteContainer.style.visibility = 'visible';
-  setTimeout(clearNote.bind(null, inputId), 5000);
-};
-
-export { clearNote, note, postError };
diff --git a/app/assets/javascripts/visual_review_toolbar/components/utils.js b/app/assets/javascripts/visual_review_toolbar/components/utils.js
deleted file mode 100644
index 4ec9bd4a32a..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/utils.js
+++ /dev/null
@@ -1,51 +0,0 @@
-/* global document */
-
-import {
-  COLLAPSE_BUTTON,
-  COMMENT_BOX,
-  COMMENT_BUTTON,
-  FORM,
-  FORM_CONTAINER,
-  MR_ID,
-  NOTE,
-  NOTE_CONTAINER,
-  REMEMBER_ITEM,
-  REVIEW_CONTAINER,
-  TOKEN_BOX,
-} from '../shared';
-
-// this style must be applied inline in a handful of components
-/* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-const buttonClearStyles = `
-  -webkit-appearance: none;
-`;
-
-// selector functions to abstract out a little
-const selectById = id => document.getElementById(id);
-const selectCollapseButton = () => document.getElementById(COLLAPSE_BUTTON);
-const selectCommentBox = () => document.getElementById(COMMENT_BOX);
-const selectCommentButton = () => document.getElementById(COMMENT_BUTTON);
-const selectContainer = () => document.getElementById(REVIEW_CONTAINER);
-const selectForm = () => document.getElementById(FORM);
-const selectFormContainer = () => document.getElementById(FORM_CONTAINER);
-const selectMrBox = () => document.getElementById(MR_ID);
-const selectNote = () => document.getElementById(NOTE);
-const selectNoteContainer = () => document.getElementById(NOTE_CONTAINER);
-const selectRemember = () => document.getElementById(REMEMBER_ITEM);
-const selectToken = () => document.getElementById(TOKEN_BOX);
-
-export {
-  buttonClearStyles,
-  selectById,
-  selectCollapseButton,
-  selectContainer,
-  selectCommentBox,
-  selectCommentButton,
-  selectForm,
-  selectFormContainer,
-  selectMrBox,
-  selectNote,
-  selectNoteContainer,
-  selectRemember,
-  selectToken,
-};
diff --git a/app/assets/javascripts/visual_review_toolbar/components/wrapper.js b/app/assets/javascripts/visual_review_toolbar/components/wrapper.js
deleted file mode 100644
index fdf8ad7c41f..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/wrapper.js
+++ /dev/null
@@ -1,79 +0,0 @@
-import { CLEAR, FORM, FORM_CONTAINER, WHITE } from '../shared';
-import {
-  selectCollapseButton,
-  selectForm,
-  selectFormContainer,
-  selectNoteContainer,
-} from './utils';
-import { collapseButton, commentIcon, compressIcon } from './wrapper_icons';
-
-const form = content => `
-  <form id="${FORM}" novalidate>
-    ${content}
-  </form>
-`;
-
-const buttonAndForm = content => `
-  <div id="${FORM_CONTAINER}" class="gitlab-form-open">
-    ${collapseButton}
-    ${form(content)}
-  </div>
-`;
-
-const addForm = nextForm => {
-  const formWrapper = selectForm();
-  formWrapper.innerHTML = nextForm;
-};
-
-function toggleForm() {
-  const toggleButton = selectCollapseButton();
-  const currentForm = selectForm();
-  const formContainer = selectFormContainer();
-  const noteContainer = selectNoteContainer();
-  const OPEN = 'open';
-  const CLOSED = 'closed';
-
-  /*
-    You may wonder why we spread the arrays before we reverse them.
-    In the immortal words of MDN,
-    Careful: reverse is destructive. It also changes the original array
-  */
-
-  const openButtonClasses = ['gitlab-collapse-closed', 'gitlab-collapse-open'];
-  const closedButtonClasses = [...openButtonClasses].reverse();
-  const openContainerClasses = ['gitlab-wrapper-closed', 'gitlab-wrapper-open'];
-  const closedContainerClasses = [...openContainerClasses].reverse();
-
-  const stateVals = {
-    [OPEN]: {
-      buttonClasses: openButtonClasses,
-      containerClasses: openContainerClasses,
-      icon: compressIcon,
-      display: 'flex',
-      backgroundColor: WHITE,
-    },
-    [CLOSED]: {
-      buttonClasses: closedButtonClasses,
-      containerClasses: closedContainerClasses,
-      icon: commentIcon,
-      display: 'none',
-      backgroundColor: CLEAR,
-    },
-  };
-
-  const nextState = toggleButton.classList.contains('gitlab-collapse-open') ? CLOSED : OPEN;
-  const currentVals = stateVals[nextState];
-
-  formContainer.classList.replace(...currentVals.containerClasses);
-  formContainer.style.backgroundColor = currentVals.backgroundColor;
-  formContainer.classList.toggle('gitlab-form-open');
-  currentForm.style.display = currentVals.display;
-  toggleButton.classList.replace(...currentVals.buttonClasses);
-  toggleButton.innerHTML = currentVals.icon;
-
-  if (noteContainer && noteContainer.innerText.length > 0) {
-    noteContainer.style.display = currentVals.display;
-  }
-}
-
-export { addForm, buttonAndForm, toggleForm };
diff --git a/app/assets/javascripts/visual_review_toolbar/components/wrapper_icons.js b/app/assets/javascripts/visual_review_toolbar/components/wrapper_icons.js
deleted file mode 100644
index b686fd4f5c2..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/components/wrapper_icons.js
+++ /dev/null
@@ -1,15 +0,0 @@
-import { buttonClearStyles } from './utils';
-
-const commentIcon = `
-  <svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><title>icn/comment</title><path d="M4 11.132l1.446-.964A1 1 0 0 1 6 10h5a1 1 0 0 0 1-1V5a1 1 0 0 0-1-1H5a1 1 0 0 0-1 1v6.132zM6.303 12l-2.748 1.832A1 1 0 0 1 2 13V5a3 3 0 0 1 3-3h6a3 3 0 0 1 3 3v4a3 3 0 0 1-3 3H6.303z" id="gitlab-comment-icon"/></svg>
-`;
-
-const compressIcon = `
-  <svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><title>icn/compress</title><path d="M5.27 12.182l-1.562 1.561a1 1 0 0 1-1.414 0h-.001a1 1 0 0 1 0-1.415l1.56-1.56L2.44 9.353a.5.5 0 0 1 .353-.854H7.09a.5.5 0 0 1 .5.5v4.294a.5.5 0 0 1-.853.353l-1.467-1.465zm6.911-6.914l1.464 1.464a.5.5 0 0 1-.353.854H8.999a.5.5 0 0 1-.5-.5V2.793a.5.5 0 0 1 .854-.354l1.414 1.415 1.56-1.561a1 1 0 1 1 1.415 1.414l-1.561 1.56z" id="gitlab-compress-icon"/></svg>
-`;
-
-const collapseButton = `
-  <button id='gitlab-collapse' style='${buttonClearStyles}' class='gitlab-button gitlab-button-secondary gitlab-collapse gitlab-collapse-open'>${compressIcon}</button>
-`;
-
-export { commentIcon, compressIcon, collapseButton };
diff --git a/app/assets/javascripts/visual_review_toolbar/index.js b/app/assets/javascripts/visual_review_toolbar/index.js
deleted file mode 100644
index 67b3fadd772..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/index.js
+++ /dev/null
@@ -1,51 +0,0 @@
-import './styles/toolbar.css';
-
-import { buttonAndForm, note, selectForm, selectContainer } from './components';
-import { REVIEW_CONTAINER } from './shared';
-import { eventLookup, getInitialView, initializeGlobalListeners, initializeState } from './store';
-
-/*
-
-  Welcome to the visual review toolbar files. A few useful notes:
-
-  - These files build a static script that is served from our webpack
-    assets folder. (https://gitlab.com/assets/webpack/visual_review_toolbar.js)
-
-  - To compile this file, run `yarn webpack-vrt`.
-
-  - Vue is not used in these files because we do not want to ask users to
-    install another library at this time. It's all pure vanilla javascript.
-
-*/
-
-window.addEventListener('load', () => {
-  initializeState(window, document);
-
-  const mainContent = buttonAndForm(getInitialView());
-  const container = document.createElement('div');
-  container.setAttribute('id', REVIEW_CONTAINER);
-  container.insertAdjacentHTML('beforeend', note);
-  container.insertAdjacentHTML('beforeend', mainContent);
-
-  document.body.insertBefore(container, document.body.firstChild);
-
-  selectContainer().addEventListener('click', event => {
-    eventLookup(event.target.id)();
-  });
-
-  selectForm().addEventListener('submit', event => {
-    // this is important to prevent the form from adding data
-    // as URL params and inadvertently revealing secrets
-    event.preventDefault();
-
-    const id =
-      event.target.querySelector('.gitlab-button-wrapper') &&
-      event.target.querySelector('.gitlab-button-wrapper').getElementsByTagName('button')[0] &&
-      event.target.querySelector('.gitlab-button-wrapper').getElementsByTagName('button')[0].id;
-
-    // even if this is called with false, it's ok; it will get the default no-op
-    eventLookup(id)();
-  });
-
-  initializeGlobalListeners();
-});
diff --git a/app/assets/javascripts/visual_review_toolbar/shared/constants.js b/app/assets/javascripts/visual_review_toolbar/shared/constants.js
deleted file mode 100644
index 0d5b666ab0a..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/shared/constants.js
+++ /dev/null
@@ -1,56 +0,0 @@
-// component selectors
-const CHANGE_MR_ID_BUTTON = 'gitlab-change-mr';
-const COLLAPSE_BUTTON = 'gitlab-collapse';
-const COMMENT_BOX = 'gitlab-comment';
-const COMMENT_BUTTON = 'gitlab-comment-button';
-const FORM = 'gitlab-form';
-const FORM_CONTAINER = 'gitlab-form-wrapper';
-const LOGIN = 'gitlab-login-button';
-const LOGOUT = 'gitlab-logout-button';
-const MR_ID = 'gitlab-submit-mr';
-const MR_ID_BUTTON = 'gitlab-submit-mr-button';
-const NOTE = 'gitlab-validation-note';
-const NOTE_CONTAINER = 'gitlab-note-wrapper';
-const REMEMBER_ITEM = 'gitlab-remember-item';
-const REVIEW_CONTAINER = 'gitlab-review-container';
-const TOKEN_BOX = 'gitlab-token';
-
-// Storage keys
-const STORAGE_PREFIX = '--gitlab'; // Using `--` to make the prefix more unique
-const STORAGE_MR_ID = `${STORAGE_PREFIX}-merge-request-id`;
-const STORAGE_TOKEN = `${STORAGE_PREFIX}-token`;
-const STORAGE_COMMENT = `${STORAGE_PREFIX}-comment`;
-
-// colors — these are applied programmatically
-// rest of styles belong in ./styles
-const BLACK = 'rgba(46, 46, 46, 1)';
-const CLEAR = 'rgba(255, 255, 255, 0)';
-const MUTED = 'rgba(223, 223, 223, 0.5)';
-const RED = 'rgba(219, 59, 33, 1)';
-const WHITE = 'rgba(250, 250, 250, 1)';
-
-export {
-  CHANGE_MR_ID_BUTTON,
-  COLLAPSE_BUTTON,
-  COMMENT_BOX,
-  COMMENT_BUTTON,
-  FORM,
-  FORM_CONTAINER,
-  LOGIN,
-  LOGOUT,
-  MR_ID,
-  MR_ID_BUTTON,
-  NOTE,
-  NOTE_CONTAINER,
-  REMEMBER_ITEM,
-  REVIEW_CONTAINER,
-  TOKEN_BOX,
-  STORAGE_MR_ID,
-  STORAGE_TOKEN,
-  STORAGE_COMMENT,
-  BLACK,
-  CLEAR,
-  MUTED,
-  RED,
-  WHITE,
-};
diff --git a/app/assets/javascripts/visual_review_toolbar/shared/index.js b/app/assets/javascripts/visual_review_toolbar/shared/index.js
deleted file mode 100644
index d8ccb170592..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/shared/index.js
+++ /dev/null
@@ -1,55 +0,0 @@
-import {
-  CHANGE_MR_ID_BUTTON,
-  COLLAPSE_BUTTON,
-  COMMENT_BOX,
-  COMMENT_BUTTON,
-  FORM,
-  FORM_CONTAINER,
-  LOGIN,
-  LOGOUT,
-  MR_ID,
-  MR_ID_BUTTON,
-  NOTE,
-  NOTE_CONTAINER,
-  REMEMBER_ITEM,
-  REVIEW_CONTAINER,
-  TOKEN_BOX,
-  STORAGE_MR_ID,
-  STORAGE_TOKEN,
-  STORAGE_COMMENT,
-  BLACK,
-  CLEAR,
-  MUTED,
-  RED,
-  WHITE,
-} from './constants';
-
-import { localStorage, sessionStorage } from './storage_utils';
-
-export {
-  localStorage,
-  sessionStorage,
-  CHANGE_MR_ID_BUTTON,
-  COLLAPSE_BUTTON,
-  COMMENT_BOX,
-  COMMENT_BUTTON,
-  FORM,
-  FORM_CONTAINER,
-  LOGIN,
-  LOGOUT,
-  MR_ID,
-  MR_ID_BUTTON,
-  NOTE,
-  NOTE_CONTAINER,
-  REMEMBER_ITEM,
-  REVIEW_CONTAINER,
-  TOKEN_BOX,
-  STORAGE_MR_ID,
-  STORAGE_TOKEN,
-  STORAGE_COMMENT,
-  BLACK,
-  CLEAR,
-  MUTED,
-  RED,
-  WHITE,
-};
diff --git a/app/assets/javascripts/visual_review_toolbar/shared/storage_utils.js b/app/assets/javascripts/visual_review_toolbar/shared/storage_utils.js
deleted file mode 100644
index 00456d3536e..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/shared/storage_utils.js
+++ /dev/null
@@ -1,42 +0,0 @@
-import { setUsingGracefulStorageFlag } from '../store/state';
-
-const TEST_KEY = 'gitlab-storage-test';
-
-const createStorageStub = () => {
-  const items = {};
-
-  return {
-    getItem(key) {
-      return items[key];
-    },
-    setItem(key, value) {
-      items[key] = value;
-    },
-    removeItem(key) {
-      delete items[key];
-    },
-  };
-};
-
-const hasStorageSupport = storage => {
-  // Support test taken from https://stackoverflow.com/a/11214467/1708147
-  try {
-    storage.setItem(TEST_KEY, TEST_KEY);
-    storage.removeItem(TEST_KEY);
-    setUsingGracefulStorageFlag(true);
-
-    return true;
-  } catch (err) {
-    setUsingGracefulStorageFlag(false);
-    return false;
-  }
-};
-
-const useGracefulStorage = storage =>
-  // If a browser does not support local storage, let's return a graceful implementation.
-  hasStorageSupport(storage) ? storage : createStorageStub();
-
-const localStorage = useGracefulStorage(window.localStorage);
-const sessionStorage = useGracefulStorage(window.sessionStorage);
-
-export { localStorage, sessionStorage };
diff --git a/app/assets/javascripts/visual_review_toolbar/store/events.js b/app/assets/javascripts/visual_review_toolbar/store/events.js
deleted file mode 100644
index c9095c77ef1..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/store/events.js
+++ /dev/null
@@ -1,73 +0,0 @@
-import {
-  addMr,
-  authorizeUser,
-  changeSelectedMr,
-  logoutUser,
-  postComment,
-  saveComment,
-  toggleForm,
-} from '../components';
-
-import {
-  CHANGE_MR_ID_BUTTON,
-  COLLAPSE_BUTTON,
-  COMMENT_BUTTON,
-  LOGIN,
-  LOGOUT,
-  MR_ID_BUTTON,
-} from '../shared';
-
-import { state } from './state';
-import debounce from './utils';
-
-const noop = () => {};
-
-// State needs to be bound here to be acted on
-// because these are called by click events and
-// as such are called with only the `event` object
-const eventLookup = id => {
-  switch (id) {
-    case CHANGE_MR_ID_BUTTON:
-      return () => {
-        saveComment();
-        changeSelectedMr(state);
-      };
-    case COLLAPSE_BUTTON:
-      return toggleForm;
-    case COMMENT_BUTTON:
-      return postComment.bind(null, state);
-    case LOGIN:
-      return authorizeUser.bind(null, state);
-    case LOGOUT:
-      return () => {
-        saveComment();
-        logoutUser(state);
-      };
-    case MR_ID_BUTTON:
-      return addMr.bind(null, state);
-    default:
-      return noop;
-  }
-};
-
-const updateWindowSize = wind => {
-  state.innerWidth = wind.innerWidth;
-  state.innerHeight = wind.innerHeight;
-};
-
-const initializeGlobalListeners = () => {
-  window.addEventListener('resize', debounce(updateWindowSize.bind(null, window), 200));
-  window.addEventListener('beforeunload', event => {
-    if (state.usingGracefulStorage) {
-      // if there is no browser storage support, reloading will lose the comment; this way, the user will be warned
-      // we assign the return value because it is required by Chrome see: https://developer.mozilla.org/en-US/docs/Web/API/WindowEventHandlers/onbeforeunload#Example,
-      event.preventDefault();
-      /* eslint-disable-next-line no-param-reassign */
-      event.returnValue = '';
-    }
-
-    saveComment();
-  });
-};
-
-export { eventLookup, initializeGlobalListeners };
diff --git a/app/assets/javascripts/visual_review_toolbar/store/index.js b/app/assets/javascripts/visual_review_toolbar/store/index.js
deleted file mode 100644
index 07c8dd6f1d2..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/store/index.js
+++ /dev/null
@@ -1,11 +0,0 @@
-import { eventLookup, initializeGlobalListeners } from './events';
-import { nextView, getInitialView, initializeState, setUsingGracefulStorageFlag } from './state';
-
-export {
-  eventLookup,
-  getInitialView,
-  initializeGlobalListeners,
-  initializeState,
-  nextView,
-  setUsingGracefulStorageFlag,
-};
diff --git a/app/assets/javascripts/visual_review_toolbar/store/state.js b/app/assets/javascripts/visual_review_toolbar/store/state.js
deleted file mode 100644
index b7853bb0723..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/store/state.js
+++ /dev/null
@@ -1,95 +0,0 @@
-import { comment, login, mrForm } from '../components';
-import { localStorage, COMMENT_BOX, LOGIN, MR_ID, STORAGE_MR_ID, STORAGE_TOKEN } from '../shared';
-
-const state = {
-  browser: '',
-  usingGracefulStorage: '',
-  innerWidth: '',
-  innerHeight: '',
-  mergeRequestId: '',
-  mrUrl: '',
-  platform: '',
-  projectId: '',
-  userAgent: '',
-  token: '',
-};
-
-// adapted from https://developer.mozilla.org/en-US/docs/Web/API/Window/navigator#Example_2_Browser_detect_and_return_an_index
-const getBrowserId = sUsrAg => {
-  /* eslint-disable-next-line @gitlab/i18n/no-non-i18n-strings */
-  const aKeys = ['MSIE', 'Edge', 'Firefox', 'Safari', 'Chrome', 'Opera'];
-  let nIdx = aKeys.length - 1;
-
-  for (nIdx; nIdx > -1 && sUsrAg.indexOf(aKeys[nIdx]) === -1; nIdx -= 1);
-  return aKeys[nIdx];
-};
-
-const nextView = (appState, form = 'none') => {
-  const formsList = {
-    [COMMENT_BOX]: currentState => (currentState.token ? mrForm : login),
-    [LOGIN]: currentState => (currentState.mergeRequestId ? comment(currentState) : mrForm),
-    [MR_ID]: currentState => (currentState.token ? comment(currentState) : login),
-    none: currentState => {
-      if (!currentState.token) {
-        return login;
-      }
-
-      if (currentState.token && !currentState.mergeRequestId) {
-        return mrForm;
-      }
-
-      return comment(currentState);
-    },
-  };
-
-  return formsList[form](appState);
-};
-
-const initializeState = (wind, doc) => {
-  const {
-    innerWidth,
-    innerHeight,
-    navigator: { platform, userAgent },
-  } = wind;
-
-  const browser = getBrowserId(userAgent);
-
-  const scriptEl = doc.getElementById('review-app-toolbar-script');
-  const { projectId, mergeRequestId, mrUrl, projectPath } = scriptEl.dataset;
-
-  // This mutates our default state object above. It's weird but it makes the linter happy.
-  Object.assign(state, {
-    browser,
-    innerWidth,
-    innerHeight,
-    mergeRequestId,
-    mrUrl,
-    platform,
-    projectId,
-    projectPath,
-    userAgent,
-  });
-
-  return state;
-};
-
-const getInitialView = () => {
-  const token = localStorage.getItem(STORAGE_TOKEN);
-  const mrId = localStorage.getItem(STORAGE_MR_ID);
-
-  if (token) {
-    state.token = token;
-  }
-
-  if (mrId) {
-    state.mergeRequestId = mrId;
-  }
-
-  return nextView(state);
-};
-
-const setUsingGracefulStorageFlag = flag => {
-  state.usingGracefulStorage = !flag;
-};
-
-export { initializeState, getInitialView, nextView, setUsingGracefulStorageFlag, state };
diff --git a/app/assets/javascripts/visual_review_toolbar/store/utils.js b/app/assets/javascripts/visual_review_toolbar/store/utils.js
deleted file mode 100644
index 5cf145351b3..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/store/utils.js
+++ /dev/null
@@ -1,15 +0,0 @@
-const debounce = (fn, time) => {
-  let current;
-
-  const debounced = () => {
-    if (current) {
-      clearTimeout(current);
-    }
-
-    current = setTimeout(fn, time);
-  };
-
-  return debounced;
-};
-
-export default debounce;
diff --git a/app/assets/javascripts/visual_review_toolbar/styles/toolbar.css b/app/assets/javascripts/visual_review_toolbar/styles/toolbar.css
deleted file mode 100644
index d1a8d66ef40..00000000000
--- a/app/assets/javascripts/visual_review_toolbar/styles/toolbar.css
+++ /dev/null
@@ -1,188 +0,0 @@
-/*
-  As a standalone script, the toolbar has its own css
- */
-
-#gitlab-collapse > * {
-  pointer-events: none;
-}
-
-#gitlab-comment {
-  background-color: #fafafa;
-}
-
-#gitlab-form {
-  display: flex;
-  flex-direction: column;
-  width: 100%;
-  margin-bottom: 0;
-}
-
-#gitlab-note-wrapper {
-  display: flex;
-  flex-direction: column;
-  background-color: #fafafa;
-  border-radius: 4px;
-  margin-bottom: .5rem;
-  padding: 1rem;
-}
-
-#gitlab-form-wrapper {
-  overflow: auto;
-  display: flex;
-  flex-direction: row-reverse;
-  border-radius: 4px;
-}
-
-#gitlab-review-container {
-  max-width: 22rem;
-  max-height: 22rem;
-  overflow: auto;
-  display: flex;
-  flex-direction: column;
-  position: fixed;
-  bottom: 1rem;
-  right: 1rem;
-  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Noto Sans', Ubuntu, Cantarell,
-  'Helvetica Neue', sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol',
-  'Noto Color Emoji';
-  font-size: .8rem;
-  font-weight: 400;
-  color: #2e2e2e;
-  z-index: 9999; /* toolbar should always be on top */
-}
-
-.gitlab-wrapper-open {
-  max-width: 22rem;
-  max-height: 22rem;
-}
-
-.gitlab-wrapper-closed {
-  max-width: 3.4rem;
-  max-height: 3.4rem;
-}
-
-.gitlab-button {
-  cursor: pointer;
-  transition: background-color 100ms linear, border-color 100ms linear, color 100ms linear, box-shadow 100ms linear;
-}
-
-.gitlab-button-secondary {
-  background: none #fafafa;
-  margin: 0 .5rem;
-  border: 1px solid #e3e3e3;
-}
-
-.gitlab-button-secondary:hover {
-  background-color: #f0f0f0;
-  border-color: #e3e3e3;
-  color: #2e2e2e;
-}
-
-.gitlab-button-secondary:active {
-  color: #2e2e2e;
-  background-color: #e1e1e1;
-  border-color: #dadada;
-}
-
-.gitlab-button-success:hover {
-  color: #fff;
-  background-color: #137e3f;
-  border-color: #127339;
-}
-
-.gitlab-button-success:active {
-  background-color: #168f48;
-  border-color: #12753a;
-  color: #fff;
-}
-
-.gitlab-button-success {
-  background-color: #1aaa55;
-  border: 1px solid #168f48;
-  color: #fff;
-}
-
-.gitlab-button-wide {
-  width: 100%;
-}
-
-.gitlab-button-wrapper {
-  margin-top: 0.5rem;
-  display: flex;
-  align-items: baseline;
-  /*
-    this makes sure the hit enter to submit picks the correct button
-    on the comment view
-   */
-  flex-direction: row-reverse;
-}
-
-.gitlab-collapse {
-  width: 2.4rem;
-  height: 2.2rem;
-  margin-left: 1rem;
-  padding: .5rem;
-}
-
-.gitlab-collapse-closed {
-  align-self: center;
-}
-
-.gitlab-checkbox-label {
-  padding: 0 .2rem;
-}
-
-.gitlab-checkbox-wrapper {
-  display: flex;
-  align-items: baseline;
-}
-
-.gitlab-form-open {
-  padding: 1rem;
-  background-color: #fafafa;
-}
-
-.gitlab-label {
-  font-weight: 600;
-  display: inline-block;
-  width: 100%;
-}
-
-.gitlab-link {
-  color: #1b69b6;
-  text-decoration: none;
-  background-color: transparent;
-  background-image: none;
-}
-
-.gitlab-link:hover {
-  text-decoration: underline;
-}
-
-.gitlab-link-button {
-  border: none;
-  cursor: pointer;
-  padding: 0 .15rem;
-}
-
-.gitlab-message {
-  padding: .25rem 0;
-  margin: 0;
-  line-height: 1.2rem;
-}
-
-.gitlab-metadata-note {
-  font-size: .7rem;
-  line-height: 1rem;
-  color: #666;
-  margin-bottom: .5rem;
-}
-
-.gitlab-input {
-  width: 100%;
-  border: 1px solid #dfdfdf;
-  border-radius: 4px;
-  padding: .1rem .2rem;
-  min-height: 2rem;
-  max-width: 17rem;
-}
diff --git a/changelogs/unreleased/66402-use-visual-review-tools-npm-package.yml b/changelogs/unreleased/66402-use-visual-review-tools-npm-package.yml
new file mode 100644
index 00000000000..46773e12002
--- /dev/null
+++ b/changelogs/unreleased/66402-use-visual-review-tools-npm-package.yml
@@ -0,0 +1,5 @@
+---
+title: Move visual review toolbar code to NPM
+merge_request: 32159
+author:
+type: fixed
diff --git a/config/webpack.config.js b/config/webpack.config.js
index 442b4b4c21e..969a84e85dd 100644
--- a/config/webpack.config.js
+++ b/config/webpack.config.js
@@ -298,6 +298,13 @@ module.exports = {
         from: path.join(ROOT_PATH, 'node_modules/pdfjs-dist/cmaps/'),
         to: path.join(ROOT_PATH, 'public/assets/webpack/cmaps/'),
       },
+      {
+        from: path.join(
+          ROOT_PATH,
+          'node_modules/@gitlab/visual-review-tools/dist/visual_review_toolbar.js',
+        ),
+        to: path.join(ROOT_PATH, 'public/assets/webpack'),
+      },
     ]),
 
     // compression can require a lot of compute time and is disabled in CI
diff --git a/config/webpack.config.review_toolbar.js b/config/webpack.config.review_toolbar.js
deleted file mode 100644
index baaba7ed387..00000000000
--- a/config/webpack.config.review_toolbar.js
+++ /dev/null
@@ -1,58 +0,0 @@
-const path = require('path');
-const CompressionPlugin = require('compression-webpack-plugin');
-
-const ROOT_PATH = path.resolve(__dirname, '..');
-const CACHE_PATH = process.env.WEBPACK_CACHE_PATH || path.join(ROOT_PATH, 'tmp/cache');
-const NO_SOURCEMAPS = process.env.NO_SOURCEMAPS;
-const IS_PRODUCTION = process.env.NODE_ENV === 'production';
-
-const devtool = IS_PRODUCTION ? 'source-map' : 'cheap-module-eval-source-map';
-
-const alias = {
-  vendor: path.join(ROOT_PATH, 'vendor/assets/javascripts'),
-  spec: path.join(ROOT_PATH, 'spec/javascripts'),
-};
-
-module.exports = {
-  mode: IS_PRODUCTION ? 'production' : 'development',
-
-  context: path.join(ROOT_PATH, 'app/assets/javascripts'),
-
-  name: 'visual_review_toolbar',
-
-  entry: './visual_review_toolbar',
-
-  output: {
-    path: path.join(ROOT_PATH, 'public/assets/webpack'),
-    filename: 'visual_review_toolbar.js',
-    library: 'VisualReviewToolbar',
-    libraryTarget: 'var',
-  },
-
-  resolve: {
-    alias,
-  },
-
-  module: {
-    rules: [
-      {
-        test: /\.js$/,
-        loader: 'babel-loader',
-        options: {
-          cacheDirectory: path.join(CACHE_PATH, 'babel-loader'),
-        },
-      },
-      {
-        test: /\.css$/,
-        use: ['style-loader', 'css-loader'],
-      },
-    ],
-  },
-
-  plugins: [
-    // compression can require a lot of compute time and is disabled in CI
-    new CompressionPlugin(),
-  ].filter(Boolean),
-
-  devtool: NO_SOURCEMAPS ? false : devtool,
-};
diff --git a/lib/tasks/gitlab/assets.rake b/lib/tasks/gitlab/assets.rake
index a07ae3a418a..7a42e4e92a0 100644
--- a/lib/tasks/gitlab/assets.rake
+++ b/lib/tasks/gitlab/assets.rake
@@ -10,15 +10,9 @@ namespace :gitlab do
         rake:assets:precompile
         webpack:compile
         gitlab:assets:fix_urls
-        gitlab:assets:compile_vrt
       ].each(&Gitlab::TaskHelpers.method(:invoke_and_time_task))
     end
 
-    desc 'GitLab | Assets | Compile visual review toolbar'
-    task :compile_vrt do
-      system 'yarn', 'webpack-vrt'
-    end
-
     desc 'GitLab | Assets | Clean up old compiled frontend assets'
     task clean: ['rake:assets:clean']
 
diff --git a/package.json b/package.json
index df5f758fa20..384584a944a 100644
--- a/package.json
+++ b/package.json
@@ -26,8 +26,7 @@
     "stylelint-create-utility-map": "node scripts/frontend/stylelint/stylelint-utility-map.js",
     "test": "node scripts/frontend/test",
     "webpack": "NODE_OPTIONS=\"--max-old-space-size=3584\" webpack --config config/webpack.config.js",
-    "webpack-prod": "NODE_OPTIONS=\"--max-old-space-size=3584\" NODE_ENV=production webpack --config config/webpack.config.js",
-    "webpack-vrt": "NODE_OPTIONS=\"--max-old-space-size=3584\" NODE_ENV=production webpack --config config/webpack.config.review_toolbar.js"
+    "webpack-prod": "NODE_OPTIONS=\"--max-old-space-size=3584\" NODE_ENV=production webpack --config config/webpack.config.js"
   },
   "dependencies": {
     "@babel/core": "^7.5.5",
@@ -40,6 +39,7 @@
     "@gitlab/csslab": "^1.9.0",
     "@gitlab/svgs": "^1.68.0",
     "@gitlab/ui": "5.18.0",
+    "@gitlab/visual-review-tools": "^1.0.0",
     "apollo-cache-inmemory": "^1.5.1",
     "apollo-client": "^2.5.1",
     "apollo-link": "^1.2.11",
diff --git a/yarn.lock b/yarn.lock
index 4489b10815a..dd85729333a 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1021,6 +1021,11 @@
     vue "^2.6.10"
     vue-loader "^15.4.2"
 
+"@gitlab/visual-review-tools@^1.0.0":
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/visual-review-tools/-/visual-review-tools-1.0.0.tgz#6012e0a19797c1f5dad34ccf4dacdaf38e400a73"
+  integrity sha512-xMvz9IwrXisQ1MH+Tj6lfbQcQSiQy88nTPuQV6OTLBGuV+vIQeVwXeIkQeTKuSpd0GqZvigPdRqxyQCa3blpIg==
+
 "@gitlab/vue-toasted@^1.2.1":
   version "1.2.1"
   resolved "https://registry.yarnpkg.com/@gitlab/vue-toasted/-/vue-toasted-1.2.1.tgz#f407b5aa710863e5b7f021f4a1f66160331ab263"
-- 
cgit v1.2.1


From 60e33885269bdae71e9710b17f199708b9b7c9e0 Mon Sep 17 00:00:00 2001
From: Adam Hegyi <ahegyi@gitlab.com>
Date: Fri, 23 Aug 2019 20:28:11 +0000
Subject: Implement validation logic to ProjectStage

- Introducting StageEvents to define the available events
- Define the event pairing rules, since some events are not compatible
- Express default Cycle Analytics stages with the event structure
---
 .../analytics/cycle_analytics/project_stage.rb     |  5 ++
 .../concerns/analytics/cycle_analytics/stage.rb    | 68 +++++++++++++++
 .../analytics/cycle_analytics/default_stages.rb    | 98 ++++++++++++++++++++++
 .../analytics/cycle_analytics/stage_events.rb      | 71 ++++++++++++++++
 .../stage_events/code_stage_start.rb               | 23 +++++
 .../cycle_analytics/stage_events/issue_created.rb  | 23 +++++
 .../issue_first_mentioned_in_commit.rb             | 23 +++++
 .../stage_events/issue_stage_end.rb                | 23 +++++
 .../stage_events/merge_request_created.rb          | 23 +++++
 .../merge_request_first_deployed_to_production.rb  | 23 +++++
 .../merge_request_last_build_finished.rb           | 23 +++++
 .../merge_request_last_build_started.rb            | 23 +++++
 .../stage_events/merge_request_merged.rb           | 23 +++++
 .../stage_events/plan_stage_start.rb               | 23 +++++
 .../stage_events/simple_stage_event.rb             | 13 +++
 .../cycle_analytics/stage_events/stage_event.rb    | 28 +++++++
 locale/gitlab.pot                                  | 24 ++++++
 .../stage_events/stage_event_spec.rb               | 10 +++
 .../cycle_analytics/project_stage_spec.rb          | 14 ++++
 .../cycle_analytics_stage_examples.rb              | 74 ++++++++++++++++
 20 files changed, 635 insertions(+)
 create mode 100644 app/models/concerns/analytics/cycle_analytics/stage.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/default_stages.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/code_stage_start.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/issue_created.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/issue_first_mentioned_in_commit.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/issue_stage_end.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_created.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_first_deployed_to_production.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_last_build_finished.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_last_build_started.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_merged.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/plan_stage_start.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/simple_stage_event.rb
 create mode 100644 lib/gitlab/analytics/cycle_analytics/stage_events/stage_event.rb
 create mode 100644 spec/lib/gitlab/analytics/cycle_analytics/stage_events/stage_event_spec.rb
 create mode 100644 spec/support/shared_examples/cycle_analytics_stage_examples.rb

diff --git a/app/models/analytics/cycle_analytics/project_stage.rb b/app/models/analytics/cycle_analytics/project_stage.rb
index 88c8cb40ccb..a312bd24e78 100644
--- a/app/models/analytics/cycle_analytics/project_stage.rb
+++ b/app/models/analytics/cycle_analytics/project_stage.rb
@@ -3,7 +3,12 @@
 module Analytics
   module CycleAnalytics
     class ProjectStage < ApplicationRecord
+      include Analytics::CycleAnalytics::Stage
+
+      validates :project, presence: true
       belongs_to :project
+
+      alias_attribute :parent, :project
     end
   end
 end
diff --git a/app/models/concerns/analytics/cycle_analytics/stage.rb b/app/models/concerns/analytics/cycle_analytics/stage.rb
new file mode 100644
index 00000000000..0c603c2d5e6
--- /dev/null
+++ b/app/models/concerns/analytics/cycle_analytics/stage.rb
@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module Analytics
+  module CycleAnalytics
+    module Stage
+      extend ActiveSupport::Concern
+
+      included do
+        validates :name, presence: true
+        validates :start_event_identifier, presence: true
+        validates :end_event_identifier, presence: true
+        validate :validate_stage_event_pairs
+
+        enum start_event_identifier: Gitlab::Analytics::CycleAnalytics::StageEvents.to_enum, _prefix: :start_event_identifier
+        enum end_event_identifier: Gitlab::Analytics::CycleAnalytics::StageEvents.to_enum, _prefix: :end_event_identifier
+
+        alias_attribute :custom_stage?, :custom
+      end
+
+      def parent=(_)
+        raise NotImplementedError
+      end
+
+      def parent
+        raise NotImplementedError
+      end
+
+      def start_event
+        Gitlab::Analytics::CycleAnalytics::StageEvents[start_event_identifier].new(params_for_start_event)
+      end
+
+      def end_event
+        Gitlab::Analytics::CycleAnalytics::StageEvents[end_event_identifier].new(params_for_end_event)
+      end
+
+      def params_for_start_event
+        {}
+      end
+
+      def params_for_end_event
+        {}
+      end
+
+      def default_stage?
+        !custom
+      end
+
+      # The model that is going to be queried, Issue or MergeRequest
+      def subject_model
+        start_event.object_type
+      end
+
+      private
+
+      def validate_stage_event_pairs
+        return if start_event_identifier.nil? || end_event_identifier.nil?
+
+        unless pairing_rules.fetch(start_event.class, []).include?(end_event.class)
+          errors.add(:end_event, :not_allowed_for_the_given_start_event)
+        end
+      end
+
+      def pairing_rules
+        Gitlab::Analytics::CycleAnalytics::StageEvents.pairing_rules
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/default_stages.rb b/lib/gitlab/analytics/cycle_analytics/default_stages.rb
new file mode 100644
index 00000000000..286c393005f
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/default_stages.rb
@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+# This module represents the default Cycle Analytics stages that are currently provided by CE
+# Each method returns a hash that can be used to build a new stage object.
+#
+# Example:
+#
+# params = Gitlab::Analytics::CycleAnalytics::DefaultStages.params_for_issue_stage
+# Analytics::CycleAnalytics::ProjectStage.new(params)
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module DefaultStages
+        def self.all
+          [
+            params_for_issue_stage,
+            params_for_plan_stage,
+            params_for_code_stage,
+            params_for_test_stage,
+            params_for_review_stage,
+            params_for_staging_stage,
+            params_for_production_stage
+          ]
+        end
+
+        def self.params_for_issue_stage
+          {
+            name: 'issue',
+            custom: false, # this stage won't be customizable, we provide it as it is
+            relative_position: 1, # when opening the CycleAnalytics page in CE, this stage will be the first item
+            start_event_identifier: :issue_created, # IssueCreated class is used as start event
+            end_event_identifier: :issue_stage_end # IssueStageEnd class is used as end event
+          }
+        end
+
+        def self.params_for_plan_stage
+          {
+            name: 'plan',
+            custom: false,
+            relative_position: 2,
+            start_event_identifier: :plan_stage_start,
+            end_event_identifier: :issue_first_mentioned_in_commit
+          }
+        end
+
+        def self.params_for_code_stage
+          {
+            name: 'code',
+            custom: false,
+            relative_position: 3,
+            start_event_identifier: :code_stage_start,
+            end_event_identifier: :merge_request_created
+          }
+        end
+
+        def self.params_for_test_stage
+          {
+            name: 'test',
+            custom: false,
+            relative_position: 4,
+            start_event_identifier: :merge_request_last_build_started,
+            end_event_identifier: :merge_request_last_build_finished
+          }
+        end
+
+        def self.params_for_review_stage
+          {
+            name: 'review',
+            custom: false,
+            relative_position: 5,
+            start_event_identifier: :merge_request_created,
+            end_event_identifier: :merge_request_merged
+          }
+        end
+
+        def self.params_for_staging_stage
+          {
+            name: 'staging',
+            custom: false,
+            relative_position: 6,
+            start_event_identifier: :merge_request_merged,
+            end_event_identifier: :merge_request_first_deployed_to_production
+          }
+        end
+
+        def self.params_for_production_stage
+          {
+            name: 'production',
+            custom: false,
+            relative_position: 7,
+            start_event_identifier: :merge_request_merged,
+            end_event_identifier: :merge_request_first_deployed_to_production
+          }
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events.rb b/lib/gitlab/analytics/cycle_analytics/stage_events.rb
new file mode 100644
index 00000000000..d21f344f483
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events.rb
@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        # Convention:
+        # Issue: < 100
+        # MergeRequest: >= 100 && < 1000
+        # Custom events for default stages: >= 1000 (legacy)
+        ENUM_MAPPING = {
+          StageEvents::IssueCreated => 1,
+          StageEvents::IssueFirstMentionedInCommit => 2,
+          StageEvents::MergeRequestCreated => 100,
+          StageEvents::MergeRequestFirstDeployedToProduction => 101,
+          StageEvents::MergeRequestLastBuildFinished => 102,
+          StageEvents::MergeRequestLastBuildStarted => 103,
+          StageEvents::MergeRequestMerged => 104,
+          StageEvents::CodeStageStart => 1_000,
+          StageEvents::IssueStageEnd => 1_001,
+          StageEvents::PlanStageStart => 1_002
+        }.freeze
+
+        EVENTS = ENUM_MAPPING.keys.freeze
+
+        # Defines which start_event and end_event pairs are allowed
+        PAIRING_RULES = {
+          StageEvents::PlanStageStart => [
+            StageEvents::IssueFirstMentionedInCommit
+          ],
+          StageEvents::CodeStageStart => [
+            StageEvents::MergeRequestCreated
+          ],
+          StageEvents::IssueCreated => [
+            StageEvents::IssueStageEnd
+          ],
+          StageEvents::MergeRequestCreated => [
+            StageEvents::MergeRequestMerged
+          ],
+          StageEvents::MergeRequestLastBuildStarted => [
+            StageEvents::MergeRequestLastBuildFinished
+          ],
+          StageEvents::MergeRequestMerged => [
+            StageEvents::MergeRequestFirstDeployedToProduction
+          ]
+        }.freeze
+
+        def [](identifier)
+          events.find { |e| e.identifier.to_s.eql?(identifier.to_s) } || raise(KeyError)
+        end
+
+        # hash for defining ActiveRecord enum: identifier => number
+        def to_enum
+          ENUM_MAPPING.each_with_object({}) { |(k, v), hash| hash[k.identifier] = v }
+        end
+
+        # will be overridden in EE with custom events
+        def pairing_rules
+          PAIRING_RULES
+        end
+
+        # will be overridden in EE with custom events
+        def events
+          EVENTS
+        end
+
+        module_function :[], :to_enum, :pairing_rules, :events
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/code_stage_start.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/code_stage_start.rb
new file mode 100644
index 00000000000..ff9c8a79225
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/code_stage_start.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        class CodeStageStart < SimpleStageEvent
+          def self.name
+            s_("CycleAnalyticsEvent|Issue first mentioned in a commit")
+          end
+
+          def self.identifier
+            :code_stage_start
+          end
+
+          def object_type
+            MergeRequest
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/issue_created.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/issue_created.rb
new file mode 100644
index 00000000000..a601c9797f8
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/issue_created.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        class IssueCreated < SimpleStageEvent
+          def self.name
+            s_("CycleAnalyticsEvent|Issue created")
+          end
+
+          def self.identifier
+            :issue_created
+          end
+
+          def object_type
+            Issue
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/issue_first_mentioned_in_commit.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/issue_first_mentioned_in_commit.rb
new file mode 100644
index 00000000000..7424043ef7b
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/issue_first_mentioned_in_commit.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        class IssueFirstMentionedInCommit < SimpleStageEvent
+          def self.name
+            s_("CycleAnalyticsEvent|Issue first mentioned in a commit")
+          end
+
+          def self.identifier
+            :issue_first_mentioned_in_commit
+          end
+
+          def object_type
+            Issue
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/issue_stage_end.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/issue_stage_end.rb
new file mode 100644
index 00000000000..ceb229c552f
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/issue_stage_end.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        class IssueStageEnd < SimpleStageEvent
+          def self.name
+            PlanStageStart.name
+          end
+
+          def self.identifier
+            :issue_stage_end
+          end
+
+          def object_type
+            Issue
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_created.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_created.rb
new file mode 100644
index 00000000000..8be00831b4f
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_created.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        class MergeRequestCreated < SimpleStageEvent
+          def self.name
+            s_("CycleAnalyticsEvent|Merge request created")
+          end
+
+          def self.identifier
+            :merge_request_created
+          end
+
+          def object_type
+            MergeRequest
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_first_deployed_to_production.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_first_deployed_to_production.rb
new file mode 100644
index 00000000000..6d7a2c023ff
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_first_deployed_to_production.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        class MergeRequestFirstDeployedToProduction < SimpleStageEvent
+          def self.name
+            s_("CycleAnalyticsEvent|Merge request first deployed to production")
+          end
+
+          def self.identifier
+            :merge_request_first_deployed_to_production
+          end
+
+          def object_type
+            MergeRequest
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_last_build_finished.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_last_build_finished.rb
new file mode 100644
index 00000000000..12d82fe2c62
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_last_build_finished.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        class MergeRequestLastBuildFinished < SimpleStageEvent
+          def self.name
+            s_("CycleAnalyticsEvent|Merge request last build finish time")
+          end
+
+          def self.identifier
+            :merge_request_last_build_finished
+          end
+
+          def object_type
+            MergeRequest
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_last_build_started.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_last_build_started.rb
new file mode 100644
index 00000000000..9e749b0fdfa
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_last_build_started.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        class MergeRequestLastBuildStarted < SimpleStageEvent
+          def self.name
+            s_("CycleAnalyticsEvent|Merge request last build start time")
+          end
+
+          def self.identifier
+            :merge_request_last_build_started
+          end
+
+          def object_type
+            MergeRequest
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_merged.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_merged.rb
new file mode 100644
index 00000000000..bbfb5d12992
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/merge_request_merged.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        class MergeRequestMerged < SimpleStageEvent
+          def self.name
+            s_("CycleAnalyticsEvent|Merge request merged")
+          end
+
+          def self.identifier
+            :merge_request_merged
+          end
+
+          def object_type
+            MergeRequest
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/plan_stage_start.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/plan_stage_start.rb
new file mode 100644
index 00000000000..803317d8b55
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/plan_stage_start.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        class PlanStageStart < SimpleStageEvent
+          def self.name
+            s_("CycleAnalyticsEvent|Issue first associated with a milestone or issue first added to a board")
+          end
+
+          def self.identifier
+            :plan_stage_start
+          end
+
+          def object_type
+            Issue
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/simple_stage_event.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/simple_stage_event.rb
new file mode 100644
index 00000000000..253c489d822
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/simple_stage_event.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        # Represents a simple event that usually refers to one database column and does not require additional user input
+        class SimpleStageEvent < StageEvent
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/analytics/cycle_analytics/stage_events/stage_event.rb b/lib/gitlab/analytics/cycle_analytics/stage_events/stage_event.rb
new file mode 100644
index 00000000000..a55eee048c2
--- /dev/null
+++ b/lib/gitlab/analytics/cycle_analytics/stage_events/stage_event.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Analytics
+    module CycleAnalytics
+      module StageEvents
+        # Base class for expressing an event that can be used for a stage.
+        class StageEvent
+          def initialize(params)
+            @params = params
+          end
+
+          def self.name
+            raise NotImplementedError
+          end
+
+          def self.identifier
+            raise NotImplementedError
+          end
+
+          def object_type
+            raise NotImplementedError
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 4f3c8e8046d..d57ab4bf66f 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -3602,6 +3602,30 @@ msgstr ""
 msgid "Cycle Analytics gives an overview of how much time it takes to go from idea to production in your project."
 msgstr ""
 
+msgid "CycleAnalyticsEvent|Issue created"
+msgstr ""
+
+msgid "CycleAnalyticsEvent|Issue first associated with a milestone or issue first added to a board"
+msgstr ""
+
+msgid "CycleAnalyticsEvent|Issue first mentioned in a commit"
+msgstr ""
+
+msgid "CycleAnalyticsEvent|Merge request created"
+msgstr ""
+
+msgid "CycleAnalyticsEvent|Merge request first deployed to production"
+msgstr ""
+
+msgid "CycleAnalyticsEvent|Merge request last build finish time"
+msgstr ""
+
+msgid "CycleAnalyticsEvent|Merge request last build start time"
+msgstr ""
+
+msgid "CycleAnalyticsEvent|Merge request merged"
+msgstr ""
+
 msgid "CycleAnalyticsStage|Code"
 msgstr ""
 
diff --git a/spec/lib/gitlab/analytics/cycle_analytics/stage_events/stage_event_spec.rb b/spec/lib/gitlab/analytics/cycle_analytics/stage_events/stage_event_spec.rb
new file mode 100644
index 00000000000..29f4be76a65
--- /dev/null
+++ b/spec/lib/gitlab/analytics/cycle_analytics/stage_events/stage_event_spec.rb
@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::Analytics::CycleAnalytics::StageEvents::StageEvent do
+  it { expect(described_class).to respond_to(:name) }
+  it { expect(described_class).to respond_to(:identifier) }
+
+  it { expect(described_class.new({})).to respond_to(:object_type) }
+end
diff --git a/spec/models/analytics/cycle_analytics/project_stage_spec.rb b/spec/models/analytics/cycle_analytics/project_stage_spec.rb
index 4e3923e82b1..83d6ff754c5 100644
--- a/spec/models/analytics/cycle_analytics/project_stage_spec.rb
+++ b/spec/models/analytics/cycle_analytics/project_stage_spec.rb
@@ -6,4 +6,18 @@ describe Analytics::CycleAnalytics::ProjectStage do
   describe 'associations' do
     it { is_expected.to belong_to(:project) }
   end
+
+  it 'default stages must be valid' do
+    project = create(:project)
+
+    Gitlab::Analytics::CycleAnalytics::DefaultStages.all.each do |params|
+      stage = described_class.new(params.merge(project: project))
+      expect(stage).to be_valid
+    end
+  end
+
+  it_behaves_like "cycle analytics stage" do
+    let(:parent) { create(:project) }
+    let(:parent_name) { :project }
+  end
 end
diff --git a/spec/support/shared_examples/cycle_analytics_stage_examples.rb b/spec/support/shared_examples/cycle_analytics_stage_examples.rb
new file mode 100644
index 00000000000..151f5325e84
--- /dev/null
+++ b/spec/support/shared_examples/cycle_analytics_stage_examples.rb
@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+shared_examples_for 'cycle analytics stage' do
+  let(:valid_params) do
+    {
+      name: 'My Stage',
+      parent: parent,
+      start_event_identifier: :merge_request_created,
+      end_event_identifier: :merge_request_merged
+    }
+  end
+
+  describe 'validation' do
+    it 'is valid' do
+      expect(described_class.new(valid_params)).to be_valid
+    end
+
+    it 'validates presence of parent' do
+      stage = described_class.new(valid_params.except(:parent))
+
+      expect(stage).not_to be_valid
+      expect(stage.errors.details[parent_name]).to eq([{ error: :blank }])
+    end
+
+    it 'validates presence of start_event_identifier' do
+      stage = described_class.new(valid_params.except(:start_event_identifier))
+
+      expect(stage).not_to be_valid
+      expect(stage.errors.details[:start_event_identifier]).to eq([{ error: :blank }])
+    end
+
+    it 'validates presence of end_event_identifier' do
+      stage = described_class.new(valid_params.except(:end_event_identifier))
+
+      expect(stage).not_to be_valid
+      expect(stage.errors.details[:end_event_identifier]).to eq([{ error: :blank }])
+    end
+
+    it 'is invalid when end_event is not allowed for the given start_event' do
+      invalid_params = valid_params.merge(
+        start_event_identifier: :merge_request_merged,
+        end_event_identifier: :merge_request_created
+      )
+      stage = described_class.new(invalid_params)
+
+      expect(stage).not_to be_valid
+      expect(stage.errors.details[:end_event]).to eq([{ error: :not_allowed_for_the_given_start_event }])
+    end
+  end
+
+  describe '#subject_model' do
+    it 'infers the model from the start event' do
+      stage = described_class.new(valid_params)
+
+      expect(stage.subject_model).to eq(MergeRequest)
+    end
+  end
+
+  describe '#start_event' do
+    it 'builds start_event object based on start_event_identifier' do
+      stage = described_class.new(start_event_identifier: 'merge_request_created')
+
+      expect(stage.start_event).to be_a_kind_of(Gitlab::Analytics::CycleAnalytics::StageEvents::MergeRequestCreated)
+    end
+  end
+
+  describe '#end_event' do
+    it 'builds end_event object based on end_event_identifier' do
+      stage = described_class.new(end_event_identifier: 'merge_request_merged')
+
+      expect(stage.end_event).to be_a_kind_of(Gitlab::Analytics::CycleAnalytics::StageEvents::MergeRequestMerged)
+    end
+  end
+end
-- 
cgit v1.2.1


From 811252536d036f39e370451060790d727601c2f1 Mon Sep 17 00:00:00 2001
From: Marius Bobin <mbobin@gitlab.com>
Date: Fri, 23 Aug 2019 20:54:32 +0000
Subject: Read pipelines from public projects though API

Allow users to read pipelines for public projects
with public builds enabled without providing an access token.
---
 .../64269-pipeline-api-fails-with-401.yml          |   5 +
 lib/api/pipelines.rb                               |   3 +-
 spec/requests/api/pipelines_spec.rb                |  11 +
 .../api/pipelines/visibility_table_examples.rb     | 235 +++++++++++++++++++++
 4 files changed, 253 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/64269-pipeline-api-fails-with-401.yml
 create mode 100644 spec/support/shared_examples/requests/api/pipelines/visibility_table_examples.rb

diff --git a/changelogs/unreleased/64269-pipeline-api-fails-with-401.yml b/changelogs/unreleased/64269-pipeline-api-fails-with-401.yml
new file mode 100644
index 00000000000..582339901ae
--- /dev/null
+++ b/changelogs/unreleased/64269-pipeline-api-fails-with-401.yml
@@ -0,0 +1,5 @@
+---
+title: Read pipelines from public projects through API without an access token
+merge_request: 31816
+author:
+type: fixed
diff --git a/lib/api/pipelines.rb b/lib/api/pipelines.rb
index 667bf1ec801..9e888368e7b 100644
--- a/lib/api/pipelines.rb
+++ b/lib/api/pipelines.rb
@@ -4,7 +4,7 @@ module API
   class Pipelines < Grape::API
     include PaginationParams
 
-    before { authenticate! }
+    before { authenticate_non_get! }
 
     params do
       requires :id, type: String, desc: 'The project ID'
@@ -32,6 +32,7 @@ module API
       end
       get ':id/pipelines' do
         authorize! :read_pipeline, user_project
+        authorize! :read_build, user_project
 
         pipelines = PipelinesFinder.new(user_project, current_user, params).execute
         present paginate(pipelines), with: Entities::PipelineBasic
diff --git a/spec/requests/api/pipelines_spec.rb b/spec/requests/api/pipelines_spec.rb
index 35b3dd219f7..174b3214d13 100644
--- a/spec/requests/api/pipelines_spec.rb
+++ b/spec/requests/api/pipelines_spec.rb
@@ -17,6 +17,8 @@ describe API::Pipelines do
   end
 
   describe 'GET /projects/:id/pipelines ' do
+    it_behaves_like 'pipelines visibility table'
+
     context 'authorized user' do
       it 'returns project pipelines' do
         get api("/projects/#{project.id}/pipelines", user)
@@ -401,6 +403,15 @@ describe API::Pipelines do
   end
 
   describe 'GET /projects/:id/pipelines/:pipeline_id' do
+    it_behaves_like 'pipelines visibility table' do
+      let(:pipelines_api_path) do
+        "/projects/#{project.id}/pipelines/#{pipeline.id}"
+      end
+
+      let(:api_response) { response_status == 200 ? response : json_response }
+      let(:response_200) { match_response_schema('public_api/v4/pipeline/detail') }
+    end
+
     context 'authorized user' do
       it 'exposes known attributes' do
         get api("/projects/#{project.id}/pipelines/#{pipeline.id}", user)
diff --git a/spec/support/shared_examples/requests/api/pipelines/visibility_table_examples.rb b/spec/support/shared_examples/requests/api/pipelines/visibility_table_examples.rb
new file mode 100644
index 00000000000..dfd07176b1c
--- /dev/null
+++ b/spec/support/shared_examples/requests/api/pipelines/visibility_table_examples.rb
@@ -0,0 +1,235 @@
+# frozen_string_literal: true
+
+shared_examples 'pipelines visibility table' do
+  using RSpec::Parameterized::TableSyntax
+
+  let(:ci_user) { create(:user) }
+  let(:api_user) { user_role && ci_user }
+
+  let(:pipelines_api_path) do
+    "/projects/#{project.id}/pipelines"
+  end
+
+  let(:response_200) do
+    a_collection_containing_exactly(
+      a_hash_including('sha', 'ref', 'status', 'web_url', 'id' => pipeline.id)
+    )
+  end
+
+  let(:response_40x) do
+    a_hash_including('message')
+  end
+
+  let(:expected_response) do
+    if response_status == 200
+      response_200
+    else
+      response_40x
+    end
+  end
+
+  let(:api_response) { json_response }
+
+  let(:visibility_levels) do
+    {
+      private: Gitlab::VisibilityLevel::PRIVATE,
+      internal: Gitlab::VisibilityLevel::INTERNAL,
+      public: Gitlab::VisibilityLevel::PUBLIC
+    }
+  end
+
+  let(:builds_access_levels) do
+    {
+      enabled: ProjectFeature::ENABLED,
+      private: ProjectFeature::PRIVATE
+    }
+  end
+
+  let(:project_attributes) do
+    {
+      visibility_level: visibility_levels[visibility_level],
+      public_builds: public_builds
+    }
+  end
+
+  let(:project_feature_attributes) do
+    {
+      builds_access_level: builds_access_levels[builds_access_level]
+    }
+  end
+
+  where(:visibility_level, :builds_access_level, :public_builds, :is_admin, :user_role, :response_status) do
+    :private  | :enabled | true  | true  | :non_member | 200
+    :private  | :enabled | true  | true  | :guest      | 200
+    :private  | :enabled | true  | true  | :reporter   | 200
+    :private  | :enabled | true  | true  | :developer  | 200
+    :private  | :enabled | true  | true  | :maintainer | 200
+
+    :private  | :enabled | true  | false | nil         | 404
+    :private  | :enabled | true  | false | :non_member | 404
+    :private  | :enabled | true  | false | :guest      | 200
+    :private  | :enabled | true  | false | :reporter   | 200
+    :private  | :enabled | true  | false | :developer  | 200
+    :private  | :enabled | true  | false | :maintainer | 200
+
+    :private  | :enabled | false | true  | :non_member | 200
+    :private  | :enabled | false | true  | :guest      | 200
+    :private  | :enabled | false | true  | :reporter   | 200
+    :private  | :enabled | false | true  | :developer  | 200
+    :private  | :enabled | false | true  | :maintainer | 200
+
+    :private  | :enabled | false | false | nil         | 404
+    :private  | :enabled | false | false | :non_member | 404
+    :private  | :enabled | false | false | :guest      | 403
+    :private  | :enabled | false | false | :reporter   | 200
+    :private  | :enabled | false | false | :developer  | 200
+    :private  | :enabled | false | false | :maintainer | 200
+
+    :private  | :private | true  | true  | :non_member | 200
+    :private  | :private | true  | true  | :guest      | 200
+    :private  | :private | true  | true  | :reporter   | 200
+    :private  | :private | true  | true  | :developer  | 200
+    :private  | :private | true  | true  | :maintainer | 200
+
+    :private  | :private | true  | false | nil         | 404
+    :private  | :private | true  | false | :non_member | 404
+    :private  | :private | true  | false | :guest      | 200
+    :private  | :private | true  | false | :reporter   | 200
+    :private  | :private | true  | false | :developer  | 200
+    :private  | :private | true  | false | :maintainer | 200
+
+    :private  | :private | false | true  | :non_member | 200
+    :private  | :private | false | true  | :guest      | 200
+    :private  | :private | false | true  | :reporter   | 200
+    :private  | :private | false | true  | :developer  | 200
+    :private  | :private | false | true  | :maintainer | 200
+
+    :private  | :private | false | false | nil         | 404
+    :private  | :private | false | false | :non_member | 404
+    :private  | :private | false | false | :guest      | 403
+    :private  | :private | false | false | :reporter   | 200
+    :private  | :private | false | false | :developer  | 200
+    :private  | :private | false | false | :maintainer | 200
+
+    :internal | :enabled | true  | true  | :non_member | 200
+    :internal | :enabled | true  | true  | :guest      | 200
+    :internal | :enabled | true  | true  | :reporter   | 200
+    :internal | :enabled | true  | true  | :developer  | 200
+    :internal | :enabled | true  | true  | :maintainer | 200
+
+    :internal | :enabled | true  | false | nil         | 404
+    :internal | :enabled | true  | false | :non_member | 200
+    :internal | :enabled | true  | false | :guest      | 200
+    :internal | :enabled | true  | false | :reporter   | 200
+    :internal | :enabled | true  | false | :developer  | 200
+    :internal | :enabled | true  | false | :maintainer | 200
+
+    :internal | :enabled | false | true  | :non_member | 200
+    :internal | :enabled | false | true  | :guest      | 200
+    :internal | :enabled | false | true  | :reporter   | 200
+    :internal | :enabled | false | true  | :developer  | 200
+    :internal | :enabled | false | true  | :maintainer | 200
+
+    :internal | :enabled | false | false | nil         | 404
+    :internal | :enabled | false | false | :non_member | 403
+    :internal | :enabled | false | false | :guest      | 403
+    :internal | :enabled | false | false | :reporter   | 200
+    :internal | :enabled | false | false | :developer  | 200
+    :internal | :enabled | false | false | :maintainer | 200
+
+    :internal | :private | true  | true  | :non_member | 200
+    :internal | :private | true  | true  | :guest      | 200
+    :internal | :private | true  | true  | :reporter   | 200
+    :internal | :private | true  | true  | :developer  | 200
+    :internal | :private | true  | true  | :maintainer | 200
+
+    :internal | :private | true  | false | nil         | 404
+    :internal | :private | true  | false | :non_member | 403
+    :internal | :private | true  | false | :guest      | 200
+    :internal | :private | true  | false | :reporter   | 200
+    :internal | :private | true  | false | :developer  | 200
+    :internal | :private | true  | false | :maintainer | 200
+
+    :internal | :private | false | true  | :non_member | 200
+    :internal | :private | false | true  | :guest      | 200
+    :internal | :private | false | true  | :reporter   | 200
+    :internal | :private | false | true  | :developer  | 200
+    :internal | :private | false | true  | :maintainer | 200
+
+    :internal | :private | false | false | nil         | 404
+    :internal | :private | false | false | :non_member | 403
+    :internal | :private | false | false | :guest      | 403
+    :internal | :private | false | false | :reporter   | 200
+    :internal | :private | false | false | :developer  | 200
+    :internal | :private | false | false | :maintainer | 200
+
+    :public   | :enabled | true  | true  | :non_member | 200
+    :public   | :enabled | true  | true  | :guest      | 200
+    :public   | :enabled | true  | true  | :reporter   | 200
+    :public   | :enabled | true  | true  | :developer  | 200
+    :public   | :enabled | true  | true  | :maintainer | 200
+
+    :public   | :enabled | true  | false | nil         | 200
+    :public   | :enabled | true  | false | :non_member | 200
+    :public   | :enabled | true  | false | :guest      | 200
+    :public   | :enabled | true  | false | :reporter   | 200
+    :public   | :enabled | true  | false | :developer  | 200
+    :public   | :enabled | true  | false | :maintainer | 200
+
+    :public   | :enabled | false | true  | :non_member | 200
+    :public   | :enabled | false | true  | :guest      | 200
+    :public   | :enabled | false | true  | :reporter   | 200
+    :public   | :enabled | false | true  | :developer  | 200
+    :public   | :enabled | false | true  | :maintainer | 200
+
+    :public   | :enabled | false | false | nil         | 403
+    :public   | :enabled | false | false | :non_member | 403
+    :public   | :enabled | false | false | :guest      | 403
+    :public   | :enabled | false | false | :reporter   | 200
+    :public   | :enabled | false | false | :developer  | 200
+    :public   | :enabled | false | false | :maintainer | 200
+
+    :public   | :private | true  | true  | :non_member | 200
+    :public   | :private | true  | true  | :guest      | 200
+    :public   | :private | true  | true  | :reporter   | 200
+    :public   | :private | true  | true  | :developer  | 200
+    :public   | :private | true  | true  | :maintainer | 200
+
+    :public   | :private | true  | false | nil         | 403
+    :public   | :private | true  | false | :non_member | 403
+    :public   | :private | true  | false | :guest      | 200
+    :public   | :private | true  | false | :reporter   | 200
+    :public   | :private | true  | false | :developer  | 200
+    :public   | :private | true  | false | :maintainer | 200
+
+    :public   | :private | false | true  | :non_member | 200
+    :public   | :private | false | true  | :guest      | 200
+    :public   | :private | false | true  | :reporter   | 200
+    :public   | :private | false | true  | :developer  | 200
+    :public   | :private | false | true  | :maintainer | 200
+
+    :public   | :private | false | false | nil         | 403
+    :public   | :private | false | false | :non_member | 403
+    :public   | :private | false | false | :guest      | 403
+    :public   | :private | false | false | :reporter   | 200
+    :public   | :private | false | false | :developer  | 200
+    :public   | :private | false | false | :maintainer | 200
+  end
+
+  with_them do
+    before do
+      ci_user.update!(admin: is_admin) if user_role
+
+      project.update!(project_attributes)
+      project.project_feature.update!(project_feature_attributes)
+      project.add_role(ci_user, user_role) if user_role && user_role != :non_member
+
+      get api(pipelines_api_path, api_user)
+    end
+
+    it do
+      expect(response).to have_gitlab_http_status(response_status)
+      expect(api_response).to match(expected_response)
+    end
+  end
+end
-- 
cgit v1.2.1


From 29e60b0643ca5451919df233a9aeb4825779e846 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Fri, 23 Aug 2019 13:53:02 -0700
Subject: Remove N+1 SQL query loading project feature in dashboard

Projects that have a pipeline may need to check whether the user has
permission to read the build (`can?(current_user, :read_build,
project)`), which requires checking the `project_features` table.
This would cause an N+1 SQL query for each project.

This change also has a beneficial side effect that may avoid a race
condition. When a user deletes a project, the project is queued for
deletion and the user is redirected back to the dashboard page. However,
the following may happen:

1. The dashboard page may load this deleted project in the list of
20 projects.
2. The view will load the project pipeline status from the cache and
attempt to show each project.
3. When the view encounters the deleted project, it calls
`can?(current_user, :read_build, project)` to determine whether to
display the pipeline status.
4. Sidekiq deletes the project from the database.
5. However, since the deleted project is still loaded in memory, it will
attempt to call `project.project_feature.access_level`.
6. Since `project_feature` was not eager loaded, a lazy `SELECT` call is
made to the database.
7. This `SELECT` call returns nothing, and the user sees a 500 error.

By eager loading `project_feature`, we can ensure that we have a
consistent view and avoid records from being deleted later.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66482
---
 app/controllers/dashboard/projects_controller.rb   |  1 +
 .../unreleased/sh-project-feature-nplus-one.yml    |  5 +++++
 spec/features/dashboard/projects_spec.rb           | 22 ++++++++++++++++++++++
 3 files changed, 28 insertions(+)
 create mode 100644 changelogs/unreleased/sh-project-feature-nplus-one.yml

diff --git a/app/controllers/dashboard/projects_controller.rb b/app/controllers/dashboard/projects_controller.rb
index 71f18694613..1dc89943f7f 100644
--- a/app/controllers/dashboard/projects_controller.rb
+++ b/app/controllers/dashboard/projects_controller.rb
@@ -70,6 +70,7 @@ class Dashboard::ProjectsController < Dashboard::ApplicationController
                 .new(params: finder_params, current_user: current_user)
                 .execute
                 .includes(:route, :creator, :group, namespace: [:route, :owner])
+                .preload(:project_feature)
                 .page(finder_params[:page])
 
     prepare_projects_for_rendering(projects)
diff --git a/changelogs/unreleased/sh-project-feature-nplus-one.yml b/changelogs/unreleased/sh-project-feature-nplus-one.yml
new file mode 100644
index 00000000000..425ae7815c1
--- /dev/null
+++ b/changelogs/unreleased/sh-project-feature-nplus-one.yml
@@ -0,0 +1,5 @@
+---
+title: Remove N+1 SQL query loading project feature in dashboard
+merge_request: 32169
+author:
+type: performance
diff --git a/spec/features/dashboard/projects_spec.rb b/spec/features/dashboard/projects_spec.rb
index e2100c8562b..f362172e712 100644
--- a/spec/features/dashboard/projects_spec.rb
+++ b/spec/features/dashboard/projects_spec.rb
@@ -220,4 +220,26 @@ describe 'Dashboard Projects' do
       expect(find('input#merge_request_target_branch', visible: false).value).to eq 'master'
     end
   end
+
+  it 'avoids an N+1 query in dashboard index' do
+    create(:ci_pipeline, :with_job, status: :success, project: project, ref: project.default_branch, sha: project.commit.sha)
+    visit dashboard_projects_path
+
+    control_count = ActiveRecord::QueryRecorder.new { visit dashboard_projects_path }.count
+
+    new_project = create(:project, :repository, name: 'new project')
+    create(:ci_pipeline, :with_job, status: :success, project: new_project, ref: new_project.commit.sha)
+    new_project.add_developer(user)
+
+    ActiveRecord::QueryRecorder.new { visit dashboard_projects_path }.count
+
+    # There are three known N+1 queries:
+    # 1. Project#open_issues_count
+    # 2. Project#open_merge_requests_count
+    # 3. Project#forks_count
+    #
+    # In addition, ProjectsHelper#load_pipeline_status also adds an
+    # additional query.
+    expect { visit dashboard_projects_path }.not_to exceed_query_limit(control_count + 4)
+  end
 end
-- 
cgit v1.2.1


From f093ceb4a0b15420cfe64fa9d97e73531b5fb35c Mon Sep 17 00:00:00 2001
From: Scott Hampton <shampton@gitlab.com>
Date: Fri, 23 Aug 2019 21:28:46 +0000
Subject: Change misleading pipeline status tooltip

Some pipeline status icon tooltips were showing
"Commit: ..." which customers found to be
misleading since it was not the commit that was
failing but the pipeline.

We are changing all status icon tooltips to say
"Pipeline: ..." instead of "Commit: ..." now.
---
 .../commit_pipeline_status_component.vue           |  4 +-
 app/helpers/ci_status_helper.rb                    |  3 +-
 app/views/ci/status/_icon.html.haml                |  3 -
 app/views/shared/projects/_project.html.haml       |  2 +-
 ...tip-messages-and-misleading-ci-status-icons.yml |  5 ++
 locale/gitlab.pot                                  |  5 +-
 spec/features/dashboard/projects_spec.rb           |  4 +-
 .../show/user_sees_last_commit_ci_status_spec.rb   |  2 +-
 spec/helpers/ci_status_helper_spec.rb              | 76 ++++++++++++++++++++++
 9 files changed, 93 insertions(+), 11 deletions(-)
 create mode 100644 changelogs/unreleased/55999-misleading-pipeline-tooltip-messages-and-misleading-ci-status-icons.yml

diff --git a/app/assets/javascripts/projects/tree/components/commit_pipeline_status_component.vue b/app/assets/javascripts/projects/tree/components/commit_pipeline_status_component.vue
index 03281aa1317..12ee1ce2f0c 100644
--- a/app/assets/javascripts/projects/tree/components/commit_pipeline_status_component.vue
+++ b/app/assets/javascripts/projects/tree/components/commit_pipeline_status_component.vue
@@ -38,7 +38,9 @@ export default {
   },
   computed: {
     statusTitle() {
-      return sprintf(s__('Commits|Commit: %{commitText}'), { commitText: this.ciStatus.text });
+      return sprintf(s__('PipelineStatusTooltip|Pipeline: %{ciStatus}'), {
+        ciStatus: this.ciStatus.text,
+      });
     },
   },
   mounted() {
diff --git a/app/helpers/ci_status_helper.rb b/app/helpers/ci_status_helper.rb
index f2b5b82b013..144df676304 100644
--- a/app/helpers/ci_status_helper.rb
+++ b/app/helpers/ci_status_helper.rb
@@ -105,14 +105,13 @@ module CiStatusHelper
     path = pipelines_project_commit_path(project, commit, ref: ref)
 
     render_status_with_link(
-      'commit',
       commit.status(ref),
       path,
       tooltip_placement: tooltip_placement,
       icon_size: 24)
   end
 
-  def render_status_with_link(type, status, path = nil, tooltip_placement: 'left', cssclass: '', container: 'body', icon_size: 16)
+  def render_status_with_link(status, path = nil, type: _('pipeline'), tooltip_placement: 'left', cssclass: '', container: 'body', icon_size: 16)
     klass = "ci-status-link ci-status-icon-#{status.dasherize} d-inline-flex #{cssclass}"
     title = "#{type.titleize}: #{ci_label_for_status(status)}"
     data = { toggle: 'tooltip', placement: tooltip_placement, container: container }
diff --git a/app/views/ci/status/_icon.html.haml b/app/views/ci/status/_icon.html.haml
index 1249b98221f..fdaacb732c7 100644
--- a/app/views/ci/status/_icon.html.haml
+++ b/app/views/ci/status/_icon.html.haml
@@ -1,13 +1,10 @@
 - status             = local_assigns.fetch(:status)
 - size               = local_assigns.fetch(:size, 16)
-- type               = local_assigns.fetch(:type, 'pipeline')
 - tooltip_placement  = local_assigns.fetch(:tooltip_placement, "left")
 - path               = local_assigns.fetch(:path, status.has_details? ? status.details_path : nil)
 - option_css_classes = local_assigns.fetch(:option_css_classes, '')
 - css_classes       = "ci-status-link ci-status-icon ci-status-icon-#{status.group} has-tooltip #{option_css_classes}"
 - title             = s_("PipelineStatusTooltip|Pipeline: %{ci_status}") % {ci_status: status.label}
-- if type == 'commit'
-  - title = s_("PipelineStatusTooltip|Commit: %{ci_status}") % {ci_status: status.label}
 
 - if path
   = link_to path, class: css_classes, title: title, data: { placement: tooltip_placement } do
diff --git a/app/views/shared/projects/_project.html.haml b/app/views/shared/projects/_project.html.haml
index b7474d891dc..573ed36d7f4 100644
--- a/app/views/shared/projects/_project.html.haml
+++ b/app/views/shared/projects/_project.html.haml
@@ -89,7 +89,7 @@
           - if pipeline_status && can?(current_user, :read_cross_project) && project.pipeline_status.has_status? && can?(current_user, :read_build, project)
             - pipeline_path = pipelines_project_commit_path(project.pipeline_status.project, project.pipeline_status.sha, ref: project.pipeline_status.ref)
             %span.icon-wrapper.pipeline-status
-              = render 'ci/status/icon', status: project.commit.last_pipeline.detailed_status(current_user), type: 'commit', tooltip_placement: 'top', path: pipeline_path
+              = render 'ci/status/icon', status: project.commit.last_pipeline.detailed_status(current_user), tooltip_placement: 'top', path: pipeline_path
         .updated-note
           %span
             = _('Updated')
diff --git a/changelogs/unreleased/55999-misleading-pipeline-tooltip-messages-and-misleading-ci-status-icons.yml b/changelogs/unreleased/55999-misleading-pipeline-tooltip-messages-and-misleading-ci-status-icons.yml
new file mode 100644
index 00000000000..a937614be38
--- /dev/null
+++ b/changelogs/unreleased/55999-misleading-pipeline-tooltip-messages-and-misleading-ci-status-icons.yml
@@ -0,0 +1,5 @@
+---
+title: Remove "Commit" from pipeline status tooltips
+merge_request: 31861
+author:
+type: fixed
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index d57ab4bf66f..f8cebc22d93 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -8026,7 +8026,7 @@ msgstr ""
 msgid "PipelineSheduleIntervalPattern|Custom"
 msgstr ""
 
-msgid "PipelineStatusTooltip|Commit: %{ci_status}"
+msgid "PipelineStatusTooltip|Pipeline: %{ciStatus}"
 msgstr ""
 
 msgid "PipelineStatusTooltip|Pipeline: %{ci_status}"
@@ -13943,6 +13943,9 @@ msgstr ""
 msgid "pending comment"
 msgstr ""
 
+msgid "pipeline"
+msgstr ""
+
 msgid "private"
 msgstr ""
 
diff --git a/spec/features/dashboard/projects_spec.rb b/spec/features/dashboard/projects_spec.rb
index e2100c8562b..e4728f37217 100644
--- a/spec/features/dashboard/projects_spec.rb
+++ b/spec/features/dashboard/projects_spec.rb
@@ -169,7 +169,7 @@ describe 'Dashboard Projects' do
         expect(page).to have_xpath("//a[@href='#{pipelines_project_commit_path(project, project.commit, ref: pipeline.ref)}']")
         expect(page).to have_css('.ci-status-link')
         expect(page).to have_css('.ci-status-icon-success')
-        expect(page).to have_link('Commit: passed')
+        expect(page).to have_link('Pipeline: passed')
       end
     end
 
@@ -189,7 +189,7 @@ describe 'Dashboard Projects' do
           expect(page).not_to have_xpath("//a[@href='#{pipelines_project_commit_path(project, project.commit, ref: pipeline.ref)}']")
           expect(page).not_to have_css('.ci-status-link')
           expect(page).not_to have_css('.ci-status-icon-success')
-          expect(page).not_to have_link('Commit: passed')
+          expect(page).not_to have_link('Pipeline: passed')
         end
       end
     end
diff --git a/spec/features/projects/show/user_sees_last_commit_ci_status_spec.rb b/spec/features/projects/show/user_sees_last_commit_ci_status_spec.rb
index a1cad261875..fdc238d55cf 100644
--- a/spec/features/projects/show/user_sees_last_commit_ci_status_spec.rb
+++ b/spec/features/projects/show/user_sees_last_commit_ci_status_spec.rb
@@ -18,7 +18,7 @@ describe 'Projects > Show > User sees last commit CI status' do
 
     page.within '.blob-commit-info' do
       expect(page).to have_content(project.commit.sha[0..6])
-      expect(page).to have_link('Commit: skipped')
+      expect(page).to have_link('Pipeline: skipped')
     end
   end
 end
diff --git a/spec/helpers/ci_status_helper_spec.rb b/spec/helpers/ci_status_helper_spec.rb
index bc2422aba90..4f665dc0514 100644
--- a/spec/helpers/ci_status_helper_spec.rb
+++ b/spec/helpers/ci_status_helper_spec.rb
@@ -53,4 +53,80 @@ describe CiStatusHelper do
       expect(helper.pipeline_status_cache_key(pipeline_status)).to eq("pipeline-status/123abc-success")
     end
   end
+
+  describe "#render_status_with_link" do
+    subject { helper.render_status_with_link("success") }
+
+    it "renders a passed status icon" do
+      is_expected.to include("<span class=\"ci-status-link ci-status-icon-success d-inline-flex")
+    end
+
+    it "has 'Pipeline' as the status type in the title" do
+      is_expected.to include("title=\"Pipeline: passed\"")
+    end
+
+    it "has the success status icon" do
+      is_expected.to include("ci-status-icon-success")
+    end
+
+    context "when pipeline has commit path" do
+      subject { helper.render_status_with_link("success", "/commit-path") }
+
+      it "links to commit" do
+        is_expected.to include("href=\"/commit-path\"")
+      end
+
+      it "does not contain a span element" do
+        is_expected.not_to include("<span")
+      end
+
+      it "has 'Pipeline' as the status type in the title" do
+        is_expected.to include("title=\"Pipeline: passed\"")
+      end
+
+      it "has the correct status icon" do
+        is_expected.to include("ci-status-icon-success")
+      end
+    end
+
+    context "when different type than pipeline is provided" do
+      subject { helper.render_status_with_link("success", type: "commit") }
+
+      it "has the provided type in the title" do
+        is_expected.to include("title=\"Commit: passed\"")
+      end
+    end
+
+    context "when tooltip_placement is provided" do
+      subject { helper.render_status_with_link("success", tooltip_placement: "right") }
+
+      it "has the provided tooltip placement" do
+        is_expected.to include("data-placement=\"right\"")
+      end
+    end
+
+    context "when additional CSS classes are provided" do
+      subject { helper.render_status_with_link("success", cssclass: "extra-class") }
+
+      it "has appended extra class to icon classes" do
+        is_expected.to include("class=\"ci-status-link ci-status-icon-success d-inline-flex extra-class\"")
+      end
+    end
+
+    context "when container is provided" do
+      subject { helper.render_status_with_link("success", container: "my-container") }
+
+      it "has the provided container in data" do
+        is_expected.to include("data-container=\"my-container\"")
+      end
+    end
+
+    context "when icon_size is provided" do
+      subject { helper.render_status_with_link("success", icon_size: 24) }
+
+      it "has the svg class to change size" do
+        is_expected.to include("<svg class=\"s24\">")
+      end
+    end
+  end
 end
-- 
cgit v1.2.1


From 4706352416005962ccb34bad1c3acc5d7479523c Mon Sep 17 00:00:00 2001
From: Mayra Cabrera <mcabrera@gitlab.com>
Date: Fri, 23 Aug 2019 21:36:12 +0000
Subject: Adds cop to enforce string limits on migrations

This cop will analyze migrations that add columns with string, and
report an offense if the string has no limit enforced

Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/64505
---
 db/migrate/20171230123729_init_schema.rb           |   2 +
 .../20180101160629_create_prometheus_metrics.rb    |   2 +
 ...d_auto_devops_domain_to_application_settings.rb |   2 +-
 .../20180129193323_add_uploads_builder_context.rb  |   2 +
 ...external_ip_to_clusters_applications_ingress.rb |   2 +-
 db/migrate/20180214093516_create_badges.rb         |   2 +
 ...4155405_create_clusters_applications_runners.rb |   2 +-
 ...20180216120000_add_pages_domain_verification.rb |   2 +-
 .../20180222043024_add_ip_address_to_runner.rb     |   2 +-
 ...d_user_internal_regex_to_application_setting.rb |   2 +-
 ...l_auth_mutual_tls_fields_to_project_settings.rb |   2 +
 db/migrate/20180319190020_create_deploy_tokens.rb  |   2 +
 .../20180502122856_create_project_mirror_data.rb   |   2 +
 db/migrate/20180503131624_create_remote_mirrors.rb |   2 +
 ...nsure_missing_columns_to_project_mirror_data.rb |   4 +-
 ...1131058_create_clusters_applications_jupyter.rb |   6 +-
 .../20180515121227_create_notes_diff_files.rb      |   2 +
 .../20180529093006_ensure_remote_mirror_columns.rb |   2 +-
 .../20180531185349_add_repository_languages.rb     |   2 +
 ...180613081317_create_ci_builds_runner_session.rb |   2 +
 db/migrate/20180713092803_create_user_statuses.rb  |   2 +
 .../20180814153625_add_commit_email_to_users.rb    |   2 +-
 ...31164908_add_identifier_to_prometheus_metric.rb |   2 +-
 ...15836_add_attr_encrypted_columns_to_web_hook.rb |   2 +
 ...2_add_token_digest_to_personal_access_tokens.rb |   2 +-
 .../20180912111628_add_knative_application.rb      |   2 +
 ...190428_create_clusters_kubernetes_namespaces.rb |   2 +
 db/migrate/20181019032400_add_shards_table.rb      |   2 +-
 .../20181019032408_add_repositories_table.rb       |   2 +-
 ...ommit_email_hostname_to_application_settings.rb |   2 +-
 .../20181031190559_drop_gcp_clusters_table.rb      |   2 +
 ...41_create_clusters_applications_cert_manager.rb |   2 +
 ...0140_add_encrypted_runners_token_to_settings.rb |   2 +-
 db/migrate/20181116050532_knative_external_ip.rb   |   2 +-
 ...15_add_encrypted_runners_token_to_namespaces.rb |   2 +-
 ...1504_add_encrypted_runners_token_to_projects.rb |   2 +-
 ...1120151656_add_token_encrypted_to_ci_runners.rb |   2 +-
 .../20181122160027_create_project_repositories.rb  |   2 +-
 db/migrate/20181123144235_create_suggestions.rb    |   2 +-
 .../20181128123704_add_state_to_pool_repository.rb |   2 +-
 ...81129104854_add_token_encrypted_to_ci_builds.rb |   2 +-
 ...1203002526_add_project_bfg_object_map_column.rb |   2 +-
 ...92510_add_name_author_id_and_sha_to_releases.rb |   4 +-
 ...0181212171634_create_error_tracking_settings.rb |   2 +
 .../20181228175414_create_releases_link_table.rb   |   2 +
 ...90109153125_add_merge_request_external_diffs.rb |   2 +-
 db/migrate/20190114172110_add_domain_to_cluster.rb |   2 +-
 ..._add_columns_project_error_tracking_settings.rb |   4 +-
 ...234221_add_sorting_fields_to_user_preference.rb |   4 +-
 ...add_external_hostname_to_ingress_and_knative.rb |   4 +-
 ...t_notification_email_to_application_settings.rb |   2 +-
 ...0190325105715_add_fields_to_user_preferences.rb |   2 +-
 ..._notification_email_to_notification_settings.rb |   2 +-
 .../20190402150158_backport_enterprise_schema.rb   |   2 +
 db/migrate/20190409224933_add_name_to_geo_nodes.rb |   2 +-
 ...190422082247_create_project_metrics_settings.rb |   2 +-
 ...190429082448_create_pages_domain_acme_orders.rb |   2 +
 .../20190430131225_create_issue_tracker_data.rb    |   2 +
 .../20190430142025_create_jira_tracker_data.rb     |   2 +
 db/migrate/20190514105711_create_ip_restriction.rb |   2 +-
 ...quired_template_name_to_application_settings.rb |   2 +-
 ...ncrypted_to_operations_feature_flags_clients.rb |   2 +-
 ...20190613044655_add_username_to_deploy_tokens.rb |   2 +-
 .../20190613073003_create_project_aliases.rb       |   2 +-
 .../20190621151636_add_merge_request_rebase_jid.rb |   2 +-
 .../20190624123615_add_grafana_url_to_settings.rb  |   2 +
 db/migrate/20190711124721_create_job_variables.rb  |   2 +
 ...5024_remove_koding_from_application_settings.rb |   2 +-
 ...04231137_remove_alternate_url_from_geo_nodes.rb |   2 +-
 ...4066_remove_sentry_from_application_settings.rb |   2 +-
 .../cop/migration/add_limit_to_string_columns.rb   |  59 +++++
 rubocop/rubocop.rb                                 |   1 +
 .../migration/add_limit_to_string_columns_spec.rb  | 268 +++++++++++++++++++++
 73 files changed, 431 insertions(+), 51 deletions(-)
 create mode 100644 rubocop/cop/migration/add_limit_to_string_columns.rb
 create mode 100644 spec/rubocop/cop/migration/add_limit_to_string_columns_spec.rb

diff --git a/db/migrate/20171230123729_init_schema.rb b/db/migrate/20171230123729_init_schema.rb
index fa90b37954f..a474ea2f925 100644
--- a/db/migrate/20171230123729_init_schema.rb
+++ b/db/migrate/20171230123729_init_schema.rb
@@ -5,6 +5,7 @@
 # rubocop:disable Metrics/AbcSize
 # rubocop:disable Migration/AddConcurrentForeignKey
 # rubocop:disable Style/WordArray
+# rubocop:disable Migration/AddLimitToStringColumns
 
 class InitSchema < ActiveRecord::Migration[4.2]
   DOWNTIME = false
@@ -1852,3 +1853,4 @@ class InitSchema < ActiveRecord::Migration[4.2]
     raise ActiveRecord::IrreversibleMigration, "The initial migration is not revertable"
   end
 end
+# rubocop:enable Migration/AddLimitToStringColumns
diff --git a/db/migrate/20180101160629_create_prometheus_metrics.rb b/db/migrate/20180101160629_create_prometheus_metrics.rb
index e3b1ed710d6..a098b999a0a 100644
--- a/db/migrate/20180101160629_create_prometheus_metrics.rb
+++ b/db/migrate/20180101160629_create_prometheus_metrics.rb
@@ -4,6 +4,7 @@ class CreatePrometheusMetrics < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :prometheus_metrics do |t|
       t.references :project, index: true, foreign_key: { on_delete: :cascade }, null: false
       t.string :title, null: false
@@ -14,5 +15,6 @@ class CreatePrometheusMetrics < ActiveRecord::Migration[4.2]
       t.integer :group, null: false, index: true
       t.timestamps_with_timezone null: false
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180122162010_add_auto_devops_domain_to_application_settings.rb b/db/migrate/20180122162010_add_auto_devops_domain_to_application_settings.rb
index c76dc5b3a68..eb446ad0d72 100644
--- a/db/migrate/20180122162010_add_auto_devops_domain_to_application_settings.rb
+++ b/db/migrate/20180122162010_add_auto_devops_domain_to_application_settings.rb
@@ -8,6 +8,6 @@ class AddAutoDevopsDomainToApplicationSettings < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
-    add_column :application_settings, :auto_devops_domain, :string
+    add_column :application_settings, :auto_devops_domain, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180129193323_add_uploads_builder_context.rb b/db/migrate/20180129193323_add_uploads_builder_context.rb
index c7227bf0f1e..710fa7b3ba8 100644
--- a/db/migrate/20180129193323_add_uploads_builder_context.rb
+++ b/db/migrate/20180129193323_add_uploads_builder_context.rb
@@ -8,7 +8,9 @@ class AddUploadsBuilderContext < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     add_column :uploads, :mount_point, :string
     add_column :uploads, :secret, :string
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180212030105_add_external_ip_to_clusters_applications_ingress.rb b/db/migrate/20180212030105_add_external_ip_to_clusters_applications_ingress.rb
index e2a9a68b1ad..78aa2014601 100644
--- a/db/migrate/20180212030105_add_external_ip_to_clusters_applications_ingress.rb
+++ b/db/migrate/20180212030105_add_external_ip_to_clusters_applications_ingress.rb
@@ -4,6 +4,6 @@ class AddExternalIpToClustersApplicationsIngress < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
-    add_column :clusters_applications_ingress, :external_ip, :string
+    add_column :clusters_applications_ingress, :external_ip, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180214093516_create_badges.rb b/db/migrate/20180214093516_create_badges.rb
index 66e017b115a..fe27d465571 100644
--- a/db/migrate/20180214093516_create_badges.rb
+++ b/db/migrate/20180214093516_create_badges.rb
@@ -2,6 +2,7 @@ class CreateBadges < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :badges do |t|
       t.string     :link_url, null: false
       t.string     :image_url, null: false
@@ -11,6 +12,7 @@ class CreateBadges < ActiveRecord::Migration[4.2]
 
       t.timestamps_with_timezone null: false
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
 
     # rubocop:disable Migration/AddConcurrentForeignKey
     add_foreign_key :badges, :namespaces, column: :group_id, on_delete: :cascade
diff --git a/db/migrate/20180214155405_create_clusters_applications_runners.rb b/db/migrate/20180214155405_create_clusters_applications_runners.rb
index ce594c91890..f611fefbb0d 100644
--- a/db/migrate/20180214155405_create_clusters_applications_runners.rb
+++ b/db/migrate/20180214155405_create_clusters_applications_runners.rb
@@ -13,7 +13,7 @@ class CreateClustersApplicationsRunners < ActiveRecord::Migration[4.2]
       t.index :cluster_id, unique: true
       t.integer :status, null: false
       t.timestamps_with_timezone null: false
-      t.string :version, null: false
+      t.string :version, null: false # rubocop:disable Migration/AddLimitToStringColumns
       t.text :status_reason
     end
 
diff --git a/db/migrate/20180216120000_add_pages_domain_verification.rb b/db/migrate/20180216120000_add_pages_domain_verification.rb
index f709f5a5809..b2f19f2e1a9 100644
--- a/db/migrate/20180216120000_add_pages_domain_verification.rb
+++ b/db/migrate/20180216120000_add_pages_domain_verification.rb
@@ -3,6 +3,6 @@ class AddPagesDomainVerification < ActiveRecord::Migration[4.2]
 
   def change
     add_column :pages_domains, :verified_at, :datetime_with_timezone
-    add_column :pages_domains, :verification_code, :string
+    add_column :pages_domains, :verification_code, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180222043024_add_ip_address_to_runner.rb b/db/migrate/20180222043024_add_ip_address_to_runner.rb
index b52366c0be1..08fb0bd900c 100644
--- a/db/migrate/20180222043024_add_ip_address_to_runner.rb
+++ b/db/migrate/20180222043024_add_ip_address_to_runner.rb
@@ -4,6 +4,6 @@ class AddIpAddressToRunner < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
-    add_column :ci_runners, :ip_address, :string
+    add_column :ci_runners, :ip_address, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180308125206_add_user_internal_regex_to_application_setting.rb b/db/migrate/20180308125206_add_user_internal_regex_to_application_setting.rb
index 5e4bf96f86f..9bdd44baf58 100644
--- a/db/migrate/20180308125206_add_user_internal_regex_to_application_setting.rb
+++ b/db/migrate/20180308125206_add_user_internal_regex_to_application_setting.rb
@@ -4,7 +4,7 @@ class AddUserInternalRegexToApplicationSetting < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def up
-    add_column :application_settings, :user_default_internal_regex, :string, null: true
+    add_column :application_settings, :user_default_internal_regex, :string, null: true # rubocop:disable Migration/AddLimitToStringColumns
   end
 
   def down
diff --git a/db/migrate/20180315160435_add_external_auth_mutual_tls_fields_to_project_settings.rb b/db/migrate/20180315160435_add_external_auth_mutual_tls_fields_to_project_settings.rb
index ee3d1078f5e..c379d207ff0 100644
--- a/db/migrate/20180315160435_add_external_auth_mutual_tls_fields_to_project_settings.rb
+++ b/db/migrate/20180315160435_add_external_auth_mutual_tls_fields_to_project_settings.rb
@@ -2,6 +2,7 @@ class AddExternalAuthMutualTlsFieldsToProjectSettings < ActiveRecord::Migration[
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     add_column :application_settings,
                :external_auth_client_cert, :text
     add_column :application_settings,
@@ -12,5 +13,6 @@ class AddExternalAuthMutualTlsFieldsToProjectSettings < ActiveRecord::Migration[
                :encrypted_external_auth_client_key_pass, :string
     add_column :application_settings,
                :encrypted_external_auth_client_key_pass_iv, :string
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180319190020_create_deploy_tokens.rb b/db/migrate/20180319190020_create_deploy_tokens.rb
index a4d797679c5..f444521b3ae 100644
--- a/db/migrate/20180319190020_create_deploy_tokens.rb
+++ b/db/migrate/20180319190020_create_deploy_tokens.rb
@@ -2,6 +2,7 @@ class CreateDeployTokens < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :deploy_tokens do |t|
       t.boolean :revoked, default: false
       t.boolean :read_repository, null: false, default: false
@@ -15,5 +16,6 @@ class CreateDeployTokens < ActiveRecord::Migration[4.2]
 
       t.index [:token, :expires_at, :id], where: "(revoked IS FALSE)"
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180502122856_create_project_mirror_data.rb b/db/migrate/20180502122856_create_project_mirror_data.rb
index 9781815a97b..04367e1c98b 100644
--- a/db/migrate/20180502122856_create_project_mirror_data.rb
+++ b/db/migrate/20180502122856_create_project_mirror_data.rb
@@ -3,6 +3,7 @@ class CreateProjectMirrorData < ActiveRecord::Migration[4.2]
 
   DOWNTIME = false
 
+  # rubocop:disable Migration/AddLimitToStringColumns
   def up
     if table_exists?(:project_mirror_data)
       add_column :project_mirror_data, :status, :string unless column_exists?(:project_mirror_data, :status)
@@ -17,6 +18,7 @@ class CreateProjectMirrorData < ActiveRecord::Migration[4.2]
       end
     end
   end
+  # rubocop:enable Migration/AddLimitToStringColumns
 
   def down
     remove_column :project_mirror_data, :status
diff --git a/db/migrate/20180503131624_create_remote_mirrors.rb b/db/migrate/20180503131624_create_remote_mirrors.rb
index 288ae365f0f..a079c1b3328 100644
--- a/db/migrate/20180503131624_create_remote_mirrors.rb
+++ b/db/migrate/20180503131624_create_remote_mirrors.rb
@@ -5,6 +5,7 @@ class CreateRemoteMirrors < ActiveRecord::Migration[4.2]
 
   disable_ddl_transaction!
 
+  # rubocop:disable Migration/AddLimitToStringColumns
   def up
     return if table_exists?(:remote_mirrors)
 
@@ -27,6 +28,7 @@ class CreateRemoteMirrors < ActiveRecord::Migration[4.2]
       t.timestamps null: false
     end
   end
+  # rubocop:enable Migration/AddLimitToStringColumns
 
   def down
     # ee/db/migrate/20160321161032_create_remote_mirrors_ee.rb will remove the table
diff --git a/db/migrate/20180503175053_ensure_missing_columns_to_project_mirror_data.rb b/db/migrate/20180503175053_ensure_missing_columns_to_project_mirror_data.rb
index 3775b3a08c9..f00493ed515 100644
--- a/db/migrate/20180503175053_ensure_missing_columns_to_project_mirror_data.rb
+++ b/db/migrate/20180503175053_ensure_missing_columns_to_project_mirror_data.rb
@@ -4,8 +4,8 @@ class EnsureMissingColumnsToProjectMirrorData < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def up
-    add_column :project_mirror_data, :status, :string unless column_exists?(:project_mirror_data, :status)
-    add_column :project_mirror_data, :jid, :string unless column_exists?(:project_mirror_data, :jid)
+    add_column :project_mirror_data, :status, :string unless column_exists?(:project_mirror_data, :status) # rubocop:disable Migration/AddLimitToStringColumns
+    add_column :project_mirror_data, :jid, :string unless column_exists?(:project_mirror_data, :jid) # rubocop:disable Migration/AddLimitToStringColumns
     add_column :project_mirror_data, :last_error, :text unless column_exists?(:project_mirror_data, :last_error)
   end
 
diff --git a/db/migrate/20180511131058_create_clusters_applications_jupyter.rb b/db/migrate/20180511131058_create_clusters_applications_jupyter.rb
index 749aeeb4792..4633d930e2d 100644
--- a/db/migrate/20180511131058_create_clusters_applications_jupyter.rb
+++ b/db/migrate/20180511131058_create_clusters_applications_jupyter.rb
@@ -7,17 +7,19 @@ class CreateClustersApplicationsJupyter < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :clusters_applications_jupyter do |t|
       t.references :cluster, null: false, unique: true, foreign_key: { on_delete: :cascade }
       t.references :oauth_application, foreign_key: { on_delete: :nullify }
 
       t.integer :status, null: false
-      t.string :version, null: false
-      t.string :hostname
+      t.string :version, null: false # rubocop:disable Migration/AddLimitToStringColumns
+      t.string :hostname # rubocop:disable Migration/AddLimitToStringColumns
 
       t.timestamps_with_timezone null: false
 
       t.text :status_reason
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180515121227_create_notes_diff_files.rb b/db/migrate/20180515121227_create_notes_diff_files.rb
index e50324d8599..5f6dba11ff9 100644
--- a/db/migrate/20180515121227_create_notes_diff_files.rb
+++ b/db/migrate/20180515121227_create_notes_diff_files.rb
@@ -4,6 +4,7 @@ class CreateNotesDiffFiles < ActiveRecord::Migration[4.2]
   disable_ddl_transaction!
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :note_diff_files do |t|
       t.references :diff_note, references: :notes, null: false, index: { unique: true }
       t.text :diff, null: false
@@ -18,5 +19,6 @@ class CreateNotesDiffFiles < ActiveRecord::Migration[4.2]
 
     # rubocop:disable Migration/AddConcurrentForeignKey
     add_foreign_key :note_diff_files, :notes, column: :diff_note_id, on_delete: :cascade
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180529093006_ensure_remote_mirror_columns.rb b/db/migrate/20180529093006_ensure_remote_mirror_columns.rb
index 207e1f089fb..a0a1150f022 100644
--- a/db/migrate/20180529093006_ensure_remote_mirror_columns.rb
+++ b/db/migrate/20180529093006_ensure_remote_mirror_columns.rb
@@ -8,7 +8,7 @@ class EnsureRemoteMirrorColumns < ActiveRecord::Migration[4.2]
   def up
     # rubocop:disable Migration/Datetime
     add_column :remote_mirrors, :last_update_started_at, :datetime unless column_exists?(:remote_mirrors, :last_update_started_at)
-    add_column :remote_mirrors, :remote_name, :string unless column_exists?(:remote_mirrors, :remote_name)
+    add_column :remote_mirrors, :remote_name, :string unless column_exists?(:remote_mirrors, :remote_name) # rubocop:disable Migration/AddLimitToStringColumns
 
     unless column_exists?(:remote_mirrors, :only_protected_branches)
       add_column_with_default(:remote_mirrors,
diff --git a/db/migrate/20180531185349_add_repository_languages.rb b/db/migrate/20180531185349_add_repository_languages.rb
index 26a01c3bb26..d517c21c26c 100644
--- a/db/migrate/20180531185349_add_repository_languages.rb
+++ b/db/migrate/20180531185349_add_repository_languages.rb
@@ -4,6 +4,7 @@ class AddRepositoryLanguages < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def up
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table(:programming_languages) do |t|
       t.string :name, null: false
       t.string :color, null: false
@@ -19,6 +20,7 @@ class AddRepositoryLanguages < ActiveRecord::Migration[4.2]
     add_index :programming_languages, :name, unique: true
     add_index :repository_languages, [:project_id, :programming_language_id],
       unique: true, name: "index_repository_languages_on_project_and_languages_id"
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 
   def down
diff --git a/db/migrate/20180613081317_create_ci_builds_runner_session.rb b/db/migrate/20180613081317_create_ci_builds_runner_session.rb
index eb41f76b105..68af38834d2 100644
--- a/db/migrate/20180613081317_create_ci_builds_runner_session.rb
+++ b/db/migrate/20180613081317_create_ci_builds_runner_session.rb
@@ -8,6 +8,7 @@ class CreateCiBuildsRunnerSession < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :ci_builds_runner_session, id: :bigserial do |t|
       t.integer :build_id, null: false
       t.string :url, null: false
@@ -17,5 +18,6 @@ class CreateCiBuildsRunnerSession < ActiveRecord::Migration[4.2]
       t.foreign_key :ci_builds, column: :build_id, on_delete: :cascade
       t.index :build_id, unique: true
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180713092803_create_user_statuses.rb b/db/migrate/20180713092803_create_user_statuses.rb
index 43b96805c1e..3abab4e45a9 100644
--- a/db/migrate/20180713092803_create_user_statuses.rb
+++ b/db/migrate/20180713092803_create_user_statuses.rb
@@ -6,6 +6,7 @@ class CreateUserStatuses < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :user_statuses, id: false, primary_key: :user_id do |t|
       t.references :user,
                    foreign_key: { on_delete: :cascade },
@@ -16,5 +17,6 @@ class CreateUserStatuses < ActiveRecord::Migration[4.2]
       t.string :message, limit: 100
       t.string :message_html
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180814153625_add_commit_email_to_users.rb b/db/migrate/20180814153625_add_commit_email_to_users.rb
index 4d9217ea504..98bafc14a03 100644
--- a/db/migrate/20180814153625_add_commit_email_to_users.rb
+++ b/db/migrate/20180814153625_add_commit_email_to_users.rb
@@ -28,6 +28,6 @@ class AddCommitEmailToUsers < ActiveRecord::Migration[4.2]
   # disable_ddl_transaction!
 
   def change
-    add_column :users, :commit_email, :string
+    add_column :users, :commit_email, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180831164908_add_identifier_to_prometheus_metric.rb b/db/migrate/20180831164908_add_identifier_to_prometheus_metric.rb
index 7aa5950249c..8f30363c310 100644
--- a/db/migrate/20180831164908_add_identifier_to_prometheus_metric.rb
+++ b/db/migrate/20180831164908_add_identifier_to_prometheus_metric.rb
@@ -6,6 +6,6 @@ class AddIdentifierToPrometheusMetric < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
-    add_column :prometheus_metrics, :identifier, :string
+    add_column :prometheus_metrics, :identifier, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180910115836_add_attr_encrypted_columns_to_web_hook.rb b/db/migrate/20180910115836_add_attr_encrypted_columns_to_web_hook.rb
index ca8dbdba2bb..9757f7fdc79 100644
--- a/db/migrate/20180910115836_add_attr_encrypted_columns_to_web_hook.rb
+++ b/db/migrate/20180910115836_add_attr_encrypted_columns_to_web_hook.rb
@@ -6,10 +6,12 @@ class AddAttrEncryptedColumnsToWebHook < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     add_column :web_hooks, :encrypted_token, :string
     add_column :web_hooks, :encrypted_token_iv, :string
 
     add_column :web_hooks, :encrypted_url, :string
     add_column :web_hooks, :encrypted_url_iv, :string
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20180910153412_add_token_digest_to_personal_access_tokens.rb b/db/migrate/20180910153412_add_token_digest_to_personal_access_tokens.rb
index 142e454832f..52923f52499 100644
--- a/db/migrate/20180910153412_add_token_digest_to_personal_access_tokens.rb
+++ b/db/migrate/20180910153412_add_token_digest_to_personal_access_tokens.rb
@@ -8,7 +8,7 @@ class AddTokenDigestToPersonalAccessTokens < ActiveRecord::Migration[4.2]
   def up
     change_column :personal_access_tokens, :token, :string, null: true
 
-    add_column :personal_access_tokens, :token_digest, :string
+    add_column :personal_access_tokens, :token_digest, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 
   def down
diff --git a/db/migrate/20180912111628_add_knative_application.rb b/db/migrate/20180912111628_add_knative_application.rb
index 86d9100d2e7..7c55de02d1c 100644
--- a/db/migrate/20180912111628_add_knative_application.rb
+++ b/db/migrate/20180912111628_add_knative_application.rb
@@ -6,6 +6,7 @@ class AddKnativeApplication < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table "clusters_applications_knative" do |t|
       t.references :cluster, null: false, unique: true, foreign_key: { on_delete: :cascade }
 
@@ -16,5 +17,6 @@ class AddKnativeApplication < ActiveRecord::Migration[4.2]
       t.string "hostname"
       t.text "status_reason"
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181009190428_create_clusters_kubernetes_namespaces.rb b/db/migrate/20181009190428_create_clusters_kubernetes_namespaces.rb
index 62ad6c63d0a..b6ffb2866aa 100644
--- a/db/migrate/20181009190428_create_clusters_kubernetes_namespaces.rb
+++ b/db/migrate/20181009190428_create_clusters_kubernetes_namespaces.rb
@@ -5,6 +5,7 @@ class CreateClustersKubernetesNamespaces < ActiveRecord::Migration[4.2]
   INDEX_NAME = 'kubernetes_namespaces_cluster_and_namespace'
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :clusters_kubernetes_namespaces, id: :bigserial do |t|
       t.references :cluster, null: false, index: true, foreign_key: { on_delete: :cascade }
       t.references :project, index: true, foreign_key: { on_delete: :nullify }
@@ -20,5 +21,6 @@ class CreateClustersKubernetesNamespaces < ActiveRecord::Migration[4.2]
 
       t.index [:cluster_id, :namespace], name: INDEX_NAME, unique: true
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181019032400_add_shards_table.rb b/db/migrate/20181019032400_add_shards_table.rb
index e31af97cc94..82287e5c3b5 100644
--- a/db/migrate/20181019032400_add_shards_table.rb
+++ b/db/migrate/20181019032400_add_shards_table.rb
@@ -5,7 +5,7 @@ class AddShardsTable < ActiveRecord::Migration[4.2]
 
   def change
     create_table :shards do |t|
-      t.string :name, null: false, index: { unique: true }
+      t.string :name, null: false, index: { unique: true } # rubocop:disable Migration/AddLimitToStringColumns
     end
   end
 end
diff --git a/db/migrate/20181019032408_add_repositories_table.rb b/db/migrate/20181019032408_add_repositories_table.rb
index 2153c1c9fc6..dd510b44084 100644
--- a/db/migrate/20181019032408_add_repositories_table.rb
+++ b/db/migrate/20181019032408_add_repositories_table.rb
@@ -6,7 +6,7 @@ class AddRepositoriesTable < ActiveRecord::Migration[4.2]
   def change
     create_table :repositories, id: :bigserial do |t|
       t.references :shard, null: false, index: true, foreign_key: { on_delete: :restrict }
-      t.string :disk_path, null: false, index: { unique: true }
+      t.string :disk_path, null: false, index: { unique: true } # rubocop:disable Migration/AddLimitToStringColumns
     end
 
     add_column :projects, :pool_repository_id, :bigint
diff --git a/db/migrate/20181025115728_add_private_commit_email_hostname_to_application_settings.rb b/db/migrate/20181025115728_add_private_commit_email_hostname_to_application_settings.rb
index 052a344f182..c0e4897b8d7 100644
--- a/db/migrate/20181025115728_add_private_commit_email_hostname_to_application_settings.rb
+++ b/db/migrate/20181025115728_add_private_commit_email_hostname_to_application_settings.rb
@@ -6,6 +6,6 @@ class AddPrivateCommitEmailHostnameToApplicationSettings < ActiveRecord::Migrati
   DOWNTIME = false
 
   def change
-    add_column(:application_settings, :commit_email_hostname, :string, null: true)
+    add_column(:application_settings, :commit_email_hostname, :string, null: true) # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181031190559_drop_gcp_clusters_table.rb b/db/migrate/20181031190559_drop_gcp_clusters_table.rb
index 597fe49f4c8..850fa93c75a 100644
--- a/db/migrate/20181031190559_drop_gcp_clusters_table.rb
+++ b/db/migrate/20181031190559_drop_gcp_clusters_table.rb
@@ -10,6 +10,7 @@ class DropGcpClustersTable < ActiveRecord::Migration[4.2]
   end
 
   def down
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :gcp_clusters do |t|
       # Order columns by best align scheme
       t.references :project, null: false, index: { unique: true }, foreign_key: { on_delete: :cascade }
@@ -49,5 +50,6 @@ class DropGcpClustersTable < ActiveRecord::Migration[4.2]
       t.text :encrypted_gcp_token
       t.string :encrypted_gcp_token_iv
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181101191341_create_clusters_applications_cert_manager.rb b/db/migrate/20181101191341_create_clusters_applications_cert_manager.rb
index 0b6155356d9..3bc20046311 100644
--- a/db/migrate/20181101191341_create_clusters_applications_cert_manager.rb
+++ b/db/migrate/20181101191341_create_clusters_applications_cert_manager.rb
@@ -6,6 +6,7 @@ class CreateClustersApplicationsCertManager < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :clusters_applications_cert_managers do |t|
       t.references :cluster, null: false, index: false, foreign_key: { on_delete: :cascade }
       t.integer :status, null: false
@@ -15,5 +16,6 @@ class CreateClustersApplicationsCertManager < ActiveRecord::Migration[4.2]
       t.text :status_reason
       t.index :cluster_id, unique: true
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181115140140_add_encrypted_runners_token_to_settings.rb b/db/migrate/20181115140140_add_encrypted_runners_token_to_settings.rb
index 5b2bb4f6b08..124eedf7933 100644
--- a/db/migrate/20181115140140_add_encrypted_runners_token_to_settings.rb
+++ b/db/migrate/20181115140140_add_encrypted_runners_token_to_settings.rb
@@ -6,6 +6,6 @@ class AddEncryptedRunnersTokenToSettings < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
-    add_column :application_settings, :runners_registration_token_encrypted, :string
+    add_column :application_settings, :runners_registration_token_encrypted, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181116050532_knative_external_ip.rb b/db/migrate/20181116050532_knative_external_ip.rb
index 5645b040a23..4634b411108 100644
--- a/db/migrate/20181116050532_knative_external_ip.rb
+++ b/db/migrate/20181116050532_knative_external_ip.rb
@@ -9,6 +9,6 @@ class KnativeExternalIp < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
-    add_column :clusters_applications_knative, :external_ip, :string
+    add_column :clusters_applications_knative, :external_ip, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181116141415_add_encrypted_runners_token_to_namespaces.rb b/db/migrate/20181116141415_add_encrypted_runners_token_to_namespaces.rb
index dcf565cd6c0..0a8ed912891 100644
--- a/db/migrate/20181116141415_add_encrypted_runners_token_to_namespaces.rb
+++ b/db/migrate/20181116141415_add_encrypted_runners_token_to_namespaces.rb
@@ -6,6 +6,6 @@ class AddEncryptedRunnersTokenToNamespaces < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
-    add_column :namespaces, :runners_token_encrypted, :string
+    add_column :namespaces, :runners_token_encrypted, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181116141504_add_encrypted_runners_token_to_projects.rb b/db/migrate/20181116141504_add_encrypted_runners_token_to_projects.rb
index 13cd80e5c8b..3083dff49b8 100644
--- a/db/migrate/20181116141504_add_encrypted_runners_token_to_projects.rb
+++ b/db/migrate/20181116141504_add_encrypted_runners_token_to_projects.rb
@@ -6,6 +6,6 @@ class AddEncryptedRunnersTokenToProjects < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
-    add_column :projects, :runners_token_encrypted, :string
+    add_column :projects, :runners_token_encrypted, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181120151656_add_token_encrypted_to_ci_runners.rb b/db/migrate/20181120151656_add_token_encrypted_to_ci_runners.rb
index 8b990451adc..2270246dfb4 100644
--- a/db/migrate/20181120151656_add_token_encrypted_to_ci_runners.rb
+++ b/db/migrate/20181120151656_add_token_encrypted_to_ci_runners.rb
@@ -6,6 +6,6 @@ class AddTokenEncryptedToCiRunners < ActiveRecord::Migration[4.2]
   DOWNTIME = false
 
   def change
-    add_column :ci_runners, :token_encrypted, :string
+    add_column :ci_runners, :token_encrypted, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181122160027_create_project_repositories.rb b/db/migrate/20181122160027_create_project_repositories.rb
index e42cef9b1c6..3f123daa150 100644
--- a/db/migrate/20181122160027_create_project_repositories.rb
+++ b/db/migrate/20181122160027_create_project_repositories.rb
@@ -11,7 +11,7 @@ class CreateProjectRepositories < ActiveRecord::Migration[5.0]
   def change
     create_table :project_repositories, id: :bigserial do |t|
       t.references :shard, null: false, index: true, foreign_key: { on_delete: :restrict }
-      t.string :disk_path, null: false, index: { unique: true }
+      t.string :disk_path, null: false, index: { unique: true } # rubocop:disable Migration/AddLimitToStringColumns
       t.references :project, null: false, index: { unique: true }, foreign_key: { on_delete: :cascade }
     end
   end
diff --git a/db/migrate/20181123144235_create_suggestions.rb b/db/migrate/20181123144235_create_suggestions.rb
index 1723f6de7eb..78888517db5 100644
--- a/db/migrate/20181123144235_create_suggestions.rb
+++ b/db/migrate/20181123144235_create_suggestions.rb
@@ -8,7 +8,7 @@ class CreateSuggestions < ActiveRecord::Migration[5.0]
       t.references :note, foreign_key: { on_delete: :cascade }, null: false
       t.integer :relative_order, null: false, limit: 2
       t.boolean :applied, null: false, default: false
-      t.string :commit_id
+      t.string :commit_id # rubocop:disable Migration/AddLimitToStringColumns
       t.text :from_content, null: false
       t.text :to_content, null: false
 
diff --git a/db/migrate/20181128123704_add_state_to_pool_repository.rb b/db/migrate/20181128123704_add_state_to_pool_repository.rb
index 714232ede56..04bbcf24f62 100644
--- a/db/migrate/20181128123704_add_state_to_pool_repository.rb
+++ b/db/migrate/20181128123704_add_state_to_pool_repository.rb
@@ -9,7 +9,7 @@ class AddStateToPoolRepository < ActiveRecord::Migration[5.0]
   # the transactions don't have to be disabled
   # rubocop: disable Migration/AddConcurrentForeignKey, Migration/AddIndex
   def change
-    add_column(:pool_repositories, :state, :string, null: true)
+    add_column(:pool_repositories, :state, :string, null: true) # rubocop:disable Migration/AddLimitToStringColumns
 
     add_column :pool_repositories, :source_project_id, :integer
     add_index :pool_repositories, :source_project_id, unique: true
diff --git a/db/migrate/20181129104854_add_token_encrypted_to_ci_builds.rb b/db/migrate/20181129104854_add_token_encrypted_to_ci_builds.rb
index 11b98203793..62a7421eae0 100644
--- a/db/migrate/20181129104854_add_token_encrypted_to_ci_builds.rb
+++ b/db/migrate/20181129104854_add_token_encrypted_to_ci_builds.rb
@@ -6,6 +6,6 @@ class AddTokenEncryptedToCiBuilds < ActiveRecord::Migration[5.0]
   DOWNTIME = false
 
   def change
-    add_column :ci_builds, :token_encrypted, :string
+    add_column :ci_builds, :token_encrypted, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181203002526_add_project_bfg_object_map_column.rb b/db/migrate/20181203002526_add_project_bfg_object_map_column.rb
index 8b42cd6f941..5e6d416895c 100644
--- a/db/migrate/20181203002526_add_project_bfg_object_map_column.rb
+++ b/db/migrate/20181203002526_add_project_bfg_object_map_column.rb
@@ -4,6 +4,6 @@ class AddProjectBfgObjectMapColumn < ActiveRecord::Migration[5.0]
   DOWNTIME = false
 
   def change
-    add_column :projects, :bfg_object_map, :string
+    add_column :projects, :bfg_object_map, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181211092510_add_name_author_id_and_sha_to_releases.rb b/db/migrate/20181211092510_add_name_author_id_and_sha_to_releases.rb
index 60815e0c31a..3ab808ba667 100644
--- a/db/migrate/20181211092510_add_name_author_id_and_sha_to_releases.rb
+++ b/db/migrate/20181211092510_add_name_author_id_and_sha_to_releases.rb
@@ -7,7 +7,7 @@ class AddNameAuthorIdAndShaToReleases < ActiveRecord::Migration[5.0]
 
   def change
     add_column :releases, :author_id, :integer
-    add_column :releases, :name, :string
-    add_column :releases, :sha, :string
+    add_column :releases, :name, :string # rubocop:disable Migration/AddLimitToStringColumns
+    add_column :releases, :sha, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181212171634_create_error_tracking_settings.rb b/db/migrate/20181212171634_create_error_tracking_settings.rb
index 18c38bd2c47..950b9a88005 100644
--- a/db/migrate/20181212171634_create_error_tracking_settings.rb
+++ b/db/migrate/20181212171634_create_error_tracking_settings.rb
@@ -6,6 +6,7 @@ class CreateErrorTrackingSettings < ActiveRecord::Migration[5.0]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :project_error_tracking_settings, id: :int, primary_key: :project_id, default: nil do |t|
       t.boolean :enabled, null: false, default: true
       t.string :api_url, null: false
@@ -13,5 +14,6 @@ class CreateErrorTrackingSettings < ActiveRecord::Migration[5.0]
       t.string :encrypted_token_iv
       t.foreign_key :projects, column: :project_id, on_delete: :cascade
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20181228175414_create_releases_link_table.rb b/db/migrate/20181228175414_create_releases_link_table.rb
index 03558202137..168c4722cc1 100644
--- a/db/migrate/20181228175414_create_releases_link_table.rb
+++ b/db/migrate/20181228175414_create_releases_link_table.rb
@@ -6,6 +6,7 @@ class CreateReleasesLinkTable < ActiveRecord::Migration[5.0]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :release_links, id: :bigserial do |t|
       t.references :release, null: false, index: false, foreign_key: { on_delete: :cascade }
       t.string :url, null: false
@@ -15,5 +16,6 @@ class CreateReleasesLinkTable < ActiveRecord::Migration[5.0]
       t.index [:release_id, :url], unique: true
       t.index [:release_id, :name], unique: true
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190109153125_add_merge_request_external_diffs.rb b/db/migrate/20190109153125_add_merge_request_external_diffs.rb
index c67903c7f67..a680856a3d8 100644
--- a/db/migrate/20190109153125_add_merge_request_external_diffs.rb
+++ b/db/migrate/20190109153125_add_merge_request_external_diffs.rb
@@ -11,7 +11,7 @@ class AddMergeRequestExternalDiffs < ActiveRecord::Migration[5.0]
 
   def change
     # Allow the merge request diff to store details about an external file
-    add_column :merge_request_diffs, :external_diff, :string
+    add_column :merge_request_diffs, :external_diff, :string # rubocop:disable Migration/AddLimitToStringColumns
     add_column :merge_request_diffs, :external_diff_store, :integer
     add_column :merge_request_diffs, :stored_externally, :boolean
 
diff --git a/db/migrate/20190114172110_add_domain_to_cluster.rb b/db/migrate/20190114172110_add_domain_to_cluster.rb
index 58d7664b8c0..d8f10af9cad 100644
--- a/db/migrate/20190114172110_add_domain_to_cluster.rb
+++ b/db/migrate/20190114172110_add_domain_to_cluster.rb
@@ -4,6 +4,6 @@ class AddDomainToCluster < ActiveRecord::Migration[5.0]
   DOWNTIME = false
 
   def change
-    add_column :clusters, :domain, :string
+    add_column :clusters, :domain, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190115092821_add_columns_project_error_tracking_settings.rb b/db/migrate/20190115092821_add_columns_project_error_tracking_settings.rb
index 190b6f958fd..afed929cce4 100644
--- a/db/migrate/20190115092821_add_columns_project_error_tracking_settings.rb
+++ b/db/migrate/20190115092821_add_columns_project_error_tracking_settings.rb
@@ -6,8 +6,8 @@ class AddColumnsProjectErrorTrackingSettings < ActiveRecord::Migration[5.0]
   DOWNTIME = false
 
   def change
-    add_column :project_error_tracking_settings, :project_name, :string
-    add_column :project_error_tracking_settings, :organization_name, :string
+    add_column :project_error_tracking_settings, :project_name, :string # rubocop:disable Migration/AddLimitToStringColumns
+    add_column :project_error_tracking_settings, :organization_name, :string # rubocop:disable Migration/AddLimitToStringColumns
 
     change_column_default :project_error_tracking_settings, :enabled, from: true, to: false
 
diff --git a/db/migrate/20190116234221_add_sorting_fields_to_user_preference.rb b/db/migrate/20190116234221_add_sorting_fields_to_user_preference.rb
index 7bf581fe9b0..39aab600546 100644
--- a/db/migrate/20190116234221_add_sorting_fields_to_user_preference.rb
+++ b/db/migrate/20190116234221_add_sorting_fields_to_user_preference.rb
@@ -10,8 +10,8 @@ class AddSortingFieldsToUserPreference < ActiveRecord::Migration[5.0]
   DOWNTIME = false
 
   def up
-    add_column :user_preferences, :issues_sort, :string
-    add_column :user_preferences, :merge_requests_sort, :string
+    add_column :user_preferences, :issues_sort, :string # rubocop:disable Migration/AddLimitToStringColumns
+    add_column :user_preferences, :merge_requests_sort, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 
   def down
diff --git a/db/migrate/20190301182457_add_external_hostname_to_ingress_and_knative.rb b/db/migrate/20190301182457_add_external_hostname_to_ingress_and_knative.rb
index 2c3a54b12a9..37ba1090cf0 100644
--- a/db/migrate/20190301182457_add_external_hostname_to_ingress_and_knative.rb
+++ b/db/migrate/20190301182457_add_external_hostname_to_ingress_and_knative.rb
@@ -4,7 +4,7 @@ class AddExternalHostnameToIngressAndKnative < ActiveRecord::Migration[5.0]
   DOWNTIME = false
 
   def change
-    add_column :clusters_applications_ingress, :external_hostname, :string
-    add_column :clusters_applications_knative, :external_hostname, :string
+    add_column :clusters_applications_ingress, :external_hostname, :string # rubocop:disable Migration/AddLimitToStringColumns
+    add_column :clusters_applications_knative, :external_hostname, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190320174702_add_lets_encrypt_notification_email_to_application_settings.rb b/db/migrate/20190320174702_add_lets_encrypt_notification_email_to_application_settings.rb
index e9cf2af84a5..aeabf4e3cb4 100644
--- a/db/migrate/20190320174702_add_lets_encrypt_notification_email_to_application_settings.rb
+++ b/db/migrate/20190320174702_add_lets_encrypt_notification_email_to_application_settings.rb
@@ -10,6 +10,6 @@ class AddLetsEncryptNotificationEmailToApplicationSettings < ActiveRecord::Migra
   DOWNTIME = false
 
   def change
-    add_column :application_settings, :lets_encrypt_notification_email, :string
+    add_column :application_settings, :lets_encrypt_notification_email, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190325105715_add_fields_to_user_preferences.rb b/db/migrate/20190325105715_add_fields_to_user_preferences.rb
index 9ea3b4f9cd8..4da5c496147 100644
--- a/db/migrate/20190325105715_add_fields_to_user_preferences.rb
+++ b/db/migrate/20190325105715_add_fields_to_user_preferences.rb
@@ -11,7 +11,7 @@ class AddFieldsToUserPreferences < ActiveRecord::Migration[5.0]
   DOWNTIME = false
 
   def up
-    add_column(:user_preferences, :timezone, :string)
+    add_column(:user_preferences, :timezone, :string) # rubocop:disable Migration/AddLimitToStringColumns
     add_column(:user_preferences, :time_display_relative, :boolean)
     add_column(:user_preferences, :time_format_in_24h, :boolean)
   end
diff --git a/db/migrate/20190327163904_add_notification_email_to_notification_settings.rb b/db/migrate/20190327163904_add_notification_email_to_notification_settings.rb
index 2f3069032a1..d912f922510 100644
--- a/db/migrate/20190327163904_add_notification_email_to_notification_settings.rb
+++ b/db/migrate/20190327163904_add_notification_email_to_notification_settings.rb
@@ -6,6 +6,6 @@ class AddNotificationEmailToNotificationSettings < ActiveRecord::Migration[5.0]
   DOWNTIME = false
 
   def change
-    add_column :notification_settings, :notification_email, :string
+    add_column :notification_settings, :notification_email, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190402150158_backport_enterprise_schema.rb b/db/migrate/20190402150158_backport_enterprise_schema.rb
index 8762cc53ed7..3f13b68c2f3 100644
--- a/db/migrate/20190402150158_backport_enterprise_schema.rb
+++ b/db/migrate/20190402150158_backport_enterprise_schema.rb
@@ -2,6 +2,7 @@
 
 # rubocop: disable Metrics/AbcSize
 # rubocop: disable Migration/Datetime
+# rubocop: disable Migration/AddLimitToStringColumns
 class BackportEnterpriseSchema < ActiveRecord::Migration[5.0]
   include Gitlab::Database::MigrationHelpers
 
@@ -2190,3 +2191,4 @@ class BackportEnterpriseSchema < ActiveRecord::Migration[5.0]
 end
 # rubocop: enable Metrics/AbcSize
 # rubocop: enable Migration/Datetime
+# rubocop: enable Migration/AddLimitToStringColumns
diff --git a/db/migrate/20190409224933_add_name_to_geo_nodes.rb b/db/migrate/20190409224933_add_name_to_geo_nodes.rb
index 2dff81b429c..65c01683995 100644
--- a/db/migrate/20190409224933_add_name_to_geo_nodes.rb
+++ b/db/migrate/20190409224933_add_name_to_geo_nodes.rb
@@ -10,7 +10,7 @@ class AddNameToGeoNodes < ActiveRecord::Migration[5.0]
   DOWNTIME = false
 
   def up
-    add_column :geo_nodes, :name, :string
+    add_column :geo_nodes, :name, :string # rubocop:disable Migration/AddLimitToStringColumns
 
     # url is also unique, and its type and size is identical to the name column,
     # so this is safe.
diff --git a/db/migrate/20190422082247_create_project_metrics_settings.rb b/db/migrate/20190422082247_create_project_metrics_settings.rb
index 3e21dd0a934..a0a2ed64820 100644
--- a/db/migrate/20190422082247_create_project_metrics_settings.rb
+++ b/db/migrate/20190422082247_create_project_metrics_settings.rb
@@ -7,7 +7,7 @@ class CreateProjectMetricsSettings < ActiveRecord::Migration[5.0]
 
   def change
     create_table :project_metrics_settings, id: :int, primary_key: :project_id, default: nil do |t|
-      t.string :external_dashboard_url, null: false
+      t.string :external_dashboard_url, null: false # rubocop:disable Migration/AddLimitToStringColumns
       t.foreign_key :projects, column: :project_id, on_delete: :cascade
     end
   end
diff --git a/db/migrate/20190429082448_create_pages_domain_acme_orders.rb b/db/migrate/20190429082448_create_pages_domain_acme_orders.rb
index af811e83518..ca1796d054c 100644
--- a/db/migrate/20190429082448_create_pages_domain_acme_orders.rb
+++ b/db/migrate/20190429082448_create_pages_domain_acme_orders.rb
@@ -10,6 +10,7 @@ class CreatePagesDomainAcmeOrders < ActiveRecord::Migration[5.1]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :pages_domain_acme_orders do |t|
       t.references :pages_domain, null: false, index: true, foreign_key: { on_delete: :cascade }, type: :integer
 
@@ -24,5 +25,6 @@ class CreatePagesDomainAcmeOrders < ActiveRecord::Migration[5.1]
       t.text :encrypted_private_key, null: false
       t.text :encrypted_private_key_iv, null: false
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190430131225_create_issue_tracker_data.rb b/db/migrate/20190430131225_create_issue_tracker_data.rb
index 7859bea9c22..d2134ad82c7 100644
--- a/db/migrate/20190430131225_create_issue_tracker_data.rb
+++ b/db/migrate/20190430131225_create_issue_tracker_data.rb
@@ -9,6 +9,7 @@ class CreateIssueTrackerData < ActiveRecord::Migration[5.1]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :issue_tracker_data do |t|
       t.references :service, foreign_key: { on_delete: :cascade }, type: :integer, index: true, null: false
       t.timestamps_with_timezone
@@ -19,5 +20,6 @@ class CreateIssueTrackerData < ActiveRecord::Migration[5.1]
       t.string :encrypted_new_issue_url
       t.string :encrypted_new_issue_url_iv
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190430142025_create_jira_tracker_data.rb b/db/migrate/20190430142025_create_jira_tracker_data.rb
index d328ad63854..5e53e5a701a 100644
--- a/db/migrate/20190430142025_create_jira_tracker_data.rb
+++ b/db/migrate/20190430142025_create_jira_tracker_data.rb
@@ -9,6 +9,7 @@ class CreateJiraTrackerData < ActiveRecord::Migration[5.1]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :jira_tracker_data do |t|
       t.references :service, foreign_key: { on_delete: :cascade }, type: :integer, index: true, null: false
       t.timestamps_with_timezone
@@ -22,5 +23,6 @@ class CreateJiraTrackerData < ActiveRecord::Migration[5.1]
       t.string :encrypted_password_iv
       t.string :jira_issue_transition_id
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190514105711_create_ip_restriction.rb b/db/migrate/20190514105711_create_ip_restriction.rb
index dfafbe32ad1..69f8c1b8c4e 100644
--- a/db/migrate/20190514105711_create_ip_restriction.rb
+++ b/db/migrate/20190514105711_create_ip_restriction.rb
@@ -12,7 +12,7 @@ class CreateIpRestriction < ActiveRecord::Migration[5.1]
                    type: :integer,
                    null: false,
                    index: true
-      t.string :range, null: false
+      t.string :range, null: false # rubocop:disable Migration/AddLimitToStringColumns
     end
 
     add_foreign_key(:ip_restrictions, :namespaces, column: :group_id, on_delete: :cascade) # rubocop: disable Migration/AddConcurrentForeignKey
diff --git a/db/migrate/20190527011309_add_required_template_name_to_application_settings.rb b/db/migrate/20190527011309_add_required_template_name_to_application_settings.rb
index 6cbac0ed507..5c47e6f33c2 100644
--- a/db/migrate/20190527011309_add_required_template_name_to_application_settings.rb
+++ b/db/migrate/20190527011309_add_required_template_name_to_application_settings.rb
@@ -10,6 +10,6 @@ class AddRequiredTemplateNameToApplicationSettings < ActiveRecord::Migration[5.1
   DOWNTIME = false
 
   def change
-    add_column :application_settings, :required_instance_ci_template, :string, null: true
+    add_column :application_settings, :required_instance_ci_template, :string, null: true # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb b/db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb
index 024b5bd2ba5..2db4dc85750 100644
--- a/db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb
+++ b/db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb
@@ -6,6 +6,6 @@ class AddTokenEncryptedToOperationsFeatureFlagsClients < ActiveRecord::Migration
   DOWNTIME = false
 
   def change
-    add_column :operations_feature_flags_clients, :token_encrypted, :string
+    add_column :operations_feature_flags_clients, :token_encrypted, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190613044655_add_username_to_deploy_tokens.rb b/db/migrate/20190613044655_add_username_to_deploy_tokens.rb
index 793553afe35..a0acb02013b 100644
--- a/db/migrate/20190613044655_add_username_to_deploy_tokens.rb
+++ b/db/migrate/20190613044655_add_username_to_deploy_tokens.rb
@@ -4,6 +4,6 @@ class AddUsernameToDeployTokens < ActiveRecord::Migration[5.1]
   DOWNTIME = false
 
   def change
-    add_column :deploy_tokens, :username, :string
+    add_column :deploy_tokens, :username, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190613073003_create_project_aliases.rb b/db/migrate/20190613073003_create_project_aliases.rb
index 5a2c2ba0cf2..896d3ca5813 100644
--- a/db/migrate/20190613073003_create_project_aliases.rb
+++ b/db/migrate/20190613073003_create_project_aliases.rb
@@ -8,7 +8,7 @@ class CreateProjectAliases < ActiveRecord::Migration[5.1]
   def change
     create_table :project_aliases do |t|
       t.references :project, null: false, index: true, foreign_key: { on_delete: :cascade }, type: :integer
-      t.string :name, null: false, index: { unique: true }
+      t.string :name, null: false, index: { unique: true } # rubocop:disable Migration/AddLimitToStringColumns
 
       t.timestamps_with_timezone null: false
     end
diff --git a/db/migrate/20190621151636_add_merge_request_rebase_jid.rb b/db/migrate/20190621151636_add_merge_request_rebase_jid.rb
index 1fed5690ead..6c1081732e8 100644
--- a/db/migrate/20190621151636_add_merge_request_rebase_jid.rb
+++ b/db/migrate/20190621151636_add_merge_request_rebase_jid.rb
@@ -4,6 +4,6 @@ class AddMergeRequestRebaseJid < ActiveRecord::Migration[5.1]
   DOWNTIME = false
 
   def change
-    add_column :merge_requests, :rebase_jid, :string
+    add_column :merge_requests, :rebase_jid, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/migrate/20190624123615_add_grafana_url_to_settings.rb b/db/migrate/20190624123615_add_grafana_url_to_settings.rb
index 61efe64a7a1..835ec4e9094 100644
--- a/db/migrate/20190624123615_add_grafana_url_to_settings.rb
+++ b/db/migrate/20190624123615_add_grafana_url_to_settings.rb
@@ -8,8 +8,10 @@ class AddGrafanaUrlToSettings < ActiveRecord::Migration[5.1]
   DOWNTIME = false
 
   def up
+    # rubocop:disable Migration/AddLimitToStringColumns
     add_column_with_default(:application_settings, :grafana_url, :string,
                             default: '/-/grafana', allow_null: false)
+    # rubocop:enable Migration/AddLimitToStringColumns
   end
 
   def down
diff --git a/db/migrate/20190711124721_create_job_variables.rb b/db/migrate/20190711124721_create_job_variables.rb
index a860522f39e..4ff4b031d8f 100644
--- a/db/migrate/20190711124721_create_job_variables.rb
+++ b/db/migrate/20190711124721_create_job_variables.rb
@@ -10,6 +10,7 @@ class CreateJobVariables < ActiveRecord::Migration[5.1]
   DOWNTIME = false
 
   def change
+    # rubocop:disable Migration/AddLimitToStringColumns
     create_table :ci_job_variables do |t|
       t.string :key, null: false
       t.text :encrypted_value
@@ -17,6 +18,7 @@ class CreateJobVariables < ActiveRecord::Migration[5.1]
       t.references :job, null: false, index: true, foreign_key: { to_table: :ci_builds, on_delete: :cascade }
       t.integer :variable_type, null: false, limit: 2, default: 1
     end
+    # rubocop:enable Migration/AddLimitToStringColumns
 
     add_index :ci_job_variables, [:key, :job_id], unique: true
   end
diff --git a/db/post_migrate/20181013005024_remove_koding_from_application_settings.rb b/db/post_migrate/20181013005024_remove_koding_from_application_settings.rb
index 550ad94f4ab..b6e5473e896 100644
--- a/db/post_migrate/20181013005024_remove_koding_from_application_settings.rb
+++ b/db/post_migrate/20181013005024_remove_koding_from_application_settings.rb
@@ -12,6 +12,6 @@ class RemoveKodingFromApplicationSettings < ActiveRecord::Migration[4.2]
 
   def down
     add_column :application_settings, :koding_enabled, :boolean # rubocop:disable Migration/SaferBooleanColumn
-    add_column :application_settings, :koding_url, :string
+    add_column :application_settings, :koding_url, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/post_migrate/20190404231137_remove_alternate_url_from_geo_nodes.rb b/db/post_migrate/20190404231137_remove_alternate_url_from_geo_nodes.rb
index 785ceb2fb28..8e7ef0ec54f 100644
--- a/db/post_migrate/20190404231137_remove_alternate_url_from_geo_nodes.rb
+++ b/db/post_migrate/20190404231137_remove_alternate_url_from_geo_nodes.rb
@@ -16,6 +16,6 @@ class RemoveAlternateUrlFromGeoNodes < ActiveRecord::Migration[5.0]
   end
 
   def down
-    add_column :geo_nodes, :alternate_url, :string
+    add_column :geo_nodes, :alternate_url, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
diff --git a/db/post_migrate/20190625184066_remove_sentry_from_application_settings.rb b/db/post_migrate/20190625184066_remove_sentry_from_application_settings.rb
index 427df343193..9d71bfafffb 100644
--- a/db/post_migrate/20190625184066_remove_sentry_from_application_settings.rb
+++ b/db/post_migrate/20190625184066_remove_sentry_from_application_settings.rb
@@ -32,7 +32,7 @@ class RemoveSentryFromApplicationSettings < ActiveRecord::Migration[5.0]
     end
 
     SENTRY_DSN_COLUMNS.each do |column|
-      add_column(:application_settings, column, :string) unless column_exists?(:application_settings, column)
+      add_column(:application_settings, column, :string) unless column_exists?(:application_settings, column) # rubocop:disable Migration/AddLimitToStringColumns
     end
   end
 end
diff --git a/rubocop/cop/migration/add_limit_to_string_columns.rb b/rubocop/cop/migration/add_limit_to_string_columns.rb
new file mode 100644
index 00000000000..30affcbb089
--- /dev/null
+++ b/rubocop/cop/migration/add_limit_to_string_columns.rb
@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require_relative '../../migration_helpers'
+
+module RuboCop
+  module Cop
+    module Migration
+      # Cop that enforces length constraints to string columns
+      class AddLimitToStringColumns < RuboCop::Cop::Cop
+        include MigrationHelpers
+
+        ADD_COLUMNS_METHODS = %i(add_column add_column_with_default).freeze
+
+        MSG = 'String columns should have a limit constraint. 255 is suggested'.freeze
+
+        def on_def(node)
+          return unless in_migration?(node)
+
+          node.each_descendant(:send) do |send_node|
+            next unless string_operation?(send_node)
+
+            add_offense(send_node, location: :selector) unless limit_on_string_column?(send_node)
+          end
+        end
+
+        private
+
+        def string_operation?(node)
+          modifier = node.children[0]
+          migration_method = node.children[1]
+
+          if migration_method == :string
+            modifier.type == :lvar
+          elsif ADD_COLUMNS_METHODS.include?(migration_method)
+            modifier.nil? && string_column?(node.children[4])
+          end
+        end
+
+        def string_column?(column_type)
+          column_type.type == :sym && column_type.value == :string
+        end
+
+        def limit_on_string_column?(node)
+          migration_method = node.children[1]
+
+          if migration_method == :string
+            limit_present?(node.children)
+          elsif ADD_COLUMNS_METHODS.include?(migration_method)
+            limit_present?(node)
+          end
+        end
+
+        def limit_present?(statement)
+          !(statement.to_s =~ /:limit/).nil?
+        end
+      end
+    end
+  end
+end
diff --git a/rubocop/rubocop.rb b/rubocop/rubocop.rb
index 58a7ead6f13..d1328c4eb38 100644
--- a/rubocop/rubocop.rb
+++ b/rubocop/rubocop.rb
@@ -17,6 +17,7 @@ require_relative 'cop/migration/add_column'
 require_relative 'cop/migration/add_concurrent_foreign_key'
 require_relative 'cop/migration/add_concurrent_index'
 require_relative 'cop/migration/add_index'
+require_relative 'cop/migration/add_limit_to_string_columns'
 require_relative 'cop/migration/add_reference'
 require_relative 'cop/migration/add_timestamps'
 require_relative 'cop/migration/datetime'
diff --git a/spec/rubocop/cop/migration/add_limit_to_string_columns_spec.rb b/spec/rubocop/cop/migration/add_limit_to_string_columns_spec.rb
new file mode 100644
index 00000000000..97a3ae8f2bc
--- /dev/null
+++ b/spec/rubocop/cop/migration/add_limit_to_string_columns_spec.rb
@@ -0,0 +1,268 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'rubocop'
+require 'rubocop/rspec/support'
+
+require_relative '../../../../rubocop/cop/migration/add_limit_to_string_columns'
+
+describe RuboCop::Cop::Migration::AddLimitToStringColumns do
+  include CopHelper
+
+  subject(:cop) { described_class.new }
+
+  context 'in migration' do
+    before do
+      allow(cop).to receive(:in_migration?).and_return(true)
+
+      inspect_source(migration)
+    end
+
+    context 'when creating a table' do
+      context 'with string columns and limit' do
+        let(:migration) do
+          %q(
+           class CreateUsers < ActiveRecord::Migration[5.2]
+             DOWNTIME = false
+
+             def change
+               create_table :users do |t|
+                 t.string :username, null: false, limit: 255
+                 t.timestamps_with_timezone null: true
+               end
+             end
+           end
+          )
+        end
+
+        it 'register no offense' do
+          expect(cop.offenses.size).to eq(0)
+        end
+
+        context 'with limit in a different position' do
+          let(:migration) do
+            %q(
+             class CreateUsers < ActiveRecord::Migration[5.2]
+               DOWNTIME = false
+
+               def change
+                 create_table :users do |t|
+                   t.string :username, limit: 255, null: false
+                   t.timestamps_with_timezone null: true
+                 end
+               end
+             end
+            )
+          end
+
+          it 'registers an offense' do
+            expect(cop.offenses.size).to eq(0)
+          end
+        end
+      end
+
+      context 'with string columns and no limit' do
+        let(:migration) do
+          %q(
+           class CreateUsers < ActiveRecord::Migration[5.2]
+             DOWNTIME = false
+
+             def change
+               create_table :users do |t|
+                 t.string :username, null: false
+                 t.timestamps_with_timezone null: true
+               end
+             end
+           end
+          )
+        end
+
+        it 'registers an offense' do
+          expect(cop.offenses.size).to eq(1)
+          expect(cop.offenses.first.message)
+            .to eq('String columns should have a limit constraint. 255 is suggested')
+        end
+      end
+
+      context 'with no string columns' do
+        let(:migration) do
+          %q(
+            class CreateMilestoneReleases < ActiveRecord::Migration[5.2]
+              DOWNTIME = false
+
+              def change
+                create_table :milestone_releases do |t|
+                  t.integer :milestone_id
+                  t.integer :release_id
+                end
+              end
+            end
+          )
+        end
+
+        it 'register no offense' do
+          expect(cop.offenses.size).to eq(0)
+        end
+      end
+    end
+
+    context 'when adding columns' do
+      context 'with string columns with limit' do
+        let(:migration) do
+          %q(
+            class AddEmailToUsers < ActiveRecord::Migration[5.2]
+              DOWNTIME = false
+
+              def change
+                add_column :users, :email, :string, limit: 255
+              end
+            end
+          )
+        end
+
+        it 'registers no offense' do
+          expect(cop.offenses.size).to eq(0)
+        end
+
+        context 'with limit in a different position' do
+          let(:migration) do
+            %q(
+              class AddEmailToUsers < ActiveRecord::Migration[5.2]
+                DOWNTIME = false
+
+                def change
+                  add_column :users, :email, :string, limit: 255, default: 'example@email.com'
+                end
+              end
+            )
+          end
+
+          it 'registers no offense' do
+            expect(cop.offenses.size).to eq(0)
+          end
+        end
+      end
+
+      context 'with string columns with no limit' do
+        let(:migration) do
+          %q(
+            class AddEmailToUsers < ActiveRecord::Migration[5.2]
+              DOWNTIME = false
+
+              def change
+                add_column :users, :email, :string
+              end
+            end
+          )
+        end
+
+        it 'registers offense' do
+          expect(cop.offenses.size).to eq(1)
+          expect(cop.offenses.first.message)
+            .to eq('String columns should have a limit constraint. 255 is suggested')
+        end
+      end
+
+      context 'with no string columns' do
+        let(:migration) do
+          %q(
+            class AddEmailToUsers < ActiveRecord::Migration[5.2]
+              DOWNTIME = false
+
+              def change
+                add_column :users, :active, :boolean, default: false
+              end
+            end
+          )
+        end
+
+        it 'registers no offense' do
+          expect(cop.offenses.size).to eq(0)
+        end
+      end
+    end
+
+    context 'with add_column_with_default' do
+      context 'with a limit' do
+        let(:migration) do
+          %q(
+           class AddRuleTypeToApprovalMergeRequestRules < ActiveRecord::Migration[5.2]
+             DOWNTIME = false
+
+             def change
+               add_column_with_default(:approval_merge_request_rules, :rule_type, :string, limit: 2, default: 1)
+             end
+           end
+           )
+        end
+
+        it 'registers no offense' do
+          expect(cop.offenses.size).to eq(0)
+        end
+      end
+
+      context 'without a limit' do
+        let(:migration) do
+          %q(
+           class AddRuleTypeToApprovalMergeRequestRules < ActiveRecord::Migration[5.2]
+             DOWNTIME = false
+
+             def change
+               add_column_with_default(:approval_merge_request_rules, :rule_type, :string, default: 1)
+             end
+           end
+           )
+        end
+
+        it 'registers an offense' do
+          expect(cop.offenses.size).to eq(1)
+        end
+      end
+    end
+
+    context 'with methods' do
+      let(:migration) do
+        %q(
+          class AddEmailToUsers < ActiveRecord::Migration[5.2]
+            DOWNTIME = false
+
+            def change
+              add_column_if_table_not_exists :users, :first_name, :string, limit: 255
+              search_namespace(user_name)
+            end
+
+            def add_column_if_not_exists(table, name, *args)
+              add_column(table, name, *args) unless column_exists?(table, name)
+            end
+
+            def search_namespace(username)
+               Uniquify.new.string(username) do |str|
+                query = "SELECT id FROM namespaces WHERE parent_id IS NULL AND path='#{str}' LIMIT 1"
+                connection.exec_query(query)
+              end
+            end
+          end
+        )
+      end
+
+      it 'registers no offense' do
+        expect(cop.offenses.size).to eq(0)
+      end
+    end
+  end
+
+  context 'outside of migrations' do
+    let(:active_record_model) do
+      %q(
+      class User < ApplicationRecord
+      end
+      )
+    end
+
+    it 'registers no offense' do
+      inspect_source(active_record_model)
+
+      expect(cop.offenses.size).to eq(0)
+    end
+  end
+end
-- 
cgit v1.2.1


From 6308a450c70e9e6d9804cdd9d346b713adefeb95 Mon Sep 17 00:00:00 2001
From: Achilleas Pipinellis <axil@gitlab.com>
Date: Fri, 23 Aug 2019 21:37:02 +0000
Subject: Fix link to issue template

---
 doc/development/documentation/feature-change-workflow.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/development/documentation/feature-change-workflow.md b/doc/development/documentation/feature-change-workflow.md
index ac93ada5a4b..00c76fe0f1b 100644
--- a/doc/development/documentation/feature-change-workflow.md
+++ b/doc/development/documentation/feature-change-workflow.md
@@ -69,7 +69,7 @@ To follow a consistent workflow every month, documentation changes
 involve the Product Managers, the developer who shipped the feature,
 and the technical writer for the DevOps stage. Each role is described below.
 
-The Documentation items in the GitLab CE/EE [Feature Proposal issue template](https://gitlab.com/gitlab-org/gitlab-ce/raw/template-improvements-for-documentation/.gitlab/issue_templates/Feature%20proposal.md)
+The Documentation items in the GitLab CE/EE [Feature Proposal issue template](https://gitlab.com/gitlab-org/gitlab-ce/raw/master/.gitlab/issue_templates/Feature%20proposal.md)
 and default merge request template will assist you with following this process.
 
 ### Product Manager role
-- 
cgit v1.2.1


From 2515c0cd44db9e14ebea9a9218b05853b9afcaad Mon Sep 17 00:00:00 2001
From: Reuben Pereira <rpereira@gitlab.com>
Date: Fri, 23 Aug 2019 22:27:41 +0000
Subject: Add a link to docs in project description

Add to the service and migration both.
---
 .../self_monitoring/project/create_service.rb      | 219 -----------------
 changelogs/unreleased/56883-migration.yml          |   5 +
 ...7_add_gitlab_instance_administration_project.rb |  16 ++
 ...2_set_self_monitoring_project_alerting_token.rb |  73 ++++++
 .../self_monitoring/project/create_service.rb      | 251 +++++++++++++++++++
 locale/gitlab.pot                                  |  30 +++
 .../self_monitoring/project/create_service_spec.rb | 267 +++++++++++++++++++++
 ..._gitlab_instance_administration_project_spec.rb | 252 +++++++++++++++++++
 .../self_monitoring/project/create_service_spec.rb | 234 ------------------
 spec/support/helpers/stub_configuration.rb         |   4 +
 10 files changed, 898 insertions(+), 453 deletions(-)
 delete mode 100644 app/services/self_monitoring/project/create_service.rb
 create mode 100644 changelogs/unreleased/56883-migration.yml
 create mode 100644 db/post_migrate/20190801072937_add_gitlab_instance_administration_project.rb
 create mode 100644 db/post_migrate/20190809072552_set_self_monitoring_project_alerting_token.rb
 create mode 100644 lib/gitlab/database_importers/self_monitoring/project/create_service.rb
 create mode 100644 spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
 create mode 100644 spec/migrations/add_gitlab_instance_administration_project_spec.rb
 delete mode 100644 spec/services/self_monitoring/project/create_service_spec.rb

diff --git a/app/services/self_monitoring/project/create_service.rb b/app/services/self_monitoring/project/create_service.rb
deleted file mode 100644
index c925c6a1610..00000000000
--- a/app/services/self_monitoring/project/create_service.rb
+++ /dev/null
@@ -1,219 +0,0 @@
-# frozen_string_literal: true
-
-module SelfMonitoring
-  module Project
-    class CreateService < ::BaseService
-      include Stepable
-      include Gitlab::Utils::StrongMemoize
-
-      VISIBILITY_LEVEL = Gitlab::VisibilityLevel::INTERNAL
-      PROJECT_NAME = 'GitLab Instance Administration'
-      PROJECT_DESCRIPTION = <<~HEREDOC
-        This project is automatically generated and will be used to help monitor this GitLab instance.
-      HEREDOC
-
-      GROUP_NAME = 'GitLab Instance Administrators'
-      GROUP_PATH = 'gitlab-instance-administrators'
-
-      steps :validate_admins,
-        :create_group,
-        :create_project,
-        :save_project_id,
-        :add_group_members,
-        :add_to_whitelist,
-        :add_prometheus_manual_configuration
-
-      def initialize
-        super(nil)
-      end
-
-      def execute
-        execute_steps
-      end
-
-      private
-
-      def validate_admins
-        unless instance_admins.any?
-          log_error('No active admin user found')
-          return error('No active admin user found')
-        end
-
-        success
-      end
-
-      def create_group
-        if project_created?
-          log_info(_('Instance administrators group already exists'))
-          @group = application_settings.instance_administration_project.owner
-          return success(group: @group)
-        end
-
-        admin_user = group_owner
-        @group = ::Groups::CreateService.new(admin_user, create_group_params).execute
-
-        if @group.persisted?
-          success(group: @group)
-        else
-          error('Could not create group')
-        end
-      end
-
-      def create_project
-        if project_created?
-          log_info(_('Instance administration project already exists'))
-          @project = application_settings.instance_administration_project
-          return success(project: project)
-        end
-
-        admin_user = group_owner
-        @project = ::Projects::CreateService.new(admin_user, create_project_params).execute
-
-        if project.persisted?
-          success(project: project)
-        else
-          log_error(_("Could not create instance administration project. Errors: %{errors}") % { errors: project.errors.full_messages })
-          error(_('Could not create project'))
-        end
-      end
-
-      def save_project_id
-        return success if project_created?
-
-        result = ApplicationSettings::UpdateService.new(
-          application_settings,
-          group_owner,
-          { instance_administration_project_id: @project.id }
-        ).execute
-
-        if result
-          success
-        else
-          log_error(_("Could not save instance administration project ID, errors: %{errors}") % { errors: application_settings.errors.full_messages })
-          error(_('Could not save project ID'))
-        end
-      end
-
-      def add_group_members
-        members = @group.add_users(group_maintainers, Gitlab::Access::MAINTAINER)
-        errors = members.flat_map { |member| member.errors.full_messages }
-
-        if errors.any?
-          log_error("Could not add admins as members to self-monitoring project. Errors: #{errors}")
-          error('Could not add admins as members')
-        else
-          success
-        end
-      end
-
-      def add_to_whitelist
-        return success unless prometheus_enabled?
-        return success unless prometheus_listen_address.present?
-
-        uri = parse_url(internal_prometheus_listen_address_uri)
-        return error(_('Prometheus listen_address is not a valid URI')) unless uri
-
-        result = ApplicationSettings::UpdateService.new(
-          application_settings,
-          group_owner,
-          add_to_outbound_local_requests_whitelist: [uri.normalized_host]
-        ).execute
-
-        if result
-          success
-        else
-          log_error(_("Could not add prometheus URL to whitelist, errors: %{errors}") % { errors: application_settings.errors.full_messages })
-          error(_('Could not add prometheus URL to whitelist'))
-        end
-      end
-
-      def add_prometheus_manual_configuration
-        return success unless prometheus_enabled?
-        return success unless prometheus_listen_address.present?
-
-        service = project.find_or_initialize_service('prometheus')
-
-        unless service.update(prometheus_service_attributes)
-          log_error("Could not save prometheus manual configuration for self-monitoring project. Errors: #{service.errors.full_messages}")
-          return error('Could not save prometheus manual configuration')
-        end
-
-        success
-      end
-
-      def application_settings
-        strong_memoize(:application_settings) do
-          Gitlab::CurrentSettings.expire_current_application_settings
-          Gitlab::CurrentSettings.current_application_settings
-        end
-      end
-
-      def project_created?
-        application_settings.instance_administration_project.present?
-      end
-
-      def parse_url(uri_string)
-        Addressable::URI.parse(uri_string)
-      rescue Addressable::URI::InvalidURIError, TypeError
-      end
-
-      def prometheus_enabled?
-        Gitlab.config.prometheus.enable
-      rescue Settingslogic::MissingSetting
-        false
-      end
-
-      def prometheus_listen_address
-        Gitlab.config.prometheus.listen_address
-      rescue Settingslogic::MissingSetting
-      end
-
-      def instance_admins
-        @instance_admins ||= User.admins.active
-      end
-
-      def group_owner
-        instance_admins.first
-      end
-
-      def group_maintainers
-        # Exclude the first so that the group_owner is not added again as a member.
-        instance_admins - [group_owner]
-      end
-
-      def create_group_params
-        {
-          name: GROUP_NAME,
-          path: "#{GROUP_PATH}-#{SecureRandom.hex(4)}",
-          visibility_level: VISIBILITY_LEVEL
-        }
-      end
-
-      def create_project_params
-        {
-          initialize_with_readme: true,
-          visibility_level: VISIBILITY_LEVEL,
-          name: PROJECT_NAME,
-          description: PROJECT_DESCRIPTION,
-          namespace_id: @group.id
-        }
-      end
-
-      def internal_prometheus_listen_address_uri
-        if prometheus_listen_address.starts_with?('http')
-          prometheus_listen_address
-        else
-          'http://' + prometheus_listen_address
-        end
-      end
-
-      def prometheus_service_attributes
-        {
-          api_url: internal_prometheus_listen_address_uri,
-          manual_configuration: true,
-          active: true
-        }
-      end
-    end
-  end
-end
diff --git a/changelogs/unreleased/56883-migration.yml b/changelogs/unreleased/56883-migration.yml
new file mode 100644
index 00000000000..d6eb49e62e1
--- /dev/null
+++ b/changelogs/unreleased/56883-migration.yml
@@ -0,0 +1,5 @@
+---
+title: Create a project for self-monitoring the GitLab instance
+merge_request: 31389
+author:
+type: added
diff --git a/db/post_migrate/20190801072937_add_gitlab_instance_administration_project.rb b/db/post_migrate/20190801072937_add_gitlab_instance_administration_project.rb
new file mode 100644
index 00000000000..8b2cf7b3d76
--- /dev/null
+++ b/db/post_migrate/20190801072937_add_gitlab_instance_administration_project.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class AddGitlabInstanceAdministrationProject < ActiveRecord::Migration[5.2]
+  DOWNTIME = false
+
+  def up
+    Gitlab::DatabaseImporters::SelfMonitoring::Project::CreateService.new.execute!
+  end
+
+  def down
+    ApplicationSetting.current_without_cache
+      &.instance_administration_project
+      &.owner
+      &.destroy!
+  end
+end
diff --git a/db/post_migrate/20190809072552_set_self_monitoring_project_alerting_token.rb b/db/post_migrate/20190809072552_set_self_monitoring_project_alerting_token.rb
new file mode 100644
index 00000000000..0c4faebc548
--- /dev/null
+++ b/db/post_migrate/20190809072552_set_self_monitoring_project_alerting_token.rb
@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+class SetSelfMonitoringProjectAlertingToken < ActiveRecord::Migration[5.2]
+  DOWNTIME = false
+
+  module Migratable
+    module Alerting
+      class ProjectAlertingSetting < ApplicationRecord
+        self.table_name = 'project_alerting_settings'
+
+        belongs_to :project
+
+        validates :token, presence: true
+
+        attr_encrypted :token,
+          mode: :per_attribute_iv,
+          key: Settings.attr_encrypted_db_key_base_truncated,
+          algorithm: 'aes-256-gcm'
+
+        before_validation :ensure_token
+
+        private
+
+        def ensure_token
+          self.token ||= generate_token
+        end
+
+        def generate_token
+          SecureRandom.hex
+        end
+      end
+    end
+
+    class Project < ApplicationRecord
+      has_one :alerting_setting, inverse_of: :project, class_name: 'Alerting::ProjectAlertingSetting'
+    end
+
+    class ApplicationSetting < ApplicationRecord
+      self.table_name = 'application_settings'
+
+      belongs_to :instance_administration_project, class_name: 'Project'
+
+      def self.current_without_cache
+        last
+      end
+    end
+  end
+
+  def setup_alertmanager_token(project)
+    return unless License.feature_available?(:prometheus_alerts)
+
+    project.create_alerting_setting!
+  end
+
+  def up
+    Gitlab.ee do
+      project = Migratable::ApplicationSetting.current_without_cache&.instance_administration_project
+
+      if project
+        setup_alertmanager_token(project)
+      end
+    end
+  end
+
+  def down
+    Gitlab.ee do
+      Migratable::ApplicationSetting.current_without_cache
+        &.instance_administration_project
+        &.alerting_setting
+        &.destroy!
+    end
+  end
+end
diff --git a/lib/gitlab/database_importers/self_monitoring/project/create_service.rb b/lib/gitlab/database_importers/self_monitoring/project/create_service.rb
new file mode 100644
index 00000000000..164854e1e1a
--- /dev/null
+++ b/lib/gitlab/database_importers/self_monitoring/project/create_service.rb
@@ -0,0 +1,251 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module DatabaseImporters
+    module SelfMonitoring
+      module Project
+        include Stepable
+
+        class CreateService < ::BaseService
+          include Stepable
+
+          STEPS_ALLOWED_TO_FAIL = [
+            :validate_application_settings, :validate_project_created, :validate_admins
+          ].freeze
+
+          VISIBILITY_LEVEL = Gitlab::VisibilityLevel::INTERNAL
+          PROJECT_NAME = 'GitLab Instance Administration'
+
+          steps :validate_application_settings,
+            :validate_project_created,
+            :validate_admins,
+            :create_group,
+            :create_project,
+            :save_project_id,
+            :add_group_members,
+            :add_to_whitelist,
+            :add_prometheus_manual_configuration
+
+          def initialize
+            super(nil)
+          end
+
+          def execute!
+            result = execute_steps
+
+            if result[:status] == :success
+              result
+            elsif STEPS_ALLOWED_TO_FAIL.include?(result[:failed_step])
+              success
+            else
+              raise StandardError, result[:message]
+            end
+          end
+
+          private
+
+          def validate_application_settings
+            return success if application_settings
+
+            log_error(_('No application_settings found'))
+            error(_('No application_settings found'))
+          end
+
+          def validate_project_created
+            return success unless project_created?
+
+            log_error(_('Project already created'))
+            error(_('Project already created'))
+          end
+
+          def validate_admins
+            unless instance_admins.any?
+              log_error(_('No active admin user found'))
+              return error(_('No active admin user found'))
+            end
+
+            success
+          end
+
+          def create_group
+            if project_created?
+              log_info(_('Instance administrators group already exists'))
+              @group = application_settings.instance_administration_project.owner
+              return success(group: @group)
+            end
+
+            @group = ::Groups::CreateService.new(group_owner, create_group_params).execute
+
+            if @group.persisted?
+              success(group: @group)
+            else
+              error(_('Could not create group'))
+            end
+          end
+
+          def create_project
+            if project_created?
+              log_info(_('Instance administration project already exists'))
+              @project = application_settings.instance_administration_project
+              return success(project: project)
+            end
+
+            @project = ::Projects::CreateService.new(group_owner, create_project_params).execute
+
+            if project.persisted?
+              success(project: project)
+            else
+              log_error(_("Could not create instance administration project. Errors: %{errors}") % { errors: project.errors.full_messages })
+              error(_('Could not create project'))
+            end
+          end
+
+          def save_project_id
+            return success if project_created?
+
+            result = application_settings.update(instance_administration_project_id: @project.id)
+
+            if result
+              success
+            else
+              log_error(_("Could not save instance administration project ID, errors: %{errors}") % { errors: application_settings.errors.full_messages })
+              error(_('Could not save project ID'))
+            end
+          end
+
+          def add_group_members
+            members = @group.add_users(members_to_add, Gitlab::Access::MAINTAINER)
+            errors = members.flat_map { |member| member.errors.full_messages }
+
+            if errors.any?
+              log_error(_('Could not add admins as members to self-monitoring project. Errors: %{errors}') % { errors: errors })
+              error(_('Could not add admins as members'))
+            else
+              success
+            end
+          end
+
+          def add_to_whitelist
+            return success unless prometheus_enabled?
+            return success unless prometheus_listen_address.present?
+
+            uri = parse_url(internal_prometheus_listen_address_uri)
+            return error(_('Prometheus listen_address is not a valid URI')) unless uri
+
+            application_settings.add_to_outbound_local_requests_whitelist([uri.normalized_host])
+            result = application_settings.save
+
+            if result
+              # Expire the Gitlab::CurrentSettings cache after updating the whitelist.
+              # This happens automatically in an after_commit hook, but in migrations,
+              # the after_commit hook only runs at the end of the migration.
+              Gitlab::CurrentSettings.expire_current_application_settings
+              success
+            else
+              log_error(_("Could not add prometheus URL to whitelist, errors: %{errors}") % { errors: application_settings.errors.full_messages })
+              error(_('Could not add prometheus URL to whitelist'))
+            end
+          end
+
+          def add_prometheus_manual_configuration
+            return success unless prometheus_enabled?
+            return success unless prometheus_listen_address.present?
+
+            service = project.find_or_initialize_service('prometheus')
+
+            unless service.update(prometheus_service_attributes)
+              log_error(_('Could not save prometheus manual configuration for self-monitoring project. Errors: %{errors}') % { errors: service.errors.full_messages })
+              return error(_('Could not save prometheus manual configuration'))
+            end
+
+            success
+          end
+
+          def application_settings
+            @application_settings ||= ApplicationSetting.current_without_cache
+          end
+
+          def project_created?
+            application_settings.instance_administration_project.present?
+          end
+
+          def parse_url(uri_string)
+            Addressable::URI.parse(uri_string)
+          rescue Addressable::URI::InvalidURIError, TypeError
+          end
+
+          def prometheus_enabled?
+            Gitlab.config.prometheus.enable
+          rescue Settingslogic::MissingSetting
+            log_error(_('prometheus.enable is not present in gitlab.yml'))
+
+            false
+          end
+
+          def prometheus_listen_address
+            Gitlab.config.prometheus.listen_address
+          rescue Settingslogic::MissingSetting
+            log_error(_('prometheus.listen_address is not present in gitlab.yml'))
+
+            nil
+          end
+
+          def instance_admins
+            @instance_admins ||= User.admins.active
+          end
+
+          def group_owner
+            instance_admins.first
+          end
+
+          def members_to_add
+            # Exclude admins who are already members of group because
+            # `@group.add_users(users)` returns an error if the users parameter contains
+            # users who are already members of the group.
+            instance_admins - @group.members.collect(&:user)
+          end
+
+          def create_group_params
+            {
+              name: 'GitLab Instance Administrators',
+              path: "gitlab-instance-administrators-#{SecureRandom.hex(4)}",
+              visibility_level: VISIBILITY_LEVEL
+            }
+          end
+
+          def docs_path
+            Rails.application.routes.url_helpers.help_page_path(
+              'administration/monitoring/gitlab_instance_administration_project/index'
+            )
+          end
+
+          def create_project_params
+            {
+              initialize_with_readme: true,
+              visibility_level: VISIBILITY_LEVEL,
+              name: PROJECT_NAME,
+              description: "This project is automatically generated and will be used to help monitor this GitLab instance. [More information](#{docs_path})",
+              namespace_id: @group.id
+            }
+          end
+
+          def internal_prometheus_listen_address_uri
+            if prometheus_listen_address.starts_with?('http')
+              prometheus_listen_address
+            else
+              'http://' + prometheus_listen_address
+            end
+          end
+
+          def prometheus_service_attributes
+            {
+              api_url: internal_prometheus_listen_address_uri,
+              manual_configuration: true,
+              active: true
+            }
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index f8cebc22d93..61642fbbd59 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -3353,6 +3353,12 @@ msgstr ""
 msgid "Copy token to clipboard"
 msgstr ""
 
+msgid "Could not add admins as members"
+msgstr ""
+
+msgid "Could not add admins as members to self-monitoring project. Errors: %{errors}"
+msgstr ""
+
 msgid "Could not add prometheus URL to whitelist"
 msgstr ""
 
@@ -3371,6 +3377,9 @@ msgstr ""
 msgid "Could not create Wiki Repository at this time. Please try again later."
 msgstr ""
 
+msgid "Could not create group"
+msgstr ""
+
 msgid "Could not create instance administration project. Errors: %{errors}"
 msgstr ""
 
@@ -3398,6 +3407,12 @@ msgstr ""
 msgid "Could not save project ID"
 msgstr ""
 
+msgid "Could not save prometheus manual configuration"
+msgstr ""
+
+msgid "Could not save prometheus manual configuration for self-monitoring project. Errors: %{errors}"
+msgstr ""
+
 msgid "Coverage"
 msgstr ""
 
@@ -7400,9 +7415,15 @@ msgstr ""
 msgid "No Tag"
 msgstr ""
 
+msgid "No active admin user found"
+msgstr ""
+
 msgid "No activities found"
 msgstr ""
 
+msgid "No application_settings found"
+msgstr ""
+
 msgid "No available namespaces to fork the project."
 msgstr ""
 
@@ -8746,6 +8767,9 @@ msgstr ""
 msgid "Project access must be granted explicitly to each user."
 msgstr ""
 
+msgid "Project already created"
+msgstr ""
+
 msgid "Project and wiki repositories"
 msgstr ""
 
@@ -13961,6 +13985,12 @@ msgstr ""
 msgid "project avatar"
 msgstr ""
 
+msgid "prometheus.enable is not present in gitlab.yml"
+msgstr ""
+
+msgid "prometheus.listen_address is not present in gitlab.yml"
+msgstr ""
+
 msgid "quick actions"
 msgstr ""
 
diff --git a/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb b/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
new file mode 100644
index 00000000000..9bd0d800086
--- /dev/null
+++ b/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
@@ -0,0 +1,267 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::DatabaseImporters::SelfMonitoring::Project::CreateService do
+  describe '#execute' do
+    let(:result) { subject.execute! }
+
+    let(:prometheus_settings) do
+      {
+        enable: true,
+        listen_address: 'localhost:9090'
+      }
+    end
+
+    before do
+      stub_config(prometheus: prometheus_settings)
+    end
+
+    context 'without application_settings' do
+      it 'does not fail' do
+        expect(subject).to receive(:log_error).and_call_original
+        expect(result).to eq(
+          status: :success
+        )
+
+        expect(Project.count).to eq(0)
+        expect(Group.count).to eq(0)
+      end
+    end
+
+    context 'without admin users' do
+      let(:application_setting) { Gitlab::CurrentSettings.current_application_settings }
+
+      before do
+        allow(ApplicationSetting).to receive(:current_without_cache) { application_setting }
+      end
+
+      it 'does not fail' do
+        expect(subject).to receive(:log_error).and_call_original
+        expect(result).to eq(
+          status: :success
+        )
+
+        expect(Project.count).to eq(0)
+        expect(Group.count).to eq(0)
+      end
+    end
+
+    context 'with admin users' do
+      let(:project) { result[:project] }
+      let(:group) { result[:group] }
+      let(:application_setting) { Gitlab::CurrentSettings.current_application_settings }
+
+      let!(:user) { create(:user, :admin) }
+
+      before do
+        allow(ApplicationSetting).to receive(:current_without_cache) { application_setting }
+        application_setting.allow_local_requests_from_web_hooks_and_services = true
+      end
+
+      shared_examples 'has prometheus service' do |listen_address|
+        it do
+          expect(result[:status]).to eq(:success)
+
+          prometheus = project.prometheus_service
+          expect(prometheus).not_to eq(nil)
+          expect(prometheus.api_url).to eq(listen_address)
+          expect(prometheus.active).to eq(true)
+          expect(prometheus.manual_configuration).to eq(true)
+        end
+      end
+
+      it_behaves_like 'has prometheus service', 'http://localhost:9090'
+
+      it 'creates group' do
+        expect(result[:status]).to eq(:success)
+        expect(group).to be_persisted
+        expect(group.name).to eq('GitLab Instance Administrators')
+        expect(group.path).to start_with('gitlab-instance-administrators')
+        expect(group.path.split('-').last.length).to eq(8)
+        expect(group.visibility_level).to eq(described_class::VISIBILITY_LEVEL)
+      end
+
+      it 'creates project with internal visibility' do
+        expect(result[:status]).to eq(:success)
+        expect(project.visibility_level).to eq(Gitlab::VisibilityLevel::INTERNAL)
+        expect(project).to be_persisted
+      end
+
+      it 'creates project with internal visibility even when internal visibility is restricted' do
+        application_setting.restricted_visibility_levels = [Gitlab::VisibilityLevel::INTERNAL]
+
+        expect(result[:status]).to eq(:success)
+        expect(project.visibility_level).to eq(Gitlab::VisibilityLevel::INTERNAL)
+        expect(project).to be_persisted
+      end
+
+      it 'creates project with correct name and description' do
+        path = 'administration/monitoring/gitlab_instance_administration_project/index'
+        docs_path = Rails.application.routes.url_helpers.help_page_path(path)
+
+        expect(result[:status]).to eq(:success)
+        expect(project.name).to eq(described_class::PROJECT_NAME)
+        expect(project.description).to eq(
+          'This project is automatically generated and will be used to help monitor this GitLab instance. ' \
+          "[More information](#{docs_path})"
+        )
+        expect(File).to exist("doc/#{path}.md")
+      end
+
+      it 'adds all admins as maintainers' do
+        admin1 = create(:user, :admin)
+        admin2 = create(:user, :admin)
+        create(:user)
+
+        expect(result[:status]).to eq(:success)
+        expect(project.owner).to eq(group)
+        expect(group.members.collect(&:user)).to contain_exactly(user, admin1, admin2)
+        expect(group.members.collect(&:access_level)).to contain_exactly(
+          Gitlab::Access::OWNER,
+          Gitlab::Access::MAINTAINER,
+          Gitlab::Access::MAINTAINER
+        )
+      end
+
+      it 'saves the project id' do
+        expect(result[:status]).to eq(:success)
+        expect(application_setting.instance_administration_project_id).to eq(project.id)
+      end
+
+      it 'returns error when saving project ID fails' do
+        allow(application_setting).to receive(:update) { false }
+
+        expect { result }.to raise_error(StandardError, 'Could not save project ID')
+      end
+
+      context 'when project already exists' do
+        let(:existing_group) { create(:group) }
+        let(:existing_project) { create(:project, namespace: existing_group) }
+
+        before do
+          admin1 = create(:user, :admin)
+          admin2 = create(:user, :admin)
+
+          existing_group.add_owner(user)
+          existing_group.add_users([admin1, admin2], Gitlab::Access::MAINTAINER)
+
+          application_setting.instance_administration_project_id = existing_project.id
+        end
+
+        it 'does not fail' do
+          expect(subject).to receive(:log_error).and_call_original
+          expect(result[:status]).to eq(:success)
+
+          expect(Project.count).to eq(1)
+          expect(Group.count).to eq(1)
+        end
+      end
+
+      context 'when local requests from hooks and services are not allowed' do
+        before do
+          application_setting.allow_local_requests_from_web_hooks_and_services = false
+        end
+
+        it_behaves_like 'has prometheus service', 'http://localhost:9090'
+
+        it 'does not overwrite the existing whitelist' do
+          application_setting.outbound_local_requests_whitelist = ['example.com']
+
+          expect(result[:status]).to eq(:success)
+          expect(application_setting.outbound_local_requests_whitelist).to contain_exactly(
+            'example.com', 'localhost'
+          )
+        end
+      end
+
+      context 'with non default prometheus address' do
+        let(:prometheus_settings) do
+          {
+            enable: true,
+            listen_address: 'https://localhost:9090'
+          }
+        end
+
+        it_behaves_like 'has prometheus service', 'https://localhost:9090'
+      end
+
+      context 'when prometheus setting is not present in gitlab.yml' do
+        before do
+          allow(Gitlab.config).to receive(:prometheus).and_raise(Settingslogic::MissingSetting)
+        end
+
+        it 'does not fail' do
+          expect(result).to include(status: :success)
+          expect(project.prometheus_service).to be_nil
+        end
+      end
+
+      context 'when prometheus setting is disabled in gitlab.yml' do
+        let(:prometheus_settings) do
+          {
+            enable: false,
+            listen_address: 'http://localhost:9090'
+          }
+        end
+
+        it 'does not configure prometheus' do
+          expect(result).to include(status: :success)
+          expect(project.prometheus_service).to be_nil
+        end
+      end
+
+      context 'when prometheus listen address is blank in gitlab.yml' do
+        let(:prometheus_settings) { { enable: true, listen_address: '' } }
+
+        it 'does not configure prometheus' do
+          expect(result).to include(status: :success)
+          expect(project.prometheus_service).to be_nil
+        end
+      end
+
+      context 'when project cannot be created' do
+        let(:project) { build(:project) }
+
+        before do
+          project.errors.add(:base, "Test error")
+
+          expect_next_instance_of(::Projects::CreateService) do |project_create_service|
+            expect(project_create_service).to receive(:execute)
+              .and_return(project)
+          end
+        end
+
+        it 'returns error' do
+          expect(subject).to receive(:log_error).and_call_original
+          expect { result }.to raise_error(StandardError, 'Could not create project')
+        end
+      end
+
+      context 'when user cannot be added to project' do
+        before do
+          subject.instance_variable_set(:@instance_admins, [user, build(:user, :admin)])
+        end
+
+        it 'returns error' do
+          expect(subject).to receive(:log_error).and_call_original
+          expect { result }.to raise_error(StandardError, 'Could not add admins as members')
+        end
+      end
+
+      context 'when prometheus manual configuration cannot be saved' do
+        let(:prometheus_settings) do
+          {
+            enable: true,
+            listen_address: 'httpinvalid://localhost:9090'
+          }
+        end
+
+        it 'returns error' do
+          expect(subject).to receive(:log_error).and_call_original
+          expect { result }.to raise_error(StandardError, 'Could not save prometheus manual configuration')
+        end
+      end
+    end
+  end
+end
diff --git a/spec/migrations/add_gitlab_instance_administration_project_spec.rb b/spec/migrations/add_gitlab_instance_administration_project_spec.rb
new file mode 100644
index 00000000000..08e20a4e8ff
--- /dev/null
+++ b/spec/migrations/add_gitlab_instance_administration_project_spec.rb
@@ -0,0 +1,252 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require Rails.root.join('db', 'post_migrate', '20190801072937_add_gitlab_instance_administration_project.rb')
+
+describe AddGitlabInstanceAdministrationProject, :migration do
+  let(:application_settings) { table(:application_settings) }
+  let(:users)                { table(:users) }
+  let(:projects)             { table(:projects) }
+  let(:namespaces)           { table(:namespaces) }
+  let(:members)              { table(:members) }
+
+  let(:service_class) do
+    Gitlab::DatabaseImporters::SelfMonitoring::Project::CreateService
+  end
+
+  let(:prometheus_settings) do
+    {
+      enable: true,
+      listen_address: 'localhost:9090'
+    }
+  end
+
+  before do
+    stub_env('IN_MEMORY_APPLICATION_SETTINGS', 'false')
+
+    stub_config(prometheus: prometheus_settings)
+  end
+
+  describe 'down' do
+    let!(:application_setting) { application_settings.create! }
+    let!(:user) { users.create!(admin: true, email: 'admin1@example.com', projects_limit: 10, state: :active) }
+
+    it 'deletes group and project' do
+      migrate!
+
+      expect(Project.count).to eq(1)
+      expect(Group.count).to eq(1)
+
+      schema_migrate_down!
+
+      expect(Project.count).to eq(0)
+      expect(Group.count).to eq(0)
+    end
+  end
+
+  describe 'up' do
+    context 'without application_settings' do
+      it 'does not fail' do
+        migrate!
+
+        expect(Project.count).to eq(0)
+      end
+    end
+
+    context 'without admin users' do
+      let!(:application_setting) { application_settings.create! }
+
+      it 'does not fail' do
+        migrate!
+
+        expect(Project.count).to eq(0)
+      end
+    end
+
+    context 'with admin users' do
+      let(:project) { Project.last }
+      let(:group) { Group.last }
+      let!(:application_setting) { application_settings.create! }
+      let!(:user) { users.create!(admin: true, email: 'admin1@example.com', projects_limit: 10, state: :active) }
+
+      before do
+        stub_application_setting(allow_local_requests_from_web_hooks_and_services: true)
+      end
+
+      shared_examples 'has prometheus service' do |listen_address|
+        it do
+          migrate!
+
+          prometheus = project.prometheus_service
+          expect(prometheus).to be_persisted
+          expect(prometheus).not_to eq(nil)
+          expect(prometheus.api_url).to eq(listen_address)
+          expect(prometheus.active).to eq(true)
+          expect(prometheus.manual_configuration).to eq(true)
+        end
+      end
+
+      it_behaves_like 'has prometheus service', 'http://localhost:9090'
+
+      it 'creates GitLab Instance Administrator group' do
+        migrate!
+
+        expect(group).to be_persisted
+        expect(group.name).to eq('GitLab Instance Administrators')
+        expect(group.path).to start_with('gitlab-instance-administrators')
+        expect(group.path.split('-').last.length).to eq(8)
+        expect(group.visibility_level).to eq(service_class::VISIBILITY_LEVEL)
+      end
+
+      it 'creates project with internal visibility' do
+        migrate!
+
+        expect(project.visibility_level).to eq(Gitlab::VisibilityLevel::INTERNAL)
+        expect(project).to be_persisted
+      end
+
+      it 'creates project with correct name and description' do
+        migrate!
+
+        path = 'administration/monitoring/gitlab_instance_administration_project/index'
+        docs_path = Rails.application.routes.url_helpers.help_page_path(path)
+
+        expect(project.name).to eq(service_class::PROJECT_NAME)
+        expect(project.description).to eq(
+          'This project is automatically generated and will be used to help monitor this GitLab instance. ' \
+          "[More information](#{docs_path})"
+        )
+        expect(File).to exist("doc/#{path}.md")
+      end
+
+      it 'adds all admins as maintainers' do
+        admin1 = users.create!(admin: true, email: 'admin2@example.com', projects_limit: 10, state: :active)
+        admin2 = users.create!(admin: true, email: 'admin3@example.com', projects_limit: 10, state: :active)
+        users.create!(email: 'nonadmin1@example.com', projects_limit: 10, state: :active)
+
+        migrate!
+
+        expect(project.owner).to eq(group)
+        expect(group.members.collect(&:user).collect(&:id)).to contain_exactly(user.id, admin1.id, admin2.id)
+        expect(group.members.collect(&:access_level)).to contain_exactly(
+          Gitlab::Access::OWNER,
+          Gitlab::Access::MAINTAINER,
+          Gitlab::Access::MAINTAINER
+        )
+      end
+
+      it 'saves the project id' do
+        migrate!
+
+        application_setting.reload
+        expect(application_setting.instance_administration_project_id).to eq(project.id)
+      end
+
+      it 'does not fail when a project already exists' do
+        group = namespaces.create!(
+          path: 'gitlab-instance-administrators',
+          name: 'GitLab Instance Administrators',
+          type: 'Group'
+        )
+        project = projects.create!(
+          namespace_id: group.id,
+          name: 'GitLab Instance Administration'
+        )
+
+        admin1 = users.create!(admin: true, email: 'admin4@example.com', projects_limit: 10, state: :active)
+        admin2 = users.create!(admin: true, email: 'admin5@example.com', projects_limit: 10, state: :active)
+
+        members.create!(
+          user_id: admin1.id,
+          source_id: group.id,
+          source_type: 'Namespace',
+          type: 'GroupMember',
+          access_level: GroupMember::MAINTAINER,
+          notification_level: NotificationSetting.levels[:global]
+        )
+        members.create!(
+          user_id: admin2.id,
+          source_id: group.id,
+          source_type: 'Namespace',
+          type: 'GroupMember',
+          access_level: GroupMember::MAINTAINER,
+          notification_level: NotificationSetting.levels[:global]
+        )
+
+        stub_application_setting(instance_administration_project: project)
+
+        migrate!
+
+        expect(Project.last.id).to eq(project.id)
+        expect(Group.last.id).to eq(group.id)
+      end
+
+      context 'when local requests from hooks and services are not allowed' do
+        before do
+          stub_application_setting(allow_local_requests_from_web_hooks_and_services: false)
+        end
+
+        it_behaves_like 'has prometheus service', 'http://localhost:9090'
+
+        it 'does not overwrite the existing whitelist' do
+          application_setting.update!(outbound_local_requests_whitelist: ['example.com'])
+
+          migrate!
+
+          application_setting.reload
+          expect(application_setting.outbound_local_requests_whitelist).to contain_exactly(
+            'example.com', 'localhost'
+          )
+        end
+      end
+
+      context 'with non default prometheus address' do
+        let(:prometheus_settings) do
+          {
+            enable: true,
+            listen_address: 'https://localhost:9090'
+          }
+        end
+
+        it_behaves_like 'has prometheus service', 'https://localhost:9090'
+      end
+
+      context 'when prometheus setting is not present in gitlab.yml' do
+        before do
+          allow(Gitlab.config).to receive(:prometheus).and_raise(Settingslogic::MissingSetting)
+        end
+
+        it 'does not fail' do
+          migrate!
+
+          expect(project.prometheus_service).to be_nil
+        end
+      end
+
+      context 'when prometheus setting is disabled in gitlab.yml' do
+        let(:prometheus_settings) do
+          {
+            enable: false,
+            listen_address: 'localhost:9090'
+          }
+        end
+
+        it 'does not configure prometheus' do
+          migrate!
+
+          expect(project.prometheus_service).to be_nil
+        end
+      end
+
+      context 'when prometheus listen address is blank in gitlab.yml' do
+        let(:prometheus_settings) { { enable: true, listen_address: '' } }
+
+        it 'does not configure prometheus' do
+          migrate!
+
+          expect(project.prometheus_service).to be_nil
+        end
+      end
+    end
+  end
+end
diff --git a/spec/services/self_monitoring/project/create_service_spec.rb b/spec/services/self_monitoring/project/create_service_spec.rb
deleted file mode 100644
index def20448bd9..00000000000
--- a/spec/services/self_monitoring/project/create_service_spec.rb
+++ /dev/null
@@ -1,234 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-describe SelfMonitoring::Project::CreateService do
-  describe '#execute' do
-    let(:result) { subject.execute }
-
-    let(:prometheus_settings) do
-      OpenStruct.new(
-        enable: true,
-        listen_address: 'localhost:9090'
-      )
-    end
-
-    before do
-      allow(Gitlab.config).to receive(:prometheus).and_return(prometheus_settings)
-    end
-
-    context 'without admin users' do
-      it 'returns error' do
-        expect(subject).to receive(:log_error).and_call_original
-        expect(result).to eq(
-          status: :error,
-          message: 'No active admin user found',
-          failed_step: :validate_admins
-        )
-      end
-    end
-
-    context 'with admin users' do
-      let(:project) { result[:project] }
-      let(:group) { result[:group] }
-      let(:application_setting) { Gitlab::CurrentSettings.current_application_settings }
-
-      let!(:user) { create(:user, :admin) }
-
-      before do
-        application_setting.allow_local_requests_from_web_hooks_and_services = true
-      end
-
-      shared_examples 'has prometheus service' do |listen_address|
-        it do
-          expect(result[:status]).to eq(:success)
-
-          prometheus = project.prometheus_service
-          expect(prometheus).not_to eq(nil)
-          expect(prometheus.api_url).to eq(listen_address)
-          expect(prometheus.active).to eq(true)
-          expect(prometheus.manual_configuration).to eq(true)
-        end
-      end
-
-      it_behaves_like 'has prometheus service', 'http://localhost:9090'
-
-      it 'creates group' do
-        expect(result[:status]).to eq(:success)
-        expect(group).to be_persisted
-        expect(group.name).to eq(described_class::GROUP_NAME)
-        expect(group.path).to start_with(described_class::GROUP_PATH)
-        expect(group.path.split('-').last.length).to eq(8)
-        expect(group.visibility_level).to eq(described_class::VISIBILITY_LEVEL)
-      end
-
-      it 'creates project with internal visibility' do
-        expect(result[:status]).to eq(:success)
-        expect(project.visibility_level).to eq(Gitlab::VisibilityLevel::INTERNAL)
-        expect(project).to be_persisted
-      end
-
-      it 'creates project with internal visibility even when internal visibility is restricted' do
-        application_setting.restricted_visibility_levels = [Gitlab::VisibilityLevel::INTERNAL]
-
-        expect(result[:status]).to eq(:success)
-        expect(project.visibility_level).to eq(Gitlab::VisibilityLevel::INTERNAL)
-        expect(project).to be_persisted
-      end
-
-      it 'creates project with correct name and description' do
-        expect(result[:status]).to eq(:success)
-        expect(project.name).to eq(described_class::PROJECT_NAME)
-        expect(project.description).to eq(described_class::PROJECT_DESCRIPTION)
-      end
-
-      it 'adds all admins as maintainers' do
-        admin1 = create(:user, :admin)
-        admin2 = create(:user, :admin)
-        create(:user)
-
-        expect(result[:status]).to eq(:success)
-        expect(project.owner).to eq(group)
-        expect(group.members.collect(&:user)).to contain_exactly(user, admin1, admin2)
-        expect(group.members.collect(&:access_level)).to contain_exactly(
-          Gitlab::Access::OWNER,
-          Gitlab::Access::MAINTAINER,
-          Gitlab::Access::MAINTAINER
-        )
-      end
-
-      it 'saves the project id' do
-        expect(result[:status]).to eq(:success)
-        expect(application_setting.instance_administration_project_id).to eq(project.id)
-      end
-
-      it 'returns error when saving project ID fails' do
-        allow(application_setting).to receive(:update) { false }
-
-        expect(result[:status]).to eq(:error)
-        expect(result[:failed_step]).to eq(:save_project_id)
-        expect(result[:message]).to eq('Could not save project ID')
-      end
-
-      it 'does not fail when a project already exists' do
-        expect(result[:status]).to eq(:success)
-
-        second_result = subject.execute
-
-        expect(second_result[:status]).to eq(:success)
-        expect(second_result[:project]).to eq(project)
-        expect(second_result[:group]).to eq(group)
-      end
-
-      context 'when local requests from hooks and services are not allowed' do
-        before do
-          application_setting.allow_local_requests_from_web_hooks_and_services = false
-        end
-
-        it_behaves_like 'has prometheus service', 'http://localhost:9090'
-
-        it 'does not overwrite the existing whitelist' do
-          application_setting.outbound_local_requests_whitelist = ['example.com']
-
-          expect(result[:status]).to eq(:success)
-          expect(application_setting.outbound_local_requests_whitelist).to contain_exactly(
-            'example.com', 'localhost'
-          )
-        end
-      end
-
-      context 'with non default prometheus address' do
-        before do
-          prometheus_settings.listen_address = 'https://localhost:9090'
-        end
-
-        it_behaves_like 'has prometheus service', 'https://localhost:9090'
-      end
-
-      context 'when prometheus setting is not present in gitlab.yml' do
-        before do
-          allow(Gitlab.config).to receive(:prometheus).and_raise(Settingslogic::MissingSetting)
-        end
-
-        it 'does not fail' do
-          expect(result).to include(status: :success)
-          expect(project.prometheus_service).to be_nil
-        end
-      end
-
-      context 'when prometheus setting is disabled in gitlab.yml' do
-        before do
-          prometheus_settings.enable = false
-        end
-
-        it 'does not configure prometheus' do
-          expect(result).to include(status: :success)
-          expect(project.prometheus_service).to be_nil
-        end
-      end
-
-      context 'when prometheus listen address is blank in gitlab.yml' do
-        before do
-          prometheus_settings.listen_address = ''
-        end
-
-        it 'does not configure prometheus' do
-          expect(result).to include(status: :success)
-          expect(project.prometheus_service).to be_nil
-        end
-      end
-
-      context 'when project cannot be created' do
-        let(:project) { build(:project) }
-
-        before do
-          project.errors.add(:base, "Test error")
-
-          expect_next_instance_of(::Projects::CreateService) do |project_create_service|
-            expect(project_create_service).to receive(:execute)
-              .and_return(project)
-          end
-        end
-
-        it 'returns error' do
-          expect(subject).to receive(:log_error).and_call_original
-          expect(result).to eq({
-            status: :error,
-            message: 'Could not create project',
-            failed_step: :create_project
-          })
-        end
-      end
-
-      context 'when user cannot be added to project' do
-        before do
-          subject.instance_variable_set(:@instance_admins, [user, build(:user, :admin)])
-        end
-
-        it 'returns error' do
-          expect(subject).to receive(:log_error).and_call_original
-          expect(result).to eq({
-            status: :error,
-            message: 'Could not add admins as members',
-            failed_step: :add_group_members
-          })
-        end
-      end
-
-      context 'when prometheus manual configuration cannot be saved' do
-        before do
-          prometheus_settings.listen_address = 'httpinvalid://localhost:9090'
-        end
-
-        it 'returns error' do
-          expect(subject).to receive(:log_error).and_call_original
-          expect(result).to eq(
-            status: :error,
-            message: 'Could not save prometheus manual configuration',
-            failed_step: :add_prometheus_manual_configuration
-          )
-        end
-      end
-    end
-  end
-end
diff --git a/spec/support/helpers/stub_configuration.rb b/spec/support/helpers/stub_configuration.rb
index c8b2bf040e6..dec7898d8d2 100644
--- a/spec/support/helpers/stub_configuration.rb
+++ b/spec/support/helpers/stub_configuration.rb
@@ -30,6 +30,10 @@ module StubConfiguration
     allow(Gitlab.config.gitlab).to receive_messages(to_settings(messages))
   end
 
+  def stub_config(messages)
+    allow(Gitlab.config).to receive_messages(to_settings(messages))
+  end
+
   def stub_default_url_options(host: "localhost", protocol: "http")
     url_options = { host: host, protocol: protocol }
     allow(Rails.application.routes).to receive(:default_url_options).and_return(url_options)
-- 
cgit v1.2.1


From 599cc49973d540b59316dcdd8de157a9ca24b814 Mon Sep 17 00:00:00 2001
From: Reuben Pereira <rpereira@gitlab.com>
Date: Sat, 24 Aug 2019 04:20:29 +0000
Subject: Drop existing trigger before creating new one

- When renaming a column concurrently, drop any existing trigger before
attempting to create a new one.

When running migration specs multiple times (as it happens during
local development), the down method of previous migrations are called.
If any of the called methods contains a call to
rename_column_concurrently, a trigger will be created and not removed.
So, the next time a migration spec is run, if the same down method is
executed again, it will cause an error when attempting to create the
trigger (since it already exists). Dropping the trigger if it already
exists will prevent this problem.
---
 lib/gitlab/database/migration_helpers.rb           | 5 +++++
 spec/lib/gitlab/database/migration_helpers_spec.rb | 8 ++++++++
 2 files changed, 13 insertions(+)

diff --git a/lib/gitlab/database/migration_helpers.rb b/lib/gitlab/database/migration_helpers.rb
index 9bba4f6ce1e..8bc45f6e78c 100644
--- a/lib/gitlab/database/migration_helpers.rb
+++ b/lib/gitlab/database/migration_helpers.rb
@@ -746,6 +746,11 @@ module Gitlab
         VOLATILE
         EOF
 
+        execute <<-EOF.strip_heredoc
+        DROP TRIGGER IF EXISTS #{trigger}
+        ON #{table}
+        EOF
+
         execute <<-EOF.strip_heredoc
         CREATE TRIGGER #{trigger}
         BEFORE INSERT OR UPDATE
diff --git a/spec/lib/gitlab/database/migration_helpers_spec.rb b/spec/lib/gitlab/database/migration_helpers_spec.rb
index 2731fc8573f..fe44b09aa24 100644
--- a/spec/lib/gitlab/database/migration_helpers_spec.rb
+++ b/spec/lib/gitlab/database/migration_helpers_spec.rb
@@ -618,11 +618,19 @@ describe Gitlab::Database::MigrationHelpers do
       expect(model).to receive(:execute)
         .with(/CREATE OR REPLACE FUNCTION foo()/m)
 
+      expect(model).to receive(:execute)
+        .with(/DROP TRIGGER IF EXISTS foo/m)
+
       expect(model).to receive(:execute)
         .with(/CREATE TRIGGER foo/m)
 
       model.install_rename_triggers_for_postgresql('foo', :users, :old, :new)
     end
+
+    it 'does not fail if trigger already exists' do
+      model.install_rename_triggers_for_postgresql('foo', :users, :old, :new)
+      model.install_rename_triggers_for_postgresql('foo', :users, :old, :new)
+    end
   end
 
   describe '#remove_rename_triggers_for_postgresql' do
-- 
cgit v1.2.1


From 440635015fbea129cbfd7b266589ea2a33dda471 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Fri, 23 Aug 2019 16:38:01 -0700
Subject: Fix N+1 Gitaly calls in /api/v4/projects/:id/issues

This is a follow-up from
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/31938.

In GitLab 9.0,
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/9661 removed the
`subscribed` flag from the API when the user requested a list of issues
or merge requests since calculating this value triggers extensive
Markdown processing.

In GitLab 12.0 via a4fbf39e, we accidentally reintroduced this
performance regression by changing `IssueBasic` to `Issue` in
`entities.rb`. This showed up as a Gitaly N+1 issue since the Markdown
processing would attempt to extract a commit if it detected a regex that
matched a commit.

We restore the prior behavior by once again removing the `subscribed`
flag for the bulk list of issues and merge requests and add a test to
ensure they aren't reintroduced.

Relates to https://gitlab.com/gitlab-org/gitlab-ce/issues/66202
---
 changelogs/unreleased/sh-fix-nplusone-issues.yml    | 5 +++++
 doc/api/issues.md                                   | 1 -
 lib/api/issues.rb                                   | 3 ++-
 spec/requests/api/issues/get_project_issues_spec.rb | 8 ++++++++
 4 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/sh-fix-nplusone-issues.yml

diff --git a/changelogs/unreleased/sh-fix-nplusone-issues.yml b/changelogs/unreleased/sh-fix-nplusone-issues.yml
new file mode 100644
index 00000000000..f749b5eeb40
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-nplusone-issues.yml
@@ -0,0 +1,5 @@
+---
+title: Fix N+1 Gitaly calls in /api/v4/projects/:id/issues
+merge_request: 32171
+author:
+type: performance
diff --git a/doc/api/issues.md b/doc/api/issues.md
index 8313dd2c3bd..cadc9291489 100644
--- a/doc/api/issues.md
+++ b/doc/api/issues.md
@@ -284,7 +284,6 @@ Example response:
          "award_emoji":"http://example.com/api/v4/projects/4/issues/41/award_emoji",
          "project":"http://example.com/api/v4/projects/4"
       },
-      "subscribed": false,
       "task_completion_status":{
          "count":0,
          "completed_count":0
diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index e16eeef202c..215178478d0 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -163,7 +163,8 @@ module API
           with_labels_details: declared_params[:with_labels_details],
           current_user: current_user,
           project: user_project,
-          issuable_metadata: issuable_meta_data(issues, 'Issue', current_user)
+          issuable_metadata: issuable_meta_data(issues, 'Issue', current_user),
+          include_subscribed: false
         }
 
         present issues, options
diff --git a/spec/requests/api/issues/get_project_issues_spec.rb b/spec/requests/api/issues/get_project_issues_spec.rb
index 521d6b88734..b7aa3f93451 100644
--- a/spec/requests/api/issues/get_project_issues_spec.rb
+++ b/spec/requests/api/issues/get_project_issues_spec.rb
@@ -446,6 +446,14 @@ describe API::Issues do
       expect_paginated_array_response([closed_issue.id, confidential_issue.id, issue.id])
     end
 
+    it 'exposes known attributes' do
+      get api("#{base_url}/issues", user)
+
+      expect(response).to have_gitlab_http_status(200)
+      expect(json_response.last.keys).to include(*%w(id iid project_id title description))
+      expect(json_response.last).not_to have_key('subscribed')
+    end
+
     context 'issues_statistics' do
       context 'no state is treated as all state' do
         let(:params) { {} }
-- 
cgit v1.2.1


From ad05e488636ebe05b4985dbf3c7d912fd8d56f49 Mon Sep 17 00:00:00 2001
From: Brett Walker <bwalker@gitlab.com>
Date: Wed, 20 Feb 2019 17:51:55 -0600
Subject: Add support for using a Camo proxy server

User images and videos will get proxied through
the Camo server in order to keep malicious
sites from collecting the IP address of users.
---
 app/helpers/application_settings_helper.rb         |  4 +
 app/models/application_setting.rb                  | 18 ++++
 app/models/application_setting_implementation.rb   | 27 ++++--
 .../application_settings/update_service.rb         | 15 +++-
 .../unreleased/security-enable-image-proxy.yml     |  5 ++
 config/initializers/asset_proxy_settings.rb        |  6 ++
 config/initializers/fill_shards.rb                 |  4 +-
 .../20190219201635_add_asset_proxy_settings.rb     | 16 ++++
 db/schema.rb                                       |  5 ++
 doc/api/settings.md                                | 10 +++
 doc/security/README.md                             |  1 +
 doc/security/asset_proxy.md                        | 28 +++++++
 lib/api/entities.rb                                |  3 +
 lib/api/settings.rb                                |  6 +-
 .../validations/types/comma_separated_to_array.rb  | 22 +++++
 lib/banzai/filter/asset_proxy_filter.rb            | 62 ++++++++++++++
 lib/banzai/filter/external_link_filter.rb          | 18 +++-
 lib/banzai/filter/image_link_filter.rb             |  3 +
 lib/banzai/filter/video_link_filter.rb             | 15 ++++
 lib/banzai/pipeline/ascii_doc_pipeline.rb          |  5 ++
 lib/banzai/pipeline/gfm_pipeline.rb                |  3 +-
 lib/banzai/pipeline/markup_pipeline.rb             |  5 ++
 lib/banzai/pipeline/single_line_pipeline.rb        |  3 +
 spec/initializers/asset_proxy_setting_spec.rb      | 13 +++
 spec/lib/banzai/filter/asset_proxy_filter_spec.rb  | 95 ++++++++++++++++++++++
 .../lib/banzai/filter/external_link_filter_spec.rb | 12 +++
 spec/lib/banzai/filter/image_link_filter_spec.rb   |  7 ++
 spec/lib/banzai/filter/video_link_filter_spec.rb   | 22 +++++
 spec/lib/banzai/pipeline/gfm_pipeline_spec.rb      | 44 ++++++++++
 spec/models/application_setting_spec.rb            | 65 +++++++++++++++
 spec/requests/api/settings_spec.rb                 | 28 +++++++
 .../application_settings/update_service_spec.rb    | 33 ++++++++
 spec/support/helpers/stub_configuration.rb         |  4 +
 33 files changed, 591 insertions(+), 16 deletions(-)
 create mode 100644 changelogs/unreleased/security-enable-image-proxy.yml
 create mode 100644 config/initializers/asset_proxy_settings.rb
 create mode 100644 db/migrate/20190219201635_add_asset_proxy_settings.rb
 create mode 100644 doc/security/asset_proxy.md
 create mode 100644 lib/api/validations/types/comma_separated_to_array.rb
 create mode 100644 lib/banzai/filter/asset_proxy_filter.rb
 create mode 100644 spec/initializers/asset_proxy_setting_spec.rb
 create mode 100644 spec/lib/banzai/filter/asset_proxy_filter_spec.rb

diff --git a/app/helpers/application_settings_helper.rb b/app/helpers/application_settings_helper.rb
index 0ab19f1d2d2..c2d7350ce12 100644
--- a/app/helpers/application_settings_helper.rb
+++ b/app/helpers/application_settings_helper.rb
@@ -164,6 +164,10 @@ module ApplicationSettingsHelper
       :allow_local_requests_from_system_hooks,
       :dns_rebinding_protection_enabled,
       :archive_builds_in_human_readable,
+      :asset_proxy_enabled,
+      :asset_proxy_secret_key,
+      :asset_proxy_url,
+      :asset_proxy_whitelist,
       :authorized_keys_enabled,
       :auto_devops_enabled,
       :auto_devops_domain,
diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb
index 2a99c6e5c59..92004b92647 100644
--- a/app/models/application_setting.rb
+++ b/app/models/application_setting.rb
@@ -18,12 +18,19 @@ class ApplicationSetting < ApplicationRecord
   # fix a lot of tests using allow_any_instance_of
   include ApplicationSettingImplementation
 
+  attr_encrypted :asset_proxy_secret_key,
+                 mode: :per_attribute_iv,
+                 insecure_mode: true,
+                 key: Settings.attr_encrypted_db_key_base_truncated,
+                 algorithm: 'aes-256-cbc'
+
   serialize :restricted_visibility_levels # rubocop:disable Cop/ActiveRecordSerialize
   serialize :import_sources # rubocop:disable Cop/ActiveRecordSerialize
   serialize :disabled_oauth_sign_in_sources, Array # rubocop:disable Cop/ActiveRecordSerialize
   serialize :domain_whitelist, Array # rubocop:disable Cop/ActiveRecordSerialize
   serialize :domain_blacklist, Array # rubocop:disable Cop/ActiveRecordSerialize
   serialize :repository_storages # rubocop:disable Cop/ActiveRecordSerialize
+  serialize :asset_proxy_whitelist, Array # rubocop:disable Cop/ActiveRecordSerialize
 
   ignore_column :koding_url
   ignore_column :koding_enabled
@@ -192,6 +199,17 @@ class ApplicationSetting < ApplicationRecord
             allow_nil: true,
             numericality: { only_integer: true, greater_than_or_equal_to: 0, less_than: 65536 }
 
+  validates :asset_proxy_url,
+            presence: true,
+            allow_blank: false,
+            url: true,
+            if: :asset_proxy_enabled?
+
+  validates :asset_proxy_secret_key,
+            presence: true,
+            allow_blank: false,
+            if: :asset_proxy_enabled?
+
   SUPPORTED_KEY_TYPES.each do |type|
     validates :"#{type}_key_restriction", presence: true, key_restriction: { type: type }
   end
diff --git a/app/models/application_setting_implementation.rb b/app/models/application_setting_implementation.rb
index 55ac1e129cf..a6dd9986e23 100644
--- a/app/models/application_setting_implementation.rb
+++ b/app/models/application_setting_implementation.rb
@@ -23,8 +23,9 @@ module ApplicationSettingImplementation
         akismet_enabled: false,
         allow_local_requests_from_web_hooks_and_services: false,
         allow_local_requests_from_system_hooks: true,
-        dns_rebinding_protection_enabled: true,
+        asset_proxy_enabled: false,
         authorized_keys_enabled: true, # TODO default to false if the instance is configured to use AuthorizedKeysCommand
+        commit_email_hostname: default_commit_email_hostname,
         container_registry_token_expire_delay: 5,
         default_artifacts_expire_in: '30 days',
         default_branch_protection: Settings.gitlab['default_branch_protection'],
@@ -33,7 +34,9 @@ module ApplicationSettingImplementation
         default_project_visibility: Settings.gitlab.default_projects_features['visibility_level'],
         default_projects_limit: Settings.gitlab['default_projects_limit'],
         default_snippet_visibility: Settings.gitlab.default_projects_features['visibility_level'],
+        diff_max_patch_bytes: Gitlab::Git::Diff::DEFAULT_MAX_PATCH_BYTES,
         disabled_oauth_sign_in_sources: [],
+        dns_rebinding_protection_enabled: true,
         domain_whitelist: Settings.gitlab['domain_whitelist'],
         dsa_key_restriction: 0,
         ecdsa_key_restriction: 0,
@@ -52,9 +55,11 @@ module ApplicationSettingImplementation
         housekeeping_gc_period: 200,
         housekeeping_incremental_repack_period: 10,
         import_sources: Settings.gitlab['import_sources'],
+        local_markdown_version: 0,
         max_artifacts_size: Settings.artifacts['max_size'],
         max_attachment_size: Settings.gitlab['max_attachment_size'],
         mirror_available: true,
+        outbound_local_requests_whitelist: [],
         password_authentication_enabled_for_git: true,
         password_authentication_enabled_for_web: Settings.gitlab['signin_enabled'],
         performance_bar_allowed_group_id: nil,
@@ -63,6 +68,8 @@ module ApplicationSettingImplementation
         plantuml_url: nil,
         polling_interval_multiplier: 1,
         project_export_enabled: true,
+        protected_ci_variables: false,
+        raw_blob_request_limit: 300,
         recaptcha_enabled: false,
         repository_checks_enabled: true,
         repository_storages: ['default'],
@@ -95,16 +102,10 @@ module ApplicationSettingImplementation
         user_default_internal_regex: nil,
         user_show_add_ssh_key_message: true,
         usage_stats_set_by_user_id: nil,
-        diff_max_patch_bytes: Gitlab::Git::Diff::DEFAULT_MAX_PATCH_BYTES,
-        commit_email_hostname: default_commit_email_hostname,
         snowplow_collector_hostname: nil,
         snowplow_cookie_domain: nil,
         snowplow_enabled: false,
-        snowplow_site_id: nil,
-        protected_ci_variables: false,
-        local_markdown_version: 0,
-        outbound_local_requests_whitelist: [],
-        raw_blob_request_limit: 300
+        snowplow_site_id: nil
       }
     end
 
@@ -198,6 +199,15 @@ module ApplicationSettingImplementation
     end
   end
 
+  def asset_proxy_whitelist=(values)
+    values = domain_strings_to_array(values) if values.is_a?(String)
+
+    # make sure we always whitelist the running host
+    values << Gitlab.config.gitlab.host unless values.include?(Gitlab.config.gitlab.host)
+
+    self[:asset_proxy_whitelist] = values
+  end
+
   def repository_storages
     Array(read_attribute(:repository_storages))
   end
@@ -306,6 +316,7 @@ module ApplicationSettingImplementation
 
     values
       .split(DOMAIN_LIST_SEPARATOR)
+      .map(&:strip)
       .reject(&:empty?)
       .uniq
   end
diff --git a/app/services/application_settings/update_service.rb b/app/services/application_settings/update_service.rb
index 471df6e2d0c..03ff282dec5 100644
--- a/app/services/application_settings/update_service.rb
+++ b/app/services/application_settings/update_service.rb
@@ -6,6 +6,8 @@ module ApplicationSettings
 
     attr_reader :params, :application_setting
 
+    MARKDOWN_CACHE_INVALIDATING_PARAMS = %w(asset_proxy_enabled asset_proxy_url asset_proxy_secret_key asset_proxy_whitelist).freeze
+
     def execute
       validate_classification_label(application_setting, :external_authorization_service_default_label)
 
@@ -25,7 +27,13 @@ module ApplicationSettings
         params[:usage_stats_set_by_user_id] = current_user.id
       end
 
-      @application_setting.update(@params)
+      @application_setting.assign_attributes(params)
+
+      if invalidate_markdown_cache?
+        @application_setting[:local_markdown_version] = @application_setting.local_markdown_version + 1
+      end
+
+      @application_setting.save
     end
 
     private
@@ -41,6 +49,11 @@ module ApplicationSettings
       @application_setting.add_to_outbound_local_requests_whitelist(values_array)
     end
 
+    def invalidate_markdown_cache?
+      !params.key?(:local_markdown_version) &&
+        (@application_setting.changes.keys & MARKDOWN_CACHE_INVALIDATING_PARAMS).any?
+    end
+
     def update_terms(terms)
       return unless terms.present?
 
diff --git a/changelogs/unreleased/security-enable-image-proxy.yml b/changelogs/unreleased/security-enable-image-proxy.yml
new file mode 100644
index 00000000000..88b49ffd9e8
--- /dev/null
+++ b/changelogs/unreleased/security-enable-image-proxy.yml
@@ -0,0 +1,5 @@
+---
+title: Added image proxy to mitigate potential stealing of IP addresses
+merge_request:
+author:
+type: security
diff --git a/config/initializers/asset_proxy_settings.rb b/config/initializers/asset_proxy_settings.rb
new file mode 100644
index 00000000000..92247aba1b8
--- /dev/null
+++ b/config/initializers/asset_proxy_settings.rb
@@ -0,0 +1,6 @@
+#
+# Asset proxy settings
+#
+ActiveSupport.on_load(:active_record) do
+  Banzai::Filter::AssetProxyFilter.initialize_settings
+end
diff --git a/config/initializers/fill_shards.rb b/config/initializers/fill_shards.rb
index 18e067c8854..cad662e12f3 100644
--- a/config/initializers/fill_shards.rb
+++ b/config/initializers/fill_shards.rb
@@ -1,3 +1,5 @@
-if Shard.connected? && !Gitlab::Database.read_only?
+# The `table_exists?` check is needed because during our migration rollback testing,
+# `Shard.connected?` could be cached and return true even though the table doesn't exist
+if Shard.connected? && Shard.table_exists? && !Gitlab::Database.read_only?
   Shard.populate!
 end
diff --git a/db/migrate/20190219201635_add_asset_proxy_settings.rb b/db/migrate/20190219201635_add_asset_proxy_settings.rb
new file mode 100644
index 00000000000..beeb6400292
--- /dev/null
+++ b/db/migrate/20190219201635_add_asset_proxy_settings.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class AddAssetProxySettings < ActiveRecord::Migration[5.0]
+  include Gitlab::Database::MigrationHelpers
+
+  # Set this constant to true if this migration requires downtime.
+  DOWNTIME = false
+
+  def change
+    add_column :application_settings, :asset_proxy_enabled, :boolean, default: false, null: false
+    add_column :application_settings, :asset_proxy_url, :string
+    add_column :application_settings, :asset_proxy_whitelist, :text
+    add_column :application_settings, :encrypted_asset_proxy_secret_key, :text
+    add_column :application_settings, :encrypted_asset_proxy_secret_key_iv, :string
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 944d23e5365..7e5e96707dc 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -278,6 +278,11 @@ ActiveRecord::Schema.define(version: 2019_08_15_093949) do
     t.boolean "allow_local_requests_from_system_hooks", default: true, null: false
     t.bigint "instance_administration_project_id"
     t.string "snowplow_collector_hostname"
+    t.boolean "asset_proxy_enabled", default: false, null: false
+    t.string "asset_proxy_url"
+    t.text "asset_proxy_whitelist"
+    t.text "encrypted_asset_proxy_secret_key"
+    t.string "encrypted_asset_proxy_secret_key_iv"
     t.index ["custom_project_templates_group_id"], name: "index_application_settings_on_custom_project_templates_group_id"
     t.index ["file_template_project_id"], name: "index_application_settings_on_file_template_project_id"
     t.index ["instance_administration_project_id"], name: "index_applicationsettings_on_instance_administration_project_id"
diff --git a/doc/api/settings.md b/doc/api/settings.md
index 710b63c9a2f..e3d8fe68e08 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -68,6 +68,9 @@ Example response:
    "allow_local_requests_from_hooks_and_services": true,
    "allow_local_requests_from_web_hooks_and_services": true,
    "allow_local_requests_from_system_hooks": false
+   "asset_proxy_enabled": true,
+   "asset_proxy_url": "https://assets.example.com",
+   "asset_proxy_whitelist": ["example.com", "*.example.com", "your-instance.com"]
 }
 ```
 
@@ -141,6 +144,9 @@ Example response:
   "user_show_add_ssh_key_message": true,
   "file_template_project_id": 1,
   "local_markdown_version": 0,
+  "asset_proxy_enabled": true,
+  "asset_proxy_url": "https://assets.example.com",
+  "asset_proxy_whitelist": ["example.com", "*.example.com", "your-instance.com"],
   "geo_node_allowed_ips": "0.0.0.0/0, ::/0",
   "allow_local_requests_from_hooks_and_services": true,
   "allow_local_requests_from_web_hooks_and_services": true,
@@ -186,6 +192,10 @@ are listed in the descriptions of the relevant settings.
 | `allow_local_requests_from_hooks_and_services` | boolean    | no                                   | (Deprecated: Use `allow_local_requests_from_web_hooks_and_services` instead) Allow requests to the local network from hooks and services. |
 | `allow_local_requests_from_web_hooks_and_services` | boolean    | no                                   | Allow requests to the local network from web hooks and services. |
 | `allow_local_requests_from_system_hooks` | boolean    | no                                   | Allow requests to the local network from system hooks. |
+| `asset_proxy_enabled`                    | boolean          | no                                   | (**If enabled, requires:** `asset_proxy_url`) Enable proxying of assets. GitLab restart is required to apply changes. |
+| `asset_proxy_secret_key`                 | string           | no                                   | Shared secret with the asset proxy server. GitLab restart is required to apply changes. |
+| `asset_proxy_url`                        | string           | no                                   | URL of the asset proxy server. GitLab restart is required to apply changes. |
+| `asset_proxy_whitelist`                  | string or array of strings | no                         | Assets that match these domain(s) will NOT be proxied. Wildcards allowed. Your GitLab installation URL is automatically whitelisted. GitLab restart is required to apply changes. |
 | `authorized_keys_enabled`                | boolean          | no                                   | By default, we write to the `authorized_keys` file to support Git over SSH without additional configuration. GitLab can be optimized to authenticate SSH keys via the database file. Only disable this if you have configured your OpenSSH server to use the AuthorizedKeysCommand. |
 | `auto_devops_domain`                     | string           | no                                   | Specify a domain to use by default for every project's Auto Review Apps and Auto Deploy stages. |
 | `auto_devops_enabled`                    | boolean          | no                                   | Enable Auto DevOps for projects by default. It will automatically build, test, and deploy applications based on a predefined CI/CD configuration. |
diff --git a/doc/security/README.md b/doc/security/README.md
index 5d498ac7602..fa34f07060e 100644
--- a/doc/security/README.md
+++ b/doc/security/README.md
@@ -17,3 +17,4 @@ type: index
 - [Enforce Two-factor authentication](two_factor_authentication.md)
 - [Send email confirmation on sign-up](user_email_confirmation.md)
 - [Security of running jobs](https://docs.gitlab.com/runner/security/)
+- [Proxying images](asset_proxy.md)
diff --git a/doc/security/asset_proxy.md b/doc/security/asset_proxy.md
new file mode 100644
index 00000000000..f25910d3db7
--- /dev/null
+++ b/doc/security/asset_proxy.md
@@ -0,0 +1,28 @@
+A possible security concern when managing a public facing GitLab instance is
+the ability to steal a users IP address by referencing images in issues, comments, etc.
+
+For example, adding `![Example image](http://example.com/example.png)` to
+an issue description will cause the image to be loaded from the external
+server in order to be displayed.  However this also allows the external server
+to log the IP address of the user.
+
+One way to mitigate this is by proxying any external images to a server you
+control.  GitLab handles this by allowing you to run the "Camo" server
+[cactus/go-camo](https://github.com/cactus/go-camo#how-it-works).
+The image request is sent to the Camo server, which then makes the request for
+the original image.  This way an attacker only ever seems the IP address
+of your Camo server.
+
+Once you have your Camo server up and running, you can configure GitLab to
+proxy image requests to it.  The following settings are supported:
+
+| Attribute                | Description |
+| ------------------------ | ----------- |
+| `asset_proxy_enabled`    | (**If enabled, requires:** `asset_proxy_url`) Enable proxying of assets. |
+| `asset_proxy_secret_key` | Shared secret with the asset proxy server. |
+| `asset_proxy_url`        | URL of the asset proxy server. |
+| `asset_proxy_whitelist`  | Assets that match these domain(s) will NOT be proxied. Wildcards allowed. Your GitLab installation URL is automatically whitelisted. |
+
+These can be set via the [Application setting API](../api/settings.md)
+
+Note that a GitLab restart is required to apply any changes.
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 5e66b4e76a5..e5df4574bc4 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -1174,6 +1174,9 @@ module API
         attributes.delete(:performance_bar_enabled)
         attributes.delete(:allow_local_requests_from_hooks_and_services)
 
+        # let's not expose the secret key in a response
+        attributes.delete(:asset_proxy_secret_key)
+
         attributes
       end
 
diff --git a/lib/api/settings.rb b/lib/api/settings.rb
index c36ee5af63f..b67c18b5465 100644
--- a/lib/api/settings.rb
+++ b/lib/api/settings.rb
@@ -36,6 +36,10 @@ module API
       given akismet_enabled: ->(val) { val } do
         requires :akismet_api_key, type: String, desc: 'Generate API key at http://www.akismet.com'
       end
+      optional :asset_proxy_enabled, type: Boolean, desc: 'Enable proxying of assets'
+      optional :asset_proxy_url, type: String, desc: 'URL of the asset proxy server'
+      optional :asset_proxy_secret_key, type: String, desc: 'Shared secret with the asset proxy server'
+      optional :asset_proxy_whitelist, type: Array[String], coerce_with: Validations::Types::CommaSeparatedToArray.coerce, desc: 'Assets that match these domain(s) will NOT be proxied. Wildcards allowed. Your GitLab installation URL is automatically whitelisted.'
       optional :container_registry_token_expire_delay, type: Integer, desc: 'Authorization token duration (minutes)'
       optional :default_artifacts_expire_in, type: String, desc: "Set the default expiration time for each job's artifacts"
       optional :default_project_creation, type: Integer, values: ::Gitlab::Access.project_creation_values, desc: 'Determine if developers can create projects in the group'
@@ -123,7 +127,7 @@ module API
       optional :terminal_max_session_time, type: Integer, desc: 'Maximum time for web terminal websocket connection (in seconds). Set to 0 for unlimited time.'
       optional :usage_ping_enabled, type: Boolean, desc: 'Every week GitLab will report license usage back to GitLab, Inc.'
       optional :instance_statistics_visibility_private, type: Boolean, desc: 'When set to `true` Instance statistics will only be available to admins'
-      optional :local_markdown_version, type: Integer, desc: "Local markdown version, increase this value when any cached markdown should be invalidated"
+      optional :local_markdown_version, type: Integer, desc: 'Local markdown version, increase this value when any cached markdown should be invalidated'
       optional :allow_local_requests_from_hooks_and_services, type: Boolean, desc: 'Deprecated: Use :allow_local_requests_from_web_hooks_and_services instead. Allow requests to the local network from hooks and services.' # support legacy names, can be removed in v5
       optional :snowplow_enabled, type: Grape::API::Boolean, desc: 'Enable Snowplow tracking'
       given snowplow_enabled: ->(val) { val } do
diff --git a/lib/api/validations/types/comma_separated_to_array.rb b/lib/api/validations/types/comma_separated_to_array.rb
new file mode 100644
index 00000000000..b551878abd1
--- /dev/null
+++ b/lib/api/validations/types/comma_separated_to_array.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module API
+  module Validations
+    module Types
+      class CommaSeparatedToArray
+        def self.coerce
+          lambda do |value|
+            case value
+            when String
+              value.split(',').map(&:strip)
+            when Array
+              value.map { |v| v.to_s.split(',').map(&:strip) }.flatten
+            else
+              []
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/banzai/filter/asset_proxy_filter.rb b/lib/banzai/filter/asset_proxy_filter.rb
new file mode 100644
index 00000000000..0a9a52a73a1
--- /dev/null
+++ b/lib/banzai/filter/asset_proxy_filter.rb
@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Banzai
+  module Filter
+    # Proxy's images/assets to another server.  Reduces mixed content warnings
+    # as well as hiding the customer's IP address when requesting images.
+    # Copies the original img `src` to `data-canonical-src` then replaces the
+    # `src` with a new url to the proxy server.
+    class AssetProxyFilter < HTML::Pipeline::CamoFilter
+      def initialize(text, context = nil, result = nil)
+        super
+      end
+
+      def validate
+        needs(:asset_proxy, :asset_proxy_secret_key) if asset_proxy_enabled?
+      end
+
+      def asset_host_whitelisted?(host)
+        context[:asset_proxy_domain_regexp] ? context[:asset_proxy_domain_regexp].match?(host) : false
+      end
+
+      def self.transform_context(context)
+        context[:disable_asset_proxy] = !Gitlab.config.asset_proxy.enabled
+
+        unless context[:disable_asset_proxy]
+          context[:asset_proxy_enabled]       = !context[:disable_asset_proxy]
+          context[:asset_proxy]               = Gitlab.config.asset_proxy.url
+          context[:asset_proxy_secret_key]    = Gitlab.config.asset_proxy.secret_key
+          context[:asset_proxy_domain_regexp] = Gitlab.config.asset_proxy.domain_regexp
+        end
+
+        context
+      end
+
+      # called during an initializer. Caching the values in Gitlab.config significantly increased
+      # performance, rather than querying Gitlab::CurrentSettings.current_application_settings
+      # over and over.  However, this does mean that the Rails servers need to get restarted
+      # whenever the application settings are changed
+      def self.initialize_settings
+        application_settings           = Gitlab::CurrentSettings.current_application_settings
+        Gitlab.config['asset_proxy'] ||= Settingslogic.new({})
+
+        if application_settings.respond_to?(:asset_proxy_enabled)
+          Gitlab.config.asset_proxy['enabled']       = application_settings.asset_proxy_enabled
+          Gitlab.config.asset_proxy['url']           = application_settings.asset_proxy_url
+          Gitlab.config.asset_proxy['secret_key']    = application_settings.asset_proxy_secret_key
+          Gitlab.config.asset_proxy['whitelist']     = application_settings.asset_proxy_whitelist || [Gitlab.config.gitlab.host]
+          Gitlab.config.asset_proxy['domain_regexp'] = compile_whitelist(Gitlab.config.asset_proxy.whitelist)
+        else
+          Gitlab.config.asset_proxy['enabled']       = ::ApplicationSetting.defaults[:asset_proxy_enabled]
+        end
+      end
+
+      def self.compile_whitelist(domain_list)
+        return if domain_list.empty?
+
+        escaped = domain_list.map { |domain| Regexp.escape(domain).gsub('\*', '.*?') }
+        Regexp.new("^(#{escaped.join('|')})$", Regexp::IGNORECASE)
+      end
+    end
+  end
+end
diff --git a/lib/banzai/filter/external_link_filter.rb b/lib/banzai/filter/external_link_filter.rb
index 61ee3eac216..fb721fe12b1 100644
--- a/lib/banzai/filter/external_link_filter.rb
+++ b/lib/banzai/filter/external_link_filter.rb
@@ -14,10 +14,10 @@ module Banzai
           # such as on `mailto:` links. Since we've been using it, do an
           # initial parse for validity and then use Addressable
           # for IDN support, etc
-          uri = uri_strict(node['href'].to_s)
+          uri = uri_strict(node_src(node))
           if uri
-            node.set_attribute('href', uri.to_s)
-            addressable_uri = addressable_uri(node['href'])
+            node.set_attribute(node_src_attribute(node), uri.to_s)
+            addressable_uri = addressable_uri(node_src(node))
           else
             addressable_uri = nil
           end
@@ -35,6 +35,16 @@ module Banzai
 
       private
 
+      # if this is a link to a proxied image, then `src` is already the correct
+      # proxied url, so work with the `data-canonical-src`
+      def node_src_attribute(node)
+        node['data-canonical-src'] ? 'data-canonical-src' : 'href'
+      end
+
+      def node_src(node)
+        node[node_src_attribute(node)]
+      end
+
       def uri_strict(href)
         URI.parse(href)
       rescue URI::Error
@@ -72,7 +82,7 @@ module Banzai
         return unless uri
         return unless context[:emailable_links]
 
-        unencoded_uri_str = Addressable::URI.unencode(node['href'])
+        unencoded_uri_str = Addressable::URI.unencode(node_src(node))
 
         if unencoded_uri_str == node.content && idn?(uri)
           node.content = uri.normalize
diff --git a/lib/banzai/filter/image_link_filter.rb b/lib/banzai/filter/image_link_filter.rb
index 01237303c27..ed0a01e6277 100644
--- a/lib/banzai/filter/image_link_filter.rb
+++ b/lib/banzai/filter/image_link_filter.rb
@@ -18,6 +18,9 @@ module Banzai
             rel: 'noopener noreferrer'
           )
 
+          # make sure the original non-proxied src carries over to the link
+          link['data-canonical-src'] = img['data-canonical-src'] if img['data-canonical-src']
+
           link.children = img.clone
 
           img.replace(link)
diff --git a/lib/banzai/filter/video_link_filter.rb b/lib/banzai/filter/video_link_filter.rb
index 0fff104cf91..a278fcfdb47 100644
--- a/lib/banzai/filter/video_link_filter.rb
+++ b/lib/banzai/filter/video_link_filter.rb
@@ -23,6 +23,14 @@ module Banzai
             "'.#{ext}' = substring(@src, string-length(@src) - #{ext.size})"
           end
 
+          if context[:asset_proxy_enabled].present?
+            src_query.concat(
+              UploaderHelper::VIDEO_EXT.map do |ext|
+                "'.#{ext}' = substring(@data-canonical-src, string-length(@data-canonical-src) - #{ext.size})"
+              end
+            )
+          end
+
           "descendant-or-self::img[not(ancestor::a) and (#{src_query.join(' or ')})]"
         end
       end
@@ -48,6 +56,13 @@ module Banzai
           target: '_blank',
           rel: 'noopener noreferrer',
           title: "Download '#{element['title'] || element['alt']}'")
+
+        # make sure the original non-proxied src carries over
+        if element['data-canonical-src']
+          video['data-canonical-src'] = element['data-canonical-src']
+          link['data-canonical-src']  = element['data-canonical-src']
+        end
+
         download_paragraph = doc.document.create_element('p')
         download_paragraph.children = link
 
diff --git a/lib/banzai/pipeline/ascii_doc_pipeline.rb b/lib/banzai/pipeline/ascii_doc_pipeline.rb
index d25b74b23b2..82b99d3de4a 100644
--- a/lib/banzai/pipeline/ascii_doc_pipeline.rb
+++ b/lib/banzai/pipeline/ascii_doc_pipeline.rb
@@ -6,12 +6,17 @@ module Banzai
       def self.filters
         FilterArray[
           Filter::AsciiDocSanitizationFilter,
+          Filter::AssetProxyFilter,
           Filter::SyntaxHighlightFilter,
           Filter::ExternalLinkFilter,
           Filter::PlantumlFilter,
           Filter::AsciiDocPostProcessingFilter
         ]
       end
+
+      def self.transform_context(context)
+        Filter::AssetProxyFilter.transform_context(context)
+      end
     end
   end
 end
diff --git a/lib/banzai/pipeline/gfm_pipeline.rb b/lib/banzai/pipeline/gfm_pipeline.rb
index 2c1006f708a..f419e54c264 100644
--- a/lib/banzai/pipeline/gfm_pipeline.rb
+++ b/lib/banzai/pipeline/gfm_pipeline.rb
@@ -17,6 +17,7 @@ module Banzai
           Filter::SpacedLinkFilter,
 
           Filter::SanitizationFilter,
+          Filter::AssetProxyFilter,
           Filter::SyntaxHighlightFilter,
 
           Filter::MathFilter,
@@ -60,7 +61,7 @@ module Banzai
       def self.transform_context(context)
         context[:only_path] = true unless context.key?(:only_path)
 
-        context
+        Filter::AssetProxyFilter.transform_context(context)
       end
     end
   end
diff --git a/lib/banzai/pipeline/markup_pipeline.rb b/lib/banzai/pipeline/markup_pipeline.rb
index ceba082cd4f..c86d5f08ded 100644
--- a/lib/banzai/pipeline/markup_pipeline.rb
+++ b/lib/banzai/pipeline/markup_pipeline.rb
@@ -6,11 +6,16 @@ module Banzai
       def self.filters
         @filters ||= FilterArray[
           Filter::SanitizationFilter,
+          Filter::AssetProxyFilter,
           Filter::ExternalLinkFilter,
           Filter::PlantumlFilter,
           Filter::SyntaxHighlightFilter
         ]
       end
+
+      def self.transform_context(context)
+        Filter::AssetProxyFilter.transform_context(context)
+      end
     end
   end
 end
diff --git a/lib/banzai/pipeline/single_line_pipeline.rb b/lib/banzai/pipeline/single_line_pipeline.rb
index 72374207a8f..9aff6880f56 100644
--- a/lib/banzai/pipeline/single_line_pipeline.rb
+++ b/lib/banzai/pipeline/single_line_pipeline.rb
@@ -7,6 +7,7 @@ module Banzai
         @filters ||= FilterArray[
           Filter::HtmlEntityFilter,
           Filter::SanitizationFilter,
+          Filter::AssetProxyFilter,
 
           Filter::EmojiFilter,
           Filter::AutolinkFilter,
@@ -29,6 +30,8 @@ module Banzai
       end
 
       def self.transform_context(context)
+        context = Filter::AssetProxyFilter.transform_context(context)
+
         super(context).merge(
           no_sourcepos: true
         )
diff --git a/spec/initializers/asset_proxy_setting_spec.rb b/spec/initializers/asset_proxy_setting_spec.rb
new file mode 100644
index 00000000000..42e4d4aa594
--- /dev/null
+++ b/spec/initializers/asset_proxy_setting_spec.rb
@@ -0,0 +1,13 @@
+require 'spec_helper'
+
+describe 'Asset proxy settings initialization' do
+  describe '#asset_proxy' do
+    it 'defaults to disabled' do
+      expect(Banzai::Filter::AssetProxyFilter).to receive(:initialize_settings)
+
+      require_relative '../../config/initializers/asset_proxy_settings'
+
+      expect(Gitlab.config.asset_proxy.enabled).to be_falsey
+    end
+  end
+end
diff --git a/spec/lib/banzai/filter/asset_proxy_filter_spec.rb b/spec/lib/banzai/filter/asset_proxy_filter_spec.rb
new file mode 100644
index 00000000000..b7f45421b2a
--- /dev/null
+++ b/spec/lib/banzai/filter/asset_proxy_filter_spec.rb
@@ -0,0 +1,95 @@
+require 'spec_helper'
+
+describe Banzai::Filter::AssetProxyFilter do
+  include FilterSpecHelper
+
+  def image(path)
+    %(<img src="#{path}" />)
+  end
+
+  it 'does not replace if disabled' do
+    stub_asset_proxy_setting(enabled: false)
+
+    context = described_class.transform_context({})
+    src     = 'http://example.com/test.png'
+    doc     = filter(image(src), context)
+
+    expect(doc.at_css('img')['src']).to eq src
+  end
+
+  context 'during initialization' do
+    after do
+      Gitlab.config.asset_proxy['enabled'] = false
+    end
+
+    it '#initialize_settings' do
+      stub_application_setting(asset_proxy_enabled: true)
+      stub_application_setting(asset_proxy_secret_key: 'shared-secret')
+      stub_application_setting(asset_proxy_url: 'https://assets.example.com')
+      stub_application_setting(asset_proxy_whitelist: %w(gitlab.com *.mydomain.com))
+
+      described_class.initialize_settings
+
+      expect(Gitlab.config.asset_proxy.enabled).to be_truthy
+      expect(Gitlab.config.asset_proxy.secret_key).to eq 'shared-secret'
+      expect(Gitlab.config.asset_proxy.url).to eq 'https://assets.example.com'
+      expect(Gitlab.config.asset_proxy.whitelist).to eq %w(gitlab.com *.mydomain.com)
+      expect(Gitlab.config.asset_proxy.domain_regexp).to eq /^(gitlab\.com|.*?\.mydomain\.com)$/i
+    end
+  end
+
+  context 'when properly configured' do
+    before do
+      stub_asset_proxy_setting(enabled: true)
+      stub_asset_proxy_setting(secret_key: 'shared-secret')
+      stub_asset_proxy_setting(url: 'https://assets.example.com')
+      stub_asset_proxy_setting(whitelist: %W(gitlab.com *.mydomain.com #{Gitlab.config.gitlab.host}))
+      stub_asset_proxy_setting(domain_regexp: described_class.compile_whitelist(Gitlab.config.asset_proxy.whitelist))
+      @context = described_class.transform_context({})
+    end
+
+    it 'replaces img src' do
+      src     = 'http://example.com/test.png'
+      new_src = 'https://assets.example.com/08df250eeeef1a8cf2c761475ac74c5065105612/687474703a2f2f6578616d706c652e636f6d2f746573742e706e67'
+      doc     = filter(image(src), @context)
+
+      expect(doc.at_css('img')['src']).to eq new_src
+      expect(doc.at_css('img')['data-canonical-src']).to eq src
+    end
+
+    it 'skips internal images' do
+      src      = "#{Gitlab.config.gitlab.url}/test.png"
+      doc      = filter(image(src), @context)
+
+      expect(doc.at_css('img')['src']).to eq src
+    end
+
+    it 'skip relative urls' do
+      src = "/test.png"
+      doc = filter(image(src), @context)
+
+      expect(doc.at_css('img')['src']).to eq src
+    end
+
+    it 'skips single domain' do
+      src = "http://gitlab.com/test.png"
+      doc = filter(image(src), @context)
+
+      expect(doc.at_css('img')['src']).to eq src
+    end
+
+    it 'skips single domain and ignores url in query string' do
+      src = "http://gitlab.com/test.png?url=http://example.com/test.png"
+      doc = filter(image(src), @context)
+
+      expect(doc.at_css('img')['src']).to eq src
+    end
+
+    it 'skips wildcarded domain' do
+      src = "http://images.mydomain.com/test.png"
+      doc = filter(image(src), @context)
+
+      expect(doc.at_css('img')['src']).to eq src
+    end
+  end
+end
diff --git a/spec/lib/banzai/filter/external_link_filter_spec.rb b/spec/lib/banzai/filter/external_link_filter_spec.rb
index 59fea5766ee..4b2500b31f7 100644
--- a/spec/lib/banzai/filter/external_link_filter_spec.rb
+++ b/spec/lib/banzai/filter/external_link_filter_spec.rb
@@ -156,6 +156,18 @@ describe Banzai::Filter::ExternalLinkFilter do
         expect(doc_email.to_html).to include('http://xn--example-6p25f.com/</a>')
       end
     end
+
+    context 'autolinked image' do
+      let(:html) { %q(<a href="https://assets.example.com/6d8b/634c" data-canonical-src="http://exa%F0%9F%98%84mple.com/test.png"><img src="http://exa%F0%9F%98%84mple.com/test.png" data-canonical-src="http://exa%F0%9F%98%84mple.com/test.png"></a>) }
+      let(:doc)  { filter(html) }
+
+      it_behaves_like 'an external link with rel attribute'
+
+      it 'adds a toolip with punycode' do
+        expect(doc.to_html).to include('class="has-tooltip"')
+        expect(doc.to_html).to include('title="http://xn--example-6p25f.com/test.png"')
+      end
+    end
   end
 
   context 'for links that look malicious' do
diff --git a/spec/lib/banzai/filter/image_link_filter_spec.rb b/spec/lib/banzai/filter/image_link_filter_spec.rb
index 7b0cb675551..011e3a1e2da 100644
--- a/spec/lib/banzai/filter/image_link_filter_spec.rb
+++ b/spec/lib/banzai/filter/image_link_filter_spec.rb
@@ -28,4 +28,11 @@ describe Banzai::Filter::ImageLinkFilter do
     doc = filter(%Q(<p>test #{image('/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg')} inline</p>))
     expect(doc.to_html).to match %r{^<p>test <a[^>]*><img[^>]*></a> inline</p>$}
   end
+
+  it 'keep the data-canonical-src' do
+    doc = filter(%q(<img src="http://assets.example.com/6cd/4d7" data-canonical-src="http://example.com/test.png" />))
+
+    expect(doc.at_css('img')['src']).to eq doc.at_css('a')['href']
+    expect(doc.at_css('img')['data-canonical-src']).to eq doc.at_css('a')['data-canonical-src']
+  end
 end
diff --git a/spec/lib/banzai/filter/video_link_filter_spec.rb b/spec/lib/banzai/filter/video_link_filter_spec.rb
index 483e806624c..cd932f502f3 100644
--- a/spec/lib/banzai/filter/video_link_filter_spec.rb
+++ b/spec/lib/banzai/filter/video_link_filter_spec.rb
@@ -49,4 +49,26 @@ describe Banzai::Filter::VideoLinkFilter do
       expect(element['src']).to eq '/path/my_image.jpg'
     end
   end
+
+  context 'when asset proxy is enabled' do
+    it 'uses the correct src' do
+      stub_asset_proxy_setting(enabled: true)
+
+      proxy_src = 'https://assets.example.com/6d8b63'
+      canonical_src = 'http://example.com/test.mp4'
+      image = %(<img src="#{proxy_src}" data-canonical-src="#{canonical_src}" />)
+      container = filter(image, asset_proxy_enabled: true).children.first
+
+      expect(container['class']).to eq 'video-container'
+
+      video, paragraph = container.children
+
+      expect(video['src']).to eq proxy_src
+      expect(video['data-canonical-src']).to eq canonical_src
+
+      link = paragraph.children.first
+
+      expect(link['href']).to eq proxy_src
+    end
+  end
 end
diff --git a/spec/lib/banzai/pipeline/gfm_pipeline_spec.rb b/spec/lib/banzai/pipeline/gfm_pipeline_spec.rb
index 0a3e0962452..3a9ecd2fb81 100644
--- a/spec/lib/banzai/pipeline/gfm_pipeline_spec.rb
+++ b/spec/lib/banzai/pipeline/gfm_pipeline_spec.rb
@@ -142,4 +142,48 @@ describe Banzai::Pipeline::GfmPipeline do
       expect(output).to include(Gitlab::Routing.url_helpers.milestone_path(milestone))
     end
   end
+
+  describe 'asset proxy' do
+    let(:project) { create(:project, :public) }
+    let(:image)   { '![proxy](http://example.com/test.png)' }
+    let(:proxy)   { 'https://assets.example.com/08df250eeeef1a8cf2c761475ac74c5065105612/687474703a2f2f6578616d706c652e636f6d2f746573742e706e67' }
+    let(:version) { Gitlab::CurrentSettings.current_application_settings.local_markdown_version }
+
+    before do
+      stub_asset_proxy_setting(enabled: true)
+      stub_asset_proxy_setting(secret_key: 'shared-secret')
+      stub_asset_proxy_setting(url: 'https://assets.example.com')
+      stub_asset_proxy_setting(whitelist: %W(gitlab.com *.mydomain.com #{Gitlab.config.gitlab.host}))
+      stub_asset_proxy_setting(domain_regexp: Banzai::Filter::AssetProxyFilter.compile_whitelist(Gitlab.config.asset_proxy.whitelist))
+    end
+
+    it 'replaces a lazy loaded img src' do
+      output = described_class.to_html(image, project: project)
+      doc    = Nokogiri::HTML.fragment(output)
+      result = doc.css('img').first
+
+      expect(result['data-src']).to eq(proxy)
+    end
+
+    it 'autolinks images to the proxy' do
+      output = described_class.to_html(image, project: project)
+      doc    = Nokogiri::HTML.fragment(output)
+      result = doc.css('a').first
+
+      expect(result['href']).to eq(proxy)
+      expect(result['data-canonical-src']).to eq('http://example.com/test.png')
+    end
+
+    it 'properly adds tooltips to link for IDN images' do
+      image  = '![proxy](http://exa😄mple.com/test.png)'
+      proxy  = 'https://assets.example.com/6d8b634c412a23c6bfe1b2963f174febf5635ddd/687474703a2f2f6578612546302539462539382538346d706c652e636f6d2f746573742e706e67'
+      output = described_class.to_html(image, project: project)
+      doc    = Nokogiri::HTML.fragment(output)
+      result = doc.css('a').first
+
+      expect(result['href']).to eq(proxy)
+      expect(result['data-canonical-src']).to eq('http://exa%F0%9F%98%84mple.com/test.png')
+      expect(result['title']).to eq 'http://xn--example-6p25f.com/test.png'
+    end
+  end
 end
diff --git a/spec/models/application_setting_spec.rb b/spec/models/application_setting_spec.rb
index db80b85360f..4f7a6d102b8 100644
--- a/spec/models/application_setting_spec.rb
+++ b/spec/models/application_setting_spec.rb
@@ -355,6 +355,71 @@ describe ApplicationSetting do
         end
       end
     end
+
+    context 'asset proxy settings' do
+      before do
+        subject.asset_proxy_enabled = true
+      end
+
+      describe '#asset_proxy_url' do
+        it { is_expected.not_to allow_value('').for(:asset_proxy_url) }
+        it { is_expected.to allow_value(http).for(:asset_proxy_url) }
+        it { is_expected.to allow_value(https).for(:asset_proxy_url) }
+        it { is_expected.not_to allow_value(ftp).for(:asset_proxy_url) }
+
+        it 'is not required when asset proxy is disabled' do
+          subject.asset_proxy_enabled = false
+          subject.asset_proxy_url = ''
+
+          expect(subject).to be_valid
+        end
+      end
+
+      describe '#asset_proxy_secret_key' do
+        it { is_expected.not_to allow_value('').for(:asset_proxy_secret_key) }
+        it { is_expected.to allow_value('anything').for(:asset_proxy_secret_key) }
+
+        it 'is not required when asset proxy is disabled' do
+          subject.asset_proxy_enabled = false
+          subject.asset_proxy_secret_key = ''
+
+          expect(subject).to be_valid
+        end
+
+        it 'is encrypted' do
+          subject.asset_proxy_secret_key = 'shared secret'
+
+          expect(subject.encrypted_asset_proxy_secret_key).to be_present
+          expect(subject.encrypted_asset_proxy_secret_key).not_to eq(subject.asset_proxy_secret_key)
+        end
+      end
+
+      describe '#asset_proxy_whitelist' do
+        context 'when given an Array' do
+          it 'sets the domains and adds current running host' do
+            setting.asset_proxy_whitelist = ['example.com', 'assets.example.com']
+            expect(setting.asset_proxy_whitelist).to eq(['example.com', 'assets.example.com', 'localhost'])
+          end
+        end
+
+        context 'when given a String' do
+          it 'sets multiple domains with spaces' do
+            setting.asset_proxy_whitelist = 'example.com *.example.com'
+            expect(setting.asset_proxy_whitelist).to eq(['example.com', '*.example.com', 'localhost'])
+          end
+
+          it 'sets multiple domains with newlines and a space' do
+            setting.asset_proxy_whitelist = "example.com\n *.example.com"
+            expect(setting.asset_proxy_whitelist).to eq(['example.com', '*.example.com', 'localhost'])
+          end
+
+          it 'sets multiple domains with commas' do
+            setting.asset_proxy_whitelist = "example.com, *.example.com"
+            expect(setting.asset_proxy_whitelist).to eq(['example.com', '*.example.com', 'localhost'])
+          end
+        end
+      end
+    end
   end
 
   context 'restrict creating duplicates' do
diff --git a/spec/requests/api/settings_spec.rb b/spec/requests/api/settings_spec.rb
index 590107d5161..048d04cdefd 100644
--- a/spec/requests/api/settings_spec.rb
+++ b/spec/requests/api/settings_spec.rb
@@ -224,5 +224,33 @@ describe API::Settings, 'Settings' do
         expect(json_response['error']).to eq('plantuml_url is missing')
       end
     end
+
+    context 'asset_proxy settings' do
+      it 'updates application settings' do
+        put api('/application/settings', admin),
+          params: {
+            asset_proxy_enabled: true,
+            asset_proxy_url: 'http://assets.example.com',
+            asset_proxy_secret_key: 'shared secret',
+            asset_proxy_whitelist: ['example.com', '*.example.com']
+          }
+
+        expect(response).to have_gitlab_http_status(200)
+        expect(json_response['asset_proxy_enabled']).to be(true)
+        expect(json_response['asset_proxy_url']).to eq('http://assets.example.com')
+        expect(json_response['asset_proxy_secret_key']).to be_nil
+        expect(json_response['asset_proxy_whitelist']).to eq(['example.com', '*.example.com', 'localhost'])
+      end
+
+      it 'allows a string for asset_proxy_whitelist' do
+        put api('/application/settings', admin),
+          params: {
+            asset_proxy_whitelist: 'example.com, *.example.com'
+          }
+
+        expect(response).to have_gitlab_http_status(200)
+        expect(json_response['asset_proxy_whitelist']).to eq(['example.com', '*.example.com', 'localhost'])
+      end
+    end
   end
 end
diff --git a/spec/services/application_settings/update_service_spec.rb b/spec/services/application_settings/update_service_spec.rb
index adb5219d691..74f94f8ed0f 100644
--- a/spec/services/application_settings/update_service_spec.rb
+++ b/spec/services/application_settings/update_service_spec.rb
@@ -110,6 +110,39 @@ describe ApplicationSettings::UpdateService do
     end
   end
 
+  describe 'markdown cache invalidators' do
+    shared_examples 'invalidates markdown cache' do |attribute|
+      let(:params) { attribute }
+
+      it 'increments cache' do
+        expect { subject.execute }.to change(application_settings, :local_markdown_version).by(1)
+      end
+    end
+
+    it_behaves_like 'invalidates markdown cache', { asset_proxy_enabled: true }
+    it_behaves_like 'invalidates markdown cache', { asset_proxy_url: 'http://test.com' }
+    it_behaves_like 'invalidates markdown cache', { asset_proxy_secret_key: 'another secret' }
+    it_behaves_like 'invalidates markdown cache', { asset_proxy_whitelist: ['domain.com'] }
+
+    context 'when also setting the local_markdown_version' do
+      let(:params) { { asset_proxy_enabled: true, local_markdown_version: 12 } }
+
+      it 'does not increment' do
+        expect { subject.execute }.to change(application_settings, :local_markdown_version).to(12)
+      end
+    end
+
+    context 'do not invalidate if value does not change' do
+      let(:params) { { asset_proxy_enabled: true, asset_proxy_secret_key: 'secret', asset_proxy_url: 'http://test.com' } }
+
+      it 'does not increment' do
+        described_class.new(application_settings, admin, params).execute
+
+        expect { described_class.new(application_settings, admin, params).execute }.not_to change(application_settings, :local_markdown_version)
+      end
+    end
+  end
+
   describe 'performance bar settings' do
     using RSpec::Parameterized::TableSyntax
 
diff --git a/spec/support/helpers/stub_configuration.rb b/spec/support/helpers/stub_configuration.rb
index dec7898d8d2..f364e4fd158 100644
--- a/spec/support/helpers/stub_configuration.rb
+++ b/spec/support/helpers/stub_configuration.rb
@@ -105,6 +105,10 @@ module StubConfiguration
     allow(Gitlab.config.gitlab_shell).to receive_messages(to_settings(messages))
   end
 
+  def stub_asset_proxy_setting(messages)
+    allow(Gitlab.config.asset_proxy).to receive_messages(to_settings(messages))
+  end
+
   def stub_rack_attack_setting(messages)
     allow(Gitlab.config.rack_attack).to receive(:git_basic_auth).and_return(messages)
     allow(Gitlab.config.rack_attack.git_basic_auth).to receive_messages(to_settings(messages))
-- 
cgit v1.2.1


From 17c312d601280c21091c3ebbc539440f779fde6a Mon Sep 17 00:00:00 2001
From: Brett Walker <bwalker@gitlab.com>
Date: Fri, 16 Aug 2019 12:15:39 -0500
Subject: Fix failing spec due to changes UpdateService

for ApplicationSettings
---
 .../database_importers/self_monitoring/project/create_service_spec.rb   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb b/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
index 9bd0d800086..00033c5ba1c 100644
--- a/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
+++ b/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
@@ -130,7 +130,7 @@ describe Gitlab::DatabaseImporters::SelfMonitoring::Project::CreateService do
       end
 
       it 'returns error when saving project ID fails' do
-        allow(application_setting).to receive(:update) { false }
+        allow(application_setting).to receive(:save) { false }
 
         expect { result }.to raise_error(StandardError, 'Could not save project ID')
       end
-- 
cgit v1.2.1


From ce07df77cc4d96d06dacc4319e4e42c23afe850e Mon Sep 17 00:00:00 2001
From: Brett Walker <bwalker@gitlab.com>
Date: Fri, 23 Aug 2019 20:17:00 -0500
Subject: disable cop Migration/AddLimitToStringColumns

---
 db/migrate/20190219201635_add_asset_proxy_settings.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/db/migrate/20190219201635_add_asset_proxy_settings.rb b/db/migrate/20190219201635_add_asset_proxy_settings.rb
index beeb6400292..9de38cf8a89 100644
--- a/db/migrate/20190219201635_add_asset_proxy_settings.rb
+++ b/db/migrate/20190219201635_add_asset_proxy_settings.rb
@@ -8,9 +8,9 @@ class AddAssetProxySettings < ActiveRecord::Migration[5.0]
 
   def change
     add_column :application_settings, :asset_proxy_enabled, :boolean, default: false, null: false
-    add_column :application_settings, :asset_proxy_url, :string
+    add_column :application_settings, :asset_proxy_url, :string # rubocop:disable Migration/AddLimitToStringColumns
     add_column :application_settings, :asset_proxy_whitelist, :text
     add_column :application_settings, :encrypted_asset_proxy_secret_key, :text
-    add_column :application_settings, :encrypted_asset_proxy_secret_key_iv, :string
+    add_column :application_settings, :encrypted_asset_proxy_secret_key_iv, :string # rubocop:disable Migration/AddLimitToStringColumns
   end
 end
-- 
cgit v1.2.1


From be571726f5e5d2a7960a386424b1ea0220a5b0fe Mon Sep 17 00:00:00 2001
From: Sean Arnold <sarnold@gitlab.com>
Date: Sat, 24 Aug 2019 05:28:02 +0000
Subject: Remove duplicate text in health check doc

---
 doc/user/admin_area/monitoring/health_check.md | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/doc/user/admin_area/monitoring/health_check.md b/doc/user/admin_area/monitoring/health_check.md
index a3f4bc774ce..52f24c602df 100644
--- a/doc/user/admin_area/monitoring/health_check.md
+++ b/doc/user/admin_area/monitoring/health_check.md
@@ -25,14 +25,6 @@ For details, see [how to add IPs to a whitelist for the monitoring endpoints](..
 
 With default whitelist settings, the probes can be accessed from localhost using the following URLs:
 
-```text
-GET http://localhost/-/health
-```
-```text
-GET http://localhost/-/readiness
-```
-```text
-GET http://localhost/-/liveness
 ```text
 GET http://localhost/-/health
 ```
-- 
cgit v1.2.1


From 22e2a601a03461d996673f2c8e974c65bcf74eda Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=92=D0=BB=D0=B0=D0=B4=D0=B8=D1=81=D0=BB=D0=B0=D0=B2=20?=
 =?UTF-8?q?=D0=9F=D0=BE=D0=BB=D1=8F=D0=BA=D0=BE=D0=B2?=
 <polrkov.tm@gmail.com>
Date: Sat, 24 Aug 2019 08:32:22 +0000
Subject: fix: remove double % from layout width description

Update show.html.haml
---
 app/views/profiles/preferences/show.html.haml | 2 +-
 locale/gitlab.pot                             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/profiles/preferences/show.html.haml b/app/views/profiles/preferences/show.html.haml
index d99063e344f..0887e8e64da 100644
--- a/app/views/profiles/preferences/show.html.haml
+++ b/app/views/profiles/preferences/show.html.haml
@@ -47,7 +47,7 @@
         = s_('Preferences|Layout width')
       = f.select :layout, layout_choices, {}, class: 'select2'
       .form-text.text-muted
-        = s_('Preferences|Choose between fixed (max. 1280px) and fluid (100%%) application layout.')
+        = s_('Preferences|Choose between fixed (max. 1280px) and fluid (%{percentage}) application layout.').html_safe % { percentage: '100%' }
     .form-group
       = f.label :dashboard, class: 'label-bold' do
         = s_('Preferences|Default dashboard')
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 61642fbbd59..7dafb389938 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -8299,7 +8299,7 @@ msgstr ""
 msgid "Preferences|Behavior"
 msgstr ""
 
-msgid "Preferences|Choose between fixed (max. 1280px) and fluid (100%%) application layout."
+msgid "Preferences|Choose between fixed (max. 1280px) and fluid (%{percentage}) application layout."
 msgstr ""
 
 msgid "Preferences|Choose what content you want to see on a project’s overview page."
-- 
cgit v1.2.1


From b70aabf9b394448ab1056950a3547e08531ea01e Mon Sep 17 00:00:00 2001
From: Gabriel Mazetto <brodock@gmail.com>
Date: Sat, 24 Aug 2019 18:16:44 -0300
Subject: Backport expired job artifact trait

---
 spec/factories/ci/job_artifacts.rb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/spec/factories/ci/job_artifacts.rb b/spec/factories/ci/job_artifacts.rb
index 2d68a8e9fe3..6f553cadfa3 100644
--- a/spec/factories/ci/job_artifacts.rb
+++ b/spec/factories/ci/job_artifacts.rb
@@ -8,6 +8,10 @@ FactoryBot.define do
     file_type :archive
     file_format :zip
 
+    trait :expired do
+      expire_at { Date.yesterday }
+    end
+
     trait :remote_store do
       file_store JobArtifactUploader::Store::REMOTE
     end
-- 
cgit v1.2.1


From 87e87b7b8c2f7e6731e92cdafd2671e983d97a92 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Sat, 24 Aug 2019 14:53:06 -0700
Subject: Bump ruby-prof to 1.0.0

This is significant improvement over the previous releases:
https://github.com/ruby-prof/ruby-prof/blob/master/CHANGES
---
 Gemfile      | 2 +-
 Gemfile.lock | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile b/Gemfile
index e5023a6f67d..6849793563c 100644
--- a/Gemfile
+++ b/Gemfile
@@ -399,7 +399,7 @@ gem 'mail_room', '~> 0.9.1'
 gem 'email_reply_trimmer', '~> 0.1'
 gem 'html2text'
 
-gem 'ruby-prof', '~> 0.17.0'
+gem 'ruby-prof', '~> 1.0.0'
 gem 'rbtrace', '~> 0.4', require: false
 gem 'memory_profiler', '~> 0.9', require: false
 gem 'benchmark-memory', '~> 0.1', require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index d9a32027f3c..db9b344cfd0 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -836,7 +836,7 @@ GEM
       i18n
     ruby-fogbugz (0.2.1)
       crack (~> 0.4)
-    ruby-prof (0.17.0)
+    ruby-prof (1.0.0)
     ruby-progressbar (1.10.1)
     ruby-saml (1.7.2)
       nokogiri (>= 1.5.10)
@@ -1215,7 +1215,7 @@ DEPENDENCIES
   rubocop-performance (~> 1.1.0)
   rubocop-rspec (~> 1.22.1)
   ruby-fogbugz (~> 0.2.1)
-  ruby-prof (~> 0.17.0)
+  ruby-prof (~> 1.0.0)
   ruby-progressbar
   ruby_parser (~> 3.8)
   rubyzip (~> 1.2.2)
-- 
cgit v1.2.1


From f855f9b8158f80cd227e054337f64760d8f841a0 Mon Sep 17 00:00:00 2001
From: Reuben Pereira <rpereira@gitlab.com>
Date: Sun, 25 Aug 2019 20:14:52 +0000
Subject: Add helper to exactly undo cleanup_concurrent_column_rename

- Also add helper to undo rename_column_concurrently.
---
 ..._from_hooks_and_services_application_setting.rb |   2 +-
 ...ooks_and_services_application_setting_rename.rb |   2 +-
 lib/gitlab/database/migration_helpers.rb           |  41 +++++++-
 spec/lib/gitlab/database/migration_helpers_spec.rb | 106 +++++++++++++++++++++
 4 files changed, 148 insertions(+), 3 deletions(-)

diff --git a/db/migrate/20190726101050_rename_allow_local_requests_from_hooks_and_services_application_setting.rb b/db/migrate/20190726101050_rename_allow_local_requests_from_hooks_and_services_application_setting.rb
index ac65e8d745c..cce8942128c 100644
--- a/db/migrate/20190726101050_rename_allow_local_requests_from_hooks_and_services_application_setting.rb
+++ b/db/migrate/20190726101050_rename_allow_local_requests_from_hooks_and_services_application_setting.rb
@@ -12,6 +12,6 @@ class RenameAllowLocalRequestsFromHooksAndServicesApplicationSetting < ActiveRec
   end
 
   def down
-    cleanup_concurrent_column_rename :application_settings, :allow_local_requests_from_web_hooks_and_services, :allow_local_requests_from_hooks_and_services
+    undo_rename_column_concurrently :application_settings, :allow_local_requests_from_hooks_and_services, :allow_local_requests_from_web_hooks_and_services
   end
 end
diff --git a/db/post_migrate/20190801114109_cleanup_allow_local_requests_from_hooks_and_services_application_setting_rename.rb b/db/post_migrate/20190801114109_cleanup_allow_local_requests_from_hooks_and_services_application_setting_rename.rb
index 127e44254ac..cb86f843f9c 100644
--- a/db/post_migrate/20190801114109_cleanup_allow_local_requests_from_hooks_and_services_application_setting_rename.rb
+++ b/db/post_migrate/20190801114109_cleanup_allow_local_requests_from_hooks_and_services_application_setting_rename.rb
@@ -12,6 +12,6 @@ class CleanupAllowLocalRequestsFromHooksAndServicesApplicationSettingRename < Ac
   end
 
   def down
-    rename_column_concurrently :application_settings, :allow_local_requests_from_web_hooks_and_services, :allow_local_requests_from_hooks_and_services
+    undo_cleanup_concurrent_column_rename :application_settings, :allow_local_requests_from_hooks_and_services, :allow_local_requests_from_web_hooks_and_services
   end
 end
diff --git a/lib/gitlab/database/migration_helpers.rb b/lib/gitlab/database/migration_helpers.rb
index 8bc45f6e78c..57a413f8e04 100644
--- a/lib/gitlab/database/migration_helpers.rb
+++ b/lib/gitlab/database/migration_helpers.rb
@@ -470,7 +470,7 @@ module Gitlab
         # We set the default value _after_ adding the column so we don't end up
         # updating any existing data with the default value. This isn't
         # necessary since we copy over old values further down.
-        change_column_default(table, new, old_col.default) if old_col.default
+        change_column_default(table, new, old_col.default) unless old_col.default.nil?
 
         install_rename_triggers(table, old, new)
 
@@ -482,6 +482,16 @@ module Gitlab
         copy_foreign_keys(table, old, new)
       end
 
+      def undo_rename_column_concurrently(table, old, new)
+        trigger_name = rename_trigger_name(table, old, new)
+
+        check_trigger_permissions!(table)
+
+        remove_rename_triggers_for_postgresql(table, trigger_name)
+
+        remove_column(table, new)
+      end
+
       # Installs triggers in a table that keep a new column in sync with an old
       # one.
       #
@@ -547,6 +557,35 @@ module Gitlab
         remove_column(table, old)
       end
 
+      def undo_cleanup_concurrent_column_rename(table, old, new, type: nil)
+        if transaction_open?
+          raise 'undo_cleanup_concurrent_column_rename can not be run inside a transaction'
+        end
+
+        check_trigger_permissions!(table)
+
+        new_column = column_for(table, new)
+
+        add_column(table, old, type || new_column.type,
+                   limit: new_column.limit,
+                   precision: new_column.precision,
+                   scale: new_column.scale)
+
+        # We set the default value _after_ adding the column so we don't end up
+        # updating any existing data with the default value. This isn't
+        # necessary since we copy over old values further down.
+        change_column_default(table, old, new_column.default) unless new_column.default.nil?
+
+        install_rename_triggers(table, old, new)
+
+        update_column_in_batches(table, old, Arel::Table.new(table)[new])
+
+        change_column_null(table, old, false) unless new_column.null
+
+        copy_indexes(table, new, old)
+        copy_foreign_keys(table, new, old)
+      end
+
       # Changes the column type of a table using a background migration.
       #
       # Because this method uses a background migration it's more suitable for
diff --git a/spec/lib/gitlab/database/migration_helpers_spec.rb b/spec/lib/gitlab/database/migration_helpers_spec.rb
index fe44b09aa24..cff4eb398bf 100644
--- a/spec/lib/gitlab/database/migration_helpers_spec.rb
+++ b/spec/lib/gitlab/database/migration_helpers_spec.rb
@@ -576,6 +576,38 @@ describe Gitlab::Database::MigrationHelpers do
 
         model.rename_column_concurrently(:users, :old, :new)
       end
+
+      context 'when default is false' do
+        let(:old_column) do
+          double(:column,
+               type: :boolean,
+               limit: nil,
+               default: false,
+               null: false,
+               precision: nil,
+               scale: nil)
+        end
+
+        it 'copies the default to the new column' do
+          expect(model).to receive(:change_column_default)
+            .with(:users, :new, old_column.default)
+
+          model.rename_column_concurrently(:users, :old, :new)
+        end
+      end
+    end
+  end
+
+  describe '#undo_rename_column_concurrently' do
+    it 'reverses the operations of rename_column_concurrently' do
+      expect(model).to receive(:check_trigger_permissions!).with(:users)
+
+      expect(model).to receive(:remove_rename_triggers_for_postgresql)
+        .with(:users, /trigger_.{12}/)
+
+      expect(model).to receive(:remove_column).with(:users, :new)
+
+      model.undo_rename_column_concurrently(:users, :old, :new)
     end
   end
 
@@ -592,6 +624,80 @@ describe Gitlab::Database::MigrationHelpers do
     end
   end
 
+  describe '#undo_cleanup_concurrent_column_rename' do
+    context 'in a transaction' do
+      it 'raises RuntimeError' do
+        allow(model).to receive(:transaction_open?).and_return(true)
+
+        expect { model.undo_cleanup_concurrent_column_rename(:users, :old, :new) }
+          .to raise_error(RuntimeError)
+      end
+    end
+
+    context 'outside a transaction' do
+      let(:new_column) do
+        double(:column,
+              type: :integer,
+              limit: 8,
+              default: 0,
+              null: false,
+              precision: 5,
+              scale: 1)
+      end
+
+      let(:trigger_name) { model.rename_trigger_name(:users, :old, :new) }
+
+      before do
+        allow(model).to receive(:transaction_open?).and_return(false)
+        allow(model).to receive(:column_for).and_return(new_column)
+      end
+
+      it 'reverses the operations of cleanup_concurrent_column_rename' do
+        expect(model).to receive(:check_trigger_permissions!).with(:users)
+
+        expect(model).to receive(:install_rename_triggers_for_postgresql)
+          .with(trigger_name, '"users"', '"old"', '"new"')
+
+        expect(model).to receive(:add_column)
+          .with(:users, :old, :integer,
+              limit: new_column.limit,
+              precision: new_column.precision,
+              scale: new_column.scale)
+
+        expect(model).to receive(:change_column_default)
+          .with(:users, :old, new_column.default)
+
+        expect(model).to receive(:update_column_in_batches)
+
+        expect(model).to receive(:change_column_null).with(:users, :old, false)
+
+        expect(model).to receive(:copy_indexes).with(:users, :new, :old)
+        expect(model).to receive(:copy_foreign_keys).with(:users, :new, :old)
+
+        model.undo_cleanup_concurrent_column_rename(:users, :old, :new)
+      end
+
+      context 'when default is false' do
+        let(:new_column) do
+          double(:column,
+               type: :boolean,
+               limit: nil,
+               default: false,
+               null: false,
+               precision: nil,
+               scale: nil)
+        end
+
+        it 'copies the default to the old column' do
+          expect(model).to receive(:change_column_default)
+            .with(:users, :old, new_column.default)
+
+          model.undo_cleanup_concurrent_column_rename(:users, :old, :new)
+        end
+      end
+    end
+  end
+
   describe '#change_column_type_concurrently' do
     it 'changes the column type' do
       expect(model).to receive(:rename_column_concurrently)
-- 
cgit v1.2.1


From c2541b64099b761b7207b808e0d752f9c8a696c4 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Sun, 25 Aug 2019 06:50:35 -0700
Subject: Upgrade Mermaid to v8.2.4

This fixes a regression that does not permit spaces in subgraph titles.

Full details: https://github.com/knsv/mermaid/releases
---
 changelogs/unreleased/sh-upgrade-mermaid-8-2-4.yml |  5 ++
 doc/user/markdown.md                               |  3 -
 package.json                                       |  2 +-
 yarn.lock                                          | 65 ++--------------------
 4 files changed, 12 insertions(+), 63 deletions(-)
 create mode 100644 changelogs/unreleased/sh-upgrade-mermaid-8-2-4.yml

diff --git a/changelogs/unreleased/sh-upgrade-mermaid-8-2-4.yml b/changelogs/unreleased/sh-upgrade-mermaid-8-2-4.yml
new file mode 100644
index 00000000000..bdb64e43ecf
--- /dev/null
+++ b/changelogs/unreleased/sh-upgrade-mermaid-8-2-4.yml
@@ -0,0 +1,5 @@
+---
+title: Upgrade Mermaid to v8.2.4
+merge_request: 32186
+author:
+type: fixed
diff --git a/doc/user/markdown.md b/doc/user/markdown.md
index 17bbed2945d..840e1856dd9 100644
--- a/doc/user/markdown.md
+++ b/doc/user/markdown.md
@@ -181,9 +181,6 @@ graph TD;
 
 #### Subgraphs
 
-NOTE: **Note:** GitLab 12.1 and up now [requires quotes around subgraph
-titles that contain multiple words](https://github.com/knsv/mermaid/pull/845).
-
 Subgraphs can also be included:
 
 ~~~
diff --git a/package.json b/package.json
index 384584a944a..1948e423e22 100644
--- a/package.json
+++ b/package.json
@@ -97,7 +97,7 @@
     "jszip-utils": "^0.0.2",
     "katex": "^0.10.0",
     "marked": "^0.3.12",
-    "mermaid": "^8.2.3",
+    "mermaid": "^8.2.4",
     "monaco-editor": "^0.15.6",
     "monaco-editor-webpack-plugin": "^1.7.0",
     "mousetrap": "^1.4.6",
diff --git a/yarn.lock b/yarn.lock
index dd85729333a..04ba96031a0 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1637,7 +1637,7 @@ ansi-align@^2.0.0:
   dependencies:
     string-width "^2.0.0"
 
-ansi-colors@^3.0.0, ansi-colors@^3.2.4:
+ansi-colors@^3.0.0:
   version "3.2.4"
   resolved "https://registry.yarnpkg.com/ansi-colors/-/ansi-colors-3.2.4.tgz#e3a3da4bfbae6c86a9c285625de124a234026fbf"
   integrity sha512-hHUXGagefjN2iRrID63xckIvotOXOojhQKWIPUZ4mNUZ9nLZW+7FMNoE1lOkEhNWYsx/7ysGIuJYCiMAA9FnrA==
@@ -1647,13 +1647,6 @@ ansi-escapes@^3.0.0:
   resolved "https://registry.yarnpkg.com/ansi-escapes/-/ansi-escapes-3.2.0.tgz#8780b98ff9dbf5638152d1f1fe5c1d7b4442976b"
   integrity sha512-cBhpre4ma+U0T1oM5fXg7Dy1Jw7zzwv7lt/GoCpr+hDQJoYnKVPLL4dCvSEFMmQurOQvSrwT7SL/DAlhBI97RQ==
 
-ansi-gray@^0.1.1:
-  version "0.1.1"
-  resolved "https://registry.yarnpkg.com/ansi-gray/-/ansi-gray-0.1.1.tgz#2962cf54ec9792c48510a3deb524436861ef7251"
-  integrity sha1-KWLPVOyXksSFEKPetSRDaGHvclE=
-  dependencies:
-    ansi-wrap "0.1.0"
-
 ansi-html@0.0.7, ansi-html@^0.0.7:
   version "0.0.7"
   resolved "https://registry.yarnpkg.com/ansi-html/-/ansi-html-0.0.7.tgz#813584021962a9e9e6fd039f940d12f56ca7859e"
@@ -1686,11 +1679,6 @@ ansi-styles@^3.2.0, ansi-styles@^3.2.1:
   dependencies:
     color-convert "^1.9.0"
 
-ansi-wrap@0.1.0:
-  version "0.1.0"
-  resolved "https://registry.yarnpkg.com/ansi-wrap/-/ansi-wrap-0.1.0.tgz#a82250ddb0015e9a27ca82e82ea603bbfa45efaf"
-  integrity sha1-qCJQ3bABXponyoLoLqYDu/pF768=
-
 anymatch@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/anymatch/-/anymatch-2.0.0.tgz#bcb24b4f37934d9aa7ac17b4adaf89e7c76ef2eb"
@@ -2985,11 +2973,6 @@ color-name@1.1.3, color-name@^1.0.0:
   resolved "https://registry.yarnpkg.com/color-name/-/color-name-1.1.3.tgz#a7d0558bd89c42f795dd42328f740831ca53bc25"
   integrity sha1-p9BVi9icQveV3UIyj3QIMcpTvCU=
 
-color-support@^1.1.3:
-  version "1.1.3"
-  resolved "https://registry.yarnpkg.com/color-support/-/color-support-1.1.3.tgz#93834379a1cc9a0c61f82f52f0d04322251bd5a2"
-  integrity sha512-qiBjkpbMLO/HL68y+lh4q0/O1MZFj2RX6X/KmMa3+gJD3z+WwI1ZzDHysvqHGS3mP6mznPckpXmw1nI9cJjyRg==
-
 colors@^1.1.0:
   version "1.3.3"
   resolved "https://registry.yarnpkg.com/colors/-/colors-1.3.3.tgz#39e005d546afe01e01f9c4ca8fa50f686a01205d"
@@ -5027,16 +5010,6 @@ extsprintf@1.3.0, extsprintf@^1.2.0:
   resolved "https://registry.yarnpkg.com/extsprintf/-/extsprintf-1.3.0.tgz#96918440e3041a7a414f8c52e3c574eb3c3e1e05"
   integrity sha1-lpGEQOMEGnpBT4xS48V06zw+HgU=
 
-fancy-log@^1.3.3:
-  version "1.3.3"
-  resolved "https://registry.yarnpkg.com/fancy-log/-/fancy-log-1.3.3.tgz#dbc19154f558690150a23953a0adbd035be45fc7"
-  integrity sha512-k9oEhlyc0FrVh25qYuSELjr8oxsCoc4/LEZfg2iJJrfEk/tZL9bCoJE47gqAvI2m/AUjluCS4+3I0eTx8n3AEw==
-  dependencies:
-    ansi-gray "^0.1.1"
-    color-support "^1.1.3"
-    parse-node-version "^1.0.0"
-    time-stamp "^1.0.0"
-
 fast-deep-equal@^2.0.1:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-2.0.1.tgz#7b05218ddf9667bf7f370bf7fdb2cb15fdd0aa49"
@@ -5782,16 +5755,6 @@ growly@^1.3.0:
   resolved "https://registry.yarnpkg.com/growly/-/growly-1.3.0.tgz#f10748cbe76af964b7c96c93c6bcc28af120c081"
   integrity sha1-8QdIy+dq+WS3yWyTxrzCivEgwIE=
 
-gulp-print@^5.0.2:
-  version "5.0.2"
-  resolved "https://registry.yarnpkg.com/gulp-print/-/gulp-print-5.0.2.tgz#8f379148218d2e168461baa74352e11d1bf7aa75"
-  integrity sha512-iIpHMzC/b3gFvVXOfP9Jk94SWGIsDLVNUrxULRleQev+08ug07mh84b1AOlW6QDQdmInQiqDFqJN1UvhU2nXdg==
-  dependencies:
-    ansi-colors "^3.2.4"
-    fancy-log "^1.3.3"
-    map-stream "0.0.7"
-    vinyl "^2.2.0"
-
 gzip-size@^5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/gzip-size/-/gzip-size-5.0.0.tgz#a55ecd99222f4c48fd8c01c625ce3b349d0a0e80"
@@ -7965,11 +7928,6 @@ map-obj@^2.0.0:
   resolved "https://registry.yarnpkg.com/map-obj/-/map-obj-2.0.0.tgz#a65cd29087a92598b8791257a523e021222ac1f9"
   integrity sha1-plzSkIepJZi4eRJXpSPgISIqwfk=
 
-map-stream@0.0.7:
-  version "0.0.7"
-  resolved "https://registry.yarnpkg.com/map-stream/-/map-stream-0.0.7.tgz#8a1f07896d82b10926bd3744a2420009f88974a8"
-  integrity sha1-ih8HiW2CsQkmvTdEokIACfiJdKg=
-
 map-visit@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/map-visit/-/map-visit-1.0.0.tgz#ecdca8f13144e660f1b5bd41f12f3479d98dfb8f"
@@ -8165,10 +8123,10 @@ merge2@^1.2.3:
   resolved "https://registry.yarnpkg.com/merge2/-/merge2-1.2.3.tgz#7ee99dbd69bb6481689253f018488a1b902b0ed5"
   integrity sha512-gdUU1Fwj5ep4kplwcmftruWofEFt6lfpkkr3h860CXbAB9c3hGb55EOL2ali0Td5oebvW0E1+3Sr+Ur7XfKpRA==
 
-mermaid@^8.2.3:
-  version "8.2.3"
-  resolved "https://registry.yarnpkg.com/mermaid/-/mermaid-8.2.3.tgz#609bad45bedc3ee1a935161c11c3c22689cfecd9"
-  integrity sha512-G2p9BAAEeTtogPs4YXM8KyX+TsZULlgk0tGvmBPfBZ5j3YCPxgAxG9ZzleiYNItF7M1hGkE485BDLN8DbfR+/Q==
+mermaid@^8.2.4:
+  version "8.2.4"
+  resolved "https://registry.yarnpkg.com/mermaid/-/mermaid-8.2.4.tgz#52bcd45611fd8552ab9ac4e385d2766a0e38dcf7"
+  integrity sha512-2la1eJhu4n+Uug4zbxFnkETFDJ9U32OY/fRP8g8A1DrRdfT3Er+7CuUSvxfhIDxl+AxSEU4dXdqCiToZAVMCmQ==
   dependencies:
     "@braintree/sanitize-url" "^3.1.0"
     d3 "^5.7.0"
@@ -8176,7 +8134,6 @@ mermaid@^8.2.3:
     dagre-layout "^0.8.8"
     documentation "^12.0.1"
     graphlibrary "^2.2.0"
-    gulp-print "^5.0.2"
     he "^1.2.0"
     lodash "^4.17.11"
     minify "^4.1.1"
@@ -9145,11 +9102,6 @@ parse-json@^4.0.0:
     error-ex "^1.3.1"
     json-parse-better-errors "^1.0.1"
 
-parse-node-version@^1.0.0:
-  version "1.0.1"
-  resolved "https://registry.yarnpkg.com/parse-node-version/-/parse-node-version-1.0.1.tgz#e2b5dbede00e7fa9bc363607f53327e8b073189b"
-  integrity sha512-3YHlOa/JgH6Mnpr05jP9eDG254US9ek25LyIxZlDItp2iJtwyaXQb57lBYLdT3MowkUFYEV2XXNAYIPlESvJlA==
-
 parse-passwd@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/parse-passwd/-/parse-passwd-1.0.0.tgz#6d5b934a456993b23d37f40a382d6f1666a8e5c6"
@@ -11783,11 +11735,6 @@ thunky@^0.1.0:
   resolved "https://registry.yarnpkg.com/thunky/-/thunky-0.1.0.tgz#bf30146824e2b6e67b0f2d7a4ac8beb26908684e"
   integrity sha1-vzAUaCTituZ7Dy16Ssi+smkIaE4=
 
-time-stamp@^1.0.0:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/time-stamp/-/time-stamp-1.1.0.tgz#764a5a11af50561921b133f3b44e618687e0f5c3"
-  integrity sha1-dkpaEa9QVhkhsTPztE5hhofg9cM=
-
 timeago.js@^3.0.2:
   version "3.0.2"
   resolved "https://registry.yarnpkg.com/timeago.js/-/timeago.js-3.0.2.tgz#32a67e7c0d887ea42ca588d3aae26f77de5e76cc"
@@ -12618,7 +12565,7 @@ vinyl-sourcemap@^1.1.0:
     remove-bom-buffer "^3.0.0"
     vinyl "^2.0.0"
 
-vinyl@^2.0.0, vinyl@^2.1.0, vinyl@^2.2.0:
+vinyl@^2.0.0, vinyl@^2.1.0:
   version "2.2.0"
   resolved "https://registry.yarnpkg.com/vinyl/-/vinyl-2.2.0.tgz#d85b07da96e458d25b2ffe19fece9f2caa13ed86"
   integrity sha512-MBH+yP0kC/GQ5GwBqrTPTzEfiiLjta7hTtvQtbxBgTeSXsmKQRQecjibMbxIXzVT3Y9KJK+drOz1/k+vsu8Nkg==
-- 
cgit v1.2.1


From 27fbd36adeddd6fe162c9a2dbe7a39b3389f4b45 Mon Sep 17 00:00:00 2001
From: Jason Goodman <jgoodman@gitlab.com>
Date: Mon, 26 Aug 2019 04:13:54 +0000
Subject: Install Unleash Client Gem

---
 Gemfile      | 1 +
 Gemfile.lock | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/Gemfile b/Gemfile
index e5023a6f67d..570462822f2 100644
--- a/Gemfile
+++ b/Gemfile
@@ -438,6 +438,7 @@ gem 'toml-rb', '~> 1.0.0', require: false
 gem 'flipper', '~> 0.13.0'
 gem 'flipper-active_record', '~> 0.13.0'
 gem 'flipper-active_support_cache_store', '~> 0.13.0'
+gem 'unleash', '~> 0.1.5'
 
 # Structured logging
 gem 'lograge', '~> 0.5'
diff --git a/Gemfile.lock b/Gemfile.lock
index d9a32027f3c..43b9eec4967 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -535,6 +535,7 @@ GEM
     multi_json (1.13.1)
     multi_xml (0.6.0)
     multipart-post (2.0.0)
+    murmurhash3 (0.1.6)
     mustermann (1.0.3)
     mustermann-grape (1.0.0)
       mustermann (~> 1.0.0)
@@ -972,6 +973,8 @@ GEM
       get_process_mem (~> 0)
       unicorn (>= 4, < 6)
     uniform_notifier (1.10.0)
+    unleash (0.1.5)
+      murmurhash3 (~> 0.1.6)
     unparser (0.4.5)
       abstract_type (~> 0.0.7)
       adamantium (~> 0.2.0)
@@ -1251,6 +1254,7 @@ DEPENDENCIES
   unf (~> 0.1.4)
   unicorn (~> 5.4.1)
   unicorn-worker-killer (~> 0.4.4)
+  unleash (~> 0.1.5)
   validates_hostname (~> 1.0.6)
   version_sorter (~> 2.2.4)
   vmstat (~> 2.3.0)
-- 
cgit v1.2.1


From b99cf2024d1b518d876bc4f1f4aac8549b4dd993 Mon Sep 17 00:00:00 2001
From: rpereira2 <rpereira@gitlab.com>
Date: Mon, 26 Aug 2019 12:41:25 +0530
Subject: Add nil check for Gitlab.config.prometheus

---
 .../self_monitoring/project/create_service.rb                 |  4 ++--
 .../self_monitoring/project/create_service_spec.rb            | 11 +++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/lib/gitlab/database_importers/self_monitoring/project/create_service.rb b/lib/gitlab/database_importers/self_monitoring/project/create_service.rb
index 164854e1e1a..6badacc2fc9 100644
--- a/lib/gitlab/database_importers/self_monitoring/project/create_service.rb
+++ b/lib/gitlab/database_importers/self_monitoring/project/create_service.rb
@@ -175,7 +175,7 @@ module Gitlab
           end
 
           def prometheus_enabled?
-            Gitlab.config.prometheus.enable
+            Gitlab.config.prometheus.enable if Gitlab.config.prometheus
           rescue Settingslogic::MissingSetting
             log_error(_('prometheus.enable is not present in gitlab.yml'))
 
@@ -183,7 +183,7 @@ module Gitlab
           end
 
           def prometheus_listen_address
-            Gitlab.config.prometheus.listen_address
+            Gitlab.config.prometheus.listen_address if Gitlab.config.prometheus
           rescue Settingslogic::MissingSetting
             log_error(_('prometheus.listen_address is not present in gitlab.yml'))
 
diff --git a/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb b/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
index 9bd0d800086..b25f0f6b887 100644
--- a/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
+++ b/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
@@ -197,6 +197,17 @@ describe Gitlab::DatabaseImporters::SelfMonitoring::Project::CreateService do
         end
       end
 
+      context 'when prometheus setting is nil' do
+        before do
+          stub_config(prometheus: nil)
+        end
+
+        it 'does not fail' do
+          expect(result).to include(status: :success)
+          expect(project.prometheus_service).to be_nil
+        end
+      end
+
       context 'when prometheus setting is disabled in gitlab.yml' do
         let(:prometheus_settings) do
           {
-- 
cgit v1.2.1


From a5b18169789cc02ce9e0e0aff029ecc5c5e2b94e Mon Sep 17 00:00:00 2001
From: Lucas Charles <me@lucascharles.me>
Date: Mon, 26 Aug 2019 08:18:32 +0000
Subject: Add changelog exclusion language for docs-only changes

---
 doc/development/changelog.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/development/changelog.md b/doc/development/changelog.md
index bd07a01e782..814624c7586 100644
--- a/doc/development/changelog.md
+++ b/doc/development/changelog.md
@@ -35,6 +35,7 @@ the `author` field. GitLab team members **should not**.
 
 - Any user-facing change **should** have a changelog entry. Example: "GitLab now
   uses system fonts for all text."
+- Any docs-only changes **should not** have a changelog entry.
 - Any change behind a feature flag **should not** have a changelog entry. The entry should be added [in the merge request removing the feature flags](feature_flags/development.md).
 - A fix for a regression introduced and then fixed in the same release (i.e.,
   fixing a bug introduced during a monthly release candidate) **should not**
-- 
cgit v1.2.1


From 6c7638dde120385f7cb1f2759f2865c6b0966117 Mon Sep 17 00:00:00 2001
From: Tristan Williams <2390023-tristan@users.noreply.gitlab.com>
Date: Mon, 26 Aug 2019 08:18:49 +0000
Subject: Docs: Replace old screenshots in project forking workflow

---
 doc/workflow/forking/branch_select.png              | Bin 15410 -> 18042 bytes
 doc/workflow/forking/merge_request.png              | Bin 16329 -> 24625 bytes
 doc/workflow/forking_workflow.md                    |   7 +++----
 .../img/forking_workflow_choose_namespace.png       | Bin 26275 -> 35084 bytes
 doc/workflow/img/forking_workflow_fork_button.png   | Bin 12962 -> 25754 bytes
 .../img/forking_workflow_path_taken_error.png       | Bin 10092 -> 21497 bytes
 6 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/doc/workflow/forking/branch_select.png b/doc/workflow/forking/branch_select.png
index 77236137190..0ea5410f832 100644
Binary files a/doc/workflow/forking/branch_select.png and b/doc/workflow/forking/branch_select.png differ
diff --git a/doc/workflow/forking/merge_request.png b/doc/workflow/forking/merge_request.png
index 407ddfb4799..43851203f3f 100644
Binary files a/doc/workflow/forking/merge_request.png and b/doc/workflow/forking/merge_request.png differ
diff --git a/doc/workflow/forking_workflow.md b/doc/workflow/forking_workflow.md
index 869a0a621c3..82c2709143d 100644
--- a/doc/workflow/forking_workflow.md
+++ b/doc/workflow/forking_workflow.md
@@ -10,8 +10,7 @@ document more information about using branches to work together.
 
 Forking a project is in most cases a two-step process.
 
-1. Click on the fork button located in the middle of the page or a project's
-   home page right next to the stars button.
+1. Click on the fork button located located in between the star and clone buttons on the project's home page.
 
    ![Fork button](img/forking_workflow_fork_button.png)
 
@@ -25,7 +24,7 @@ Forking a project is in most cases a two-step process.
    **Note:**
    If the namespace you chose to fork the project to has another project with
    the same path name, you will be presented with a warning that the forking
-   could not be completed. Try to resolve the error and repeat the forking
+   could not be completed. Try to resolve the error before repeating the forking
    process.
 
    ![Path taken error](img/forking_workflow_path_taken_error.png)
@@ -44,7 +43,7 @@ create the [merge request](merge_requests.md).
 ![Selecting branches](forking/branch_select.png)
 
 You can then assign the merge request to someone to have them review
-your changes. Upon pressing the 'Accept Merge Request' button, your
+your changes. Upon pressing the 'Submit Merge Request' button, your
 changes will be added to the repository and branch you're merging into.
 
 ![New merge request](forking/merge_request.png)
diff --git a/doc/workflow/img/forking_workflow_choose_namespace.png b/doc/workflow/img/forking_workflow_choose_namespace.png
index b34b12090a1..eb023ca85f2 100644
Binary files a/doc/workflow/img/forking_workflow_choose_namespace.png and b/doc/workflow/img/forking_workflow_choose_namespace.png differ
diff --git a/doc/workflow/img/forking_workflow_fork_button.png b/doc/workflow/img/forking_workflow_fork_button.png
index 941d5363c35..7fb07529b6d 100644
Binary files a/doc/workflow/img/forking_workflow_fork_button.png and b/doc/workflow/img/forking_workflow_fork_button.png differ
diff --git a/doc/workflow/img/forking_workflow_path_taken_error.png b/doc/workflow/img/forking_workflow_path_taken_error.png
index df938da5677..ef62d0ab6a9 100644
Binary files a/doc/workflow/img/forking_workflow_path_taken_error.png and b/doc/workflow/img/forking_workflow_path_taken_error.png differ
-- 
cgit v1.2.1


From 2e83665ed30259a7908350d316605a9c100f0876 Mon Sep 17 00:00:00 2001
From: Robert Schilling <rschilling@student.tugraz.at>
Date: Wed, 13 Feb 2019 21:18:40 +0100
Subject: API: Promote project labels to group labels

---
 ...omote-label-to-group-label-via-api-endpoint.yml |  5 +++++
 lib/api/labels.rb                                  | 25 ++++++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 changelogs/unreleased/57657-promote-label-to-group-label-via-api-endpoint.yml

diff --git a/changelogs/unreleased/57657-promote-label-to-group-label-via-api-endpoint.yml b/changelogs/unreleased/57657-promote-label-to-group-label-via-api-endpoint.yml
new file mode 100644
index 00000000000..572bce34f45
--- /dev/null
+++ b/changelogs/unreleased/57657-promote-label-to-group-label-via-api-endpoint.yml
@@ -0,0 +1,5 @@
+---
+title: 'API: Promote project labels to group labels'
+merge_request: 25218
+author: Robert Schilling
+type: added
diff --git a/lib/api/labels.rb b/lib/api/labels.rb
index 83d645ca07a..5079d95c2b4 100644
--- a/lib/api/labels.rb
+++ b/lib/api/labels.rb
@@ -62,6 +62,31 @@ module API
       delete ':id/labels' do
         delete_label(user_project)
       end
+
+      desc 'Promote a label to a group label' do
+        detail 'This feature was added in GitLab 11.9'
+        success Entities::GroupLabel
+      end
+      params do
+        requires :name, type: String, desc: 'The name of the label to be promoted'
+      end
+      post ':id/labels/promote' do
+        authorize! :admin_label, parent
+
+        label = find_label(parent, params[:name], include_ancestor_groups: false)
+
+        begin
+          group_label = Labels::PromoteService.new(user_project, current_user).execute(label)
+
+          if group_label
+            present group_label, with: Entities::GroupLabel, current_user: current_user, parent: user_project.group
+          else
+            render_api_error!('Failed to promote project label to group label', 400)
+          end
+        rescue => error
+          render_api_error!(error.to_s, 400)
+        end
+      end
     end
   end
 end
-- 
cgit v1.2.1


From 41412f73604159ca735420396df73f7b6eef6f86 Mon Sep 17 00:00:00 2001
From: Robert Schilling <rschilling@student.tugraz.at>
Date: Wed, 13 Feb 2019 22:51:53 +0100
Subject: Add docs and first specs

---
 doc/api/labels.md                | 34 ++++++++++++++++++++++++++++++++++
 lib/api/labels.rb                |  6 +++---
 spec/requests/api/labels_spec.rb | 23 +++++++++++++++++++++++
 3 files changed, 60 insertions(+), 3 deletions(-)

diff --git a/doc/api/labels.md b/doc/api/labels.md
index fde1d861cf6..9b640a0203d 100644
--- a/doc/api/labels.md
+++ b/doc/api/labels.md
@@ -186,6 +186,40 @@ Example response:
 }
 ```
 
+## Promote a project label to a group label
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/25218) in GitLab 11.9.
+
+Promotes a project label to a group label.
+
+```
+POST /projects/:id/labels/promote
+```
+
+| Attribute       | Type    | Required                          | Description                      |
+| --------------- | ------- | --------------------------------- | -------------------------------  |
+| `id`      | integer/string    | yes      | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
+| `name`          | string  | yes                               | The name of the existing label   |
+
+```bash
+curl --request POST --data "name=documentation" --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/labels/promote"
+```
+
+Example response:
+
+```json
+{
+  "id" : 8,
+  "name" : "documentation",
+  "color" : "#8E44AD",
+  "description": "Documentation",
+  "open_issues_count": 1,
+  "closed_issues_count": 0,
+  "open_merge_requests_count": 2,
+  "subscribed": false
+}
+```
+
 ## Subscribe to a label
 
 Subscribes the authenticated user to a label to receive notifications.
diff --git a/lib/api/labels.rb b/lib/api/labels.rb
index 5079d95c2b4..9f847c39fac 100644
--- a/lib/api/labels.rb
+++ b/lib/api/labels.rb
@@ -71,12 +71,12 @@ module API
         requires :name, type: String, desc: 'The name of the label to be promoted'
       end
       post ':id/labels/promote' do
-        authorize! :admin_label, parent
+        authorize! :admin_label, user_project
 
-        label = find_label(parent, params[:name], include_ancestor_groups: false)
+        label = find_label(user_project, params[:name], include_ancestor_groups: false)
 
         begin
-          group_label = Labels::PromoteService.new(user_project, current_user).execute(label)
+          group_label = ::Labels::PromoteService.new(user_project, current_user).execute(label)
 
           if group_label
             present group_label, with: Entities::GroupLabel, current_user: current_user, parent: user_project.group
diff --git a/spec/requests/api/labels_spec.rb b/spec/requests/api/labels_spec.rb
index f6640fe41d0..047e8b6c507 100644
--- a/spec/requests/api/labels_spec.rb
+++ b/spec/requests/api/labels_spec.rb
@@ -473,6 +473,29 @@ describe API::Labels do
     end
   end
 
+  describe 'POST /projects/:id/labels/promote' do
+    it 'returns 200 if label is promoted' do
+      post api("/projects/#{project.id}/labels/promote", user), params: { name: 'label1' }
+
+      expect(response).to have_gitlab_http_status(200)
+      expect(json_response['name']).to eq(label1.name)
+      expect(json_response['color']).to eq('#FFFFFF')
+    end
+
+    it 'returns 404 if label does not exist' do
+      post api("/projects/#{project.id}/labels/promote", user), params: { name: 'unknown' }
+
+      expect(response).to have_gitlab_http_status(404)
+    end
+
+    it 'returns 400 if no label name given' do
+      post api("/projects/#{project.id}/labels/promote", user)
+
+      expect(response).to have_gitlab_http_status(400)
+      expect(json_response['error']).to eq('name is missing')
+    end
+  end
+
   describe "POST /projects/:id/labels/:label_id/subscribe" do
     context "when label_id is a label title" do
       it "subscribes to the label" do
-- 
cgit v1.2.1


From efafc98bd8ca7d4ed4c86f19325eb2aa51edd227 Mon Sep 17 00:00:00 2001
From: Robert Schilling <rschilling@student.tugraz.at>
Date: Thu, 14 Feb 2019 11:40:28 +0100
Subject: Move promote to put and add more specs

---
 doc/api/labels.md                |  4 ++--
 lib/api/labels.rb                |  2 +-
 spec/requests/api/labels_spec.rb | 34 +++++++++++++++++++++++++++++-----
 3 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/doc/api/labels.md b/doc/api/labels.md
index 9b640a0203d..21ac8a99965 100644
--- a/doc/api/labels.md
+++ b/doc/api/labels.md
@@ -193,7 +193,7 @@ Example response:
 Promotes a project label to a group label.
 
 ```
-POST /projects/:id/labels/promote
+PUT /projects/:id/labels/promote
 ```
 
 | Attribute       | Type    | Required                          | Description                      |
@@ -202,7 +202,7 @@ POST /projects/:id/labels/promote
 | `name`          | string  | yes                               | The name of the existing label   |
 
 ```bash
-curl --request POST --data "name=documentation" --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/labels/promote"
+curl --request PUT --data "name=documentation" --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/labels/promote"
 ```
 
 Example response:
diff --git a/lib/api/labels.rb b/lib/api/labels.rb
index 9f847c39fac..321ffa241b5 100644
--- a/lib/api/labels.rb
+++ b/lib/api/labels.rb
@@ -70,7 +70,7 @@ module API
       params do
         requires :name, type: String, desc: 'The name of the label to be promoted'
       end
-      post ':id/labels/promote' do
+      put ':id/labels/promote' do
         authorize! :admin_label, user_project
 
         label = find_label(user_project, params[:name], include_ancestor_groups: false)
diff --git a/spec/requests/api/labels_spec.rb b/spec/requests/api/labels_spec.rb
index 047e8b6c507..f7df9bb1b3f 100644
--- a/spec/requests/api/labels_spec.rb
+++ b/spec/requests/api/labels_spec.rb
@@ -473,23 +473,47 @@ describe API::Labels do
     end
   end
 
-  describe 'POST /projects/:id/labels/promote' do
+  describe 'PUT /projects/:id/labels/promote' do
+    let(:group) { create(:group) }
+
+    before do
+      project.update(group: group)
+    end
+
     it 'returns 200 if label is promoted' do
-      post api("/projects/#{project.id}/labels/promote", user), params: { name: 'label1' }
+      put api("/projects/#{project.id}/labels/promote", user), params: { name: label1.name }
 
       expect(response).to have_gitlab_http_status(200)
       expect(json_response['name']).to eq(label1.name)
-      expect(json_response['color']).to eq('#FFFFFF')
+      expect(json_response['color']).to eq(label1.color)
+    end
+
+    it 'returns 400 if group label already exists' do
+      create(:group_label, title: label1.name, group: group)
+
+      put api("/projects/#{project.id}/labels/promote", user), params: { name: label1.name }
+
+      expect(response).to have_gitlab_http_status(400)
+      expect(json_response['message']).to eq('Failed to promote project label to group label')
+    end
+
+    it 'returns 403 if guest promotes label' do
+      guest = create(:user)
+      project.add_guest(guest)
+
+      put api("/projects/#{project.id}/labels/promote", guest), params: { name: label1.name }
+
+      expect(response).to have_gitlab_http_status(403)
     end
 
     it 'returns 404 if label does not exist' do
-      post api("/projects/#{project.id}/labels/promote", user), params: { name: 'unknown' }
+      put api("/projects/#{project.id}/labels/promote", user), params: { name: 'unknown' }
 
       expect(response).to have_gitlab_http_status(404)
     end
 
     it 'returns 400 if no label name given' do
-      post api("/projects/#{project.id}/labels/promote", user)
+      put api("/projects/#{project.id}/labels/promote", user)
 
       expect(response).to have_gitlab_http_status(400)
       expect(json_response['error']).to eq('name is missing')
-- 
cgit v1.2.1


From b89df394684a0b98a5dc17f0c2e798c410dfb96f Mon Sep 17 00:00:00 2001
From: Lucy Fox <lucy@afox.org>
Date: Mon, 26 Aug 2019 08:48:06 +0000
Subject: Update gitlab_schema.rb to fix typo

---
 app/graphql/gitlab_schema.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/graphql/gitlab_schema.rb b/app/graphql/gitlab_schema.rb
index 7edd14e48f7..4c8612c8f2e 100644
--- a/app/graphql/gitlab_schema.rb
+++ b/app/graphql/gitlab_schema.rb
@@ -49,7 +49,7 @@ class GitlabSchema < GraphQL::Schema
     def id_from_object(object)
       unless object.respond_to?(:to_global_id)
         # This is an error in our schema and needs to be solved. So raise a
-        # more meaningfull error message
+        # more meaningful error message
         raise "#{object} does not implement `to_global_id`. "\
               "Include `GlobalID::Identification` into `#{object.class}"
       end
-- 
cgit v1.2.1


From e211387037c80c8ebadea4fe639e00c57a43cbc8 Mon Sep 17 00:00:00 2001
From: Dennis Appelt <dappelt@gitlab.com>
Date: Mon, 26 Aug 2019 09:14:15 +0000
Subject: Dont run SAST on tests

---
 .gitlab/ci/reports.gitlab-ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index ccd7d6ec84d..e3768ecf2a2 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -19,6 +19,7 @@ sast:
   cache: {}
   variables:
     SAST_BRAKEMAN_LEVEL: 2
+    SAST_EXCLUDED_PATHS: qa,spec,doc
 
 dependency_scanning:
   extends: .dedicated-no-docs
-- 
cgit v1.2.1


From a13abd6731ecc3dc24017729c019ad6af9a7b114 Mon Sep 17 00:00:00 2001
From: Patrick Derichs <pderichs@gitlab.com>
Date: Mon, 26 Aug 2019 09:20:00 +0000
Subject: Add edit_note and spec for editing quick actions

Call QuickActionsService on Note update

Add support for notes which just contain
commands after editing

Return http status gone (410) if note was deleted

Temporary frontend addition so it is not
failing when a note is deleted

Move specs to shared examples

Fix rubocop style issue

Deleting note on frontend when status is 410

Use guard clause for note which got deleted

Simplified condition for nil note

This method should no longer be called
with nil note

Refactoring of execute method to reduce
complexity

Move errors update to delete_note method

Note is now deleted visually when it only
contains commands after update

Add expectation

Fix style issues

Changing action to fix tests

Add tests for removeNote and update
deleteNote expectations
---
 app/assets/javascripts/lib/utils/http_status.js    |  1 +
 .../javascripts/notes/components/noteable_note.vue | 31 +++++++---
 app/assets/javascripts/notes/stores/actions.js     | 22 +++++---
 app/controllers/concerns/notes_actions.rb          |  5 ++
 app/controllers/projects/notes_controller.rb       |  2 +-
 app/services/notes/update_service.rb               | 66 ++++++++++++++++++----
 .../unreleased/21505-quickactions-update-pd.yml    |  5 ++
 locale/gitlab.pot                                  |  3 +
 spec/javascripts/notes/stores/actions_spec.js      | 45 ++++++++++++++-
 .../issue/move_quick_action_shared_examples.rb     | 49 ++++++++++++++++
 10 files changed, 197 insertions(+), 32 deletions(-)
 create mode 100644 changelogs/unreleased/21505-quickactions-update-pd.yml

diff --git a/app/assets/javascripts/lib/utils/http_status.js b/app/assets/javascripts/lib/utils/http_status.js
index 37ad1676f7a..5e5d10883a3 100644
--- a/app/assets/javascripts/lib/utils/http_status.js
+++ b/app/assets/javascripts/lib/utils/http_status.js
@@ -19,6 +19,7 @@ const httpStatusCodes = {
   UNAUTHORIZED: 401,
   FORBIDDEN: 403,
   NOT_FOUND: 404,
+  GONE: 410,
   UNPROCESSABLE_ENTITY: 422,
 };
 
diff --git a/app/assets/javascripts/notes/components/noteable_note.vue b/app/assets/javascripts/notes/components/noteable_note.vue
index 2f201839d45..9019f0542b6 100644
--- a/app/assets/javascripts/notes/components/noteable_note.vue
+++ b/app/assets/javascripts/notes/components/noteable_note.vue
@@ -14,6 +14,7 @@ import NoteBody from './note_body.vue';
 import eventHub from '../event_hub';
 import noteable from '../mixins/noteable';
 import resolvable from '../mixins/resolvable';
+import httpStatusCodes from '~/lib/utils/http_status';
 
 export default {
   name: 'NoteableNote',
@@ -122,7 +123,13 @@ export default {
   },
 
   methods: {
-    ...mapActions(['deleteNote', 'updateNote', 'toggleResolveNote', 'scrollToNoteIfNeeded']),
+    ...mapActions([
+      'deleteNote',
+      'removeNote',
+      'updateNote',
+      'toggleResolveNote',
+      'scrollToNoteIfNeeded',
+    ]),
     editHandler() {
       this.isEditing = true;
       this.$emit('handleEdit');
@@ -185,15 +192,21 @@ export default {
           this.updateSuccess();
           callback();
         })
-        .catch(() => {
-          this.isRequesting = false;
-          this.isEditing = true;
-          this.$nextTick(() => {
-            const msg = __('Something went wrong while editing your comment. Please try again.');
-            Flash(msg, 'alert', this.$el);
-            this.recoverNoteContent(noteText);
+        .catch(response => {
+          if (response.status === httpStatusCodes.GONE) {
+            this.removeNote(this.note);
+            this.updateSuccess();
             callback();
-          });
+          } else {
+            this.isRequesting = false;
+            this.isEditing = true;
+            this.$nextTick(() => {
+              const msg = __('Something went wrong while editing your comment. Please try again.');
+              Flash(msg, 'alert', this.$el);
+              this.recoverNoteContent(noteText);
+              callback();
+            });
+          }
         });
     },
     formCancelHandler(shouldConfirm, isDirty) {
diff --git a/app/assets/javascripts/notes/stores/actions.js b/app/assets/javascripts/notes/stores/actions.js
index b7857997d42..411bd585672 100644
--- a/app/assets/javascripts/notes/stores/actions.js
+++ b/app/assets/javascripts/notes/stores/actions.js
@@ -61,18 +61,22 @@ export const updateDiscussion = ({ commit, state }, discussion) => {
   return utils.findNoteObjectById(state.discussions, discussion.id);
 };
 
-export const deleteNote = ({ commit, dispatch, state }, note) =>
-  axios.delete(note.path).then(() => {
-    const discussion = state.discussions.find(({ id }) => id === note.discussion_id);
+export const removeNote = ({ commit, dispatch, state }, note) => {
+  const discussion = state.discussions.find(({ id }) => id === note.discussion_id);
 
-    commit(types.DELETE_NOTE, note);
+  commit(types.DELETE_NOTE, note);
 
-    dispatch('updateMergeRequestWidget');
-    dispatch('updateResolvableDiscussionsCounts');
+  dispatch('updateMergeRequestWidget');
+  dispatch('updateResolvableDiscussionsCounts');
 
-    if (isInMRPage()) {
-      dispatch('diffs/removeDiscussionsFromDiff', discussion);
-    }
+  if (isInMRPage()) {
+    dispatch('diffs/removeDiscussionsFromDiff', discussion);
+  }
+};
+
+export const deleteNote = ({ dispatch }, note) =>
+  axios.delete(note.path).then(() => {
+    dispatch('removeNote', note);
   });
 
 export const updateNote = ({ commit, dispatch }, { endpoint, note }) =>
diff --git a/app/controllers/concerns/notes_actions.rb b/app/controllers/concerns/notes_actions.rb
index d2a961efff7..4b7899d469b 100644
--- a/app/controllers/concerns/notes_actions.rb
+++ b/app/controllers/concerns/notes_actions.rb
@@ -73,6 +73,11 @@ module NotesActions
   # rubocop:disable Gitlab/ModuleWithInstanceVariables
   def update
     @note = Notes::UpdateService.new(project, current_user, update_note_params).execute(note)
+    unless @note
+      head :gone
+      return
+    end
+
     prepare_notes_for_rendering([@note])
 
     respond_to do |format|
diff --git a/app/controllers/projects/notes_controller.rb b/app/controllers/projects/notes_controller.rb
index 65d9b074eee..13e8453ed00 100644
--- a/app/controllers/projects/notes_controller.rb
+++ b/app/controllers/projects/notes_controller.rb
@@ -6,7 +6,7 @@ class Projects::NotesController < Projects::ApplicationController
   include NotesHelper
   include ToggleAwardEmoji
 
-  before_action :whitelist_query_limiting, only: [:create]
+  before_action :whitelist_query_limiting, only: [:create, :update]
   before_action :authorize_read_note!
   before_action :authorize_create_note!, only: [:create]
   before_action :authorize_resolve_note!, only: [:resolve, :unresolve]
diff --git a/app/services/notes/update_service.rb b/app/services/notes/update_service.rb
index 384d1dd2e50..853faed9d85 100644
--- a/app/services/notes/update_service.rb
+++ b/app/services/notes/update_service.rb
@@ -8,24 +8,70 @@ module Notes
       old_mentioned_users = note.mentioned_users.to_a
 
       note.update(params.merge(updated_by: current_user))
-      note.create_new_cross_references!(current_user)
 
-      if note.previous_changes.include?('note')
-        TodoService.new.update_note(note, current_user, old_mentioned_users)
+      only_commands = false
+
+      quick_actions_service = QuickActionsService.new(project, current_user)
+      if quick_actions_service.supported?(note)
+        content, update_params, message = quick_actions_service.execute(note, {})
+
+        only_commands = content.empty?
+
+        note.note = content
+      end
+
+      unless only_commands
+        note.create_new_cross_references!(current_user)
+
+        update_todos(note, old_mentioned_users)
+
+        update_suggestions(note)
       end
 
-      if note.supports_suggestion?
-        Suggestion.transaction do
-          note.suggestions.delete_all
-          Suggestions::CreateService.new(note).execute
+      if quick_actions_service.commands_executed_count.to_i > 0
+        if update_params.present?
+          quick_actions_service.apply_updates(update_params, note)
+          note.commands_changes = update_params
         end
 
-        # We need to refresh the previous suggestions call cache
-        # in order to get the new records.
-        note.reset
+        if only_commands
+          delete_note(note, message)
+          note = nil
+        else
+          note.save
+        end
       end
 
       note
     end
+
+    private
+
+    def delete_note(note, message)
+      # We must add the error after we call #save because errors are reset
+      # when #save is called
+      note.errors.add(:commands_only, message.presence || _('Commands did not apply'))
+
+      Notes::DestroyService.new(project, current_user).execute(note)
+    end
+
+    def update_suggestions(note)
+      return unless note.supports_suggestion?
+
+      Suggestion.transaction do
+        note.suggestions.delete_all
+        Suggestions::CreateService.new(note).execute
+      end
+
+      # We need to refresh the previous suggestions call cache
+      # in order to get the new records.
+      note.reset
+    end
+
+    def update_todos(note, old_mentioned_users)
+      return unless note.previous_changes.include?('note')
+
+      TodoService.new.update_note(note, current_user, old_mentioned_users)
+    end
   end
 end
diff --git a/changelogs/unreleased/21505-quickactions-update-pd.yml b/changelogs/unreleased/21505-quickactions-update-pd.yml
new file mode 100644
index 00000000000..243f8eda4e3
--- /dev/null
+++ b/changelogs/unreleased/21505-quickactions-update-pd.yml
@@ -0,0 +1,5 @@
+---
+title: Apply quickactions when modifying comments
+merge_request: 31136
+author:
+type: added
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 61642fbbd59..8c8574d0a48 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -2977,6 +2977,9 @@ msgstr ""
 msgid "Commands applied"
 msgstr ""
 
+msgid "Commands did not apply"
+msgstr ""
+
 msgid "Comment"
 msgstr ""
 
diff --git a/spec/javascripts/notes/stores/actions_spec.js b/spec/javascripts/notes/stores/actions_spec.js
index e55aa0e965a..1fd4a9a7612 100644
--- a/spec/javascripts/notes/stores/actions_spec.js
+++ b/spec/javascripts/notes/stores/actions_spec.js
@@ -336,7 +336,7 @@ describe('Actions Notes Store', () => {
     });
   });
 
-  describe('deleteNote', () => {
+  describe('removeNote', () => {
     const endpoint = `${TEST_HOST}/note`;
     let axiosMock;
 
@@ -357,7 +357,7 @@ describe('Actions Notes Store', () => {
       const note = { path: endpoint, id: 1 };
 
       testAction(
-        actions.deleteNote,
+        actions.removeNote,
         note,
         store.state,
         [
@@ -384,7 +384,7 @@ describe('Actions Notes Store', () => {
       $('body').attr('data-page', 'projects:merge_requests:show');
 
       testAction(
-        actions.deleteNote,
+        actions.removeNote,
         note,
         store.state,
         [
@@ -409,6 +409,45 @@ describe('Actions Notes Store', () => {
     });
   });
 
+  describe('deleteNote', () => {
+    const endpoint = `${TEST_HOST}/note`;
+    let axiosMock;
+
+    beforeEach(() => {
+      axiosMock = new AxiosMockAdapter(axios);
+      axiosMock.onDelete(endpoint).replyOnce(200, {});
+
+      $('body').attr('data-page', '');
+    });
+
+    afterEach(() => {
+      axiosMock.restore();
+
+      $('body').attr('data-page', '');
+    });
+
+    it('dispatches removeNote', done => {
+      const note = { path: endpoint, id: 1 };
+
+      testAction(
+        actions.deleteNote,
+        note,
+        {},
+        [],
+        [
+          {
+            type: 'removeNote',
+            payload: {
+              id: 1,
+              path: 'http://test.host/note',
+            },
+          },
+        ],
+        done,
+      );
+    });
+  });
+
   describe('createNewNote', () => {
     describe('success', () => {
       const res = {
diff --git a/spec/support/shared_examples/quick_actions/issue/move_quick_action_shared_examples.rb b/spec/support/shared_examples/quick_actions/issue/move_quick_action_shared_examples.rb
index a37b2392d52..bebc8509d53 100644
--- a/spec/support/shared_examples/quick_actions/issue/move_quick_action_shared_examples.rb
+++ b/spec/support/shared_examples/quick_actions/issue/move_quick_action_shared_examples.rb
@@ -89,5 +89,54 @@ shared_examples 'move quick action' do
         it_behaves_like 'applies the commands to issues in both projects, target and source'
       end
     end
+
+    context 'when editing comments' do
+      let(:target_project) { create(:project, :public) }
+
+      before do
+        target_project.add_maintainer(user)
+
+        sign_in(user)
+        visit project_issue_path(project, issue)
+        wait_for_all_requests
+      end
+
+      it 'moves the issue after quickcommand note was updated' do
+        # misspelled quick action
+        add_note("test note.\n/mvoe #{target_project.full_path}")
+
+        expect(issue.reload).not_to be_closed
+
+        edit_note("/mvoe #{target_project.full_path}", "test note.\n/move #{target_project.full_path}")
+        wait_for_all_requests
+
+        expect(page).to have_content 'test note.'
+        expect(issue.reload).to be_closed
+
+        visit project_issue_path(target_project, issue)
+        wait_for_all_requests
+
+        expect(page).to have_content 'Issues 1'
+      end
+
+      it 'deletes the note if it was updated to just contain a command' do
+        # missspelled quick action
+        add_note("test note.\n/mvoe #{target_project.full_path}")
+
+        expect(page).not_to have_content 'Commands applied'
+        expect(issue.reload).not_to be_closed
+
+        edit_note("/mvoe #{target_project.full_path}", "/move #{target_project.full_path}")
+        wait_for_all_requests
+
+        expect(page).not_to have_content "/move #{target_project.full_path}"
+        expect(issue.reload).to be_closed
+
+        visit project_issue_path(target_project, issue)
+        wait_for_all_requests
+
+        expect(page).to have_content 'Issues 1'
+      end
+    end
   end
 end
-- 
cgit v1.2.1


From 93267348316118dba4cd79696fb15c76ef4c876e Mon Sep 17 00:00:00 2001
From: Lukas Eipert <leipert@gitlab.com>
Date: Mon, 26 Aug 2019 10:23:42 +0000
Subject: Update dependency @gitlab/ui to v5.19.0

---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index e076f9e6664..8fa34cdea28 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "@babel/preset-env": "^7.5.5",
     "@gitlab/csslab": "^1.9.0",
     "@gitlab/svgs": "^1.70.0",
-    "@gitlab/ui": "5.18.0",
+    "@gitlab/ui": "5.19.0",
     "@gitlab/visual-review-tools": "^1.0.0",
     "apollo-cache-inmemory": "^1.5.1",
     "apollo-client": "^2.5.1",
diff --git a/yarn.lock b/yarn.lock
index ef66861488c..712cdace0d7 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1003,10 +1003,10 @@
   resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.70.0.tgz#bdae478148c15d955fc06e69fd5d5ecae8298943"
   integrity sha512-0uV9fgTwe17Fyy0hTcrsGX2jJuCrz3uRIe8yffuqc6pbQrSfYJyN66mfCCB45wq8lKTgOB5q0qcUyJx3RQEcKg==
 
-"@gitlab/ui@5.18.0":
-  version "5.18.0"
-  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-5.18.0.tgz#f7f93ad41673f5ae081cd2246dda5456d3c956a2"
-  integrity sha512-umB7JCKVDZOajed0N563JBYSpiyK+VDL2eCdkinW+twWhMct8onoW4CLTpkgBi6Z9Y1Bq47aqnFtGf+1IKNIGw==
+"@gitlab/ui@5.19.0":
+  version "5.19.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-5.19.0.tgz#ef5431e0e91eb4009a30edcf49a40716cc2570d9"
+  integrity sha512-gCeTymtVzzO2uOWZGIweLM5JcHq3TN1QwP61CXw7b9Lp5A2MysRb8upehtR5d4JLOf/GQg8rHQB26uRvUc+AXQ==
   dependencies:
     "@babel/standalone" "^7.0.0"
     "@gitlab/vue-toasted" "^1.2.1"
-- 
cgit v1.2.1


From a844a958ea875b548b572faaca8e2fd523464735 Mon Sep 17 00:00:00 2001
From: Zeger-Jan van de Weg <git@zjvandeweg.nl>
Date: Mon, 26 Aug 2019 12:31:25 +0200
Subject: Remove the object pools feature flag

The flag defaulted to true, so there's no change unless users turned it
off. Given there's a lack of issues regarding object pools, this should
be OK.
---
 app/models/project.rb                          |  3 +--
 doc/administration/repository_storage_types.md | 12 +++++-----
 doc/development/git_object_deduplication.md    | 24 --------------------
 spec/models/project_spec.rb                    | 31 ++++++++------------------
 4 files changed, 15 insertions(+), 55 deletions(-)

diff --git a/app/models/project.rb b/app/models/project.rb
index 10679fb1f85..66d5286196e 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -2175,8 +2175,7 @@ class Project < ApplicationRecord
     hashed_storage?(:repository) &&
       public? &&
       repository_exists? &&
-      Gitlab::CurrentSettings.hashed_storage_enabled &&
-      Feature.enabled?(:object_pools, self, default_enabled: true)
+      Gitlab::CurrentSettings.hashed_storage_enabled
   end
 
   def leave_pool_repository
diff --git a/doc/administration/repository_storage_types.md b/doc/administration/repository_storage_types.md
index 142bcc65561..3ee8673b297 100644
--- a/doc/administration/repository_storage_types.md
+++ b/doc/administration/repository_storage_types.md
@@ -82,19 +82,17 @@ by another folder with the next 2 characters. They are both stored in a special
 
 > [Introduced](https://gitlab.com/gitlab-org/gitaly/issues/1606) in GitLab 12.1.
 
-Forks of public projects are deduplicated by creating a third repository, the object pool, containing the objects from the source project. Using `objects/info/alternates`, the source project and forks use the object pool for shared objects. Objects are moved from the source project to the object pool when housekeeping is run on the source project.
+Forks of public projects are deduplicated by creating a third repository, the
+object pool, containing the objects from the source project. Using
+`objects/info/alternates`, the source project and forks use the object pool for
+shared objects. Objects are moved from the source project to the object pool
+when housekeeping is run on the source project.
 
 ```ruby
 # object pool paths
 "@pools/#{hash[0..1]}/#{hash[2..3]}/#{hash}.git"
 ```
 
-Object pools can be disabled using the `object_pools` feature flag, and can be
-disabled for individual projects by executing
-`Feature.disable(:object_pools, Project.find(<id>))`. Disabling object pools
-will not change existing deduplicated forks, but will prevent new forks from
-being deduplicated.
-
 DANGER: **Danger:**
 Do not run `git prune` or `git gc` in pool repositories! This can
 cause data loss in "real" repositories that depend on the pool in
diff --git a/doc/development/git_object_deduplication.md b/doc/development/git_object_deduplication.md
index 5ce59891afa..8d32d0314ae 100644
--- a/doc/development/git_object_deduplication.md
+++ b/doc/development/git_object_deduplication.md
@@ -8,30 +8,6 @@ storage disk use. To counteract this problem, we are adding Git object
 deduplication for forks to GitLab. In this document, we will describe how
 GitLab implements Git object deduplication.
 
-## Enabling Git object deduplication via feature flags
-
-As of GitLab 12.0, Git object deduplication in GitLab is still behind a
-feature flag. In this document, you can read about the effects of
-enabling the feature. Also, note that Git object deduplication is
-limited to forks of public projects on hashed repository storage.
-
-You can enable deduplication globally by setting the `object_pools`
-feature flag to `true`:
-
-``` {.ruby}
-Feature.enable(:object_pools)
-```
-
-Or just for forks of a specific project:
-
-``` {.ruby}
-fork_parent = Project.find(MY_PROJECT_ID)
-Feature.enable(:object_pools, fork_parent)
-```
-
-To check if a project uses Git object deduplication, look in a Rails
-console if `project.pool_repository` is present.
-
 ## Pool repositories
 
 ### Understanding Git alternates
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index ff9e94afc12..bd352db2236 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -4877,35 +4877,22 @@ describe Project do
 
   describe '#git_objects_poolable?' do
     subject { project }
-
-    context 'when the feature flag is turned off' do
-      before do
-        stub_feature_flags(object_pools: false)
-      end
-
-      let(:project) { create(:project, :repository, :public) }
+    context 'when not using hashed storage' do
+      let(:project) { create(:project, :legacy_storage, :public, :repository) }
 
       it { is_expected.not_to be_git_objects_poolable }
     end
 
-    context 'when the feature flag is enabled' do
-      context 'when not using hashed storage' do
-        let(:project) { create(:project, :legacy_storage, :public, :repository) }
-
-        it { is_expected.not_to be_git_objects_poolable }
-      end
+    context 'when the project is not public' do
+      let(:project) { create(:project, :private) }
 
-      context 'when the project is not public' do
-        let(:project) { create(:project, :private) }
-
-        it { is_expected.not_to be_git_objects_poolable }
-      end
+      it { is_expected.not_to be_git_objects_poolable }
+    end
 
-      context 'when objects are poolable' do
-        let(:project) { create(:project, :repository, :public) }
+    context 'when objects are poolable' do
+      let(:project) { create(:project, :repository, :public) }
 
-        it { is_expected.to be_git_objects_poolable }
-      end
+      it { is_expected.to be_git_objects_poolable }
     end
   end
 
-- 
cgit v1.2.1


From e2a7dd3f0aaa767a7b1cb01f69e9b4520ae04b65 Mon Sep 17 00:00:00 2001
From: Robert Schilling <rschilling@student.tugraz.at>
Date: Mon, 26 Aug 2019 10:49:48 +0200
Subject: Update docs targeting 12.3

---
 doc/api/labels.md | 2 +-
 lib/api/labels.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/api/labels.md b/doc/api/labels.md
index 21ac8a99965..9692cc8b710 100644
--- a/doc/api/labels.md
+++ b/doc/api/labels.md
@@ -188,7 +188,7 @@ Example response:
 
 ## Promote a project label to a group label
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/25218) in GitLab 11.9.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/25218) in GitLab 12.3.
 
 Promotes a project label to a group label.
 
diff --git a/lib/api/labels.rb b/lib/api/labels.rb
index 321ffa241b5..de89e94b0c0 100644
--- a/lib/api/labels.rb
+++ b/lib/api/labels.rb
@@ -64,7 +64,7 @@ module API
       end
 
       desc 'Promote a label to a group label' do
-        detail 'This feature was added in GitLab 11.9'
+        detail 'This feature was added in GitLab 12.3'
         success Entities::GroupLabel
       end
       params do
-- 
cgit v1.2.1


From 0ec6134ff91093742dbe4ee37683a8691e058775 Mon Sep 17 00:00:00 2001
From: Robert Schilling <rschilling@student.tugraz.at>
Date: Mon, 26 Aug 2019 11:57:56 +0200
Subject: Make tests pass

---
 spec/requests/api/labels_spec.rb | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/spec/requests/api/labels_spec.rb b/spec/requests/api/labels_spec.rb
index f7df9bb1b3f..ce9b6b47ad3 100644
--- a/spec/requests/api/labels_spec.rb
+++ b/spec/requests/api/labels_spec.rb
@@ -475,45 +475,47 @@ describe API::Labels do
 
   describe 'PUT /projects/:id/labels/promote' do
     let(:group) { create(:group) }
+    let!(:project1) { create(:project, namespace: group) }
+    let!(:label1) { create(:label, title: 'label1', project: project1) }
 
     before do
-      project.update(group: group)
+      group.add_owner(user)
     end
 
     it 'returns 200 if label is promoted' do
-      put api("/projects/#{project.id}/labels/promote", user), params: { name: label1.name }
+      put api("/projects/#{project1.id}/labels/promote", user), params: { name: label1.name }
 
       expect(response).to have_gitlab_http_status(200)
       expect(json_response['name']).to eq(label1.name)
       expect(json_response['color']).to eq(label1.color)
     end
 
-    it 'returns 400 if group label already exists' do
+    it 'returns 200 if group label already exists' do
       create(:group_label, title: label1.name, group: group)
 
-      put api("/projects/#{project.id}/labels/promote", user), params: { name: label1.name }
+      put api("/projects/#{project1.id}/labels/promote", user), params: { name: label1.name }
 
-      expect(response).to have_gitlab_http_status(400)
-      expect(json_response['message']).to eq('Failed to promote project label to group label')
+      expect(response).to have_gitlab_http_status(200)
+      expect(project1.labels.size).to eq(0)
     end
 
     it 'returns 403 if guest promotes label' do
       guest = create(:user)
-      project.add_guest(guest)
+      project1.add_guest(guest)
 
-      put api("/projects/#{project.id}/labels/promote", guest), params: { name: label1.name }
+      put api("/projects/#{project1.id}/labels/promote", guest), params: { name: label1.name }
 
       expect(response).to have_gitlab_http_status(403)
     end
 
     it 'returns 404 if label does not exist' do
-      put api("/projects/#{project.id}/labels/promote", user), params: { name: 'unknown' }
+      put api("/projects/#{project1.id}/labels/promote", user), params: { name: 'unknown' }
 
       expect(response).to have_gitlab_http_status(404)
     end
 
     it 'returns 400 if no label name given' do
-      put api("/projects/#{project.id}/labels/promote", user)
+      put api("/projects/#{project1.id}/labels/promote", user)
 
       expect(response).to have_gitlab_http_status(400)
       expect(json_response['error']).to eq('name is missing')
-- 
cgit v1.2.1


From e1e571e05f8993128638f46c37025fcfb9b3ec17 Mon Sep 17 00:00:00 2001
From: Jacob Vosmaer <jacob@gitlab.com>
Date: Mon, 26 Aug 2019 12:47:15 +0200
Subject: Use Gitaly 1.61.0

---
 GITALY_SERVER_VERSION                            | 2 +-
 changelogs/unreleased/security-gitaly-1-61-0.yml | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/security-gitaly-1-61-0.yml

diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 4d5fde5bd16..91951fd8ad7 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-1.60.0
+1.61.0
diff --git a/changelogs/unreleased/security-gitaly-1-61-0.yml b/changelogs/unreleased/security-gitaly-1-61-0.yml
new file mode 100644
index 00000000000..cbcd5f545a0
--- /dev/null
+++ b/changelogs/unreleased/security-gitaly-1-61-0.yml
@@ -0,0 +1,5 @@
+---
+title: "Gitaly: ignore git redirects"
+merge_request:
+author:
+type: security
-- 
cgit v1.2.1


From fa5f0c5c0d3e0262162117ba247964b02c54fbcb Mon Sep 17 00:00:00 2001
From: Peter Leitzen <pleitzen@gitlab.com>
Date: Mon, 26 Aug 2019 11:00:09 +0000
Subject: Danger: Map .rubocop{,_todo}.yml to ~backend

---
 lib/gitlab/danger/helper.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/gitlab/danger/helper.rb b/lib/gitlab/danger/helper.rb
index 332ca8bf9b8..5424298723e 100644
--- a/lib/gitlab/danger/helper.rb
+++ b/lib/gitlab/danger/helper.rb
@@ -126,6 +126,7 @@ module Gitlab
         %r{\A(ee/)?vendor/(languages\.yml|licenses\.csv)\z} => :backend,
         %r{\A(Dangerfile|Gemfile|Gemfile.lock|Procfile|Rakefile|\.gitlab-ci\.yml)\z} => :backend,
         %r{\A[A-Z_]+_VERSION\z} => :backend,
+        %r{\A\.rubocop(_todo)?\.yml\z} => :backend,
 
         %r{\A(ee/)?qa/} => :qa,
 
-- 
cgit v1.2.1


From 3733fd20a4abcaf88b98cc5be883772157b1f821 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Thu, 22 Aug 2019 18:06:05 +0200
Subject: Copy ee/app/models/license.rb in the QA image if present
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 .dockerignore | 10 +++++++++-
 qa/Dockerfile |  2 ++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/.dockerignore b/.dockerignore
index b8e239e4049..4f5b33de167 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -4,6 +4,7 @@
 # the files we need to build the QA image are in these folders.
 # Following are the files we need:
 # - ./config/initializers/0_inject_enterprise_edition_module.rb
+# - ./ee/app/models/license.rb
 # - ./lib/gitlab.rb
 # - ./qa/
 # - ./INSTALLATION_TYPE
@@ -23,7 +24,14 @@
 /db/
 /doc/
 /docker/
-/ee/
+/ee/bin/
+/ee/changelogs/
+/ee/config/
+/ee/db/
+/ee/fixtures/
+/ee/lib/
+/ee/locale/
+/ee/spec/
 /fixtures/
 /templates/
 /lint/
diff --git a/qa/Dockerfile b/qa/Dockerfile
index 3309f5b6ce3..84dbfae1008 100644
--- a/qa/Dockerfile
+++ b/qa/Dockerfile
@@ -50,6 +50,8 @@ RUN export CLOUD_SDK_REPO="cloud-sdk-$(lsb_release -c -s)" && \
 WORKDIR /home/gitlab/qa
 COPY ./qa/Gemfile* /home/gitlab/qa/
 COPY ./config/initializers/0_inject_enterprise_edition_module.rb /home/gitlab/config/initializers/
+# Copy VERSION to ensure the COPY succeeds to copy at least one file since ee/app/models/license.rb isn't present in CE
+COPY VERSION ./ee/app/models/license.r[b] /home/gitlab/ee/app/models/
 COPY ./lib/gitlab.rb /home/gitlab/lib/
 COPY ./INSTALLATION_TYPE /home/gitlab/
 COPY ./VERSION /home/gitlab/
-- 
cgit v1.2.1


From e101a26444f0f02df2c6301f13bc1f3e20781f8b Mon Sep 17 00:00:00 2001
From: Peter Leitzen <pleitzen@gitlab.com>
Date: Mon, 26 Aug 2019 12:24:25 +0000
Subject: Utilize RuboCop's Include/Exclude config

Stop checking the file location programmatically.
---
 .rubocop.yml                                       | 54 ++++++++++++++++++++++
 rubocop/cop/gitlab/httparty.rb                     |  6 +--
 rubocop/cop/gitlab/union.rb                        |  4 --
 rubocop/cop/graphql/authorize_types.rb             |  6 ---
 rubocop/cop/include_action_view_context.rb         |  5 --
 rubocop/cop/include_sidekiq_worker.rb              |  5 +-
 rubocop/cop/rspec/env_assignment.rb                |  5 +-
 rubocop/cop/rspec/factories_in_migration_specs.rb  |  5 +-
 rubocop/cop/sidekiq_options_queue.rb               |  5 +-
 rubocop/spec_helpers.rb                            | 30 ------------
 spec/rubocop/cop/gitlab/union_spec.rb              |  6 ---
 spec/rubocop/cop/rspec/env_assignment_spec.rb      | 26 +++--------
 .../cop/rspec/factories_in_migration_specs_spec.rb | 22 +--------
 13 files changed, 67 insertions(+), 112 deletions(-)
 delete mode 100644 rubocop/spec_helpers.rb

diff --git a/.rubocop.yml b/.rubocop.yml
index b75c63e1f58..012f4890c33 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -178,6 +178,9 @@ Gitlab/ModuleWithInstanceVariables:
 
 Gitlab/HTTParty:
   Enabled: true
+  Exclude:
+    - 'spec/**/*'
+    - 'ee/spec/**/*'
 
 GitlabSecurity/PublicSend:
   Enabled: true
@@ -211,3 +214,54 @@ ActiveRecordAssociationReload:
   Exclude:
     - 'spec/**/*'
     - 'ee/spec/**/*'
+
+RSpec/FactoriesInMigrationSpecs:
+  Enabled: true
+  Include:
+    - 'spec/migrations/**/*.rb'
+    - 'ee/spec/migrations/**/*.rb'
+    - 'spec/lib/gitlab/background_migration/**/*.rb'
+    - 'ee/spec/lib/gitlab/background_migration/**/*.rb'
+
+Cop/IncludeActionViewContext:
+  Enabled: true
+  Exclude:
+    - 'spec/**/*'
+    - 'ee/spec/**/*'
+
+Cop/IncludeSidekiqWorker:
+  Enabled: true
+  Exclude:
+    - 'spec/**/*'
+    - 'ee/spec/**/*'
+
+Gitlab/Union:
+  Enabled: true
+  Exclude:
+    - 'spec/**/*'
+    - 'ee/spec/**/*'
+
+Cop/SidekiqOptionsQueue:
+  Enabled: true
+  Exclude:
+    - 'spec/**/*.rb'
+    - 'ee/spec/**/*.rb'
+
+Graphql/AuthorizeTypes:
+  Enabled: true
+  Exclude:
+    - 'spec/**/*.rb'
+    - 'ee/spec/**/*.rb'
+
+RSpec/EnvAssignment:
+  Enable: true
+  Include:
+    - 'spec/**/*.rb'
+    - 'ee/spec/**/*.rb'
+  Exclude:
+    - 'spec/**/fast_spec_helper.rb'
+    - 'ee/spec/**/fast_spec_helper.rb'
+    - 'spec/**/rails_helper.rb'
+    - 'ee/spec/**/rails_helper.rb'
+    - 'spec/**/spec_helper.rb'
+    - 'ee/spec/**/spec_helper.rb'
diff --git a/rubocop/cop/gitlab/httparty.rb b/rubocop/cop/gitlab/httparty.rb
index 215f18b6993..8acebff624d 100644
--- a/rubocop/cop/gitlab/httparty.rb
+++ b/rubocop/cop/gitlab/httparty.rb
@@ -1,11 +1,9 @@
-require_relative '../../spec_helpers'
+# frozen_string_literal: true
 
 module RuboCop
   module Cop
     module Gitlab
       class HTTParty < RuboCop::Cop::Cop
-        include SpecHelpers
-
         MSG_SEND = <<~EOL.freeze
           Avoid calling `HTTParty` directly. Instead, use the Gitlab::HTTP
           wrapper. To allow request to localhost or the private network set
@@ -27,8 +25,6 @@ module RuboCop
         PATTERN
 
         def on_send(node)
-          return if in_spec?(node)
-
           add_offense(node, location: :expression, message: MSG_SEND) if httparty_node?(node)
           add_offense(node, location: :expression, message: MSG_INCLUDE) if includes_httparty?(node)
         end
diff --git a/rubocop/cop/gitlab/union.rb b/rubocop/cop/gitlab/union.rb
index 09541d8af3b..c44c847657b 100644
--- a/rubocop/cop/gitlab/union.rb
+++ b/rubocop/cop/gitlab/union.rb
@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-require_relative '../../spec_helpers'
 
 module RuboCop
   module Cop
@@ -7,8 +6,6 @@ module RuboCop
       # Cop that disallows the use of `Gitlab::SQL::Union`, in favour of using
       # the `FromUnion` module.
       class Union < RuboCop::Cop::Cop
-        include SpecHelpers
-
         MSG = 'Use the `FromUnion` concern, instead of using `Gitlab::SQL::Union` directly'
 
         def_node_matcher :raw_union?, <<~PATTERN
@@ -17,7 +14,6 @@ module RuboCop
 
         def on_send(node)
           return unless raw_union?(node)
-          return if in_spec?(node)
 
           add_offense(node, location: :expression)
         end
diff --git a/rubocop/cop/graphql/authorize_types.rb b/rubocop/cop/graphql/authorize_types.rb
index 93fe80c3edf..cd8bdbaee59 100644
--- a/rubocop/cop/graphql/authorize_types.rb
+++ b/rubocop/cop/graphql/authorize_types.rb
@@ -1,13 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../../spec_helpers'
-
 module RuboCop
   module Cop
     module Graphql
       class AuthorizeTypes < RuboCop::Cop::Cop
-        include SpecHelpers
-
         MSG = 'Add an `authorize :ability` call to the type: '\
               'https://docs.gitlab.com/ee/development/api_graphql_styleguide.html#type-authorization'
 
@@ -32,8 +28,6 @@ module RuboCop
         private
 
         def in_type?(node)
-          return if in_spec?(node)
-
           path = node.location.expression.source_buffer.name
 
           path.include?(TYPES_DIR)
diff --git a/rubocop/cop/include_action_view_context.rb b/rubocop/cop/include_action_view_context.rb
index 14662a33e95..52c84a711c9 100644
--- a/rubocop/cop/include_action_view_context.rb
+++ b/rubocop/cop/include_action_view_context.rb
@@ -1,13 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../spec_helpers'
-
 module RuboCop
   module Cop
     # Cop that makes sure workers include `::Gitlab::ActionViewOutput::Context`, not `ActionView::Context`.
     class IncludeActionViewContext < RuboCop::Cop::Cop
-      include SpecHelpers
-
       MSG = 'Include `::Gitlab::ActionViewOutput::Context`, not `ActionView::Context`, for Rails 5.'.freeze
 
       def_node_matcher :includes_action_view_context?, <<~PATTERN
@@ -15,7 +11,6 @@ module RuboCop
       PATTERN
 
       def on_send(node)
-        return if in_spec?(node)
         return unless includes_action_view_context?(node)
 
         add_offense(node.arguments.first, location: :expression)
diff --git a/rubocop/cop/include_sidekiq_worker.rb b/rubocop/cop/include_sidekiq_worker.rb
index 8da4a147219..e69bc018add 100644
--- a/rubocop/cop/include_sidekiq_worker.rb
+++ b/rubocop/cop/include_sidekiq_worker.rb
@@ -1,11 +1,9 @@
-require_relative '../spec_helpers'
+# frozen_string_literal: true
 
 module RuboCop
   module Cop
     # Cop that makes sure workers include `ApplicationWorker`, not `Sidekiq::Worker`.
     class IncludeSidekiqWorker < RuboCop::Cop::Cop
-      include SpecHelpers
-
       MSG = 'Include `ApplicationWorker`, not `Sidekiq::Worker`.'.freeze
 
       def_node_matcher :includes_sidekiq_worker?, <<~PATTERN
@@ -13,7 +11,6 @@ module RuboCop
       PATTERN
 
       def on_send(node)
-        return if in_spec?(node)
         return unless includes_sidekiq_worker?(node)
 
         add_offense(node.arguments.first, location: :expression)
diff --git a/rubocop/cop/rspec/env_assignment.rb b/rubocop/cop/rspec/env_assignment.rb
index 8b61fa8e264..73e108c2232 100644
--- a/rubocop/cop/rspec/env_assignment.rb
+++ b/rubocop/cop/rspec/env_assignment.rb
@@ -1,4 +1,4 @@
-require_relative '../../spec_helpers'
+# frozen_string_literal: true
 
 module RuboCop
   module Cop
@@ -17,8 +17,6 @@ module RuboCop
       #     stub_env('FOO', 'bar')
       #   end
       class EnvAssignment < RuboCop::Cop::Cop
-        include SpecHelpers
-
         MESSAGE = "Don't assign to ENV, use `stub_env` instead.".freeze
 
         def_node_search :env_assignment?, <<~PATTERN
@@ -28,7 +26,6 @@ module RuboCop
         # Following is what node.children looks like on a match
         # [s(:const, nil, :ENV), :[]=, s(:str, "key"), s(:str, "value")]
         def on_send(node)
-          return unless in_spec?(node)
           return unless env_assignment?(node)
 
           add_offense(node, location: :expression, message: MESSAGE)
diff --git a/rubocop/cop/rspec/factories_in_migration_specs.rb b/rubocop/cop/rspec/factories_in_migration_specs.rb
index 0c5aa838a2c..65c7638a0f4 100644
--- a/rubocop/cop/rspec/factories_in_migration_specs.rb
+++ b/rubocop/cop/rspec/factories_in_migration_specs.rb
@@ -1,4 +1,4 @@
-require_relative '../../spec_helpers'
+# frozen_string_literal: true
 
 module RuboCop
   module Cop
@@ -14,8 +14,6 @@ module RuboCop
       #   let(:users) { table(:users) }
       #   let(:user) { users.create!(name: 'User 1', username: 'user1') }
       class FactoriesInMigrationSpecs < RuboCop::Cop::Cop
-        include SpecHelpers
-
         MESSAGE = "Don't use FactoryBot.%s in migration specs, use `table` instead.".freeze
         FORBIDDEN_METHODS = %i[build build_list create create_list].freeze
 
@@ -27,7 +25,6 @@ module RuboCop
         # - Without FactoryBot namespace: [nil, :build, s(:sym, :user)]
         # - With FactoryBot namespace: [s(:const, nil, :FactoryBot), :build, s(:sym, :user)]
         def on_send(node)
-          return unless in_migration_spec?(node)
           return unless forbidden_factory_usage?(node)
 
           method = node.children[1]
diff --git a/rubocop/cop/sidekiq_options_queue.rb b/rubocop/cop/sidekiq_options_queue.rb
index 253d2958866..499c712175e 100644
--- a/rubocop/cop/sidekiq_options_queue.rb
+++ b/rubocop/cop/sidekiq_options_queue.rb
@@ -1,11 +1,9 @@
-require_relative '../spec_helpers'
+# frozen_string_literal: true
 
 module RuboCop
   module Cop
     # Cop that prevents manually setting a queue in Sidekiq workers.
     class SidekiqOptionsQueue < RuboCop::Cop::Cop
-      include SpecHelpers
-
       MSG = 'Do not manually set a queue; `ApplicationWorker` sets one automatically.'.freeze
 
       def_node_matcher :sidekiq_options?, <<~PATTERN
@@ -13,7 +11,6 @@ module RuboCop
       PATTERN
 
       def on_send(node)
-        return if in_spec?(node)
         return unless sidekiq_options?(node)
 
         node.arguments.first.each_node(:pair) do |pair|
diff --git a/rubocop/spec_helpers.rb b/rubocop/spec_helpers.rb
deleted file mode 100644
index ecd77c4351d..00000000000
--- a/rubocop/spec_helpers.rb
+++ /dev/null
@@ -1,30 +0,0 @@
-module RuboCop
-  module SpecHelpers
-    SPEC_HELPERS = %w[fast_spec_helper.rb rails_helper.rb spec_helper.rb].freeze
-    MIGRATION_SPEC_DIRECTORIES = ['spec/migrations', 'spec/lib/gitlab/background_migration'].freeze
-
-    # Returns true if the given node originated from the spec directory.
-    def in_spec?(node)
-      path = node.location.expression.source_buffer.name
-      pwd = RuboCop::PathUtil.pwd
-
-      !SPEC_HELPERS.include?(File.basename(path)) &&
-        path.start_with?(File.join(pwd, 'spec'), File.join(pwd, 'ee', 'spec'))
-    end
-
-    def migration_directories
-      @migration_directories ||= MIGRATION_SPEC_DIRECTORIES.map do |dir|
-        pwd = RuboCop::PathUtil.pwd
-        [File.join(pwd, dir), File.join(pwd, 'ee', dir)]
-      end.flatten
-    end
-
-    # Returns true if the given node originated from a migration spec.
-    def in_migration_spec?(node)
-      path = node.location.expression.source_buffer.name
-
-      in_spec?(node) &&
-        path.start_with?(*migration_directories)
-    end
-  end
-end
diff --git a/spec/rubocop/cop/gitlab/union_spec.rb b/spec/rubocop/cop/gitlab/union_spec.rb
index 5b06f30b25f..f0544fdb66e 100644
--- a/spec/rubocop/cop/gitlab/union_spec.rb
+++ b/spec/rubocop/cop/gitlab/union_spec.rb
@@ -16,10 +16,4 @@ describe RuboCop::Cop::Gitlab::Union do
     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Use the `FromUnion` concern, instead of using `Gitlab::SQL::Union` directly
     SOURCE
   end
-
-  it 'does not flag the use of Gitlab::SQL::Union in a spec' do
-    allow(cop).to receive(:in_spec?).and_return(true)
-
-    expect_no_offenses('Gitlab::SQL::Union.new([foo])')
-  end
 end
diff --git a/spec/rubocop/cop/rspec/env_assignment_spec.rb b/spec/rubocop/cop/rspec/env_assignment_spec.rb
index 659633f6467..621afbad3ba 100644
--- a/spec/rubocop/cop/rspec/env_assignment_spec.rb
+++ b/spec/rubocop/cop/rspec/env_assignment_spec.rb
@@ -33,27 +33,13 @@ describe RuboCop::Cop::RSpec::EnvAssignment do
     end
   end
 
-  context 'in a spec file' do
-    before do
-      allow(cop).to receive(:in_spec?).and_return(true)
-    end
-
-    context 'with a key using single quotes' do
-      it_behaves_like 'an offensive ENV#[]= call', OFFENSE_CALL_SINGLE_QUOTES_KEY
-      it_behaves_like 'an autocorrected ENV#[]= call', OFFENSE_CALL_SINGLE_QUOTES_KEY, %(stub_env('FOO', 'bar'))
-    end
-
-    context 'with a key using double quotes' do
-      it_behaves_like 'an offensive ENV#[]= call', OFFENSE_CALL_DOUBLE_QUOTES_KEY
-      it_behaves_like 'an autocorrected ENV#[]= call', OFFENSE_CALL_DOUBLE_QUOTES_KEY, %(stub_env("FOO", 'bar'))
-    end
+  context 'with a key using single quotes' do
+    it_behaves_like 'an offensive ENV#[]= call', OFFENSE_CALL_SINGLE_QUOTES_KEY
+    it_behaves_like 'an autocorrected ENV#[]= call', OFFENSE_CALL_SINGLE_QUOTES_KEY, %(stub_env('FOO', 'bar'))
   end
 
-  context 'outside of a spec file' do
-    it "does not register an offense for `#{OFFENSE_CALL_SINGLE_QUOTES_KEY}` in a non-spec file" do
-      inspect_source(OFFENSE_CALL_SINGLE_QUOTES_KEY)
-
-      expect(cop.offenses.size).to eq(0)
-    end
+  context 'with a key using double quotes' do
+    it_behaves_like 'an offensive ENV#[]= call', OFFENSE_CALL_DOUBLE_QUOTES_KEY
+    it_behaves_like 'an autocorrected ENV#[]= call', OFFENSE_CALL_DOUBLE_QUOTES_KEY, %(stub_env("FOO", 'bar'))
   end
 end
diff --git a/spec/rubocop/cop/rspec/factories_in_migration_specs_spec.rb b/spec/rubocop/cop/rspec/factories_in_migration_specs_spec.rb
index 2763f2bda21..94324bc615d 100644
--- a/spec/rubocop/cop/rspec/factories_in_migration_specs_spec.rb
+++ b/spec/rubocop/cop/rspec/factories_in_migration_specs_spec.rb
@@ -8,8 +8,6 @@ require_relative '../../../../rubocop/cop/rspec/factories_in_migration_specs'
 describe RuboCop::Cop::RSpec::FactoriesInMigrationSpecs do
   include CopHelper
 
-  let(:source_file) { 'spec/migrations/foo_spec.rb' }
-
   subject(:cop) { described_class.new }
 
   shared_examples 'an offensive factory call' do |namespace|
@@ -27,22 +25,6 @@ describe RuboCop::Cop::RSpec::FactoriesInMigrationSpecs do
     end
   end
 
-  context 'in a migration spec file' do
-    before do
-      allow(cop).to receive(:in_migration_spec?).and_return(true)
-    end
-
-    it_behaves_like 'an offensive factory call', ''
-    it_behaves_like 'an offensive factory call', 'FactoryBot.'
-  end
-
-  context 'outside of a migration spec file' do
-    it "does not register an offense" do
-      expect_no_offenses(<<-RUBY)
-        describe 'foo' do
-          let(:user) { create(:user) }
-        end
-      RUBY
-    end
-  end
+  it_behaves_like 'an offensive factory call', ''
+  it_behaves_like 'an offensive factory call', 'FactoryBot.'
 end
-- 
cgit v1.2.1


From 05fd0259da87b56144faf40cb49eca2c32eef085 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Thu, 22 Aug 2019 08:04:39 +0200
Subject: Use the 'needs' keyword for 'package-and-qa-always' job
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 .gitlab/ci/qa.gitlab-ci.yml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitlab/ci/qa.gitlab-ci.yml b/.gitlab/ci/qa.gitlab-ci.yml
index 144e5392e55..69b932801ad 100644
--- a/.gitlab/ci/qa.gitlab-ci.yml
+++ b/.gitlab/ci/qa.gitlab-ci.yml
@@ -1,7 +1,8 @@
 .package-and-qa-base:
   image: ruby:2.6-alpine
-  stage: review  # So even if review-deploy failed we can still run this
+  stage: qa
   before_script: []
+  needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
   dependencies: []
   cache: {}
   variables:
@@ -14,12 +15,16 @@
   only:
     - branches@gitlab-org/gitlab-ce
     - branches@gitlab-org/gitlab-ee
+  except:
+    - master
 
 package-and-qa-manual:
-  extends:
-    - .package-and-qa-base
-    - .no-docs-and-no-qa
+  extends: .package-and-qa-base
   when: manual
+  except:
+    - master
+    - /(^docs[\/-].+|.+-docs$)/
+    - /(^qa[\/-].*|.*-qa$)
 
 package-and-qa:
   extends: .package-and-qa-base
-- 
cgit v1.2.1


From 1819dbd4d1c06489325f4223222b499a59b78e37 Mon Sep 17 00:00:00 2001
From: Robert Schilling <rschilling@student.tugraz.at>
Date: Mon, 26 Aug 2019 15:02:12 +0200
Subject: Incorporate review feedback

---
 spec/requests/api/labels_spec.rb | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/spec/requests/api/labels_spec.rb b/spec/requests/api/labels_spec.rb
index ce9b6b47ad3..9aef67e28a7 100644
--- a/spec/requests/api/labels_spec.rb
+++ b/spec/requests/api/labels_spec.rb
@@ -475,15 +475,14 @@ describe API::Labels do
 
   describe 'PUT /projects/:id/labels/promote' do
     let(:group) { create(:group) }
-    let!(:project1) { create(:project, namespace: group) }
-    let!(:label1) { create(:label, title: 'label1', project: project1) }
 
     before do
       group.add_owner(user)
+      project.update!(group: group)
     end
 
     it 'returns 200 if label is promoted' do
-      put api("/projects/#{project1.id}/labels/promote", user), params: { name: label1.name }
+      put api("/projects/#{project.id}/labels/promote", user), params: { name: label1.name }
 
       expect(response).to have_gitlab_http_status(200)
       expect(json_response['name']).to eq(label1.name)
@@ -493,29 +492,30 @@ describe API::Labels do
     it 'returns 200 if group label already exists' do
       create(:group_label, title: label1.name, group: group)
 
-      put api("/projects/#{project1.id}/labels/promote", user), params: { name: label1.name }
+      expect { put api("/projects/#{project.id}/labels/promote", user), params: { name: label1.name } }
+        .to change(project.labels, :count).by(-1)
+        .and change(group.labels, :count).by(0)
 
       expect(response).to have_gitlab_http_status(200)
-      expect(project1.labels.size).to eq(0)
     end
 
     it 'returns 403 if guest promotes label' do
       guest = create(:user)
-      project1.add_guest(guest)
+      project.add_guest(guest)
 
-      put api("/projects/#{project1.id}/labels/promote", guest), params: { name: label1.name }
+      put api("/projects/#{project.id}/labels/promote", guest), params: { name: label1.name }
 
       expect(response).to have_gitlab_http_status(403)
     end
 
     it 'returns 404 if label does not exist' do
-      put api("/projects/#{project1.id}/labels/promote", user), params: { name: 'unknown' }
+      put api("/projects/#{project.id}/labels/promote", user), params: { name: 'unknown' }
 
       expect(response).to have_gitlab_http_status(404)
     end
 
     it 'returns 400 if no label name given' do
-      put api("/projects/#{project1.id}/labels/promote", user)
+      put api("/projects/#{project.id}/labels/promote", user)
 
       expect(response).to have_gitlab_http_status(400)
       expect(json_response['error']).to eq('name is missing')
-- 
cgit v1.2.1


From a8040a61d8bb6edb325236f9748c30e39ecaa335 Mon Sep 17 00:00:00 2001
From: Igor <idrozdov@gitlab.com>
Date: Mon, 26 Aug 2019 14:30:45 +0000
Subject: Add usage pings for merge request creating

Code Review Usage Ping for Create SMAU
---
 app/services/merge_requests/create_service.rb                  |  1 +
 changelogs/unreleased/id-code-review-smau.yml                  |  5 +++++
 lib/gitlab/usage_data.rb                                       |  3 ++-
 lib/gitlab/usage_data_counters/merge_request_counter.rb        | 10 ++++++++++
 .../gitlab/usage_data_counters/merge_request_counter_spec.rb   |  9 +++++++++
 spec/lib/gitlab/usage_data_spec.rb                             |  1 +
 spec/services/merge_requests/create_service_spec.rb            |  8 +++++++-
 7 files changed, 35 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/id-code-review-smau.yml
 create mode 100644 lib/gitlab/usage_data_counters/merge_request_counter.rb
 create mode 100644 spec/lib/gitlab/usage_data_counters/merge_request_counter_spec.rb

diff --git a/app/services/merge_requests/create_service.rb b/app/services/merge_requests/create_service.rb
index 06e46595b95..a69678a4422 100644
--- a/app/services/merge_requests/create_service.rb
+++ b/app/services/merge_requests/create_service.rb
@@ -27,6 +27,7 @@ module MergeRequests
       issuable.cache_merge_request_closes_issues!(current_user)
       create_pipeline_for(issuable, current_user)
       issuable.update_head_pipeline
+      Gitlab::UsageDataCounters::MergeRequestCounter.count(:create)
 
       super
     end
diff --git a/changelogs/unreleased/id-code-review-smau.yml b/changelogs/unreleased/id-code-review-smau.yml
new file mode 100644
index 00000000000..0bc7bca789b
--- /dev/null
+++ b/changelogs/unreleased/id-code-review-smau.yml
@@ -0,0 +1,5 @@
+---
+title: Add usage pings for merge request creating
+merge_request: 32059
+author:
+type: added
diff --git a/lib/gitlab/usage_data.rb b/lib/gitlab/usage_data.rb
index 353298e67b3..a93301cb4ce 100644
--- a/lib/gitlab/usage_data.rb
+++ b/lib/gitlab/usage_data.rb
@@ -142,7 +142,8 @@ module Gitlab
          Gitlab::UsageDataCounters::SnippetCounter,
          Gitlab::UsageDataCounters::SearchCounter,
          Gitlab::UsageDataCounters::CycleAnalyticsCounter,
-         Gitlab::UsageDataCounters::SourceCodeCounter
+         Gitlab::UsageDataCounters::SourceCodeCounter,
+         Gitlab::UsageDataCounters::MergeRequestCounter
         ]
       end
 
diff --git a/lib/gitlab/usage_data_counters/merge_request_counter.rb b/lib/gitlab/usage_data_counters/merge_request_counter.rb
new file mode 100644
index 00000000000..e786e595f77
--- /dev/null
+++ b/lib/gitlab/usage_data_counters/merge_request_counter.rb
@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module UsageDataCounters
+    class MergeRequestCounter < BaseCounter
+      KNOWN_EVENTS = %w[create].freeze
+      PREFIX = 'merge_request'
+    end
+  end
+end
diff --git a/spec/lib/gitlab/usage_data_counters/merge_request_counter_spec.rb b/spec/lib/gitlab/usage_data_counters/merge_request_counter_spec.rb
new file mode 100644
index 00000000000..4be4a661260
--- /dev/null
+++ b/spec/lib/gitlab/usage_data_counters/merge_request_counter_spec.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::UsageDataCounters::MergeRequestCounter do
+  it_behaves_like 'a redis usage counter', 'Merge Request', :create
+
+  it_behaves_like 'a redis usage counter with totals', :merge_request, create: 5
+end
diff --git a/spec/lib/gitlab/usage_data_spec.rb b/spec/lib/gitlab/usage_data_spec.rb
index dda119e09b1..b3a179e276b 100644
--- a/spec/lib/gitlab/usage_data_spec.rb
+++ b/spec/lib/gitlab/usage_data_spec.rb
@@ -69,6 +69,7 @@ describe Gitlab::UsageData do
         snippet_update: a_kind_of(Integer),
         snippet_comment: a_kind_of(Integer),
         merge_request_comment: a_kind_of(Integer),
+        merge_request_create: a_kind_of(Integer),
         commit_comment: a_kind_of(Integer),
         wiki_pages_create: a_kind_of(Integer),
         wiki_pages_update: a_kind_of(Integer),
diff --git a/spec/services/merge_requests/create_service_spec.rb b/spec/services/merge_requests/create_service_spec.rb
index ed48f4b1e44..699f2a98088 100644
--- a/spec/services/merge_requests/create_service_spec.rb
+++ b/spec/services/merge_requests/create_service_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe MergeRequests::CreateService do
+describe MergeRequests::CreateService, :clean_gitlab_redis_shared_state do
   include ProjectForksHelper
 
   let(:project) { create(:project, :repository) }
@@ -285,6 +285,12 @@ describe MergeRequests::CreateService do
           end
         end
       end
+
+      it 'increments the usage data counter of create event' do
+        counter = Gitlab::UsageDataCounters::MergeRequestCounter
+
+        expect { service.execute }.to change { counter.read(:create) }.by(1)
+      end
     end
 
     it_behaves_like 'new issuable record that supports quick actions' do
-- 
cgit v1.2.1


From e9a128b5742efdf16116f5bc86a66322d9d20b89 Mon Sep 17 00:00:00 2001
From: Walmyr Lima <walmyr@gitlab.com>
Date: Mon, 26 Aug 2019 18:12:36 +0200
Subject: Update view to add testability

---
 app/views/layouts/nav/sidebar/_project.html.haml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/layouts/nav/sidebar/_project.html.haml b/app/views/layouts/nav/sidebar/_project.html.haml
index 02ecf816e90..48fea2bbecf 100644
--- a/app/views/layouts/nav/sidebar/_project.html.haml
+++ b/app/views/layouts/nav/sidebar/_project.html.haml
@@ -115,7 +115,7 @@
                   = _('List')
 
             = nav_link(controller: :boards) do
-              = link_to project_boards_path(@project), title: boards_link_text do
+              = link_to project_boards_path(@project), title: boards_link_text, data: { qa_selector: "issue_boards_link" } do
                 %span
                   = boards_link_text
 
-- 
cgit v1.2.1


From a9cae447f11b0e6a6a7c060f04dfe9ac5e65ef7e Mon Sep 17 00:00:00 2001
From: Walmyr Lima <walmyr@gitlab.com>
Date: Mon, 26 Aug 2019 18:13:12 +0200
Subject: Update issues submenu

With a new element and a new method to go to issue boards.
---
 qa/qa/page/project/sub_menus/issues.rb | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/qa/qa/page/project/sub_menus/issues.rb b/qa/qa/page/project/sub_menus/issues.rb
index 8fb8fa06346..d27a250a300 100644
--- a/qa/qa/page/project/sub_menus/issues.rb
+++ b/qa/qa/page/project/sub_menus/issues.rb
@@ -10,6 +10,7 @@ module QA
           def self.included(base)
             base.class_eval do
               view 'app/views/layouts/nav/sidebar/_project.html.haml' do
+                element :issue_boards_link
                 element :issues_item
                 element :labels_link
                 element :milestones_link
@@ -29,6 +30,14 @@ module QA
             end
           end
 
+          def go_to_boards
+            hover_issues do
+              within_submenu do
+                click_element(:issue_boards_link)
+              end
+            end
+          end
+
           def go_to_labels
             hover_issues do
               within_submenu do
-- 
cgit v1.2.1


From 679e9cd1a5f67d27b26c6037864ed42e03a3b5d2 Mon Sep 17 00:00:00 2001
From: George Koltsov <koltsov.george@gmail.com>
Date: Mon, 26 Aug 2019 16:19:47 +0000
Subject: Change default visibility level for FogBugz imported projects to
 Private

---
 ...eorgekoltsov-54023-fogbugz-visibility-level.yml |  5 ++++
 lib/gitlab/fogbugz_import/project_creator.rb       |  2 +-
 .../gitlab/fogbugz_import/project_creator_spec.rb  | 29 ++++++++++++++++++++++
 3 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/georgekoltsov-54023-fogbugz-visibility-level.yml
 create mode 100644 spec/lib/gitlab/fogbugz_import/project_creator_spec.rb

diff --git a/changelogs/unreleased/georgekoltsov-54023-fogbugz-visibility-level.yml b/changelogs/unreleased/georgekoltsov-54023-fogbugz-visibility-level.yml
new file mode 100644
index 00000000000..d292958c92a
--- /dev/null
+++ b/changelogs/unreleased/georgekoltsov-54023-fogbugz-visibility-level.yml
@@ -0,0 +1,5 @@
+---
+title: Change default visibility level for FogBugz imported projects to Private
+merge_request: 32142
+author:
+type: fixed
diff --git a/lib/gitlab/fogbugz_import/project_creator.rb b/lib/gitlab/fogbugz_import/project_creator.rb
index 3c71031a8d9..841f9de8d4a 100644
--- a/lib/gitlab/fogbugz_import/project_creator.rb
+++ b/lib/gitlab/fogbugz_import/project_creator.rb
@@ -20,7 +20,7 @@ module Gitlab
           path: repo.path,
           namespace: namespace,
           creator: current_user,
-          visibility_level: Gitlab::VisibilityLevel::INTERNAL,
+          visibility_level: Gitlab::VisibilityLevel::PRIVATE,
           import_type: 'fogbugz',
           import_source: repo.name,
           import_url: Project::UNKNOWN_IMPORT_URL,
diff --git a/spec/lib/gitlab/fogbugz_import/project_creator_spec.rb b/spec/lib/gitlab/fogbugz_import/project_creator_spec.rb
new file mode 100644
index 00000000000..503fe897e29
--- /dev/null
+++ b/spec/lib/gitlab/fogbugz_import/project_creator_spec.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::FogbugzImport::ProjectCreator do
+  let(:user) { create(:user) }
+
+  let(:repo) do
+    instance_double(Gitlab::FogbugzImport::Repository,
+      name: 'Vim',
+      safe_name: 'vim',
+      path: 'vim',
+      raw_data: '')
+  end
+
+  let(:uri) { 'https://testing.fogbugz.com' }
+  let(:token) { 'token' }
+  let(:fb_session) { { uri: uri, token: token } }
+  let(:project_creator) { described_class.new(repo, fb_session, user.namespace, user) }
+
+  subject do
+    project_creator.execute
+  end
+
+  it 'creates project with private visibility level' do
+    expect(subject.persisted?).to eq(true)
+    expect(subject.visibility_level).to eq(Gitlab::VisibilityLevel::PRIVATE)
+  end
+end
-- 
cgit v1.2.1


From cf4856337d50ca3eab59a34e8d5a10441999a920 Mon Sep 17 00:00:00 2001
From: Aishwarya Subramanian <asubramanian@gitlab.com>
Date: Mon, 26 Aug 2019 21:53:38 +0530
Subject: Added routes for trial registration api

---
 app/services/users/build_service.rb | 8 +++++++-
 config/routes.rb                    | 4 ++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/app/services/users/build_service.rb b/app/services/users/build_service.rb
index 026bcfcdaf4..c853d6fce33 100644
--- a/app/services/users/build_service.rb
+++ b/app/services/users/build_service.rb
@@ -87,7 +87,9 @@ module Users
         :password_automatically_set,
         :name,
         :password,
-        :username
+        :username,
+        :first_name,
+        :last_name
       ]
     end
 
@@ -107,6 +109,10 @@ module Users
         if user_params[:skip_confirmation].nil?
           user_params[:skip_confirmation] = skip_user_confirmation_email_from_setting
         end
+
+        if (user_params[:first_name].present? || user_params[:last_name].present?) && !user_params[:name].present?
+          user_params[:name] = "#{user_params[:first_name]} #{user_params[:last_name]}"
+        end
       end
 
       if user_default_internal_regex_enabled? && !user_params.key?(:external)
diff --git a/config/routes.rb b/config/routes.rb
index d633228a495..3cdb0328604 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -188,6 +188,10 @@ Rails.application.routes.draw do
   draw :user
   draw :project
 
+  Gitlab.ee do
+    draw :trial_registration
+  end
+
   root to: "root#index"
 
   get '*unmatched_route', to: 'application#route_not_found'
-- 
cgit v1.2.1


From ab560c72b85c521054146ea606aacf6e420694ea Mon Sep 17 00:00:00 2001
From: Aishwarya Subramanian <asubramanian@gitlab.com>
Date: Mon, 26 Aug 2019 22:03:35 +0530
Subject: Added skip_authorization as true for trials

---
 app/controllers/registrations_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/registrations_controller.rb b/app/controllers/registrations_controller.rb
index e773ec09924..3701abe9d32 100644
--- a/app/controllers/registrations_controller.rb
+++ b/app/controllers/registrations_controller.rb
@@ -115,7 +115,7 @@ class RegistrationsController < Devise::RegistrationsController
   end
 
   def resource
-    @resource ||= Users::BuildService.new(current_user, sign_up_params).execute
+    @resource ||= Users::BuildService.new(current_user, sign_up_params).execute(skip_authorization: true)
   end
 
   def devise_mapping
-- 
cgit v1.2.1


From 093e954616d05021a6b7a9a09ba1cae5f6e9f8e5 Mon Sep 17 00:00:00 2001
From: Peter Leitzen <pleitzen@gitlab.com>
Date: Mon, 26 Aug 2019 16:55:03 +0000
Subject: Extract gcloud and minikube cluster provider

Add cluster provider k3d
---
 qa/qa.rb                                   |   7 ++
 qa/qa/service/cluster_provider/base.rb     |  41 +++++++++
 qa/qa/service/cluster_provider/gcloud.rb   |  87 +++++++++++++++++++
 qa/qa/service/cluster_provider/k3d.rb      | 131 ++++++++++++++++++++++++++++
 qa/qa/service/cluster_provider/minikube.rb |  26 ++++++
 qa/qa/service/kubernetes_cluster.rb        | 134 ++++++++++-------------------
 6 files changed, 338 insertions(+), 88 deletions(-)
 create mode 100644 qa/qa/service/cluster_provider/base.rb
 create mode 100644 qa/qa/service/cluster_provider/gcloud.rb
 create mode 100644 qa/qa/service/cluster_provider/k3d.rb
 create mode 100644 qa/qa/service/cluster_provider/minikube.rb

diff --git a/qa/qa.rb b/qa/qa.rb
index 8be2a289422..a760f72f70d 100644
--- a/qa/qa.rb
+++ b/qa/qa.rb
@@ -359,6 +359,13 @@ module QA
     autoload :KubernetesCluster, 'qa/service/kubernetes_cluster'
     autoload :Omnibus, 'qa/service/omnibus'
     autoload :Runner, 'qa/service/runner'
+
+    module ClusterProvider
+      autoload :Base, 'qa/service/cluster_provider/base'
+      autoload :Gcloud, 'qa/service/cluster_provider/gcloud'
+      autoload :Minikube, 'qa/service/cluster_provider/minikube'
+      autoload :K3d, 'qa/service/cluster_provider/k3d'
+    end
   end
 
   ##
diff --git a/qa/qa/service/cluster_provider/base.rb b/qa/qa/service/cluster_provider/base.rb
new file mode 100644
index 00000000000..a9678557aca
--- /dev/null
+++ b/qa/qa/service/cluster_provider/base.rb
@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module QA
+  module Service
+    module ClusterProvider
+      class Base
+        include Service::Shellout
+
+        attr_reader :rbac
+
+        def initialize(rbac:)
+          @rbac = rbac
+        end
+
+        def cluster_name
+          @cluster_name ||= "qa-cluster-#{Time.now.utc.strftime("%Y%m%d%H%M%S")}-#{SecureRandom.hex(4)}"
+        end
+
+        def set_credentials(admin_user)
+          raise NotImplementedError
+        end
+
+        def validate_dependencies
+          raise NotImplementedError
+        end
+
+        def setup
+          raise NotImplementedError
+        end
+
+        def teardown
+          raise NotImplementedError
+        end
+
+        def filter_credentials(credentials)
+          credentials
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/service/cluster_provider/gcloud.rb b/qa/qa/service/cluster_provider/gcloud.rb
new file mode 100644
index 00000000000..9c82151666c
--- /dev/null
+++ b/qa/qa/service/cluster_provider/gcloud.rb
@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module QA
+  module Service
+    module ClusterProvider
+      class Gcloud < Base
+        def validate_dependencies
+          find_executable('gcloud') || raise("You must first install `gcloud` executable to run these tests.")
+        end
+
+        def set_credentials(admin_user)
+          master_auth = JSON.parse(`gcloud container clusters describe #{cluster_name} --region #{Runtime::Env.gcloud_region} --format 'json(masterAuth.username, masterAuth.password)'`)
+
+          shell <<~CMD.tr("\n", ' ')
+            kubectl config set-credentials #{admin_user}
+              --username #{master_auth['masterAuth']['username']}
+              --password #{master_auth['masterAuth']['password']}
+          CMD
+        end
+
+        def setup
+          login_if_not_already_logged_in
+          create_cluster
+        end
+
+        def teardown
+          delete_cluster
+        end
+
+        private
+
+        def login_if_not_already_logged_in
+          if Runtime::Env.has_gcloud_credentials?
+            attempt_login_with_env_vars
+          else
+            account = `gcloud auth list --filter=status:ACTIVE --format="value(account)"`
+            if account.empty?
+              raise "Failed to login to gcloud. No credentials provided in environment and no credentials found locally."
+            else
+              puts "gcloud account found. Using: #{account} for creating K8s cluster."
+            end
+          end
+        end
+
+        def attempt_login_with_env_vars
+          puts "No gcloud account. Attempting to login from env vars GCLOUD_ACCOUNT_EMAIL and GCLOUD_ACCOUNT_KEY."
+          gcloud_account_key = Tempfile.new('gcloud-account-key')
+          gcloud_account_key.write(Runtime::Env.gcloud_account_key)
+          gcloud_account_key.close
+          gcloud_account_email = Runtime::Env.gcloud_account_email
+          shell("gcloud auth activate-service-account #{gcloud_account_email} --key-file #{gcloud_account_key.path}")
+        ensure
+          gcloud_account_key && gcloud_account_key.unlink
+        end
+
+        def auth_options
+          "--enable-legacy-authorization" unless rbac
+        end
+
+        def create_cluster
+          shell <<~CMD.tr("\n", ' ')
+            gcloud container clusters
+            create #{cluster_name}
+            #{auth_options}
+            --enable-basic-auth
+            --region #{Runtime::Env.gcloud_region}
+            --disk-size 10GB
+            --num-nodes #{Runtime::Env.gcloud_num_nodes}
+            && gcloud container clusters
+            get-credentials
+            --region #{Runtime::Env.gcloud_region}
+            #{cluster_name}
+          CMD
+        end
+
+        def delete_cluster
+          shell <<~CMD.tr("\n", ' ')
+            gcloud container clusters delete
+              --region #{Runtime::Env.gcloud_region}
+              #{cluster_name}
+              --quiet --async
+          CMD
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/service/cluster_provider/k3d.rb b/qa/qa/service/cluster_provider/k3d.rb
new file mode 100644
index 00000000000..8e117c2dbd5
--- /dev/null
+++ b/qa/qa/service/cluster_provider/k3d.rb
@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+module QA
+  module Service
+    module ClusterProvider
+      class K3d < Base
+        def validate_dependencies
+          find_executable('k3d') || raise("You must first install `k3d` executable to run these tests.")
+        end
+
+        def set_credentials(admin_user)
+        end
+
+        def setup
+          shell "k3d create --workers 1 --name #{cluster_name} --wait 0"
+
+          @old_kubeconfig = ENV['KUBECONFIG']
+          ENV['KUBECONFIG'] = fetch_kubeconfig
+          raise "Could not fetch kubeconfig" unless ENV['KUBECONFIG']
+
+          install_local_storage
+        end
+
+        def teardown
+          ENV['KUBECONFIG'] = @old_kubeconfig
+          shell "k3d delete --name #{cluster_name}"
+        end
+
+        # Fetch "real" certificate
+        # See https://github.com/rancher/k3s/issues/27
+        def filter_credentials(credentials)
+          kubeconfig = YAML.load_file(ENV['KUBECONFIG'])
+          ca_certificate = kubeconfig.dig('clusters', 0, 'cluster', 'certificate-authority-data')
+
+          credentials.merge('data' => credentials['data'].merge('ca.crt' => ca_certificate))
+        end
+
+        private
+
+        def retry_until(max_attempts: 10, wait: 1)
+          max_attempts.times do
+            result = yield
+            return result if result
+
+            sleep wait
+          end
+
+          raise "Retried #{max_attempts} times. Aborting"
+        end
+
+        def fetch_kubeconfig
+          retry_until do
+            config = `k3d get-kubeconfig --name #{cluster_name}`.chomp
+            config if config =~ /kubeconfig.yaml/
+          end
+        end
+
+        def install_local_storage
+          shell('kubectl apply -f -', stdin_data: local_storage_config)
+        end
+
+        # See https://github.com/rancher/k3d/issues/67
+        def local_storage_config
+          <<~YAML
+            ---
+            apiVersion: v1
+            kind: ServiceAccount
+            metadata:
+              name: storage-provisioner
+              namespace: kube-system
+            ---
+            apiVersion: rbac.authorization.k8s.io/v1
+            kind: ClusterRoleBinding
+            metadata:
+              name: storage-provisioner
+            roleRef:
+              apiGroup: rbac.authorization.k8s.io
+              kind: ClusterRole
+              name: system:persistent-volume-provisioner
+            subjects:
+              - kind: ServiceAccount
+                name: storage-provisioner
+                namespace: kube-system
+            ---
+            apiVersion: v1
+            kind: Pod
+            metadata:
+              name: storage-provisioner
+              namespace: kube-system
+            spec:
+              serviceAccountName: storage-provisioner
+              tolerations:
+              - effect: NoExecute
+                key: node.kubernetes.io/not-ready
+                operator: Exists
+                tolerationSeconds: 300
+              - effect: NoExecute
+                key: node.kubernetes.io/unreachable
+                operator: Exists
+                tolerationSeconds: 300
+              hostNetwork: true
+              containers:
+              - name: storage-provisioner
+                image: gcr.io/k8s-minikube/storage-provisioner:v1.8.1
+                command: ["/storage-provisioner"]
+                imagePullPolicy: IfNotPresent
+                volumeMounts:
+                - mountPath: /tmp
+                  name: tmp
+              volumes:
+              - name: tmp
+                hostPath:
+                  path: /tmp
+                  type: Directory
+            ---
+            kind: StorageClass
+            apiVersion: storage.k8s.io/v1
+            metadata:
+              name: standard
+              namespace: kube-system
+              annotations:
+                storageclass.kubernetes.io/is-default-class: "true"
+              labels:
+                addonmanager.kubernetes.io/mode: EnsureExists
+            provisioner: k8s.io/minikube-hostpath
+          YAML
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/service/cluster_provider/minikube.rb b/qa/qa/service/cluster_provider/minikube.rb
new file mode 100644
index 00000000000..fc916245357
--- /dev/null
+++ b/qa/qa/service/cluster_provider/minikube.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module QA
+  module Service
+    module ClusterProvider
+      class Minikube < Base
+        def validate_dependencies
+          find_executable('minikube') || raise("You must first install `minikube` executable to run these tests.")
+        end
+
+        def set_credentials(admin_user)
+        end
+
+        def setup
+          shell 'minikube stop'
+          shell "minikube profile #{cluster_name}"
+          shell 'minikube start'
+        end
+
+        def teardown
+          shell 'minikube delete'
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/service/kubernetes_cluster.rb b/qa/qa/service/kubernetes_cluster.rb
index ac0b6313167..26b5f58d2d3 100644
--- a/qa/qa/service/kubernetes_cluster.rb
+++ b/qa/qa/service/kubernetes_cluster.rb
@@ -9,90 +9,63 @@ module QA
     class KubernetesCluster
       include Service::Shellout
 
-      attr_reader :api_url, :ca_certificate, :token, :rbac
+      attr_reader :api_url, :ca_certificate, :token, :rbac, :provider
 
-      def initialize(rbac: true)
+      def initialize(rbac: true, provider_class: QA::Service::ClusterProvider::Gcloud)
         @rbac = rbac
-      end
-
-      def cluster_name
-        @cluster_name ||= "qa-cluster-#{SecureRandom.hex(4)}-#{Time.now.utc.strftime("%Y%m%d%H%M%S")}"
+        @provider = provider_class.new(rbac: rbac)
       end
 
       def create!
         validate_dependencies
-        login_if_not_already_logged_in
-
-        shell <<~CMD.tr("\n", ' ')
-          gcloud container clusters
-          create #{cluster_name}
-          #{auth_options}
-          --enable-basic-auth
-          --region #{Runtime::Env.gcloud_region}
-          --disk-size 10GB
-          --num-nodes #{Runtime::Env.gcloud_num_nodes}
-          && gcloud container clusters
-          get-credentials
-          --region #{Runtime::Env.gcloud_region}
-          #{cluster_name}
-        CMD
-
-        @api_url = `kubectl config view --minify -o jsonpath='{.clusters[].cluster.server}'`
-
-        @admin_user = "#{cluster_name}-admin"
-        master_auth = JSON.parse(`gcloud container clusters describe #{cluster_name} --region #{Runtime::Env.gcloud_region} --format 'json(masterAuth.username, masterAuth.password)'`)
-        shell <<~CMD.tr("\n", ' ')
-          kubectl config set-credentials #{@admin_user}
-          --username #{master_auth['masterAuth']['username']}
-          --password #{master_auth['masterAuth']['password']}
-        CMD
-
-        if rbac
-          create_service_account
-
-          secrets = JSON.parse(`kubectl get secrets -o json`)
-          gitlab_account = secrets['items'].find do |item|
-            item['metadata']['annotations']['kubernetes.io/service-account.name'] == 'gitlab-account'
-          end
-
-          @ca_certificate = Base64.decode64(gitlab_account['data']['ca.crt'])
-          @token = Base64.decode64(gitlab_account['data']['token'])
-        else
-          @ca_certificate = Base64.decode64(`kubectl get secrets -o jsonpath="{.items[0].data['ca\\.crt']}"`)
-          @token = Base64.decode64(`kubectl get secrets -o jsonpath='{.items[0].data.token}'`)
-        end
+
+        @provider.validate_dependencies
+        @provider.setup
+
+        @api_url = fetch_api_url
+
+        credentials = @provider.filter_credentials(fetch_credentials)
+        @ca_certificate = Base64.decode64(credentials.dig('data', 'ca.crt'))
+        @token = Base64.decode64(credentials.dig('data', 'token'))
 
         self
       end
 
       def remove!
-        shell <<~CMD.tr("\n", ' ')
-          gcloud container clusters delete
-          --region #{Runtime::Env.gcloud_region}
-          #{cluster_name}
-          --quiet --async
-        CMD
+        @provider.teardown
+      end
+
+      def cluster_name
+        @provider.cluster_name
       end
 
       private
 
-      def create_service_account
-        shell('kubectl create -f -', stdin_data: service_account)
-        shell("kubectl --user #{@admin_user} create -f -", stdin_data: service_account_role_binding)
+      def fetch_api_url
+        `kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}'`
+      end
+
+      def fetch_credentials
+        return global_credentials unless rbac
+
+        @provider.set_credentials(admin_user)
+        create_service_account(admin_user)
+        account_credentials
       end
 
-      def service_account
-        <<~YAML
+      def admin_user
+        @admin_user ||= "#{@provider.cluster_name}-admin"
+      end
+
+      def create_service_account(user)
+        service_account = <<~YAML
+          ---
           apiVersion: v1
           kind: ServiceAccount
           metadata:
             name: gitlab-account
             namespace: default
-        YAML
-      end
-
-      def service_account_role_binding
-        <<~YAML
+          ---
           kind: ClusterRoleBinding
           apiVersion: rbac.authorization.k8s.io/v1
           metadata:
@@ -106,39 +79,24 @@ module QA
             name: cluster-admin
             apiGroup: rbac.authorization.k8s.io
         YAML
-      end
 
-      def auth_options
-        "--enable-legacy-authorization" unless rbac
+        shell('kubectl apply -f -', stdin_data: service_account)
       end
 
-      def validate_dependencies
-        find_executable('gcloud') || raise("You must first install `gcloud` executable to run these tests.")
-        find_executable('kubectl') || raise("You must first install `kubectl` executable to run these tests.")
-      end
+      def account_credentials
+        secrets = JSON.parse(`kubectl get secrets -o json`)
 
-      def login_if_not_already_logged_in
-        if Runtime::Env.has_gcloud_credentials?
-          attempt_login_with_env_vars
-        else
-          account = `gcloud auth list --filter=status:ACTIVE --format="value(account)"`
-          if account.empty?
-            raise "Failed to login to gcloud. No credentials provided in environment and no credentials found locally."
-          else
-            puts "gcloud account found. Using: #{account} for creating K8s cluster."
-          end
+        secrets['items'].find do |item|
+          item['metadata']['annotations']['kubernetes.io/service-account.name'] == 'gitlab-account'
         end
       end
 
-      def attempt_login_with_env_vars
-        puts "No gcloud account. Attempting to login from env vars GCLOUD_ACCOUNT_EMAIL and GCLOUD_ACCOUNT_KEY."
-        gcloud_account_key = Tempfile.new('gcloud-account-key')
-        gcloud_account_key.write(Runtime::Env.gcloud_account_key)
-        gcloud_account_key.close
-        gcloud_account_email = Runtime::Env.gcloud_account_email
-        shell("gcloud auth activate-service-account #{gcloud_account_email} --key-file #{gcloud_account_key.path}")
-      ensure
-        gcloud_account_key && gcloud_account_key.unlink
+      def global_credentials
+        JSON.parse(`kubectl get secrets -o jsonpath='{.items[0]}'`)
+      end
+
+      def validate_dependencies
+        find_executable('kubectl') || raise("You must first install `kubectl` executable to run these tests.")
       end
     end
   end
-- 
cgit v1.2.1


From bdd5b5b69533b8035d0a03a1d4c9de38ba3da189 Mon Sep 17 00:00:00 2001
From: Brett Walker <bwalker@gitlab.com>
Date: Mon, 26 Aug 2019 17:43:38 +0000
Subject: Replace echo function with a resolver

The `GraphQL::Function` has been deprecated in
favor of resolvers.
---
 Gemfile                                            |  2 +-
 Gemfile.lock                                       |  4 ++--
 app/graphql/functions/base_function.rb             |  6 ------
 app/graphql/functions/echo.rb                      | 15 --------------
 app/graphql/resolvers/echo_resolver.rb             | 14 +++++++++++++
 app/graphql/types/query_type.rb                    |  2 +-
 lib/gitlab/graphql/present/instrumentation.rb      |  4 +++-
 spec/graphql/resolvers/echo_resolver_spec.rb       | 24 ++++++++++++++++++++++
 .../authorize/authorize_field_service_spec.rb      |  5 ++++-
 spec/lib/gitlab/graphql/markdown_field_spec.rb     |  7 +++++--
 .../api/graphql/multiplexed_queries_spec.rb        |  8 ++++----
 11 files changed, 58 insertions(+), 33 deletions(-)
 delete mode 100644 app/graphql/functions/base_function.rb
 delete mode 100644 app/graphql/functions/echo.rb
 create mode 100644 app/graphql/resolvers/echo_resolver.rb
 create mode 100644 spec/graphql/resolvers/echo_resolver_spec.rb

diff --git a/Gemfile b/Gemfile
index 751f5169b0c..595dedd4656 100644
--- a/Gemfile
+++ b/Gemfile
@@ -83,7 +83,7 @@ gem 'grape-entity', '~> 0.7.1'
 gem 'rack-cors', '~> 1.0.0', require: 'rack/cors'
 
 # GraphQL API
-gem 'graphql', '~> 1.8.0'
+gem 'graphql', '= 1.8.4'
 gem 'graphiql-rails', '~> 1.4.10'
 gem 'apollo_upload_server', '~> 2.0.0.beta3'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]
diff --git a/Gemfile.lock b/Gemfile.lock
index a6a44cc6960..ae0d0e78c37 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -375,7 +375,7 @@ GEM
     graphiql-rails (1.4.10)
       railties
       sprockets-rails
-    graphql (1.8.1)
+    graphql (1.8.4)
     graphql-docs (1.6.0)
       commonmarker (~> 0.16)
       escape_utils (~> 1.2)
@@ -1118,7 +1118,7 @@ DEPENDENCIES
   grape-path-helpers (~> 1.1)
   grape_logging (~> 1.7)
   graphiql-rails (~> 1.4.10)
-  graphql (~> 1.8.0)
+  graphql (= 1.8.4)
   graphql-docs (~> 1.6.0)
   grpc (~> 1.19.0)
   haml_lint (~> 0.31.0)
diff --git a/app/graphql/functions/base_function.rb b/app/graphql/functions/base_function.rb
deleted file mode 100644
index 2512ecbd255..00000000000
--- a/app/graphql/functions/base_function.rb
+++ /dev/null
@@ -1,6 +0,0 @@
-# frozen_string_literal: true
-
-module Functions
-  class BaseFunction < GraphQL::Function
-  end
-end
diff --git a/app/graphql/functions/echo.rb b/app/graphql/functions/echo.rb
deleted file mode 100644
index 3104486faac..00000000000
--- a/app/graphql/functions/echo.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-module Functions
-  class Echo < BaseFunction
-    argument :text, GraphQL::STRING_TYPE
-
-    description "Testing endpoint to validate the API with"
-
-    def call(obj, args, ctx)
-      username = ctx[:current_user]&.username
-
-      "#{username.inspect} says: #{args[:text]}"
-    end
-  end
-end
diff --git a/app/graphql/resolvers/echo_resolver.rb b/app/graphql/resolvers/echo_resolver.rb
new file mode 100644
index 00000000000..8076e1784ce
--- /dev/null
+++ b/app/graphql/resolvers/echo_resolver.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Resolvers
+  class EchoResolver < BaseResolver
+    argument    :text, GraphQL::STRING_TYPE, required: true
+    description 'Testing endpoint to validate the API with'
+
+    def resolve(**args)
+      username = context[:current_user]&.username
+
+      "#{username.inspect} says: #{args[:text]}"
+    end
+  end
+end
diff --git a/app/graphql/types/query_type.rb b/app/graphql/types/query_type.rb
index 53d36b43576..c686300b25d 100644
--- a/app/graphql/types/query_type.rb
+++ b/app/graphql/types/query_type.rb
@@ -24,6 +24,6 @@ module Types
           resolver: Resolvers::MetadataResolver,
           description: 'Metadata about GitLab'
 
-    field :echo, GraphQL::STRING_TYPE, null: false, function: Functions::Echo.new
+    field :echo, GraphQL::STRING_TYPE, null: false, resolver: Resolvers::EchoResolver
   end
 end
diff --git a/lib/gitlab/graphql/present/instrumentation.rb b/lib/gitlab/graphql/present/instrumentation.rb
index ab03c40c22d..941a4f434a1 100644
--- a/lib/gitlab/graphql/present/instrumentation.rb
+++ b/lib/gitlab/graphql/present/instrumentation.rb
@@ -23,7 +23,9 @@ module Gitlab
             end
 
             presenter = presented_in.presenter_class.new(object, **context.to_h)
-            wrapped = presented_type.class.new(presenter, context)
+
+            # we have to use the new `authorized_new` method, as `new` is protected
+            wrapped = presented_type.class.authorized_new(presenter, context)
 
             old_resolver.call(wrapped, args, context)
           end
diff --git a/spec/graphql/resolvers/echo_resolver_spec.rb b/spec/graphql/resolvers/echo_resolver_spec.rb
new file mode 100644
index 00000000000..466501a4227
--- /dev/null
+++ b/spec/graphql/resolvers/echo_resolver_spec.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Resolvers::EchoResolver do
+  include GraphqlHelpers
+
+  let(:current_user) { create(:user) }
+  let(:text) { 'Message test' }
+
+  describe '#resolve' do
+    it 'echoes text and username' do
+      expect(resolve_echo(text)).to eq %Q("#{current_user.username}" says: #{text})
+    end
+
+    it 'echoes text and nil as username' do
+      expect(resolve_echo(text, { current_user: nil })).to eq "nil says: #{text}"
+    end
+  end
+
+  def resolve_echo(text, context = { current_user: current_user })
+    resolve(described_class, obj: nil, args: { text: text }, ctx: context)
+  end
+end
diff --git a/spec/lib/gitlab/graphql/authorize/authorize_field_service_spec.rb b/spec/lib/gitlab/graphql/authorize/authorize_field_service_spec.rb
index d60d1b7559a..7a7ae373058 100644
--- a/spec/lib/gitlab/graphql/authorize/authorize_field_service_spec.rb
+++ b/spec/lib/gitlab/graphql/authorize/authorize_field_service_spec.rb
@@ -30,7 +30,10 @@ describe Gitlab::Graphql::Authorize::AuthorizeFieldService do
   describe '#authorized_resolve' do
     let(:presented_object) { double('presented object') }
     let(:presented_type) { double('parent type', object: presented_object) }
-    subject(:resolved) { service.authorized_resolve.call(presented_type, {}, { current_user: current_user }) }
+    let(:query_type) { GraphQL::ObjectType.new }
+    let(:schema) { GraphQL::Schema.define(query: query_type, mutation: nil)}
+    let(:context) { GraphQL::Query::Context.new(query: OpenStruct.new(schema: schema), values: { current_user: current_user }, object: nil) }
+    subject(:resolved) { service.authorized_resolve.call(presented_type, {}, context) }
 
     context 'scalar types' do
       shared_examples 'checking permissions on the presented object' do
diff --git a/spec/lib/gitlab/graphql/markdown_field_spec.rb b/spec/lib/gitlab/graphql/markdown_field_spec.rb
index a8566aa8e1c..866a20801d3 100644
--- a/spec/lib/gitlab/graphql/markdown_field_spec.rb
+++ b/spec/lib/gitlab/graphql/markdown_field_spec.rb
@@ -30,17 +30,20 @@ describe Gitlab::Graphql::MarkdownField do
       let(:note) { build(:note, note: '# Markdown!') }
       let(:thing_with_markdown) { double('markdown thing', object: note) }
       let(:expected_markdown) { '<h1 data-sourcepos="1:1-1:11" dir="auto">Markdown!</h1>' }
+      let(:query_type) { GraphQL::ObjectType.new }
+      let(:schema) { GraphQL::Schema.define(query: query_type, mutation: nil)}
+      let(:context) { GraphQL::Query::Context.new(query: OpenStruct.new(schema: schema), values: nil, object: nil) }
 
       it 'renders markdown from the same property as the field name without the `_html` suffix' do
         field = class_with_markdown_field(:note_html, null: false).fields['noteHtml']
 
-        expect(field.to_graphql.resolve(thing_with_markdown, {}, {})).to eq(expected_markdown)
+        expect(field.to_graphql.resolve(thing_with_markdown, {}, context)).to eq(expected_markdown)
       end
 
       it 'renders markdown from a specific property when a `method` argument is passed' do
         field = class_with_markdown_field(:test_html, null: false, method: :note).fields['testHtml']
 
-        expect(field.to_graphql.resolve(thing_with_markdown, {}, {})).to eq(expected_markdown)
+        expect(field.to_graphql.resolve(thing_with_markdown, {}, context)).to eq(expected_markdown)
       end
     end
   end
diff --git a/spec/requests/api/graphql/multiplexed_queries_spec.rb b/spec/requests/api/graphql/multiplexed_queries_spec.rb
index 844fd979285..9ebb57f6b9c 100644
--- a/spec/requests/api/graphql/multiplexed_queries_spec.rb
+++ b/spec/requests/api/graphql/multiplexed_queries_spec.rb
@@ -6,9 +6,9 @@ describe 'Multiplexed queries' do
 
   it 'returns responses for multiple queries' do
     queries = [
-      { query: 'query($text: String) { echo(text: $text) }',
+      { query: 'query($text: String!) { echo(text: $text) }',
         variables: { 'text' => 'Hello' } },
-      { query: 'query($text: String) { echo(text: $text) }',
+      { query: 'query($text: String!) { echo(text: $text) }',
         variables: { 'text' => 'World' } }
     ]
 
@@ -23,8 +23,8 @@ describe 'Multiplexed queries' do
 
   it 'returns error and data combinations' do
     queries = [
-      { query: 'query($text: String) { broken query }' },
-      { query: 'query working($text: String) { echo(text: $text) }',
+      { query: 'query($text: String!) { broken query }' },
+      { query: 'query working($text: String!) { echo(text: $text) }',
         variables: { 'text' => 'World' } }
     ]
 
-- 
cgit v1.2.1


From 6c82462df617b3ae4adf64582e08a7432c69fb9a Mon Sep 17 00:00:00 2001
From: Jeremy Jackson <jjackson@gitlab.com>
Date: Mon, 26 Aug 2019 18:14:48 +0000
Subject: Changes snowplow to use cookies for sessions

This also restructures how and where the configuration for
Snowplow lives.
---
 app/assets/javascripts/main.js           |  2 +
 app/assets/javascripts/tracking.js       | 28 ++++++++++
 app/views/layouts/_snowplow.html.haml    | 21 +-------
 lib/gitlab/snowplow_tracker.rb           | 35 -------------
 lib/gitlab/tracking.rb                   | 44 ++++++++++++++++
 spec/frontend/tracking_spec.js           | 46 +++++++++++++++--
 spec/lib/gitlab/snowplow_tracker_spec.rb | 45 ----------------
 spec/lib/gitlab/tracking_spec.rb         | 88 ++++++++++++++++++++++++++++++++
 8 files changed, 204 insertions(+), 105 deletions(-)
 delete mode 100644 lib/gitlab/snowplow_tracker.rb
 create mode 100644 lib/gitlab/tracking.rb
 delete mode 100644 spec/lib/gitlab/snowplow_tracker_spec.rb
 create mode 100644 spec/lib/gitlab/tracking_spec.rb

diff --git a/app/assets/javascripts/main.js b/app/assets/javascripts/main.js
index 39f2097c174..0ddf40b0405 100644
--- a/app/assets/javascripts/main.js
+++ b/app/assets/javascripts/main.js
@@ -35,6 +35,7 @@ import initPerformanceBar from './performance_bar';
 import initSearchAutocomplete from './search_autocomplete';
 import GlFieldErrors from './gl_field_errors';
 import initUserPopovers from './user_popovers';
+import { initUserTracking } from './tracking';
 import { __ } from './locale';
 
 import 'ee_else_ce/main_ee';
@@ -94,6 +95,7 @@ function deferredInitialisation() {
   initLogoAnimation();
   initUsagePingConsent();
   initUserPopovers();
+  initUserTracking();
 
   if (document.querySelector('.search')) initSearchAutocomplete();
 
diff --git a/app/assets/javascripts/tracking.js b/app/assets/javascripts/tracking.js
index a852f937eec..03281b5ef49 100644
--- a/app/assets/javascripts/tracking.js
+++ b/app/assets/javascripts/tracking.js
@@ -1,5 +1,23 @@
 import $ from 'jquery';
 
+const DEFAULT_SNOWPLOW_OPTIONS = {
+  namespace: 'gl',
+  hostname: window.location.hostname,
+  cookieDomain: window.location.hostname,
+  appId: '',
+  userFingerprint: false,
+  respectDoNotTrack: true,
+  forceSecureTracker: true,
+  eventMethod: 'post',
+  contexts: { webPage: true },
+  // Page tracking tracks a single event when the page loads.
+  pageTrackingEnabled: false,
+  // Activity tracking tracks when a user is still interacting with the page.
+  // Events like scrolling and mouse movements are used to determine if the
+  // user has the tab active and is still actively engaging.
+  activityTrackingEnabled: false,
+};
+
 const extractData = (el, opts = {}) => {
   const { trackEvent, trackLabel = '', trackProperty = '' } = el.dataset;
   let trackValue = el.dataset.trackValue || el.value || '';
@@ -71,3 +89,13 @@ export default class Tracking {
     };
   }
 }
+
+export function initUserTracking() {
+  if (!Tracking.enabled()) return;
+
+  const opts = Object.assign({}, DEFAULT_SNOWPLOW_OPTIONS, window.snowplowOptions);
+  window.snowplow('newTracker', opts.namespace, opts.hostname, opts);
+
+  if (opts.activityTrackingEnabled) window.snowplow('enableActivityTracking', 30, 30);
+  if (opts.pageTrackingEnabled) window.snowplow('trackPageView'); // must be after enableActivityTracking
+}
diff --git a/app/views/layouts/_snowplow.html.haml b/app/views/layouts/_snowplow.html.haml
index 5f5c5e984c5..d7ff5ad1094 100644
--- a/app/views/layouts/_snowplow.html.haml
+++ b/app/views/layouts/_snowplow.html.haml
@@ -7,23 +7,4 @@
     };p[i].q=p[i].q||[];n=l.createElement(o);g=l.getElementsByTagName(o)[0];n.async=1;
     n.src=w;g.parentNode.insertBefore(n,g)}}(window,document,"script","#{asset_url('snowplow/sp.js')}","snowplow"));
 
-    window.snowplow('newTracker', '#{Gitlab::SnowplowTracker::NAMESPACE}', '#{Gitlab::CurrentSettings.snowplow_collector_hostname}', {
-      appId: '#{Gitlab::CurrentSettings.snowplow_site_id}',
-      cookieDomain: '#{Gitlab::CurrentSettings.snowplow_cookie_domain}',
-      userFingerprint: false,
-      respectDoNotTrack: true,
-      forceSecureTracker: true,
-      post: true,
-      contexts: { webPage: true },
-      stateStorageStrategy: "localStorage"
-    });
-
-    window.snowplow('enableActivityTracking', 30, 30);
-    window.snowplow('trackPageView');
-
-- return unless Feature.enabled?(:additional_snowplow_tracking, @group)
-
-= javascript_tag nonce: true do
-  :plain
-    window.snowplow('enableFormTracking');
-    window.snowplow('enableLinkClickTracking');
+    window.snowplowOptions = #{Gitlab::Tracking.snowplow_options(@group).to_json}
diff --git a/lib/gitlab/snowplow_tracker.rb b/lib/gitlab/snowplow_tracker.rb
deleted file mode 100644
index 9f12513e09e..00000000000
--- a/lib/gitlab/snowplow_tracker.rb
+++ /dev/null
@@ -1,35 +0,0 @@
-# frozen_string_literal: true
-
-require 'snowplow-tracker'
-
-module Gitlab
-  module SnowplowTracker
-    NAMESPACE = 'cf'
-
-    class << self
-      def track_event(category, action, label: nil, property: nil, value: nil, context: nil)
-        tracker&.track_struct_event(category, action, label, property, value, context, Time.now.to_i)
-      end
-
-      private
-
-      def tracker
-        return unless enabled?
-
-        @tracker ||= ::SnowplowTracker::Tracker.new(emitter, subject, NAMESPACE, Gitlab::CurrentSettings.snowplow_site_id)
-      end
-
-      def subject
-        ::SnowplowTracker::Subject.new
-      end
-
-      def emitter
-        ::SnowplowTracker::Emitter.new(Gitlab::CurrentSettings.snowplow_collector_hostname)
-      end
-
-      def enabled?
-        Gitlab::CurrentSettings.snowplow_enabled?
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/tracking.rb b/lib/gitlab/tracking.rb
new file mode 100644
index 00000000000..ef669b03c87
--- /dev/null
+++ b/lib/gitlab/tracking.rb
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'snowplow-tracker'
+
+module Gitlab
+  module Tracking
+    SNOWPLOW_NAMESPACE = 'gl'
+
+    class << self
+      def enabled?
+        Gitlab::CurrentSettings.snowplow_enabled?
+      end
+
+      def event(category, action, label: nil, property: nil, value: nil, context: nil)
+        return unless enabled?
+
+        snowplow.track_struct_event(category, action, label, property, value, context, Time.now.to_i)
+      end
+
+      def snowplow_options(group)
+        additional_features = Feature.enabled?(:additional_snowplow_tracking, group)
+        {
+          namespace: SNOWPLOW_NAMESPACE,
+          hostname: Gitlab::CurrentSettings.snowplow_collector_hostname,
+          cookie_domain: Gitlab::CurrentSettings.snowplow_cookie_domain,
+          app_id: Gitlab::CurrentSettings.snowplow_site_id,
+          page_tracking_enabled: additional_features,
+          activity_tracking_enabled: additional_features
+        }.transform_keys! { |key| key.to_s.camelize(:lower).to_sym }
+      end
+
+      private
+
+      def snowplow
+        @snowplow ||= SnowplowTracker::Tracker.new(
+          SnowplowTracker::Emitter.new(Gitlab::CurrentSettings.snowplow_collector_hostname),
+          SnowplowTracker::Subject.new,
+          SNOWPLOW_NAMESPACE,
+          Gitlab::CurrentSettings.snowplow_site_id
+        )
+      end
+    end
+  end
+end
diff --git a/spec/frontend/tracking_spec.js b/spec/frontend/tracking_spec.js
index 0e862c683d3..7c98a1a66c9 100644
--- a/spec/frontend/tracking_spec.js
+++ b/spec/frontend/tracking_spec.js
@@ -1,20 +1,56 @@
 import $ from 'jquery';
 import { setHTMLFixture } from './helpers/fixtures';
 
-import Tracking from '~/tracking';
+import Tracking, { initUserTracking } from '~/tracking';
 
 describe('Tracking', () => {
+  let snowplowSpy;
+
   beforeEach(() => {
     window.snowplow = window.snowplow || (() => {});
+    window.snowplowOptions = {
+      namespace: '_namespace_',
+      hostname: 'app.gitfoo.com',
+      cookieDomain: '.gitfoo.com',
+    };
+    snowplowSpy = jest.spyOn(window, 'snowplow');
   });
 
-  describe('.event', () => {
-    let snowplowSpy = null;
+  describe('initUserTracking', () => {
+    it('calls through to get a new tracker with the expected options', () => {
+      initUserTracking();
+      expect(snowplowSpy).toHaveBeenCalledWith('newTracker', '_namespace_', 'app.gitfoo.com', {
+        namespace: '_namespace_',
+        hostname: 'app.gitfoo.com',
+        cookieDomain: '.gitfoo.com',
+        appId: '',
+        userFingerprint: false,
+        respectDoNotTrack: true,
+        forceSecureTracker: true,
+        eventMethod: 'post',
+        contexts: { webPage: true },
+        activityTrackingEnabled: false,
+        pageTrackingEnabled: false,
+      });
+    });
 
-    beforeEach(() => {
-      snowplowSpy = jest.spyOn(window, 'snowplow');
+    it('should activate features based on what has been enabled', () => {
+      initUserTracking();
+      expect(snowplowSpy).not.toHaveBeenCalledWith('enableActivityTracking', 30, 30);
+      expect(snowplowSpy).not.toHaveBeenCalledWith('trackPageView');
+
+      window.snowplowOptions = Object.assign({}, window.snowplowOptions, {
+        activityTrackingEnabled: true,
+        pageTrackingEnabled: true,
+      });
+
+      initUserTracking();
+      expect(snowplowSpy).toHaveBeenCalledWith('enableActivityTracking', 30, 30);
+      expect(snowplowSpy).toHaveBeenCalledWith('trackPageView');
     });
+  });
 
+  describe('.event', () => {
     afterEach(() => {
       window.doNotTrack = undefined;
       navigator.doNotTrack = undefined;
diff --git a/spec/lib/gitlab/snowplow_tracker_spec.rb b/spec/lib/gitlab/snowplow_tracker_spec.rb
deleted file mode 100644
index 073a33e5973..00000000000
--- a/spec/lib/gitlab/snowplow_tracker_spec.rb
+++ /dev/null
@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-require 'spec_helper'
-
-describe Gitlab::SnowplowTracker do
-  let(:timestamp) { Time.utc(2017, 3, 22) }
-
-  around do |example|
-    Timecop.freeze(timestamp) { example.run }
-  end
-
-  subject { described_class.track_event('epics', 'action', property: 'what', value: 'doit') }
-
-  context '.track_event' do
-    context 'when Snowplow tracker is disabled' do
-      it 'does not track the event' do
-        expect(SnowplowTracker::Tracker).not_to receive(:new)
-
-        subject
-      end
-    end
-
-    context 'when Snowplow tracker is enabled' do
-      before do
-        stub_application_setting(snowplow_enabled: true)
-        stub_application_setting(snowplow_site_id: 'awesome gitlab')
-        stub_application_setting(snowplow_collector_hostname: 'url.com')
-      end
-
-      it 'tracks the event' do
-        tracker = double
-
-        expect(::SnowplowTracker::Tracker).to receive(:new)
-          .with(
-            an_instance_of(::SnowplowTracker::Emitter),
-            an_instance_of(::SnowplowTracker::Subject),
-            'cf', 'awesome gitlab'
-          ).and_return(tracker)
-        expect(tracker).to receive(:track_struct_event)
-          .with('epics', 'action', nil, 'what', 'doit', nil, timestamp.to_i)
-
-        subject
-      end
-    end
-  end
-end
diff --git a/spec/lib/gitlab/tracking_spec.rb b/spec/lib/gitlab/tracking_spec.rb
new file mode 100644
index 00000000000..f14e74427e1
--- /dev/null
+++ b/spec/lib/gitlab/tracking_spec.rb
@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+require 'spec_helper'
+
+describe Gitlab::Tracking do
+  let(:timestamp) { Time.utc(2017, 3, 22) }
+
+  before do
+    stub_application_setting(snowplow_enabled: true)
+    stub_application_setting(snowplow_collector_hostname: 'gitfoo.com')
+    stub_application_setting(snowplow_cookie_domain: '.gitfoo.com')
+    stub_application_setting(snowplow_site_id: '_abc123_')
+  end
+
+  describe '.snowplow_options' do
+    subject(&method(:described_class))
+
+    it 'returns useful client options' do
+      expect(subject.snowplow_options(nil)).to eq(
+        namespace: 'gl',
+        hostname: 'gitfoo.com',
+        cookieDomain: '.gitfoo.com',
+        appId: '_abc123_',
+        pageTrackingEnabled: true,
+        activityTrackingEnabled: true
+      )
+    end
+
+    it 'enables features using feature flags' do
+      stub_feature_flags(additional_snowplow_tracking: true)
+      allow(Feature).to receive(:enabled?).with(
+        :additional_snowplow_tracking,
+        '_group_'
+      ).and_return(false)
+
+      expect(subject.snowplow_options('_group_')).to include(
+        pageTrackingEnabled: false,
+        activityTrackingEnabled: false
+      )
+    end
+  end
+
+  describe '.event' do
+    subject(&method(:described_class))
+
+    around do |example|
+      Timecop.freeze(timestamp) { example.run }
+    end
+
+    it 'can track events' do
+      tracker = double
+
+      expect(SnowplowTracker::Emitter).to receive(:new).with(
+        'gitfoo.com'
+      ).and_return('_emitter_')
+
+      expect(SnowplowTracker::Tracker).to receive(:new).with(
+        '_emitter_',
+        an_instance_of(SnowplowTracker::Subject),
+        'gl',
+        '_abc123_'
+      ).and_return(tracker)
+
+      expect(tracker).to receive(:track_struct_event).with(
+        'category',
+        'action',
+        '_label_',
+        '_property_',
+        '_value_',
+        '_context_',
+        timestamp.to_i
+      )
+
+      subject.event('category', 'action',
+        label: '_label_',
+        property: '_property_',
+        value: '_value_',
+        context: '_context_'
+      )
+    end
+
+    it 'does not track when not enabled' do
+      stub_application_setting(snowplow_enabled: false)
+      expect(SnowplowTracker::Tracker).not_to receive(:new)
+
+      subject.event('epics', 'action', property: 'what', value: 'doit')
+    end
+  end
+end
-- 
cgit v1.2.1


From a06410d995e1200c7734b2d50e68506320d13dd0 Mon Sep 17 00:00:00 2001
From: Aishwarya Subramanian <asubramanian@gitlab.com>
Date: Mon, 26 Aug 2019 18:20:18 +0000
Subject: Using before_save method instead of setter

Removed unused method for name setter method
---
 app/models/user.rb                                   | 12 +++++++++++-
 changelogs/unreleased/user_name_migration.yml        |  5 +++++
 .../20190820163320_add_first_last_name_to_user.rb    | 14 ++++++++++++++
 db/schema.rb                                         |  4 +++-
 spec/models/user_spec.rb                             | 20 ++++++++++++++++++++
 5 files changed, 53 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/user_name_migration.yml
 create mode 100644 db/migrate/20190820163320_add_first_last_name_to_user.rb

diff --git a/app/models/user.rb b/app/models/user.rb
index 6131a8dc710..6107aaa7fca 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -161,6 +161,8 @@ class User < ApplicationRecord
   #
   # Note: devise :validatable above adds validations for :email and :password
   validates :name, presence: true, length: { maximum: 128 }
+  validates :first_name, length: { maximum: 255 }
+  validates :last_name, length: { maximum: 255 }
   validates :email, confirmation: true
   validates :notification_email, presence: true
   validates :notification_email, devise_email: true, if: ->(user) { user.notification_email != user.email }
@@ -881,7 +883,15 @@ class User < ApplicationRecord
   end
 
   def first_name
-    name.split.first unless name.blank?
+    read_attribute(:first_name) || begin
+      name.split(' ').first unless name.blank?
+    end
+  end
+
+  def last_name
+    read_attribute(:last_name) || begin
+      name.split(' ').drop(1).join(' ') unless name.blank?
+    end
   end
 
   def projects_limit_left
diff --git a/changelogs/unreleased/user_name_migration.yml b/changelogs/unreleased/user_name_migration.yml
new file mode 100644
index 00000000000..11d6ff2e8b2
--- /dev/null
+++ b/changelogs/unreleased/user_name_migration.yml
@@ -0,0 +1,5 @@
+---
+title: Add First and Last name columns to User model
+merge_request: 31985
+author:
+type: added
diff --git a/db/migrate/20190820163320_add_first_last_name_to_user.rb b/db/migrate/20190820163320_add_first_last_name_to_user.rb
new file mode 100644
index 00000000000..0ea465fc2e2
--- /dev/null
+++ b/db/migrate/20190820163320_add_first_last_name_to_user.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class AddFirstLastNameToUser < ActiveRecord::Migration[5.2]
+  # Set this constant to true if this migration requires downtime.
+  DOWNTIME = false
+
+  def change
+    add_column(:users, :first_name, :string, null: true, limit: 255)
+    add_column(:users, :last_name, :string, null: true, limit: 255)
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 944d23e5365..36bf2371994 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2019_08_15_093949) do
+ActiveRecord::Schema.define(version: 2019_08_20_163320) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "pg_trgm"
@@ -3511,6 +3511,8 @@ ActiveRecord::Schema.define(version: 2019_08_15_093949) do
     t.text "note"
     t.integer "roadmap_layout", limit: 2
     t.integer "bot_type", limit: 2
+    t.string "first_name", limit: 255
+    t.string "last_name", limit: 255
     t.index ["accepted_term_id"], name: "index_users_on_accepted_term_id"
     t.index ["admin"], name: "index_users_on_admin"
     t.index ["bot_type"], name: "index_users_on_bot_type"
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 46b86e8393d..8338d2b5b39 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -103,6 +103,14 @@ describe User do
       it { is_expected.to validate_length_of(:name).is_at_most(128) }
     end
 
+    describe 'first name' do
+      it { is_expected.to validate_length_of(:first_name).is_at_most(255) }
+    end
+
+    describe 'last name' do
+      it { is_expected.to validate_length_of(:last_name).is_at_most(255) }
+    end
+
     describe 'username' do
       it 'validates presence' do
         expect(subject).to validate_presence_of(:username)
@@ -678,6 +686,18 @@ describe User do
     end
   end
 
+  describe 'name getters' do
+    let(:user) { create(:user, name: 'Kane Martin William') }
+
+    it 'derives first name from full name, if not present' do
+      expect(user.first_name).to eq('Kane')
+    end
+
+    it 'derives last name from full name, if not present' do
+      expect(user.last_name).to eq('Martin William')
+    end
+  end
+
   describe '#highest_role' do
     let(:user) { create(:user) }
 
-- 
cgit v1.2.1


From d76375b971f922b1da4f4dc9064245a27595cd9d Mon Sep 17 00:00:00 2001
From: Miguel Rincon <mrincon@gitlab.com>
Date: Mon, 26 Aug 2019 18:40:38 +0000
Subject: Add Documentation for `line-chart`

---
 doc/user/project/integrations/prometheus.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/user/project/integrations/prometheus.md b/doc/user/project/integrations/prometheus.md
index 9fc0ade809e..a80332adc46 100644
--- a/doc/user/project/integrations/prometheus.md
+++ b/doc/user/project/integrations/prometheus.md
@@ -194,7 +194,7 @@ The following tables outline the details of expected properties.
 
 | Property | Type | Required | Description |
 | ------ | ------ | ------ | ------- |
-| `type` | enum | no, defaults to `area-chart` | Specifies the chart type to use. |
+| `type` | enum | no, defaults to `area-chart` | Specifies the chart type to use, can be `area-chart` or `line-chart` |
 | `title` | string | yes | Heading for the panel. |
 | `y_label` | string | no, but highly encouraged | Y-Axis label for the panel. |
 | `weight` | number | no, defaults to order in file | Order to appear within the grouping. Lower number means higher priority, which will be higher on the page. Numbers do not need to be consecutive. |
-- 
cgit v1.2.1


From 826db5cf32913a5d43e13432e1aaab2284d9d79e Mon Sep 17 00:00:00 2001
From: Ben Bodenmiller <bbodenmiller@hotmail.com>
Date: Mon, 26 Aug 2019 18:53:25 +0000
Subject: Improve Gitaly path details

related to https://gitlab.com/gitlab-org/gitlab-ce/issues/65422
---
 doc/administration/gitaly/index.md | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/doc/administration/gitaly/index.md b/doc/administration/gitaly/index.md
index e0a06e71316..dd3cc796ef2 100644
--- a/doc/administration/gitaly/index.md
+++ b/doc/administration/gitaly/index.md
@@ -139,7 +139,7 @@ Git operations in GitLab will result in an API error.
 
 NOTE: **Note:**
 In most or all cases, the storage paths below end in `/repositories` which is
-not that case with `path` in `git_data_dirs` of Omnibus GitLab installations.
+not the case with `path` in `git_data_dirs` of Omnibus GitLab installations.
 Check the directory layout on your Gitaly server to be sure.
 
 **For Omnibus GitLab**
@@ -283,10 +283,6 @@ can read and write to `/mnt/gitlab/storage2`.
    gitlab_rails['gitaly_token'] = 'abc123secret'
    ```
 
-   NOTE: **Note:**
-   In some cases, you'll have to set `path` for each `git_data_dirs` in the
-   format `'path' => '/mnt/gitlab/<storage name>'`.
-
 1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
 1. Tail the logs to see the requests:
 
@@ -304,18 +300,22 @@ can read and write to `/mnt/gitlab/storage2`.
        storages:
          default:
            gitaly_address: tcp://gitaly1.internal:8075
+           path: /some/dummy/path
          storage1:
            gitaly_address: tcp://gitaly1.internal:8075
+           path: /some/dummy/path
          storage2:
            gitaly_address: tcp://gitaly2.internal:8075
+           path: /some/dummy/path
 
      gitaly:
        token: 'abc123secret'
    ```
 
    NOTE: **Note:**
-   In some cases, you'll have to set `path` for each of the `storages` in the
-   format `path: /mnt/gitlab/<storage name>/repositories`.
+   `/some/dummy/path` should be set to a local folder that exists, however no
+   data will be stored in this folder. This will no longer be necessary after
+   [this issue](https://gitlab.com/gitlab-org/gitaly/issues/1282) is resolved.
 
 1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
 1. Tail the logs to see the requests:
@@ -416,18 +416,22 @@ To configure Gitaly with TLS:
        storages:
          default:
            gitaly_address: tls://gitaly1.internal:9999
+           path: /some/dummy/path
          storage1:
            gitaly_address: tls://gitaly1.internal:9999
+           path: /some/dummy/path
          storage2:
            gitaly_address: tls://gitaly2.internal:9999
+           path: /some/dummy/path
 
      gitaly:
        token: 'abc123secret'
    ```
 
    NOTE: **Note:**
-   In some cases, you'll have to set `path` for each of the `storages` in the
-   format `path: /mnt/gitlab/<storage name>/repositories`.
+   `/some/dummy/path` should be set to a local folder that exists, however no
+   data will be stored in this folder. This will no longer be necessary after
+   [this issue](https://gitlab.com/gitlab-org/gitaly/issues/1282) is resolved.
 
 1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
 1. On the Gitaly server nodes, edit `/home/git/gitaly/config.toml`:
-- 
cgit v1.2.1


From 317586379ab1afc9e6505b61d4d364caf7a48db8 Mon Sep 17 00:00:00 2001
From: Seth Berger <4310743-sethgitlab@users.noreply.gitlab.com>
Date: Mon, 26 Aug 2019 19:31:06 +0000
Subject: Updated container scanning

Updated container scanning docs with a sample config
---
 .../container_scanning/index.md                    | 32 +++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/doc/user/application_security/container_scanning/index.md b/doc/user/application_security/container_scanning/index.md
index 86491c7d74e..7b631a5a1cd 100644
--- a/doc/user/application_security/container_scanning/index.md
+++ b/doc/user/application_security/container_scanning/index.md
@@ -94,6 +94,36 @@ If you want to whitelist some specific vulnerabilities, you can do so by definin
 them in a YAML file named `clair-whitelist.yml`. Read more in the
 [Clair documentation](https://github.com/arminc/clair-scanner/blob/master/README.md#example-whitelist-yaml-file).
 
+## Example
+
+The following is a sample `.gitlab-ci.yml` that will build your Docker Image, push it to the container registry and run Container Scanning. 
+
+```yaml
+variables:
+  DOCKER_DRIVER: overlay2
+
+services:
+  - docker:stable-dind
+
+stages:
+  - build
+  - test
+
+include:
+  - template: Container-Scanning.gitlab-ci.yml
+
+build:
+  image: docker:stable
+  stage: build
+  variables:
+    IMAGE: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA
+  script:
+    - docker info
+    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
+    - docker build -t $IMAGE .
+    - docker push $IMAGE
+```
+
 ## Security Dashboard
 
 The Security Dashboard is a good place to get an overview of all the security
@@ -125,4 +155,4 @@ docker: Error response from daemon: failed to copy xattrs: failed to set xattr "
 This is a result of a bug in Docker which is now [fixed](https://github.com/containerd/continuity/pull/138 "fs: add WithAllowXAttrErrors CopyOpt").
 To prevent the error, ensure the Docker version that the Runner is using is
 `18.09.03` or higher. For more information, see
-[issue #10241](https://gitlab.com/gitlab-org/gitlab-ee/issues/10241 "Investigate why Container Scanning is not working with NFS mounts").
+[issue #10241](https://gitlab.com/gitlab-org/gitlab-ee/issues/10241 "Investigate why Container Scanning is not working with NFS mounts").
\ No newline at end of file
-- 
cgit v1.2.1


From 9cbed1086b0ed078f931626fee33552b60261284 Mon Sep 17 00:00:00 2001
From: Bill Bagdon <wbagdon@gmail.com>
Date: Mon, 26 Aug 2019 19:54:37 +0000
Subject: ci_builds also has encrypted tokens

These need to be reset
---
 doc/raketasks/backup_restore.md | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/doc/raketasks/backup_restore.md b/doc/raketasks/backup_restore.md
index b4b7d711d5a..19486052dd9 100644
--- a/doc/raketasks/backup_restore.md
+++ b/doc/raketasks/backup_restore.md
@@ -923,6 +923,29 @@ backup beforehand.
    UPDATE ci_runners SET token = null, token_encrypted = null;
    ```
 
+#### Reset pending pipeline jobs
+
+1. Enter the DB console:
+
+   For Omnibus GitLab packages:
+
+   ```sh
+   sudo gitlab-rails dbconsole
+   ```
+
+   For installations from source:
+
+   ```sh
+   sudo -u git -H bundle exec rails dbconsole RAILS_ENV=production
+   ```
+
+1. Clear all the tokens for pending jobs:
+
+   ```sql
+   -- Clear build tokens
+   UPDATE ci_builds SET token = null, token_encrypted = null;
+   ```
+
 A similar strategy can be employed for the remaining features - by removing the
 data that cannot be decrypted, GitLab can be brought back into working order,
 and the lost data can be manually replaced.
-- 
cgit v1.2.1


From 6a85824170eea05baf2a08eeeb2a7b159146e655 Mon Sep 17 00:00:00 2001
From: Fabien Catteau <fcatteau@gitlab.com>
Date: Mon, 26 Aug 2019 19:58:02 +0000
Subject: License Compliance defaults to Python 3

License Compliance now uses Python 3 by default.

See https://gitlab.com/gitlab-org/gitlab-ee/issues/12032
---
 doc/user/application_security/license_management/index.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/user/application_security/license_management/index.md b/doc/user/application_security/license_management/index.md
index 912f2f0e209..44b2671930e 100644
--- a/doc/user/application_security/license_management/index.md
+++ b/doc/user/application_security/license_management/index.md
@@ -169,9 +169,9 @@ If you still need to run tests during `mvn install`, add `-DskipTests=false` to
 
 > [Introduced](https://gitlab.com/gitlab-org/security-products/license-management/merge_requests/36) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.0.
 
-License Compliance uses Python 2.7 and pip 10.0 by default.
-If your project requires Python 3, you can switch to Python 3.5 and pip 19.1
-by setting the `LM_PYTHON_VERSION` environment variable to `3`.
+License Compliance uses Python 3.5 and pip 19.1 by default.
+If your project requires Python 2, you can switch to Python 2.7 and pip 10.0
+by setting the `LM_PYTHON_VERSION` environment variable to `2`.
 
 ```yaml
 include:
@@ -179,7 +179,7 @@ include:
 
 license_management:
   variables:
-    LM_PYTHON_VERSION: 3
+    LM_PYTHON_VERSION: 2
 ```
 
 ## Project policies for License Compliance
-- 
cgit v1.2.1


From d642c60df9d84d4053b5c1ce9381558e5ff2698a Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Mon, 26 Aug 2019 20:17:51 +0000
Subject: Add backticks and remove square brackets

Square and Angle bracket use causes kramdown warnings,
so changed or enclosed in backticks as needed
---
 doc/administration/issue_closing_pattern.md        |  17 +-
 .../monitoring/prometheus/gitlab_metrics.md        | 326 ++++++++++-----------
 doc/api/projects.md                                |   8 +-
 3 files changed, 170 insertions(+), 181 deletions(-)

diff --git a/doc/administration/issue_closing_pattern.md b/doc/administration/issue_closing_pattern.md
index 66ab3ef8d81..f9be06c6daf 100644
--- a/doc/administration/issue_closing_pattern.md
+++ b/doc/administration/issue_closing_pattern.md
@@ -1,8 +1,8 @@
 # Issue closing pattern **(CORE ONLY)**
 
 >**Note:**
-This is the administration documentation.
-There is a separate [user documentation] on issue closing pattern.
+This is the administration documentation. There is a separate [user documentation](../user/project/issues/managing_issues.md#closing-issues-automatically)
+on issue closing pattern.
 
 When a commit or merge request resolves one or more issues, it is possible to
 automatically have these issues closed when the commit or merge request lands
@@ -13,8 +13,8 @@ in the project's default branch.
 In order to change the pattern you need to have access to the server that GitLab
 is installed on.
 
-The default pattern can be located in [`gitlab.yml.example`] under the
-"Automatic issue closing" section.
+The default pattern can be located in [`gitlab.yml.example`](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/config/gitlab.yml.example)
+under the "Automatic issue closing" section.
 
 > **Tip:**
 You are advised to use <http://rubular.com> to test the issue closing pattern.
@@ -31,7 +31,7 @@ Because Rubular doesn't understand `%{issue_ref}`, you can replace this by
    gitlab_rails['gitlab_issue_closing_pattern'] = "\b((?:[Cc]los(?:e[sd]|ing)|\b[Ff]ix(?:e[sd]|ing)?) +(?:(?:issues? +)?%{issue_ref}(?:(?:, *| +and +)?))+)"
    ```
 
-1. [Reconfigure] GitLab for the changes to take effect.
+1. [Reconfigure](restart_gitlab.md#omnibus-gitlab-reconfigure) GitLab for the changes to take effect.
 
 **For installations from source**
 
@@ -42,9 +42,4 @@ Because Rubular doesn't understand `%{issue_ref}`, you can replace this by
    issue_closing_pattern: "\b((?:[Cc]los(?:e[sd]|ing)|\b[Ff]ix(?:e[sd]|ing)?) +(?:(?:issues? +)?%{issue_ref}(?:(?:, *| +and +)?))+)"
    ```
 
-1. [Restart] GitLab for the changes to take effect.
-
-[gitlab.yml.example]: https://gitlab.com/gitlab-org/gitlab-ce/blob/master/config/gitlab.yml.example
-[reconfigure]: restart_gitlab.md#omnibus-gitlab-reconfigure
-[restart]: restart_gitlab.md#installations-from-source
-[user documentation]: ../user/project/issues/managing_issues.md#closing-issues-automatically
+1. [Restart](restart_gitlab.md#installations-from-source) GitLab for the changes to take effect.
diff --git a/doc/administration/monitoring/prometheus/gitlab_metrics.md b/doc/administration/monitoring/prometheus/gitlab_metrics.md
index 0605fb76e2f..4809bee0df6 100644
--- a/doc/administration/monitoring/prometheus/gitlab_metrics.md
+++ b/doc/administration/monitoring/prometheus/gitlab_metrics.md
@@ -1,7 +1,7 @@
 # GitLab Prometheus metrics
 
 >**Note:**
-Available since [Omnibus GitLab 9.3][29118]. For
+Available since [Omnibus GitLab 9.3](https://gitlab.com/gitlab-org/gitlab-ce/issues/29118). For
 installations from source you'll have to configure it yourself.
 
 To enable the GitLab Prometheus metrics:
@@ -9,13 +9,13 @@ To enable the GitLab Prometheus metrics:
 1. Log into GitLab as an administrator, and go to the Admin area.
 1. Click on the gear, then click on Settings.
 1. Find the `Metrics - Prometheus` section, and click `Enable Prometheus Metrics`
-1. [Restart GitLab][restart] for the changes to take effect
+1. [Restart GitLab](../../restart_gitlab.md#omnibus-gitlab-restart) for the changes to take effect
 
 ## Collecting the metrics
 
 GitLab monitors its own internal service metrics, and makes them available at the
-`/-/metrics` endpoint. Unlike other [Prometheus] exporters, in order to access
-it, the client IP needs to be [included in a whitelist][whitelist].
+`/-/metrics` endpoint. Unlike other [Prometheus](https://prometheus.io) exporters, in order to access
+it, the client IP needs to be [included in a whitelist](../ip_whitelist.md).
 
 For Omnibus and Chart installations, these metrics are automatically enabled and collected as of [GitLab 9.4](https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests/1702). For source installations or earlier versions, these metrics will need to be enabled manually and collected by a Prometheus server.
 
@@ -23,159 +23,159 @@ For Omnibus and Chart installations, these metrics are automatically enabled and
 
 The following metrics are available:
 
-| Metric                                                       | Type      |                  Since | Description                                                                                         | Labels                                              |
-|:-------------------------------------------------------------|:----------|-----------------------:|:----------------------------------------------------------------------------------------------------|:----------------------------------------------------|
-| gitlab_banzai_cached_render_real_duration_seconds            | Histogram |                    9.4 | Duration of rendering markdown into HTML when cached output exists                                  | controller, action                                  |
-| gitlab_banzai_cacheless_render_real_duration_seconds         | Histogram |                    9.4 | Duration of rendering markdown into HTML when cached outupt does not exist                          | controller, action                                  |
-| gitlab_cache_misses_total                                    | Counter   |                   10.2 | Cache read miss                                                                                     | controller, action                                  |
-| gitlab_cache_operation_duration_seconds                      | Histogram |                   10.2 | Cache access time                                                                                   |                                                     |
-| gitlab_cache_operations_total                                | Counter   |                   12.2 | Cache operations by controller/action                                                               | controller, action, operation                       |
-| gitlab_database_transaction_seconds                          | Histogram |                   12.1 | Time spent in database transactions, in seconds                                                     |                                                     |
-| gitlab_method_call_duration_seconds                          | Histogram |                   10.2 | Method calls real duration                                                                          | controller, action, module, method                  |
-| gitlab_rails_queue_duration_seconds                          | Histogram |                    9.4 | Measures latency between gitlab-workhorse forwarding a request to Rails                             |                                                     |
-| gitlab_sql_duration_seconds                                  | Histogram |                   10.2 | SQL execution time, excluding SCHEMA operations and BEGIN / COMMIT                                  |                                                     |
-| gitlab_transaction_allocated_memory_bytes                    | Histogram |                   10.2 | Allocated memory for all transactions (gitlab_transaction_* metrics)                                |                                                     |
-| gitlab_transaction_cache_<key>_count_total                   | Counter   |                   10.2 | Counter for total Rails cache calls (per key)                                                       |                                                     |
-| gitlab_transaction_cache_<key>_duration_total                | Counter   |                   10.2 | Counter for total time (seconds) spent in Rails cache calls (per key)                               |                                                     |
-| gitlab_transaction_cache_count_total                         | Counter   |                   10.2 | Counter for total Rails cache calls (aggregate)                                                     |                                                     |
-| gitlab_transaction_cache_duration_total                      | Counter   |                   10.2 | Counter for total time (seconds) spent in Rails cache calls (aggregate)                             |                                                     |
-| gitlab_transaction_cache_read_hit_count_total                | Counter   |                   10.2 | Counter for cache hits for Rails cache calls                                                        | controller, action                                  |
-| gitlab_transaction_cache_read_miss_count_total               | Counter   |                   10.2 | Counter for cache misses for Rails cache calls                                                      | controller, action                                  |
-| gitlab_transaction_duration_seconds                          | Histogram |                   10.2 | Duration for all transactions (gitlab_transaction_* metrics)                                        | controller, action                                  |
-| gitlab_transaction_event_build_found_total                   | Counter   |                    9.4 | Counter for build found for api /jobs/request                                                       |                                                     |
-| gitlab_transaction_event_build_invalid_total                 | Counter   |                    9.4 | Counter for build invalid due to concurrency conflict for api /jobs/request                         |                                                     |
-| gitlab_transaction_event_build_not_found_cached_total        | Counter   |                    9.4 | Counter for cached response of build not found for api /jobs/request                                |                                                     |
-| gitlab_transaction_event_build_not_found_total               | Counter   |                    9.4 | Counter for build not found for api /jobs/request                                                   |                                                     |
-| gitlab_transaction_event_change_default_branch_total         | Counter   |                    9.4 | Counter when default branch is changed for any repository                                           |                                                     |
-| gitlab_transaction_event_create_repository_total             | Counter   |                    9.4 | Counter when any repository is created                                                              |                                                     |
-| gitlab_transaction_event_etag_caching_cache_hit_total        | Counter   |                    9.4 | Counter for etag cache hit.                                                                         | endpoint                                            |
-| gitlab_transaction_event_etag_caching_header_missing_total   | Counter   |                    9.4 | Counter for etag cache miss - header missing                                                        | endpoint                                            |
-| gitlab_transaction_event_etag_caching_key_not_found_total    | Counter   |                    9.4 | Counter for etag cache miss - key not found                                                         | endpoint                                            |
-| gitlab_transaction_event_etag_caching_middleware_used_total  | Counter   |                    9.4 | Counter for etag middleware accessed                                                                | endpoint                                            |
-| gitlab_transaction_event_etag_caching_resource_changed_total | Counter   |                    9.4 | Counter for etag cache miss - resource changed                                                      | endpoint                                            |
-| gitlab_transaction_event_fork_repository_total               | Counter   |                    9.4 | Counter for repository forks (RepositoryForkWorker). Only incremented when source repository exists |                                                     |
-| gitlab_transaction_event_import_repository_total             | Counter   |                    9.4 | Counter for repository imports (RepositoryImportWorker)                                             |                                                     |
-| gitlab_transaction_event_push_branch_total                   | Counter   |                    9.4 | Counter for all branch pushes                                                                       |                                                     |
-| gitlab_transaction_event_push_commit_total                   | Counter   |                    9.4 | Counter for commits                                                                                 | branch                                              |
-| gitlab_transaction_event_push_tag_total                      | Counter   |                    9.4 | Counter for tag pushes                                                                              |                                                     |
-| gitlab_transaction_event_rails_exception_total               | Counter   |                    9.4 | Counter for number of rails exceptions                                                              |                                                     |
-| gitlab_transaction_event_receive_email_total                 | Counter   |                    9.4 | Counter for recieved emails                                                                         | handler                                             |
-| gitlab_transaction_event_remote_mirrors_failed_total         | Counter   |                   10.8 | Counter for failed remote mirrors                                                                   |                                                     |
-| gitlab_transaction_event_remote_mirrors_finished_total       | Counter   |                   10.8 | Counter for finished remote mirrors                                                                 |                                                     |
-| gitlab_transaction_event_remote_mirrors_running_total        | Counter   |                   10.8 | Counter for running remote mirrors                                                                  |                                                     |
-| gitlab_transaction_event_remove_branch_total                 | Counter   |                    9.4 | Counter when a branch is removed for any repository                                                 |                                                     |
-| gitlab_transaction_event_remove_repository_total             | Counter   |                    9.4 | Counter when a repository is removed                                                                |                                                     |
-| gitlab_transaction_event_remove_tag_total                    | Counter   |                    9.4 | Counter when a tag is remove for any repository                                                     |                                                     |
-| gitlab_transaction_event_sidekiq_exception_total             | Counter   |                    9.4 | Counter of sidekiq exceptions                                                                       |                                                     |
-| gitlab_transaction_event_stuck_import_jobs_total             | Counter   |                    9.4 | Count of stuck import jobs                                                                          | projects_without_jid_count, projects_with_jid_count |
-| gitlab_transaction_event_update_build_total                  | Counter   |                    9.4 | Counter for update build for api /jobs/request/:id                                                  |                                                     |
-| gitlab_transaction_new_redis_connections_total               | Counter   |                    9.4 | Counter for new redis connections                                                                   |                                                     |
-| gitlab_transaction_queue_duration_total                      | Counter   |                    9.4 | Duration jobs were enqueued before processing                                                       |                                                     |
-| gitlab_transaction_rails_queue_duration_total                | Counter   |                    9.4 | Measures latency between gitlab-workhorse forwarding a request to Rails                             | controller, action                                  |
-| gitlab_transaction_view_duration_total                       | Counter   |                    9.4 | Duration for views                                                                                  | controller, action, view                            |
-| gitlab_view_rendering_duration_seconds                       | Histogram |                   10.2 | Duration for views (histogram)                                                                      | controller, action, view                            |
-| http_requests_total                                          | Counter   |                    9.4 | Rack request count                                                                                  | method                                              |
-| http_request_duration_seconds                                | Histogram |                    9.4 | HTTP response time from rack middleware                                                             | method, status                                      |
-| pipelines_created_total                                      | Counter   |                    9.4 | Counter of pipelines created                                                                        |                                                     |
-| rack_uncaught_errors_total                                   | Counter   |                    9.4 | Rack connections handling uncaught errors count                                                     |                                                     |
-| user_session_logins_total                                    | Counter   |                    9.4 | Counter of how many users have logged in                                                            |                                                     |
-| upload_file_does_not_exist                                   | Counter   | 10.7 in EE, 11.5 in CE | Number of times an upload record could not find its file                                            |                                                     |
-| failed_login_captcha_total                                   | Gauge     |                   11.0 | Counter of failed CAPTCHA attempts during login                                                     |                                                     |
-| successful_login_captcha_total                               | Gauge     |                   11.0 | Counter of successful CAPTCHA attempts during login                                                 |                                                     |
+| Metric                                                         | Type      |                  Since | Description                                                                                         | Labels                                              |
+|:---------------------------------------------------------------|:----------|-----------------------:|:----------------------------------------------------------------------------------------------------|:----------------------------------------------------|
+| `gitlab_banzai_cached_render_real_duration_seconds`            | Histogram |                    9.4 | Duration of rendering markdown into HTML when cached output exists                                  | controller, action                                  |
+| `gitlab_banzai_cacheless_render_real_duration_seconds`         | Histogram |                    9.4 | Duration of rendering markdown into HTML when cached outupt does not exist                          | controller, action                                  |
+| `gitlab_cache_misses_total`                                    | Counter   |                   10.2 | Cache read miss                                                                                     | controller, action                                  |
+| `gitlab_cache_operation_duration_seconds`                      | Histogram |                   10.2 | Cache access time                                                                                   |                                                     |
+| `gitlab_cache_operations_total`                                | Counter   |                   12.2 | Cache operations by controller/action                                                               | controller, action, operation                       |
+| `gitlab_database_transaction_seconds`                          | Histogram |                   12.1 | Time spent in database transactions, in seconds                                                     |                                                     |
+| `gitlab_method_call_duration_seconds`                          | Histogram |                   10.2 | Method calls real duration                                                                          | controller, action, module, method                  |
+| `gitlab_rails_queue_duration_seconds`                          | Histogram |                    9.4 | Measures latency between GitLab Workhorse forwarding a request to Rails                             |                                                     |
+| `gitlab_sql_duration_seconds`                                  | Histogram |                   10.2 | SQL execution time, excluding SCHEMA operations and BEGIN / COMMIT                                  |                                                     |
+| `gitlab_transaction_allocated_memory_bytes`                    | Histogram |                   10.2 | Allocated memory for all transactions (gitlab_transaction_* metrics)                                |                                                     |
+| `gitlab_transaction_cache_<key>_count_total`                   | Counter   |                   10.2 | Counter for total Rails cache calls (per key)                                                       |                                                     |
+| `gitlab_transaction_cache_<key>_duration_total`                | Counter   |                   10.2 | Counter for total time (seconds) spent in Rails cache calls (per key)                               |                                                     |
+| `gitlab_transaction_cache_count_total`                         | Counter   |                   10.2 | Counter for total Rails cache calls (aggregate)                                                     |                                                     |
+| `gitlab_transaction_cache_duration_total`                      | Counter   |                   10.2 | Counter for total time (seconds) spent in Rails cache calls (aggregate)                             |                                                     |
+| `gitlab_transaction_cache_read_hit_count_total`                | Counter   |                   10.2 | Counter for cache hits for Rails cache calls                                                        | controller, action                                  |
+| `gitlab_transaction_cache_read_miss_count_total`               | Counter   |                   10.2 | Counter for cache misses for Rails cache calls                                                      | controller, action                                  |
+| `gitlab_transaction_duration_seconds`                          | Histogram |                   10.2 | Duration for all transactions (gitlab_transaction_* metrics)                                        | controller, action                                  |
+| `gitlab_transaction_event_build_found_total`                   | Counter   |                    9.4 | Counter for build found for api /jobs/request                                                       |                                                     |
+| `gitlab_transaction_event_build_invalid_total`                 | Counter   |                    9.4 | Counter for build invalid due to concurrency conflict for api /jobs/request                         |                                                     |
+| `gitlab_transaction_event_build_not_found_cached_total`        | Counter   |                    9.4 | Counter for cached response of build not found for api /jobs/request                                |                                                     |
+| `gitlab_transaction_event_build_not_found_total`               | Counter   |                    9.4 | Counter for build not found for api /jobs/request                                                   |                                                     |
+| `gitlab_transaction_event_change_default_branch_total`         | Counter   |                    9.4 | Counter when default branch is changed for any repository                                           |                                                     |
+| `gitlab_transaction_event_create_repository_total`             | Counter   |                    9.4 | Counter when any repository is created                                                              |                                                     |
+| `gitlab_transaction_event_etag_caching_cache_hit_total`        | Counter   |                    9.4 | Counter for etag cache hit.                                                                         | endpoint                                            |
+| `gitlab_transaction_event_etag_caching_header_missing_total`   | Counter   |                    9.4 | Counter for etag cache miss - header missing                                                        | endpoint                                            |
+| `gitlab_transaction_event_etag_caching_key_not_found_total`    | Counter   |                    9.4 | Counter for etag cache miss - key not found                                                         | endpoint                                            |
+| `gitlab_transaction_event_etag_caching_middleware_used_total`  | Counter   |                    9.4 | Counter for etag middleware accessed                                                                | endpoint                                            |
+| `gitlab_transaction_event_etag_caching_resource_changed_total` | Counter   |                    9.4 | Counter for etag cache miss - resource changed                                                      | endpoint                                            |
+| `gitlab_transaction_event_fork_repository_total`               | Counter   |                    9.4 | Counter for repository forks (RepositoryForkWorker). Only incremented when source repository exists |                                                     |
+| `gitlab_transaction_event_import_repository_total`             | Counter   |                    9.4 | Counter for repository imports (RepositoryImportWorker)                                             |                                                     |
+| `gitlab_transaction_event_push_branch_total`                   | Counter   |                    9.4 | Counter for all branch pushes                                                                       |                                                     |
+| `gitlab_transaction_event_push_commit_total`                   | Counter   |                    9.4 | Counter for commits                                                                                 | branch                                              |
+| `gitlab_transaction_event_push_tag_total`                      | Counter   |                    9.4 | Counter for tag pushes                                                                              |                                                     |
+| `gitlab_transaction_event_rails_exception_total`               | Counter   |                    9.4 | Counter for number of rails exceptions                                                              |                                                     |
+| `gitlab_transaction_event_receive_email_total`                 | Counter   |                    9.4 | Counter for recieved emails                                                                         | handler                                             |
+| `gitlab_transaction_event_remote_mirrors_failed_total`         | Counter   |                   10.8 | Counter for failed remote mirrors                                                                   |                                                     |
+| `gitlab_transaction_event_remote_mirrors_finished_total`       | Counter   |                   10.8 | Counter for finished remote mirrors                                                                 |                                                     |
+| `gitlab_transaction_event_remote_mirrors_running_total`        | Counter   |                   10.8 | Counter for running remote mirrors                                                                  |                                                     |
+| `gitlab_transaction_event_remove_branch_total`                 | Counter   |                    9.4 | Counter when a branch is removed for any repository                                                 |                                                     |
+| `gitlab_transaction_event_remove_repository_total`             | Counter   |                    9.4 | Counter when a repository is removed                                                                |                                                     |
+| `gitlab_transaction_event_remove_tag_total`                    | Counter   |                    9.4 | Counter when a tag is remove for any repository                                                     |                                                     |
+| `gitlab_transaction_event_sidekiq_exception_total`             | Counter   |                    9.4 | Counter of sidekiq exceptions                                                                       |                                                     |
+| `gitlab_transaction_event_stuck_import_jobs_total`             | Counter   |                    9.4 | Count of stuck import jobs                                                                          | projects_without_jid_count, projects_with_jid_count |
+| `gitlab_transaction_event_update_build_total`                  | Counter   |                    9.4 | Counter for update build for api /jobs/request/:id                                                  |                                                     |
+| `gitlab_transaction_new_redis_connections_total`               | Counter   |                    9.4 | Counter for new redis connections                                                                   |                                                     |
+| `gitlab_transaction_queue_duration_total`                      | Counter   |                    9.4 | Duration jobs were enqueued before processing                                                       |                                                     |
+| `gitlab_transaction_rails_queue_duration_total`                | Counter   |                    9.4 | Measures latency between GitLab Workhorse forwarding a request to Rails                             | controller, action                                  |
+| `gitlab_transaction_view_duration_total`                       | Counter   |                    9.4 | Duration for views                                                                                  | controller, action, view                            |
+| `gitlab_view_rendering_duration_seconds`                       | Histogram |                   10.2 | Duration for views (histogram)                                                                      | controller, action, view                            |
+| `http_requests_total`                                          | Counter   |                    9.4 | Rack request count                                                                                  | method                                              |
+| `http_request_duration_seconds`                                | Histogram |                    9.4 | HTTP response time from rack middleware                                                             | method, status                                      |
+| `pipelines_created_total`                                      | Counter   |                    9.4 | Counter of pipelines created                                                                        |                                                     |
+| `rack_uncaught_errors_total`                                   | Counter   |                    9.4 | Rack connections handling uncaught errors count                                                     |                                                     |
+| `user_session_logins_total`                                    | Counter   |                    9.4 | Counter of how many users have logged in                                                            |                                                     |
+| `upload_file_does_not_exist`                                   | Counter   | 10.7 in EE, 11.5 in CE | Number of times an upload record could not find its file                                            |                                                     |
+| `failed_login_captcha_total`                                   | Gauge     |                   11.0 | Counter of failed CAPTCHA attempts during login                                                     |                                                     |
+| `successful_login_captcha_total`                               | Gauge     |                   11.0 | Counter of successful CAPTCHA attempts during login                                                 |                                                     |
 
 ## Metrics controlled by a feature flag
 
 The following metrics can be controlled by feature flags:
 
-| Metric                                                       | Feature Flag                                                     |
-|:-------------------------------------------------------------|:-----------------------------------------------------------------|
-| gitlab_method_call_duration_seconds                          | prometheus_metrics_method_instrumentation                        |
-| gitlab_transaction_allocated_memory_bytes                    | prometheus_metrics_transaction_allocated_memory                  |
-| gitlab_transaction_event_build_found_total                   | prometheus_transaction_event_build_found_total                   |
-| gitlab_transaction_event_build_invalid_total                 | prometheus_transaction_event_build_invalid_total                 |
-| gitlab_transaction_event_build_not_found_cached_total        | prometheus_transaction_event_build_not_found_cached_total        |
-| gitlab_transaction_event_build_not_found_total               | prometheus_transaction_event_build_not_found_total               |
-| gitlab_transaction_event_change_default_branch_total         | prometheus_transaction_event_change_default_branch_total         |
-| gitlab_transaction_event_create_repository_total             | prometheus_transaction_event_create_repository_total             |
-| gitlab_transaction_event_etag_caching_cache_hit_total        | prometheus_transaction_event_etag_caching_cache_hit_total        |
-| gitlab_transaction_event_etag_caching_header_missing_total   | prometheus_transaction_event_etag_caching_header_missing_total   |
-| gitlab_transaction_event_etag_caching_key_not_found_total    | prometheus_transaction_event_etag_caching_key_not_found_total    |
-| gitlab_transaction_event_etag_caching_middleware_used_total  | prometheus_transaction_event_etag_caching_middleware_used_total  |
-| gitlab_transaction_event_etag_caching_resource_changed_total | prometheus_transaction_event_etag_caching_resource_changed_total |
-| gitlab_transaction_event_fork_repository_total               | prometheus_transaction_event_fork_repository_total               |
-| gitlab_transaction_event_import_repository_total             | prometheus_transaction_event_import_repository_total             |
-| gitlab_transaction_event_push_branch_total                   | prometheus_transaction_event_push_branch_total                   |
-| gitlab_transaction_event_push_commit_total                   | prometheus_transaction_event_push_commit_total                   |
-| gitlab_transaction_event_push_tag_total                      | prometheus_transaction_event_push_tag_total                      |
-| gitlab_transaction_event_rails_exception_total               | prometheus_transaction_event_rails_exception_total               |
-| gitlab_transaction_event_receive_email_total                 | prometheus_transaction_event_receive_email_total                 |
-| gitlab_transaction_event_remote_mirrors_failed_total         | prometheus_transaction_event_remote_mirrors_failed_total         |
-| gitlab_transaction_event_remote_mirrors_finished_total       | prometheus_transaction_event_remote_mirrors_finished_total       |
-| gitlab_transaction_event_remote_mirrors_running_total        | prometheus_transaction_event_remote_mirrors_running_total        |
-| gitlab_transaction_event_remove_branch_total                 | prometheus_transaction_event_remove_branch_total                 |
-| gitlab_transaction_event_remove_repository_total             | prometheus_transaction_event_remove_repository_total             |
-| gitlab_transaction_event_remove_tag_total                    | prometheus_transaction_event_remove_tag_total                    |
-| gitlab_transaction_event_sidekiq_exception_total             | prometheus_transaction_event_sidekiq_exception_total             |
-| gitlab_transaction_event_stuck_import_jobs_total             | prometheus_transaction_event_stuck_import_jobs_total             |
-| gitlab_transaction_event_update_build_total                  | prometheus_transaction_event_update_build_total                  |
-| gitlab_view_rendering_duration_seconds                       | prometheus_metrics_view_instrumentation                          |
+| Metric                                                         | Feature Flag                                                       |
+|:---------------------------------------------------------------|:-------------------------------------------------------------------|
+| `gitlab_method_call_duration_seconds`                          | `prometheus_metrics_method_instrumentation`                        |
+| `gitlab_transaction_allocated_memory_bytes`                    | `prometheus_metrics_transaction_allocated_memory`                  |
+| `gitlab_transaction_event_build_found_total`                   | `prometheus_transaction_event_build_found_total`                   |
+| `gitlab_transaction_event_build_invalid_total`                 | `prometheus_transaction_event_build_invalid_total`                 |
+| `gitlab_transaction_event_build_not_found_cached_total`        | `prometheus_transaction_event_build_not_found_cached_total`        |
+| `gitlab_transaction_event_build_not_found_total`               | `prometheus_transaction_event_build_not_found_total`               |
+| `gitlab_transaction_event_change_default_branch_total`         | `prometheus_transaction_event_change_default_branch_total`         |
+| `gitlab_transaction_event_create_repository_total`             | `prometheus_transaction_event_create_repository_total`             |
+| `gitlab_transaction_event_etag_caching_cache_hit_total`        | `prometheus_transaction_event_etag_caching_cache_hit_total`        |
+| `gitlab_transaction_event_etag_caching_header_missing_total`   | `prometheus_transaction_event_etag_caching_header_missing_total`   |
+| `gitlab_transaction_event_etag_caching_key_not_found_total`    | `prometheus_transaction_event_etag_caching_key_not_found_total`    |
+| `gitlab_transaction_event_etag_caching_middleware_used_total`  | `prometheus_transaction_event_etag_caching_middleware_used_total`  |
+| `gitlab_transaction_event_etag_caching_resource_changed_total` | `prometheus_transaction_event_etag_caching_resource_changed_total` |
+| `gitlab_transaction_event_fork_repository_total`               | `prometheus_transaction_event_fork_repository_total`               |
+| `gitlab_transaction_event_import_repository_total`             | `prometheus_transaction_event_import_repository_total`             |
+| `gitlab_transaction_event_push_branch_total`                   | `prometheus_transaction_event_push_branch_total`                   |
+| `gitlab_transaction_event_push_commit_total`                   | `prometheus_transaction_event_push_commit_total`                   |
+| `gitlab_transaction_event_push_tag_total`                      | `prometheus_transaction_event_push_tag_total`                      |
+| `gitlab_transaction_event_rails_exception_total`               | `prometheus_transaction_event_rails_exception_total`               |
+| `gitlab_transaction_event_receive_email_total`                 | `prometheus_transaction_event_receive_email_total`                 |
+| `gitlab_transaction_event_remote_mirrors_failed_total`         | `prometheus_transaction_event_remote_mirrors_failed_total`         |
+| `gitlab_transaction_event_remote_mirrors_finished_total`       | `prometheus_transaction_event_remote_mirrors_finished_total`       |
+| `gitlab_transaction_event_remote_mirrors_running_total`        | `prometheus_transaction_event_remote_mirrors_running_total`        |
+| `gitlab_transaction_event_remove_branch_total`                 | `prometheus_transaction_event_remove_branch_total`                 |
+| `gitlab_transaction_event_remove_repository_total`             | `prometheus_transaction_event_remove_repository_total`             |
+| `gitlab_transaction_event_remove_tag_total`                    | `prometheus_transaction_event_remove_tag_total`                    |
+| `gitlab_transaction_event_sidekiq_exception_total`             | `prometheus_transaction_event_sidekiq_exception_total`             |
+| `gitlab_transaction_event_stuck_import_jobs_total`             | `prometheus_transaction_event_stuck_import_jobs_total`             |
+| `gitlab_transaction_event_update_build_total`                  | `prometheus_transaction_event_update_build_total`                  |
+| `gitlab_view_rendering_duration_seconds`                       | `prometheus_metrics_view_instrumentation`                          |
 
 ## Sidekiq Metrics available for Geo **(PREMIUM)**
 
 Sidekiq jobs may also gather metrics, and these metrics can be accessed if the Sidekiq exporter is enabled (e.g. via
 the `monitoring.sidekiq_exporter` configuration option in `gitlab.yml`.
 
-| Metric                                       | Type    | Since | Description | Labels |
-|:-------------------------------------------- |:------- |:----- |:----------- |:------ |
-| geo_db_replication_lag_seconds               | Gauge   | 10.2  | Database replication lag (seconds) | url
-| geo_repositories                             | Gauge   | 10.2  | Total number of repositories available on primary | url
-| geo_repositories_synced                      | Gauge   | 10.2  | Number of repositories synced on secondary | url
-| geo_repositories_failed                      | Gauge   | 10.2  | Number of repositories failed to sync on secondary | url
-| geo_lfs_objects                              | Gauge   | 10.2  | Total number of LFS objects available on primary | url
-| geo_lfs_objects_synced                       | Gauge   | 10.2  | Number of LFS objects synced on secondary | url
-| geo_lfs_objects_failed                       | Gauge   | 10.2  | Number of LFS objects failed to sync on secondary | url
-| geo_attachments                              | Gauge   | 10.2  | Total number of file attachments available on primary | url
-| geo_attachments_synced                       | Gauge   | 10.2  | Number of attachments synced on secondary | url
-| geo_attachments_failed                       | Gauge   | 10.2  | Number of attachments failed to sync on secondary | url
-| geo_last_event_id                            | Gauge   | 10.2  | Database ID of the latest event log entry on the primary | url
-| geo_last_event_timestamp                     | Gauge   | 10.2  | UNIX timestamp of the latest event log entry on the primary | url
-| geo_cursor_last_event_id                     | Gauge   | 10.2  | Last database ID of the event log processed by the secondary | url
-| geo_cursor_last_event_timestamp              | Gauge   | 10.2  | Last UNIX timestamp of the event log processed by the secondary | url
-| geo_status_failed_total                      | Counter | 10.2  | Number of times retrieving the status from the Geo Node failed | url
-| geo_last_successful_status_check_timestamp   | Gauge   | 10.2  | Last timestamp when the status was successfully updated | url
-| geo_lfs_objects_synced_missing_on_primary    | Gauge   | 10.7  | Number of LFS objects marked as synced due to the file missing on the primary | url
-| geo_job_artifacts_synced_missing_on_primary  | Gauge   | 10.7  | Number of job artifacts marked as synced due to the file missing on the primary | url
-| geo_attachments_synced_missing_on_primary    | Gauge   | 10.7  | Number of attachments marked as synced due to the file missing on the primary | url
-| geo_repositories_checksummed_count           | Gauge   | 10.7  | Number of repositories checksummed on primary | url
-| geo_repositories_checksum_failed_count       | Gauge   | 10.7  | Number of repositories failed to calculate the checksum on primary | url
-| geo_wikis_checksummed_count                  | Gauge   | 10.7  | Number of wikis checksummed on primary | url
-| geo_wikis_checksum_failed_count              | Gauge   | 10.7  | Number of wikis failed to calculate the checksum on primary | url
-| geo_repositories_verified_count              | Gauge   | 10.7  | Number of repositories verified on secondary | url
-| geo_repositories_verification_failed_count   | Gauge   | 10.7  | Number of repositories failed to verify on secondary | url
-| geo_repositories_checksum_mismatch_count     | Gauge   | 10.7  | Number of repositories that checksum mismatch on secondary | url
-| geo_wikis_verified_count                     | Gauge   | 10.7  | Number of wikis verified on secondary | url
-| geo_wikis_verification_failed_count          | Gauge   | 10.7  | Number of wikis failed to verify on secondary | url
-| geo_wikis_checksum_mismatch_count            | Gauge   | 10.7  | Number of wikis that checksum mismatch on secondary | url
-| geo_repositories_checked_count               | Gauge   | 11.1  | Number of repositories that have been checked via `git fsck` | url
-| geo_repositories_checked_failed_count        | Gauge   | 11.1  | Number of repositories that have a failure from `git fsck` | url
-| geo_repositories_retrying_verification_count | Gauge   | 11.2  | Number of repositories verification failures that Geo is actively trying to correct on secondary  | url
-| geo_wikis_retrying_verification_count        | Gauge   | 11.2  | Number of wikis verification failures that Geo is actively trying to correct on secondary | url
+| Metric                                         | Type    | Since | Description | Labels |
+|:---------------------------------------------- |:------- |:----- |:----------- |:------ |
+| `geo_db_replication_lag_seconds`               | Gauge   | 10.2  | Database replication lag (seconds) | url |
+| `geo_repositories`                             | Gauge   | 10.2  | Total number of repositories available on primary | url |
+| `geo_repositories_synced`                      | Gauge   | 10.2  | Number of repositories synced on secondary | url |
+| `geo_repositories_failed`                      | Gauge   | 10.2  | Number of repositories failed to sync on secondary | url |
+| `geo_lfs_objects`                              | Gauge   | 10.2  | Total number of LFS objects available on primary | url |
+| `geo_lfs_objects_synced`                       | Gauge   | 10.2  | Number of LFS objects synced on secondary | url |
+| `geo_lfs_objects_failed`                       | Gauge   | 10.2  | Number of LFS objects failed to sync on secondary | url |
+| `geo_attachments`                              | Gauge   | 10.2  | Total number of file attachments available on primary | url |
+| `geo_attachments_synced`                       | Gauge   | 10.2  | Number of attachments synced on secondary | url |
+| `geo_attachments_failed`                       | Gauge   | 10.2  | Number of attachments failed to sync on secondary | url |
+| `geo_last_event_id`                            | Gauge   | 10.2  | Database ID of the latest event log entry on the primary | url |
+| `geo_last_event_timestamp`                     | Gauge   | 10.2  | UNIX timestamp of the latest event log entry on the primary | url |
+| `geo_cursor_last_event_id`                     | Gauge   | 10.2  | Last database ID of the event log processed by the secondary | url |
+| `geo_cursor_last_event_timestamp`              | Gauge   | 10.2  | Last UNIX timestamp of the event log processed by the secondary | url |
+| `geo_status_failed_total`                      | Counter | 10.2  | Number of times retrieving the status from the Geo Node failed | url |
+| `geo_last_successful_status_check_timestamp`   | Gauge   | 10.2  | Last timestamp when the status was successfully updated | url |
+| `geo_lfs_objects_synced_missing_on_primary`    | Gauge   | 10.7  | Number of LFS objects marked as synced due to the file missing on the primary | url |
+| `geo_job_artifacts_synced_missing_on_primary`  | Gauge   | 10.7  | Number of job artifacts marked as synced due to the file missing on the primary | url |
+| `geo_attachments_synced_missing_on_primary`    | Gauge   | 10.7  | Number of attachments marked as synced due to the file missing on the primary | url |
+| `geo_repositories_checksummed_count`           | Gauge   | 10.7  | Number of repositories checksummed on primary | url |
+| `geo_repositories_checksum_failed_count`       | Gauge   | 10.7  | Number of repositories failed to calculate the checksum on primary | url |
+| `geo_wikis_checksummed_count`                  | Gauge   | 10.7  | Number of wikis checksummed on primary | url |
+| `geo_wikis_checksum_failed_count`              | Gauge   | 10.7  | Number of wikis failed to calculate the checksum on primary | url |
+| `geo_repositories_verified_count`              | Gauge   | 10.7  | Number of repositories verified on secondary | url |
+| `geo_repositories_verification_failed_count`   | Gauge   | 10.7  | Number of repositories failed to verify on secondary | url |
+| `geo_repositories_checksum_mismatch_count`     | Gauge   | 10.7  | Number of repositories that checksum mismatch on secondary | url |
+| `geo_wikis_verified_count`                     | Gauge   | 10.7  | Number of wikis verified on secondary | url |
+| `geo_wikis_verification_failed_count`          | Gauge   | 10.7  | Number of wikis failed to verify on secondary | url |
+| `geo_wikis_checksum_mismatch_count`            | Gauge   | 10.7  | Number of wikis that checksum mismatch on secondary | url |
+| `geo_repositories_checked_count`               | Gauge   | 11.1  | Number of repositories that have been checked via `git fsck` | url |
+| `geo_repositories_checked_failed_count`        | Gauge   | 11.1  | Number of repositories that have a failure from `git fsck` | url |
+| `geo_repositories_retrying_verification_count` | Gauge   | 11.2  | Number of repositories verification failures that Geo is actively trying to correct on secondary  | url |
+| `geo_wikis_retrying_verification_count`        | Gauge   | 11.2  | Number of wikis verification failures that Geo is actively trying to correct on secondary | url |
 
 ### Ruby metrics
 
 Some basic Ruby runtime metrics are available:
 
-| Metric                                 | Type      | Since | Description |
-|:-------------------------------------- |:--------- |:----- |:----------- |
-| ruby_gc_duration_seconds               | Counter   | 11.1  | Time spent by Ruby in GC |
-| ruby_gc_stat_...                       | Gauge     | 11.1  | Various metrics from [GC.stat] |
-| ruby_file_descriptors                  | Gauge     | 11.1  | File descriptors per process |
-| ruby_memory_bytes                      | Gauge     | 11.1  | Memory usage by process |
-| ruby_sampler_duration_seconds          | Counter   | 11.1  | Time spent collecting stats |
-| ruby_process_cpu_seconds_total         | Gauge     | 12.0  | Total amount of CPU time per process |
-| ruby_process_max_fds                   | Gauge     | 12.0  | Maximum number of open file descriptors per process |
-| ruby_process_resident_memory_bytes     | Gauge     | 12.0  | Memory usage by process, measured in bytes |
-| ruby_process_start_time_seconds        | Gauge     | 12.0  | UNIX timestamp of process start time |
+| Metric                               | Type      | Since | Description |
+|:------------------------------------ |:--------- |:----- |:----------- |
+| `ruby_gc_duration_seconds`           | Counter   | 11.1  | Time spent by Ruby in GC |
+| `ruby_gc_stat_...`                   | Gauge     | 11.1  | Various metrics from [GC.stat] |
+| `ruby_file_descriptors`              | Gauge     | 11.1  | File descriptors per process |
+| `ruby_memory_bytes`                  | Gauge     | 11.1  | Memory usage by process |
+| `ruby_sampler_duration_seconds`      | Counter   | 11.1  | Time spent collecting stats |
+| `ruby_process_cpu_seconds_total`     | Gauge     | 12.0  | Total amount of CPU time per process |
+| `ruby_process_max_fds`               | Gauge     | 12.0  | Maximum number of open file descriptors per process |
+| `ruby_process_resident_memory_bytes` | Gauge     | 12.0  | Memory usage by process, measured in bytes |
+| `ruby_process_start_time_seconds`    | Gauge     | 12.0  | UNIX timestamp of process start time |
 
 [GC.stat]: https://ruby-doc.org/core-2.6.3/GC.html#method-c-stat
 
@@ -183,28 +183,28 @@ Some basic Ruby runtime metrics are available:
 
 Unicorn specific metrics, when Unicorn is used.
 
-| Metric                     | Type  | Since | Description                                        |
-|:---------------------------|:------|:------|:---------------------------------------------------|
-| unicorn_active_connections | Gauge | 11.0  | The number of active Unicorn connections (workers) |
-| unicorn_queued_connections | Gauge | 11.0  | The number of queued Unicorn connections           |
-| unicorn_workers            | Gauge | 12.0  | The number of Unicorn workers                      |
+| Metric                       | Type  | Since | Description                                        |
+|:-----------------------------|:------|:------|:---------------------------------------------------|
+| `unicorn_active_connections` | Gauge | 11.0  | The number of active Unicorn connections (workers) |
+| `unicorn_queued_connections` | Gauge | 11.0  | The number of queued Unicorn connections           |
+| `unicorn_workers`            | Gauge | 12.0  | The number of Unicorn workers                      |
 
 ## Puma Metrics **(EXPERIMENTAL)**
 
-When Puma is used instead of Unicorn, following metrics are available:
-
-| Metric                                       | Type    | Since | Description |
-|:-------------------------------------------- |:------- |:----- |:----------- |
-| puma_workers                                 | Gauge   | 12.0  | Total number of workers |
-| puma_running_workers                         | Gauge   | 12.0  | Number of booted workers |
-| puma_stale_workers                           | Gauge   | 12.0  | Number of old workers |
-| puma_running                                 | Gauge   | 12.0  | Number of running threads |
-| puma_queued_connections                      | Gauge   | 12.0  | Number of connections in that worker's "todo" set waiting for a worker thread |
-| puma_active_connections                      | Gauge   | 12.0  | Number of threads processing a request |
-| puma_pool_capacity                           | Gauge   | 12.0  | Number of requests the worker is capable of taking right now |
-| puma_max_threads                             | Gauge   | 12.0  | Maximum number of worker threads |
-| puma_idle_threads                            | Gauge   | 12.0  | Number of spawned threads which are not processing a request |
-| puma_killer_terminations_total               | Gauge   | 12.0  | Number of workers terminated by PumaWorkerKiller |
+When Puma is used instead of Unicorn, the following metrics are available:
+
+| Metric                                         | Type    | Since | Description |
+|:---------------------------------------------- |:------- |:----- |:----------- |
+| `puma_workers`                                 | Gauge   | 12.0  | Total number of workers |
+| `puma_running_workers`                         | Gauge   | 12.0  | Number of booted workers |
+| `puma_stale_workers`                           | Gauge   | 12.0  | Number of old workers |
+| `puma_running`                                 | Gauge   | 12.0  | Number of running threads |
+| `puma_queued_connections`                      | Gauge   | 12.0  | Number of connections in that worker's "todo" set waiting for a worker thread |
+| `puma_active_connections`                      | Gauge   | 12.0  | Number of threads processing a request |
+| `puma_pool_capacity`                           | Gauge   | 12.0  | Number of requests the worker is capable of taking right now |
+| `puma_max_threads`                             | Gauge   | 12.0  | Maximum number of worker threads |
+| `puma_idle_threads`                            | Gauge   | 12.0  | Number of spawned threads which are not processing a request |
+| `puma_killer_terminations_total`               | Gauge   | 12.0  | Number of workers terminated by PumaWorkerKiller |
 
 ## Metrics shared directory
 
@@ -221,9 +221,3 @@ If GitLab is installed using Omnibus and `tmpfs` is available then metrics
 directory will be automatically configured.
 
 [← Back to the main Prometheus page](index.md)
-
-[29118]: https://gitlab.com/gitlab-org/gitlab-ce/issues/29118
-[Prometheus]: https://prometheus.io
-[restart]: ../../restart_gitlab.md#omnibus-gitlab-restart
-[whitelist]: ../ip_whitelist.md
-[reconfigure]: ../../restart_gitlab.md#omnibus-gitlab-reconfigure
diff --git a/doc/api/projects.md b/doc/api/projects.md
index 9f392418153..cf28ea84704 100644
--- a/doc/api/projects.md
+++ b/doc/api/projects.md
@@ -852,10 +852,10 @@ Get the users list of a project.
 GET /projects/:id/users
 ```
 
-| Attribute | Type | Required | Description |
-| --------- | ---- | -------- | ----------- |
-| `search` | string | no | Search for specific users |
-| `skip_users` | array[int] | no | Filter out users with the specified IDs |
+| Attribute    | Type          | Required | Description |
+| ------------ | ------------- | -------- | ----------- |
+| `search`     | string        | no       | Search for specific users |
+| `skip_users` | integer array | no       | Filter out users with the specified IDs |
 
 ```json
 [
-- 
cgit v1.2.1


From 6f3fa06fd182b5d758bdb8c05ca90bced45cd3d7 Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Mon, 26 Aug 2019 20:31:04 +0000
Subject: Change docs markdown linter

Change from ruby mdl to node markdownlint, add
config file to root of project, delete old config
file, update exceptions, and fix one doc that
was didn't meet standards
---
 .gitlab/ci/docs.gitlab-ci.yml                    |  2 +-
 .markdownlint.json                               | 31 +++++++++++++++++++++++
 .mdlrc                                           |  7 ------
 .mdlrc.style                                     | 32 ------------------------
 danger/only_documentation/Dangerfile             |  2 +-
 doc/administration/smime_signing_email.md        |  2 +-
 doc/development/emails.md                        |  2 +-
 doc/development/namespaces_storage_statistics.md | 24 +++++++++---------
 doc/development/uploads.md                       | 11 ++++----
 doc/gitlab-basics/start-using-git.md             |  6 ++---
 10 files changed, 55 insertions(+), 64 deletions(-)
 create mode 100644 .markdownlint.json
 delete mode 100644 .mdlrc
 delete mode 100644 .mdlrc.style

diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index 39ae62a43c9..d724ab07663 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -65,7 +65,7 @@ docs lint:
     - mv doc/ /tmp/gitlab-docs/content/$DOCS_GITLAB_REPO_SUFFIX
     - cd /tmp/gitlab-docs
     # Lint Markdown
-    - bundle exec mdl content/$DOCS_GITLAB_REPO_SUFFIX -c $CI_PROJECT_DIR/.mdlrc
+    - markdownlint --config $CI_PROJECT_DIR/.markdownlint.json content/$DOCS_GITLAB_REPO_SUFFIX/**/*.md
     # Build HTML from Markdown
     - bundle exec nanoc
     # Check the internal links
diff --git a/.markdownlint.json b/.markdownlint.json
new file mode 100644
index 00000000000..2c40c0859f0
--- /dev/null
+++ b/.markdownlint.json
@@ -0,0 +1,31 @@
+{
+  "default": true,
+  "first-header-h1": true,
+  "header-style": {
+    "style": "atx"
+  },
+  "ul-style": {
+    "style": "dash"
+  },
+  "line-length": false,
+  "commands-show-output": false,
+  "no-duplicate-header": {
+    "allow_different_nesting": true
+  },
+  "no-trailing-punctuation": {
+    "punctuation": ".,;:!。，；：！？"
+  },
+  "ol-prefix": {
+    "style": "one"
+  },
+  "no-inline-html": false,
+  "hr-style": {
+    "style": "---"
+  },
+  "no-emphasis-as-heading": false,
+  "fenced-code-language": false,
+  "first-line-h1": false,
+  "code-block-style": {
+    "style": "fenced"
+  }
+}
diff --git a/.mdlrc b/.mdlrc
deleted file mode 100644
index 151c54f7d44..00000000000
--- a/.mdlrc
+++ /dev/null
@@ -1,7 +0,0 @@
-# This is the options file for mdl, configured in .gitlab/ci/docs.gitlab-ci.yml,
-# and related to the style file ./mdlrc.style
-
-# See https://github.com/markdownlint/markdownlint/blob/master/docs/configuration.md
-
-ignore_front_matter true
-style File.expand_path('.mdlrc.style', __dir__)
diff --git a/.mdlrc.style b/.mdlrc.style
deleted file mode 100644
index 85bc3aaa99b..00000000000
--- a/.mdlrc.style
+++ /dev/null
@@ -1,32 +0,0 @@
-# This is the style file for mdl, configured in .gitlab/ci/docs.gitlab-ci.yml,
-# and related to the options file ./mdlrc
-
-# See https://github.com/markdownlint/markdownlint/blob/master/docs/RULES.md
-# for more detailed information on the rules and styles.
-
-rule "MD001"
-rule "MD002"
-rule "MD003", :style => :atx
-rule "MD006"
-rule "MD010"
-rule "MD011"
-rule "MD012"
-rule "MD019"
-rule "MD022"
-rule "MD023"
-rule "MD025"
-rule "MD028"
-rule "MD029", :style => :one
-rule "MD030"
-# rule "MD032"
-rule "MD034"
-rule "MD037"
-rule "MD038"
-
-# Should not be used currently:
-
-# rule "MD004", :style => :dash # unordered list style - dash
-# False positives, see https://github.com/markdownlint/markdownlint/issues/261
- 
-# rule "MD039" # Spaces inside link text
-# Crashes when link text has certain punctuation
diff --git a/danger/only_documentation/Dangerfile b/danger/only_documentation/Dangerfile
index dad12c0d29c..ce7ede26d9a 100644
--- a/danger/only_documentation/Dangerfile
+++ b/danger/only_documentation/Dangerfile
@@ -1,7 +1,7 @@
 # rubocop:disable Style/SignalException
 # frozen_string_literal: true
 
-has_only_docs_changes = helper.all_changed_files.all? { |file| file.start_with?('doc/', '.gitlab/ci/docs.gitlab-ci.yml', '.mdlrc') || file.end_with?('.md') }
+has_only_docs_changes = helper.all_changed_files.all? { |file| file.start_with?('doc/', '.gitlab/ci/docs.gitlab-ci.yml', '.markdownlint.json') || file.end_with?('.md') }
 is_docs_only_branch = gitlab.branch_for_head =~ /(^docs[\/-].*|.*-docs$)/
 
 if is_docs_only_branch && !has_only_docs_changes
diff --git a/doc/administration/smime_signing_email.md b/doc/administration/smime_signing_email.md
index 9f719088f25..b2e3bf8487b 100644
--- a/doc/administration/smime_signing_email.md
+++ b/doc/administration/smime_signing_email.md
@@ -22,7 +22,7 @@ email_smime:
 ```
 
 - Both files must be provided PEM-encoded.
-- The key file must be unencrypted so that Gitlab can read it without user 
+- The key file must be unencrypted so that Gitlab can read it without user
   intervention.
 
 NOTE: **Note:** Be mindful of the access levels for your private keys and visibility to
diff --git a/doc/development/emails.md b/doc/development/emails.md
index edec0f86989..5676c3b32f4 100644
--- a/doc/development/emails.md
+++ b/doc/development/emails.md
@@ -6,7 +6,7 @@ To view rendered emails "sent" in your development instance, visit
 [`/rails/letter_opener`](http://localhost:3000/rails/letter_opener).
 
 Please note that [S/MIME signed](../administration/smime_signing_email.md) emails
-[cannot be currently previewed](https://github.com/fgrehm/letter_opener_web/issues/96) with 
+[cannot be currently previewed](https://github.com/fgrehm/letter_opener_web/issues/96) with
 `letter_opener`.
 
 ## Mailer previews
diff --git a/doc/development/namespaces_storage_statistics.md b/doc/development/namespaces_storage_statistics.md
index b3285de4705..2c7e5935435 100644
--- a/doc/development/namespaces_storage_statistics.md
+++ b/doc/development/namespaces_storage_statistics.md
@@ -20,8 +20,8 @@ every time the project is saved.
 The summary of those statistics per namespace is then retrieved
 by [`Namespaces#with_statistics`](https://gitlab.com/gitlab-org/gitlab-ce/blob/v12.2.0.pre/app/models/namespace.rb#L70) scope. Analyzing this query we noticed that:
 
-* It takes up to `1.2` seconds for namespaces with over `15k` projects.
-* It can't be analyzed with [ChatOps](chatops_on_gitlabcom.md), as it times out.
+- It takes up to `1.2` seconds for namespaces with over `15k` projects.
+- It can't be analyzed with [ChatOps](chatops_on_gitlabcom.md), as it times out.
 
 Additionally, the pattern that is currently used to update the project statistics
 (the callback) doesn't scale adequately. It is currently one of the largest
@@ -62,8 +62,8 @@ REFRESH MATERIALIZED VIEW root_namespace_storage_statistics;
 
 While this implied a single query update (and probably a fast one), it has some downsides:
 
-* Materialized views syntax varies from PostgreSQL and MySQL. While this feature was worked on, MySQL was still supported by GitLab.
-* Rails does not have native support for materialized views. We'd need to use a specialized gem to take care of the management of the database views, which implies additional work.
+- Materialized views syntax varies from PostgreSQL and MySQL. While this feature was worked on, MySQL was still supported by GitLab.
+- Rails does not have native support for materialized views. We'd need to use a specialized gem to take care of the management of the database views, which implies additional work.
 
 ### Attempt B: An update through a CTE
 
@@ -131,8 +131,8 @@ WHERE namespace_id IN (
 
 Even though this approach would make aggregating much easier, it has some major downsides:
 
-* We'd have to migrate **all namespaces** by adding and filling a new column. Because of the size of the table, dealing with time/cost will not be great. The background migration will take approximately `153h`, see <https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/29772>.
-* Background migration has to be shipped one release before, delaying the functionality by another milestone.
+- We'd have to migrate **all namespaces** by adding and filling a new column. Because of the size of the table, dealing with time/cost will not be great. The background migration will take approximately `153h`, see <https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/29772>.
+- Background migration has to be shipped one release before, delaying the functionality by another milestone.
 
 ### Attempt E (final): Update the namespace storage statistics in async way
 
@@ -155,10 +155,10 @@ but we refresh them through Sidekiq jobs and in different transactions:
 
 This implementation has the following benefits:
 
-* All the updates are done async, so we're not increasing the length of the transactions for `project_statistics`.
-* We're doing the update in a single SQL query.
-* It is compatible with PostgreSQL and MySQL.
-* No background migration required.
+- All the updates are done async, so we're not increasing the length of the transactions for `project_statistics`.
+- We're doing the update in a single SQL query.
+- It is compatible with PostgreSQL and MySQL.
+- No background migration required.
 
 The only downside of this approach is that namespaces' statistics are updated up to `1.5` hours after the change is done,
 which means there's a time window in which the statistics are inaccurate. Because we're still not
@@ -171,8 +171,8 @@ performant approach of aggregating the root namespaces.
 
 All the details regarding this use case can be found on:
 
-* <https://gitlab.com/gitlab-org/gitlab-ce/issues/62214>
-* Merge Request with the implementation: <https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/28996>
+- <https://gitlab.com/gitlab-org/gitlab-ce/issues/62214>
+- Merge Request with the implementation: <https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/28996>
 
 Performance of the namespace storage statistics were measured in staging and production (GitLab.com). All results were posted
 on <https://gitlab.com/gitlab-org/gitlab-ce/issues/64092>: No problem has been reported so far.
diff --git a/doc/development/uploads.md b/doc/development/uploads.md
index 234539bb673..681ce9d9fe8 100644
--- a/doc/development/uploads.md
+++ b/doc/development/uploads.md
@@ -174,14 +174,14 @@ sequenceDiagram
     c ->>+w: POST /some/url/upload
 
     w->>+s: save the incoming file on a temporary location
-    s-->>-w: 
+    s-->>-w:  
 
     w->>+r:  POST /some/url/upload
     Note over w,r: file was replaced with its location<br>and other metadata
 
     opt requires async processing
       r->>+redis: schedule a job
-      redis-->>-r: 
+      redis-->>-r:  
     end
 
     r-->>-c: request result
@@ -230,17 +230,17 @@ sequenceDiagram
 
     w->>+os: PUT file
     Note over w,os: file is stored on a temporary location. Rails select the destination
-    os-->>-w: 
+    os-->>-w:  
 
     w->>+r:  POST /some/url/upload
     Note over w,r: file was replaced with its location<br>and other metadata
 
     r->>+os: move object to final destination
-    os-->>-r: 
+    os-->>-r:  
 
     opt requires async processing
       r->>+redis: schedule a job
-      redis-->>-r: 
+      redis-->>-r:  
     end
 
     r-->>-c: request result
@@ -268,4 +268,3 @@ sequenceDiagram
 This option affect the response to the `/authorize` call. When not enabled, the API response will not contain presigned URLs and workhorse will write the file the shared disk, on the path is provided by rails, acting like object storage was disabled.
 
 Once the request reachs rails, it will schedule an object storage upload as a sidekiq job.
-
diff --git a/doc/gitlab-basics/start-using-git.md b/doc/gitlab-basics/start-using-git.md
index 5de173abbff..a289b90b81b 100644
--- a/doc/gitlab-basics/start-using-git.md
+++ b/doc/gitlab-basics/start-using-git.md
@@ -102,7 +102,7 @@ files to your local computer, automatically preserving the Git connection with t
 remote repository.
 
 You can either clone it via HTTPS or [SSH](../ssh/README.md). If you chose to clone
-it via HTTPS, you'll have to enter your credentials every time you pull and push. You can read more about credential storage in the [Git Credentials documentation](https://git-scm.com/book/en/v2/Git-Tools-Credential-Storage). With SSH, you enter your credentials only once. 
+it via HTTPS, you'll have to enter your credentials every time you pull and push. You can read more about credential storage in the [Git Credentials documentation](https://git-scm.com/book/en/v2/Git-Tools-Credential-Storage). With SSH, you enter your credentials only once.
 
 You can find both paths (HTTPS and SSH) by navigating to your project's landing page
 and clicking **Clone**. GitLab will prompt you with both paths, from which you can copy
@@ -157,7 +157,7 @@ git pull <REMOTE> <name-of-branch>
 When you clone a repository, `REMOTE` is typically `origin`. This is where the
 repository was cloned from, and it indicates the SSH or HTTPS URL of the repository
 on the remote server. `<name-of-branch>` is usually `master`, but it may be any existing
-branch. You can create additional named remotes and branches as necessary. 
+branch. You can create additional named remotes and branches as necessary.
 
 You can learn more on how Git manages remote repositories in the [Git Remote documentation](https://git-scm.com/book/en/v2/Git-Basics-Working-with-Remotes).
 
@@ -169,7 +169,7 @@ To view your remote repositories, type:
 git remote -v
 ```
 
-The `-v` flag stands for verbose. 
+The `-v` flag stands for verbose.
 
 ### Add a remote repository
 
-- 
cgit v1.2.1


From 6fa5f510e83a91e19a1601bf6c01a9cffe6fd5c9 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Sun, 25 Aug 2019 07:20:17 -0700
Subject: Guard against deleted project feature entry

In https://gitlab.com/gitlab-org/gitlab-ce/issues/66482, we see that a
project's `project_feature` association may be lazily loaded and hence
return `nil` if the entry is deleted if the `Project` is already loaded
in memory. To ensure we don't fail hard when this happens, assume all
features are disabled.

We can fix this issue by eager loading the `project_feature` in
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/32169, but we
shouldn't have to depend on that.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66482
---
 app/policies/project_policy.rb                              |  2 ++
 .../sh-guard-against-orphaned-project-feature.yml           |  5 +++++
 spec/policies/project_policy_spec.rb                        | 13 +++++++++++++
 3 files changed, 20 insertions(+)
 create mode 100644 changelogs/unreleased/sh-guard-against-orphaned-project-feature.yml

diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb
index b8dee1b0789..e2634692dc7 100644
--- a/app/policies/project_policy.rb
+++ b/app/policies/project_policy.rb
@@ -502,6 +502,8 @@ class ProjectPolicy < BasePolicy
   end
 
   def feature_available?(feature)
+    return false unless project.project_feature
+
     case project.project_feature.access_level(feature)
     when ProjectFeature::DISABLED
       false
diff --git a/changelogs/unreleased/sh-guard-against-orphaned-project-feature.yml b/changelogs/unreleased/sh-guard-against-orphaned-project-feature.yml
new file mode 100644
index 00000000000..99c8732c5b0
--- /dev/null
+++ b/changelogs/unreleased/sh-guard-against-orphaned-project-feature.yml
@@ -0,0 +1,5 @@
+---
+title: Guard against deleted project feature entry in project permissions
+merge_request: 32187
+author:
+type: fixed
diff --git a/spec/policies/project_policy_spec.rb b/spec/policies/project_policy_spec.rb
index 8fd54e0bf1d..71ba73d5661 100644
--- a/spec/policies/project_policy_spec.rb
+++ b/spec/policies/project_policy_spec.rb
@@ -94,6 +94,19 @@ describe ProjectPolicy do
     permissions.each { |p| is_expected.not_to be_allowed(p) }
   end
 
+  context 'with no project feature' do
+    subject { described_class.new(owner, project) }
+
+    before do
+      project.project_feature.destroy
+      project.reload
+    end
+
+    it 'returns false' do
+      is_expected.to be_disallowed(:read_build)
+    end
+  end
+
   it 'does not include the read_issue permission when the issue author is not a member of the private project' do
     project = create(:project, :private)
     issue   = create(:issue, project: project, author: create(:user))
-- 
cgit v1.2.1


From 7c9eb111494b8407e5251f51b963652857707891 Mon Sep 17 00:00:00 2001
From: Reuben Pereira <rpereira@gitlab.com>
Date: Mon, 26 Aug 2019 20:39:59 +0000
Subject: Remove unnecessary include

---
 lib/gitlab/database_importers/self_monitoring/project/create_service.rb | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/gitlab/database_importers/self_monitoring/project/create_service.rb b/lib/gitlab/database_importers/self_monitoring/project/create_service.rb
index 164854e1e1a..9387a76369f 100644
--- a/lib/gitlab/database_importers/self_monitoring/project/create_service.rb
+++ b/lib/gitlab/database_importers/self_monitoring/project/create_service.rb
@@ -4,8 +4,6 @@ module Gitlab
   module DatabaseImporters
     module SelfMonitoring
       module Project
-        include Stepable
-
         class CreateService < ::BaseService
           include Stepable
 
-- 
cgit v1.2.1


From b881c7725366a18034bf795548718e5d4874bd6e Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Mon, 26 Aug 2019 13:41:55 -0700
Subject: Reduce complexity of CI files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 .gitlab-ci.yml                         |  26 ++-
 .gitlab/ci/cng.gitlab-ci.yml           |   7 +-
 .gitlab/ci/docs.gitlab-ci.yml          |  47 +++---
 .gitlab/ci/frontend.gitlab-ci.yml      | 167 ++++++++++---------
 .gitlab/ci/global.gitlab-ci.yml        | 102 +++++-------
 .gitlab/ci/memory.gitlab-ci.yml        |  17 +-
 .gitlab/ci/pages.gitlab-ci.yml         |  21 ++-
 .gitlab/ci/qa.gitlab-ci.yml            |   6 +-
 .gitlab/ci/rails.gitlab-ci.yml         | 288 +++++++++++++++++----------------
 .gitlab/ci/reports.gitlab-ci.yml       |  33 ++--
 .gitlab/ci/review.gitlab-ci.yml        | 129 +++++++--------
 .gitlab/ci/setup.gitlab-ci.yml         |  45 +++---
 .gitlab/ci/test-metadata.gitlab-ci.yml |  30 ++--
 .gitlab/ci/yaml.gitlab-ci.yml          |   7 +-
 14 files changed, 474 insertions(+), 451 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f926cbc2939..4c7a8c05b37 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,5 +1,15 @@
 image: "dev.gitlab.org:5005/gitlab/gitlab-build-images:ruby-2.6.3-golang-1.11-git-2.22-chrome-73.0-node-12.x-yarn-1.16-postgresql-9.6-graphicsmagick-1.3.33"
 
+stages:
+  - build
+  - prepare
+  - quick-test
+  - test
+  - review
+  - qa
+  - post-test
+  - pages
+
 variables:
   RAILS_ENV: "test"
   NODE_ENV: "test"
@@ -11,25 +21,9 @@ variables:
   FLAKY_RSPEC_SUITE_REPORT_PATH: rspec_flaky/report-suite.json
   BUILD_ASSETS_IMAGE: "false"
 
-before_script:
-  - date
-  - source scripts/utils.sh
-  - source scripts/prepare_build.sh
-  - date
-
 after_script:
   - date
 
-stages:
-  - build
-  - prepare
-  - merge
-  - test
-  - review
-  - qa
-  - post-test
-  - pages
-
 include:
   - local: .gitlab/ci/global.gitlab-ci.yml
   - local: .gitlab/ci/cng.gitlab-ci.yml
diff --git a/.gitlab/ci/cng.gitlab-ci.yml b/.gitlab/ci/cng.gitlab-ci.yml
index d624e8d09f6..a43d3694103 100644
--- a/.gitlab/ci/cng.gitlab-ci.yml
+++ b/.gitlab/ci/cng.gitlab-ci.yml
@@ -1,16 +1,15 @@
 cloud-native-image:
   image: ruby:2.6-alpine
-  before_script: []
   dependencies: []
   stage: post-test
   allow_failure: true
   variables:
     GIT_DEPTH: "1"
-  cache: {}
   when: manual
   script:
     - install_gitlab_gem
     - CNG_PROJECT_PATH="gitlab-org/build/CNG" BUILD_TRIGGER_TOKEN=$CI_JOB_TOKEN ./scripts/trigger-build cng
   only:
-    - tags@gitlab-org/gitlab-ce
-    - tags@gitlab-org/gitlab-ee
+    refs:
+      - tags@gitlab-org/gitlab-ce
+      - tags@gitlab-org/gitlab-ee
diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index d724ab07663..1fad731543c 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -1,24 +1,34 @@
-.review-docs: &review-docs
-  extends: .single-script-job-dedicated-runner
+.review-docs:
+  extends:
+    - .default-tags
+    - .default-retry
+  image: ruby:2.6-alpine
+  stage: review
+  dependencies: []
   variables:
-    SCRIPT_NAME: trigger-build-docs
+    GIT_STRATEGY: none
   environment:
     name: review-docs/$CI_COMMIT_REF_SLUG
     # DOCS_REVIEW_APPS_DOMAIN and DOCS_GITLAB_REPO_SUFFIX are CI variables
     # Discussion: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14236/diffs#note_40140693
     url: http://$CI_ENVIRONMENT_SLUG.$DOCS_REVIEW_APPS_DOMAIN/$DOCS_GITLAB_REPO_SUFFIX
     on_stop: review-docs-cleanup
+  before_script:
+    # We don't clone the repo by using GIT_STRATEGY: none and only download the
+    # single script we need here so it's much faster than cloning.
+    - apk add --update openssl
+    - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/trigger-build-docs
+    - chmod 755 trigger-build-docs
 
 # Trigger a manual docs build in gitlab-docs only on non docs-only branches.
 # Useful to preview the docs changes live.
 review-docs-deploy-manual:
   extends:
     - .review-docs
-    - .no-docs-and-no-qa
-  stage: review
+    - .except-docs-qa
   script:
     - gem install gitlab --no-document
-    - ./$SCRIPT_NAME deploy
+    - ./trigger-build-docs deploy
   when: manual
   only:
     - branches@gitlab-org/gitlab-ce
@@ -27,39 +37,40 @@ review-docs-deploy-manual:
 # Always trigger a docs build in gitlab-docs only on docs-only branches.
 # Useful to preview the docs changes live.
 review-docs-deploy:
-  <<: *review-docs
-  stage: review
+  extends:
+    - .review-docs
+    - .except-qa
   script:
     - gem install gitlab --no-document
-    - ./$SCRIPT_NAME deploy
+    - ./trigger-build-docs deploy
   only:
     - /(^docs[\/-].+|.+-docs$)/@gitlab-org/gitlab-ce
     - /(^docs[\/-].+|.+-docs$)/@gitlab-org/gitlab-ee
-  except:
-    - /(^qa[\/-].*|.*-qa$)/
 
 # Cleanup remote environment of gitlab-docs
 review-docs-cleanup:
-  <<: *review-docs
-  stage: review
+  extends:
+    - .review-docs
+    - .except-qa
   environment:
     name: review-docs/$CI_COMMIT_REF_SLUG
     action: stop
   script:
     - gem install gitlab --no-document
-    - ./$SCRIPT_NAME cleanup
+    - ./trigger-build-docs cleanup
   when: manual
   only:
     - branches@gitlab-org/gitlab-ce
     - branches@gitlab-org/gitlab-ee
 
 docs lint:
-  extends: .dedicated-runner
+  extends:
+    - .default-tags
+    - .default-retry
+    - .except-qa
   image: "registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-docs-lint"
   stage: test
-  cache: {}
   dependencies: []
-  before_script: []
   script:
     - scripts/lint-doc.sh
     - mv doc/ /tmp/gitlab-docs/content/$DOCS_GITLAB_REPO_SUFFIX
@@ -72,5 +83,3 @@ docs lint:
     - bundle exec nanoc check internal_links
     # Check the internal anchor links
     - bundle exec nanoc check internal_anchors
-  except:
-    - /(^qa[\/-].*|.*-qa$)/
diff --git a/.gitlab/ci/frontend.gitlab-ci.yml b/.gitlab/ci/frontend.gitlab-ci.yml
index 5c3278fcf53..df38cb4ff8e 100644
--- a/.gitlab/ci/frontend.gitlab-ci.yml
+++ b/.gitlab/ci/frontend.gitlab-ci.yml
@@ -1,23 +1,19 @@
-.assets-compile-cache: &assets-compile-cache
+.assets-compile-cache:
   cache:
-    key: "assets-compile:vendor_ruby:.yarn-cache:tmp_cache_assets_sprockets:v6"
     paths:
       - vendor/ruby/
       - .yarn-cache/
       - tmp/cache/assets/sprockets
 
-.use-pg: &use-pg
-  services:
-    - name: postgres:9.6.14
-      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
-    - name: redis:alpine
-
 .gitlab:assets:compile-metadata:
-  <<: *assets-compile-cache
-  extends: .dedicated-no-docs-pull-cache-job
+  extends:
+    - .default-tags
+    - .default-retry
+    - .assets-compile-cache
+    - .default-before_script
+    - .except-docs
   image: dev.gitlab.org:5005/gitlab/gitlab-build-images:ruby-2.6.3-git-2.22-chrome-73.0-node-12.x-yarn-1.16-graphicsmagick-1.3.33-docker-18.06.1
-  dependencies:
-    - setup-test-env
+  dependencies: ["setup-test-env"]
   services:
     - docker:19.03.0-dind
   variables:
@@ -30,6 +26,14 @@
     NODE_OPTIONS: --max_old_space_size=3584
     DOCKER_DRIVER: overlay2
     DOCKER_HOST: tcp://docker:2375
+  cache:
+    key: "assets-compile:production:vendor_ruby:.yarn-cache:tmp_cache_assets_sprockets:v6"
+  artifacts:
+    name: webpack-report
+    expire_in: 31d
+    paths:
+      - webpack-report/
+      - public/assets/
   script:
     - node --version
     - retry yarn install --frozen-lockfile --production --cache-folder .yarn-cache --prefer-offline
@@ -42,43 +46,41 @@
     - install_api_client_dependencies_with_apt
     - play_job "review-build-cng" || true  # this job might not exist so ignore the failure if it cannot be played
     - play_job "schedule:review-build-cng" || true  # this job might not exist so ignore the failure if it cannot be played
-  artifacts:
-    name: webpack-report
-    expire_in: 31d
-    paths:
-      - webpack-report/
-      - public/assets/
   only:
     - /.+/@gitlab-org/gitlab-ce
     - /.+/@gitlab-org/gitlab-ee
     - /.+/@gitlab/gitlabhq
     - /.+/@gitlab/gitlab-ee
   tags:
-    - docker
     - gitlab-org
+    - docker
 
 gitlab:assets:compile:
   extends: .gitlab:assets:compile-metadata
+  only:
+    refs:
+      - master@gitlab-org/gitlab-ce
+      - master@gitlab-org/gitlab-ee
   cache:
     policy: pull-push
-  only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
 
 gitlab:assets:compile pull-cache:
   extends: .gitlab:assets:compile-metadata
-  cache:
-    policy: pull
   except:
     refs:
       - master@gitlab-org/gitlab-ce
       - master@gitlab-org/gitlab-ee
       - /(^docs[\/-].+|.+-docs$)/
+  cache:
+    policy: pull
 
 .compile-assets-metadata:
-  extends: .dedicated-runner
-  <<: *use-pg
-  <<: *assets-compile-cache
+  extends:
+    - .default-tags
+    - .default-retry
+    - .assets-compile-cache
+    - .default-before_script
+    - .use-pg
   stage: prepare
   script:
     - node --version
@@ -89,6 +91,8 @@ gitlab:assets:compile pull-cache:
   variables:
     # we override the max_old_space_size to prevent OOM errors
     NODE_OPTIONS: --max_old_space_size=3584
+  cache:
+    key: "assets-compile:test:vendor_ruby:.yarn-cache:tmp_cache_assets_sprockets:v6"
   artifacts:
     expire_in: 7d
     paths:
@@ -96,30 +100,34 @@ gitlab:assets:compile pull-cache:
       - public/assets
 
 compile-assets:
-  extends: .compile-assets-metadata
+  extends:
+    - .compile-assets-metadata
+  only:
+    refs:
+      - master@gitlab-org/gitlab-ce
+      - master@gitlab-org/gitlab-ee
   cache:
     policy: pull-push
-  only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
 
 compile-assets pull-cache:
   extends: .compile-assets-metadata
-  cache:
-    policy: pull
   except:
     refs:
       - master@gitlab-org/gitlab-ce
       - master@gitlab-org/gitlab-ee
       - /(^docs[\/-].+|.+-docs$)/
+  cache:
+    policy: pull
 
 karma:
-  extends: .dedicated-no-docs-pull-cache-job
-  <<: *use-pg
-  dependencies:
-    - compile-assets
-    - compile-assets pull-cache
-    - setup-test-env
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs
+  dependencies: ["compile-assets", "compile-assets pull-cache", "setup-test-env"]
   variables:
     # we override the max_old_space_size to prevent OOM errors
     NODE_OPTIONS: --max_old_space_size=3584
@@ -142,12 +150,14 @@ karma:
       junit: junit_karma.xml
 
 jest:
-  extends: .dedicated-no-docs-and-no-qa-pull-cache-job
-  <<: *use-pg
-  dependencies:
-    - compile-assets
-    - compile-assets pull-cache
-    - setup-test-env
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  dependencies: ["compile-assets", "compile-assets pull-cache", "setup-test-env"]
   script:
     - scripts/gitaly-test-spawn
     - date
@@ -170,36 +180,41 @@ jest:
       - tmp/jest/jest/
     policy: pull-push
 
-qa:internal:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  services: []
-  script:
+.qa:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .except-docs
+  dependencies: ["setup-test-env"]
+  variables:
+    SETUP_DB: "false"
+  before_script:
     - cd qa/
     - bundle install
+
+qa:internal:
+  extends: .qa
+  script:
     - bundle exec rspec
-  dependencies:
-    - setup-test-env
 
 qa:selectors:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  services: []
+  extends: .qa
   script:
-    - cd qa/
-    - bundle install
     - bundle exec bin/qa Test::Sanity::Selectors
-  dependencies:
-    - setup-test-env
 
-.qa-frontend-node: &qa-frontend-node
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  stage: test
+.qa-frontend-node:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .except-docs
+  dependencies: []
   cache:
     key: "$CI_JOB_NAME"
     paths:
       - .yarn-cache/
     policy: pull-push
-  dependencies: []
-  before_script: []
   script:
     - date
     - yarn install --frozen-lockfile --cache-folder .yarn-cache --prefer-offline
@@ -207,23 +222,28 @@ qa:selectors:
     - yarn run webpack-prod
 
 qa-frontend-node:8:
-  <<: *qa-frontend-node
+  extends: .qa-frontend-node
   image: node:carbon
 
 qa-frontend-node:10:
-  <<: *qa-frontend-node
+  extends: .qa-frontend-node
   image: node:dubnium
 
 qa-frontend-node:latest:
-  <<: *qa-frontend-node
+  extends: .qa-frontend-node
   image: node:latest
   allow_failure: true
 
 lint:javascript:report:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .except-docs
+  variables:
+    SETUP_DB: "false"
   stage: post-test
   dependencies: []
-  before_script: []
   script:
     - date
     - yarn run eslint-report || true  # ignore exit code
@@ -234,12 +254,15 @@ lint:javascript:report:
       - eslint-report.html
 
 jsdoc:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .except-docs
+  variables:
+    SETUP_DB: "false"
   stage: post-test
-  dependencies:
-    - compile-assets
-    - compile-assets pull-cache
-  before_script: []
+  dependencies: ["compile-assets", "compile-assets pull-cache"]
   script:
     - date
     - yarn run jsdoc || true  # ignore exit code
diff --git a/.gitlab/ci/global.gitlab-ci.yml b/.gitlab/ci/global.gitlab-ci.yml
index 56fe9739d5f..04135447ca4 100644
--- a/.gitlab/ci/global.gitlab-ci.yml
+++ b/.gitlab/ci/global.gitlab-ci.yml
@@ -1,83 +1,56 @@
-.dedicated-runner:
+.default-tags:
+  tags:
+    - gitlab-org
+
+.default-retry:
   retry:
     max: 2  # This is confusing but this means "3 runs at max".
     when:
       - unknown_failure
       - api_failure
       - runner_system_failure
-  tags:
-    - gitlab-org
-
-.default-cache: &default-cache
-  key: "debian-stretch-ruby-2.6.3-node-12.x"
-  paths:
-    - vendor/ruby
-    - .yarn-cache/
-    - vendor/gitaly-ruby
 
-.dedicated-runner-default-cache:
-  extends: .dedicated-runner
-  cache:
-    <<: *default-cache
+.default-before_script:
+  before_script:
+    - date
+    - source scripts/utils.sh
+    - source scripts/prepare_build.sh
+    - date
 
 # Jobs that only need to pull cache
-.dedicated-pull-cache-job:
-  extends: .dedicated-runner
+.default-cache:
   cache:
-    <<: *default-cache
+    key: "debian-stretch-ruby-2.6.3-node-12.x"
+    paths:
+      - vendor/ruby
+      - .yarn-cache/
+      - vendor/gitaly-ruby
     policy: pull
-  stage: test
 
-.no-docs:
+.except-docs:
   except:
     refs:
       - /(^docs[\/-].+|.+-docs$)/
 
-.no-docs-and-no-qa:
+.except-qa:
   except:
     refs:
-      - /(^docs[\/-].+|.+-docs$)/
       - /(^qa[\/-].*|.*-qa$)/
 
-.dedicated-no-docs-pull-cache-job:
-  extends:
-    - .dedicated-pull-cache-job
-    - .no-docs
-
-.dedicated-no-docs-and-no-qa-pull-cache-job:
-  extends:
-    - .dedicated-pull-cache-job
-    - .no-docs-and-no-qa
-
-# Jobs that do not need a DB
-.dedicated-no-docs-no-db-pull-cache-job:
-  extends: .dedicated-no-docs-pull-cache-job
-  variables:
-    SETUP_DB: "false"
-
-# Jobs that need a dedicated runner, with no cache
-.dedicated-no-docs:
-  extends:
-    - .dedicated-runner
-    - .no-docs
+.except-docs-qa:
+  except:
+    refs:
+      - /(^docs[\/-].+|.+-docs$)/
+      - /(^qa[\/-].*|.*-qa$)/
 
-.single-script-job-dedicated-runner:
-  extends: .dedicated-runner
-  image: ruby:2.6-alpine
-  stage: test
-  cache: {}
-  dependencies: []
-  variables:
-    GIT_STRATEGY: none
-  before_script:
-    # We don't clone the repo by using GIT_STRATEGY: none and only download the
-    # single script we need here so it's much faster than cloning.
-    - export SCRIPT_NAME="${SCRIPT_NAME:-$CI_JOB_NAME}"
-    - apk add --update openssl
-    - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/$SCRIPT_NAME
-    - chmod 755 $(basename $SCRIPT_NAME)
+.except-docs-qa-geo:
+  except:
+    refs:
+      - /(^docs[\/-].+|.+-docs$)/
+      - /(^qa[\/-].*|.*-qa$)/
+      - /(^geo[\/-].*|.*-geo$)/
 
-.review-only: &review-only
+.review-only:
   only:
     refs:
       - branches@gitlab-org/gitlab-ce
@@ -88,3 +61,16 @@
       - master
       - /^\d+-\d+-auto-deploy-\d+$/
       - /(^docs[\/-].+|.+-docs$)/
+
+.use-pg:
+  services:
+    - name: postgres:9.6.14
+      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+    - name: redis:alpine
+
+.use-pg-10:
+  image: "dev.gitlab.org:5005/gitlab/gitlab-build-images:ruby-2.6.3-golang-1.11-git-2.22-chrome-73.0-node-12.x-yarn-1.16-postgresql-10-graphicsmagick-1.3.33"
+  services:
+    - name: postgres:10.9
+      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+    - name: redis:alpine
diff --git a/.gitlab/ci/memory.gitlab-ci.yml b/.gitlab/ci/memory.gitlab-ci.yml
index 9923732e587..1936933cca4 100644
--- a/.gitlab/ci/memory.gitlab-ci.yml
+++ b/.gitlab/ci/memory.gitlab-ci.yml
@@ -1,5 +1,12 @@
 memory-static:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .except-docs
+  variables:
+    SETUP_DB: "false"
   script:
     # Uses two different reports from the 'derailed_benchmars' gem.
 
@@ -23,7 +30,13 @@ memory-static:
 # The application is booted in `production` environment.
 # All tests are run without a webserver (directly using Rack::Mock by default).
 memory-on-boot:
-  extends: .rspec-metadata-pg-10
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg-10
+    - .except-docs-qa
   variables:
     NODE_ENV: "production"
     RAILS_ENV: "production"
diff --git a/.gitlab/ci/pages.gitlab-ci.yml b/.gitlab/ci/pages.gitlab-ci.yml
index f7b18b809b4..3247d7c4bce 100644
--- a/.gitlab/ci/pages.gitlab-ci.yml
+++ b/.gitlab/ci/pages.gitlab-ci.yml
@@ -1,13 +1,15 @@
 pages:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  before_script: []
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .except-docs
+  only:
+    refs:
+      - master@gitlab-org/gitlab-ce
+      - master@gitlab-org/gitlab-ee
   stage: pages
-  dependencies:
-    - coverage
-    - karma
-    - gitlab:assets:compile
-    - lint:javascript:report
-    - jsdoc
+  dependencies: ["coverage", "karma", "gitlab:assets:compile", "lint:javascript:report", "jsdoc"]
   script:
     - mv public/ .public/
     - mkdir public/
@@ -21,6 +23,3 @@ pages:
   artifacts:
     paths:
       - public
-  only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
diff --git a/.gitlab/ci/qa.gitlab-ci.yml b/.gitlab/ci/qa.gitlab-ci.yml
index 69b932801ad..ac2a70dda0b 100644
--- a/.gitlab/ci/qa.gitlab-ci.yml
+++ b/.gitlab/ci/qa.gitlab-ci.yml
@@ -1,10 +1,8 @@
 .package-and-qa-base:
   image: ruby:2.6-alpine
   stage: qa
-  before_script: []
   needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
   dependencies: []
-  cache: {}
   variables:
     GIT_DEPTH: "1"
   retry: 0
@@ -19,7 +17,9 @@
     - master
 
 package-and-qa-manual:
-  extends: .package-and-qa-base
+  extends:
+    - .package-and-qa-base
+    - .except-docs-qa
   when: manual
   except:
     - master
diff --git a/.gitlab/ci/rails.gitlab-ci.yml b/.gitlab/ci/rails.gitlab-ci.yml
index 50476b43dd6..2e8b197829b 100644
--- a/.gitlab/ci/rails.gitlab-ci.yml
+++ b/.gitlab/ci/rails.gitlab-ci.yml
@@ -1,52 +1,31 @@
-.use-pg: &use-pg
-  services:
-    - name: postgres:9.6.14
-      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
-    - name: redis:alpine
-
-.use-pg-10: &use-pg-10
-  services:
-    - name: postgres:10.9
-      command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
-    - name: redis:alpine
-
-.only-schedules-master: &only-schedules-master
+.only-schedules-master:
   only:
-    - schedules@gitlab-org/gitlab-ce
-    - schedules@gitlab-org/gitlab-ee
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
-    - master@gitlab/gitlabhq
-    - master@gitlab/gitlab-ee
+    refs:
+      - schedules@gitlab-org/gitlab-ce
+      - schedules@gitlab-org/gitlab-ee
+      - master@gitlab-org/gitlab-ce
+      - master@gitlab-org/gitlab-ee
+      - master@gitlab/gitlabhq
+      - master@gitlab/gitlab-ee
 
-.gitlab-setup: &gitlab-setup
+.rake-exec:
   extends:
-    - .dedicated-no-docs-and-no-qa-pull-cache-job
-    - .use-pg
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
   variables:
     SETUP_DB: "false"
-  script:
-    # Manually clone gitlab-test and only seed this project in
-    # db/fixtures/development/04_project.rb thanks to SIZE=1 below
-    - git clone https://gitlab.com/gitlab-org/gitlab-test.git
-       /home/git/repositories/gitlab-org/gitlab-test.git
-    - scripts/gitaly-test-spawn
-    - force=yes SIZE=1 FIXTURE_PATH="db/fixtures/development" bundle exec rake gitlab:setup
-  artifacts:
-    when: on_failure
-    expire_in: 1d
-    paths:
-      - log/development.log
-
-.rake-exec: &rake-exec
-  extends: .dedicated-no-docs-no-db-pull-cache-job
   script:
     - bundle exec rake $CI_JOB_NAME
 
-.rspec-metadata: &rspec-metadata
+.rspec-base:
   extends:
-    - .dedicated-pull-cache-job
-    - .no-docs-and-no-qa
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .except-docs-qa
   stage: test
   script:
     - JOB_NAME=( $CI_JOB_NAME )
@@ -83,52 +62,24 @@
     reports:
       junit: junit_rspec.xml
 
-.rspec-metadata-pg: &rspec-metadata-pg
-  <<: *rspec-metadata
-  <<: *use-pg
-
-.rspec-metadata-pg-10: &rspec-metadata-pg-10
-  <<: *rspec-metadata
-  <<: *use-pg-10
-  image: "dev.gitlab.org:5005/gitlab/gitlab-build-images:ruby-2.6.3-golang-1.11-git-2.22-chrome-73.0-node-12.x-yarn-1.16-postgresql-10-graphicsmagick-1.3.33"
-
-# DB migration, rollback, and seed jobs
-.db-migrate-reset: &db-migrate-reset
-  extends: .dedicated-no-docs-and-no-qa-pull-cache-job
-  script:
-    - bundle exec rake db:migrate:reset
-  dependencies:
-    - setup-test-env
+.rspec-base-pg:
+  extends:
+    - .rspec-base
+    - .use-pg
 
-.migration-paths: &migration-paths
-  extends: .dedicated-no-docs-and-no-qa-pull-cache-job
-  variables:
-    SETUP_DB: "false"
-  script:
-    - git fetch https://gitlab.com/gitlab-org/gitlab-ce.git v11.11.0
-    - git checkout -f FETCH_HEAD
-    - sed -i "s/gem 'oj', '~> 2.17.4'//" Gemfile
-    - sed -i "s/gem 'bootsnap', '~> 1.0.0'/gem 'bootsnap'/" Gemfile
-    - bundle update google-protobuf grpc bootsnap
-    - bundle install $BUNDLE_INSTALL_FLAGS
-    - date
-    - cp config/gitlab.yml.example config/gitlab.yml
-    - bundle exec rake db:drop db:create db:schema:load db:seed_fu
-    - date
-    - git checkout -f $CI_COMMIT_SHA
-    - bundle install $BUNDLE_INSTALL_FLAGS
-    - date
-    - . scripts/prepare_build.sh
-    - date
-    - bundle exec rake db:migrate
-  dependencies:
-    - setup-test-env
+.rspec-base-pg-10:
+  extends:
+    - .rspec-base
+    - .use-pg-10
 
 setup-test-env:
   extends:
-    - .dedicated-runner-default-cache
-    - .no-docs
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
     - .use-pg
+    - .except-docs
   stage: prepare
   script:
     - bundle exec ruby -Ispec -e 'require "spec_helper" ; TestEnv.init'
@@ -141,67 +92,72 @@ setup-test-env:
       - vendor/gitaly-ruby
 
 rspec unit pg:
-  <<: *rspec-metadata-pg
+  extends: .rspec-base-pg
   parallel: 20
 
 rspec integration pg:
-  <<: *rspec-metadata-pg
+  extends: .rspec-base-pg
   parallel: 6
 
 rspec system pg:
-  <<: *rspec-metadata-pg
+  extends: .rspec-base-pg
   parallel: 24
 
 rspec unit pg-10:
-  <<: *rspec-metadata-pg-10
-  <<: *only-schedules-master
+  extends:
+    - .rspec-base-pg-10
+    - .only-schedules-master
   parallel: 20
 
 rspec integration pg-10:
-  <<: *rspec-metadata-pg-10
-  <<: *only-schedules-master
+  extends:
+    - .rspec-base-pg-10
+    - .only-schedules-master
   parallel: 6
 
 rspec system pg-10:
-  <<: *rspec-metadata-pg-10
-  <<: *only-schedules-master
+  extends:
+    - .rspec-base-pg-10
+    - .only-schedules-master
   parallel: 24
 
 rspec-fast-spec-helper:
-  <<: *rspec-metadata-pg
+  extends: .rspec-base-pg
   script:
     - bundle exec rspec spec/fast_spec_helper.rb
 
-.rspec-quarantine: &rspec-quarantine
-  <<: *only-schedules-master
+rspec quarantine pg:
+  extends:
+    - .default-before_script
+    - .rspec-base-pg
+    - .only-schedules-master
   script:
-    - export CACHE_CLASSES=true
+    - export NO_KNAPSACK=1 CACHE_CLASSES=true
     - scripts/gitaly-test-spawn
     - bin/rspec --color --format documentation --tag quarantine -- spec/
-
-rspec quarantine pg:
-  <<: *rspec-metadata-pg
-  <<: *rspec-quarantine
   allow_failure: true
 
 static-analysis:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
-  dependencies:
-    - compile-assets
-    - compile-assets pull-cache
-    - setup-test-env
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .except-docs
+  dependencies: ["setup-test-env", "compile-assets", "compile-assets pull-cache"]
+  variables:
+    SETUP_DB: "false"
   script:
     - scripts/static-analysis
   cache:
-    key: "debian-stretch-ruby-2.6.3-node-12.x-and-rubocop"
+    key: "debian-stretch-ruby-2.6.3-and-rubocop"
     paths:
       - vendor/ruby
-      - .yarn-cache/
       - tmp/rubocop_cache
     policy: pull-push
 
 downtime_check:
-  <<: *rake-exec
+  extends: .rake-exec
   except:
     refs:
       - master
@@ -209,22 +165,20 @@ downtime_check:
       - /^[\d-]+-stable(-ee)?$/
       - /(^docs[\/-].+|.+-docs$)/
       - /(^qa[\/-].*|.*-qa$)/
-  dependencies:
-    - setup-test-env
+  dependencies: ["setup-test-env"]
 
 ee_compat_check:
-  <<: *rake-exec
+  extends: .rake-exec
   dependencies: []
   except:
     refs:
       - master
       - tags
-      - /[\d-]+-stable(-ee)?/
-      - /^security-/
       - branches@gitlab-org/gitlab-ee
       - branches@gitlab/gitlab-ee
+      - /^[\d-]+-stable(-ee)?$/
       - /(^docs[\/-].+|.+-docs$)/
-  retry: 0
+      - /^security-/
   artifacts:
     name: "${CI_JOB_NAME}_${CI_COMIT_REF_NAME}_${CI_COMMIT_SHA}"
     when: always
@@ -232,44 +186,106 @@ ee_compat_check:
     paths:
       - ee_compat_check/patches/*.patch
 
-db:migrate:reset-pg:
-  <<: *db-migrate-reset
-  <<: *use-pg
+# DB migration, rollback, and seed jobs
+db:migrate:reset:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  dependencies: ["setup-test-env"]
+  script:
+    - bundle exec rake db:migrate:reset
 
-db:check-schema-pg:
-  <<: *db-migrate-reset
-  <<: *use-pg
+db:check-schema:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  dependencies: ["setup-test-env"]
   script:
     - source scripts/schema_changed.sh
 
-migration:path-pg:
-  <<: *migration-paths
-  <<: *use-pg
+db:migrate-from-v11.11.0:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  dependencies: ["setup-test-env"]
+  variables:
+    SETUP_DB: "false"
+  script:
+    - git fetch https://gitlab.com/gitlab-org/gitlab-ce.git v11.11.0
+    - git checkout -f FETCH_HEAD
+    - sed -i "s/gem 'oj', '~> 2.17.4'//" Gemfile
+    - sed -i "s/gem 'bootsnap', '~> 1.0.0'/gem 'bootsnap'/" Gemfile
+    - bundle update google-protobuf grpc bootsnap
+    - bundle install $BUNDLE_INSTALL_FLAGS
+    - date
+    - cp config/gitlab.yml.example config/gitlab.yml
+    - bundle exec rake db:drop db:create db:schema:load db:seed_fu
+    - date
+    - git checkout -f $CI_COMMIT_SHA
+    - bundle install $BUNDLE_INSTALL_FLAGS
+    - date
+    - . scripts/prepare_build.sh
+    - date
+    - bundle exec rake db:migrate
 
-.db-rollback: &db-rollback
-  extends: .dedicated-no-docs-and-no-qa-pull-cache-job
+db:rollback:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  dependencies: ["setup-test-env"]
   script:
     - bundle exec rake db:migrate VERSION=20180101160629
     - bundle exec rake db:migrate SKIP_SCHEMA_VERSION_CHECK=true
-  dependencies:
-    - setup-test-env
-
-db:rollback-pg:
-  <<: *db-rollback
-  <<: *use-pg
 
-gitlab:setup-pg:
-  <<: *gitlab-setup
-  <<: *use-pg
-  dependencies:
-    - setup-test-env
+gitlab:setup:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  dependencies: ["setup-test-env"]
+  variables:
+    SETUP_DB: "false"
+  script:
+    # Manually clone gitlab-test and only seed this project in
+    # db/fixtures/development/04_project.rb thanks to SIZE=1 below
+    - git clone https://gitlab.com/gitlab-org/gitlab-test.git
+       /home/git/repositories/gitlab-org/gitlab-test.git
+    - scripts/gitaly-test-spawn
+    - force=yes SIZE=1 FIXTURE_PATH="db/fixtures/development" bundle exec rake gitlab:setup
+  artifacts:
+    when: on_failure
+    expire_in: 1d
+    paths:
+      - log/development.log
 
 coverage:
   # Don't include dedicated-no-docs-no-db-pull-cache-job here since we need to
   # download artifacts from all the rspec jobs instead of from setup-test-env only
   extends:
-    - .dedicated-runner-default-cache
-    - .no-docs-and-no-qa
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .except-docs-qa
   cache:
     policy: pull
   variables:
diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index e3768ecf2a2..905f1ede2c4 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -4,36 +4,29 @@ include:
   - template: Security/Dependency-Scanning.gitlab-ci.yml
   - template: Security/DAST.gitlab-ci.yml
 
+.reports:
+  extends:
+    - .default-retry
+    - .except-docs
+  tags:
+    - gitlab-org
+    - docker
+
 code_quality:
-  extends: .dedicated-no-docs
-  # gitlab-org runners set `privileged: false` but we need to have it set to true
-  # since we're using Docker in Docker
-  tags: []
-  before_script: []
-  cache: {}
+  extends: .reports
 
 sast:
-  extends: .dedicated-no-docs
-  tags: []
-  before_script: []
-  cache: {}
+  extends: .reports
   variables:
     SAST_BRAKEMAN_LEVEL: 2
     SAST_EXCLUDED_PATHS: qa,spec,doc
 
 dependency_scanning:
-  extends: .dedicated-no-docs
-  tags: []
-  before_script: []
-  cache: {}
+  extends: .reports
 
 dast:
-  extends:
-    - .dedicated-runner
-    - .review-only
+  extends: .reports
   stage: qa
-  dependencies:
-    - review-deploy
+  dependencies: ["review-deploy"]
   before_script:
     - export DAST_WEBSITE="$(cat review_app_url.txt)"
-  cache: {}
diff --git a/.gitlab/ci/review.gitlab-ci.yml b/.gitlab/ci/review.gitlab-ci.yml
index beb049c0b3b..3415f1b6ab4 100644
--- a/.gitlab/ci/review.gitlab-ci.yml
+++ b/.gitlab/ci/review.gitlab-ci.yml
@@ -1,4 +1,4 @@
-.review-schedules-only: &review-schedules-only
+.review-schedules-only:
   only:
     refs:
       - schedules@gitlab-org/gitlab-ce
@@ -11,39 +11,39 @@
       - tags
       - /(^docs[\/-].+|.+-docs$)/
 
-.review-base: &review-base
+.review-base:
   extends:
-    - .dedicated-runner
+    - .default-tags
+    - .default-retry
     - .review-only
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-charts-build-base
-  cache: {}
   dependencies: []
   before_script:
     - source scripts/utils.sh
 
-.review-docker: &review-docker
-  <<: *review-base
+.review-docker:
+  extends: .review-base
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-qa-alpine
   services:
     - docker:19.03.0-dind
   tags:
     - gitlab-org
     - docker
-  variables: &review-docker-variables
+  variables:
     DOCKER_DRIVER: overlay2
     DOCKER_HOST: tcp://docker:2375
     LATEST_QA_IMAGE: "gitlab/${CI_PROJECT_NAME}-qa:nightly"
     QA_IMAGE: "${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab/${CI_PROJECT_NAME}-qa:${CI_COMMIT_REF_SLUG}"
 
 build-qa-image:
-  <<: *review-docker
+  extends: .review-docker
   stage: test
   script:
     - time docker build --cache-from ${LATEST_QA_IMAGE} --tag ${QA_IMAGE} --file ./qa/Dockerfile ./
     - echo "${CI_JOB_TOKEN}" | docker login --username gitlab-ci-token --password-stdin ${CI_REGISTRY}
     - time docker push ${QA_IMAGE}
 
-.review-build-cng-base: &review-build-cng-base
+.review-build-cng-base:
   image: ruby:2.6-alpine
   stage: test
   when: manual
@@ -52,20 +52,21 @@ build-qa-image:
     - install_api_client_dependencies_with_apk
     - install_gitlab_gem
   dependencies: []
-  cache: {}
   script:
     - BUILD_TRIGGER_TOKEN=$REVIEW_APPS_BUILD_TRIGGER_TOKEN ./scripts/trigger-build cng
 
 review-build-cng:
-  extends: .review-only
-  <<: *review-build-cng-base
+  extends:
+    - .review-build-cng-base
+    - .review-only
 
 schedule:review-build-cng:
-  <<: *review-schedules-only
-  <<: *review-build-cng-base
+  extends:
+    - .review-build-cng-base
+    - .review-schedules-only
 
-.review-deploy-base: &review-deploy-base
-  <<: *review-base
+review-deploy:
+  extends: .review-base
   allow_failure: true
   retry: 1
   stage: review
@@ -73,7 +74,7 @@ schedule:review-build-cng:
     HOST_SUFFIX: "${CI_ENVIRONMENT_SLUG}"
     DOMAIN: "-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}"
     GITLAB_HELM_CHART_REF: "master"
-  environment: &review-environment
+  environment:
     name: review/${CI_COMMIT_REF_NAME}
     url: https://gitlab-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}
     on_stop: review-stop
@@ -98,50 +99,45 @@ schedule:review-build-cng:
     expire_in: 2 days
     when: always
 
-review-deploy:
-  <<: *review-deploy-base
-
 schedule:review-deploy:
-  <<: *review-deploy-base
-  <<: *review-schedules-only
+  extends:
+    - review-deploy
+    - .review-schedules-only
 
 review-stop:
-  extends:
-    - .single-script-job-dedicated-runner
-    - .review-only
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-charts-build-base
-  stage: review
+  extends: review-deploy
   when: manual
-  allow_failure: true
-  variables:
-    SCRIPT_NAME: review_apps/review-apps.sh
   environment:
-    <<: *review-environment
     action: stop
-  script:
+  variables:
+    GIT_STRATEGY: none
+  before_script:
+    # We don't clone the repo by using GIT_STRATEGY: none and only download the
+    # single script we need here so it's much faster than cloning.
+    - apk add --update openssl
+    - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/review_apps/review-apps.sh
     - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/utils.sh
     - source utils.sh
-    - source $(basename $SCRIPT_NAME)
+    - source review-apps.sh
+  script:
     - delete
+  artifacts: {}
 
-.review-qa-base: &review-qa-base
-  <<: *review-docker
-  allow_failure: true
+.review-qa-base:
+  extends: .review-docker
   retry: 2
   stage: qa
   variables:
-    <<: *review-docker-variables
     QA_ARTIFACTS_DIR: "${CI_PROJECT_DIR}/qa"
     QA_CAN_TEST_GIT_PROTOCOL_V2: "false"
+    QA_DEBUG: "true"
     GITLAB_USERNAME: "root"
     GITLAB_PASSWORD: "${REVIEW_APPS_ROOT_PASSWORD}"
     GITLAB_ADMIN_USERNAME: "root"
     GITLAB_ADMIN_PASSWORD: "${REVIEW_APPS_ROOT_PASSWORD}"
     GITHUB_ACCESS_TOKEN: "${REVIEW_APPS_QA_GITHUB_ACCESS_TOKEN}"
     EE_LICENSE: "${REVIEW_APPS_EE_LICENSE}"
-    QA_DEBUG: "true"
-  dependencies:
-    - review-deploy
+  dependencies: ["review-deploy"]
   artifacts:
     paths:
       - ./qa/gitlab-qa-run-*
@@ -156,12 +152,13 @@ review-stop:
     - gem install gitlab-qa --no-document ${GITLAB_QA_VERSION:+ --version ${GITLAB_QA_VERSION}}
 
 review-qa-smoke:
-  <<: *review-qa-base
+  extends: .review-qa-base
+  allow_failure: true
   script:
     - gitlab-qa Test::Instance::Smoke "${QA_IMAGE}" "${CI_ENVIRONMENT_URL}"
 
 review-qa-all:
-  <<: *review-qa-base
+  extends: .review-qa-base
   allow_failure: true
   when: manual
   parallel: 5
@@ -172,21 +169,16 @@ review-qa-all:
 
 parallel-spec-reports:
   extends:
-    - .dedicated-runner
-    - .no-docs
-  dependencies:
-    - review-qa-all
+    - .default-tags
+    - .except-docs
   image: ruby:2.6-alpine
-  services: []
-  before_script: []
+  stage: post-test
+  dependencies: ["review-qa-all"]
   variables:
-    SETUP_DB: "false"
     NEW_PARALLEL_SPECS_REPORT: qa/report-new.html
     BASE_ARTIFACT_URL: "${CI_PROJECT_URL}/-/jobs/${CI_JOB_ID}/artifacts/file/qa/"
-  stage: post-test
   allow_failure: true
   when: manual
-  retry: 0
   artifacts:
     when: always
     paths:
@@ -196,15 +188,15 @@ parallel-spec-reports:
       junit: qa/gitlab-qa-run-*/**/rspec-*.xml
   script:
     - apk add --update build-base libxml2-dev libxslt-dev && rm -rf /var/cache/apk/*
-    - gem install nokogiri
+    - gem install nokogiri --no-document
     - cd qa/gitlab-qa-run-*/gitlab-*
     - ARTIFACT_DIRS=$(pwd |rev| awk -F / '{print $1,$2}' | rev | sed s_\ _/_)
-    - cd ../../..
+    - cd -
     - '[[ -f $NEW_PARALLEL_SPECS_REPORT ]] || echo "{}" > ${NEW_PARALLEL_SPECS_REPORT}'
     - scripts/merge-html-reports ${NEW_PARALLEL_SPECS_REPORT} ${BASE_ARTIFACT_URL}${ARTIFACT_DIRS} qa/gitlab-qa-run-*/**/rspec.htm
 
-.review-performance-base: &review-performance-base
-  <<: *review-qa-base
+review-performance:
+  extends: .review-qa-base
   allow_failure: true
   before_script:
     - export CI_ENVIRONMENT_URL="$(cat review_app_url.txt)"
@@ -222,18 +214,16 @@ parallel-spec-reports:
     reports:
       performance: performance.json
 
-review-performance:
-  <<: *review-performance-base
-
 schedule:review-performance:
-  <<: *review-performance-base
-  <<: *review-schedules-only
-  dependencies:
-    - schedule:review-deploy
+  extends:
+    - review-performance
+    - .review-schedules-only
+  dependencies: ["schedule:review-deploy"]
 
 schedule:review-cleanup:
-  <<: *review-base
-  <<: *review-schedules-only
+  extends:
+    - .review-base
+    - .review-schedules-only
   stage: build
   allow_failure: true
   environment:
@@ -246,11 +236,13 @@ schedule:review-cleanup:
     - ruby -rrubygems scripts/review_apps/automated_cleanup.rb
 
 danger-review:
-  extends: .dedicated-pull-cache-job
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:danger
   stage: test
   dependencies: []
-  before_script: []
   only:
     variables:
       - $DANGER_GITLAB_API_TOKEN
@@ -259,9 +251,8 @@ danger-review:
       - master
       - /^\d+-\d+-auto-deploy-\d+$/
       - /^[\d-]+-stable(-ee)?$/
-    variables:
-      - $CI_COMMIT_REF_NAME =~ /^ce-to-ee-.*/
-      - $CI_COMMIT_REF_NAME =~ /.*-stable(-ee)?-prepare-.*/
+      - /^ce-to-ee-.*/
+      - /.*-stable(-ee)?-prepare-.*/
   script:
     - git version
     - node --version
diff --git a/.gitlab/ci/setup.gitlab-ci.yml b/.gitlab/ci/setup.gitlab-ci.yml
index c1fc3a893ca..d9384780356 100644
--- a/.gitlab/ci/setup.gitlab-ci.yml
+++ b/.gitlab/ci/setup.gitlab-ci.yml
@@ -1,41 +1,42 @@
 # Insurance in case a gem needed by one of our releases gets yanked from
 # rubygems.org in the future.
 cache gems:
-  extends: .dedicated-no-docs-no-db-pull-cache-job
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .except-docs
+  dependencies: ["setup-test-env"]
+  variables:
+    SETUP_DB: "false"
   script:
     - bundle package --all --all-platforms
   artifacts:
     paths:
       - vendor/cache
   only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
-    - tags
-  dependencies:
-    - setup-test-env
+    refs:
+      - master@gitlab-org/gitlab-ce
+      - master@gitlab-org/gitlab-ee
+      - tags
 
-gitlab_git_test:
+.minimal-job:
   extends:
-    - .dedicated-runner
-    - .no-docs-and-no-qa
-  variables:
-    SETUP_DB: "false"
-  before_script: []
+    - .default-tags
+    - .default-retry
+    - .except-docs-qa
   dependencies: []
-  cache: {}
+
+gitlab_git_test:
+  extends: .minimal-job
   script:
     - spec/support/prepare-gitlab-git-test-for-commit --check-for-changes
 
 no_ee_check:
-  extends:
-    - .dedicated-runner
-    - .no-docs-and-no-qa
-  variables:
-    SETUP_DB: "false"
-  before_script: []
-  dependencies: []
-  cache: {}
+  extends: .minimal-job
   script:
     - scripts/no-ee-check
   only:
-    - /.+/@gitlab-org/gitlab-ce
+    refs:
+      - branches@gitlab-org/gitlab-ce
diff --git a/.gitlab/ci/test-metadata.gitlab-ci.yml b/.gitlab/ci/test-metadata.gitlab-ci.yml
index 4c97a4feb18..b9dac64957e 100644
--- a/.gitlab/ci/test-metadata.gitlab-ci.yml
+++ b/.gitlab/ci/test-metadata.gitlab-ci.yml
@@ -1,5 +1,4 @@
-.tests-metadata-state: &tests-metadata-state
-  extends: .dedicated-runner
+.tests-metadata-state:
   variables:
     TESTS_METADATA_S3_BUCKET: "gitlab-ce-cache"
   before_script:
@@ -14,7 +13,7 @@
 retrieve-tests-metadata:
   extends:
     - .tests-metadata-state
-    - .no-docs-and-no-qa
+    - .except-docs-qa
   stage: prepare
   cache:
     key: tests_metadata
@@ -29,7 +28,7 @@ retrieve-tests-metadata:
     - '[[ -f $FLAKY_RSPEC_SUITE_REPORT_PATH ]] || echo "{}" > ${FLAKY_RSPEC_SUITE_REPORT_PATH}'
 
 update-tests-metadata:
-  <<: *tests-metadata-state
+  extends: .tests-metadata-state
   stage: post-test
   cache:
     key: tests_metadata
@@ -49,25 +48,24 @@ update-tests-metadata:
     - rm -f rspec_flaky/all_*.json rspec_flaky/new_*.json
     - scripts/insert-rspec-profiling-data
   only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
-    - master@gitlab/gitlabhq
-    - master@gitlab/gitlab-ee
+    refs:
+      - master@gitlab-org/gitlab-ce
+      - master@gitlab-org/gitlab-ee
+      - master@gitlab/gitlabhq
+      - master@gitlab/gitlab-ee
 
 flaky-examples-check:
-  extends: .dedicated-runner
+  extends:
+    - .default-tags
+    - .default-retry
   image: ruby:2.6-alpine
-  services: []
-  before_script: []
+  stage: post-test
   variables:
-    SETUP_DB: "false"
-    USE_BUNDLE_INSTALL: "false"
     NEW_FLAKY_SPECS_REPORT: rspec_flaky/report-new.json
-  stage: post-test
   allow_failure: true
-  retry: 0
   only:
-    - branches
+    refs:
+      - branches
   except:
     refs:
       - master
diff --git a/.gitlab/ci/yaml.gitlab-ci.yml b/.gitlab/ci/yaml.gitlab-ci.yml
index b7aa418d8f7..3e107b475c9 100644
--- a/.gitlab/ci/yaml.gitlab-ci.yml
+++ b/.gitlab/ci/yaml.gitlab-ci.yml
@@ -1,9 +1,10 @@
 # Yamllint of *.yml for .gitlab-ci.yml.
 # This uses rules from project root `.yamllint`.
 lint-ci-gitlab:
-  extends: .dedicated-runner
-  before_script: []
-  dependencies: []
+  extends:
+    - .default-tags
+    - .default-retry
   image: sdesbure/yamllint:latest
+  dependencies: []
   script:
     - yamllint .gitlab-ci.yml .gitlab/ci lib/gitlab/ci/templates changelogs
-- 
cgit v1.2.1


From 5095e0cfe31a21d2b3b951b6b47613609bb3e645 Mon Sep 17 00:00:00 2001
From: Jacob Vosmaer <jacob@gitlab.com>
Date: Mon, 26 Aug 2019 20:51:15 +0000
Subject: Add documentation about Gitaly concurrency limiter

---
 doc/administration/gitaly/index.md | 41 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/doc/administration/gitaly/index.md b/doc/administration/gitaly/index.md
index dd3cc796ef2..daec5f14e36 100644
--- a/doc/administration/gitaly/index.md
+++ b/doc/administration/gitaly/index.md
@@ -518,6 +518,47 @@ One current feature of GitLab that still requires a shared directory (NFS) is
 There is [work in progress](https://gitlab.com/gitlab-org/gitlab-pages/issues/196)
 to eliminate the need for NFS to support GitLab Pages.
 
+## Limiting RPC concurrency
+
+It can happen that CI clone traffic puts a large strain on your Gitaly
+service. The bulk of the work gets done in the SSHUploadPack (for Git
+SSH) and PostUploadPack (for Git HTTP) RPC's. To prevent such workloads
+from overcrowding your Gitaly server you can set concurrency limits in
+Gitaly's configuration file.
+
+```ruby
+# in /etc/gitlab/gitlab.rb
+
+gitaly['concurrency'] = [
+  {
+    'rpc' => "/gitaly.SmartHTTPService/PostUploadPack",
+    'max_per_repo' => 20
+  },
+  {
+    'rpc' => "/gitaly.SSHService/SSHUploadPack",
+    'max_per_repo' => 20
+  }
+]
+```
+This will limit the number of in-flight RPC calls for the given RPC's.
+The limit is applied per repository. In the example above, each on the
+Gitaly server can have at most 20 simultaneous PostUploadPack calls in
+flight, and the same for SSHUploadPack. If another request comes in for
+a repository that hase used up its 20 slots, that request will get
+queued.
+
+You can observe the behavior of this queue via the Gitaly logs and via
+Prometheus. In the Gitaly logs, you can look for the string (or
+structured log field) `acquire_ms`. Messages that have this field are
+reporting about the concurrency limiter. In Prometheus, look for the
+`gitaly_rate_limiting_in_progress`, `gitaly_rate_limiting_queued` and
+`gitaly_rate_limiting_seconds` metrics.
+
+The name of the Prometheus metric is not quite right because this is a
+concurrency limiter, not a rate limiter. If a client makes 1000 requests
+in a row in a very short timespan, the concurrency will not exceed 1,
+and this mechanism (the concurrency limiter) will do nothing.
+
 ## Troubleshooting Gitaly
 
 ### Commits, pushes, and clones return a 401
-- 
cgit v1.2.1


From 1679d202cbed9e1f5ce7939db4b036fc0e5f9718 Mon Sep 17 00:00:00 2001
From: Russell Dickenson <rdickenson@gitlab.com>
Date: Mon, 26 Aug 2019 20:56:42 +0000
Subject: Added note that Multiple Issue Boards moved tiers.

---
 doc/user/index.md               |  2 +-
 doc/user/project/index.md       |  4 ++--
 doc/user/project/issue_board.md | 30 +++++++++++-------------------
 3 files changed, 14 insertions(+), 22 deletions(-)

diff --git a/doc/user/index.md b/doc/user/index.md
index c93f64cd528..27e75189fc3 100644
--- a/doc/user/index.md
+++ b/doc/user/index.md
@@ -53,7 +53,7 @@ With GitLab Enterprise Edition, you can also:
 - Improve collaboration with
   [Merge Request Approvals](project/merge_requests/index.md#merge-request-approvals-starter),
   [Multiple Assignees for Issues](project/issues/multiple_assignees_for_issues.md),
-  and [Multiple Issue Boards](project/issue_board.md#multiple-issue-boards-starter).
+  and [Multiple Issue Boards](project/issue_board.md#multiple-issue-boards).
 - Create formal relationships between issues with [Related Issues](project/issues/related_issues.md).
 - Use [Burndown Charts](project/milestones/burndown_charts.md) to track progress during a sprint or while working on a new version of their software.
 - Leverage [Elasticsearch](../integration/elasticsearch.md) with [Advanced Global Search](search/advanced_global_search.md) and [Advanced Syntax Search](search/advanced_search_syntax.md) for faster, more advanced code search across your entire GitLab instance.
diff --git a/doc/user/project/index.md b/doc/user/project/index.md
index 932e7fd10b2..64c4066683b 100644
--- a/doc/user/project/index.md
+++ b/doc/user/project/index.md
@@ -17,7 +17,7 @@ When you create a project in GitLab, you'll have access to a large number of
 
 - [Issue tracker](issues/index.md): Discuss implementations with your team within issues
   - [Issue Boards](issue_board.md): Organize and prioritize your workflow
-  - [Multiple Issue Boards](issue_board.md#multiple-issue-boards-starter): Allow your teams to create their own workflows (Issue Boards) for the same project **(STARTER)**
+  - [Multiple Issue Boards](issue_board.md#multiple-issue-boards): Allow your teams to create their own workflows (Issue Boards) for the same project
 - [Repositories](repository/index.md): Host your code in a fully
   integrated platform
   - [Branches](repository/branches/index.md): use Git branching strategies to
@@ -34,7 +34,7 @@ When you create a project in GitLab, you'll have access to a large number of
 
 - [Issue tracker](issues/index.md): Discuss implementations with your team within issues
   - [Issue Boards](issue_board.md): Organize and prioritize your workflow
-  - [Multiple Issue Boards](issue_board.md#multiple-issue-boards-starter): Allow your teams to create their own workflows (Issue Boards) for the same project **(STARTER)**
+  - [Multiple Issue Boards](issue_board.md#multiple-issue-boards): Allow your teams to create their own workflows (Issue Boards) for the same project
 - [Merge Requests](merge_requests/index.md): Apply your branching
   strategy and get reviewed by your team
   - [Merge Request Approvals](merge_requests/merge_request_approvals.md): Ask for approval before
diff --git a/doc/user/project/issue_board.md b/doc/user/project/issue_board.md
index eaca5f8cfb8..519c02cf0ad 100644
--- a/doc/user/project/issue_board.md
+++ b/doc/user/project/issue_board.md
@@ -13,7 +13,7 @@ keeping everything in the same place, so that you don't need to jump
 between different platforms to organize your workflow.
 
 With GitLab Issue Boards, you organize your issues in lists that correspond to
-their assigned labels, visualizing issues designed as cards throughout that lists.
+their assigned labels, visualizing issues designed as cards throughout those lists.
 
 You define your process and GitLab organizes it for you. You add your labels
 then create the corresponding list to pull in your existing issues. When
@@ -27,12 +27,9 @@ Issue Boards** (version introduced in GitLab 8.11 - August 2016).
 
 ### Advanced features of Issue Boards
 
-With [GitLab Starter](https://about.gitlab.com/pricing/), you can create
-[multiple issue boards](#multiple-issue-boards-starter) for a given project. **(STARTER)**
-
-With [GitLab Premium](https://about.gitlab.com/pricing/), you can also create multiple
-issue boards for your groups, and add lists for [assignees](#assignee-lists-premium) and
-[milestones](#milestone-lists-premium). **(PREMIUM)**
+- Create multiple issue boards per project.
+- Create multiple issue boards per group. **(PREMIUM)**
+- Add lists for [assignees](#assignee-lists-premium) and [milestones](#milestone-lists-premium). **(PREMIUM)**
 
 Check all the [advanced features of Issue Boards](#gitlab-enterprise-features-for-issue-boards)
 below.
@@ -58,8 +55,7 @@ You create issues, host code, perform reviews, build, test,
 and deploy from one single platform. Issue Boards help you to visualize
 and manage the entire process _in_ GitLab.
 
-With [Multiple Issue Boards](#use-cases-for-multiple-issue-boards), available
-only in [different tiers of GitLab Enterprise Edition](#gitlab-enterprise-features-for-issue-boards),
+With [Multiple Issue Boards](#use-cases-for-multiple-issue-boards),
 you go even further, as you can not only keep yourself and your project
 organized from a broader perspective with one Issue Board per project,
 but also allow your team members to organize their own workflow by creating
@@ -88,7 +84,7 @@ If we have the labels "**backend**", "**frontend**", "**staging**", and
 "**production**", and an Issue Board with a list for each, we can:
 
 - Visualize the entire flow of implementations since the
-  beginning of the development lifecycle until deployed to production
+  beginning of the development life cycle until deployed to production
 - Prioritize the issues in a list by moving them vertically
 - Move issues between lists to organize them according to the labels you've set
 - Add multiple issues to lists in the board by selecting one or more existing issues
@@ -97,8 +93,7 @@ If we have the labels "**backend**", "**frontend**", "**staging**", and
 
 ### Use cases for Multiple Issue Boards
 
-With [Multiple Issue Boards](#multiple-issue-boards-starter), available only in
-[GitLab Enterprise Edition](https://about.gitlab.com/pricing/),
+With [Multiple Issue Boards](#multiple-issue-boards),
 each team can have their own board to organize their workflow individually.
 
 #### Scrum team
@@ -159,13 +154,14 @@ Issue Board, that is, create or delete lists and drag issues from one list to an
 GitLab Issue Boards are available on GitLab Core and GitLab.com Free, but some
 advanced functionalities are only present in higher tiers: GitLab.com Bronze,
 Silver, or Gold, or GitLab self-managed Starter, Premium, and Ultimate, as described
-on the following sections.
+in the following sections.
 
 For a collection of [features per tier](#summary-of-features-per-tier), check the summary below.
 
-### Multiple Issue Boards **(STARTER)**
+### Multiple Issue Boards
 
-> Introduced in [GitLab Enterprise Edition 8.13](https://about.gitlab.com/2016/10/22/gitlab-8-13-released/#multiple-issue-boards-ee).
+> - Multiple Issue Boards per project [moved](https://gitlab.com/gitlab-org/gitlab-ce/issues/53811) to [GitLab Core](https://about.gitlab.com/pricing/) in GitLab 12.1.
+> - Multiple Issue Boards per group is available in [GitLab Premium Edition](https://about.gitlab.com/pricing/).
 
 Multiple Issue Boards, as the name suggests, allow for more than one Issue Board
 for a given project or group. This is great for large projects with more than one team
@@ -184,10 +180,6 @@ These are shortcuts to your last 4 visited boards.
 When you're revisiting an issue board in a project or group with multiple boards,
 GitLab will automatically load the last board you visited.
 
-NOTE: **Note:**
-The Multiple Issue Boards feature is available for
-**projects in GitLab Starter Edition** and for **groups in GitLab Premium Edition**.
-
 ### Configurable Issue Boards **(STARTER)**
 
 > Introduced in [GitLab Starter Edition 10.2](https://about.gitlab.com/2017/11/22/gitlab-10-2-released/#issue-boards-configuration).
-- 
cgit v1.2.1


From 888af11fe59fc157775242d1f515c9d0aa8ca658 Mon Sep 17 00:00:00 2001
From: Mark Lapierre <mlapierre@gitlab.com>
Date: Tue, 27 Aug 2019 07:40:43 +1000
Subject: Remove tests from quarantine

---
 .../features/browser_ui/3_create/repository/add_file_template_spec.rb  | 3 +--
 .../features/browser_ui/3_create/web_ide/add_file_template_spec.rb     | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/qa/qa/specs/features/browser_ui/3_create/repository/add_file_template_spec.rb b/qa/qa/specs/features/browser_ui/3_create/repository/add_file_template_spec.rb
index 458072b1507..567c6a83ddf 100644
--- a/qa/qa/specs/features/browser_ui/3_create/repository/add_file_template_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/repository/add_file_template_spec.rb
@@ -1,8 +1,7 @@
 # frozen_string_literal: true
 
 module QA
-  # Failure issue: https://gitlab.com/gitlab-org/quality/nightly/issues/127
-  context 'Create', :quarantine do
+  context 'Create' do
     describe 'File templates' do
       include Runtime::Fixtures
 
diff --git a/qa/qa/specs/features/browser_ui/3_create/web_ide/add_file_template_spec.rb b/qa/qa/specs/features/browser_ui/3_create/web_ide/add_file_template_spec.rb
index 9ff7919f199..c09c65a57a5 100644
--- a/qa/qa/specs/features/browser_ui/3_create/web_ide/add_file_template_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/web_ide/add_file_template_spec.rb
@@ -1,8 +1,7 @@
 # frozen_string_literal: true
 
 module QA
-  context 'Create', :quarantine do
-    # Failure issue: https://gitlab.com/gitlab-org/quality/nightly/issues/127
+  context 'Create' do
     describe 'Web IDE file templates' do
       include Runtime::Fixtures
 
-- 
cgit v1.2.1


From 0587ca335eaeab2455dcf2f8a70f06e3d3267a77 Mon Sep 17 00:00:00 2001
From: Andreas Brandl <abrandl@gitlab.com>
Date: Mon, 26 Aug 2019 22:00:01 +0000
Subject: Change database maintainers group for codeowners

Aligning with backend maintainers, @gitlab-org/maintainers/database is
now used for codeowners.
---
 .gitlab/CODEOWNERS | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/.gitlab/CODEOWNERS b/.gitlab/CODEOWNERS
index dae3c349ff4..0f2dd081e9e 100644
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@@ -9,12 +9,13 @@
 app/assets/ @ClemMakesApps @fatihacet @filipa @mikegreiling @timzallmann @kushalpandya @pslaughter
 *.scss @annabeldunstone @ClemMakesApps @fatihacet @filipa @mikegreiling @timzallmann @kushalpandya @pslaughter
 
-# Maintainers from the Database team should review changes in `db/`
-db/ @gl-database
-lib/gitlab/background_migration/ @gl-database
-lib/gitlab/database/ @gl-database
-lib/gitlab/sql/ @gl-database
-/ee/db/ @gl-database
+# Database maintainers should review changes in `db/`
+db/ @gitlab-org/maintainers/database
+lib/gitlab/background_migration/ @gitlab-org/maintainers/database
+lib/gitlab/database/ @gitlab-org/maintainers/database
+lib/gitlab/sql/ @gitlab-org/maintainers/database
+lib/gitlab/github_import/ @gitlab-org/maintainers/database
+/ee/db/ @gitlab-org/maintainers/database
 
 # Feature specific owners
 /ee/lib/gitlab/code_owners/ @reprazent
-- 
cgit v1.2.1


From 1a90baa13ae875677adccebb45c6834805dd9af9 Mon Sep 17 00:00:00 2001
From: Aishwarya Subramanian <asubramanian@gitlab.com>
Date: Tue, 27 Aug 2019 03:46:03 +0530
Subject: Modified route to nest under -

---
 app/controllers/registrations_controller.rb | 2 +-
 config/routes.rb                            | 5 +----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/app/controllers/registrations_controller.rb b/app/controllers/registrations_controller.rb
index 3701abe9d32..e773ec09924 100644
--- a/app/controllers/registrations_controller.rb
+++ b/app/controllers/registrations_controller.rb
@@ -115,7 +115,7 @@ class RegistrationsController < Devise::RegistrationsController
   end
 
   def resource
-    @resource ||= Users::BuildService.new(current_user, sign_up_params).execute(skip_authorization: true)
+    @resource ||= Users::BuildService.new(current_user, sign_up_params).execute
   end
 
   def devise_mapping
diff --git a/config/routes.rb b/config/routes.rb
index 3cdb0328604..c333550f758 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -110,6 +110,7 @@ Rails.application.routes.draw do
       draw :smartcard
       draw :jira_connect
       draw :username
+      draw :trial_registration
     end
 
     Gitlab.ee do
@@ -188,10 +189,6 @@ Rails.application.routes.draw do
   draw :user
   draw :project
 
-  Gitlab.ee do
-    draw :trial_registration
-  end
-
   root to: "root#index"
 
   get '*unmatched_route', to: 'application#route_not_found'
-- 
cgit v1.2.1


From 92b723db956e2b75b4bdcfb4d94c3c3cff8bf639 Mon Sep 17 00:00:00 2001
From: Jeremy Jackson <jjackson@gitlab.com>
Date: Mon, 26 Aug 2019 22:16:23 +0000
Subject: Revert "Merge branch 'user-tracking-settings' into 'master'"

This reverts merge request !31826
---
 app/assets/javascripts/main.js           |  2 -
 app/assets/javascripts/tracking.js       | 28 ----------
 app/views/layouts/_snowplow.html.haml    | 21 +++++++-
 lib/gitlab/snowplow_tracker.rb           | 35 +++++++++++++
 lib/gitlab/tracking.rb                   | 44 ----------------
 spec/frontend/tracking_spec.js           | 46 ++---------------
 spec/lib/gitlab/snowplow_tracker_spec.rb | 45 ++++++++++++++++
 spec/lib/gitlab/tracking_spec.rb         | 88 --------------------------------
 8 files changed, 105 insertions(+), 204 deletions(-)
 create mode 100644 lib/gitlab/snowplow_tracker.rb
 delete mode 100644 lib/gitlab/tracking.rb
 create mode 100644 spec/lib/gitlab/snowplow_tracker_spec.rb
 delete mode 100644 spec/lib/gitlab/tracking_spec.rb

diff --git a/app/assets/javascripts/main.js b/app/assets/javascripts/main.js
index 0ddf40b0405..39f2097c174 100644
--- a/app/assets/javascripts/main.js
+++ b/app/assets/javascripts/main.js
@@ -35,7 +35,6 @@ import initPerformanceBar from './performance_bar';
 import initSearchAutocomplete from './search_autocomplete';
 import GlFieldErrors from './gl_field_errors';
 import initUserPopovers from './user_popovers';
-import { initUserTracking } from './tracking';
 import { __ } from './locale';
 
 import 'ee_else_ce/main_ee';
@@ -95,7 +94,6 @@ function deferredInitialisation() {
   initLogoAnimation();
   initUsagePingConsent();
   initUserPopovers();
-  initUserTracking();
 
   if (document.querySelector('.search')) initSearchAutocomplete();
 
diff --git a/app/assets/javascripts/tracking.js b/app/assets/javascripts/tracking.js
index 03281b5ef49..a852f937eec 100644
--- a/app/assets/javascripts/tracking.js
+++ b/app/assets/javascripts/tracking.js
@@ -1,23 +1,5 @@
 import $ from 'jquery';
 
-const DEFAULT_SNOWPLOW_OPTIONS = {
-  namespace: 'gl',
-  hostname: window.location.hostname,
-  cookieDomain: window.location.hostname,
-  appId: '',
-  userFingerprint: false,
-  respectDoNotTrack: true,
-  forceSecureTracker: true,
-  eventMethod: 'post',
-  contexts: { webPage: true },
-  // Page tracking tracks a single event when the page loads.
-  pageTrackingEnabled: false,
-  // Activity tracking tracks when a user is still interacting with the page.
-  // Events like scrolling and mouse movements are used to determine if the
-  // user has the tab active and is still actively engaging.
-  activityTrackingEnabled: false,
-};
-
 const extractData = (el, opts = {}) => {
   const { trackEvent, trackLabel = '', trackProperty = '' } = el.dataset;
   let trackValue = el.dataset.trackValue || el.value || '';
@@ -89,13 +71,3 @@ export default class Tracking {
     };
   }
 }
-
-export function initUserTracking() {
-  if (!Tracking.enabled()) return;
-
-  const opts = Object.assign({}, DEFAULT_SNOWPLOW_OPTIONS, window.snowplowOptions);
-  window.snowplow('newTracker', opts.namespace, opts.hostname, opts);
-
-  if (opts.activityTrackingEnabled) window.snowplow('enableActivityTracking', 30, 30);
-  if (opts.pageTrackingEnabled) window.snowplow('trackPageView'); // must be after enableActivityTracking
-}
diff --git a/app/views/layouts/_snowplow.html.haml b/app/views/layouts/_snowplow.html.haml
index d7ff5ad1094..5f5c5e984c5 100644
--- a/app/views/layouts/_snowplow.html.haml
+++ b/app/views/layouts/_snowplow.html.haml
@@ -7,4 +7,23 @@
     };p[i].q=p[i].q||[];n=l.createElement(o);g=l.getElementsByTagName(o)[0];n.async=1;
     n.src=w;g.parentNode.insertBefore(n,g)}}(window,document,"script","#{asset_url('snowplow/sp.js')}","snowplow"));
 
-    window.snowplowOptions = #{Gitlab::Tracking.snowplow_options(@group).to_json}
+    window.snowplow('newTracker', '#{Gitlab::SnowplowTracker::NAMESPACE}', '#{Gitlab::CurrentSettings.snowplow_collector_hostname}', {
+      appId: '#{Gitlab::CurrentSettings.snowplow_site_id}',
+      cookieDomain: '#{Gitlab::CurrentSettings.snowplow_cookie_domain}',
+      userFingerprint: false,
+      respectDoNotTrack: true,
+      forceSecureTracker: true,
+      post: true,
+      contexts: { webPage: true },
+      stateStorageStrategy: "localStorage"
+    });
+
+    window.snowplow('enableActivityTracking', 30, 30);
+    window.snowplow('trackPageView');
+
+- return unless Feature.enabled?(:additional_snowplow_tracking, @group)
+
+= javascript_tag nonce: true do
+  :plain
+    window.snowplow('enableFormTracking');
+    window.snowplow('enableLinkClickTracking');
diff --git a/lib/gitlab/snowplow_tracker.rb b/lib/gitlab/snowplow_tracker.rb
new file mode 100644
index 00000000000..9f12513e09e
--- /dev/null
+++ b/lib/gitlab/snowplow_tracker.rb
@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require 'snowplow-tracker'
+
+module Gitlab
+  module SnowplowTracker
+    NAMESPACE = 'cf'
+
+    class << self
+      def track_event(category, action, label: nil, property: nil, value: nil, context: nil)
+        tracker&.track_struct_event(category, action, label, property, value, context, Time.now.to_i)
+      end
+
+      private
+
+      def tracker
+        return unless enabled?
+
+        @tracker ||= ::SnowplowTracker::Tracker.new(emitter, subject, NAMESPACE, Gitlab::CurrentSettings.snowplow_site_id)
+      end
+
+      def subject
+        ::SnowplowTracker::Subject.new
+      end
+
+      def emitter
+        ::SnowplowTracker::Emitter.new(Gitlab::CurrentSettings.snowplow_collector_hostname)
+      end
+
+      def enabled?
+        Gitlab::CurrentSettings.snowplow_enabled?
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/tracking.rb b/lib/gitlab/tracking.rb
deleted file mode 100644
index ef669b03c87..00000000000
--- a/lib/gitlab/tracking.rb
+++ /dev/null
@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-require 'snowplow-tracker'
-
-module Gitlab
-  module Tracking
-    SNOWPLOW_NAMESPACE = 'gl'
-
-    class << self
-      def enabled?
-        Gitlab::CurrentSettings.snowplow_enabled?
-      end
-
-      def event(category, action, label: nil, property: nil, value: nil, context: nil)
-        return unless enabled?
-
-        snowplow.track_struct_event(category, action, label, property, value, context, Time.now.to_i)
-      end
-
-      def snowplow_options(group)
-        additional_features = Feature.enabled?(:additional_snowplow_tracking, group)
-        {
-          namespace: SNOWPLOW_NAMESPACE,
-          hostname: Gitlab::CurrentSettings.snowplow_collector_hostname,
-          cookie_domain: Gitlab::CurrentSettings.snowplow_cookie_domain,
-          app_id: Gitlab::CurrentSettings.snowplow_site_id,
-          page_tracking_enabled: additional_features,
-          activity_tracking_enabled: additional_features
-        }.transform_keys! { |key| key.to_s.camelize(:lower).to_sym }
-      end
-
-      private
-
-      def snowplow
-        @snowplow ||= SnowplowTracker::Tracker.new(
-          SnowplowTracker::Emitter.new(Gitlab::CurrentSettings.snowplow_collector_hostname),
-          SnowplowTracker::Subject.new,
-          SNOWPLOW_NAMESPACE,
-          Gitlab::CurrentSettings.snowplow_site_id
-        )
-      end
-    end
-  end
-end
diff --git a/spec/frontend/tracking_spec.js b/spec/frontend/tracking_spec.js
index 7c98a1a66c9..0e862c683d3 100644
--- a/spec/frontend/tracking_spec.js
+++ b/spec/frontend/tracking_spec.js
@@ -1,56 +1,20 @@
 import $ from 'jquery';
 import { setHTMLFixture } from './helpers/fixtures';
 
-import Tracking, { initUserTracking } from '~/tracking';
+import Tracking from '~/tracking';
 
 describe('Tracking', () => {
-  let snowplowSpy;
-
   beforeEach(() => {
     window.snowplow = window.snowplow || (() => {});
-    window.snowplowOptions = {
-      namespace: '_namespace_',
-      hostname: 'app.gitfoo.com',
-      cookieDomain: '.gitfoo.com',
-    };
-    snowplowSpy = jest.spyOn(window, 'snowplow');
   });
 
-  describe('initUserTracking', () => {
-    it('calls through to get a new tracker with the expected options', () => {
-      initUserTracking();
-      expect(snowplowSpy).toHaveBeenCalledWith('newTracker', '_namespace_', 'app.gitfoo.com', {
-        namespace: '_namespace_',
-        hostname: 'app.gitfoo.com',
-        cookieDomain: '.gitfoo.com',
-        appId: '',
-        userFingerprint: false,
-        respectDoNotTrack: true,
-        forceSecureTracker: true,
-        eventMethod: 'post',
-        contexts: { webPage: true },
-        activityTrackingEnabled: false,
-        pageTrackingEnabled: false,
-      });
-    });
-
-    it('should activate features based on what has been enabled', () => {
-      initUserTracking();
-      expect(snowplowSpy).not.toHaveBeenCalledWith('enableActivityTracking', 30, 30);
-      expect(snowplowSpy).not.toHaveBeenCalledWith('trackPageView');
-
-      window.snowplowOptions = Object.assign({}, window.snowplowOptions, {
-        activityTrackingEnabled: true,
-        pageTrackingEnabled: true,
-      });
+  describe('.event', () => {
+    let snowplowSpy = null;
 
-      initUserTracking();
-      expect(snowplowSpy).toHaveBeenCalledWith('enableActivityTracking', 30, 30);
-      expect(snowplowSpy).toHaveBeenCalledWith('trackPageView');
+    beforeEach(() => {
+      snowplowSpy = jest.spyOn(window, 'snowplow');
     });
-  });
 
-  describe('.event', () => {
     afterEach(() => {
       window.doNotTrack = undefined;
       navigator.doNotTrack = undefined;
diff --git a/spec/lib/gitlab/snowplow_tracker_spec.rb b/spec/lib/gitlab/snowplow_tracker_spec.rb
new file mode 100644
index 00000000000..073a33e5973
--- /dev/null
+++ b/spec/lib/gitlab/snowplow_tracker_spec.rb
@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+require 'spec_helper'
+
+describe Gitlab::SnowplowTracker do
+  let(:timestamp) { Time.utc(2017, 3, 22) }
+
+  around do |example|
+    Timecop.freeze(timestamp) { example.run }
+  end
+
+  subject { described_class.track_event('epics', 'action', property: 'what', value: 'doit') }
+
+  context '.track_event' do
+    context 'when Snowplow tracker is disabled' do
+      it 'does not track the event' do
+        expect(SnowplowTracker::Tracker).not_to receive(:new)
+
+        subject
+      end
+    end
+
+    context 'when Snowplow tracker is enabled' do
+      before do
+        stub_application_setting(snowplow_enabled: true)
+        stub_application_setting(snowplow_site_id: 'awesome gitlab')
+        stub_application_setting(snowplow_collector_hostname: 'url.com')
+      end
+
+      it 'tracks the event' do
+        tracker = double
+
+        expect(::SnowplowTracker::Tracker).to receive(:new)
+          .with(
+            an_instance_of(::SnowplowTracker::Emitter),
+            an_instance_of(::SnowplowTracker::Subject),
+            'cf', 'awesome gitlab'
+          ).and_return(tracker)
+        expect(tracker).to receive(:track_struct_event)
+          .with('epics', 'action', nil, 'what', 'doit', nil, timestamp.to_i)
+
+        subject
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/tracking_spec.rb b/spec/lib/gitlab/tracking_spec.rb
deleted file mode 100644
index f14e74427e1..00000000000
--- a/spec/lib/gitlab/tracking_spec.rb
+++ /dev/null
@@ -1,88 +0,0 @@
-# frozen_string_literal: true
-require 'spec_helper'
-
-describe Gitlab::Tracking do
-  let(:timestamp) { Time.utc(2017, 3, 22) }
-
-  before do
-    stub_application_setting(snowplow_enabled: true)
-    stub_application_setting(snowplow_collector_hostname: 'gitfoo.com')
-    stub_application_setting(snowplow_cookie_domain: '.gitfoo.com')
-    stub_application_setting(snowplow_site_id: '_abc123_')
-  end
-
-  describe '.snowplow_options' do
-    subject(&method(:described_class))
-
-    it 'returns useful client options' do
-      expect(subject.snowplow_options(nil)).to eq(
-        namespace: 'gl',
-        hostname: 'gitfoo.com',
-        cookieDomain: '.gitfoo.com',
-        appId: '_abc123_',
-        pageTrackingEnabled: true,
-        activityTrackingEnabled: true
-      )
-    end
-
-    it 'enables features using feature flags' do
-      stub_feature_flags(additional_snowplow_tracking: true)
-      allow(Feature).to receive(:enabled?).with(
-        :additional_snowplow_tracking,
-        '_group_'
-      ).and_return(false)
-
-      expect(subject.snowplow_options('_group_')).to include(
-        pageTrackingEnabled: false,
-        activityTrackingEnabled: false
-      )
-    end
-  end
-
-  describe '.event' do
-    subject(&method(:described_class))
-
-    around do |example|
-      Timecop.freeze(timestamp) { example.run }
-    end
-
-    it 'can track events' do
-      tracker = double
-
-      expect(SnowplowTracker::Emitter).to receive(:new).with(
-        'gitfoo.com'
-      ).and_return('_emitter_')
-
-      expect(SnowplowTracker::Tracker).to receive(:new).with(
-        '_emitter_',
-        an_instance_of(SnowplowTracker::Subject),
-        'gl',
-        '_abc123_'
-      ).and_return(tracker)
-
-      expect(tracker).to receive(:track_struct_event).with(
-        'category',
-        'action',
-        '_label_',
-        '_property_',
-        '_value_',
-        '_context_',
-        timestamp.to_i
-      )
-
-      subject.event('category', 'action',
-        label: '_label_',
-        property: '_property_',
-        value: '_value_',
-        context: '_context_'
-      )
-    end
-
-    it 'does not track when not enabled' do
-      stub_application_setting(snowplow_enabled: false)
-      expect(SnowplowTracker::Tracker).not_to receive(:new)
-
-      subject.event('epics', 'action', property: 'what', value: 'doit')
-    end
-  end
-end
-- 
cgit v1.2.1


From f6058981919ab431e7c1e053b5ae6119a9a24e30 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Mon, 26 Aug 2019 13:03:42 -0700
Subject: Fix Piwik not working

Due to indentation, the changes in
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/31402 broke the
templating of Piwik script header.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66627
---
 app/views/layouts/_piwik.html.haml              |  4 ++--
 changelogs/unreleased/sh-fix-piwik-template.yml |  5 +++++
 spec/views/layouts/_head.html.haml_spec.rb      | 20 ++++++++++++++++++++
 3 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/sh-fix-piwik-template.yml

diff --git a/app/views/layouts/_piwik.html.haml b/app/views/layouts/_piwik.html.haml
index 2cb2e23433d..361a7b03180 100644
--- a/app/views/layouts/_piwik.html.haml
+++ b/app/views/layouts/_piwik.html.haml
@@ -11,5 +11,5 @@
       var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
       g.type='text/javascript'; g.async=true; g.defer=true; g.src=u+'piwik.js'; s.parentNode.insertBefore(g,s);
     })();
-  <noscript><p><img src="//#{extra_config.piwik_url}/piwik.php?idsite=#{extra_config.piwik_site_id}" style="border:0;" alt="" /></p></noscript>
-  <!-- End Piwik Code -->
+<noscript><p><img src="//#{extra_config.piwik_url}/piwik.php?idsite=#{extra_config.piwik_site_id}" style="border:0;" alt="" /></p></noscript>
+<!-- End Piwik Code -->
diff --git a/changelogs/unreleased/sh-fix-piwik-template.yml b/changelogs/unreleased/sh-fix-piwik-template.yml
new file mode 100644
index 00000000000..f0baed6a2e0
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-piwik-template.yml
@@ -0,0 +1,5 @@
+---
+title: Fix Piwik not working
+merge_request: 32234
+author:
+type: fixed
diff --git a/spec/views/layouts/_head.html.haml_spec.rb b/spec/views/layouts/_head.html.haml_spec.rb
index 70cdc08b4b6..d7f24950e6f 100644
--- a/spec/views/layouts/_head.html.haml_spec.rb
+++ b/spec/views/layouts/_head.html.haml_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe 'layouts/_head' do
+  include StubConfiguration
+
   before do
     allow(view).to receive(:current_application_settings).and_return(Gitlab::CurrentSettings.current_application_settings)
   end
@@ -87,6 +89,24 @@ describe 'layouts/_head' do
     end
   end
 
+  context 'when a Piwik config is set' do
+    let(:piwik_host) { 'piwik.example.com' }
+
+    before do
+      stub_config(extra: {
+                    piwik_url: piwik_host,
+                    piwik_site_id: 12345
+                  })
+    end
+
+    it 'add a Piwik Javascript' do
+      render
+
+      expect(rendered).to match(/<script.*>.*var u="\/\/#{piwik_host}\/".*<\/script>/m)
+      expect(rendered).to match(%r(<noscript>.*<img src="//#{piwik_host}/piwik.php.*</noscript>))
+    end
+  end
+
   def stub_helper_with_safe_string(method)
     allow_any_instance_of(PageLayoutHelper).to receive(method)
       .and_return(%q{foo" http-equiv="refresh}.html_safe)
-- 
cgit v1.2.1


From a520b5a4172608ef3af6221aa5880ae5edb517ca Mon Sep 17 00:00:00 2001
From: Aishwarya Subramanian <asubramanian@gitlab.com>
Date: Tue, 27 Aug 2019 04:23:17 +0530
Subject: Moved construction of name to EE namespace

---
 app/services/users/build_service.rb | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/app/services/users/build_service.rb b/app/services/users/build_service.rb
index c853d6fce33..614ed734c3e 100644
--- a/app/services/users/build_service.rb
+++ b/app/services/users/build_service.rb
@@ -109,10 +109,6 @@ module Users
         if user_params[:skip_confirmation].nil?
           user_params[:skip_confirmation] = skip_user_confirmation_email_from_setting
         end
-
-        if (user_params[:first_name].present? || user_params[:last_name].present?) && !user_params[:name].present?
-          user_params[:name] = "#{user_params[:first_name]} #{user_params[:last_name]}"
-        end
       end
 
       if user_default_internal_regex_enabled? && !user_params.key?(:external)
-- 
cgit v1.2.1


From 5af73e845152107bede43ce7ad082a0fbe853ae5 Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Wed, 21 Aug 2019 20:29:16 +1200
Subject: Add docs for db_load_balancing metrics

---
 doc/administration/monitoring/prometheus/gitlab_metrics.md | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/doc/administration/monitoring/prometheus/gitlab_metrics.md b/doc/administration/monitoring/prometheus/gitlab_metrics.md
index 4809bee0df6..ca48326c6d0 100644
--- a/doc/administration/monitoring/prometheus/gitlab_metrics.md
+++ b/doc/administration/monitoring/prometheus/gitlab_metrics.md
@@ -161,7 +161,16 @@ the `monitoring.sidekiq_exporter` configuration option in `gitlab.yml`.
 | `geo_repositories_retrying_verification_count` | Gauge   | 11.2  | Number of repositories verification failures that Geo is actively trying to correct on secondary  | url |
 | `geo_wikis_retrying_verification_count`        | Gauge   | 11.2  | Number of wikis verification failures that Geo is actively trying to correct on secondary | url |
 
-### Ruby metrics
+## Database load balancing metrics **(PREMIUM ONLY)**
+
+The following metrics are available:
+
+| Metric                            | Type      | Since                                                         | Description                            |
+|:--------------------------------- |:--------- |:------------------------------------------------------------- |:-------------------------------------- |
+| `db_load_balancing_hosts`         | Gauge     | [12.3](https://gitlab.com/gitlab-org/gitlab-ee/issues/13630)  | Current number of load balancing hosts |
+| `db_load_balancing_index`         | Gauge     | [12.3](https://gitlab.com/gitlab-org/gitlab-ee/issues/13630)  | Current load balancing host index      |
+
+## Ruby metrics
 
 Some basic Ruby runtime metrics are available:
 
-- 
cgit v1.2.1


From 2b55fb03e72ee2b6af56562543d7479219d880d9 Mon Sep 17 00:00:00 2001
From: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Date: Tue, 27 Aug 2019 01:24:44 +0000
Subject: Update CHANGELOG.md for 12.0.7

[ci skip]
---
 CHANGELOG.md | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ffca09a92e7..5f90359861e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -591,6 +591,34 @@ entry.
 - Removes EE differences for app/views/admin/users/show.html.haml.
 
 
+## 12.0.7
+
+### Security (22 changes)
+
+- Ensure only authorised users can create notes on Merge Requests and Issues.
+- Add :login_recaptcha_protection_enabled setting to prevent bots from brute-force attacks.
+- Queries for Upload should be scoped by model.
+- Speed up regexp in namespace format by failing fast after reaching maximum namespace depth.
+- Limit the size of issuable description and comments.
+- Send TODOs for comments on commits correctly.
+- Restrict MergeRequests#test_reports to authenticated users with read-access on Builds.
+- Added image proxy to mitigate potential stealing of IP addresses.
+- Filter out old system notes for epics in notes api endpoint response.
+- Avoid exposing unaccessible repo data upon GFM post processing.
+- Fix HTML injection for label description.
+- Make sure HTML text is always escaped when replacing label/milestone references.
+- Prevent DNS rebind on JIRA service integration.
+- Use admin_group authorization in Groups::RunnersController.
+- Prevent disclosure of merge request ID via email.
+- Show cross-referenced MR-id in issues' activities only to authorized users.
+- Enforce max chars and max render time in markdown math.
+- Check permissions before responding in MergeController#pipeline_status.
+- Remove EXIF from users/personal snippet uploads.
+- Fix project import restricted visibility bypass via API.
+- Fix weak session management by clearing password reset tokens after login (username/email) are updated.
+- Fix SSRF via DNS rebinding in Kubernetes Integration.
+
+
 ## 12.0.6
 
 - No changes.
-- 
cgit v1.2.1


From efb42411b6a39bc2b1b8bc36da63e67efbc718bf Mon Sep 17 00:00:00 2001
From: drew <dscimino@gmail.com>
Date: Tue, 27 Aug 2019 01:38:25 +0000
Subject: CI Yaml configuration docs for using job rules

---
 doc/ci/yaml/README.md | 120 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 120 insertions(+)

diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md
index 89a61b2a9e3..663fa1395a6 100644
--- a/doc/ci/yaml/README.md
+++ b/doc/ci/yaml/README.md
@@ -100,6 +100,7 @@ The following table lists available parameters for jobs:
 | [`stage`](#stage)                                  | Defines a job stage (default: `test`).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | [`only`](#onlyexcept-basic)                        | Limit when jobs are created. Also available: [`only:refs`, `only:kubernetes`, `only:variables`, and `only:changes`](#onlyexcept-advanced).                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | [`except`](#onlyexcept-basic)                      | Limit when jobs are not created. Also available: [`except:refs`, `except:kubernetes`, `except:variables`, and `except:changes`](#onlyexcept-advanced).                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| [`rules`](#rules)                                  | List of coniditions to evaluate and determine selected attributes of a build and whether or not it is created. May not be used alongside `only`/`except`.
 | [`tags`](#tags)                                    | List of tags which are used to select Runner.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | [`allow_failure`](#allow_failure)                  | Allow job to fail. Failed job doesn't contribute to commit status.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | [`when`](#when)                                    | When to run job. Also available: `when:manual` and `when:delayed`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
@@ -690,6 +691,125 @@ In the scenario above, if a merge request is created or updated that changes
 either files in `service-one` directory or the `Dockerfile`, GitLab creates
 and triggers the `docker build service one` job.
 
+### `rules`
+
+Using `rules` allows for a list of individual rule objects to be evaluated
+*in order*, until one matches and dynamically provides attributes to the job.
+
+Available rule clauses include:
+
+- `if` (similar to [`only:variables`](#onlyvariablesexceptvariables)).
+- `changes` (same as [`only:changes`](#onlychangesexceptchanges)).
+
+For example, using `if`:
+
+```yaml
+job:
+  script: "echo Hello, Rules!"
+  rules:
+    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH == "master"' # This rule will be evaluated
+      when: always
+    - if: '$VAR =~ /pattern/' # This rule will only be evaluated if the first does not match
+      when: manual
+    - when: on_success # A Rule entry with no conditional clauses evaluates to true. If neither of the first two Rules match, this one will and set job:when to "on_success"
+```
+
+If the first rule does not match, further rules will be evaluated sequentially
+until a match is found. The above configuration will specify that `job` should
+be built and run for every pipeline on merge requests targeting `master`,
+regardless of the status of other builds.
+
+#### `rules:if`
+
+`rules:if` differs slightly from `only:variables` by accepting only a single
+expression string, rather than an array of them. Any set of expressions to be
+evaluated should be conjoined into a single expression using `&&` or `||`. For example:
+
+```yaml
+job:
+  script: "echo Hello, Rules!"
+  rules:
+    - if: '$CI_MERGE_REQUEST_SOURCE_BRANCH =~ /^feature/ && $CI_MERGE_REQUEST_TARGET_BRANCH == "master"' # This rule will be evaluated
+      when: always
+    - if: '$CI_MERGE_REQUEST_SOURCE_BRANCH =~ /^feature/' # This rule will only be evaluated if the target branch is not "master"
+      when: manual
+    - if: '$CI_MERGE_REQUEST_SOURCE_BRANCH' # If neither of the first two match but the simple presence does, we set to "on_success" by default
+```
+
+If none of the provided rules match, the job will be set to `when:never`, and
+not included in the pipeline. If `rules:when` is not included in the configuration
+at all, the behavior defaults to `job:when`, which continues to default to
+`on_success`.
+
+#### `rules:changes`
+
+`changes` works exactly the same way as [`only`/`except`](#onlychangesexceptchanges),
+accepting an array of paths. The following configuration configures a job to be
+run manually if `Dockerfile` has changed OR `$VAR == "string value"`. Otherwise
+it is set to `when:on_success` by the last rule, where 0 clauses evaluate as
+vacuously true.
+
+```yaml
+docker build:
+  script: docker build -t my-image:$CI_COMMIT_REF_SLUG .
+  rules:
+    - changes: # Will include the job and set to when:manual if any of the follow paths match a modified file.
+      - Dockerfile
+      when: manual
+    - if: '$VAR == "string value"'
+      when: manual # Will include the job and set to when:manual if the expression evaluates to true, after the `changes:` rule fails to match.
+    - when: on_success # If neither of the first rules match, set to on_success
+
+```
+
+#### Complex Rule Clauses
+
+To conjoin `if` and `changes` clauses with an AND, use them in the same rule.
+Here we run the job manually if `Dockerfile` or any file in `docker/scripts/`
+has changed AND `$VAR == "string value"`. Otherwise, the job will not be
+included in the pipeline.
+
+```yaml
+docker build:
+  script: docker build -t my-image:$CI_COMMIT_REF_SLUG .
+  rules:
+    - if: '$VAR == "string value"'
+      changes: # Will include the job and set to when:manual if any of the follow paths match a modified file.
+      - Dockerfile
+      - docker/scripts/*
+      when: manual
+  # - when: never would be redundant here, this is implied any time rules are listed.
+```
+
+The only clauses currently available are `if` and `changes`. Keywords such as
+`branches` or `refs` that are currently available for `only`/`except` are not
+yet available in `rules` as they are being individually considered for their
+usage and behavior in the newer context.
+
+#### Permitted attributes
+
+The only job attributes currently set by `rules` are `when` and `start_in`, if
+`when` is set to `delayed`. A job will be included in a pipeline if `when` is
+evaluated to any value except `never`.
+
+Delayed jobs require a `start_in` value, so rule objects do as well. For example:
+
+```yaml
+docker build:
+  script: docker build -t my-image:$CI_COMMIT_REF_SLUG .
+  rules:
+    - changes: # Will include the job and delay 3 hours when the Dockerfile has changed
+      - Dockerfile
+      when: delayed
+      start_in: '3 hours'
+    - when: on_success # Otherwise include the job and set to run normally
+
+```
+
+Additional Job configuration may be added to rules in the future, if something
+useful isn't available, please open an issue on
+[Gitlab CE](https://www.gitlab.com/gitlab-org/gitlab-ce/issues).
+
 ### `tags`
 
 `tags` is used to select specific Runners from the list of all Runners that are
-- 
cgit v1.2.1


From 3394c6532e4ef4582d806aed8c5285bf462fea3b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Etienne=20Baqu=C3=A9?= <ebaque@gitlab.com>
Date: Thu, 11 Jul 2019 16:41:04 -0400
Subject: Added migration to encrypt token in DeployToken records

Added migrations to make token column accepting null values and to add
encrypted token column.
---
 ...11200053_change_deploy_tokens_token_not_null.rb | 11 +++++++++
 ...1200508_add_token_encrypted_to_deploy_tokens.rb | 11 +++++++++
 .../20190711201818_encrypt_deploy_tokens_tokens.rb | 27 ++++++++++++++++++++++
 db/schema.rb                                       |  3 ++-
 4 files changed, 51 insertions(+), 1 deletion(-)
 create mode 100644 db/migrate/20190711200053_change_deploy_tokens_token_not_null.rb
 create mode 100644 db/migrate/20190711200508_add_token_encrypted_to_deploy_tokens.rb
 create mode 100644 db/post_migrate/20190711201818_encrypt_deploy_tokens_tokens.rb

diff --git a/db/migrate/20190711200053_change_deploy_tokens_token_not_null.rb b/db/migrate/20190711200053_change_deploy_tokens_token_not_null.rb
new file mode 100644
index 00000000000..14ccf544d0b
--- /dev/null
+++ b/db/migrate/20190711200053_change_deploy_tokens_token_not_null.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class ChangeDeployTokensTokenNotNull < ActiveRecord::Migration[5.1]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  def change
+    change_column_null :deploy_tokens, :token, true
+  end
+end
diff --git a/db/migrate/20190711200508_add_token_encrypted_to_deploy_tokens.rb b/db/migrate/20190711200508_add_token_encrypted_to_deploy_tokens.rb
new file mode 100644
index 00000000000..3c352441057
--- /dev/null
+++ b/db/migrate/20190711200508_add_token_encrypted_to_deploy_tokens.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class AddTokenEncryptedToDeployTokens < ActiveRecord::Migration[5.1]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  def change
+    add_column :deploy_tokens, :token_encrypted, :string
+  end
+end
diff --git a/db/post_migrate/20190711201818_encrypt_deploy_tokens_tokens.rb b/db/post_migrate/20190711201818_encrypt_deploy_tokens_tokens.rb
new file mode 100644
index 00000000000..6245a87dc62
--- /dev/null
+++ b/db/post_migrate/20190711201818_encrypt_deploy_tokens_tokens.rb
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+class EncryptDeployTokensTokens < ActiveRecord::Migration[5.1]
+  DOWNTIME = false
+
+  class DeploymentTokens < ActiveRecord::Base
+    self.table_name = 'deploy_tokens'
+  end
+
+  def up
+    say_with_time("Encrypting tokens from deploy_tokens") do
+      DeploymentTokens.where('token_encrypted is NULL AND token IS NOT NULL').find_each do |deploy_token|
+        token_encrypted = Gitlab::CryptoHelper.aes256_gcm_encrypt(deploy_token.token)
+        deploy_token.update!(token_encrypted: token_encrypted)
+      end
+    end
+  end
+
+  def down
+    say_with_time("Decrypting tokens from deploy_tokens") do
+      DeploymentTokens.where('token_encrypted IS NOT NULL AND token IS NULL').find_each do |deploy_token|
+        token = Gitlab::CryptoHelper.aes256_gcm_decrypt(deploy_token.token_encrypted)
+        deploy_token.update!(token: token)
+      end
+    end
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 36bf2371994..f36ee372382 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1121,8 +1121,9 @@ ActiveRecord::Schema.define(version: 2019_08_20_163320) do
     t.datetime_with_timezone "expires_at", null: false
     t.datetime_with_timezone "created_at", null: false
     t.string "name", null: false
-    t.string "token", null: false
+    t.string "token"
     t.string "username"
+    t.string "token_encrypted"
     t.index ["token", "expires_at", "id"], name: "index_deploy_tokens_on_token_and_expires_at_and_id", where: "(revoked IS FALSE)"
     t.index ["token"], name: "index_deploy_tokens_on_token", unique: true
   end
-- 
cgit v1.2.1


From 63ade4b819bd222eb436f271a4a919a199bc023b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Etienne=20Baqu=C3=A9?= <ebaque@gitlab.com>
Date: Fri, 12 Jul 2019 11:24:18 -0400
Subject: Added EncryptDeployTokensTokens spec file

---
 .../encrypt_deploy_tokens_tokens_spec.rb           | 47 ++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 spec/migrations/encrypt_deploy_tokens_tokens_spec.rb

diff --git a/spec/migrations/encrypt_deploy_tokens_tokens_spec.rb b/spec/migrations/encrypt_deploy_tokens_tokens_spec.rb
new file mode 100644
index 00000000000..a398e079731
--- /dev/null
+++ b/spec/migrations/encrypt_deploy_tokens_tokens_spec.rb
@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+require Rails.root.join('db', 'post_migrate', '20190711201818_encrypt_deploy_tokens_tokens.rb')
+
+describe EncryptDeployTokensTokens, :migration do
+  let(:migration) { described_class.new }
+  let(:deployment_tokens) { table(:deploy_tokens) }
+  let(:plaintext) { "secret-token" }
+  let(:expires_at) { DateTime.now + 1.year }
+  let(:ciphertext) { Gitlab::CryptoHelper.aes256_gcm_encrypt(plaintext) }
+
+  describe '#up' do
+    it 'keeps plaintext token the same and populates token_encrypted if not present' do
+      deploy_token = deployment_tokens.create!(
+        name: 'test_token',
+        read_repository: true,
+        expires_at: expires_at,
+        username: 'gitlab-token-1',
+        token: plaintext
+      )
+
+      migration.up
+
+      expect(deploy_token.reload.token).to eq(plaintext)
+      expect(deploy_token.reload.token_encrypted).to eq(ciphertext)
+    end
+  end
+
+  describe '#down' do
+    it 'decrypts encrypted token and saves it' do
+      deploy_token = deployment_tokens.create!(
+        name: 'test_token',
+        read_repository: true,
+        expires_at: expires_at,
+        username: 'gitlab-token-1',
+        token_encrypted: ciphertext
+      )
+
+      migration.down
+
+      expect(deploy_token.reload.token).to eq(plaintext)
+      expect(deploy_token.reload.token_encrypted).to eq(ciphertext)
+    end
+  end
+end
-- 
cgit v1.2.1


From 93cf4124737b20e3f810f0c0ad366271a9a0c251 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Etienne=20Baqu=C3=A9?= <ebaque@gitlab.com>
Date: Fri, 12 Jul 2019 16:49:47 -0400
Subject: Add encrypted optional option to DeployToken authentication field

---
 app/models/deploy_token.rb  | 2 +-
 config/database.yml.example | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 create mode 100644 config/database.yml.example

diff --git a/app/models/deploy_token.rb b/app/models/deploy_token.rb
index 33f0be91632..85f5a2040c0 100644
--- a/app/models/deploy_token.rb
+++ b/app/models/deploy_token.rb
@@ -5,7 +5,7 @@ class DeployToken < ApplicationRecord
   include TokenAuthenticatable
   include PolicyActor
   include Gitlab::Utils::StrongMemoize
-  add_authentication_token_field :token
+  add_authentication_token_field :token, encrypted: :optional
 
   AVAILABLE_SCOPES = %i(read_repository read_registry).freeze
   GITLAB_DEPLOY_TOKEN_NAME = 'gitlab-deploy-token'.freeze
diff --git a/config/database.yml.example b/config/database.yml.example
new file mode 100644
index 00000000000..e69de29bb2d
-- 
cgit v1.2.1


From 3e48d419318b319ba5629669472234ec7ecd77d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Etienne=20Baqu=C3=A9?= <ebaque@gitlab.com>
Date: Mon, 15 Jul 2019 11:39:01 -0400
Subject: Added changelog file for this security fix

---
 changelogs/unreleased/63502-encrypt-deploy-token.yml | 5 +++++
 config/database.yml.example                          | 0
 2 files changed, 5 insertions(+)
 create mode 100644 changelogs/unreleased/63502-encrypt-deploy-token.yml
 delete mode 100644 config/database.yml.example

diff --git a/changelogs/unreleased/63502-encrypt-deploy-token.yml b/changelogs/unreleased/63502-encrypt-deploy-token.yml
new file mode 100644
index 00000000000..249f52014cd
--- /dev/null
+++ b/changelogs/unreleased/63502-encrypt-deploy-token.yml
@@ -0,0 +1,5 @@
+---
+title: Encrypt existing deploy tokens and new ones when storing them
+merge_request: 30679
+author:
+type: security
diff --git a/config/database.yml.example b/config/database.yml.example
deleted file mode 100644
index e69de29bb2d..00000000000
-- 
cgit v1.2.1


From a6b60fee67f6ea4d22ab5cb34901d0707829eec0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Etienne=20Baqu=C3=A9?= <ebaque@gitlab.com>
Date: Wed, 17 Jul 2019 09:38:28 -0400
Subject: Iterating through token to encrypt with find_each

---
 db/post_migrate/20190711201818_encrypt_deploy_tokens_tokens.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/db/post_migrate/20190711201818_encrypt_deploy_tokens_tokens.rb b/db/post_migrate/20190711201818_encrypt_deploy_tokens_tokens.rb
index 6245a87dc62..2eb8d1ee11c 100644
--- a/db/post_migrate/20190711201818_encrypt_deploy_tokens_tokens.rb
+++ b/db/post_migrate/20190711201818_encrypt_deploy_tokens_tokens.rb
@@ -9,7 +9,7 @@ class EncryptDeployTokensTokens < ActiveRecord::Migration[5.1]
 
   def up
     say_with_time("Encrypting tokens from deploy_tokens") do
-      DeploymentTokens.where('token_encrypted is NULL AND token IS NOT NULL').find_each do |deploy_token|
+      DeploymentTokens.where('token_encrypted is NULL AND token IS NOT NULL').find_each(batch_size: 10000) do |deploy_token|
         token_encrypted = Gitlab::CryptoHelper.aes256_gcm_encrypt(deploy_token.token)
         deploy_token.update!(token_encrypted: token_encrypted)
       end
@@ -18,7 +18,7 @@ class EncryptDeployTokensTokens < ActiveRecord::Migration[5.1]
 
   def down
     say_with_time("Decrypting tokens from deploy_tokens") do
-      DeploymentTokens.where('token_encrypted IS NOT NULL AND token IS NULL').find_each do |deploy_token|
+      DeploymentTokens.where('token_encrypted IS NOT NULL AND token IS NULL').find_each(batch_size: 10000) do |deploy_token|
         token = Gitlab::CryptoHelper.aes256_gcm_decrypt(deploy_token.token_encrypted)
         deploy_token.update!(token: token)
       end
-- 
cgit v1.2.1


From 84d6dcbe5040b9f0475f6b2155800617e397db94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Etienne=20Baqu=C3=A9?= <ebaque@gitlab.com>
Date: Fri, 19 Jul 2019 13:44:30 -0400
Subject: Updated call to find deploy token

---
 lib/gitlab/auth.rb              | 3 +--
 spec/factories/deploy_tokens.rb | 3 ++-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/gitlab/auth.rb b/lib/gitlab/auth.rb
index e17a096ef19..fe40d553b2f 100644
--- a/lib/gitlab/auth.rb
+++ b/lib/gitlab/auth.rb
@@ -202,8 +202,7 @@ module Gitlab
       def deploy_token_check(login, password)
         return unless password.present?
 
-        token =
-          DeployToken.active.find_by(token: password)
+        token = DeployToken.active.find_by_token(password)
 
         return unless token && login
         return if login != token.username
diff --git a/spec/factories/deploy_tokens.rb b/spec/factories/deploy_tokens.rb
index a96258f5cbe..99486acc2ab 100644
--- a/spec/factories/deploy_tokens.rb
+++ b/spec/factories/deploy_tokens.rb
@@ -2,7 +2,8 @@
 
 FactoryBot.define do
   factory :deploy_token do
-    token { SecureRandom.hex(50) }
+    token nil
+    token_encrypted { Gitlab::CryptoHelper.aes256_gcm_encrypt( SecureRandom.hex(50) ) }
     sequence(:name) { |n| "PDT #{n}" }
     read_repository true
     read_registry true
-- 
cgit v1.2.1


From 64e24d6492f39a4ab7f2202897755afd1704f147 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Etienne=20Baqu=C3=A9?= <ebaque@gitlab.com>
Date: Fri, 19 Jul 2019 14:00:56 -0400
Subject: Added new index to deploy_tokens table

---
 ...174505_add_index_to_deploy_tokens_token_encrypted.rb | 17 +++++++++++++++++
 db/schema.rb                                            |  1 +
 2 files changed, 18 insertions(+)
 create mode 100644 db/migrate/20190719174505_add_index_to_deploy_tokens_token_encrypted.rb

diff --git a/db/migrate/20190719174505_add_index_to_deploy_tokens_token_encrypted.rb b/db/migrate/20190719174505_add_index_to_deploy_tokens_token_encrypted.rb
new file mode 100644
index 00000000000..d58d1d8348c
--- /dev/null
+++ b/db/migrate/20190719174505_add_index_to_deploy_tokens_token_encrypted.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddIndexToDeployTokensTokenEncrypted < ActiveRecord::Migration[5.1]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_index :deploy_tokens, :token_encrypted, unique: true, name: "index_deploy_tokens_on_token_encrypted"
+  end
+
+  def down
+    remove_concurrent_index_by_name :deploy_tokens, "index_deploy_tokens_on_token_encrypted"
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index f36ee372382..1393737b8b9 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1126,6 +1126,7 @@ ActiveRecord::Schema.define(version: 2019_08_20_163320) do
     t.string "token_encrypted"
     t.index ["token", "expires_at", "id"], name: "index_deploy_tokens_on_token_and_expires_at_and_id", where: "(revoked IS FALSE)"
     t.index ["token"], name: "index_deploy_tokens_on_token", unique: true
+    t.index ["token_encrypted"], name: "index_deploy_tokens_on_token_encrypted", unique: true
   end
 
   create_table "deployments", id: :serial, force: :cascade do |t|
-- 
cgit v1.2.1


From bc4efd18a06e0b31a30b8e63828506ad647b2d8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Etienne=20Baqu=C3=A9?= <ebaque@gitlab.com>
Date: Fri, 19 Jul 2019 15:16:07 -0400
Subject: Removed rubocop disable flags, updated changelog

---
 changelogs/unreleased/63502-encrypt-deploy-token.yml | 4 ++--
 lib/gitlab/auth.rb                                   | 2 --
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/changelogs/unreleased/63502-encrypt-deploy-token.yml b/changelogs/unreleased/63502-encrypt-deploy-token.yml
index 249f52014cd..81ce1e6c3dd 100644
--- a/changelogs/unreleased/63502-encrypt-deploy-token.yml
+++ b/changelogs/unreleased/63502-encrypt-deploy-token.yml
@@ -1,5 +1,5 @@
 ---
-title: Encrypt existing deploy tokens and new ones when storing them
+title: Encrypt existing and new deploy tokens
 merge_request: 30679
 author:
-type: security
+type: other
diff --git a/lib/gitlab/auth.rb b/lib/gitlab/auth.rb
index fe40d553b2f..6769bd95c2b 100644
--- a/lib/gitlab/auth.rb
+++ b/lib/gitlab/auth.rb
@@ -198,7 +198,6 @@ module Gitlab
         end.uniq
       end
 
-      # rubocop: disable CodeReuse/ActiveRecord
       def deploy_token_check(login, password)
         return unless password.present?
 
@@ -213,7 +212,6 @@ module Gitlab
           Gitlab::Auth::Result.new(token, token.project, :deploy_token, scopes)
         end
       end
-      # rubocop: enable CodeReuse/ActiveRecord
 
       def lfs_token_check(login, encoded_token, project)
         deploy_key_matches = login.match(/\Alfs\+deploy-key-(\d+)\z/)
-- 
cgit v1.2.1


From 2dd6f423b77c82436e3e0b3978d9bda513207b4b Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Mon, 26 Aug 2019 19:44:28 -0700
Subject: Add limit: 255 to token_ecnrypted column

---
 db/migrate/20190711200508_add_token_encrypted_to_deploy_tokens.rb | 2 +-
 db/schema.rb                                                      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/db/migrate/20190711200508_add_token_encrypted_to_deploy_tokens.rb b/db/migrate/20190711200508_add_token_encrypted_to_deploy_tokens.rb
index 3c352441057..ea0956fdf7f 100644
--- a/db/migrate/20190711200508_add_token_encrypted_to_deploy_tokens.rb
+++ b/db/migrate/20190711200508_add_token_encrypted_to_deploy_tokens.rb
@@ -6,6 +6,6 @@ class AddTokenEncryptedToDeployTokens < ActiveRecord::Migration[5.1]
   DOWNTIME = false
 
   def change
-    add_column :deploy_tokens, :token_encrypted, :string
+    add_column :deploy_tokens, :token_encrypted, :string, limit: 255
   end
 end
diff --git a/db/schema.rb b/db/schema.rb
index 1393737b8b9..f30dad3d030 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1123,7 +1123,7 @@ ActiveRecord::Schema.define(version: 2019_08_20_163320) do
     t.string "name", null: false
     t.string "token"
     t.string "username"
-    t.string "token_encrypted"
+    t.string "token_encrypted", limit: 255
     t.index ["token", "expires_at", "id"], name: "index_deploy_tokens_on_token_and_expires_at_and_id", where: "(revoked IS FALSE)"
     t.index ["token"], name: "index_deploy_tokens_on_token", unique: true
     t.index ["token_encrypted"], name: "index_deploy_tokens_on_token_encrypted", unique: true
-- 
cgit v1.2.1


From f8b2d63e1a251595de79145b415d95ac41f72b7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexis=20S=C3=A1nchez?= <aasanchez@gmail.com>
Date: Tue, 27 Aug 2019 03:01:05 +0000
Subject: Update doc/api/events.md

---
 doc/api/events.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/api/events.md b/doc/api/events.md
index 6dca8e52f69..1cd7047b867 100644
--- a/doc/api/events.md
+++ b/doc/api/events.md
@@ -70,7 +70,7 @@ Parameters:
 
 Example request:
 
-```
+```bash
 curl --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/events?target_type=issue&action=created&after=2017-01-31&before=2017-03-01
 ```
 
@@ -275,7 +275,7 @@ Parameters:
 
 Example request:
 
-```
+```bash
 curl --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/projects/:project_id/events?target_type=issue&action=created&after=2017-01-31&before=2017-03-01
 ```
 
@@ -343,8 +343,8 @@ Example response:
         "username": "root",
         "id": 1,
         "state": "active",
-        "avatar_url": "http://localhost:3000/uploads/user/avatar/1/fox_avatar.png",
-        "web_url": "http://localhost:3000/root"
+        "avatar_url": "https://gitlab.example.com/uploads/user/avatar/1/fox_avatar.png",
+        "web_url": "https://gitlab.example.com/root"
       },
       "created_at": "2015-12-04T10:33:56.698Z",
       "system": false,
@@ -357,8 +357,8 @@ Example response:
       "username": "root",
       "id": 1,
       "state": "active",
-      "avatar_url": "http://localhost:3000/uploads/user/avatar/1/fox_avatar.png",
-      "web_url": "http://localhost:3000/root"
+      "avatar_url": "https://gitlab.example.com/uploads/user/avatar/1/fox_avatar.png",
+      "web_url": "https://gitlab.example.com/root"
     },
     "author_username": "root"
   }
-- 
cgit v1.2.1


From 6e2032f24e0428189f8c9fe9e296a9630277155e Mon Sep 17 00:00:00 2001
From: dodocat <jingqq5210@gmail.com>
Date: Tue, 27 Aug 2019 03:46:32 +0000
Subject: Update docs and comments about saml with allow_bypass_two_factor

allow_bypass_two_factor configration dose not work with saml provider
---
 changelogs/unreleased/oauth_bypass_two_factor.yml |  5 +++++
 config/gitlab.yml.example                         |  8 ++++++++
 config/initializers/1_settings.rb                 |  1 +
 doc/integration/omniauth.md                       | 20 ++++++++++++++++++++
 lib/gitlab/auth/o_auth/user.rb                    |  7 ++++++-
 spec/features/oauth_login_spec.rb                 | 12 ++++++++++++
 spec/lib/gitlab/auth/o_auth/user_spec.rb          | 22 ++++++++++++++++++----
 7 files changed, 70 insertions(+), 5 deletions(-)
 create mode 100644 changelogs/unreleased/oauth_bypass_two_factor.yml

diff --git a/changelogs/unreleased/oauth_bypass_two_factor.yml b/changelogs/unreleased/oauth_bypass_two_factor.yml
new file mode 100644
index 00000000000..7261e65a9f3
--- /dev/null
+++ b/changelogs/unreleased/oauth_bypass_two_factor.yml
@@ -0,0 +1,5 @@
+---
+title: Add option to allow OAuth providers to bypass two factor
+merge_request: 31996
+author: Dodocat
+type: added
diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
index 973c2747838..20b1020e025 100644
--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
@@ -780,6 +780,14 @@ production: &base
     # (default: [])
     external_providers: []
 
+    # CAUTION!
+    # This allows users to login with the specified providers without two factor. Define the allowed providers
+    # using an array, e.g. ["twitter", 'google_oauth2'], or as true/false to allow all providers or none.
+    # This option should only be configured for providers which already have two factor. 
+    # This configration dose not apply to SAML.
+    # (default: false)
+    allow_bypass_two_factor: ["twitter", 'google_oauth2']
+
     ## Auth providers
     # Uncomment the following lines and fill in the data of the auth provider you want to use
     # If your favorite auth provider is not listed you can use others:
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index fdc6b0a05ab..81433b620bc 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -84,6 +84,7 @@ Settings['omniauth'] ||= Settingslogic.new({})
 Settings.omniauth['enabled'] = true if Settings.omniauth['enabled'].nil?
 Settings.omniauth['auto_sign_in_with_provider'] = false if Settings.omniauth['auto_sign_in_with_provider'].nil?
 Settings.omniauth['allow_single_sign_on'] = false if Settings.omniauth['allow_single_sign_on'].nil?
+Settings.omniauth['allow_bypass_two_factor'] = false if Settings.omniauth['allow_bypass_two_factor'].nil?
 Settings.omniauth['external_providers'] = [] if Settings.omniauth['external_providers'].nil?
 Settings.omniauth['block_auto_created_users'] = true if Settings.omniauth['block_auto_created_users'].nil?
 Settings.omniauth['auto_link_ldap_user'] = false if Settings.omniauth['auto_link_ldap_user'].nil?
diff --git a/doc/integration/omniauth.md b/doc/integration/omniauth.md
index 7a92ed994c7..0fc5a25ae33 100644
--- a/doc/integration/omniauth.md
+++ b/doc/integration/omniauth.md
@@ -277,3 +277,23 @@ omniauth:
   sync_profile_from_provider: ['twitter', 'google_oauth2']
   sync_profile_attributes: ['email', 'location']
 ```
+## Bypassing two factor authentication
+
+Starting with GitLab 12.3, this allows users to login with the specified
+providers without two factor authentication.
+
+Define the allowed providers using an array, e.g. `["twitter", 'google_oauth2']`, or as
+`true`/`false` to allow all providers or none. This option should only be configured
+for providers which already have two factor authentication (default: false).
+This configration dose not apply to SAML.
+
+```ruby
+gitlab_rails['omniauth_allow_bypass_two_factor'] = ['twitter', 'google_oauth2']
+```
+
+**For installations from source**
+
+```yaml
+omniauth:
+  allow_bypass_two_factor: ['twitter', 'google_oauth2']
+```
diff --git a/lib/gitlab/auth/o_auth/user.rb b/lib/gitlab/auth/o_auth/user.rb
index 09d1d79fefc..f121dce4cbb 100644
--- a/lib/gitlab/auth/o_auth/user.rb
+++ b/lib/gitlab/auth/o_auth/user.rb
@@ -77,7 +77,12 @@ module Gitlab
         end
 
         def bypass_two_factor?
-          false
+          providers = Gitlab.config.omniauth.allow_bypass_two_factor
+          if providers.is_a?(Array)
+            providers.include?(auth_hash.provider)
+          else
+            providers
+          end
         end
 
         protected
diff --git a/spec/features/oauth_login_spec.rb b/spec/features/oauth_login_spec.rb
index a47eaa9bda7..c6e69fa3fb0 100644
--- a/spec/features/oauth_login_spec.rb
+++ b/spec/features/oauth_login_spec.rb
@@ -55,6 +55,18 @@ describe 'OAuth Login', :js, :allow_forgery_protection do
 
           expect(current_path).to eq root_path
         end
+
+        it 'when bypass-two-factor is enabled' do
+          allow(Gitlab.config.omniauth).to receive_messages(allow_bypass_two_factor: true)
+          login_via(provider.to_s, user, uid, remember_me: false)
+          expect(current_path).to eq root_path
+        end
+
+        it 'when bypass-two-factor is disabled' do
+          allow(Gitlab.config.omniauth).to receive_messages(allow_bypass_two_factor: false)
+          login_with_provider(provider, enter_two_factor: true)
+          expect(current_path).to eq root_path
+        end
       end
 
       context 'when "remember me" is checked' do
diff --git a/spec/lib/gitlab/auth/o_auth/user_spec.rb b/spec/lib/gitlab/auth/o_auth/user_spec.rb
index a9b15c411dc..1e3da4f7c2d 100644
--- a/spec/lib/gitlab/auth/o_auth/user_spec.rb
+++ b/spec/lib/gitlab/auth/o_auth/user_spec.rb
@@ -787,11 +787,25 @@ describe Gitlab::Auth::OAuth::User do
     end
   end
 
-  describe '#bypass_two_factor?' do
-    subject { oauth_user.bypass_two_factor? }
+  describe "#bypass_two_factor?" do
+    it "when with allow_bypass_two_factor disabled (Default)" do
+      stub_omniauth_config(allow_bypass_two_factor: false)
+      expect(oauth_user.bypass_two_factor?).to be_falsey
+    end
+
+    it "when with allow_bypass_two_factor enabled" do
+      stub_omniauth_config(allow_bypass_two_factor: true)
+      expect(oauth_user.bypass_two_factor?).to be_truthy
+    end
+
+    it "when provider in allow_bypass_two_factor array" do
+      stub_omniauth_config(allow_bypass_two_factor: [provider])
+      expect(oauth_user.bypass_two_factor?).to be_truthy
+    end
 
-    it 'returns always false' do
-      is_expected.to be_falsey
+    it "when provider not in allow_bypass_two_factor array" do
+      stub_omniauth_config(allow_bypass_two_factor: ["foo"])
+      expect(oauth_user.bypass_two_factor?).to be_falsey
     end
   end
 end
-- 
cgit v1.2.1


From 9f219873a1677d17275e08b9ca7328f976c84fa9 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Fri, 23 Aug 2019 23:41:47 -0700
Subject: Add QA specs for using IP rate limits

This will help prevent issues such as
https://gitlab.com/gitlab-org/gitlab-ce/issues/66449.
---
 .../application_settings/_ip_limits.html.haml      |  8 +++---
 .../admin/application_settings/network.html.haml   |  2 +-
 app/views/layouts/nav/sidebar/_admin.html.haml     |  2 +-
 qa/qa.rb                                           |  2 ++
 qa/qa/page/admin/menu.rb                           |  8 ++++++
 qa/qa/page/admin/settings/component/ip_limits.rb   | 30 ++++++++++++++++++++++
 qa/qa/page/admin/settings/network.rb               | 23 +++++++++++++++++
 qa/qa/runtime/api/client.rb                        | 21 ++++++++++++++-
 .../features/api/1_manage/rate_limits_spec.rb      | 20 +++++++++++++++
 9 files changed, 109 insertions(+), 7 deletions(-)
 create mode 100644 qa/qa/page/admin/settings/component/ip_limits.rb
 create mode 100644 qa/qa/page/admin/settings/network.rb
 create mode 100644 qa/qa/specs/features/api/1_manage/rate_limits_spec.rb

diff --git a/app/views/admin/application_settings/_ip_limits.html.haml b/app/views/admin/application_settings/_ip_limits.html.haml
index 67a04fcf698..9512c1837bf 100644
--- a/app/views/admin/application_settings/_ip_limits.html.haml
+++ b/app/views/admin/application_settings/_ip_limits.html.haml
@@ -4,7 +4,7 @@
   %fieldset
     .form-group
       .form-check
-        = f.check_box :throttle_unauthenticated_enabled, class: 'form-check-input'
+        = f.check_box :throttle_unauthenticated_enabled, class: 'form-check-input', data: { qa_selector: 'throttle_unauthenticated_checkbox' }
         = f.label :throttle_unauthenticated_enabled, class: 'form-check-label' do
           Enable unauthenticated request rate limit
         %span.form-text.text-muted
@@ -17,7 +17,7 @@
       = f.number_field :throttle_unauthenticated_period_in_seconds, class: 'form-control'
     .form-group
       .form-check
-        = f.check_box :throttle_authenticated_api_enabled, class: 'form-check-input'
+        = f.check_box :throttle_authenticated_api_enabled, class: 'form-check-input', data: { qa_selector: 'throttle_authenticated_api_checkbox' }
         = f.label :throttle_authenticated_api_enabled, class: 'form-check-label' do
           Enable authenticated API request rate limit
         %span.form-text.text-muted
@@ -30,7 +30,7 @@
       = f.number_field :throttle_authenticated_api_period_in_seconds, class: 'form-control'
     .form-group
       .form-check
-        = f.check_box :throttle_authenticated_web_enabled, class: 'form-check-input'
+        = f.check_box :throttle_authenticated_web_enabled, class: 'form-check-input', data: { qa_selector: 'throttle_authenticated_web_checkbox' }
         = f.label :throttle_authenticated_web_enabled, class: 'form-check-label' do
           Enable authenticated web request rate limit
         %span.form-text.text-muted
@@ -42,4 +42,4 @@
       = f.label :throttle_authenticated_web_period_in_seconds, 'Rate limit period in seconds', class: 'label-bold'
       = f.number_field :throttle_authenticated_web_period_in_seconds, class: 'form-control'
 
-  = f.submit 'Save changes', class: "btn btn-success"
+  = f.submit 'Save changes', class: "btn btn-success", data: { qa_selector: 'save_changes_button' }
diff --git a/app/views/admin/application_settings/network.html.haml b/app/views/admin/application_settings/network.html.haml
index 26fd745f45f..3a4d901ca1d 100644
--- a/app/views/admin/application_settings/network.html.haml
+++ b/app/views/admin/application_settings/network.html.haml
@@ -13,7 +13,7 @@
   .settings-content
     = render 'performance'
 
-%section.settings.as-ip-limits.no-animate#js-ip-limits-settings{ class: ('expanded' if expanded_by_default?) }
+%section.settings.as-ip-limits.no-animate#js-ip-limits-settings{ class: ('expanded' if expanded_by_default?), data: { qa_selector: 'ip_limits_section' } }
   .settings-header
     %h4
       = _('User and IP Rate Limits')
diff --git a/app/views/layouts/nav/sidebar/_admin.html.haml b/app/views/layouts/nav/sidebar/_admin.html.haml
index cb39c830170..9e92ced9f89 100644
--- a/app/views/layouts/nav/sidebar/_admin.html.haml
+++ b/app/views/layouts/nav/sidebar/_admin.html.haml
@@ -261,7 +261,7 @@
                 %span
                   = _('Metrics and profiling')
             = nav_link(path: 'application_settings#network') do
-              = link_to network_admin_application_settings_path, title: _('Network') do
+              = link_to network_admin_application_settings_path, title: _('Network'), data: { qa_selector: 'admin_settings_network_item' } do
                 %span
                   = _('Network')
             - if template_exists?('admin/application_settings/geo')
diff --git a/qa/qa.rb b/qa/qa.rb
index a760f72f70d..c12a9d9d19a 100644
--- a/qa/qa.rb
+++ b/qa/qa.rb
@@ -303,8 +303,10 @@ module QA
         autoload :Repository, 'qa/page/admin/settings/repository'
         autoload :General, 'qa/page/admin/settings/general'
         autoload :MetricsAndProfiling, 'qa/page/admin/settings/metrics_and_profiling'
+        autoload :Network, 'qa/page/admin/settings/network'
 
         module Component
+          autoload :IpLimits, 'qa/page/admin/settings/component/ip_limits'
           autoload :RepositoryStorage, 'qa/page/admin/settings/component/repository_storage'
           autoload :AccountAndLimit, 'qa/page/admin/settings/component/account_and_limit'
           autoload :PerformanceBar, 'qa/page/admin/settings/component/performance_bar'
diff --git a/qa/qa/page/admin/menu.rb b/qa/qa/page/admin/menu.rb
index 61ec9854726..a520fb546c8 100644
--- a/qa/qa/page/admin/menu.rb
+++ b/qa/qa/page/admin/menu.rb
@@ -49,6 +49,14 @@ module QA
           end
         end
 
+        def go_to_network_settings
+          hover_settings do
+            within_submenu do
+              click_element :admin_settings_network_item
+            end
+          end
+        end
+
         private
 
         def hover_settings
diff --git a/qa/qa/page/admin/settings/component/ip_limits.rb b/qa/qa/page/admin/settings/component/ip_limits.rb
new file mode 100644
index 00000000000..9db2ae8ba58
--- /dev/null
+++ b/qa/qa/page/admin/settings/component/ip_limits.rb
@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module QA
+  module Page
+    module Admin
+      module Settings
+        module Component
+          class IpLimits < Page::Base
+            view 'app/views/admin/application_settings/_ip_limits.html.haml' do
+              element :throttle_unauthenticated_checkbox
+              element :throttle_authenticated_api_checkbox
+              element :throttle_authenticated_web_checkbox
+              element :save_changes_button
+            end
+
+            def enable_throttles
+              check_element :throttle_unauthenticated_checkbox
+              check_element :throttle_authenticated_api_checkbox
+              check_element :throttle_authenticated_web_checkbox
+            end
+
+            def save_settings
+              click_element :save_changes_button
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/page/admin/settings/network.rb b/qa/qa/page/admin/settings/network.rb
new file mode 100644
index 00000000000..fdb8fcda281
--- /dev/null
+++ b/qa/qa/page/admin/settings/network.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module QA
+  module Page
+    module Admin
+      module Settings
+        class Network < Page::Base
+          include QA::Page::Settings::Common
+
+          view 'app/views/admin/application_settings/network.html.haml' do
+            element :ip_limits_section
+          end
+
+          def expand_ip_limits(&block)
+            expand_section(:ip_limits_section) do
+              Component::IpLimits.perform(&block)
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/runtime/api/client.rb b/qa/qa/runtime/api/client.rb
index 663be27a849..25d8f3c0fbb 100644
--- a/qa/qa/runtime/api/client.rb
+++ b/qa/qa/runtime/api/client.rb
@@ -8,11 +8,12 @@ module QA
       class Client
         attr_reader :address, :user
 
-        def initialize(address = :gitlab, personal_access_token: nil, is_new_session: true, user: nil)
+        def initialize(address = :gitlab, personal_access_token: nil, is_new_session: true, user: nil, ip_limits: false)
           @address = address
           @personal_access_token = personal_access_token
           @is_new_session = is_new_session
           @user = user
+          enable_ip_limits if ip_limits
         end
 
         def personal_access_token
@@ -26,6 +27,24 @@ module QA
 
         private
 
+        def enable_ip_limits
+          Page::Main::Menu.perform(&:sign_out) if Page::Main::Menu.perform { |p| p.has_personal_area?(wait: 0) }
+
+          Runtime::Browser.visit(@address, Page::Main::Login)
+          Page::Main::Login.perform(&:sign_in_using_admin_credentials)
+          Page::Main::Menu.perform(&:click_admin_area)
+          Page::Admin::Menu.perform(&:go_to_network_settings)
+
+          Page::Admin::Settings::Network.perform do |setting|
+            setting.expand_ip_limits do |page|
+              page.enable_throttles
+              page.save_settings
+            end
+          end
+
+          Page::Main::Menu.perform(&:sign_out)
+        end
+
         def create_personal_access_token
           Page::Main::Menu.perform(&:sign_out) if @is_new_session && Page::Main::Menu.perform { |p| p.has_personal_area?(wait: 0) }
 
diff --git a/qa/qa/specs/features/api/1_manage/rate_limits_spec.rb b/qa/qa/specs/features/api/1_manage/rate_limits_spec.rb
new file mode 100644
index 00000000000..44c5e0b4196
--- /dev/null
+++ b/qa/qa/specs/features/api/1_manage/rate_limits_spec.rb
@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module QA
+  context 'Manage with IP rate limits', :requires_admin do
+    describe 'Users API' do
+      before(:context) do
+        @api_client = Runtime::API::Client.new(:gitlab, ip_limits: true)
+      end
+
+      let(:request) { Runtime::API::Request.new(@api_client, '/users') }
+
+      it 'GET /users' do
+        5.times do
+          get request.url
+          expect_status(200)
+        end
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From f787377eb75a61362aae94a1d47c679644c88fd7 Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Tue, 27 Aug 2019 05:11:00 +0000
Subject: Add missing blank line to omniauth doc

---
 doc/integration/omniauth.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/integration/omniauth.md b/doc/integration/omniauth.md
index 0fc5a25ae33..0314b5a808d 100644
--- a/doc/integration/omniauth.md
+++ b/doc/integration/omniauth.md
@@ -277,6 +277,7 @@ omniauth:
   sync_profile_from_provider: ['twitter', 'google_oauth2']
   sync_profile_attributes: ['email', 'location']
 ```
+
 ## Bypassing two factor authentication
 
 Starting with GitLab 12.3, this allows users to login with the specified
-- 
cgit v1.2.1


From 0c733154266828c26f817386d4a45b5a957ebb67 Mon Sep 17 00:00:00 2001
From: Daniel Gruesso <dgruesso@gitlab.com>
Date: Tue, 27 Aug 2019 05:47:12 +0000
Subject: Update `only` `chat` statement to correct singular form

---
 doc/ci/yaml/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md
index 663fa1395a6..5237c61f191 100644
--- a/doc/ci/yaml/README.md
+++ b/doc/ci/yaml/README.md
@@ -387,7 +387,7 @@ In addition, `only` and `except` allow the use of special keywords:
 | `triggers`       | For pipelines created using a trigger token. |
 | `web`            | For pipelines created using **Run pipeline** button in GitLab UI (under your project's **Pipelines**). |
 | `merge_requests` | When a merge request is created or updated (See [pipelines for merge requests](../merge_request_pipelines/index.md)). |
-| `chats`          | For jobs created using a [GitLab ChatOps](../chatops/README.md) command. |
+| `chat`          | For jobs created using a [GitLab ChatOps](../chatops/README.md) command. |
 
 In the example below, `job` will run only for refs that start with `issue-`,
 whereas all branches will be skipped:
-- 
cgit v1.2.1


From 7a162e1a8f1f1aeb45fee149c201115f7a7231c9 Mon Sep 17 00:00:00 2001
From: Sanad Liaquat <sliaquat@gitlab.com>
Date: Tue, 27 Aug 2019 10:48:04 +0500
Subject: CE Backport of EE changes

Add qa selector elements and files from the EE branch
---
 app/views/groups/edit.html.haml                  |  2 +-
 app/views/groups/settings/_permissions.html.haml |  2 +-
 app/views/layouts/nav/sidebar/_group.html.haml   |  2 +-
 qa/qa.rb                                         |  4 ++++
 qa/qa/page/group/settings/general.rb             | 18 ++++++++++++++++++
 qa/qa/resource/sandbox.rb                        |  2 +-
 6 files changed, 26 insertions(+), 4 deletions(-)
 create mode 100644 qa/qa/page/group/settings/general.rb

diff --git a/app/views/groups/edit.html.haml b/app/views/groups/edit.html.haml
index 0c8f86c2822..6d06bb246cb 100644
--- a/app/views/groups/edit.html.haml
+++ b/app/views/groups/edit.html.haml
@@ -14,7 +14,7 @@
   .settings-content
     = render 'groups/settings/general'
 
-%section.settings.gs-permissions.no-animate#js-permissions-settings{ class: ('expanded' if expanded) }
+%section.settings.gs-permissions.no-animate#js-permissions-settings{ class: ('expanded' if expanded), data: { qa_selector: 'permission_lfs_2fa_section' } }
   .settings-header
     %h4.settings-title.js-settings-toggle.js-settings-toggle-trigger-only{ role: 'button' }
       = _('Permissions, LFS, 2FA')
diff --git a/app/views/groups/settings/_permissions.html.haml b/app/views/groups/settings/_permissions.html.haml
index 94a938021f9..c55730ccd31 100644
--- a/app/views/groups/settings/_permissions.html.haml
+++ b/app/views/groups/settings/_permissions.html.haml
@@ -31,4 +31,4 @@
     = render 'groups/settings/two_factor_auth', f: f
     = render_if_exists 'groups/member_lock_setting', f: f, group: @group
 
-  = f.submit _('Save changes'), class: 'btn btn-success prepend-top-default js-dirty-submit'
+  = f.submit _('Save changes'), class: 'btn btn-success prepend-top-default js-dirty-submit', data: { qa_selector: 'save_permissions_changes_button' }
diff --git a/app/views/layouts/nav/sidebar/_group.html.haml b/app/views/layouts/nav/sidebar/_group.html.haml
index 48c9f19f89f..c1f4b3adfec 100644
--- a/app/views/layouts/nav/sidebar/_group.html.haml
+++ b/app/views/layouts/nav/sidebar/_group.html.haml
@@ -147,7 +147,7 @@
                   = _('Settings')
             %li.divider.fly-out-top-item
             = nav_link(path: 'groups#edit') do
-              = link_to edit_group_path(@group), title: _('General') do
+              = link_to edit_group_path(@group), title: _('General'), data: { qa_selector: 'general_settings_link' } do
                 %span
                   = _('General')
 
diff --git a/qa/qa.rb b/qa/qa.rb
index 8be2a289422..47ae22f2267 100644
--- a/qa/qa.rb
+++ b/qa/qa.rb
@@ -160,6 +160,10 @@ module QA
     module Group
       autoload :New, 'qa/page/group/new'
       autoload :Show, 'qa/page/group/show'
+
+      module Settings
+        autoload :General, 'qa/page/group/settings/general'
+      end
     end
 
     module File
diff --git a/qa/qa/page/group/settings/general.rb b/qa/qa/page/group/settings/general.rb
new file mode 100644
index 00000000000..07b421f154a
--- /dev/null
+++ b/qa/qa/page/group/settings/general.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module QA
+  module Page
+    module Group
+      module Settings
+        class General < QA::Page::Base
+          view 'app/views/groups/edit.html.haml' do
+            element :permission_lfs_2fa_section
+          end
+          view 'app/views/groups/settings/_permissions.html.haml' do
+            element :save_permissions_changes_button
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/resource/sandbox.rb b/qa/qa/resource/sandbox.rb
index e2b1c4c0831..6eff0e87ddc 100644
--- a/qa/qa/resource/sandbox.rb
+++ b/qa/qa/resource/sandbox.rb
@@ -7,7 +7,7 @@ module QA
     # creating it if it doesn't yet exist.
     #
     class Sandbox < Base
-      attr_reader :path
+      attr_accessor :path
 
       attribute :id
 
-- 
cgit v1.2.1


From 0b32c3a21cb866a8c13a47a47d6975287d98f094 Mon Sep 17 00:00:00 2001
From: Jace Bennest <jacebennest87@gmail.com>
Date: Tue, 27 Aug 2019 06:10:44 +0000
Subject: [#2838] add cache override explanation

---
 doc/ci/caching/index.md | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/doc/ci/caching/index.md b/doc/ci/caching/index.md
index f8151e3e18c..a59a0477b80 100644
--- a/doc/ci/caching/index.md
+++ b/doc/ci/caching/index.md
@@ -172,6 +172,29 @@ job:
   cache: {}
 ```
 
+### Inherit global config, but override specific settings per job
+
+You can override cache settings without overwriting the global cache by using
+[anchors](../yaml/README.md#anchors). For example, if you want to override the 
+`policy` for one job:
+
+```yaml
+cache: &global_cache
+    key: ${CI_COMMIT_REF_SLUG}
+    paths:
+      - node_modules/
+      - public/
+      - vendor/
+    policy: pull-push
+
+job:
+  cache:
+    # inherit all global cache settings
+    <<: *global_cache
+    # override the policy
+    policy: pull
+```
+
 For more fine tuning, read also about the
 [`cache: policy`](../yaml/README.md#cachepolicy).
 
-- 
cgit v1.2.1


From 20920f8074a45c0e2c3bbeab9be44e7b6d1dd398 Mon Sep 17 00:00:00 2001
From: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Date: Tue, 27 Aug 2019 06:45:13 +0000
Subject: Update CHANGELOG.md for 12.2.2

[ci skip]
---
 CHANGELOG.md | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5f90359861e..08cccd1768b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,34 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 12.2.2
+
+### Security (22 changes)
+
+- Ensure only authorised users can create notes on Merge Requests and Issues.
+- Gitaly: ignore git redirects.
+- Add :login_recaptcha_protection_enabled setting to prevent bots from brute-force attacks.
+- Speed up regexp in namespace format by failing fast after reaching maximum namespace depth.
+- Limit the size of issuable description and comments.
+- Send TODOs for comments on commits correctly.
+- Restrict MergeRequests#test_reports to authenticated users with read-access on Builds.
+- Added image proxy to mitigate potential stealing of IP addresses.
+- Filter out old system notes for epics in notes api endpoint response.
+- Avoid exposing unaccessible repo data upon GFM post processing.
+- Fix HTML injection for label description.
+- Make sure HTML text is always escaped when replacing label/milestone references.
+- Prevent DNS rebind on JIRA service integration.
+- Use admin_group authorization in Groups::RunnersController.
+- Prevent disclosure of merge request ID via email.
+- Show cross-referenced MR-id in issues' activities only to authorized users.
+- Enforce max chars and max render time in markdown math.
+- Check permissions before responding in MergeController#pipeline_status.
+- Remove EXIF from users/personal snippet uploads.
+- Fix project import restricted visibility bypass via API.
+- Fix weak session management by clearing password reset tokens after login (username/email) are updated.
+- Fix SSRF via DNS rebinding in Kubernetes Integration.
+
+
 ## 12.2.1
 
 ### Fixed (3 changes)
-- 
cgit v1.2.1


From 72a91622307d2ac14021fed4af84a6f1d5246dfc Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Tue, 27 Aug 2019 08:41:50 +0000
Subject: Update capitalization in /integrations and /raketasks

Also updates redirect text in /project-services
---
 doc/integration/auth0.md                          |  4 ++--
 doc/integration/azure.md                          |  4 ++--
 doc/integration/cas.md                            |  4 ++--
 doc/integration/elasticsearch.md                  | 22 +++++++++++-----------
 doc/integration/facebook.md                       |  4 ++--
 doc/integration/github.md                         |  6 +++---
 doc/integration/gitlab.md                         |  4 ++--
 doc/integration/jenkins_deprecated.md             |  4 ++--
 doc/integration/jira.md                           |  2 +-
 doc/integration/jira_development_panel.md         |  2 +-
 doc/integration/kerberos.md                       |  7 +++----
 doc/integration/omniauth.md                       |  2 +-
 doc/integration/salesforce.md                     |  4 ++--
 doc/integration/saml.md                           | 10 +++++-----
 doc/integration/shibboleth.md                     | 16 ++++++++--------
 doc/integration/twitter.md                        |  4 ++--
 doc/integration/ultra_auth.md                     |  4 ++--
 doc/project_services/bamboo.md                    |  2 +-
 doc/project_services/bugzilla.md                  |  2 +-
 doc/project_services/emails_on_push.md            |  2 +-
 doc/project_services/hipchat.md                   |  6 +++++-
 doc/project_services/irker.md                     |  2 +-
 doc/project_services/jira.md                      |  2 +-
 doc/project_services/kubernetes.md                |  2 +-
 doc/project_services/mattermost.md                |  2 +-
 doc/project_services/mattermost_slash_commands.md |  2 +-
 doc/project_services/project_services.md          |  2 +-
 doc/project_services/redmine.md                   |  2 +-
 doc/project_services/services_templates.md        |  2 +-
 doc/project_services/slack.md                     |  2 +-
 doc/project_services/slack_slash_commands.md      |  2 +-
 doc/raketasks/README.md                           |  2 +-
 doc/raketasks/backup_restore.md                   | 14 +++++++-------
 doc/raketasks/features.md                         |  2 +-
 doc/raketasks/import.md                           |  8 ++++----
 35 files changed, 82 insertions(+), 79 deletions(-)

diff --git a/doc/integration/auth0.md b/doc/integration/auth0.md
index 5061b863e79..2dd6fa3d5a2 100644
--- a/doc/integration/auth0.md
+++ b/doc/integration/auth0.md
@@ -30,7 +30,7 @@ application.
 
 1. On your GitLab server, open the configuration file.
 
-   For omnibus package:
+   For Omnibus package:
 
    ```sh
    sudo editor /etc/gitlab/gitlab.rb
@@ -48,7 +48,7 @@ application.
 
 1. Add the provider configuration:
 
-   For omnibus package:
+   For Omnibus package:
 
    ```ruby
    gitlab_rails['omniauth_providers'] = [
diff --git a/doc/integration/azure.md b/doc/integration/azure.md
index a9468f201ef..c30d79e3dab 100644
--- a/doc/integration/azure.md
+++ b/doc/integration/azure.md
@@ -32,7 +32,7 @@ To enable the Microsoft Azure OAuth2 OmniAuth provider you must register your ap
 
 1. On your GitLab server, open the configuration file.
 
-   For omnibus package:
+   For Omnibus package:
 
    ```sh
    sudo editor /etc/gitlab/gitlab.rb
@@ -50,7 +50,7 @@ To enable the Microsoft Azure OAuth2 OmniAuth provider you must register your ap
 
 1. Add the provider configuration:
 
-   For omnibus package:
+   For Omnibus package:
 
    ```ruby
    gitlab_rails['omniauth_providers'] = [
diff --git a/doc/integration/cas.md b/doc/integration/cas.md
index f99337376a8..83b64773c9f 100644
--- a/doc/integration/cas.md
+++ b/doc/integration/cas.md
@@ -4,7 +4,7 @@ To enable the CAS OmniAuth provider you must register your application with your
 
 1. On your GitLab server, open the configuration file.
 
-   For omnibus package:
+   For Omnibus package:
 
    ```sh
    sudo editor /etc/gitlab/gitlab.rb
@@ -22,7 +22,7 @@ To enable the CAS OmniAuth provider you must register your application with your
 
 1. Add the provider configuration:
 
-   For omnibus package:
+   For Omnibus package:
 
    ```ruby
    gitlab_rails['omniauth_providers'] = [
diff --git a/doc/integration/elasticsearch.md b/doc/integration/elasticsearch.md
index eee05eaef02..de49508b47a 100644
--- a/doc/integration/elasticsearch.md
+++ b/doc/integration/elasticsearch.md
@@ -123,8 +123,8 @@ production instances, they recommend considerably more resources.
 
 Storage requirements also vary based on the installation side, but as a rule of
 thumb, you should allocate the total size of your production database, **plus**
-two-thirds of the total size of your git repositories. Efforts to reduce this
-total are being tracked in this epic: [gitlab-org&153](https://gitlab.com/groups/gitlab-org/-/epics/153).
+two-thirds of the total size of your Git repositories. Efforts to reduce this
+total are being tracked in [epic &153](https://gitlab.com/groups/gitlab-org/-/epics/153).
 
 ## Enabling Elasticsearch
 
@@ -341,27 +341,27 @@ Currently for repository and snippet files, GitLab would only index up to 1 MB o
 
 There are several rake tasks available to you via the command line:
 
-- [sudo gitlab-rake gitlab:elastic:index](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
+- [`sudo gitlab-rake gitlab:elastic:index`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
   - This is a wrapper task. It does the following:
     - `sudo gitlab-rake gitlab:elastic:create_empty_index`
     - `sudo gitlab-rake gitlab:elastic:clear_index_status`
     - `sudo gitlab-rake gitlab:elastic:index_projects`
     - `sudo gitlab-rake gitlab:elastic:index_snippets`
-- [sudo gitlab-rake gitlab:elastic:index_projects](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
+- [`sudo gitlab-rake gitlab:elastic:index_projects`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
   - This iterates over all projects and queues sidekiq jobs to index them in the background.
-- [sudo gitlab-rake gitlab:elastic:index_projects_status](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
+- [`sudo gitlab-rake gitlab:elastic:index_projects_status`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
   - This determines the overall status of the indexing. It is done by counting the total number of indexed projects, dividing by a count of the total number of projects, then multiplying by 100.
-- [sudo gitlab-rake gitlab:elastic:create_empty_index](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
+- [`sudo gitlab-rake gitlab:elastic:create_empty_index`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
   - This generates an empty index on the Elasticsearch side.
-- [sudo gitlab-rake gitlab:elastic:clear_index_status](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
+- [`sudo gitlab-rake gitlab:elastic:clear_index_status`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
   - This deletes all instances of IndexStatus for all projects.
-- [sudo gitlab-rake gitlab:elastic:delete_index](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
+- [`sudo gitlab-rake gitlab:elastic:delete_index`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
   - This removes the GitLab index on the Elasticsearch instance.
-- [sudo gitlab-rake gitlab:elastic:recreate_index](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
+- [`sudo gitlab-rake gitlab:elastic:recreate_index`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
   - Does the same thing as `sudo gitlab-rake gitlab:elastic:create_empty_index`
-- [sudo gitlab-rake gitlab:elastic:index_snippets](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
+- [`sudo gitlab-rake gitlab:elastic:index_snippets`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
   - Performs an Elasticsearch import that indexes the snippets data.
-- [sudo gitlab-rake gitlab:elastic:projects_not_indexed](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
+- [`sudo gitlab-rake gitlab:elastic:projects_not_indexed`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
   - Displays which projects are not indexed.
 
 ### Environment Variables
diff --git a/doc/integration/facebook.md b/doc/integration/facebook.md
index 49b3d194a01..d46486ad888 100644
--- a/doc/integration/facebook.md
+++ b/doc/integration/facebook.md
@@ -49,7 +49,7 @@ To enable the Facebook OmniAuth provider you must register your application with
 
 1. On your GitLab server, open the configuration file.
 
-   For omnibus package:
+   For Omnibus package:
 
    ```sh
    sudo editor /etc/gitlab/gitlab.rb
@@ -67,7 +67,7 @@ To enable the Facebook OmniAuth provider you must register your application with
 
 1. Add the provider configuration:
 
-   For omnibus package:
+   For Omnibus package:
 
    ```ruby
    gitlab_rails['omniauth_providers'] = [
diff --git a/doc/integration/github.md b/doc/integration/github.md
index c8dbae65465..f19b3109d15 100644
--- a/doc/integration/github.md
+++ b/doc/integration/github.md
@@ -36,7 +36,7 @@ To get the credentials (a pair of Client ID and Client Secret), you must registe
 
 1. On your GitLab server, open the configuration file.
 
-   For omnibus package:
+   For Omnibus package:
 
    ```sh
    sudo editor /etc/gitlab/gitlab.rb
@@ -54,7 +54,7 @@ To get the credentials (a pair of Client ID and Client Secret), you must registe
 
 1. Add the provider configuration:
 
-   For omnibus package:
+   For Omnibus package:
 
    For GitHub.com:
 
@@ -124,7 +124,7 @@ certificate and the imports are failing, you will need to disable SSL verificati
 It should be disabled by adding `verify_ssl` to `false` in the provider configuration
 and changing the global Git `sslVerify` option to `false` in the GitLab server.
 
-For omnibus package:
+For Omnibus package:
 
 ```ruby
 gitlab_rails['omniauth_providers'] = [
diff --git a/doc/integration/gitlab.md b/doc/integration/gitlab.md
index 46da3d88d90..74f2d5cb403 100644
--- a/doc/integration/gitlab.md
+++ b/doc/integration/gitlab.md
@@ -30,7 +30,7 @@ GitLab.com will generate an application ID and secret key for you to use.
 
 1. On your GitLab server, open the configuration file.
 
-   For omnibus package:
+   For Omnibus package:
 
    ```sh
    sudo editor /etc/gitlab/gitlab.rb
@@ -48,7 +48,7 @@ GitLab.com will generate an application ID and secret key for you to use.
 
 1. Add the provider configuration:
 
-   For omnibus package:
+   For Omnibus package:
 
    ```ruby
    gitlab_rails['omniauth_providers'] = [
diff --git a/doc/integration/jenkins_deprecated.md b/doc/integration/jenkins_deprecated.md
index bac89ae2dc6..3e437eb688a 100644
--- a/doc/integration/jenkins_deprecated.md
+++ b/doc/integration/jenkins_deprecated.md
@@ -14,12 +14,12 @@ Integration includes:
 Requirements:
 
 - [Jenkins GitLab Hook plugin](https://wiki.jenkins.io/display/JENKINS/GitLab+Hook+Plugin)
-- git clone access for Jenkins from GitLab repo (via ssh key)
+- Git clone access for Jenkins from GitLab repo (via ssh key)
 
 ## Jenkins
 
 1. Install [GitLab Hook plugin](https://wiki.jenkins.io/display/JENKINS/GitLab+Hook+Plugin)
-1. Set up jenkins project
+1. Set up Jenkins project
 
 ![screen](img/jenkins_project.png)
 
diff --git a/doc/integration/jira.md b/doc/integration/jira.md
index c09fde08326..37eba25fb5a 100644
--- a/doc/integration/jira.md
+++ b/doc/integration/jira.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/jira.md'
 ---
 
-This document was moved to [integrations/jira](../user/project/integrations/jira.md).
+This document was moved to [another location](../user/project/integrations/jira.md).
diff --git a/doc/integration/jira_development_panel.md b/doc/integration/jira_development_panel.md
index 3e894371df9..c413e07ec93 100644
--- a/doc/integration/jira_development_panel.md
+++ b/doc/integration/jira_development_panel.md
@@ -23,7 +23,7 @@ or instance admin (in the case of self-hosted GitLab) set up the integration,
 in order to simplify administration.
 
 TIP: **Tip:**
-Create and use a single-purpose "jira" user in GitLab, so that removing
+Create and use a single-purpose `jira` user in GitLab, so that removing
 regular users won't impact your integration.
 
 ## Requirements
diff --git a/doc/integration/kerberos.md b/doc/integration/kerberos.md
index b791cbd428d..81a1e9b0067 100644
--- a/doc/integration/kerberos.md
+++ b/doc/integration/kerberos.md
@@ -46,7 +46,7 @@ sudo chmod 0600 /etc/http.keytab
 For source installations, make sure the `kerberos` gem group
 [has been installed](../install/installation.md#install-gems).
 
-1. Edit the kerberos section of [gitlab.yml] to enable Kerberos ticket-based
+1. Edit the `kerberos` section of [`gitlab.yml`](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/config/gitlab.yml.example) to enable Kerberos ticket-based
    authentication. In most cases, you only need to enable Kerberos and specify
    the location of the keytab:
 
@@ -153,7 +153,7 @@ keep offering only `basic` authentication.
      listen [::]:8443 ipv6only=on ssl;
    ```
 
-1. Update the Kerberos section of [gitlab.yml]:
+1. Update the `kerberos` section of [`gitlab.yml`](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/config/gitlab.yml.example):
 
    ```yaml
    kerberos:
@@ -203,7 +203,7 @@ remove the OmniAuth provider named `kerberos` from your `gitlab.yml` /
 
 **For installations from source**
 
-1. Edit [gitlab.yml] and remove the `- { name: 'kerberos' }` line under omniauth
+1. Edit [`gitlab.yml`](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/config/gitlab.yml.example) and remove the `- { name: 'kerberos' }` line under omniauth
    providers:
 
    ```yaml
@@ -295,7 +295,6 @@ See also: [Git v2.11 release notes](https://github.com/git/git/blob/master/Docum
 - <http://blog.manula.org/2012/04/setting-up-kerberos-server-with-debian.html>
 - <http://www.roguelynn.com/words/explain-like-im-5-kerberos/>
 
-[gitlab.yml]: https://gitlab.com/gitlab-org/gitlab-ce/blob/master/config/gitlab.yml.example
 [restart gitlab]: ../administration/restart_gitlab.md#installations-from-source
 [reconfigure gitlab]: ../administration/restart_gitlab.md#omnibus-gitlab-reconfigure
 [nginx]: http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers
diff --git a/doc/integration/omniauth.md b/doc/integration/omniauth.md
index 0314b5a808d..ef319f7f0ce 100644
--- a/doc/integration/omniauth.md
+++ b/doc/integration/omniauth.md
@@ -69,7 +69,7 @@ that are in common for all providers that we need to consider.
 
 To change these settings:
 
-- **For omnibus package**
+- **For Omnibus package**
 
   Open the configuration file:
 
diff --git a/doc/integration/salesforce.md b/doc/integration/salesforce.md
index 176622e8050..10ab9d3c126 100644
--- a/doc/integration/salesforce.md
+++ b/doc/integration/salesforce.md
@@ -29,7 +29,7 @@ To get the credentials (a pair of Client ID and Client Secret), you must [create
 
 1. On your GitLab server, open the configuration file.
 
-   For omnibus package:
+   For Omnibus package:
 
    ```sh
    sudo editor /etc/gitlab/gitlab.rb
@@ -46,7 +46,7 @@ To get the credentials (a pair of Client ID and Client Secret), you must [create
 
 1. Add the provider configuration:
 
-   For omnibus package:
+   For Omnibus package:
 
    ```ruby
    gitlab_rails['omniauth_providers'] = [
diff --git a/doc/integration/saml.md b/doc/integration/saml.md
index 22e07594d6f..de160e72dda 100644
--- a/doc/integration/saml.md
+++ b/doc/integration/saml.md
@@ -17,7 +17,7 @@ in your SAML IdP:
 
 1. On your GitLab server, open the configuration file.
 
-   For omnibus package:
+   For Omnibus package:
 
    ```sh
    sudo editor /etc/gitlab/gitlab.rb
@@ -34,7 +34,7 @@ in your SAML IdP:
 1. To allow your users to use SAML to sign up without having to manually create
    an account first, don't forget to add the following values to your configuration:
 
-   For omnibus package:
+   For Omnibus package:
 
    ```ruby
    gitlab_rails['omniauth_enabled'] = true
@@ -54,7 +54,7 @@ in your SAML IdP:
 1. You can also automatically link SAML users with existing GitLab users if their
    email addresses match by adding the following setting:
 
-   For omnibus package:
+   For Omnibus package:
 
    ```ruby
    gitlab_rails['omniauth_auto_link_saml_user'] = true
@@ -68,7 +68,7 @@ in your SAML IdP:
 
 1. Add the provider configuration:
 
-   For omnibus package:
+   For Omnibus package:
 
    ```ruby
    gitlab_rails['omniauth_providers'] = [
@@ -342,7 +342,7 @@ You can add this setting to your GitLab configuration to automatically redirect
 to your SAML server for authentication, thus removing the need to click a button
 before actually signing in.
 
-For omnibus package:
+For Omnibus package:
 
 ```ruby
 gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'
diff --git a/doc/integration/shibboleth.md b/doc/integration/shibboleth.md
index 27355d25266..ca5a8077e73 100644
--- a/doc/integration/shibboleth.md
+++ b/doc/integration/shibboleth.md
@@ -1,18 +1,18 @@
 # Shibboleth OmniAuth Provider
 
-This documentation is for enabling shibboleth with omnibus-gitlab package.
+This documentation is for enabling Shibboleth with the Omnibus GitLab package.
 
-In order to enable Shibboleth support in gitlab we need to use Apache instead of Nginx (It may be possible to use Nginx, however this is difficult to configure using the bundled Nginx provided in the omnibus-gitlab package). Apache uses mod_shib2 module for shibboleth authentication and can pass attributes as headers to omniauth-shibboleth provider.
+In order to enable Shibboleth support in GitLab we need to use Apache instead of Nginx (It may be possible to use Nginx, however this is difficult to configure using the bundled Nginx provided in the Omnibus GitLab package). Apache uses mod_shib2 module for Shibboleth authentication and can pass attributes as headers to Omniauth Shibboleth provider.
 
-To enable the Shibboleth OmniAuth provider you must configure Apache shibboleth module.
+To enable the Shibboleth OmniAuth provider you must configure Apache Shibboleth module.
 The installation and configuration of the module itself is out of the scope of this document.
 Check <https://wiki.shibboleth.net/confluence/display/SP3/Apache> for more info.
 
-You can find Apache config in gitlab-recipes (<https://gitlab.com/gitlab-org/gitlab-recipes/tree/master/web-server/apache>).
+You can find Apache config in [GitLab Recipes](https://gitlab.com/gitlab-org/gitlab-recipes/tree/master/web-server/apache).
 
 The following changes are needed to enable Shibboleth:
 
-1. Protect omniauth-shibboleth callback URL:
+1. Protect Omniauth Shibboleth callback URL:
 
    ```
    <Location /users/auth/shibboleth/callback>
@@ -32,7 +32,7 @@ The following changes are needed to enable Shibboleth:
    </Location>
    ```
 
-1. Exclude shibboleth URLs from rewriting. Add `RewriteCond %{REQUEST_URI} !/Shibboleth.sso` and `RewriteCond %{REQUEST_URI} !/shibboleth-sp`. Config should look like this:
+1. Exclude Shibboleth URLs from rewriting. Add `RewriteCond %{REQUEST_URI} !/Shibboleth.sso` and `RewriteCond %{REQUEST_URI} !/shibboleth-sp`. Config should look like this:
 
    ```
    # Apache equivalent of Nginx try files
@@ -50,7 +50,7 @@ The following changes are needed to enable Shibboleth:
    attribute mapping. Therefore the values of the `args` hash
    should be in the form of `"HTTP_ATTRIBUTE"`. The keys in the hash are arguments
    to the [OmniAuth::Strategies::Shibboleth class](https://github.com/toyokazu/omniauth-shibboleth/blob/master/lib/omniauth/strategies/shibboleth.rb)
-   and are documented by the [omniauth-shibboleth gem](https://github.com/toyokazu/omniauth-shibboleth)
+   and are documented by the [`omniauth-shibboleth` gem](https://github.com/toyokazu/omniauth-shibboleth)
    (take care to note the version of the gem packaged with GitLab). If some of
    your users appear to be authenticated by Shibboleth and Apache, but GitLab
    rejects their account with a URI that contains "e-mail is invalid" then your
@@ -94,7 +94,7 @@ On the sign in page, there should now be a "Sign in with: Shibboleth" icon below
 ## Apache 2.4 / GitLab 8.6 update
 
 The order of the first 2 Location directives is important. If they are reversed,
-you will not get a shibboleth session!
+you will not get a Shibboleth session!
 
 ```
 <Location />
diff --git a/doc/integration/twitter.md b/doc/integration/twitter.md
index d8096993885..b2bd1b57d0f 100644
--- a/doc/integration/twitter.md
+++ b/doc/integration/twitter.md
@@ -32,7 +32,7 @@ To enable the Twitter OmniAuth provider you must register your application with
 
 1. On your GitLab server, open the configuration file.
 
-   For omnibus package:
+   For Omnibus package:
 
    ```sh
      sudo editor /etc/gitlab/gitlab.rb
@@ -50,7 +50,7 @@ To enable the Twitter OmniAuth provider you must register your application with
 
 1. Add the provider configuration:
 
-   For omnibus package:
+   For Omnibus package:
 
    ```ruby
      gitlab_rails['omniauth_providers'] = [
diff --git a/doc/integration/ultra_auth.md b/doc/integration/ultra_auth.md
index 9ed1bdb4882..fb950ba989a 100644
--- a/doc/integration/ultra_auth.md
+++ b/doc/integration/ultra_auth.md
@@ -25,7 +25,7 @@ To get the credentials (a pair of Client ID and Client Secret), you must registe
 1. Select **Register application**.
 1. On your GitLab server, open the configuration file.
 
-   For omnibus package:
+   For Omnibus package:
 
    ```sh
    sudo editor /etc/gitlab/gitlab.rb
@@ -41,7 +41,7 @@ To get the credentials (a pair of Client ID and Client Secret), you must registe
 1. See [Initial OmniAuth Configuration](omniauth.md#initial-omniauth-configuration) for initial settings.
 1. Add the provider configuration:
 
-   For omnibus package:
+   For Omnibus package:
 
    ```ruby
    gitlab_rails['omniauth_providers'] = [
diff --git a/doc/project_services/bamboo.md b/doc/project_services/bamboo.md
index a1ff8909f87..b1d37898516 100644
--- a/doc/project_services/bamboo.md
+++ b/doc/project_services/bamboo.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/bamboo.md'
 ---
 
-This document was moved to [user/project/integrations/bamboo.md](../user/project/integrations/bamboo.md).
+This document was moved to [another location](../user/project/integrations/bamboo.md).
diff --git a/doc/project_services/bugzilla.md b/doc/project_services/bugzilla.md
index 1abf1b28939..17dff538c0e 100644
--- a/doc/project_services/bugzilla.md
+++ b/doc/project_services/bugzilla.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/bugzilla.md'
 ---
 
-This document was moved to [user/project/integrations/bugzilla.md](../user/project/integrations/bugzilla.md).
+This document was moved to [another location](../user/project/integrations/bugzilla.md).
diff --git a/doc/project_services/emails_on_push.md b/doc/project_services/emails_on_push.md
index c5ab8aa5c70..a7d91934ce9 100644
--- a/doc/project_services/emails_on_push.md
+++ b/doc/project_services/emails_on_push.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/emails_on_push.md'
 ---
 
-This document was moved to [user/project/integrations/emails_on_push.md](../user/project/integrations/emails_on_push.md).
+This document was moved to [another location](../user/project/integrations/emails_on_push.md).
diff --git a/doc/project_services/hipchat.md b/doc/project_services/hipchat.md
index 4ae9f6c6b2e..a2fbbd5cce5 100644
--- a/doc/project_services/hipchat.md
+++ b/doc/project_services/hipchat.md
@@ -1 +1,5 @@
-This document was moved to [user/project/integrations/hipchat.md](../user/project/integrations/hipchat.md).
+---
+redirect_to: '../user/project/integrations/hipchat.md'
+---
+
+This document was moved to [another location](../user/project/integrations/hipchat.md).
diff --git a/doc/project_services/irker.md b/doc/project_services/irker.md
index af47abab117..70e46b1b364 100644
--- a/doc/project_services/irker.md
+++ b/doc/project_services/irker.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/irker.md'
 ---
 
-This document was moved to [user/project/integrations/irker.md](../user/project/integrations/irker.md).
+This document was moved to [another location](../user/project/integrations/irker.md).
diff --git a/doc/project_services/jira.md b/doc/project_services/jira.md
index 6a0108f400f..37eba25fb5a 100644
--- a/doc/project_services/jira.md
+++ b/doc/project_services/jira.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/jira.md'
 ---
 
-This document was moved to [user/project/integrations/jira.md](../user/project/integrations/jira.md).
+This document was moved to [another location](../user/project/integrations/jira.md).
diff --git a/doc/project_services/kubernetes.md b/doc/project_services/kubernetes.md
index cfe36fcd1b2..585c5ddb002 100644
--- a/doc/project_services/kubernetes.md
+++ b/doc/project_services/kubernetes.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/kubernetes.md'
 ---
 
-This document was moved to [user/project/integrations/kubernetes.md](../user/project/integrations/kubernetes.md).
+This document was moved to [another location](../user/project/integrations/kubernetes.md).
diff --git a/doc/project_services/mattermost.md b/doc/project_services/mattermost.md
index de9f4d14cf7..78888395031 100644
--- a/doc/project_services/mattermost.md
+++ b/doc/project_services/mattermost.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/mattermost.md'
 ---
 
-This document was moved to [user/project/integrations/mattermost.md](../user/project/integrations/mattermost.md).
+This document was moved to [another location](../user/project/integrations/mattermost.md).
diff --git a/doc/project_services/mattermost_slash_commands.md b/doc/project_services/mattermost_slash_commands.md
index 82ec34739c1..0c2774d95e0 100644
--- a/doc/project_services/mattermost_slash_commands.md
+++ b/doc/project_services/mattermost_slash_commands.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/mattermost_slash_commands.md'
 ---
 
-This document was moved to [user/project/integrations/mattermost_slash_commands.md](../user/project/integrations/mattermost_slash_commands.md).
+This document was moved to [another location](../user/project/integrations/mattermost_slash_commands.md).
diff --git a/doc/project_services/project_services.md b/doc/project_services/project_services.md
index a355851a273..2ae7a0ce3ce 100644
--- a/doc/project_services/project_services.md
+++ b/doc/project_services/project_services.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/project_services.md'
 ---
 
-This document was moved to [user/project/integrations/project_services.md](../user/project/integrations/project_services.md).
+This document was moved to [another location](../user/project/integrations/project_services.md).
diff --git a/doc/project_services/redmine.md b/doc/project_services/redmine.md
index 05f28f00adc..141c72d6b6b 100644
--- a/doc/project_services/redmine.md
+++ b/doc/project_services/redmine.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/redmine.md'
 ---
 
-This document was moved to [user/project/integrations/redmine.md](../user/project/integrations/redmine.md).
+This document was moved to [another location](../user/project/integrations/redmine.md).
diff --git a/doc/project_services/services_templates.md b/doc/project_services/services_templates.md
index ac6b85cc801..8b2c85802de 100644
--- a/doc/project_services/services_templates.md
+++ b/doc/project_services/services_templates.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/services_templates.md'
 ---
 
-This document was moved to [user/project/integrations/services_templates.md](../user/project/integrations/services_templates.md).
+This document was moved to [another location](../user/project/integrations/services_templates.md).
diff --git a/doc/project_services/slack.md b/doc/project_services/slack.md
index 4c89ce92002..815032a08d5 100644
--- a/doc/project_services/slack.md
+++ b/doc/project_services/slack.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/slack.md'
 ---
 
-This document was moved to [user/project/integrations/slack.md](../user/project/integrations/slack.md).
+This document was moved to [another location](../user/project/integrations/slack.md).
diff --git a/doc/project_services/slack_slash_commands.md b/doc/project_services/slack_slash_commands.md
index ca0034256f1..caae4d2ba4b 100644
--- a/doc/project_services/slack_slash_commands.md
+++ b/doc/project_services/slack_slash_commands.md
@@ -2,4 +2,4 @@
 redirect_to: '../user/project/integrations/slack_slash_commands.md'
 ---
 
-This document was moved to [user/project/integrations/slack_slash_commands.md](../user/project/integrations/slack_slash_commands.md).
+This document was moved to [another location](../user/project/integrations/slack_slash_commands.md).
diff --git a/doc/raketasks/README.md b/doc/raketasks/README.md
index dcc96507676..ad86555fc17 100644
--- a/doc/raketasks/README.md
+++ b/doc/raketasks/README.md
@@ -12,7 +12,7 @@ comments: false
 - [General Maintenance](../administration/raketasks/maintenance.md) and self-checks
 - [User management](user_management.md)
 - [Webhooks](web_hooks.md)
-- [Import](import.md) of git repositories in bulk
+- [Import](import.md) of Git repositories in bulk
 - [Rebuild authorized_keys file](../administration/raketasks/maintenance.md#rebuild-authorized_keys-file) task for administrators
 - [Migrate Uploads](../administration/raketasks/uploads/migrate.md)
 - [Sanitize Uploads](../administration/raketasks/uploads/sanitize.md)
diff --git a/doc/raketasks/backup_restore.md b/doc/raketasks/backup_restore.md
index 19486052dd9..336000f6cb9 100644
--- a/doc/raketasks/backup_restore.md
+++ b/doc/raketasks/backup_restore.md
@@ -94,7 +94,7 @@ docker exec -t <container name> gitlab-backup create
 
 If you are using the [GitLab helm chart](https://gitlab.com/charts/gitlab) on a
 Kubernetes cluster, you can run the backup task using `backup-utility` script on
-the gitlab task runner pod via `kubectl`. Refer to [backing up a GitLab installation](https://gitlab.com/charts/gitlab/blob/master/doc/backup-restore/backup.md#backing-up-a-gitlab-installation) for more details:
+the GitLab task runner pod via `kubectl`. Refer to [backing up a GitLab installation](https://gitlab.com/charts/gitlab/blob/master/doc/backup-restore/backup.md#backing-up-a-gitlab-installation) for more details:
 
 ```sh
 kubectl exec -it <gitlab task-runner pod> backup-utility
@@ -458,7 +458,7 @@ You may also send backups to a mounted share (`NFS` / `CIFS` / `SMB` / etc.) by
 using the Fog [`Local`](https://github.com/fog/fog-local#usage) storage provider.
 The directory pointed to by the `local_root` key **must** be owned by the `git`
 user **when mounted** (mounting with the `uid=` of the `git` user for `CIFS` and
-`SMB`) or the user that you are executing the backup tasks under (for omnibus
+`SMB`) or the user that you are executing the backup tasks under (for Omnibus
 packages, this is the `git` user).
 
 The `backup_upload_remote_directory` **must** be set in addition to the
@@ -507,7 +507,7 @@ For installations from source:
 ### Backup archive permissions
 
 The backup archives created by GitLab (`1393513186_2014_02_27_gitlab_backup.tar`)
-will have owner/group git:git and 0600 permissions by default.
+will have owner/group `git`/`git` and 0600 permissions by default.
 This is meant to avoid other system users reading GitLab's data.
 If you need the backup archives to have different permissions you can use the 'archive_permissions' setting.
 
@@ -614,7 +614,7 @@ GitLab that you created it on, for example CE 9.1.0.
 
 You need to have a working GitLab installation before you can perform
 a restore. This is mainly because the system user performing the
-restore actions ('git') is usually not allowed to create or delete
+restore actions (`git`) is usually not allowed to create or delete
 the SQL database it needs to import data into ('gitlabhq_production').
 All existing data will be either erased (SQL) or moved to a separate
 directory (repositories, uploads).
@@ -773,14 +773,14 @@ In this case you can consider using filesystem snapshots as part of your backup
 
 Example: Amazon EBS
 
-> A GitLab server using omnibus-gitlab hosted on Amazon AWS.
+> A GitLab server using Omnibus GitLab hosted on Amazon AWS.
 > An EBS drive containing an ext4 filesystem is mounted at `/var/opt/gitlab`.
 > In this case you could make an application backup by taking an EBS snapshot.
 > The backup includes all repositories, uploads and Postgres data.
 
 Example: LVM snapshots + rsync
 
-> A GitLab server using omnibus-gitlab, with an LVM logical volume mounted at `/var/opt/gitlab`.
+> A GitLab server using Omnibus GitLab, with an LVM logical volume mounted at `/var/opt/gitlab`.
 > Replicating the `/var/opt/gitlab` directory using rsync would not be reliable because too many files would change while rsync is running.
 > Instead of rsync-ing `/var/opt/gitlab`, we create a temporary LVM snapshot, which we mount as a read-only filesystem at `/mnt/gitlab_backup`.
 > Now we can have a longer running rsync job which will create a consistent replica on the remote server.
@@ -804,7 +804,7 @@ will have all your repositories, but not any other data.
 
 ## Troubleshooting
 
-### Restoring database backup using omnibus packages outputs warnings
+### Restoring database backup using Omnibus packages outputs warnings
 
 If you are using backup restore procedures you might encounter the following warnings:
 
diff --git a/doc/raketasks/features.md b/doc/raketasks/features.md
index 57c16f110e4..c06800a2aa3 100644
--- a/doc/raketasks/features.md
+++ b/doc/raketasks/features.md
@@ -6,7 +6,7 @@ This command will enable the namespaces feature introduced in v4.0. It will move
 
 Note:
 
-- Because the **repository location will change**, you will need to **update all your git URLs** to point to the new location.
+- Because the **repository location will change**, you will need to **update all your Git URLs** to point to the new location.
 - Username can be changed at **Profile ➔ Account**.
 
 **Example:**
diff --git a/doc/raketasks/import.md b/doc/raketasks/import.md
index c76180a242e..d93e7241fda 100644
--- a/doc/raketasks/import.md
+++ b/doc/raketasks/import.md
@@ -13,7 +13,7 @@
 
 ### Create a new folder to import your Git repositories from
 
-The new folder needs to have git user ownership and read/write/execute access for git user and its group:
+The new folder needs to have Git user ownership and read/write/execute access for Git user and its group:
 
 ```
 sudo -u git mkdir -p /var/opt/gitlab/git-data/repository-import-<date>/new_group
@@ -21,7 +21,7 @@ sudo -u git mkdir -p /var/opt/gitlab/git-data/repository-import-<date>/new_group
 
 ### Copy your bare repositories inside this newly created folder
 
-- Any .git repositories found on any of the subfolders will be imported as projects
+- Any `.git` repositories found on any of the subfolders will be imported as projects
 - Groups will be created as needed, these could be nested folders. Example:
 
 If we copy the repos to `/var/opt/gitlab/git-data/repository-import-<date>`, and repo A needs to be under the groups G1 and G2, it will
@@ -34,7 +34,7 @@ sudo cp -r /old/git/foo.git /var/opt/gitlab/git-data/repository-import-<date>/ne
 sudo chown -R git:git /var/opt/gitlab/git-data/repository-import-<date>
 ```
 
-`foo.git` needs to be owned by the git user and git users group.
+`foo.git` needs to be owned by the `git` user and `git` users group.
 
 If you are using an installation from source, replace `/var/opt/gitlab/` with `/home/git`.
 
@@ -96,7 +96,7 @@ Importing bare repositories from hashed storage is unsupported.
 
 To support importing bare repositories from hashed storage, GitLab 10.4 and
 later stores the full project path with each repository, in a special section of
-the git repository's config file. This section is formatted as follows:
+the Git repository's config file. This section is formatted as follows:
 
 ```
 [gitlab]
-- 
cgit v1.2.1


From 9c87a3499cc0ad2ffda13b843b5095998b20c0d8 Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Tue, 27 Aug 2019 08:44:07 +0000
Subject: Update capitalization in /dev docs

Clean up capitalization in /development /gitlab-basics and
/install
---
 doc/development/architecture.md             | 62 ++++++++++++++---------------
 doc/development/automatic_ce_ee_merge.md    |  4 +-
 doc/development/background_migrations.md    |  2 +-
 doc/development/build_test_package.md       |  8 ++--
 doc/development/database_debugging.md       |  2 +-
 doc/development/ee_features.md              |  4 +-
 doc/development/elasticsearch.md            | 10 +++--
 doc/development/filtering_by_label.md       | 18 ++++-----
 doc/development/gemfile.md                  |  4 +-
 doc/development/geo.md                      |  2 +-
 doc/development/git_object_deduplication.md |  2 +-
 doc/development/gitaly.md                   | 14 +++----
 doc/development/kubernetes.md               |  2 +-
 doc/development/logging.md                  |  2 +-
 doc/development/omnibus.md                  | 22 +++++-----
 doc/development/session.md                  |  2 +-
 doc/development/shell_commands.md           |  4 +-
 doc/gitlab-basics/add-file.md               |  2 +-
 doc/gitlab-basics/command-line-commands.md  |  2 +-
 doc/install/README.md                       |  2 +-
 doc/install/installation.md                 | 16 ++++----
 doc/install/relative_url.md                 |  2 +-
 22 files changed, 93 insertions(+), 95 deletions(-)

diff --git a/doc/development/architecture.md b/doc/development/architecture.md
index 5cb2ddf6e52..2adca2dae28 100644
--- a/doc/development/architecture.md
+++ b/doc/development/architecture.md
@@ -12,21 +12,21 @@ New versions of GitLab are released in stable branches and the master branch is
 
 For information, see the [GitLab Release Process](https://gitlab.com/gitlab-org/release/docs/tree/master#gitlab-release-process).
 
-Both EE and CE require some add-on components called gitlab-shell and Gitaly. These components are available from the [gitlab-shell](https://gitlab.com/gitlab-org/gitlab-shell/tree/master) and [gitaly](https://gitlab.com/gitlab-org/gitaly/tree/master) repositories respectively. New versions are usually tags but staying on the master branch will give you the latest stable version. New releases are generally around the same time as GitLab CE releases with exception for informal security updates deemed critical.
+Both EE and CE require some add-on components called GitLab Shell and Gitaly. These components are available from the [GitLab Shell](https://gitlab.com/gitlab-org/gitlab-shell/tree/master) and [Gitaly](https://gitlab.com/gitlab-org/gitaly/tree/master) repositories respectively. New versions are usually tags but staying on the master branch will give you the latest stable version. New releases are generally around the same time as GitLab CE releases with exception for informal security updates deemed critical.
 
 ## Components
 
 A typical install of GitLab will be on GNU/Linux. It uses Nginx or Apache as a web front end to proxypass the Unicorn web server. By default, communication between Unicorn and the front end is via a Unix domain socket but forwarding requests via TCP is also supported. The web front end accesses `/home/git/gitlab/public` bypassing the Unicorn server to serve static pages, uploads (e.g. avatar images or attachments), and precompiled assets. GitLab serves web pages and a [GitLab API](https://gitlab.com/gitlab-org/gitlab-ce/tree/master/doc/api) using the Unicorn web server. It uses Sidekiq as a job queue which, in turn, uses redis as a non-persistent database backend for job information, meta data, and incoming jobs.
 
-We also support deploying GitLab on Kubernetes using our [gitlab Helm chart](https://docs.gitlab.com/charts/).
+We also support deploying GitLab on Kubernetes using our [GitLab Helm chart](https://docs.gitlab.com/charts/).
 
-The GitLab web app uses PostgreSQL for persistent database information (e.g. users, permissions, issues, other meta data). GitLab stores the bare git repositories it serves in `/home/git/repositories` by default. It also keeps default branch and hook information with the bare repository.
+The GitLab web app uses PostgreSQL for persistent database information (e.g. users, permissions, issues, other meta data). GitLab stores the bare Git repositories it serves in `/home/git/repositories` by default. It also keeps default branch and hook information with the bare repository.
 
-When serving repositories over HTTP/HTTPS GitLab utilizes the GitLab API to resolve authorization and access as well as serving git objects.
+When serving repositories over HTTP/HTTPS GitLab utilizes the GitLab API to resolve authorization and access as well as serving Git objects.
 
-The add-on component gitlab-shell serves repositories over SSH. It manages the SSH keys within `/home/git/.ssh/authorized_keys` which should not be manually edited. gitlab-shell accesses the bare repositories through Gitaly to serve git objects and communicates with redis to submit jobs to Sidekiq for GitLab to process. gitlab-shell queries the GitLab API to determine authorization and access.
+The add-on component GitLab Shell serves repositories over SSH. It manages the SSH keys within `/home/git/.ssh/authorized_keys` which should not be manually edited. GitLab Shell accesses the bare repositories through Gitaly to serve Git objects and communicates with redis to submit jobs to Sidekiq for GitLab to process. GitLab Shell queries the GitLab API to determine authorization and access.
 
-Gitaly executes git operations from gitlab-shell and the GitLab web app, and provides an API to the GitLab web app to get attributes from git (e.g. title, branches, tags, other meta data), and to get blobs (e.g. diffs, commits, files).
+Gitaly executes Git operations from GitLab Shell and the GitLab web app, and provides an API to the GitLab web app to get attributes from Git (e.g. title, branches, tags, other meta data), and to get blobs (e.g. diffs, commits, files).
 
 You may also be interested in the [production architecture of GitLab.com](https://about.gitlab.com/handbook/engineering/infrastructure/production-architecture/).
 
@@ -130,7 +130,7 @@ Component statuses are linked to configuration documentation for each component.
 | [NGINX](#nginx) | Routes requests to appropriate components, terminates SSL | [✅][nginx-omnibus] | [✅][nginx-charts] | [⚙][nginx-charts] | [✅](https://about.gitlab.com/handbook/engineering/infrastructure/production-architecture/#service-architecture) | [⤓][nginx-source] | ❌ | CE & EE |
 | [Unicorn (GitLab Rails)](#unicorn) | Handles requests for the web interface and API | [✅][unicorn-omnibus] | [✅][unicorn-charts] | [✅][unicorn-charts] | [✅](../user/gitlab_com/index.md#unicorn) | [⚙][unicorn-source] | [✅][gitlab-yml] | CE & EE |
 | [Sidekiq](#sidekiq) | Background jobs processor | [✅][sidekiq-omnibus] | [✅][sidekiq-charts] | [✅](https://docs.gitlab.com/charts/charts/gitlab/sidekiq/index.html) | [✅](../user/gitlab_com/index.md#sidekiq) | [✅][gitlab-yml] | [✅][gitlab-yml] | CE & EE |
-| [Gitaly](#gitaly) | Git RPC service for handling all git calls made by GitLab | [✅][gitaly-omnibus] | [✅][gitaly-charts] | [✅][gitaly-charts] | [✅](https://about.gitlab.com/handbook/engineering/infrastructure/production-architecture/#service-architecture) | [⚙][gitaly-source] | ✅ | CE & EE |
+| [Gitaly](#gitaly) | Git RPC service for handling all Git calls made by GitLab | [✅][gitaly-omnibus] | [✅][gitaly-charts] | [✅][gitaly-charts] | [✅](https://about.gitlab.com/handbook/engineering/infrastructure/production-architecture/#service-architecture) | [⚙][gitaly-source] | ✅ | CE & EE |
 | [GitLab Workhorse](#gitlab-workhorse) | Smart reverse proxy, handles large HTTP requests | [✅][workhorse-omnibus] | [✅][workhorse-charts] | [✅][workhorse-charts] | [✅](https://about.gitlab.com/handbook/engineering/infrastructure/production-architecture/#service-architecture) | [⚙][workhorse-source] | ✅ | CE & EE |
 | [GitLab Shell](#gitlab-shell) | Handles `git` over SSH sessions | [✅][shell-omnibus] | [✅][shell-charts] | [✅][shell-charts] | [✅](https://about.gitlab.com/handbook/engineering/infrastructure/production-architecture/#service-architecture) | [⚙][shell-source] | [✅][gitlab-yml] | CE & EE |
 | [GitLab Pages](#gitlab-pages) | Hosts static websites | [⚙][pages-omnibus] | [❌][pages-charts] | [❌][pages-charts] | [✅](../user/gitlab_com/index.md#gitlab-pages) | [⚙][pages-source] | [⚙][pages-gdk] | CE & EE  |
@@ -185,7 +185,7 @@ GitLab can be considered to have two layers from a process perspective:
 - Layer: Monitoring
 - Process: `alertmanager`
 
-[Alert manager](https://prometheus.io/docs/alerting/alertmanager/) is a tool provided by Prometheus that _"handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integration such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts."_ You can read more in [issue gitlab-ce#45740](https://gitlab.com/gitlab-org/gitlab-ce/issues/45740) about what we will be alerting on.
+[Alert manager](https://prometheus.io/docs/alerting/alertmanager/) is a tool provided by Prometheus that _"handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integration such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts."_ You can read more in [issue #45740](https://gitlab.com/gitlab-org/gitlab-ce/issues/45740) about what we will be alerting on.
 
 #### Certificate management
 
@@ -223,12 +223,12 @@ Elasticsearch is a distributed RESTful search engine built for the cloud.
 
 Gitaly is a service designed by GitLab to remove our need for NFS for Git storage in distributed deployments of GitLab (think GitLab.com or High Availability Deployments). As of 11.3.0, this service handles all Git level access in GitLab. You can read more about the project [in the project's readme](https://gitlab.com/gitlab-org/gitaly).
 
-#### Gitlab Geo
+#### GitLab Geo
 
 - Configuration: [Omnibus][geo-omnibus], [Charts][geo-charts], [GDK][geo-gdk]
 - Layer: Core Service (Processor)
 
-#### Gitlab Monitor
+#### GitLab Monitor
 
 - [Project page](https://gitlab.com/gitlab-org/gitlab-monitor)
 - Configuration: [Omnibus][gitlab-monitor-omnibus], [Charts][gitlab-monitor-charts]
@@ -237,7 +237,7 @@ Gitaly is a service designed by GitLab to remove our need for NFS for Git storag
 
 GitLab Monitor is a process designed in house that allows us to export metrics about GitLab application internals to Prometheus. You can read more [in the project's readme](https://gitlab.com/gitlab-org/gitlab-monitor).
 
-#### Gitlab Pages
+#### GitLab Pages
 
 - Configuration: [Omnibus][pages-omnibus], [Charts][pages-charts], [Source][pages-source], [GDK][pages-gdk]
 - Layer: Core Service (Processor)
@@ -246,7 +246,7 @@ GitLab Pages is a feature that allows you to publish static websites directly fr
 
 You can use it either for personal or business websites, such as portfolios, documentation, manifestos, and business presentations. You can also attribute any license to your content.
 
-#### Gitlab Runner
+#### GitLab Runner
 
 - [Project page](https://gitlab.com/gitlab-org/gitlab-runner/blob/master/README.md)
 - Configuration: [Omnibus][runner-omnibus], [Charts][runner-charts], [Source][runner-source], [GDK][runner-gdk]
@@ -256,7 +256,7 @@ GitLab Runner runs tests and sends the results to GitLab.
 
 GitLab CI is the open-source continuous integration service included with GitLab that coordinates the testing. The old name of this project was GitLab CI Multi Runner but please use "GitLab Runner" (without CI) from now on.
 
-#### Gitlab Shell
+#### GitLab Shell
 
 - [Project page](https://gitlab.com/gitlab-org/gitlab-shell/blob/master/README.md)
 - Configuration: [Omnibus][shell-omnibus], [Charts][shell-charts], [Source][shell-source], [GDK][gitlab-yml]
@@ -264,7 +264,7 @@ GitLab CI is the open-source continuous integration service included with GitLab
 
 [GitLab Shell](https://gitlab.com/gitlab-org/gitlab-shell) is a program designed at GitLab to handle ssh-based `git` sessions, and modifies the list of authorized keys. GitLab Shell is not a Unix shell nor a replacement for Bash or Zsh.
 
-#### Gitlab Workhorse
+#### GitLab Workhorse
 
 - [Project page](https://gitlab.com/gitlab-org/gitlab-workhorse/blob/master/README.md)
 - Configuration: [Omnibus][workhorse-omnibus], [Charts][workhorse-charts], [Source][workhorse-source]
@@ -475,7 +475,7 @@ It's important to understand the distinction as some processes are used in both
 When making a request to an HTTP Endpoint (think `/users/sign_in`) the request will take the following path through the GitLab Service:
 
 - nginx - Acts as our first line reverse proxy.
-- gitlab-workhorse - This determines if it needs to go to the Rails application or somewhere else to reduce load on Unicorn.
+- GitLab Workhorse - This determines if it needs to go to the Rails application or somewhere else to reduce load on Unicorn.
 - unicorn - Since this is a web request, and it needs to access the application it will go to Unicorn.
 - Postgres/Gitaly/Redis - Depending on the type of request, it may hit these services to store or retrieve data.
 
@@ -493,13 +493,13 @@ TODO
 
 ## System Layout
 
-When referring to `~git` in the pictures it means the home directory of the git user which is typically `/home/git`.
+When referring to `~git` in the pictures it means the home directory of the Git user which is typically `/home/git`.
 
 GitLab is primarily installed within the `/home/git` user home directory as `git` user. Within the home directory is where the gitlabhq server software resides as well as the repositories (though the repository location is configurable).
 
 The bare repositories are located in `/home/git/repositories`. GitLab is a ruby on rails application so the particulars of the inner workings can be learned by studying how a ruby on rails application works.
 
-To serve repositories over SSH there's an add-on application called gitlab-shell which is installed in `/home/git/gitlab-shell`.
+To serve repositories over SSH there's an add-on application called GitLab Shell which is installed in `/home/git/gitlab-shell`.
 
 ### Installation Folder Summary
 
@@ -523,7 +523,7 @@ processes: `unicorn_rails master` (1 process), `unicorn_rails worker`
 
 ### Repository access
 
-Repositories get accessed via HTTP or SSH. HTTP cloning/push/pull utilizes the GitLab API and SSH cloning is handled by gitlab-shell (previously explained).
+Repositories get accessed via HTTP or SSH. HTTP cloning/push/pull utilizes the GitLab API and SSH cloning is handled by GitLab Shell (previously explained).
 
 ## Troubleshooting
 
@@ -531,28 +531,28 @@ See the README for more information.
 
 ### Init scripts of the services
 
-The GitLab init script starts and stops Unicorn and Sidekiq.
+The GitLab init script starts and stops Unicorn and Sidekiq:
 
 ```
 /etc/init.d/gitlab
 Usage: service gitlab {start|stop|restart|reload|status}
 ```
 
-Redis (key-value store/non-persistent database)
+Redis (key-value store/non-persistent database):
 
 ```
 /etc/init.d/redis
 Usage: /etc/init.d/redis {start|stop|status|restart|condrestart|try-restart}
 ```
 
-SSH daemon
+SSH daemon:
 
 ```
 /etc/init.d/sshd
 Usage: /etc/init.d/sshd {start|stop|restart|reload|force-reload|condrestart|try-restart|status}
 ```
 
-Web server (one of the following)
+Web server (one of the following):
 
 ```
 /etc/init.d/httpd
@@ -562,7 +562,7 @@ $ /etc/init.d/nginx
 Usage: nginx {start|stop|restart|reload|force-reload|status|configtest}
 ```
 
-Persistent database
+Persistent database:
 
 ```
 $ /etc/init.d/postgresql
@@ -571,34 +571,34 @@ Usage: /etc/init.d/postgresql {start|stop|restart|reload|force-reload|status} [v
 
 ### Log locations of the services
 
-gitlabhq (includes Unicorn and Sidekiq logs)
+gitlabhq (includes Unicorn and Sidekiq logs):
 
 - `/home/git/gitlab/log/` contains `application.log`, `production.log`, `sidekiq.log`, `unicorn.stdout.log`, `git_json.log` and `unicorn.stderr.log` normally.
 
-gitlab-shell
+GitLab Shell:
 
 - `/home/git/gitlab-shell/gitlab-shell.log`
 
-ssh
+SSH:
 
 - `/var/log/auth.log` auth log (on Ubuntu).
 - `/var/log/secure` auth log (on RHEL).
 
-nginx
+nginx:
 
 - `/var/log/nginx/` contains error and access logs.
 
-Apache httpd
+Apache httpd:
 
 - [Explanation of Apache logs](https://httpd.apache.org/docs/2.2/logs.html).
 - `/var/log/apache2/` contains error and output logs (on Ubuntu).
 - `/var/log/httpd/` contains error and output logs (on RHEL).
 
-redis
+Redis:
 
 - `/var/log/redis/redis.log` there are also log-rotated logs there.
 
-PostgreSQL
+PostgreSQL:
 
 - `/var/log/postgresql/*`
 
@@ -610,7 +610,7 @@ GitLab has configuration files located in `/home/git/gitlab/config/*`. Commonly
 - `unicorn.rb` - Unicorn web server settings.
 - `database.yml` - Database connection settings.
 
-gitlab-shell has a configuration file at `/home/git/gitlab-shell/config.yml`.
+GitLab Shell has a configuration file at `/home/git/gitlab-shell/config.yml`.
 
 ### Maintenance Tasks
 
diff --git a/doc/development/automatic_ce_ee_merge.md b/doc/development/automatic_ce_ee_merge.md
index 158606aa6a2..c2700461467 100644
--- a/doc/development/automatic_ce_ee_merge.md
+++ b/doc/development/automatic_ce_ee_merge.md
@@ -174,9 +174,9 @@ Now, every time you create an MR for CE and EE:
 ## How we run the Automatic CE->EE merge at GitLab
 
 At GitLab, we use the [Merge Train](https://gitlab.com/gitlab-org/merge-train)
-project to keep our [gitlab-ee](https://gitlab.com/gitlab-org/gitlab-ee)
+project to keep our [GitLab EE](https://gitlab.com/gitlab-org/gitlab-ee)
 repository updated with commits from
-[gitlab-ce](https://gitlab.com/gitlab-org/gitlab-ce).
+[GitLab CE](https://gitlab.com/gitlab-org/gitlab-ce).
 
 We have a mirror of the [Merge Train](https://gitlab.com/gitlab-org/merge-train)
 project [configured](https://ops.gitlab.net/gitlab-org/merge-train) to run an
diff --git a/doc/development/background_migrations.md b/doc/development/background_migrations.md
index 642dac614c7..3fd95537eaa 100644
--- a/doc/development/background_migrations.md
+++ b/doc/development/background_migrations.md
@@ -294,7 +294,7 @@ to migrate you database down and up, which can result in other background
 migrations being called. That means that using `spy` test doubles with
 `have_received` is encouraged, instead of using regular test doubles, because
 your expectations defined in a `it` block can conflict with what is being
-called in RSpec hooks. See [gitlab-org/gitlab-ce#35351][issue-rspec-hooks]
+called in RSpec hooks. See [issue #35351][issue-rspec-hooks]
 for more details.
 
 ## Best practices
diff --git a/doc/development/build_test_package.md b/doc/development/build_test_package.md
index c5f6adfeaeb..21891f70d73 100644
--- a/doc/development/build_test_package.md
+++ b/doc/development/build_test_package.md
@@ -3,7 +3,7 @@
 While developing a new feature or modifying an existing one, it is helpful if an
 installable package (or a docker image) containing those changes is available
 for testing. For this very purpose, a manual job is provided in the GitLab CI/CD
-pipeline that can be used to trigger a pipeline in the omnibus-gitlab repository
+pipeline that can be used to trigger a pipeline in the Omnibus GitLab repository
 that will create:
 
 - A deb package for Ubuntu 16.04, available as a build artifact, and
@@ -12,7 +12,7 @@ that will create:
   (images titled `gitlab-ce` and `gitlab-ee` respectively and image tag is the
   commit which triggered the pipeline).
 
-When you push a commit to either the gitlab-ce or gitlab-ee project, the
+When you push a commit to either the GitLab CE or GitLab EE project, the
 pipeline for that commit will have a `build-package` manual action you can
 trigger.
 
@@ -30,9 +30,9 @@ branch `0-1-stable`, modify the content of `GITALY_SERVER_VERSION` to
 `0-1-stable` and push the commit. This will create a manual job that can be
 used to trigger the build.
 
-## Specifying the branch in omnibus-gitlab repository
+## Specifying the branch in Omnibus GitLab repository
 
-In scenarios where a configuration change is to be introduced and omnibus-gitlab
+In scenarios where a configuration change is to be introduced and Omnibus GitLab
 repository already has the necessary changes in a specific branch, you can build
 a package against that branch through an environment variable named
 `OMNIBUS_BRANCH`. To do this, specify that environment variable with the name of
diff --git a/doc/development/database_debugging.md b/doc/development/database_debugging.md
index eb3b227473b..6c9fa983c96 100644
--- a/doc/development/database_debugging.md
+++ b/doc/development/database_debugging.md
@@ -9,7 +9,7 @@ An easy first step is to search for your error in Slack or google "GitLab (my er
 
 Available `RAILS_ENV`
 
-- `production` (generally not for your main GDK db, but you may need this for e.g. omnibus)
+- `production` (generally not for your main GDK db, but you may need this for e.g. Omnibus)
 - `development` (this is your main GDK db)
 - `test` (used for tests like rspec)
 
diff --git a/doc/development/ee_features.md b/doc/development/ee_features.md
index a732a94b7c4..1358851f3cd 100644
--- a/doc/development/ee_features.md
+++ b/doc/development/ee_features.md
@@ -910,7 +910,7 @@ import bundle from 'ee_else_ce/protected_branches/protected_branches_bundle.js';
 ```
 
 See the frontend guide [performance section](fe_guide/performance.md) for
-information on managing page-specific javascript within EE.
+information on managing page-specific JavaScript within EE.
 
 ## Vue code in `assets/javascript`
 
@@ -1057,7 +1057,7 @@ Here is a workflow to make sure those changes end up backported safely into CE t
 
 **Note:** regarding SCSS, make sure the files living outside `/ee/` don't diverge between CE and EE projects.
 
-## gitlab-svgs
+## GitLab-svgs
 
 Conflicts in `app/assets/images/icons.json` or `app/assets/images/icons.svg` can
 be resolved simply by regenerating those assets with
diff --git a/doc/development/elasticsearch.md b/doc/development/elasticsearch.md
index 090e5235619..f2412c249c1 100644
--- a/doc/development/elasticsearch.md
+++ b/doc/development/elasticsearch.md
@@ -40,9 +40,11 @@ There is no need to install any plugins
 
 If you're interested on working with the new beta repo indexer, all you need to do is:
 
-- git clone git@gitlab.com:gitlab-org/gitlab-elasticsearch-indexer.git
-- make
-- make install
+```sh
+git clone git@gitlab.com:gitlab-org/gitlab-elasticsearch-indexer.git
+make
+make install
+```
 
 this adds `gitlab-elasticsearch-indexer` to `$GOPATH/bin`, please make sure that is in your `$PATH`. After that GitLab will find it and you'll be able to enable it in the admin settings area.
 
@@ -188,7 +190,7 @@ The global configurations per version are now in the `Elastic::(Version)::Config
 
 NOTE: **Note:** this is not applicable yet as multiple indices functionality is not fully implemented.
 
-Folders like `ee/lib/elastic/v12p1` contain snapshots of search logic from different versions. To keep a continuous git history, the latest version lives under `ee/lib/elastic/latest`, but its classes are aliased under an actual version (e.g. `ee/lib/elastic/v12p3`). When referencing these classes, never use the `Latest` namespace directly, but use the actual version (e.g. `V12p3`).
+Folders like `ee/lib/elastic/v12p1` contain snapshots of search logic from different versions. To keep a continuous Git history, the latest version lives under `ee/lib/elastic/latest`, but its classes are aliased under an actual version (e.g. `ee/lib/elastic/v12p3`). When referencing these classes, never use the `Latest` namespace directly, but use the actual version (e.g. `V12p3`).
 
 The version name basically follows GitLab's release version. If setting is changed in 12.3, we will create a new namespace called `V12p3` (p stands for "point"). Raise an issue if there is a need to name a version differently.
 
diff --git a/doc/development/filtering_by_label.md b/doc/development/filtering_by_label.md
index 5e7376db725..dd8944ff1c8 100644
--- a/doc/development/filtering_by_label.md
+++ b/doc/development/filtering_by_label.md
@@ -40,16 +40,14 @@ In particular, note that:
 
 This is more complicated than is ideal. It makes the query construction more
 prone to errors (such as
-[gitlab-org/gitlab-ce#15557](https://gitlab.com/gitlab-org/gitlab-ce/issues/15557)).
+[issue #15557](https://gitlab.com/gitlab-org/gitlab-ce/issues/15557)).
 
 ## Attempt A: WHERE EXISTS
 
 ### Attempt A1: use multiple subqueries with WHERE EXISTS
 
-In
-[gitlab-org/gitlab-ce#37137](https://gitlab.com/gitlab-org/gitlab-ce/issues/37137)
-and its associated merge request
-[gitlab-org/gitlab-ce!14022](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14022),
+In [issue #37137](https://gitlab.com/gitlab-org/gitlab-ce/issues/37137)
+and its associated [merge request](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14022),
 we tried to replace the `GROUP BY` with multiple uses of `WHERE EXISTS`. For the
 example above, this would give:
 
@@ -81,12 +79,11 @@ it did not improve query performance.
 
 ## Attempt B: Denormalize using an array column
 
-Having [removed MySQL support in GitLab
-12.1](https://about.gitlab.com/2019/06/27/removing-mysql-support/), using
-[Postgres's arrays](https://www.postgresql.org/docs/9.6/arrays.html) became more
+Having [removed MySQL support in GitLab 12.1](https://about.gitlab.com/2019/06/27/removing-mysql-support/),
+using [Postgres's arrays](https://www.postgresql.org/docs/9.6/arrays.html) became more
 tractable as we didn't have to support two databases. We discussed denormalizing
 the `label_links` table for querying in
-[gitlab-org/gitlab-ce#49651](https://gitlab.com/gitlab-org/gitlab-ce/issues/49651),
+[issue #49651](https://gitlab.com/gitlab-org/gitlab-ce/issues/49651),
 with two options: label IDs and titles.
 
 We can think of both of those as array columns on `issues`, `merge_requests`,
@@ -150,8 +147,7 @@ WHERE
     label_titles @> ARRAY['Plan', 'backend']
 ```
 
-And our [tests in
-gitlab-org/gitlab-ce#49651](https://gitlab.com/gitlab-org/gitlab-ce/issues/49651#note_188777346)
+And our [tests in issue #49651](https://gitlab.com/gitlab-org/gitlab-ce/issues/49651#note_188777346)
 showed that this could be fast.
 
 However, at present, the disadvantages outweigh the advantages.
diff --git a/doc/development/gemfile.md b/doc/development/gemfile.md
index ec9718cea71..8d93c52e7bc 100644
--- a/doc/development/gemfile.md
+++ b/doc/development/gemfile.md
@@ -3,9 +3,9 @@
 When adding a new entry to `Gemfile` or upgrading an existing dependency pay
 attention to the following rules.
 
-## No gems fetched from git repositories
+## No gems fetched from Git repositories
 
-We do not allow gems that are fetched from git repositories. All gems have
+We do not allow gems that are fetched from Git repositories. All gems have
 to be available in the RubyGems index. We want to minimize external build
 dependencies and build times.
 
diff --git a/doc/development/geo.md b/doc/development/geo.md
index 24f16eae9fa..cc3e2d1ccc5 100644
--- a/doc/development/geo.md
+++ b/doc/development/geo.md
@@ -170,7 +170,7 @@ while `pull` requests will continue to be served by the **secondary** node for m
 HTTPS and SSH requests are handled differently:
 
 - With HTTPS, we will give the user a `HTTP 302 Redirect` pointing to the project on the **primary** node.
-  The git client is wise enough to understand that status code and process the redirection.
+  The Git client is wise enough to understand that status code and process the redirection.
 - With SSH, because there is no equivalent way to perform a redirect, we have to proxy the request.
   This is done inside [`gitlab-shell`](https://gitlab.com/gitlab-org/gitlab-shell), by first translating the request
   to the HTTP protocol, and then proxying it to the **primary** node.
diff --git a/doc/development/git_object_deduplication.md b/doc/development/git_object_deduplication.md
index 8d32d0314ae..4dd1edf9b5a 100644
--- a/doc/development/git_object_deduplication.md
+++ b/doc/development/git_object_deduplication.md
@@ -169,7 +169,7 @@ There are three different things that can go wrong here.
 In this case, we miss out on disk space savings but all RPC's on A
 itself will function fine. The next time garbage collection runs on A,
 the alternates connection gets established in Gitaly. This is done by
-`Projects::GitDeduplicationService` in gitlab-rails.
+`Projects::GitDeduplicationService` in GitLab Rails.
 
 #### 2. SQL says repo A belongs to pool P1 but Gitaly says A has alternate objects in pool P2
 
diff --git a/doc/development/gitaly.md b/doc/development/gitaly.md
index 2ade59b76ed..592fc13873b 100644
--- a/doc/development/gitaly.md
+++ b/doc/development/gitaly.md
@@ -45,13 +45,13 @@ The process for adding new Gitaly features is:
 - release a new version of gitaly-proto
 - write implementation and tests for the RPC [in Gitaly](https://gitlab.com/gitlab-org/gitaly), in Go or Ruby
 - release a new version of Gitaly
-- write client code in gitlab-ce/ee, gitlab-workhorse or gitlab-shell that calls the new Gitaly RPC
+- write client code in GitLab CE/EE, GitLab Workhorse or GitLab Shell that calls the new Gitaly RPC
 
 These steps often overlap. It is possible to use an unreleased version
 of Gitaly and gitaly-proto during testing and development.
 
 - See the [Gitaly repo](https://gitlab.com/gitlab-org/gitaly/blob/master/CONTRIBUTING.md#development-and-testing-with-a-custom-gitaly-proto) for instructions on writing server side code with an unreleased protocol.
-- See [below](#running-tests-with-a-locally-modified-version-of-gitaly) for instructions on running gitlab-ce tests with a modified version of Gitaly.
+- See [below](#running-tests-with-a-locally-modified-version-of-gitaly) for instructions on running GitLab CE tests with a modified version of Gitaly.
 - In GDK run `gdk install` and restart `gdk run` (or `gdk run app`) to use a locally modified Gitaly version for development
 
 ### Gitaly-ruby
@@ -146,7 +146,7 @@ Once the code is wrapped in this block, this code-path will be excluded from n+1
 
 ## Request counts
 
-Commits and other git data, is now fetched through Gitaly. These fetches can,
+Commits and other Git data, is now fetched through Gitaly. These fetches can,
 much like with a database, be batched. This improves performance for the client
 and for Gitaly itself and therefore for the users too. To keep performance stable
 and guard performance regressions, Gitaly calls can be counted and the call count
@@ -164,10 +164,10 @@ end
 
 ## Running tests with a locally modified version of Gitaly
 
-Normally, gitlab-ce/ee tests use a local clone of Gitaly in
+Normally, GitLab CE/EE tests use a local clone of Gitaly in
 `tmp/tests/gitaly` pinned at the version specified in
 `GITALY_SERVER_VERSION`. The `GITALY_SERVER_VERSION` file supports
-`=my-branch` syntax to use a custom branch in gitlab-org/gitaly. If
+`=my-branch` syntax to use a custom branch in <https://gitlab.com/gitlab-org/gitaly>. If
 you want to run tests locally against a modified version of Gitaly you
 can replace `tmp/tests/gitaly` with a symlink. This is much faster
 because the `=my-branch` syntax forces a Gitaly re-install each time
@@ -276,9 +276,9 @@ Here are the steps to gate a new feature in Gitaly behind a feature flag.
    require.NoError(t, err)
    ```
 
-### Gitlab-Rails
+### GitLab Rails
 
-1. Add feature flag to `lib/gitlab/gitaly_client.rb` (in gitlab-rails):
+1. Add feature flag to `lib/gitlab/gitaly_client.rb` (in GitLab Rails):
 
    ```ruby
    SERVER_FEATURE_FLAGS = %w[go-find-all-tags].freeze
diff --git a/doc/development/kubernetes.md b/doc/development/kubernetes.md
index 4b2d48903ac..f4528667814 100644
--- a/doc/development/kubernetes.md
+++ b/doc/development/kubernetes.md
@@ -107,7 +107,7 @@ Mitigation strategies include:
 ## Debugging
 
 Logs related to the Kubernetes integration can be found in
-[kubernetes.log](../administration/logs.md#kuberneteslog). On a local
+[`kubernetes.log`](../administration/logs.md#kuberneteslog). On a local
 GDK install, this will be present in `log/kubernetes.log`.
 
 Some services such as
diff --git a/doc/development/logging.md b/doc/development/logging.md
index 4f63c84fc0e..b43f1029cc6 100644
--- a/doc/development/logging.md
+++ b/doc/development/logging.md
@@ -133,7 +133,7 @@ importer progresses. Here's what to do:
    logs in `/var/log/gitlab/gitlab-rails/*.log` every hour and [keep at
    most 30 compressed files](https://docs.gitlab.com/omnibus/settings/logs.html#logrotate).
    On GitLab.com, that setting is only 6 compressed files. These settings should suffice
-   for most users, but you may need to tweak them in [omnibus-gitlab](https://gitlab.com/gitlab-org/omnibus-gitlab).
+   for most users, but you may need to tweak them in [Omnibus GitLab](https://gitlab.com/gitlab-org/omnibus-gitlab).
 
 1. If you add a new file, submit an issue to the [production
    tracker](https://gitlab.com/gitlab-com/gl-infra/production/issues) or
diff --git a/doc/development/omnibus.md b/doc/development/omnibus.md
index 0ba354d28a2..ea5c18f1a8c 100644
--- a/doc/development/omnibus.md
+++ b/doc/development/omnibus.md
@@ -1,32 +1,32 @@
-# What you should know about omnibus packages
+# What you should know about Omnibus packages
 
-Most users install GitLab using our omnibus packages. As a developer it can be
-good to know how the omnibus packages differ from what you have on your laptop
+Most users install GitLab using our Omnibus packages. As a developer it can be
+good to know how the Omnibus packages differ from what you have on your laptop
 when you are coding.
 
 ## Files are owned by root by default
 
-All the files in the Rails tree (`app/`, `config/` etc.) are owned by 'root' in
-omnibus installations. This makes the installation simpler and it provides
-extra security. The omnibus reconfigure script contains commands that give
-write access to the 'git' user only where needed.
+All the files in the Rails tree (`app/`, `config/` etc.) are owned by `root` in
+Omnibus installations. This makes the installation simpler and it provides
+extra security. The Omnibus reconfigure script contains commands that give
+write access to the `git` user only where needed.
 
-For example, the 'git' user is allowed to write in the `log/` directory, in
+For example, the `git` user is allowed to write in the `log/` directory, in
 `public/uploads`, and they are allowed to rewrite the `db/schema.rb` file.
 
 In other cases, the reconfigure script tricks GitLab into not trying to write a
 file. For instance, GitLab will generate a `.secret` file if it cannot find one
-and write it to the Rails root. In the omnibus packages, reconfigure writes the
+and write it to the Rails root. In the Omnibus packages, reconfigure writes the
 `.secret` file first, so that GitLab never tries to write it.
 
 ## Code, data and logs are in separate directories
 
-The omnibus design separates code (read-only, under `/opt/gitlab`) from data
+The Omnibus design separates code (read-only, under `/opt/gitlab`) from data
 (read/write, under `/var/opt/gitlab`) and logs (read/write, under
 `/var/log/gitlab`). To make this happen the reconfigure script sets custom
 paths where it can in GitLab config files, and where there are no path
 settings, it uses symlinks.
 
 For example, `config/gitlab.yml` is treated as data so that file is a symlink.
-The same goes for `public/uploads`. The `log/` directory is replaced by omnibus
+The same goes for `public/uploads`. The `log/` directory is replaced by Omnibus
 with a symlink to `/var/log/gitlab/gitlab-rails`.
diff --git a/doc/development/session.md b/doc/development/session.md
index 9edce3dbda0..971795d8816 100644
--- a/doc/development/session.md
+++ b/doc/development/session.md
@@ -17,7 +17,7 @@ When storing values in a session it is best to:
 - Use simple primitives and avoid storing objects to avoid marshaling complications.
 - Clean up after unneeded variables to keep memory usage in Redis down.
 
-## Gitlab::Session
+## GitLab::Session
 
 Sometimes you might want to persist data in the session instead of another store like the database. `Gitlab::Session` lets you access this without passing the session around extensively. For example, you could access it from within a policy without having to pass the session through to each place permissions are checked from.
 
diff --git a/doc/development/shell_commands.md b/doc/development/shell_commands.md
index 7bdf676be58..1300c99622e 100644
--- a/doc/development/shell_commands.md
+++ b/doc/development/shell_commands.md
@@ -35,7 +35,7 @@ Gitlab::Popen.popen(%W(find /some/path -not -path /some/path -mmin +120 -delete)
 
 This coding style could have prevented CVE-2013-4490.
 
-## Always use the configurable git binary path for git commands
+## Always use the configurable Git binary path for Git commands
 
 ```ruby
 # Wrong
@@ -114,7 +114,7 @@ user = `whoami`
 user, exit_status = Gitlab::Popen.popen(%W(whoami))
 ```
 
-In other repositories, such as gitlab-shell you can also use `IO.popen`.
+In other repositories, such as GitLab Shell you can also use `IO.popen`.
 
 ```ruby
 # Safe IO.popen example
diff --git a/doc/gitlab-basics/add-file.md b/doc/gitlab-basics/add-file.md
index 41cc8bc4aeb..d547584bf80 100644
--- a/doc/gitlab-basics/add-file.md
+++ b/doc/gitlab-basics/add-file.md
@@ -70,7 +70,7 @@ git commit -m "DESCRIBE COMMIT IN A FEW WORDS"
 ```
 
 Now you can push (send) your changes (in the branch `<branch-name>`) to GitLab
-(the git remote named 'origin'):
+(the Git remote named 'origin'):
 
 ```sh
 git push origin <branch-name>
diff --git a/doc/gitlab-basics/command-line-commands.md b/doc/gitlab-basics/command-line-commands.md
index ed70d3ce598..74539b33642 100644
--- a/doc/gitlab-basics/command-line-commands.md
+++ b/doc/gitlab-basics/command-line-commands.md
@@ -10,7 +10,7 @@ learn, in order to make full use of the command line.
 
 ## Start working on your project
 
-To work on a git project locally (from your own computer), with the command line,
+To work on a Git project locally (from your own computer), with the command line,
 first you will need to [clone (copy) it](start-using-git.md#clone-a-repository) to
 your computer.
 
diff --git a/doc/install/README.md b/doc/install/README.md
index af98791c8e9..fd91527ed4c 100644
--- a/doc/install/README.md
+++ b/doc/install/README.md
@@ -13,7 +13,7 @@ and cost of hosting.
 
 There are many ways you can install GitLab depending on your platform:
 
-1. **Omnibus Gitlab**: The official deb/rpm packages that contain a bundle of GitLab
+1. **Omnibus GitLab**: The official deb/rpm packages that contain a bundle of GitLab
    and the various components it depends on like PostgreSQL, Redis, Sidekiq, etc.
 1. **GitLab Helm chart**: The cloud native Helm chart for installing GitLab and all
    its components on Kubernetes.
diff --git a/doc/install/installation.md b/doc/install/installation.md
index 6d64b8a4936..2989a4edaf7 100644
--- a/doc/install/installation.md
+++ b/doc/install/installation.md
@@ -57,18 +57,18 @@ of this page:
 ```
 
 - `/home/git/.ssh` - Contains OpenSSH settings. Specifically the `authorized_keys`
-  file managed by gitlab-shell.
+  file managed by GitLab Shell.
 - `/home/git/gitlab` - GitLab core software.
 - `/home/git/gitlab-shell` - Core add-on component of GitLab. Maintains SSH
   cloning and other functionality.
 - `/home/git/repositories` - Bare repositories for all projects organized by
-  namespace. This is where the git repositories which are pushed/pulled are
+  namespace. This is where the Git repositories which are pushed/pulled are
   maintained for all projects. **This area contains critical data for projects.
   [Keep a backup](../raketasks/backup_restore.md).**
 
 NOTE: **Note:**
 The default locations for repositories can be configured in `config/gitlab.yml`
-of GitLab and `config.yml` of gitlab-shell.
+of GitLab and `config.yml` of GitLab Shell.
 
 For a more in-depth overview, see the [GitLab architecture doc](../development/architecture.md).
 
@@ -569,7 +569,7 @@ GitLab Shell application startup time can be greatly reduced by disabling RubyGe
 - Compile Ruby with `configure --disable-rubygems` to disable RubyGems by default. Not recommended for system-wide Ruby.
 - Omnibus GitLab [replaces the *shebang* line of the `gitlab-shell/bin/*` scripts](https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests/1707).
 
-### Install gitlab-workhorse
+### Install GitLab Workhorse
 
 GitLab-Workhorse uses [GNU Make](https://www.gnu.org/software/make/). The
 following command-line will install GitLab-Workhorse in `/home/git/gitlab-workhorse`
@@ -833,7 +833,7 @@ To use GitLab with HTTPS:
 1. In `gitlab.yml`:
    1. Set the `port` option in section 1 to `443`.
    1. Set the `https` option in section 1 to `true`.
-1. In the `config.yml` of gitlab-shell:
+1. In the `config.yml` of GitLab Shell:
    1. Set `gitlab_url` option to the HTTPS endpoint of GitLab (e.g. `https://git.example.com`).
    1. Set the certificates using either the `ca_file` or `ca_path` option.
 1. Use the `gitlab-ssl` Nginx example config instead of the `gitlab` config.
@@ -852,7 +852,7 @@ Using a self-signed certificate is discouraged but if you must use it, follow th
    sudo chmod o-r gitlab.key
    ```
 
-1. In the `config.yml` of gitlab-shell set `self_signed_cert` to `true`.
+1. In the `config.yml` of GitLab Shell set `self_signed_cert` to `true`.
 
 ### Enable Reply by email
 
@@ -950,8 +950,8 @@ To use GitLab with Puma:
 
 If you see this message when attempting to clone a repository hosted by GitLab,
 this is likely due to an outdated Nginx or Apache configuration, or a missing or
-misconfigured gitlab-workhorse instance. Double-check that you've
-[installed Go](#3-go), [installed gitlab-workhorse](#install-gitlab-workhorse),
+misconfigured GitLab Workhorse instance. Double-check that you've
+[installed Go](#3-go), [installed GitLab Workhorse](#install-gitlab-workhorse),
 and correctly [configured Nginx](#site-configuration).
 
 ### google-protobuf "LoadError: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.14' not found"
diff --git a/doc/install/relative_url.md b/doc/install/relative_url.md
index bc6364f57f7..595304e27e2 100644
--- a/doc/install/relative_url.md
+++ b/doc/install/relative_url.md
@@ -110,7 +110,7 @@ Make sure to follow all steps below:
 
    **Note:**
    If you are using a custom init script, make sure to edit the above
-   gitlab-workhorse setting as needed.
+   GitLab Workhorse setting as needed.
 
 1. [Restart GitLab][] for the changes to take effect.
 
-- 
cgit v1.2.1


From 858daaff0dbdc016b57fd9e018ae4e2c3e0503b9 Mon Sep 17 00:00:00 2001
From: Seth Berger <4310743-sethgitlab@users.noreply.gitlab.com>
Date: Tue, 27 Aug 2019 08:51:02 +0000
Subject: Update index of feature flags

Made it clear the pages are about feature flags,
and not documentation.
---
 doc/development/feature_flags/index.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/development/feature_flags/index.md b/doc/development/feature_flags/index.md
index 56872f8c075..f1374b9e280 100644
--- a/doc/development/feature_flags/index.md
+++ b/doc/development/feature_flags/index.md
@@ -8,5 +8,5 @@ disable those changes, without having to revert an entire release.
 Before using feature flags for GitLab's development, read through the following:
 
 - [Process for using features flags](process.md).
-- [Developing with feature flags documentation](development.md).
-- [Controlling feature flags documentation](controls.md).
+- [Developing with feature flags](development.md).
+- [Controlling feature flags](controls.md).
-- 
cgit v1.2.1


From 3c236bb8f29f5254d53754a9eed456b879c194de Mon Sep 17 00:00:00 2001
From: Ash McKenzie <amckenzie@gitlab.com>
Date: Tue, 27 Aug 2019 16:53:58 +1000
Subject: Remove the mdl gem as it's no longer in use

---
 Gemfile      |  1 -
 Gemfile.lock | 10 ----------
 2 files changed, 11 deletions(-)

diff --git a/Gemfile b/Gemfile
index 595dedd4656..6c7ef7264c3 100644
--- a/Gemfile
+++ b/Gemfile
@@ -367,7 +367,6 @@ group :development, :test do
   gem 'haml_lint', '~> 0.31.0', require: false
   gem 'simplecov', '~> 0.16.1', require: false
   gem 'bundler-audit', '~> 0.5.0', require: false
-  gem 'mdl', '~> 0.5.0', require: false
 
   gem 'benchmark-ips', '~> 2.3.0', require: false
 
diff --git a/Gemfile.lock b/Gemfile.lock
index ae0d0e78c37..dac68eac5b0 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -475,7 +475,6 @@ GEM
     kgio (2.11.2)
     knapsack (1.17.0)
       rake
-    kramdown (1.17.0)
     kubeclient (4.2.2)
       http (~> 3.0)
       recursive-open-struct (~> 1.0, >= 1.0.4)
@@ -511,10 +510,6 @@ GEM
     mail_room (0.9.1)
     marcel (0.3.3)
       mimemagic (~> 0.3.2)
-    mdl (0.5.0)
-      kramdown (~> 1.12, >= 1.12.0)
-      mixlib-cli (~> 1.7, >= 1.7.0)
-      mixlib-config (~> 2.2, >= 2.2.1)
     memoist (0.16.0)
     memoizable (0.4.2)
       thread_safe (~> 0.3, >= 0.3.1)
@@ -528,9 +523,6 @@ GEM
     mini_mime (1.0.1)
     mini_portile2 (2.4.0)
     minitest (5.11.3)
-    mixlib-cli (1.7.0)
-    mixlib-config (2.2.18)
-      tomlrb
     msgpack (1.3.0)
     multi_json (1.13.1)
     multi_xml (0.6.0)
@@ -951,7 +943,6 @@ GEM
       parslet (~> 1.8.0)
     toml-rb (1.0.0)
       citrus (~> 3.0, > 3.0)
-    tomlrb (1.2.8)
     truncato (0.7.11)
       htmlentities (~> 4.3.1)
       nokogiri (>= 1.7.0, <= 2.0)
@@ -1146,7 +1137,6 @@ DEPENDENCIES
   lograge (~> 0.5)
   loofah (~> 2.2)
   mail_room (~> 0.9.1)
-  mdl (~> 0.5.0)
   memory_profiler (~> 0.9)
   method_source (~> 0.8)
   mimemagic (~> 0.3.2)
-- 
cgit v1.2.1


From 31c7bf16aa9adef361818d7cdfd4c7141556b433 Mon Sep 17 00:00:00 2001
From: Achilleas Pipinellis <axil@gitlab.com>
Date: Tue, 27 Aug 2019 09:15:15 +0000
Subject: Run markdownlint before Nanoc checks

Make it simpler to run markdownlint by moving it before
we do those hacks to run Nanoc.
---
 .gitlab/ci/docs.gitlab-ci.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index 1fad731543c..e77c773824f 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -73,10 +73,11 @@ docs lint:
   dependencies: []
   script:
     - scripts/lint-doc.sh
+    # Lint Markdown
+    - markdownlint --config .markdownlint.json doc/**/*.md
+    # Prepare docs for build
     - mv doc/ /tmp/gitlab-docs/content/$DOCS_GITLAB_REPO_SUFFIX
     - cd /tmp/gitlab-docs
-    # Lint Markdown
-    - markdownlint --config $CI_PROJECT_DIR/.markdownlint.json content/$DOCS_GITLAB_REPO_SUFFIX/**/*.md
     # Build HTML from Markdown
     - bundle exec nanoc
     # Check the internal links
-- 
cgit v1.2.1


From cfef583e943620b8f78a804b484f843e6776cf91 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Tue, 27 Aug 2019 12:16:44 +0200
Subject: Detect the new stage labels in Gitlab::Danger::Teammate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 lib/gitlab/danger/teammate.rb           | 4 ++--
 spec/lib/gitlab/danger/teammate_spec.rb | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/gitlab/danger/teammate.rb b/lib/gitlab/danger/teammate.rb
index 74cbcc11255..8ae4ffdadb0 100644
--- a/lib/gitlab/danger/teammate.rb
+++ b/lib/gitlab/danger/teammate.rb
@@ -39,9 +39,9 @@ module Gitlab
       def has_capability?(project, category, kind, labels)
         case category
         when :test
-          area = role[/Test Automation Engineer(?:.*?, (\w+))/, 1]
+          area = role[/Test Automation Engineer(?:.*?, (\w+))/, 1].downcase
 
-          area && labels.any?(area) if kind == :reviewer
+          area && labels.any?("devops::#{area}") if kind == :reviewer
         else
           capabilities(project).include?("#{kind} #{category}")
         end
diff --git a/spec/lib/gitlab/danger/teammate_spec.rb b/spec/lib/gitlab/danger/teammate_spec.rb
index 171f2344e82..61b43e343c1 100644
--- a/spec/lib/gitlab/danger/teammate_spec.rb
+++ b/spec/lib/gitlab/danger/teammate_spec.rb
@@ -28,7 +28,7 @@ describe Gitlab::Danger::Teammate do
     end
 
     context 'when labels contain Create and the category is test' do
-      let(:labels) { ['Create'] }
+      let(:labels) { ['devops::create'] }
 
       context 'when role is Test Automation Engineer, Create' do
         let(:role) { 'Test Automation Engineer, Create' }
-- 
cgit v1.2.1


From 9d5ea4203c374c1c2994e0ed97c3204039093d96 Mon Sep 17 00:00:00 2001
From: Mayra Cabrera <mcabrera@gitlab.com>
Date: Tue, 27 Aug 2019 10:22:12 +0000
Subject: Migrations guide: use atomic steps, when possible

Currently, the DB migrations guide says that "you must" use non-blocking
operations (such as CREATE INDEX CONCURRENTLY), always.

But this does not make sense in cases of empty tables and leads to
splitting the work to multiple non-atomic
(with disable_ddl_transaction!) DB migrations.

To follow KISS principle, to have fewer DB migrations steps,
to have them atomic when it's possible and simplify deployment
and troubleshooting, the following exceptions were added
to the doc:

- index creation,
- index dropping,
- defining an FK,
- adding a column with DEFAULT,
---
 doc/development/database_review.md       |   2 +-
 doc/development/migration_style_guide.md | 141 +++++++++++++++++++++----------
 2 files changed, 99 insertions(+), 44 deletions(-)

diff --git a/doc/development/database_review.md b/doc/development/database_review.md
index 3f1b359cb0b..367a481ee11 100644
--- a/doc/development/database_review.md
+++ b/doc/development/database_review.md
@@ -91,7 +91,7 @@ and details for a database reviewer:
     concurrent index/foreign key helpers (with transactions disabled)
   - Check consistency with `db/schema.rb` and that migrations are [reversible](migration_style_guide.md#reversibility)
   - Check queries timing (If any): Queries executed in a migration
-    need to fit comfortable within `15s` - preferably much less than that - on GitLab.com.
+    need to fit comfortably within `15s` - preferably much less than that - on GitLab.com.
 - Check [background migrations](background_migrations.md):
   - For data migrations, establish a time estimate for execution
   - They should only be used when migrating data in larger tables.
diff --git a/doc/development/migration_style_guide.md b/doc/development/migration_style_guide.md
index 3181b3a88cc..077dd2f43d0 100644
--- a/doc/development/migration_style_guide.md
+++ b/doc/development/migration_style_guide.md
@@ -1,12 +1,12 @@
 # Migration Style Guide
 
 When writing migrations for GitLab, you have to take into account that
-these will be ran by hundreds of thousands of organizations of all sizes, some with
+these will be run by hundreds of thousands of organizations of all sizes, some with
 many years of data in their database.
 
 In addition, having to take a server offline for an upgrade small or big is a
-big burden for most organizations. For this reason it is important that your
-migrations are written carefully, can be applied online and adhere to the style
+big burden for most organizations. For this reason, it is important that your
+migrations are written carefully, can be applied online, and adhere to the style
 guide below.
 
 Migrations are **not** allowed to require GitLab installations to be taken
@@ -85,7 +85,38 @@ be possible to downgrade in case of a vulnerability or bugs.
 In your migration, add a comment describing how the reversibility of the
 migration was tested.
 
-## Multi Threading
+## Atomicity
+
+By default, migrations are single transaction. That is, a transaction is opened
+at the beginning of the migration, and committed after all steps are processed.
+
+Running migrations in a single transaction makes sure that if one of the steps fails,
+none of the steps will be executed, leaving the database in valid state.
+Therefore, either:
+
+- Put all migrations in one single-transaction migration.
+- If necessary, put most actions in one migration and create a separate migration 
+  for the steps that cannot be done in a single transaction.
+   
+For example, if you create an empty table and need to build an index for it,
+it is recommended to use a regular single-transaction migration and the default
+rails schema statement: [`add_index`](https://api.rubyonrails.org/v5.2/classes/ActiveRecord/ConnectionAdapters/SchemaStatements.html#method-i-add_index).
+This is a blocking operation, but it won't cause problems because the table is not yet used,
+and therefore it does not have any records yet.
+
+## Heavy operations in a single transaction
+
+When using a single-transaction migration, a transaction will hold on a database connection
+for the duration of the migration, so you must make sure the actions in the migration
+do not take too much time: In general, queries executed in a migration need to fit comfortably
+within `15s` on GitLab.com.
+
+In case you need to insert, update, or delete a significant amount of data, you:
+
+- Must disable the single transaction with `disable_ddl_transaction!`.
+- Should consider doing it in a [Background Migration](background_migrations.md).
+
+## Multi-Threading
 
 Sometimes a migration might need to use multiple Ruby threads to speed up a
 migration. For this to work your migration needs to include the module
@@ -122,16 +153,16 @@ pool.  This ensures each thread has its own connection object, and won't time
 out when trying to obtain one.
 
 **NOTE:** PostgreSQL has a maximum amount of connections that it allows. This
-limit can vary from installation to installation. As a result it's recommended
-you do not use more than 32 threads in a single migration. Usually 4-8 threads
+limit can vary from installation to installation. As a result, it's recommended
+you do not use more than 32 threads in a single migration. Usually, 4-8 threads
 should be more than enough.
 
 ## Removing indexes
 
-When removing an index make sure to use the method `remove_concurrent_index` instead
-of the regular `remove_index` method. The `remove_concurrent_index` method
-automatically drops concurrent indexes when using PostgreSQL, removing the
-need for downtime. To use this method you must disable single-transaction mode
+If the table is not empty when removing an index, make sure to use the method
+`remove_concurrent_index` instead of the regular `remove_index` method.
+The `remove_concurrent_index` method drops indexes concurrently, so no locking is required,
+and there is no need for downtime. To use this method, you must disable single-transaction mode
 by calling the method `disable_ddl_transaction!` in the body of your migration
 class like so:
 
@@ -149,19 +180,25 @@ end
 Note that it is not necessary to check if the index exists prior to
 removing it.
 
+For a small table (such as an empty one or one with less than `1,000` records),
+it is recommended to use `remove_index` in a single-transaction migration,
+combining it with other operations that don't require `disable_ddl_transaction!`.
+
 ## Adding indexes
 
-If you need to add a unique index please keep in mind there is the possibility
+If you need to add a unique index, please keep in mind there is the possibility
 of existing duplicates being present in the database. This means that should
 always _first_ add a migration that removes any duplicates, before adding the
 unique index.
 
-When adding an index make sure to use the method `add_concurrent_index` instead
-of the regular `add_index` method. The `add_concurrent_index` method
-automatically creates concurrent indexes when using PostgreSQL, removing the
-need for downtime. To use this method you must disable transactions by calling
-the method `disable_ddl_transaction!` in the body of your migration class like
-so:
+When adding an index to a non-empty table make sure to use the method
+`add_concurrent_index` instead of the regular `add_index` method. 
+The `add_concurrent_index` method automatically creates concurrent indexes
+when using PostgreSQL, removing the need for downtime. 
+
+To use this method, you must disable single-transactions mode
+by calling the method `disable_ddl_transaction!` in the body of your migration
+class like so:
 
 ```ruby
 class MyMigration < ActiveRecord::Migration[4.2]
@@ -179,16 +216,20 @@ class MyMigration < ActiveRecord::Migration[4.2]
 end
 ```
 
+For a small table (such as an empty one or one with less than `1,000` records), 
+it is recommended to use `add_index` in a single-transaction migration, combining it with other
+operations that don't require `disable_ddl_transaction!`.
+
 ## Adding foreign-key constraints
 
-When adding a foreign-key constraint to either an existing or new
-column remember to also add a index on the column.
+When adding a foreign-key constraint to either an existing or a new column also
+remember to add an index on the column.
 
 This is **required** for all foreign-keys, e.g., to support efficient cascading
 deleting: when a lot of rows in a table get deleted, the referenced records need
 to be deleted too. The database has to look for corresponding records in the
 referenced table. Without an index, this will result in a sequential scan on the
-table which can take a long time.
+table, which can take a long time.
 
 Here's an example where we add a new column with a foreign key
 constraint. Note it includes `index: true` to create an index for it.
@@ -202,13 +243,17 @@ class Migration < ActiveRecord::Migration[4.2]
 end
 ```
 
-When adding a foreign-key constraint to an existing column, we
-have to employ `add_concurrent_foreign_key` and `add_concurrent_index`
+When adding a foreign-key constraint to an existing column in a non-empty table,
+we have to employ `add_concurrent_foreign_key` and `add_concurrent_index`
 instead of `add_reference`.
 
+For an empty table (such as a fresh one), it is recommended to use
+`add_reference` in a single-transaction migration, combining it with other
+operations that don't require `disable_ddl_transaction!`.
+
 ## Adding Columns With Default Values
 
-When adding columns with default values you must use the method
+When adding columns with default values to non-empty tables, you must use
 `add_column_with_default`. This method ensures the table is updated without
 requiring downtime. This method is not reversible so you must manually define
 the `up` and `down` methods in your migration class.
@@ -232,10 +277,14 @@ end
 ```
 
 Keep in mind that this operation can easily take 10-15 minutes to complete on
-larger installations (e.g. GitLab.com). As a result you should only add default
-values if absolutely necessary. There is a RuboCop cop that will fail if this
-method is used on some tables that are very large on GitLab.com, which would
-cause other issues.
+larger installations (e.g. GitLab.com). As a result, you should only add
+default values if absolutely necessary. There is a RuboCop cop that will fail if
+this method is used on some tables that are very large on GitLab.com, which
+would cause other issues.
+
+For a small table (such as an empty one or one with less than `1,000` records),
+use `add_column` and `change_column_default` in a single-transaction migration,
+combining it with other operations that don't require `disable_ddl_transaction!`.
 
 ## Updating an existing column
 
@@ -253,8 +302,10 @@ update_column_in_batches(:projects, :foo, 10) do |table, query|
 end
 ```
 
-To perform a computed update, the value can be wrapped in `Arel.sql`, so Arel
-treats it as an SQL literal. The below example is the same as the one above, but
+If a computed update is needed, the value can be wrapped in `Arel.sql`, so Arel
+treats it as an SQL literal. It's also a required deprecation for [Rails 6](https://gitlab.com/gitlab-org/gitlab-ce/issues/61451).
+
+The below example is the same as the one above, but
 the value is set to the product of the `bar` and `baz` columns:
 
 ```ruby
@@ -275,12 +326,12 @@ staging environment - or asking someone else to do so for you - beforehand.
 
 By default, an integer column can hold up to a 4-byte (32-bit) number. That is
 a max value of 2,147,483,647. Be aware of this when creating a column that will
-hold file sizes in byte units. If you are tracking file size in bytes this
+hold file sizes in byte units. If you are tracking file size in bytes, this
 restricts the maximum file size to just over 2GB.
 
 To allow an integer column to hold up to an 8-byte (64-bit) number, explicitly
 set the limit to 8-bytes. This will allow the column to hold a value up to
-9,223,372,036,854,775,807.
+`9,223,372,036,854,775,807`.
 
 Rails migration example:
 
@@ -294,9 +345,11 @@ add_column(:projects, :foo, :integer, default: 10, limit: 8)
 
 ## Timestamp column type
 
-By default, Rails uses the `timestamp` data type that stores timestamp data without timezone information.
-The `timestamp` data type is used by calling either the `add_timestamps` or the `timestamps` method.
-Also Rails converts the `:datetime` data type to the `timestamp` one.
+By default, Rails uses the `timestamp` data type that stores timestamp data
+without timezone information. The `timestamp` data type is used by calling
+either the `add_timestamps` or the `timestamps` method.
+
+Also, Rails converts the `:datetime` data type to the `timestamp` one.
 
 Example:
 
@@ -317,14 +370,16 @@ def up
 end
 ```
 
-Instead of using these methods one should use the following methods to store timestamps with timezones:
+Instead of using these methods, one should use the following methods to store
+timestamps with timezones:
 
 - `add_timestamps_with_timezone`
 - `timestamps_with_timezone`
 
-This ensures all timestamps have a time zone specified. This in turn means existing timestamps won't
-suddenly use a different timezone when the system's timezone changes. It also makes it very clear which
-timezone was used in the first place.
+This ensures all timestamps have a time zone specified. This, in turn, means
+existing timestamps won't suddenly use a different timezone when the system's
+timezone changes. It also makes it very clear which timezone was used in the
+first place.
 
 ## Storing JSON in database
 
@@ -359,7 +414,7 @@ Make sure your migration can be reversed.
 ## Data migration
 
 Please prefer Arel and plain SQL over usual ActiveRecord syntax. In case of
-using plain SQL you need to quote all input manually with `quote_string` helper.
+using plain SQL, you need to quote all input manually with `quote_string` helper.
 
 Example with Arel:
 
@@ -384,7 +439,7 @@ select_all("SELECT name, COUNT(id) as cnt FROM tags GROUP BY name HAVING COUNT(i
 end
 ```
 
-If you need more complex logic you can define and use models local to a
+If you need more complex logic, you can define and use models local to a
 migration. For example:
 
 ```ruby
@@ -395,13 +450,13 @@ class MyMigration < ActiveRecord::Migration[4.2]
 end
 ```
 
-When doing so be sure to explicitly set the model's table name so it's not
+When doing so be sure to explicitly set the model's table name, so it's not
 derived from the class name or namespace.
 
 ### Renaming reserved paths
 
-When a new route for projects is introduced that could conflict with any
-existing records. The path for this records should be renamed, and the
+When a new route for projects is introduced, it could conflict with any
+existing records. The path for these records should be renamed, and the
 related data should be moved on disk.
 
 Since we had to do this a few times already, there are now some helpers to help
-- 
cgit v1.2.1


From ae467503ce93e8d1788c1e9a4e04e0e4b6edc2bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Wed, 21 Aug 2019 14:49:26 +0200
Subject: Improve documentation of stage, group, category, feature labels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 PROCESS.md                                         |   4 +-
 doc/development/contributing/index.md              |  18 +-
 doc/development/contributing/issue_workflow.md     | 295 ++++++++++++---------
 .../contributing/merge_request_workflow.md         |   2 +-
 4 files changed, 181 insertions(+), 138 deletions(-)

diff --git a/PROCESS.md b/PROCESS.md
index 22b68b0aaca..f0a82838f62 100644
--- a/PROCESS.md
+++ b/PROCESS.md
@@ -267,9 +267,7 @@ The two scenarios below can [bypass the exception request in the release process
 When a bug is found:
 1. Create an issue describing the problem in the most detailed way possible.
 1. If possible, provide links to real examples and how to reproduce the problem.
-1. Label the issue properly, using the [team label](https://docs.gitlab.com/ee/development/contributing/issue_workflow.html#team-labels),
-   the [subject label](https://docs.gitlab.com/ee/development/contributing/issue_workflow.html#subject-labels)
-   and any other label that may apply in the specific case
+1. Label the issue properly, by respecting the [Partial triage level](https://about.gitlab.com/handbook/engineering/issue-triage/#partial-triage).
 1. Notify the respective Engineering Manager to evaluate and apply the [Severity label](https://docs.gitlab.com/ee/development/contributing/issue_workflow.html#severity-labels) and [Priority label](https://docs.gitlab.com/ee/development/contributing/issue_workflow.html#priority-labels).
 The counterpart Product Manager is included to weigh-in on prioritization as needed.
 1. If the ~bug is **NOT** a regression:
diff --git a/doc/development/contributing/index.md b/doc/development/contributing/index.md
index 853882e8642..3637a08c3cd 100644
--- a/doc/development/contributing/index.md
+++ b/doc/development/contributing/index.md
@@ -93,26 +93,20 @@ When submitting code to GitLab, you may feel that your contribution requires the
 
 When your code contains more than 500 changes, any major breaking changes, or an external library, `@mention` a maintainer in the merge request. If you are not sure who to mention, the reviewer will add one early in the merge request process.
 
-## Issues
+## Issues workflow
 
-This [documentation](issue_workflow.md) outlines the current issue process.
+This [documentation](issue_workflow.md) outlines the current issue workflow:
 
-- [Type labels](issue_workflow.md#type-labels)
-- [Subject labels](issue_workflow.md#subject-labels)
-- [Team labels](issue_workflow.md#team-labels)
-- [Release Scoping labels](issue_workflow.md#release-scoping-labels)
-- [Priority labels](issue_workflow.md#priority-labels)
-- [Severity labels](issue_workflow.md#severity-labels)
-- [Label for community contributors](issue_workflow.md#label-for-community-contributors)
+- [Issue tracker guidelines](issue_workflow.md#issue-tracker-guidelines)
 - [Issue triaging](issue_workflow.md#issue-triaging)
+- [Labels](issue_workflow.md#labels)
 - [Feature proposals](issue_workflow.md#feature-proposals)
-- [Issue tracker guidelines](issue_workflow.md#issue-tracker-guidelines)
 - [Issue weight](issue_workflow.md#issue-weight)
 - [Regression issues](issue_workflow.md#regression-issues)
 - [Technical and UX debt](issue_workflow.md#technical-and-ux-debt)
-- [Stewardship](issue_workflow.md#stewardship)
+- [Technical debt in follow-up issues](issue_workflow.md#technical-debt-in-follow-up-issues)
 
-## Merge requests
+## Merge requests workflow
 
 This [documentation](merge_request_workflow.md) outlines the current merge request process.
 
diff --git a/doc/development/contributing/issue_workflow.md b/doc/development/contributing/issue_workflow.md
index b2e3ef7bf63..64fbc997b45 100644
--- a/doc/development/contributing/issue_workflow.md
+++ b/doc/development/contributing/issue_workflow.md
@@ -1,17 +1,51 @@
-# Workflow labels
+# Issues workflow
 
-To allow for asynchronous issue handling, we use [milestones][milestones-page]
+## Issue tracker guidelines
+
+**[Search the issue tracker](https://gitlab.com/gitlab-org/gitlab-ce/issues)** for similar entries before
+submitting your own, there's a good chance somebody else had the same issue or
+feature proposal. Show your support with an award emoji and/or join the
+discussion.
+
+Please submit bugs using the ['Bug' issue template](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/.gitlab/issue_templates/Bug.md) provided on the issue tracker.
+The text in the parenthesis is there to help you with what to include. Omit it
+when submitting the actual issue. You can copy-paste it and then edit as you
+see fit.
+
+## Issue triaging
+
+Our issue triage policies are [described in our handbook](https://about.gitlab.com/handbook/engineering/issue-triage/).
+You are very welcome to help the GitLab team triage issues.
+We also organize [issue bash events](https://gitlab.com/gitlab-org/gitlab-ce/issues/17815)
+once every quarter.
+
+The most important thing is making sure valid issues receive feedback from the
+development team. Therefore the priority is mentioning developers that can help
+on those issues. Please select someone with relevant experience from the
+[GitLab team](https://about.gitlab.com/team/).
+If there is nobody mentioned with that expertise look in the commit history for
+the affected files to find someone.
+
+We also use [GitLab Triage](https://gitlab.com/gitlab-org/gitlab-triage) to
+automate some triaging policies. This is currently set up as a
+[scheduled pipeline](https://gitlab.com/gitlab-org/quality/triage-ops/pipeline_schedules/10512/edit)
+running on [quality/triage-ops](https://gitlab.com/gitlab-org/quality/triage-ops) project.
+
+## Labels
+
+To allow for asynchronous issue handling, we use [milestones](https://gitlab.com/groups/gitlab-org/-/milestones)
 and [labels](https://gitlab.com/gitlab-org/gitlab-ce/-/labels). Leads and product managers handle most of the
 scheduling into milestones. Labelling is a task for everyone.
 
 Most issues will have labels for at least one of the following:
 
 - Type: ~feature, ~bug, ~backstage, etc.
-- Subject: ~wiki, ~"Container Registry", ~ldap, ~api, etc.
-- Team: ~Documentation, ~Delivery, etc.
 - Stage: ~"devops::plan", ~"devops::create", etc.
-- Group: ~"group::source code" ~"group::knowledge" ~"group::editor", etc.
+- Group: ~"group::source code", ~"group::knowledge", ~"group::editor", etc.
+- Category: ~"Category:Code Analytics", ~"Category:DevOps Score", ~"Category:Templates", etc.
+- Feature: ~wiki, ~ldap, ~api, ~issues, ~"merge requests", etc.
 - Department: ~UX, ~Quality
+- Team: ~Documentation, ~Delivery
 - Specialization: ~frontend, ~backend
 - Release Scoping: ~Deliverable, ~Stretch, ~"Next Patch Release"
 - Priority: ~P1, ~P2, ~P3, ~P4
@@ -23,14 +57,18 @@ All labels, their meaning and priority are defined on the
 If you come across an issue that has none of these, and you're allowed to set
 labels, you can _always_ add the team and type, and often also the subject.
 
-[milestones-page]: https://gitlab.com/groups/gitlab-org/-/milestones
-
-## Type labels
+### Type labels
 
 Type labels are very important. They define what kind of issue this is. Every
-issue should have one or more.
+issue should have one and only one.
 
-Examples of type labels are ~feature, ~bug, ~backstage and ~security
+The current type labels are:
+
+- ~feature
+- ~bug
+- ~backstage
+- ~"support request"
+- ~meta
 
 A number of type labels have a priority assigned to them, which automatically
 makes them float to the top, depending on their importance.
@@ -38,68 +76,56 @@ makes them float to the top, depending on their importance.
 Type labels are always lowercase, and can have any color, besides blue (which is
 already reserved for subject labels).
 
-The descriptions on the [labels page](https://gitlab.com/gitlab-org/gitlab-ce/-/labels) explain what falls under each type label.
-
-## Subject labels
-
-Subject labels are labels that define what area or feature of GitLab this issue
-hits. They are not always necessary, but very convenient.
-
-Subject labels are now used to infer and apply relevant group and devops stage
-labels. Please apply them whenever possible to facilitate accurate matching.
-Please refer to [this merge request][inferred-labels] for more information.
-
-Examples of subject labels are ~wiki, ~ldap, ~api,
-~issues, ~"merge requests", ~labels, and ~"Container Registry".
-
-If you are an expert in a particular area, it makes it easier to find issues to
-work on. You can also subscribe to those labels to receive an email each time an
-issue is labeled with a subject label corresponding to your expertise.
-
-Subject labels are always all-lowercase.
+The descriptions on the [labels page](https://gitlab.com/groups/gitlab-org/-/labels)
+explain what falls under each type label.
 
-## Team labels
+### Stage labels
 
-**Important**: Most of the historical team labels (e.g. Manage, Plan etc.) are
-now deprecated in favor of [Group labels](#group-labels) and [Stage labels](#stage-labels).
+Stage labels specify which [stage](https://about.gitlab.com/handbook/product/categories/#hierarchy) the issue belongs to.
 
-Team labels specify what team is responsible for this issue.
-Assigning a team label makes sure issues get the attention of the appropriate
-people.
+#### Naming and color convention
 
-The current team labels are:
+Stage labels respects the `devops::<stage_key>` naming convention.
+`<stage_key>` is the stage key as it is in the single source of truth for stages at
+<https://gitlab.com/gitlab-com/www-gitlab-com/blob/master/data/stages.yml>
+with `_` replaced with ` `.
 
-- ~Delivery
-- ~Documentation
-- ~Quality
+For instance, the "Manage" stage is represented by the ~"devops::manage" label in
+the `gitlab-org` group since its key under `stages` is `manage`.
 
-Team labels are always capitalized so that they show up as the first label for
-any issue.
+The current stage labels can be found by [searching the labels list for `devops::`](https://gitlab.com/groups/gitlab-org/-/labels?search=devops::).
 
-## Stage labels
+These labels are [scoped labels](../../user/project/labels.md#scoped-labels-premium)
+and thus are mutually exclusive.
 
-Stage labels specify which [DevOps stage][devops-stages] the issue belongs to.
+The Stage labels are used to generate the [direction pages](https://about.gitlab.com/direction/) automatically.
 
-The current stage labels can be found by [searching the labels list for `devops::`](https://gitlab.com/groups/gitlab-org/-/labels?search=devops%3A%3A).
+### Group labels
 
-These labels are [scoped labels](../../user/project/labels.md#scoped-labels-premium)
-and thus are mutually exclusive.
+Group labels specify which [groups](https://about.gitlab.com/company/team/structure/#product-groups) the issue belongs to.
 
-The Stage labels are used to generate the [direction pages][direction-pages] automatically.
+It's highly recommended to add a group label, as it's used by our triage
+automation to
+[infer the correct stage label](https://about.gitlab.com/handbook/engineering/quality/triage-operations/#auto-labelling-of-issues).
 
-[devops-stages]: https://about.gitlab.com/direction/#devops-stages
-[direction-pages]: https://about.gitlab.com/direction/
+#### Naming and color convention
 
-## Group labels
+Group labels respects the `group::<group_key>` naming convention and
+their color is `#A8D695`.
+`<group_key>` is the group key as it is in the single source of truth for groups at
+<https://gitlab.com/gitlab-com/www-gitlab-com/blob/master/data/stages.yml>,
+with `_` replaced with ` `.
 
-Group labels specify which [groups][structure-groups] the issue belongs to.
+For instance, the "Continuous Integration" group is represented by the
+~"group::continuous integration"  label in the `gitlab-org` group since its key
+under `stages.manage.groups` is `continuous_integration`.
 
-The current group labels can be found by [searching the labels list for `group::`](https://gitlab.com/groups/gitlab-org/-/labels?search=group%3A%3A).
+The current group labels can be found by [searching the labels list for `group::`](https://gitlab.com/groups/gitlab-org/-/labels?search=group::).
 
 These labels are [scoped labels](../../user/project/labels.md#scoped-labels-premium)
 and thus are mutually exclusive.
 
-You can find the groups listed in the [Product Stages, Groups, and Categories][product-categories] page.
+You can find the groups listed in the [Product Stages, Groups, and Categories](https://about.gitlab.com/handbook/product/categories/) page.
 
 We use the term group to map down product requirements from our product stages.
 As a team needs some way to collect the work their members are planning to be assigned to, we use the `~group::` labels to do so.
@@ -110,24 +136,95 @@ any issue can be picked up by any group, depending on current priorities. For ex
 We also use stage and group labels to help quantify our [throughput](https://about.gitlab.com/handbook/engineering/management/throughput).
 Please read [Stage and Group labels in Throughtput](https://about.gitlab.com/handbook/engineering/management/throughput/#stage-and-group-labels-in-throughput) for more information on how the labels are used in this context.
 
-[structure-groups]: https://about.gitlab.com/company/team/structure/#groups
-[product-categories]: https://about.gitlab.com/handbook/product/categories/
+### Category labels
+
+From the handbook's
+[Product stages, groups, and categories](https://about.gitlab.com/handbook/product/categories/#hierarchy)
+page:
+
+> Categories are high-level capabilities that may be a standalone product at
+another company. e.g. Portfolio Management.
+
+It's highly recommended to add a category label, as it's used by our triage
+automation to
+[infer the correct group and stage labels](https://about.gitlab.com/handbook/engineering/quality/triage-operations/#auto-labelling-of-issues).
+
+If you are an expert in a particular area, it makes it easier to find issues to
+work on. You can also subscribe to those labels to receive an email each time an
+issue is labeled with a category label corresponding to your expertise.
+
+#### Naming and color convention
+
+Category labels respects the `Category:<Category Name>` naming convention and
+their color is `#428BCA`.
+`<Category Name>` is the category name as it is in the single source of truth for categories at
+<https://gitlab.com/gitlab-com/www-gitlab-com/blob/master/data/categories.yml>.
+
+For instance, the "Code Analytics" category is represented by the
+~"Category:Code Analytics" label in the `gitlab-org` group since its
+`code_analytics.name` value is "Code Analytics".
+
+If a category's label doesn't respect this naming convention, it should be specified
+with [the `label` attribute](https://about.gitlab.com/handbook/marketing/website/#category-attributes)
+in <https://gitlab.com/gitlab-com/www-gitlab-com/blob/master/data/categories.yml>.
+
+### Feature labels
+
+From the handbook's
+[Product stages, groups, and categories](https://about.gitlab.com/handbook/product/categories/#hierarchy)
+page:
+
+> Features: Small, discrete functionalities. e.g. Issue weights. Some common
+features are listed within parentheses to facilitate finding responsible PMs by keyword.
+
+It's highly recommended to add a feature label if no category label applies, as
+it's used by our triage automation to
+[infer the correct group and stage labels](https://about.gitlab.com/handbook/engineering/quality/triage-operations/#auto-labelling-of-issues).
+
+If you are an expert in a particular area, it makes it easier to find issues to
+work on. You can also subscribe to those labels to receive an email each time an
+issue is labeled with a feature label corresponding to your expertise.
+
+Examples of feature labels are ~wiki, ~ldap, ~api, ~issues, ~"merge requests" etc.
+
+#### Naming and color convention
 
-## Department labels
+Feature labels are all-lowercase.
+
+### Department labels
 
 The current department labels are:
 
 - ~UX
 - ~Quality
 
-## Specialization labels
+### Team labels
+
+**Important**: Most of the historical team labels (e.g. Manage, Plan etc.) are
+now deprecated in favor of [Group labels](#group-labels) and [Stage labels](#stage-labels).
+
+Team labels specify what team is responsible for this issue.
+Assigning a team label makes sure issues get the attention of the appropriate
+people.
+
+The current team labels are:
+
+- ~Delivery
+- ~Documentation
+
+#### Naming and color convention
+
+Team labels are always capitalized so that they show up as the first label for
+any issue.
+
+### Specialization labels
 
 These labels narrow the [specialization](https://about.gitlab.com/company/team/structure/#specialist) on a unit of work.
 
 - ~frontend
 - ~backend
 
-## Release Scoping labels
+### Release scoping labels
 
 Release Scoping labels help us clearly communicate expectations of the work for the
 release. There are three levels of Release Scoping labels:
@@ -145,7 +242,7 @@ Each issue scheduled for the current milestone should be labeled ~Deliverable
 or ~"Stretch". Any open issue for a previous milestone should be labeled
 ~"Next Patch Release", or otherwise rescheduled to a different milestone.
 
-### Priority labels
+#### Priority labels
 
 Priority labels help us define the time a ~bug fix should be completed. Priority determines how quickly the defect turnaround time must be.
 If there are multiple defects, the priority decides which defect has to be fixed immediately versus later.
@@ -158,7 +255,7 @@ This label documents the planned timeline & urgency which is used to measure aga
 | ~P3   | Medium Priority | Within the next 3 releases (approx one quarter or 90 days)                 |
 | ~P4   | Low Priority    | Anything outside the next 3 releases (more than one quarter or 120 days)   |
 
-## Severity labels
+### Severity labels
 
 Severity labels help us clearly communicate the impact of a ~bug on users.
 There can be multiple facets of the impact. The below is a guideline.
@@ -187,7 +284,7 @@ If a bug seems to fall between two severity labels, assign it to the higher-seve
   - Label colors are incorrect.
   - UI elements are not fully aligned.
 
-## Label for community contributors
+### Label for community contributors
 
 Issues that are beneficial to our users, 'nice to haves', that we currently do
 not have the capacity for or want to give the priority to, are labeled as
@@ -217,11 +314,11 @@ After adding the ~"Accepting merge requests" label, we try to estimate the
 [weight](#issue-weight) of the issue. We use issue weight to let contributors
 know how difficult the issue is. Additionally:
 
-- We advertise [`Accepting merge requests` issues with weight < 5][up-for-grabs]
+- We advertise [`Accepting merge requests` issues with weight < 5](https://gitlab.com/groups/gitlab-org/-/issues?state=opened&label_name[]=Accepting+merge+requests&assignee_id=None&sort=weight)
   as suitable for people that have never contributed to GitLab before on the
   [Up For Grabs campaign](http://up-for-grabs.net)
 - We encourage people that have never contributed to any open source project to
-  look for [`Accepting merge requests` issues with a weight of 1][first-timers]
+  look for [`Accepting merge requests` issues with a weight of 1](https://gitlab.com/groups/gitlab-org/-/issues?state=opened&label_name[]=Accepting+merge+requests&assignee_id=None&sort=weight&weight=1)
 
 If you've decided that you would like to work on an issue, please @-mention
 the [appropriate product manager](https://about.gitlab.com/handbook/product/#who-to-talk-to-for-what)
@@ -234,42 +331,29 @@ GitLab team members who apply the ~"Accepting merge requests" label to an issue
 should update the issue description with a responsible product manager, inviting
 any potential community contributor to @-mention per above.
 
-[up-for-grabs]: https://gitlab.com/groups/gitlab-org/-/issues?state=opened&label_name[]=Accepting+merge+requests&assignee_id=None&sort=weight
-[first-timers]: https://gitlab.com/groups/gitlab-org/-/issues?state=opened&label_name[]=Accepting+merge+requests&assignee_id=None&sort=weight&weight=1
+### Stewardship label
 
-## Issue triaging
-
-Our issue triage policies are [described in our handbook]. You are very welcome
-to help the GitLab team triage issues. We also organize [issue bash events] once
-every quarter.
-
-The most important thing is making sure valid issues receive feedback from the
-development team. Therefore the priority is mentioning developers that can help
-on those issues. Please select someone with relevant experience from the
-[GitLab team][team]. If there is nobody mentioned with that expertise look in
-the commit history for the affected files to find someone.
+For issues related to the open source stewardship of GitLab,
+there is the ~"stewardship" label.
 
-We also use [GitLab Triage] to automate some triaging policies. This is
-currently set up as a [scheduled pipeline] running on [quality/triage-ops]
-project.
+This label is to be used for issues in which the stewardship of GitLab
+is a topic of discussion. For instance if GitLab Inc. is planning to add
+features from GitLab EE to GitLab CE, related issues would be labelled with
+~"stewardship".
 
-[described in our handbook]: https://about.gitlab.com/handbook/engineering/issue-triage/
-[issue bash events]: https://gitlab.com/gitlab-org/gitlab-ce/issues/17815
-[GitLab Triage]: https://gitlab.com/gitlab-org/gitlab-triage
-[scheduled pipeline]: https://gitlab.com/gitlab-org/quality/triage-ops/pipeline_schedules/10512/edit
-[quality/triage-ops]: https://gitlab.com/gitlab-org/quality/triage-ops
-[team]: https://about.gitlab.com/team/
+A recent example of this was the issue for
+[bringing the time tracking API to GitLab CE](https://gitlab.com/gitlab-org/gitlab-ce/issues/25517#note_20019084).
 
 ## Feature proposals
 
 To create a feature proposal for CE, open an issue on the
-[issue tracker of CE][ce-tracker].
+[issue tracker of CE](https://gitlab.com/gitlab-org/gitlab-ce/issues).
 
 For feature proposals for EE, open an issue on the
-[issue tracker of EE][ee-tracker].
+[issue tracker of EE](https://gitlab.com/gitlab-org/gitlab-ee/issues).
 
 In order to help track the feature proposals, we have created a
-[`feature`][fl] label. For the time being, users that are not members
+[`feature`](https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name=feature) label. For the time being, users that are not members
 of the project cannot add labels. You can instead ask one of the [core team](https://about.gitlab.com/community/core-team/)
 members to add the label ~feature to the issue or add the following
 code snippet right after your description in a new line: `~feature`.
@@ -286,20 +370,6 @@ need to ask one of the [core team](https://about.gitlab.com/community/core-team/
 If you want to create something yourself, consider opening an issue first to
 discuss whether it is interesting to include this in GitLab.
 
-[fl]: https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name=feature
-
-## Issue tracker guidelines
-
-**[Search the issue tracker][ce-tracker]** for similar entries before
-submitting your own, there's a good chance somebody else had the same issue or
-feature proposal. Show your support with an award emoji and/or join the
-discussion.
-
-Please submit bugs using the ['Bug' issue template](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/.gitlab/issue_templates/Bug.md) provided on the issue tracker.
-The text in the parenthesis is there to help you with what to include. Omit it
-when submitting the actual issue. You can copy-paste it and then edit as you
-see fit.
-
 ## Issue weight
 
 Issue weight allows us to get an idea of the amount of work required to solve
@@ -345,7 +415,7 @@ addressed.
 ## Technical and UX debt
 
 In order to track things that can be improved in GitLab's codebase,
-we use the ~"technical debt" label in [GitLab's issue tracker][ce-tracker].
+we use the ~"technical debt" label in [GitLab's issue tracker](https://gitlab.com/gitlab-org/gitlab-ce/issues).
 For missed user experience requirements, we use the ~"UX debt" label.
 
 These labels should be added to issues that describe things that can be improved,
@@ -406,25 +476,6 @@ should be of the same quality as those created
 **must not** begin with `Follow-up`! The creating maintainer should also expect
 to be involved in some capacity when work begins on the follow-up issue.
 
-## Stewardship
-
-For issues related to the open source stewardship of GitLab,
-there is the ~"stewardship" label.
-
-This label is to be used for issues in which the stewardship of GitLab
-is a topic of discussion. For instance if GitLab Inc. is planning to add
-features from GitLab EE to GitLab CE, related issues would be labelled with
-~"stewardship".
-
-A recent example of this was the issue for
-[bringing the time tracking API to GitLab CE][time-tracking-issue].
-
-[time-tracking-issue]: https://gitlab.com/gitlab-org/gitlab-ce/issues/25517#note_20019084
-
 ---
 
 [Return to Contributing documentation](index.md)
-
-[ce-tracker]: https://gitlab.com/gitlab-org/gitlab-ce/issues
-[ee-tracker]: https://gitlab.com/gitlab-org/gitlab-ee/issues
-[inferred-labels]: https://gitlab.com/gitlab-org/quality/triage-ops/merge_requests/155
diff --git a/doc/development/contributing/merge_request_workflow.md b/doc/development/contributing/merge_request_workflow.md
index 4e9c5c81379..bdb026d498d 100644
--- a/doc/development/contributing/merge_request_workflow.md
+++ b/doc/development/contributing/merge_request_workflow.md
@@ -1,4 +1,4 @@
-# Merge requests
+# Merge requests workflow
 
 We welcome merge requests from everyone, with fixes and improvements
 to GitLab code, tests, and documentation. The issues that are specifically suitable
-- 
cgit v1.2.1


From cc67829a0777bde70ccc6521406ee4fddb47a799 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Thu, 22 Aug 2019 09:45:05 +0200
Subject: Introduce facet labels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 doc/development/contributing/issue_workflow.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/doc/development/contributing/issue_workflow.md b/doc/development/contributing/issue_workflow.md
index 64fbc997b45..f00a810ec42 100644
--- a/doc/development/contributing/issue_workflow.md
+++ b/doc/development/contributing/issue_workflow.md
@@ -79,6 +79,24 @@ already reserved for subject labels).
 The descriptions on the [labels page](https://gitlab.com/groups/gitlab-org/-/labels)
 explain what falls under each type label.
 
+### Facet labels
+
+Sometimes it's useful to refine the type of an issue. In those cases, you can
+add facet labels.
+
+Following is a non-exhaustive list of facet labels:
+
+- ~enhancement: This label can refine an issue that has the ~feature label.
+- ~"master:broken": This label can refine an issue that has the ~bug label.
+- ~"master:flaky": This label can refine an issue that has the ~bug label.
+- ~"technical debt": This label can refine an issue that has the ~backstage label.
+- ~"static analysis": This label can refine an issue that has the ~backstage label.
+- ~"ci-build": This label can refine an issue that has the ~backstage label.
+- ~performance: A performance issue could describe a ~bug or a ~feature.
+- ~security: A security issue could describe a ~bug or a ~feature.
+- ~database: A database issue could describe a ~bug or a ~feature.
+- ~customer: This relates to an issue that was created by a customer, or that is of interest for a customer.
+
 ### Stage labels
 
 Stage labels specify which [stage](https://about.gitlab.com/handbook/product/categories/#hierarchy) the issue belongs to.
-- 
cgit v1.2.1


From 1ee8d6385d8cb00ed3487dd7b02874e0279b78f6 Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Tue, 27 Aug 2019 17:04:27 +0800
Subject: Use `stub_full_request` to fix spec failure

Also change test URL sequest to .test TLD
---
 spec/factories/sequences.rb            |  2 +-
 spec/models/ci/pipeline_spec.rb        |  5 +++--
 spec/services/web_hook_service_spec.rb | 33 ++++++++++++++++++++-------------
 3 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/spec/factories/sequences.rb b/spec/factories/sequences.rb
index b6f2d6d8389..17b54d69372 100644
--- a/spec/factories/sequences.rb
+++ b/spec/factories/sequences.rb
@@ -7,7 +7,7 @@ FactoryBot.define do
   sequence(:email_alias) { |n| "user.alias#{n}@example.org" }
   sequence(:title) { |n| "My title #{n}" }
   sequence(:filename) { |n| "filename-#{n}.rb" }
-  sequence(:url) { |n| "http://example#{n}.org" }
+  sequence(:url) { |n| "http://example#{n}.test" }
   sequence(:label_title) { |n| "label#{n}" }
   sequence(:branch) { |n| "my-branch-#{n}" }
   sequence(:past_time) { |n| 4.hours.ago + (2 * n).seconds }
diff --git a/spec/models/ci/pipeline_spec.rb b/spec/models/ci/pipeline_spec.rb
index 78be4a8131a..7d84d094bdf 100644
--- a/spec/models/ci/pipeline_spec.rb
+++ b/spec/models/ci/pipeline_spec.rb
@@ -4,6 +4,7 @@ require 'spec_helper'
 
 describe Ci::Pipeline, :mailer do
   include ProjectForksHelper
+  include StubRequests
 
   let(:user) { create(:user) }
   set(:project) { create(:project) }
@@ -2504,7 +2505,7 @@ describe Ci::Pipeline, :mailer do
       let(:enabled) { true }
 
       before do
-        WebMock.stub_request(:post, hook.url)
+        stub_full_request(hook.url, method: :post)
       end
 
       context 'with multiple builds' do
@@ -2558,7 +2559,7 @@ describe Ci::Pipeline, :mailer do
         end
 
         def have_requested_pipeline_hook(status)
-          have_requested(:post, hook.url).with do |req|
+          have_requested(:post, stubbed_hostname(hook.url)).with do |req|
             json_body = JSON.parse(req.body)
             json_body['object_attributes']['status'] == status &&
               json_body['builds'].length == 2
diff --git a/spec/services/web_hook_service_spec.rb b/spec/services/web_hook_service_spec.rb
index 50167a2e059..2a4368868d5 100644
--- a/spec/services/web_hook_service_spec.rb
+++ b/spec/services/web_hook_service_spec.rb
@@ -55,31 +55,38 @@ describe WebHookService do
   describe '#execute' do
     before do
       project.hooks << [project_hook]
-
-      WebMock.stub_request(:post, project_hook.url)
     end
 
     context 'when token is defined' do
       let(:project_hook) { create(:project_hook, :token) }
 
       it 'POSTs to the webhook URL' do
+        stub_full_request(project_hook.url, method: :post)
+
         service_instance.execute
-        expect(WebMock).to have_requested(:post, project_hook.url).with(
+
+        expect(WebMock).to have_requested(:post, stubbed_hostname(project_hook.url)).with(
           headers: headers.merge({ 'X-Gitlab-Token' => project_hook.token })
         ).once
       end
     end
 
     it 'POSTs to the webhook URL' do
+      stub_full_request(project_hook.url, method: :post)
+
       service_instance.execute
-      expect(WebMock).to have_requested(:post, project_hook.url).with(
+
+      expect(WebMock).to have_requested(:post, stubbed_hostname(project_hook.url)).with(
         headers: headers
       ).once
     end
 
     it 'POSTs the data as JSON' do
+      stub_full_request(project_hook.url, method: :post)
+
       service_instance.execute
-      expect(WebMock).to have_requested(:post, project_hook.url).with(
+
+      expect(WebMock).to have_requested(:post, stubbed_hostname(project_hook.url)).with(
         headers: headers
       ).once
     end
@@ -115,7 +122,7 @@ describe WebHookService do
     end
 
     it 'catches exceptions' do
-      WebMock.stub_request(:post, project_hook.url).to_raise(StandardError.new('Some error'))
+      stub_full_request(project_hook.url, method: :post).to_raise(StandardError.new('Some error'))
 
       expect { service_instance.execute }.to raise_error(StandardError)
     end
@@ -125,20 +132,20 @@ describe WebHookService do
       exceptions.each do |exception_class|
         exception = exception_class.new('Exception message')
 
-        WebMock.stub_request(:post, project_hook.url).to_raise(exception)
+        stub_full_request(project_hook.url, method: :post).to_raise(exception)
         expect(service_instance.execute).to eq({ status: :error, message: exception.to_s })
         expect { service_instance.execute }.not_to raise_error
       end
     end
 
     it 'handles 200 status code' do
-      WebMock.stub_request(:post, project_hook.url).to_return(status: 200, body: 'Success')
+      stub_full_request(project_hook.url, method: :post).to_return(status: 200, body: 'Success')
 
       expect(service_instance.execute).to include({ status: :success, http_status: 200, message: 'Success' })
     end
 
     it 'handles 2xx status codes' do
-      WebMock.stub_request(:post, project_hook.url).to_return(status: 201, body: 'Success')
+      stub_full_request(project_hook.url, method: :post).to_return(status: 201, body: 'Success')
 
       expect(service_instance.execute).to include({ status: :success, http_status: 201, message: 'Success' })
     end
@@ -148,7 +155,7 @@ describe WebHookService do
 
       context 'with success' do
         before do
-          WebMock.stub_request(:post, project_hook.url).to_return(status: 200, body: 'Success')
+          stub_full_request(project_hook.url, method: :post).to_return(status: 200, body: 'Success')
           service_instance.execute
         end
 
@@ -165,7 +172,7 @@ describe WebHookService do
 
       context 'with exception' do
         before do
-          WebMock.stub_request(:post, project_hook.url).to_raise(SocketError.new('Some HTTP Post error'))
+          stub_full_request(project_hook.url, method: :post).to_raise(SocketError.new('Some HTTP Post error'))
           service_instance.execute
         end
 
@@ -182,7 +189,7 @@ describe WebHookService do
 
       context 'with unsafe response body' do
         before do
-          WebMock.stub_request(:post, project_hook.url).to_return(status: 200, body: "\xBB")
+          stub_full_request(project_hook.url, method: :post).to_return(status: 200, body: "\xBB")
           service_instance.execute
         end
 
@@ -202,7 +209,7 @@ describe WebHookService do
         let(:service_instance) { described_class.new(service_hook, data, 'service_hook') }
 
         before do
-          WebMock.stub_request(:post, service_hook.url).to_return(status: 200, body: 'Success')
+          stub_full_request(service_hook.url, method: :post).to_return(status: 200, body: 'Success')
         end
 
         it { expect { service_instance.execute }.not_to change(WebHookLog, :count) }
-- 
cgit v1.2.1


From 42e8bef3ebdcb4c1361e9fc91ec32f1bebcb6773 Mon Sep 17 00:00:00 2001
From: Evan Read <eread@gitlab.com>
Date: Tue, 27 Aug 2019 11:31:43 +0000
Subject: Removes trailing whitespace to fix linting

---
 doc/development/migration_style_guide.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/doc/development/migration_style_guide.md b/doc/development/migration_style_guide.md
index 077dd2f43d0..4740cf4de7b 100644
--- a/doc/development/migration_style_guide.md
+++ b/doc/development/migration_style_guide.md
@@ -95,9 +95,9 @@ none of the steps will be executed, leaving the database in valid state.
 Therefore, either:
 
 - Put all migrations in one single-transaction migration.
-- If necessary, put most actions in one migration and create a separate migration 
+- If necessary, put most actions in one migration and create a separate migration
   for the steps that cannot be done in a single transaction.
-   
+
 For example, if you create an empty table and need to build an index for it,
 it is recommended to use a regular single-transaction migration and the default
 rails schema statement: [`add_index`](https://api.rubyonrails.org/v5.2/classes/ActiveRecord/ConnectionAdapters/SchemaStatements.html#method-i-add_index).
@@ -192,9 +192,9 @@ always _first_ add a migration that removes any duplicates, before adding the
 unique index.
 
 When adding an index to a non-empty table make sure to use the method
-`add_concurrent_index` instead of the regular `add_index` method. 
+`add_concurrent_index` instead of the regular `add_index` method.
 The `add_concurrent_index` method automatically creates concurrent indexes
-when using PostgreSQL, removing the need for downtime. 
+when using PostgreSQL, removing the need for downtime.
 
 To use this method, you must disable single-transactions mode
 by calling the method `disable_ddl_transaction!` in the body of your migration
@@ -216,7 +216,7 @@ class MyMigration < ActiveRecord::Migration[4.2]
 end
 ```
 
-For a small table (such as an empty one or one with less than `1,000` records), 
+For a small table (such as an empty one or one with less than `1,000` records),
 it is recommended to use `add_index` in a single-transaction migration, combining it with other
 operations that don't require `disable_ddl_transaction!`.
 
-- 
cgit v1.2.1


From 7e0960f6e220c2ae54abb457508c9b20fa132a9f Mon Sep 17 00:00:00 2001
From: Toon Claes <toon@gitlab.com>
Date: Tue, 27 Aug 2019 09:48:16 +0200
Subject: Bring text mail for new issue & MR more in line

Make these templates for mail notifications for a new issue and a new
merge request more similar.

Also remove some leading whitespace in text mails.
---
 app/views/notify/new_issue_email.text.erb                    | 10 +++-------
 app/views/notify/new_merge_request_email.text.erb            |  4 ++--
 changelogs/unreleased/tc-cleanup-issue-created-text-mail.yml |  5 +++++
 3 files changed, 10 insertions(+), 9 deletions(-)
 create mode 100644 changelogs/unreleased/tc-cleanup-issue-created-text-mail.yml

diff --git a/app/views/notify/new_issue_email.text.erb b/app/views/notify/new_issue_email.text.erb
index b93d95ef02f..bd61db3ee76 100644
--- a/app/views/notify/new_issue_email.text.erb
+++ b/app/views/notify/new_issue_email.text.erb
@@ -1,9 +1,5 @@
-<%= sanitize_name(@issue.author_name) %> <%= 'created an issue:' %>
+<%= sanitize_name(@issue.author_name) %> <%= 'created an issue:' %> <%= url_for(project_issue_url(@issue.project, @issue)) %>
 
-<% if @issue.assignees.any? -%>
-  <%= assignees_label(@issue) %>
-<% end %>
+<%= assignees_label(@issue) if @issue.assignees.any? %>
 
-<% if @issue.description -%>
-  <%= @issue.description %>
-<% end %>
+<%= @issue.description %>
diff --git a/app/views/notify/new_merge_request_email.text.erb b/app/views/notify/new_merge_request_email.text.erb
index 6c0d7b1e60b..f4b0ed0f886 100644
--- a/app/views/notify/new_merge_request_email.text.erb
+++ b/app/views/notify/new_merge_request_email.text.erb
@@ -1,8 +1,8 @@
-<%= @merge_request.author_name %> <%= 'created a merge request:' %> <%= url_for(project_merge_request_url(@merge_request.target_project, @merge_request)) %>
+<%= sanitize_name(@merge_request.author_name) %> <%= 'created a merge request:' %> <%= url_for(project_merge_request_url(@merge_request.target_project, @merge_request)) %>
 
 <%= merge_path_description(@merge_request, 'to') %>
 <%= 'Author:' %>    <%= @merge_request.author_name %>
-<%= assignees_label(@merge_request) %>
+<%= assignees_label(@merge_request) if @merge_request.assignees.any? %>
 <%= render_if_exists 'notify/merge_request_approvers', presenter: @mr_presenter %>
 
 <%= @merge_request.description %>
diff --git a/changelogs/unreleased/tc-cleanup-issue-created-text-mail.yml b/changelogs/unreleased/tc-cleanup-issue-created-text-mail.yml
new file mode 100644
index 00000000000..cc590ee38eb
--- /dev/null
+++ b/changelogs/unreleased/tc-cleanup-issue-created-text-mail.yml
@@ -0,0 +1,5 @@
+---
+title: Bring text mail for new issue & MR more in line
+merge_request: 32254
+author:
+type: changed
-- 
cgit v1.2.1


From 30bc74f20d89930611871b251233a8b75e24e16e Mon Sep 17 00:00:00 2001
From: "David H. Wilkins" <dwilkins@gitlab.com>
Date: Tue, 27 Aug 2019 08:15:18 -0500
Subject: Broken Link to Test Design

- previous link
  engineering/quality/guidelines/test-engineering/test-design
  is missing and apparently should be
  engineering/quality/test-engineering/#test-heuristics
---
 doc/development/testing_guide/best_practices.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/development/testing_guide/best_practices.md b/doc/development/testing_guide/best_practices.md
index f30a83a4c71..0f982c3a48b 100644
--- a/doc/development/testing_guide/best_practices.md
+++ b/doc/development/testing_guide/best_practices.md
@@ -13,7 +13,7 @@ a level that is difficult to manage.
 Test heuristics can help solve this problem. They concisely address many of the common ways bugs
 manifest themselves within our code. When designing our tests, take time to review known test heuristics to inform
 our test design. We can find some helpful heuristics documented in the Handbook in the
-[Test Design](https://about.gitlab.com/handbook/engineering/quality/guidelines/test-engineering/test-design/) section.
+[Test Engineering](https://about.gitlab.com/handbook/engineering/quality/test-engineering/#test-heuristics) section.
 
 ## Test speed
 
-- 
cgit v1.2.1


From b4cc539d3c2ea96fa0fe30e1ab9aa3063bd387ed Mon Sep 17 00:00:00 2001
From: Enrique Alcantara <ealcantara@gitlab.com>
Date: Mon, 26 Aug 2019 10:56:20 -0400
Subject: Move gke_cluster_dropdowns to create_cluster dir

This commit creates a create_cluster directory to collect
all Vue applications related to creating kubernetes applications
using gitlab.

It also moves the gke_cluster_dropdowns collection of apps to
the create_cluster directory. gke_cluster_dropdowns contains
dropdown components used to select configuration options to
create a Kubernetes cluster in Google Cloud.
---
 .../gke_cluster/components/gke_dropdown_mixin.js   |  71 ++++++++
 .../components/gke_machine_type_dropdown.vue       | 129 ++++++++++++++
 .../components/gke_project_id_dropdown.vue         | 188 +++++++++++++++++++++
 .../gke_cluster/components/gke_zone_dropdown.vue   | 103 +++++++++++
 .../create_cluster/gke_cluster/constants.js        |  11 ++
 .../create_cluster/gke_cluster/index.js            |  88 ++++++++++
 .../create_cluster/gke_cluster/store/actions.js    |  95 +++++++++++
 .../create_cluster/gke_cluster/store/getters.js    |   3 +
 .../create_cluster/gke_cluster/store/index.js      |  18 ++
 .../gke_cluster/store/mutation_types.js            |   8 +
 .../create_cluster/gke_cluster/store/mutations.js  |  28 +++
 .../create_cluster/gke_cluster/store/state.js      |  13 ++
 .../javascripts/pages/admin/clusters/index.js      |   2 +-
 app/assets/javascripts/pages/groups/index.js       |   2 +-
 app/assets/javascripts/pages/projects/index.js     |   2 +-
 .../components/gke_dropdown_mixin.js               |  71 --------
 .../components/gke_machine_type_dropdown.vue       | 129 --------------
 .../components/gke_project_id_dropdown.vue         | 188 ---------------------
 .../components/gke_zone_dropdown.vue               | 103 -----------
 .../projects/gke_cluster_dropdowns/constants.js    |  11 --
 .../projects/gke_cluster_dropdowns/index.js        |  88 ----------
 .../gke_cluster_dropdowns/store/actions.js         |  95 -----------
 .../gke_cluster_dropdowns/store/getters.js         |   3 -
 .../projects/gke_cluster_dropdowns/store/index.js  |  18 --
 .../gke_cluster_dropdowns/store/mutation_types.js  |   8 -
 .../gke_cluster_dropdowns/store/mutations.js       |  28 ---
 .../projects/gke_cluster_dropdowns/store/state.js  |  13 --
 .../components/gke_machine_type_dropdown_spec.js   | 109 ++++++++++++
 .../components/gke_project_id_dropdown_spec.js     | 104 ++++++++++++
 .../components/gke_zone_dropdown_spec.js           |  94 +++++++++++
 .../create_cluster/gke_cluster/helpers.js          |  49 ++++++
 .../create_cluster/gke_cluster/mock_data.js        |  75 ++++++++
 .../gke_cluster/stores/actions_spec.js             | 131 ++++++++++++++
 .../gke_cluster/stores/getters_spec.js             |  65 +++++++
 .../gke_cluster/stores/mutations_spec.js           |  87 ++++++++++
 .../components/gke_machine_type_dropdown_spec.js   | 109 ------------
 .../components/gke_project_id_dropdown_spec.js     | 104 ------------
 .../components/gke_zone_dropdown_spec.js           |  94 -----------
 .../projects/gke_cluster_dropdowns/helpers.js      |  49 ------
 .../projects/gke_cluster_dropdowns/mock_data.js    |  75 --------
 .../gke_cluster_dropdowns/stores/actions_spec.js   | 131 --------------
 .../gke_cluster_dropdowns/stores/getters_spec.js   |  65 -------
 .../gke_cluster_dropdowns/stores/mutations_spec.js |  87 ----------
 43 files changed, 1472 insertions(+), 1472 deletions(-)
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/components/gke_dropdown_mixin.js
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/components/gke_machine_type_dropdown.vue
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/components/gke_project_id_dropdown.vue
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/components/gke_zone_dropdown.vue
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/constants.js
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/index.js
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/store/actions.js
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/store/getters.js
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/store/index.js
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/store/mutation_types.js
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/store/mutations.js
 create mode 100644 app/assets/javascripts/create_cluster/gke_cluster/store/state.js
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_dropdown_mixin.js
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_machine_type_dropdown.vue
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_project_id_dropdown.vue
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_zone_dropdown.vue
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/constants.js
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/index.js
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/store/actions.js
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/store/getters.js
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/store/index.js
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/store/mutation_types.js
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/store/mutations.js
 delete mode 100644 app/assets/javascripts/projects/gke_cluster_dropdowns/store/state.js
 create mode 100644 spec/javascripts/create_cluster/gke_cluster/components/gke_machine_type_dropdown_spec.js
 create mode 100644 spec/javascripts/create_cluster/gke_cluster/components/gke_project_id_dropdown_spec.js
 create mode 100644 spec/javascripts/create_cluster/gke_cluster/components/gke_zone_dropdown_spec.js
 create mode 100644 spec/javascripts/create_cluster/gke_cluster/helpers.js
 create mode 100644 spec/javascripts/create_cluster/gke_cluster/mock_data.js
 create mode 100644 spec/javascripts/create_cluster/gke_cluster/stores/actions_spec.js
 create mode 100644 spec/javascripts/create_cluster/gke_cluster/stores/getters_spec.js
 create mode 100644 spec/javascripts/create_cluster/gke_cluster/stores/mutations_spec.js
 delete mode 100644 spec/javascripts/projects/gke_cluster_dropdowns/components/gke_machine_type_dropdown_spec.js
 delete mode 100644 spec/javascripts/projects/gke_cluster_dropdowns/components/gke_project_id_dropdown_spec.js
 delete mode 100644 spec/javascripts/projects/gke_cluster_dropdowns/components/gke_zone_dropdown_spec.js
 delete mode 100644 spec/javascripts/projects/gke_cluster_dropdowns/helpers.js
 delete mode 100644 spec/javascripts/projects/gke_cluster_dropdowns/mock_data.js
 delete mode 100644 spec/javascripts/projects/gke_cluster_dropdowns/stores/actions_spec.js
 delete mode 100644 spec/javascripts/projects/gke_cluster_dropdowns/stores/getters_spec.js
 delete mode 100644 spec/javascripts/projects/gke_cluster_dropdowns/stores/mutations_spec.js

diff --git a/app/assets/javascripts/create_cluster/gke_cluster/components/gke_dropdown_mixin.js b/app/assets/javascripts/create_cluster/gke_cluster/components/gke_dropdown_mixin.js
new file mode 100644
index 00000000000..5a3407693e5
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/components/gke_dropdown_mixin.js
@@ -0,0 +1,71 @@
+import _ from 'underscore';
+import DropdownSearchInput from '~/vue_shared/components/dropdown/dropdown_search_input.vue';
+import DropdownHiddenInput from '~/vue_shared/components/dropdown/dropdown_hidden_input.vue';
+import DropdownButton from '~/vue_shared/components/dropdown/dropdown_button.vue';
+import { GlLoadingIcon } from '@gitlab/ui';
+
+import store from '../store';
+
+export default {
+  store,
+  components: {
+    DropdownButton,
+    DropdownSearchInput,
+    DropdownHiddenInput,
+    GlLoadingIcon,
+  },
+  props: {
+    fieldId: {
+      type: String,
+      required: true,
+    },
+    fieldName: {
+      type: String,
+      required: true,
+    },
+    defaultValue: {
+      type: String,
+      required: false,
+      default: '',
+    },
+  },
+  data() {
+    return {
+      isLoading: false,
+      hasErrors: false,
+      searchQuery: '',
+      gapiError: '',
+    };
+  },
+  computed: {
+    results() {
+      if (!this.items) {
+        return [];
+      }
+
+      return this.items.filter(item => item.name.toLowerCase().indexOf(this.searchQuery) > -1);
+    },
+  },
+  methods: {
+    fetchSuccessHandler() {
+      if (this.defaultValue) {
+        const itemToSelect = _.find(this.items, item => item.name === this.defaultValue);
+
+        if (itemToSelect) {
+          this.setItem(itemToSelect.name);
+        }
+      }
+
+      this.isLoading = false;
+      this.hasErrors = false;
+    },
+    fetchFailureHandler(resp) {
+      this.isLoading = false;
+      this.hasErrors = true;
+
+      if (resp.result && resp.result.error) {
+        this.gapiError = resp.result.error.message;
+      }
+    },
+  },
+};
diff --git a/app/assets/javascripts/create_cluster/gke_cluster/components/gke_machine_type_dropdown.vue b/app/assets/javascripts/create_cluster/gke_cluster/components/gke_machine_type_dropdown.vue
new file mode 100644
index 00000000000..83811ab489a
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/components/gke_machine_type_dropdown.vue
@@ -0,0 +1,129 @@
+<script>
+import { sprintf, s__ } from '~/locale';
+import { mapState, mapGetters, mapActions } from 'vuex';
+
+import gkeDropdownMixin from './gke_dropdown_mixin';
+
+export default {
+  name: 'GkeMachineTypeDropdown',
+  mixins: [gkeDropdownMixin],
+  computed: {
+    ...mapState([
+      'isValidatingProjectBilling',
+      'projectHasBillingEnabled',
+      'selectedZone',
+      'selectedMachineType',
+    ]),
+    ...mapState({ items: 'machineTypes' }),
+    ...mapGetters(['hasZone', 'hasMachineType']),
+    allDropdownsSelected() {
+      return this.projectHasBillingEnabled && this.hasZone && this.hasMachineType;
+    },
+    isDisabled() {
+      return (
+        this.isLoading ||
+        this.isValidatingProjectBilling ||
+        !this.projectHasBillingEnabled ||
+        !this.hasZone
+      );
+    },
+    toggleText() {
+      if (this.isLoading) {
+        return s__('ClusterIntegration|Fetching machine types');
+      }
+
+      if (this.selectedMachineType) {
+        return this.selectedMachineType;
+      }
+
+      if (!this.projectHasBillingEnabled && !this.hasZone) {
+        return s__('ClusterIntegration|Select project and zone to choose machine type');
+      }
+
+      return !this.hasZone
+        ? s__('ClusterIntegration|Select zone to choose machine type')
+        : s__('ClusterIntegration|Select machine type');
+    },
+    errorMessage() {
+      return sprintf(
+        s__(
+          'ClusterIntegration|An error occurred while trying to fetch zone machine types: %{error}',
+        ),
+        { error: this.gapiError },
+      );
+    },
+  },
+  watch: {
+    selectedZone() {
+      this.hasErrors = false;
+
+      if (this.hasZone) {
+        this.isLoading = true;
+
+        this.fetchMachineTypes()
+          .then(this.fetchSuccessHandler)
+          .catch(this.fetchFailureHandler);
+      }
+    },
+    selectedMachineType() {
+      this.enableSubmit();
+    },
+  },
+  methods: {
+    ...mapActions(['fetchMachineTypes']),
+    ...mapActions({ setItem: 'setMachineType' }),
+    enableSubmit() {
+      if (this.allDropdownsSelected) {
+        const submitButtonEl = document.querySelector('.js-gke-cluster-creation-submit');
+
+        if (submitButtonEl) {
+          submitButtonEl.removeAttribute('disabled');
+        }
+      }
+    },
+  },
+};
+</script>
+
+<template>
+  <div>
+    <div class="js-gcp-machine-type-dropdown dropdown">
+      <dropdown-hidden-input :name="fieldName" :value="selectedMachineType" />
+      <dropdown-button
+        :class="{ 'border-danger': hasErrors }"
+        :is-disabled="isDisabled"
+        :is-loading="isLoading"
+        :toggle-text="toggleText"
+      />
+      <div class="dropdown-menu dropdown-select">
+        <dropdown-search-input
+          v-model="searchQuery"
+          :placeholder-text="s__('ClusterIntegration|Search machine types')"
+        />
+        <div class="dropdown-content">
+          <ul>
+            <li v-show="!results.length">
+              <span class="menu-item">
+                {{ s__('ClusterIntegration|No machine types matched your search') }}
+              </span>
+            </li>
+            <li v-for="result in results" :key="result.id">
+              <button type="button" @click.prevent="setItem(result.name)">{{ result.name }}</button>
+            </li>
+          </ul>
+        </div>
+        <div class="dropdown-loading"><gl-loading-icon /></div>
+      </div>
+    </div>
+    <span
+      v-if="hasErrors"
+      :class="{
+        'text-danger': hasErrors,
+        'text-muted': !hasErrors,
+      }"
+      class="form-text"
+    >
+      {{ errorMessage }}
+    </span>
+  </div>
+</template>
diff --git a/app/assets/javascripts/create_cluster/gke_cluster/components/gke_project_id_dropdown.vue b/app/assets/javascripts/create_cluster/gke_cluster/components/gke_project_id_dropdown.vue
new file mode 100644
index 00000000000..a2eb79af4f9
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/components/gke_project_id_dropdown.vue
@@ -0,0 +1,188 @@
+<script>
+import _ from 'underscore';
+import { s__, sprintf } from '~/locale';
+import { mapState, mapGetters, mapActions } from 'vuex';
+
+import gkeDropdownMixin from './gke_dropdown_mixin';
+
+export default {
+  name: 'GkeProjectIdDropdown',
+  mixins: [gkeDropdownMixin],
+  props: {
+    docsUrl: {
+      type: String,
+      required: true,
+    },
+  },
+  computed: {
+    ...mapState(['selectedProject', 'isValidatingProjectBilling', 'projectHasBillingEnabled']),
+    ...mapState({ items: 'projects' }),
+    ...mapGetters(['hasProject']),
+    hasOneProject() {
+      return this.items && this.items.length === 1;
+    },
+    isDisabled() {
+      return (
+        this.isLoading || this.isValidatingProjectBilling || (this.items && this.items.length < 2)
+      );
+    },
+    toggleText() {
+      if (this.isValidatingProjectBilling) {
+        return s__('ClusterIntegration|Validating project billing status');
+      }
+
+      if (this.isLoading) {
+        return s__('ClusterIntegration|Fetching projects');
+      }
+
+      if (this.hasProject) {
+        return this.selectedProject.name;
+      }
+
+      if (!this.items) {
+        return s__('ClusterIntegration|No projects found');
+      }
+
+      return s__('ClusterIntegration|Select project');
+    },
+    helpText() {
+      let message;
+      if (this.hasErrors) {
+        return this.errorMessage;
+      }
+
+      if (!this.items) {
+        message =
+          'ClusterIntegration|We were unable to fetch any projects. Ensure that you have a project on %{docsLinkStart}Google Cloud Platform%{docsLinkEnd}.';
+      }
+
+      message =
+        this.items && this.items.length
+          ? 'ClusterIntegration|To use a new project, first create one on %{docsLinkStart}Google Cloud Platform%{docsLinkEnd}.'
+          : 'ClusterIntegration|To create a cluster, first create a project on %{docsLinkStart}Google Cloud Platform%{docsLinkEnd}.';
+
+      return sprintf(
+        s__(message),
+        {
+          docsLinkEnd: '&nbsp;<i class="fa fa-external-link" aria-hidden="true"></i></a>',
+          docsLinkStart: `<a href="${_.escape(
+            this.docsUrl,
+          )}" target="_blank" rel="noopener noreferrer">`,
+        },
+        false,
+      );
+    },
+    errorMessage() {
+      if (!this.projectHasBillingEnabled) {
+        if (this.gapiError) {
+          return s__(
+            'ClusterIntegration|We could not verify that one of your projects on GCP has billing enabled. Please try again.',
+          );
+        }
+
+        return sprintf(
+          s__(
+            'This project does not have billing enabled. To create a cluster, <a href=%{linkToBilling} target="_blank" rel="noopener noreferrer">enable billing <i class="fa fa-external-link" aria-hidden="true"></i></a> and try again.',
+          ),
+          {
+            linkToBilling:
+              'https://console.cloud.google.com/freetrial?utm_campaign=2018_cpanel&utm_source=gitlab&utm_medium=referral',
+          },
+          false,
+        );
+      }
+
+      return sprintf(
+        s__('ClusterIntegration|An error occurred while trying to fetch your projects: %{error}'),
+        { error: this.gapiError },
+      );
+    },
+  },
+  watch: {
+    selectedProject() {
+      this.setIsValidatingProjectBilling(true);
+
+      this.validateProjectBilling()
+        .then(this.validateProjectBillingSuccessHandler)
+        .catch(this.validateProjectBillingFailureHandler);
+    },
+  },
+  created() {
+    this.isLoading = true;
+
+    this.fetchProjects()
+      .then(this.fetchSuccessHandler)
+      .catch(this.fetchFailureHandler);
+  },
+  methods: {
+    ...mapActions(['fetchProjects', 'setIsValidatingProjectBilling', 'validateProjectBilling']),
+    ...mapActions({ setItem: 'setProject' }),
+    fetchSuccessHandler() {
+      if (this.defaultValue) {
+        const projectToSelect = _.find(this.items, item => item.projectId === this.defaultValue);
+
+        if (projectToSelect) {
+          this.setItem(projectToSelect);
+        }
+      } else if (this.items.length === 1) {
+        this.setItem(this.items[0]);
+      }
+
+      this.isLoading = false;
+      this.hasErrors = false;
+    },
+    validateProjectBillingSuccessHandler() {
+      this.hasErrors = !this.projectHasBillingEnabled;
+    },
+    validateProjectBillingFailureHandler(resp) {
+      this.hasErrors = true;
+
+      this.gapiError = resp.result ? resp.result.error.message : resp;
+    },
+  },
+};
+</script>
+
+<template>
+  <div>
+    <div class="js-gcp-project-id-dropdown dropdown">
+      <dropdown-hidden-input :name="fieldName" :value="selectedProject.projectId" />
+      <dropdown-button
+        :class="{
+          'border-danger': hasErrors,
+          'read-only': hasOneProject,
+        }"
+        :is-disabled="isDisabled"
+        :is-loading="isLoading"
+        :toggle-text="toggleText"
+      />
+      <div class="dropdown-menu dropdown-select">
+        <dropdown-search-input
+          v-model="searchQuery"
+          :placeholder-text="s__('ClusterIntegration|Search projects')"
+        />
+        <div class="dropdown-content">
+          <ul>
+            <li v-show="!results.length">
+              <span class="menu-item">
+                {{ s__('ClusterIntegration|No projects matched your search') }}
+              </span>
+            </li>
+            <li v-for="result in results" :key="result.project_number">
+              <button type="button" @click.prevent="setItem(result)">{{ result.name }}</button>
+            </li>
+          </ul>
+        </div>
+        <div class="dropdown-loading"><gl-loading-icon /></div>
+      </div>
+    </div>
+    <span
+      :class="{
+        'text-danger': hasErrors,
+        'text-muted': !hasErrors,
+      }"
+      class="form-text"
+      v-html="helpText"
+    ></span>
+  </div>
+</template>
diff --git a/app/assets/javascripts/create_cluster/gke_cluster/components/gke_zone_dropdown.vue b/app/assets/javascripts/create_cluster/gke_cluster/components/gke_zone_dropdown.vue
new file mode 100644
index 00000000000..fd5d5f86401
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/components/gke_zone_dropdown.vue
@@ -0,0 +1,103 @@
+<script>
+import { sprintf, s__ } from '~/locale';
+import { mapState, mapActions } from 'vuex';
+
+import gkeDropdownMixin from './gke_dropdown_mixin';
+
+export default {
+  name: 'GkeZoneDropdown',
+  mixins: [gkeDropdownMixin],
+  computed: {
+    ...mapState([
+      'selectedProject',
+      'selectedZone',
+      'projects',
+      'isValidatingProjectBilling',
+      'projectHasBillingEnabled',
+    ]),
+    ...mapState({ items: 'zones' }),
+    isDisabled() {
+      return this.isLoading || this.isValidatingProjectBilling || !this.projectHasBillingEnabled;
+    },
+    toggleText() {
+      if (this.isLoading) {
+        return s__('ClusterIntegration|Fetching zones');
+      }
+
+      if (this.selectedZone) {
+        return this.selectedZone;
+      }
+
+      return !this.projectHasBillingEnabled
+        ? s__('ClusterIntegration|Select project to choose zone')
+        : s__('ClusterIntegration|Select zone');
+    },
+    errorMessage() {
+      return sprintf(
+        s__('ClusterIntegration|An error occurred while trying to fetch project zones: %{error}'),
+        { error: this.gapiError },
+      );
+    },
+  },
+  watch: {
+    isValidatingProjectBilling(isValidating) {
+      this.hasErrors = false;
+
+      if (!isValidating && this.projectHasBillingEnabled) {
+        this.isLoading = true;
+
+        this.fetchZones()
+          .then(this.fetchSuccessHandler)
+          .catch(this.fetchFailureHandler);
+      }
+    },
+  },
+  methods: {
+    ...mapActions(['fetchZones']),
+    ...mapActions({ setItem: 'setZone' }),
+  },
+};
+</script>
+
+<template>
+  <div>
+    <div class="js-gcp-zone-dropdown dropdown">
+      <dropdown-hidden-input :name="fieldName" :value="selectedZone" />
+      <dropdown-button
+        :class="{ 'border-danger': hasErrors }"
+        :is-disabled="isDisabled"
+        :is-loading="isLoading"
+        :toggle-text="toggleText"
+      />
+      <div class="dropdown-menu dropdown-select">
+        <dropdown-search-input
+          v-model="searchQuery"
+          :placeholder-text="s__('ClusterIntegration|Search zones')"
+        />
+        <div class="dropdown-content">
+          <ul>
+            <li v-show="!results.length">
+              <span class="menu-item">
+                {{ s__('ClusterIntegration|No zones matched your search') }}
+              </span>
+            </li>
+            <li v-for="result in results" :key="result.id">
+              <button type="button" @click.prevent="setItem(result.name)">{{ result.name }}</button>
+            </li>
+          </ul>
+        </div>
+        <div class="dropdown-loading"><gl-loading-icon /></div>
+      </div>
+    </div>
+    <span
+      v-if="hasErrors"
+      :class="{
+        'text-danger': hasErrors,
+        'text-muted': !hasErrors,
+      }"
+      class="form-text"
+    >
+      {{ errorMessage }}
+    </span>
+  </div>
+</template>
diff --git a/app/assets/javascripts/create_cluster/gke_cluster/constants.js b/app/assets/javascripts/create_cluster/gke_cluster/constants.js
new file mode 100644
index 00000000000..2a1c0819916
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/constants.js
@@ -0,0 +1,11 @@
+import { s__ } from '~/locale';
+
+export const GCP_API_ERROR = s__(
+  'ClusterIntegration|An error occurred when trying to contact the Google Cloud API. Please try again later.',
+);
+export const GCP_API_CLOUD_BILLING_ENDPOINT =
+  'https://www.googleapis.com/discovery/v1/apis/cloudbilling/v1/rest';
+export const GCP_API_CLOUD_RESOURCE_MANAGER_ENDPOINT =
+  'https://www.googleapis.com/discovery/v1/apis/cloudresourcemanager/v1/rest';
+export const GCP_API_COMPUTE_ENDPOINT =
+  'https://www.googleapis.com/discovery/v1/apis/compute/v1/rest';
diff --git a/app/assets/javascripts/create_cluster/gke_cluster/index.js b/app/assets/javascripts/create_cluster/gke_cluster/index.js
new file mode 100644
index 00000000000..729b9404b64
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/index.js
@@ -0,0 +1,88 @@
+/* global gapi */
+import Vue from 'vue';
+import Flash from '~/flash';
+import GkeProjectIdDropdown from './components/gke_project_id_dropdown.vue';
+import GkeZoneDropdown from './components/gke_zone_dropdown.vue';
+import GkeMachineTypeDropdown from './components/gke_machine_type_dropdown.vue';
+import * as CONSTANTS from './constants';
+
+const mountComponent = (entryPoint, component, componentName, extraProps = {}) => {
+  const el = document.querySelector(entryPoint);
+  if (!el) return false;
+
+  const hiddenInput = el.querySelector('input');
+
+  return new Vue({
+    el,
+    components: {
+      [componentName]: component,
+    },
+    render: createElement =>
+      createElement(componentName, {
+        props: {
+          fieldName: hiddenInput.getAttribute('name'),
+          fieldId: hiddenInput.getAttribute('id'),
+          defaultValue: hiddenInput.value,
+          ...extraProps,
+        },
+      }),
+  });
+};
+
+const mountGkeProjectIdDropdown = () => {
+  const entryPoint = '.js-gcp-project-id-dropdown-entry-point';
+  const el = document.querySelector(entryPoint);
+
+  mountComponent(entryPoint, GkeProjectIdDropdown, 'gke-project-id-dropdown', {
+    docsUrl: el.dataset.docsurl,
+  });
+};
+
+const mountGkeZoneDropdown = () => {
+  mountComponent('.js-gcp-zone-dropdown-entry-point', GkeZoneDropdown, 'gke-zone-dropdown');
+};
+
+const mountGkeMachineTypeDropdown = () => {
+  mountComponent(
+    '.js-gcp-machine-type-dropdown-entry-point',
+    GkeMachineTypeDropdown,
+    'gke-machine-type-dropdown',
+  );
+};
+
+const gkeDropdownErrorHandler = () => {
+  Flash(CONSTANTS.GCP_API_ERROR);
+};
+
+const initializeGapiClient = () => {
+  const el = document.querySelector('.js-gke-cluster-creation');
+  if (!el) return false;
+
+  return gapi.client
+    .init({
+      discoveryDocs: [
+        CONSTANTS.GCP_API_CLOUD_BILLING_ENDPOINT,
+        CONSTANTS.GCP_API_CLOUD_RESOURCE_MANAGER_ENDPOINT,
+        CONSTANTS.GCP_API_COMPUTE_ENDPOINT,
+      ],
+    })
+    .then(() => {
+      gapi.client.setToken({ access_token: el.dataset.token });
+
+      mountGkeProjectIdDropdown();
+      mountGkeZoneDropdown();
+      mountGkeMachineTypeDropdown();
+    })
+    .catch(gkeDropdownErrorHandler);
+};
+
+const initGkeDropdowns = () => {
+  if (!gapi) {
+    gkeDropdownErrorHandler();
+    return false;
+  }
+
+  return gapi.load('client', initializeGapiClient);
+};
+
+export default initGkeDropdowns;
diff --git a/app/assets/javascripts/create_cluster/gke_cluster/store/actions.js b/app/assets/javascripts/create_cluster/gke_cluster/store/actions.js
new file mode 100644
index 00000000000..f05ad7773a2
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/store/actions.js
@@ -0,0 +1,95 @@
+/* global gapi */
+import * as types from './mutation_types';
+
+const gapiResourceListRequest = ({ resource, params, commit, mutation, payloadKey }) =>
+  new Promise((resolve, reject) => {
+    const request = resource.list(params);
+
+    return request.then(
+      resp => {
+        const { result } = resp;
+
+        commit(mutation, result[payloadKey]);
+
+        resolve();
+      },
+      resp => {
+        reject(resp);
+      },
+    );
+  });
+
+export const setProject = ({ commit }, selectedProject) => {
+  commit(types.SET_PROJECT, selectedProject);
+};
+
+export const setZone = ({ commit }, selectedZone) => {
+  commit(types.SET_ZONE, selectedZone);
+};
+
+export const setMachineType = ({ commit }, selectedMachineType) => {
+  commit(types.SET_MACHINE_TYPE, selectedMachineType);
+};
+
+export const setIsValidatingProjectBilling = ({ commit }, isValidatingProjectBilling) => {
+  commit(types.SET_IS_VALIDATING_PROJECT_BILLING, isValidatingProjectBilling);
+};
+
+export const fetchProjects = ({ commit }) =>
+  gapiResourceListRequest({
+    resource: gapi.client.cloudresourcemanager.projects,
+    params: {},
+    commit,
+    mutation: types.SET_PROJECTS,
+    payloadKey: 'projects',
+  });
+
+export const validateProjectBilling = ({ dispatch, commit, state }) =>
+  new Promise((resolve, reject) => {
+    const request = gapi.client.cloudbilling.projects.getBillingInfo({
+      name: `projects/${state.selectedProject.projectId}`,
+    });
+
+    commit(types.SET_ZONE, '');
+    commit(types.SET_MACHINE_TYPE, '');
+
+    return request.then(
+      resp => {
+        const { billingEnabled } = resp.result;
+
+        commit(types.SET_PROJECT_BILLING_STATUS, Boolean(billingEnabled));
+        dispatch('setIsValidatingProjectBilling', false);
+        resolve();
+      },
+      resp => {
+        dispatch('setIsValidatingProjectBilling', false);
+        reject(resp);
+      },
+    );
+  });
+
+export const fetchZones = ({ commit, state }) =>
+  gapiResourceListRequest({
+    resource: gapi.client.compute.zones,
+    params: {
+      project: state.selectedProject.projectId,
+    },
+    commit,
+    mutation: types.SET_ZONES,
+    payloadKey: 'items',
+  });
+
+export const fetchMachineTypes = ({ commit, state }) =>
+  gapiResourceListRequest({
+    resource: gapi.client.compute.machineTypes,
+    params: {
+      project: state.selectedProject.projectId,
+      zone: state.selectedZone,
+    },
+    commit,
+    mutation: types.SET_MACHINE_TYPES,
+    payloadKey: 'items',
+  });
+
+// prevent babel-plugin-rewire from generating an invalid default during karma tests
+export default () => {};
diff --git a/app/assets/javascripts/create_cluster/gke_cluster/store/getters.js b/app/assets/javascripts/create_cluster/gke_cluster/store/getters.js
new file mode 100644
index 00000000000..f9e2e2f74fb
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/store/getters.js
@@ -0,0 +1,3 @@
+export const hasProject = state => Boolean(state.selectedProject.projectId);
+export const hasZone = state => Boolean(state.selectedZone);
+export const hasMachineType = state => Boolean(state.selectedMachineType);
diff --git a/app/assets/javascripts/create_cluster/gke_cluster/store/index.js b/app/assets/javascripts/create_cluster/gke_cluster/store/index.js
new file mode 100644
index 00000000000..5f72060633e
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/store/index.js
@@ -0,0 +1,18 @@
+import Vue from 'vue';
+import Vuex from 'vuex';
+import * as actions from './actions';
+import * as getters from './getters';
+import mutations from './mutations';
+import createState from './state';
+
+Vue.use(Vuex);
+
+export const createStore = () =>
+  new Vuex.Store({
+    actions,
+    getters,
+    mutations,
+    state: createState(),
+  });
+
+export default createStore();
diff --git a/app/assets/javascripts/create_cluster/gke_cluster/store/mutation_types.js b/app/assets/javascripts/create_cluster/gke_cluster/store/mutation_types.js
new file mode 100644
index 00000000000..45a91efc2d9
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/store/mutation_types.js
@@ -0,0 +1,8 @@
+export const SET_PROJECT = 'SET_PROJECT';
+export const SET_PROJECT_BILLING_STATUS = 'SET_PROJECT_BILLING_STATUS';
+export const SET_IS_VALIDATING_PROJECT_BILLING = 'SET_IS_VALIDATING_PROJECT_BILLING';
+export const SET_ZONE = 'SET_ZONE';
+export const SET_MACHINE_TYPE = 'SET_MACHINE_TYPE';
+export const SET_PROJECTS = 'SET_PROJECTS';
+export const SET_ZONES = 'SET_ZONES';
+export const SET_MACHINE_TYPES = 'SET_MACHINE_TYPES';
diff --git a/app/assets/javascripts/create_cluster/gke_cluster/store/mutations.js b/app/assets/javascripts/create_cluster/gke_cluster/store/mutations.js
new file mode 100644
index 00000000000..88a2c1b630d
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/store/mutations.js
@@ -0,0 +1,28 @@
+import * as types from './mutation_types';
+
+export default {
+  [types.SET_PROJECT](state, selectedProject) {
+    Object.assign(state, { selectedProject });
+  },
+  [types.SET_IS_VALIDATING_PROJECT_BILLING](state, isValidatingProjectBilling) {
+    Object.assign(state, { isValidatingProjectBilling });
+  },
+  [types.SET_PROJECT_BILLING_STATUS](state, projectHasBillingEnabled) {
+    Object.assign(state, { projectHasBillingEnabled });
+  },
+  [types.SET_ZONE](state, selectedZone) {
+    Object.assign(state, { selectedZone });
+  },
+  [types.SET_MACHINE_TYPE](state, selectedMachineType) {
+    Object.assign(state, { selectedMachineType });
+  },
+  [types.SET_PROJECTS](state, projects) {
+    Object.assign(state, { projects });
+  },
+  [types.SET_ZONES](state, zones) {
+    Object.assign(state, { zones });
+  },
+  [types.SET_MACHINE_TYPES](state, machineTypes) {
+    Object.assign(state, { machineTypes });
+  },
+};
diff --git a/app/assets/javascripts/create_cluster/gke_cluster/store/state.js b/app/assets/javascripts/create_cluster/gke_cluster/store/state.js
new file mode 100644
index 00000000000..9f3c473d4bc
--- /dev/null
+++ b/app/assets/javascripts/create_cluster/gke_cluster/store/state.js
@@ -0,0 +1,13 @@
+export default () => ({
+  selectedProject: {
+    projectId: '',
+    name: '',
+  },
+  selectedZone: '',
+  selectedMachineType: '',
+  isValidatingProjectBilling: null,
+  projectHasBillingEnabled: null,
+  projects: [],
+  zones: [],
+  machineTypes: [],
+});
diff --git a/app/assets/javascripts/pages/admin/clusters/index.js b/app/assets/javascripts/pages/admin/clusters/index.js
index d0c9ae66c6a..43992938d07 100644
--- a/app/assets/javascripts/pages/admin/clusters/index.js
+++ b/app/assets/javascripts/pages/admin/clusters/index.js
@@ -1,5 +1,5 @@
 import PersistentUserCallout from '~/persistent_user_callout';
-import initGkeDropdowns from '~/projects/gke_cluster_dropdowns';
+import initGkeDropdowns from '~/create_cluster/gke_cluster';
 
 function initGcpSignupCallout() {
   const callout = document.querySelector('.gcp-signup-offer');
diff --git a/app/assets/javascripts/pages/groups/index.js b/app/assets/javascripts/pages/groups/index.js
index 451be6497de..a33d242908b 100644
--- a/app/assets/javascripts/pages/groups/index.js
+++ b/app/assets/javascripts/pages/groups/index.js
@@ -1,5 +1,5 @@
 import PersistentUserCallout from '~/persistent_user_callout';
-import initGkeDropdowns from '~/projects/gke_cluster_dropdowns';
+import initGkeDropdowns from '~/create_cluster/gke_cluster';
 
 function initGcpSignupCallout() {
   const callout = document.querySelector('.gcp-signup-offer');
diff --git a/app/assets/javascripts/pages/projects/index.js b/app/assets/javascripts/pages/projects/index.js
index 55c377ebec0..196798a9076 100644
--- a/app/assets/javascripts/pages/projects/index.js
+++ b/app/assets/javascripts/pages/projects/index.js
@@ -1,4 +1,4 @@
-import initGkeDropdowns from '~/projects/gke_cluster_dropdowns';
+import initGkeDropdowns from '~/create_cluster/gke_cluster';
 import initGkeNamespace from '~/projects/gke_cluster_namespace';
 import PersistentUserCallout from '../../persistent_user_callout';
 import Project from './project';
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_dropdown_mixin.js b/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_dropdown_mixin.js
deleted file mode 100644
index 5a3407693e5..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_dropdown_mixin.js
+++ /dev/null
@@ -1,71 +0,0 @@
-import _ from 'underscore';
-import DropdownSearchInput from '~/vue_shared/components/dropdown/dropdown_search_input.vue';
-import DropdownHiddenInput from '~/vue_shared/components/dropdown/dropdown_hidden_input.vue';
-import DropdownButton from '~/vue_shared/components/dropdown/dropdown_button.vue';
-import { GlLoadingIcon } from '@gitlab/ui';
-
-import store from '../store';
-
-export default {
-  store,
-  components: {
-    DropdownButton,
-    DropdownSearchInput,
-    DropdownHiddenInput,
-    GlLoadingIcon,
-  },
-  props: {
-    fieldId: {
-      type: String,
-      required: true,
-    },
-    fieldName: {
-      type: String,
-      required: true,
-    },
-    defaultValue: {
-      type: String,
-      required: false,
-      default: '',
-    },
-  },
-  data() {
-    return {
-      isLoading: false,
-      hasErrors: false,
-      searchQuery: '',
-      gapiError: '',
-    };
-  },
-  computed: {
-    results() {
-      if (!this.items) {
-        return [];
-      }
-
-      return this.items.filter(item => item.name.toLowerCase().indexOf(this.searchQuery) > -1);
-    },
-  },
-  methods: {
-    fetchSuccessHandler() {
-      if (this.defaultValue) {
-        const itemToSelect = _.find(this.items, item => item.name === this.defaultValue);
-
-        if (itemToSelect) {
-          this.setItem(itemToSelect.name);
-        }
-      }
-
-      this.isLoading = false;
-      this.hasErrors = false;
-    },
-    fetchFailureHandler(resp) {
-      this.isLoading = false;
-      this.hasErrors = true;
-
-      if (resp.result && resp.result.error) {
-        this.gapiError = resp.result.error.message;
-      }
-    },
-  },
-};
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_machine_type_dropdown.vue b/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_machine_type_dropdown.vue
deleted file mode 100644
index 83811ab489a..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_machine_type_dropdown.vue
+++ /dev/null
@@ -1,129 +0,0 @@
-<script>
-import { sprintf, s__ } from '~/locale';
-import { mapState, mapGetters, mapActions } from 'vuex';
-
-import gkeDropdownMixin from './gke_dropdown_mixin';
-
-export default {
-  name: 'GkeMachineTypeDropdown',
-  mixins: [gkeDropdownMixin],
-  computed: {
-    ...mapState([
-      'isValidatingProjectBilling',
-      'projectHasBillingEnabled',
-      'selectedZone',
-      'selectedMachineType',
-    ]),
-    ...mapState({ items: 'machineTypes' }),
-    ...mapGetters(['hasZone', 'hasMachineType']),
-    allDropdownsSelected() {
-      return this.projectHasBillingEnabled && this.hasZone && this.hasMachineType;
-    },
-    isDisabled() {
-      return (
-        this.isLoading ||
-        this.isValidatingProjectBilling ||
-        !this.projectHasBillingEnabled ||
-        !this.hasZone
-      );
-    },
-    toggleText() {
-      if (this.isLoading) {
-        return s__('ClusterIntegration|Fetching machine types');
-      }
-
-      if (this.selectedMachineType) {
-        return this.selectedMachineType;
-      }
-
-      if (!this.projectHasBillingEnabled && !this.hasZone) {
-        return s__('ClusterIntegration|Select project and zone to choose machine type');
-      }
-
-      return !this.hasZone
-        ? s__('ClusterIntegration|Select zone to choose machine type')
-        : s__('ClusterIntegration|Select machine type');
-    },
-    errorMessage() {
-      return sprintf(
-        s__(
-          'ClusterIntegration|An error occurred while trying to fetch zone machine types: %{error}',
-        ),
-        { error: this.gapiError },
-      );
-    },
-  },
-  watch: {
-    selectedZone() {
-      this.hasErrors = false;
-
-      if (this.hasZone) {
-        this.isLoading = true;
-
-        this.fetchMachineTypes()
-          .then(this.fetchSuccessHandler)
-          .catch(this.fetchFailureHandler);
-      }
-    },
-    selectedMachineType() {
-      this.enableSubmit();
-    },
-  },
-  methods: {
-    ...mapActions(['fetchMachineTypes']),
-    ...mapActions({ setItem: 'setMachineType' }),
-    enableSubmit() {
-      if (this.allDropdownsSelected) {
-        const submitButtonEl = document.querySelector('.js-gke-cluster-creation-submit');
-
-        if (submitButtonEl) {
-          submitButtonEl.removeAttribute('disabled');
-        }
-      }
-    },
-  },
-};
-</script>
-
-<template>
-  <div>
-    <div class="js-gcp-machine-type-dropdown dropdown">
-      <dropdown-hidden-input :name="fieldName" :value="selectedMachineType" />
-      <dropdown-button
-        :class="{ 'border-danger': hasErrors }"
-        :is-disabled="isDisabled"
-        :is-loading="isLoading"
-        :toggle-text="toggleText"
-      />
-      <div class="dropdown-menu dropdown-select">
-        <dropdown-search-input
-          v-model="searchQuery"
-          :placeholder-text="s__('ClusterIntegration|Search machine types')"
-        />
-        <div class="dropdown-content">
-          <ul>
-            <li v-show="!results.length">
-              <span class="menu-item">
-                {{ s__('ClusterIntegration|No machine types matched your search') }}
-              </span>
-            </li>
-            <li v-for="result in results" :key="result.id">
-              <button type="button" @click.prevent="setItem(result.name)">{{ result.name }}</button>
-            </li>
-          </ul>
-        </div>
-        <div class="dropdown-loading"><gl-loading-icon /></div>
-      </div>
-    </div>
-    <span
-      v-if="hasErrors"
-      :class="{
-        'text-danger': hasErrors,
-        'text-muted': !hasErrors,
-      }"
-      class="form-text"
-    >
-      {{ errorMessage }}
-    </span>
-  </div>
-</template>
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_project_id_dropdown.vue b/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_project_id_dropdown.vue
deleted file mode 100644
index a2eb79af4f9..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_project_id_dropdown.vue
+++ /dev/null
@@ -1,188 +0,0 @@
-<script>
-import _ from 'underscore';
-import { s__, sprintf } from '~/locale';
-import { mapState, mapGetters, mapActions } from 'vuex';
-
-import gkeDropdownMixin from './gke_dropdown_mixin';
-
-export default {
-  name: 'GkeProjectIdDropdown',
-  mixins: [gkeDropdownMixin],
-  props: {
-    docsUrl: {
-      type: String,
-      required: true,
-    },
-  },
-  computed: {
-    ...mapState(['selectedProject', 'isValidatingProjectBilling', 'projectHasBillingEnabled']),
-    ...mapState({ items: 'projects' }),
-    ...mapGetters(['hasProject']),
-    hasOneProject() {
-      return this.items && this.items.length === 1;
-    },
-    isDisabled() {
-      return (
-        this.isLoading || this.isValidatingProjectBilling || (this.items && this.items.length < 2)
-      );
-    },
-    toggleText() {
-      if (this.isValidatingProjectBilling) {
-        return s__('ClusterIntegration|Validating project billing status');
-      }
-
-      if (this.isLoading) {
-        return s__('ClusterIntegration|Fetching projects');
-      }
-
-      if (this.hasProject) {
-        return this.selectedProject.name;
-      }
-
-      if (!this.items) {
-        return s__('ClusterIntegration|No projects found');
-      }
-
-      return s__('ClusterIntegration|Select project');
-    },
-    helpText() {
-      let message;
-      if (this.hasErrors) {
-        return this.errorMessage;
-      }
-
-      if (!this.items) {
-        message =
-          'ClusterIntegration|We were unable to fetch any projects. Ensure that you have a project on %{docsLinkStart}Google Cloud Platform%{docsLinkEnd}.';
-      }
-
-      message =
-        this.items && this.items.length
-          ? 'ClusterIntegration|To use a new project, first create one on %{docsLinkStart}Google Cloud Platform%{docsLinkEnd}.'
-          : 'ClusterIntegration|To create a cluster, first create a project on %{docsLinkStart}Google Cloud Platform%{docsLinkEnd}.';
-
-      return sprintf(
-        s__(message),
-        {
-          docsLinkEnd: '&nbsp;<i class="fa fa-external-link" aria-hidden="true"></i></a>',
-          docsLinkStart: `<a href="${_.escape(
-            this.docsUrl,
-          )}" target="_blank" rel="noopener noreferrer">`,
-        },
-        false,
-      );
-    },
-    errorMessage() {
-      if (!this.projectHasBillingEnabled) {
-        if (this.gapiError) {
-          return s__(
-            'ClusterIntegration|We could not verify that one of your projects on GCP has billing enabled. Please try again.',
-          );
-        }
-
-        return sprintf(
-          s__(
-            'This project does not have billing enabled. To create a cluster, <a href=%{linkToBilling} target="_blank" rel="noopener noreferrer">enable billing <i class="fa fa-external-link" aria-hidden="true"></i></a> and try again.',
-          ),
-          {
-            linkToBilling:
-              'https://console.cloud.google.com/freetrial?utm_campaign=2018_cpanel&utm_source=gitlab&utm_medium=referral',
-          },
-          false,
-        );
-      }
-
-      return sprintf(
-        s__('ClusterIntegration|An error occurred while trying to fetch your projects: %{error}'),
-        { error: this.gapiError },
-      );
-    },
-  },
-  watch: {
-    selectedProject() {
-      this.setIsValidatingProjectBilling(true);
-
-      this.validateProjectBilling()
-        .then(this.validateProjectBillingSuccessHandler)
-        .catch(this.validateProjectBillingFailureHandler);
-    },
-  },
-  created() {
-    this.isLoading = true;
-
-    this.fetchProjects()
-      .then(this.fetchSuccessHandler)
-      .catch(this.fetchFailureHandler);
-  },
-  methods: {
-    ...mapActions(['fetchProjects', 'setIsValidatingProjectBilling', 'validateProjectBilling']),
-    ...mapActions({ setItem: 'setProject' }),
-    fetchSuccessHandler() {
-      if (this.defaultValue) {
-        const projectToSelect = _.find(this.items, item => item.projectId === this.defaultValue);
-
-        if (projectToSelect) {
-          this.setItem(projectToSelect);
-        }
-      } else if (this.items.length === 1) {
-        this.setItem(this.items[0]);
-      }
-
-      this.isLoading = false;
-      this.hasErrors = false;
-    },
-    validateProjectBillingSuccessHandler() {
-      this.hasErrors = !this.projectHasBillingEnabled;
-    },
-    validateProjectBillingFailureHandler(resp) {
-      this.hasErrors = true;
-
-      this.gapiError = resp.result ? resp.result.error.message : resp;
-    },
-  },
-};
-</script>
-
-<template>
-  <div>
-    <div class="js-gcp-project-id-dropdown dropdown">
-      <dropdown-hidden-input :name="fieldName" :value="selectedProject.projectId" />
-      <dropdown-button
-        :class="{
-          'border-danger': hasErrors,
-          'read-only': hasOneProject,
-        }"
-        :is-disabled="isDisabled"
-        :is-loading="isLoading"
-        :toggle-text="toggleText"
-      />
-      <div class="dropdown-menu dropdown-select">
-        <dropdown-search-input
-          v-model="searchQuery"
-          :placeholder-text="s__('ClusterIntegration|Search projects')"
-        />
-        <div class="dropdown-content">
-          <ul>
-            <li v-show="!results.length">
-              <span class="menu-item">
-                {{ s__('ClusterIntegration|No projects matched your search') }}
-              </span>
-            </li>
-            <li v-for="result in results" :key="result.project_number">
-              <button type="button" @click.prevent="setItem(result)">{{ result.name }}</button>
-            </li>
-          </ul>
-        </div>
-        <div class="dropdown-loading"><gl-loading-icon /></div>
-      </div>
-    </div>
-    <span
-      :class="{
-        'text-danger': hasErrors,
-        'text-muted': !hasErrors,
-      }"
-      class="form-text"
-      v-html="helpText"
-    ></span>
-  </div>
-</template>
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_zone_dropdown.vue b/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_zone_dropdown.vue
deleted file mode 100644
index fd5d5f86401..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/components/gke_zone_dropdown.vue
+++ /dev/null
@@ -1,103 +0,0 @@
-<script>
-import { sprintf, s__ } from '~/locale';
-import { mapState, mapActions } from 'vuex';
-
-import gkeDropdownMixin from './gke_dropdown_mixin';
-
-export default {
-  name: 'GkeZoneDropdown',
-  mixins: [gkeDropdownMixin],
-  computed: {
-    ...mapState([
-      'selectedProject',
-      'selectedZone',
-      'projects',
-      'isValidatingProjectBilling',
-      'projectHasBillingEnabled',
-    ]),
-    ...mapState({ items: 'zones' }),
-    isDisabled() {
-      return this.isLoading || this.isValidatingProjectBilling || !this.projectHasBillingEnabled;
-    },
-    toggleText() {
-      if (this.isLoading) {
-        return s__('ClusterIntegration|Fetching zones');
-      }
-
-      if (this.selectedZone) {
-        return this.selectedZone;
-      }
-
-      return !this.projectHasBillingEnabled
-        ? s__('ClusterIntegration|Select project to choose zone')
-        : s__('ClusterIntegration|Select zone');
-    },
-    errorMessage() {
-      return sprintf(
-        s__('ClusterIntegration|An error occurred while trying to fetch project zones: %{error}'),
-        { error: this.gapiError },
-      );
-    },
-  },
-  watch: {
-    isValidatingProjectBilling(isValidating) {
-      this.hasErrors = false;
-
-      if (!isValidating && this.projectHasBillingEnabled) {
-        this.isLoading = true;
-
-        this.fetchZones()
-          .then(this.fetchSuccessHandler)
-          .catch(this.fetchFailureHandler);
-      }
-    },
-  },
-  methods: {
-    ...mapActions(['fetchZones']),
-    ...mapActions({ setItem: 'setZone' }),
-  },
-};
-</script>
-
-<template>
-  <div>
-    <div class="js-gcp-zone-dropdown dropdown">
-      <dropdown-hidden-input :name="fieldName" :value="selectedZone" />
-      <dropdown-button
-        :class="{ 'border-danger': hasErrors }"
-        :is-disabled="isDisabled"
-        :is-loading="isLoading"
-        :toggle-text="toggleText"
-      />
-      <div class="dropdown-menu dropdown-select">
-        <dropdown-search-input
-          v-model="searchQuery"
-          :placeholder-text="s__('ClusterIntegration|Search zones')"
-        />
-        <div class="dropdown-content">
-          <ul>
-            <li v-show="!results.length">
-              <span class="menu-item">
-                {{ s__('ClusterIntegration|No zones matched your search') }}
-              </span>
-            </li>
-            <li v-for="result in results" :key="result.id">
-              <button type="button" @click.prevent="setItem(result.name)">{{ result.name }}</button>
-            </li>
-          </ul>
-        </div>
-        <div class="dropdown-loading"><gl-loading-icon /></div>
-      </div>
-    </div>
-    <span
-      v-if="hasErrors"
-      :class="{
-        'text-danger': hasErrors,
-        'text-muted': !hasErrors,
-      }"
-      class="form-text"
-    >
-      {{ errorMessage }}
-    </span>
-  </div>
-</template>
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/constants.js b/app/assets/javascripts/projects/gke_cluster_dropdowns/constants.js
deleted file mode 100644
index 2a1c0819916..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/constants.js
+++ /dev/null
@@ -1,11 +0,0 @@
-import { s__ } from '~/locale';
-
-export const GCP_API_ERROR = s__(
-  'ClusterIntegration|An error occurred when trying to contact the Google Cloud API. Please try again later.',
-);
-export const GCP_API_CLOUD_BILLING_ENDPOINT =
-  'https://www.googleapis.com/discovery/v1/apis/cloudbilling/v1/rest';
-export const GCP_API_CLOUD_RESOURCE_MANAGER_ENDPOINT =
-  'https://www.googleapis.com/discovery/v1/apis/cloudresourcemanager/v1/rest';
-export const GCP_API_COMPUTE_ENDPOINT =
-  'https://www.googleapis.com/discovery/v1/apis/compute/v1/rest';
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/index.js b/app/assets/javascripts/projects/gke_cluster_dropdowns/index.js
deleted file mode 100644
index 729b9404b64..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/index.js
+++ /dev/null
@@ -1,88 +0,0 @@
-/* global gapi */
-import Vue from 'vue';
-import Flash from '~/flash';
-import GkeProjectIdDropdown from './components/gke_project_id_dropdown.vue';
-import GkeZoneDropdown from './components/gke_zone_dropdown.vue';
-import GkeMachineTypeDropdown from './components/gke_machine_type_dropdown.vue';
-import * as CONSTANTS from './constants';
-
-const mountComponent = (entryPoint, component, componentName, extraProps = {}) => {
-  const el = document.querySelector(entryPoint);
-  if (!el) return false;
-
-  const hiddenInput = el.querySelector('input');
-
-  return new Vue({
-    el,
-    components: {
-      [componentName]: component,
-    },
-    render: createElement =>
-      createElement(componentName, {
-        props: {
-          fieldName: hiddenInput.getAttribute('name'),
-          fieldId: hiddenInput.getAttribute('id'),
-          defaultValue: hiddenInput.value,
-          ...extraProps,
-        },
-      }),
-  });
-};
-
-const mountGkeProjectIdDropdown = () => {
-  const entryPoint = '.js-gcp-project-id-dropdown-entry-point';
-  const el = document.querySelector(entryPoint);
-
-  mountComponent(entryPoint, GkeProjectIdDropdown, 'gke-project-id-dropdown', {
-    docsUrl: el.dataset.docsurl,
-  });
-};
-
-const mountGkeZoneDropdown = () => {
-  mountComponent('.js-gcp-zone-dropdown-entry-point', GkeZoneDropdown, 'gke-zone-dropdown');
-};
-
-const mountGkeMachineTypeDropdown = () => {
-  mountComponent(
-    '.js-gcp-machine-type-dropdown-entry-point',
-    GkeMachineTypeDropdown,
-    'gke-machine-type-dropdown',
-  );
-};
-
-const gkeDropdownErrorHandler = () => {
-  Flash(CONSTANTS.GCP_API_ERROR);
-};
-
-const initializeGapiClient = () => {
-  const el = document.querySelector('.js-gke-cluster-creation');
-  if (!el) return false;
-
-  return gapi.client
-    .init({
-      discoveryDocs: [
-        CONSTANTS.GCP_API_CLOUD_BILLING_ENDPOINT,
-        CONSTANTS.GCP_API_CLOUD_RESOURCE_MANAGER_ENDPOINT,
-        CONSTANTS.GCP_API_COMPUTE_ENDPOINT,
-      ],
-    })
-    .then(() => {
-      gapi.client.setToken({ access_token: el.dataset.token });
-
-      mountGkeProjectIdDropdown();
-      mountGkeZoneDropdown();
-      mountGkeMachineTypeDropdown();
-    })
-    .catch(gkeDropdownErrorHandler);
-};
-
-const initGkeDropdowns = () => {
-  if (!gapi) {
-    gkeDropdownErrorHandler();
-    return false;
-  }
-
-  return gapi.load('client', initializeGapiClient);
-};
-
-export default initGkeDropdowns;
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/actions.js b/app/assets/javascripts/projects/gke_cluster_dropdowns/store/actions.js
deleted file mode 100644
index f05ad7773a2..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/actions.js
+++ /dev/null
@@ -1,95 +0,0 @@
-/* global gapi */
-import * as types from './mutation_types';
-
-const gapiResourceListRequest = ({ resource, params, commit, mutation, payloadKey }) =>
-  new Promise((resolve, reject) => {
-    const request = resource.list(params);
-
-    return request.then(
-      resp => {
-        const { result } = resp;
-
-        commit(mutation, result[payloadKey]);
-
-        resolve();
-      },
-      resp => {
-        reject(resp);
-      },
-    );
-  });
-
-export const setProject = ({ commit }, selectedProject) => {
-  commit(types.SET_PROJECT, selectedProject);
-};
-
-export const setZone = ({ commit }, selectedZone) => {
-  commit(types.SET_ZONE, selectedZone);
-};
-
-export const setMachineType = ({ commit }, selectedMachineType) => {
-  commit(types.SET_MACHINE_TYPE, selectedMachineType);
-};
-
-export const setIsValidatingProjectBilling = ({ commit }, isValidatingProjectBilling) => {
-  commit(types.SET_IS_VALIDATING_PROJECT_BILLING, isValidatingProjectBilling);
-};
-
-export const fetchProjects = ({ commit }) =>
-  gapiResourceListRequest({
-    resource: gapi.client.cloudresourcemanager.projects,
-    params: {},
-    commit,
-    mutation: types.SET_PROJECTS,
-    payloadKey: 'projects',
-  });
-
-export const validateProjectBilling = ({ dispatch, commit, state }) =>
-  new Promise((resolve, reject) => {
-    const request = gapi.client.cloudbilling.projects.getBillingInfo({
-      name: `projects/${state.selectedProject.projectId}`,
-    });
-
-    commit(types.SET_ZONE, '');
-    commit(types.SET_MACHINE_TYPE, '');
-
-    return request.then(
-      resp => {
-        const { billingEnabled } = resp.result;
-
-        commit(types.SET_PROJECT_BILLING_STATUS, Boolean(billingEnabled));
-        dispatch('setIsValidatingProjectBilling', false);
-        resolve();
-      },
-      resp => {
-        dispatch('setIsValidatingProjectBilling', false);
-        reject(resp);
-      },
-    );
-  });
-
-export const fetchZones = ({ commit, state }) =>
-  gapiResourceListRequest({
-    resource: gapi.client.compute.zones,
-    params: {
-      project: state.selectedProject.projectId,
-    },
-    commit,
-    mutation: types.SET_ZONES,
-    payloadKey: 'items',
-  });
-
-export const fetchMachineTypes = ({ commit, state }) =>
-  gapiResourceListRequest({
-    resource: gapi.client.compute.machineTypes,
-    params: {
-      project: state.selectedProject.projectId,
-      zone: state.selectedZone,
-    },
-    commit,
-    mutation: types.SET_MACHINE_TYPES,
-    payloadKey: 'items',
-  });
-
-// prevent babel-plugin-rewire from generating an invalid default during karma tests
-export default () => {};
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/getters.js b/app/assets/javascripts/projects/gke_cluster_dropdowns/store/getters.js
deleted file mode 100644
index f9e2e2f74fb..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/getters.js
+++ /dev/null
@@ -1,3 +0,0 @@
-export const hasProject = state => Boolean(state.selectedProject.projectId);
-export const hasZone = state => Boolean(state.selectedZone);
-export const hasMachineType = state => Boolean(state.selectedMachineType);
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/index.js b/app/assets/javascripts/projects/gke_cluster_dropdowns/store/index.js
deleted file mode 100644
index 5f72060633e..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/index.js
+++ /dev/null
@@ -1,18 +0,0 @@
-import Vue from 'vue';
-import Vuex from 'vuex';
-import * as actions from './actions';
-import * as getters from './getters';
-import mutations from './mutations';
-import createState from './state';
-
-Vue.use(Vuex);
-
-export const createStore = () =>
-  new Vuex.Store({
-    actions,
-    getters,
-    mutations,
-    state: createState(),
-  });
-
-export default createStore();
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/mutation_types.js b/app/assets/javascripts/projects/gke_cluster_dropdowns/store/mutation_types.js
deleted file mode 100644
index 45a91efc2d9..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/mutation_types.js
+++ /dev/null
@@ -1,8 +0,0 @@
-export const SET_PROJECT = 'SET_PROJECT';
-export const SET_PROJECT_BILLING_STATUS = 'SET_PROJECT_BILLING_STATUS';
-export const SET_IS_VALIDATING_PROJECT_BILLING = 'SET_IS_VALIDATING_PROJECT_BILLING';
-export const SET_ZONE = 'SET_ZONE';
-export const SET_MACHINE_TYPE = 'SET_MACHINE_TYPE';
-export const SET_PROJECTS = 'SET_PROJECTS';
-export const SET_ZONES = 'SET_ZONES';
-export const SET_MACHINE_TYPES = 'SET_MACHINE_TYPES';
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/mutations.js b/app/assets/javascripts/projects/gke_cluster_dropdowns/store/mutations.js
deleted file mode 100644
index 88a2c1b630d..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/mutations.js
+++ /dev/null
@@ -1,28 +0,0 @@
-import * as types from './mutation_types';
-
-export default {
-  [types.SET_PROJECT](state, selectedProject) {
-    Object.assign(state, { selectedProject });
-  },
-  [types.SET_IS_VALIDATING_PROJECT_BILLING](state, isValidatingProjectBilling) {
-    Object.assign(state, { isValidatingProjectBilling });
-  },
-  [types.SET_PROJECT_BILLING_STATUS](state, projectHasBillingEnabled) {
-    Object.assign(state, { projectHasBillingEnabled });
-  },
-  [types.SET_ZONE](state, selectedZone) {
-    Object.assign(state, { selectedZone });
-  },
-  [types.SET_MACHINE_TYPE](state, selectedMachineType) {
-    Object.assign(state, { selectedMachineType });
-  },
-  [types.SET_PROJECTS](state, projects) {
-    Object.assign(state, { projects });
-  },
-  [types.SET_ZONES](state, zones) {
-    Object.assign(state, { zones });
-  },
-  [types.SET_MACHINE_TYPES](state, machineTypes) {
-    Object.assign(state, { machineTypes });
-  },
-};
diff --git a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/state.js b/app/assets/javascripts/projects/gke_cluster_dropdowns/store/state.js
deleted file mode 100644
index 9f3c473d4bc..00000000000
--- a/app/assets/javascripts/projects/gke_cluster_dropdowns/store/state.js
+++ /dev/null
@@ -1,13 +0,0 @@
-export default () => ({
-  selectedProject: {
-    projectId: '',
-    name: '',
-  },
-  selectedZone: '',
-  selectedMachineType: '',
-  isValidatingProjectBilling: null,
-  projectHasBillingEnabled: null,
-  projects: [],
-  zones: [],
-  machineTypes: [],
-});
diff --git a/spec/javascripts/create_cluster/gke_cluster/components/gke_machine_type_dropdown_spec.js b/spec/javascripts/create_cluster/gke_cluster/components/gke_machine_type_dropdown_spec.js
new file mode 100644
index 00000000000..7aa7aa9a112
--- /dev/null
+++ b/spec/javascripts/create_cluster/gke_cluster/components/gke_machine_type_dropdown_spec.js
@@ -0,0 +1,109 @@
+import Vue from 'vue';
+import GkeMachineTypeDropdown from '~/create_cluster/gke_cluster/components/gke_machine_type_dropdown.vue';
+import { createStore } from '~/create_cluster/gke_cluster/store';
+import {
+  SET_PROJECT,
+  SET_PROJECT_BILLING_STATUS,
+  SET_ZONE,
+  SET_MACHINE_TYPES,
+} from '~/create_cluster/gke_cluster/store/mutation_types';
+import { mountComponentWithStore } from 'spec/helpers/vue_mount_component_helper';
+import {
+  selectedZoneMock,
+  selectedProjectMock,
+  selectedMachineTypeMock,
+  gapiMachineTypesResponseMock,
+} from '../mock_data';
+
+const componentConfig = {
+  fieldId: 'cluster_provider_gcp_attributes_gcp_machine_type',
+  fieldName: 'cluster[provider_gcp_attributes][gcp_machine_type]',
+};
+
+const LABELS = {
+  LOADING: 'Fetching machine types',
+  DISABLED_NO_PROJECT: 'Select project and zone to choose machine type',
+  DISABLED_NO_ZONE: 'Select zone to choose machine type',
+  DEFAULT: 'Select machine type',
+};
+
+const createComponent = (store, props = componentConfig) => {
+  const Component = Vue.extend(GkeMachineTypeDropdown);
+
+  return mountComponentWithStore(Component, {
+    el: null,
+    props,
+    store,
+  });
+};
+
+describe('GkeMachineTypeDropdown', () => {
+  let vm;
+  let store;
+
+  beforeEach(() => {
+    store = createStore();
+    vm = createComponent(store);
+  });
+
+  afterEach(() => {
+    vm.$destroy();
+  });
+
+  describe('shows various toggle text depending on state', () => {
+    it('returns disabled state toggle text when no project and zone are selected', () => {
+      expect(vm.toggleText).toBe(LABELS.DISABLED_NO_PROJECT);
+    });
+
+    it('returns disabled state toggle text when no zone is selected', () => {
+      vm.$store.commit(SET_PROJECT, selectedProjectMock);
+      vm.$store.commit(SET_PROJECT_BILLING_STATUS, true);
+
+      expect(vm.toggleText).toBe(LABELS.DISABLED_NO_ZONE);
+    });
+
+    it('returns loading toggle text', () => {
+      vm.isLoading = true;
+
+      expect(vm.toggleText).toBe(LABELS.LOADING);
+    });
+
+    it('returns default toggle text', () => {
+      expect(vm.toggleText).toBe(LABELS.DISABLED_NO_PROJECT);
+
+      vm.$store.commit(SET_PROJECT, selectedProjectMock);
+      vm.$store.commit(SET_PROJECT_BILLING_STATUS, true);
+      vm.$store.commit(SET_ZONE, selectedZoneMock);
+
+      expect(vm.toggleText).toBe(LABELS.DEFAULT);
+    });
+
+    it('returns machine type name if machine type selected', () => {
+      vm.setItem(selectedMachineTypeMock);
+
+      expect(vm.toggleText).toBe(selectedMachineTypeMock);
+    });
+  });
+
+  describe('form input', () => {
+    it('reflects new value when dropdown item is clicked', done => {
+      expect(vm.$el.querySelector('input').value).toBe('');
+      vm.$store.commit(SET_MACHINE_TYPES, gapiMachineTypesResponseMock.items);
+
+      return vm
+        .$nextTick()
+        .then(() => {
+          vm.$el.querySelector('.dropdown-content button').click();
+
+          return vm
+            .$nextTick()
+            .then(() => {
+              expect(vm.$el.querySelector('input').value).toBe(selectedMachineTypeMock);
+              done();
+            })
+            .catch(done.fail);
+        })
+        .catch(done.fail);
+    });
+  });
+});
diff --git a/spec/javascripts/create_cluster/gke_cluster/components/gke_project_id_dropdown_spec.js b/spec/javascripts/create_cluster/gke_cluster/components/gke_project_id_dropdown_spec.js
new file mode 100644
index 00000000000..809da3f9088
--- /dev/null
+++ b/spec/javascripts/create_cluster/gke_cluster/components/gke_project_id_dropdown_spec.js
@@ -0,0 +1,104 @@
+import Vue from 'vue';
+import GkeProjectIdDropdown from '~/create_cluster/gke_cluster/components/gke_project_id_dropdown.vue';
+import { createStore } from '~/create_cluster/gke_cluster/store';
+import { SET_PROJECTS } from '~/create_cluster/gke_cluster/store/mutation_types';
+import { mountComponentWithStore } from 'spec/helpers/vue_mount_component_helper';
+import { emptyProjectMock, selectedProjectMock } from '../mock_data';
+
+const componentConfig = {
+  docsUrl: 'https://console.cloud.google.com/home/dashboard',
+  fieldId: 'cluster_provider_gcp_attributes_gcp_project_id',
+  fieldName: 'cluster[provider_gcp_attributes][gcp_project_id]',
+};
+
+const LABELS = {
+  LOADING: 'Fetching projects',
+  VALIDATING_PROJECT_BILLING: 'Validating project billing status',
+  DEFAULT: 'Select project',
+  EMPTY: 'No projects found',
+};
+
+const createComponent = (store, props = componentConfig) => {
+  const Component = Vue.extend(GkeProjectIdDropdown);
+
+  return mountComponentWithStore(Component, {
+    el: null,
+    props,
+    store,
+  });
+};
+
+describe('GkeProjectIdDropdown', () => {
+  let vm;
+  let store;
+
+  beforeEach(() => {
+    store = createStore();
+    vm = createComponent(store);
+  });
+
+  afterEach(() => {
+    vm.$destroy();
+  });
+
+  describe('toggleText', () => {
+    it('returns loading toggle text', () => {
+      expect(vm.toggleText).toBe(LABELS.LOADING);
+    });
+
+    it('returns project billing validation text', () => {
+      vm.setIsValidatingProjectBilling(true);
+
+      expect(vm.toggleText).toBe(LABELS.VALIDATING_PROJECT_BILLING);
+    });
+
+    it('returns default toggle text', done =>
+      setTimeout(() => {
+        vm.setItem(emptyProjectMock);
+
+        expect(vm.toggleText).toBe(LABELS.DEFAULT);
+
+        done();
+      }));
+
+    it('returns project name if project selected', done =>
+      setTimeout(() => {
+        vm.isLoading = false;
+
+        expect(vm.toggleText).toBe(selectedProjectMock.name);
+
+        done();
+      }));
+
+    it('returns empty toggle text', done =>
+      setTimeout(() => {
+        vm.$store.commit(SET_PROJECTS, null);
+        vm.setItem(emptyProjectMock);
+
+        expect(vm.toggleText).toBe(LABELS.EMPTY);
+
+        done();
+      }));
+  });
+
+  describe('selectItem', () => {
+    it('reflects new value when dropdown item is clicked', done => {
+      expect(vm.$el.querySelector('input').value).toBe('');
+
+      return vm
+        .$nextTick()
+        .then(() => {
+          vm.$el.querySelector('.dropdown-content button').click();
+
+          return vm
+            .$nextTick()
+            .then(() => {
+              expect(vm.$el.querySelector('input').value).toBe(selectedProjectMock.projectId);
+              done();
+            })
+            .catch(done.fail);
+        })
+        .catch(done.fail);
+    });
+  });
+});
diff --git a/spec/javascripts/create_cluster/gke_cluster/components/gke_zone_dropdown_spec.js b/spec/javascripts/create_cluster/gke_cluster/components/gke_zone_dropdown_spec.js
new file mode 100644
index 00000000000..9cb9419e433
--- /dev/null
+++ b/spec/javascripts/create_cluster/gke_cluster/components/gke_zone_dropdown_spec.js
@@ -0,0 +1,94 @@
+import Vue from 'vue';
+import GkeZoneDropdown from '~/create_cluster/gke_cluster/components/gke_zone_dropdown.vue';
+import { createStore } from '~/create_cluster/gke_cluster/store';
+import {
+  SET_PROJECT,
+  SET_ZONES,
+  SET_PROJECT_BILLING_STATUS,
+} from '~/create_cluster/gke_cluster/store/mutation_types';
+import { mountComponentWithStore } from 'spec/helpers/vue_mount_component_helper';
+import { selectedZoneMock, selectedProjectMock, gapiZonesResponseMock } from '../mock_data';
+
+const componentConfig = {
+  fieldId: 'cluster_provider_gcp_attributes_gcp_zone',
+  fieldName: 'cluster[provider_gcp_attributes][gcp_zone]',
+};
+
+const LABELS = {
+  LOADING: 'Fetching zones',
+  DISABLED: 'Select project to choose zone',
+  DEFAULT: 'Select zone',
+};
+
+const createComponent = (store, props = componentConfig) => {
+  const Component = Vue.extend(GkeZoneDropdown);
+
+  return mountComponentWithStore(Component, {
+    el: null,
+    props,
+    store,
+  });
+};
+
+describe('GkeZoneDropdown', () => {
+  let vm;
+  let store;
+
+  beforeEach(() => {
+    store = createStore();
+    vm = createComponent(store);
+  });
+
+  afterEach(() => {
+    vm.$destroy();
+  });
+
+  describe('toggleText', () => {
+    it('returns disabled state toggle text', () => {
+      expect(vm.toggleText).toBe(LABELS.DISABLED);
+    });
+
+    it('returns loading toggle text', () => {
+      vm.isLoading = true;
+
+      expect(vm.toggleText).toBe(LABELS.LOADING);
+    });
+
+    it('returns default toggle text', () => {
+      expect(vm.toggleText).toBe(LABELS.DISABLED);
+
+      vm.$store.commit(SET_PROJECT, selectedProjectMock);
+      vm.$store.commit(SET_PROJECT_BILLING_STATUS, true);
+
+      expect(vm.toggleText).toBe(LABELS.DEFAULT);
+    });
+
+    it('returns project name if project selected', () => {
+      vm.setItem(selectedZoneMock);
+
+      expect(vm.toggleText).toBe(selectedZoneMock);
+    });
+  });
+
+  describe('selectItem', () => {
+    it('reflects new value when dropdown item is clicked', done => {
+      expect(vm.$el.querySelector('input').value).toBe('');
+      vm.$store.commit(SET_ZONES, gapiZonesResponseMock.items);
+
+      return vm
+        .$nextTick()
+        .then(() => {
+          vm.$el.querySelector('.dropdown-content button').click();
+
+          return vm
+            .$nextTick()
+            .then(() => {
+              expect(vm.$el.querySelector('input').value).toBe(selectedZoneMock);
+              done();
+            })
+            .catch(done.fail);
+        })
+        .catch(done.fail);
+    });
+  });
+});
diff --git a/spec/javascripts/create_cluster/gke_cluster/helpers.js b/spec/javascripts/create_cluster/gke_cluster/helpers.js
new file mode 100644
index 00000000000..6df511e9157
--- /dev/null
+++ b/spec/javascripts/create_cluster/gke_cluster/helpers.js
@@ -0,0 +1,49 @@
+import {
+  gapiProjectsResponseMock,
+  gapiZonesResponseMock,
+  gapiMachineTypesResponseMock,
+} from './mock_data';
+
+// eslint-disable-next-line import/prefer-default-export
+export const gapi = () => ({
+  client: {
+    cloudbilling: {
+      projects: {
+        getBillingInfo: () =>
+          new Promise(resolve => {
+            resolve({
+              result: { billingEnabled: true },
+            });
+          }),
+      },
+    },
+    cloudresourcemanager: {
+      projects: {
+        list: () =>
+          new Promise(resolve => {
+            resolve({
+              result: { ...gapiProjectsResponseMock },
+            });
+          }),
+      },
+    },
+    compute: {
+      zones: {
+        list: () =>
+          new Promise(resolve => {
+            resolve({
+              result: { ...gapiZonesResponseMock },
+            });
+          }),
+      },
+      machineTypes: {
+        list: () =>
+          new Promise(resolve => {
+            resolve({
+              result: { ...gapiMachineTypesResponseMock },
+            });
+          }),
+      },
+    },
+  },
+});
diff --git a/spec/javascripts/create_cluster/gke_cluster/mock_data.js b/spec/javascripts/create_cluster/gke_cluster/mock_data.js
new file mode 100644
index 00000000000..d9f5dbc636f
--- /dev/null
+++ b/spec/javascripts/create_cluster/gke_cluster/mock_data.js
@@ -0,0 +1,75 @@
+export const emptyProjectMock = {
+  projectId: '',
+  name: '',
+};
+
+export const selectedProjectMock = {
+  projectId: 'gcp-project-123',
+  name: 'gcp-project',
+};
+
+export const selectedZoneMock = 'us-central1-a';
+
+export const selectedMachineTypeMock = 'n1-standard-2';
+
+export const gapiProjectsResponseMock = {
+  projects: [
+    {
+      projectNumber: '1234',
+      projectId: 'gcp-project-123',
+      lifecycleState: 'ACTIVE',
+      name: 'gcp-project',
+      createTime: '2017-12-16T01:48:29.129Z',
+      parent: {
+        type: 'organization',
+        id: '12345',
+      },
+    },
+  ],
+};
+
+export const gapiZonesResponseMock = {
+  kind: 'compute#zoneList',
+  id: 'projects/gitlab-internal-153318/zones',
+  items: [
+    {
+      kind: 'compute#zone',
+      id: '2000',
+      creationTimestamp: '1969-12-31T16:00:00.000-08:00',
+      name: 'us-central1-a',
+      description: 'us-central1-a',
+      status: 'UP',
+      region:
+        'https://www.googleapis.com/compute/v1/projects/gitlab-internal-153318/regions/us-central1',
+      selfLink:
+        'https://www.googleapis.com/compute/v1/projects/gitlab-internal-153318/zones/us-central1-a',
+      availableCpuPlatforms: ['Intel Skylake', 'Intel Broadwell', 'Intel Sandy Bridge'],
+    },
+  ],
+  selfLink: 'https://www.googleapis.com/compute/v1/projects/gitlab-internal-153318/zones',
+};
+
+export const gapiMachineTypesResponseMock = {
+  kind: 'compute#machineTypeList',
+  id: 'projects/gitlab-internal-153318/zones/us-central1-a/machineTypes',
+  items: [
+    {
+      kind: 'compute#machineType',
+      id: '3002',
+      creationTimestamp: '1969-12-31T16:00:00.000-08:00',
+      name: 'n1-standard-2',
+      description: '2 vCPUs, 7.5 GB RAM',
+      guestCpus: 2,
+      memoryMb: 7680,
+      imageSpaceGb: 10,
+      maximumPersistentDisks: 64,
+      maximumPersistentDisksSizeGb: '65536',
+      zone: 'us-central1-a',
+      selfLink:
+        'https://www.googleapis.com/compute/v1/projects/gitlab-internal-153318/zones/us-central1-a/machineTypes/n1-standard-2',
+      isSharedCpu: false,
+    },
+  ],
+  selfLink:
+    'https://www.googleapis.com/compute/v1/projects/gitlab-internal-153318/zones/us-central1-a/machineTypes',
+};
diff --git a/spec/javascripts/create_cluster/gke_cluster/stores/actions_spec.js b/spec/javascripts/create_cluster/gke_cluster/stores/actions_spec.js
new file mode 100644
index 00000000000..a7591cc38c7
--- /dev/null
+++ b/spec/javascripts/create_cluster/gke_cluster/stores/actions_spec.js
@@ -0,0 +1,131 @@
+import testAction from 'spec/helpers/vuex_action_helper';
+import * as actions from '~/create_cluster/gke_cluster/store/actions';
+import { createStore } from '~/create_cluster/gke_cluster/store';
+import { gapi } from '../helpers';
+import { selectedProjectMock, selectedZoneMock, selectedMachineTypeMock } from '../mock_data';
+
+describe('GCP Cluster Dropdown Store Actions', () => {
+  let store;
+
+  beforeEach(() => {
+    store = createStore();
+  });
+
+  describe('setProject', () => {
+    it('should set project', done => {
+      testAction(
+        actions.setProject,
+        selectedProjectMock,
+        { selectedProject: {} },
+        [{ type: 'SET_PROJECT', payload: selectedProjectMock }],
+        [],
+        done,
+      );
+    });
+  });
+
+  describe('setZone', () => {
+    it('should set zone', done => {
+      testAction(
+        actions.setZone,
+        selectedZoneMock,
+        { selectedZone: '' },
+        [{ type: 'SET_ZONE', payload: selectedZoneMock }],
+        [],
+        done,
+      );
+    });
+  });
+
+  describe('setMachineType', () => {
+    it('should set machine type', done => {
+      testAction(
+        actions.setMachineType,
+        selectedMachineTypeMock,
+        { selectedMachineType: '' },
+        [{ type: 'SET_MACHINE_TYPE', payload: selectedMachineTypeMock }],
+        [],
+        done,
+      );
+    });
+  });
+
+  describe('setIsValidatingProjectBilling', () => {
+    it('should set machine type', done => {
+      testAction(
+        actions.setIsValidatingProjectBilling,
+        true,
+        { isValidatingProjectBilling: null },
+        [{ type: 'SET_IS_VALIDATING_PROJECT_BILLING', payload: true }],
+        [],
+        done,
+      );
+    });
+  });
+
+  describe('async fetch methods', () => {
+    window.gapi = gapi();
+
+    describe('fetchProjects', () => {
+      it('fetches projects from Google API', done => {
+        store
+          .dispatch('fetchProjects')
+          .then(() => {
+            expect(store.state.projects[0].projectId).toEqual(selectedProjectMock.projectId);
+            expect(store.state.projects[0].name).toEqual(selectedProjectMock.name);
+
+            done();
+          })
+          .catch(done.fail);
+      });
+    });
+
+    describe('validateProjectBilling', () => {
+      it('checks project billing status from Google API', done => {
+        testAction(
+          actions.validateProjectBilling,
+          true,
+          {
+            selectedProject: selectedProjectMock,
+            selectedZone: '',
+            selectedMachineType: '',
+            projectHasBillingEnabled: null,
+          },
+          [
+            { type: 'SET_ZONE', payload: '' },
+            { type: 'SET_MACHINE_TYPE', payload: '' },
+            { type: 'SET_PROJECT_BILLING_STATUS', payload: true },
+          ],
+          [{ type: 'setIsValidatingProjectBilling', payload: false }],
+          done,
+        );
+      });
+    });
+
+    describe('fetchZones', () => {
+      it('fetches zones from Google API', done => {
+        store
+          .dispatch('fetchZones')
+          .then(() => {
+            expect(store.state.zones[0].name).toEqual(selectedZoneMock);
+
+            done();
+          })
+          .catch(done.fail);
+      });
+    });
+
+    describe('fetchMachineTypes', () => {
+      it('fetches machine types from Google API', done => {
+        store
+          .dispatch('fetchMachineTypes')
+          .then(() => {
+            expect(store.state.machineTypes[0].name).toEqual(selectedMachineTypeMock);
+
+            done();
+          })
+          .catch(done.fail);
+      });
+    });
+  });
+});
diff --git a/spec/javascripts/create_cluster/gke_cluster/stores/getters_spec.js b/spec/javascripts/create_cluster/gke_cluster/stores/getters_spec.js
new file mode 100644
index 00000000000..ac92716b0ab
--- /dev/null
+++ b/spec/javascripts/create_cluster/gke_cluster/stores/getters_spec.js
@@ -0,0 +1,65 @@
+import * as getters from '~/create_cluster/gke_cluster/store/getters';
+import { selectedProjectMock, selectedZoneMock, selectedMachineTypeMock } from '../mock_data';
+
+describe('GCP Cluster Dropdown Store Getters', () => {
+  let state;
+
+  describe('valid states', () => {
+    beforeEach(() => {
+      state = {
+        selectedProject: selectedProjectMock,
+        selectedZone: selectedZoneMock,
+        selectedMachineType: selectedMachineTypeMock,
+      };
+    });
+
+    describe('hasProject', () => {
+      it('should return true when project is selected', () => {
+        expect(getters.hasProject(state)).toEqual(true);
+      });
+    });
+
+    describe('hasZone', () => {
+      it('should return true when zone is selected', () => {
+        expect(getters.hasZone(state)).toEqual(true);
+      });
+    });
+
+    describe('hasMachineType', () => {
+      it('should return true when machine type is selected', () => {
+        expect(getters.hasMachineType(state)).toEqual(true);
+      });
+    });
+  });
+
+  describe('invalid states', () => {
+    beforeEach(() => {
+      state = {
+        selectedProject: {
+          projectId: '',
+          name: '',
+        },
+        selectedZone: '',
+        selectedMachineType: '',
+      };
+    });
+
+    describe('hasProject', () => {
+      it('should return false when project is not selected', () => {
+        expect(getters.hasProject(state)).toEqual(false);
+      });
+    });
+
+    describe('hasZone', () => {
+      it('should return false when zone is not selected', () => {
+        expect(getters.hasZone(state)).toEqual(false);
+      });
+    });
+
+    describe('hasMachineType', () => {
+      it('should return false when machine type is not selected', () => {
+        expect(getters.hasMachineType(state)).toEqual(false);
+      });
+    });
+  });
+});
diff --git a/spec/javascripts/create_cluster/gke_cluster/stores/mutations_spec.js b/spec/javascripts/create_cluster/gke_cluster/stores/mutations_spec.js
new file mode 100644
index 00000000000..7ee6ff436e2
--- /dev/null
+++ b/spec/javascripts/create_cluster/gke_cluster/stores/mutations_spec.js
@@ -0,0 +1,87 @@
+import { createStore } from '~/create_cluster/gke_cluster/store';
+import * as types from '~/create_cluster/gke_cluster/store/mutation_types';
+import {
+  selectedProjectMock,
+  selectedZoneMock,
+  selectedMachineTypeMock,
+  gapiProjectsResponseMock,
+  gapiZonesResponseMock,
+  gapiMachineTypesResponseMock,
+} from '../mock_data';
+
+describe('GCP Cluster Dropdown Store Mutations', () => {
+  let store;
+
+  beforeEach(() => {
+    store = createStore();
+  });
+
+  describe('SET_PROJECT', () => {
+    it('should set GCP project as selectedProject', () => {
+      const projectToSelect = gapiProjectsResponseMock.projects[0];
+
+      store.commit(types.SET_PROJECT, projectToSelect);
+
+      expect(store.state.selectedProject.projectId).toEqual(selectedProjectMock.projectId);
+      expect(store.state.selectedProject.name).toEqual(selectedProjectMock.name);
+    });
+  });
+
+  describe('SET_PROJECT_BILLING_STATUS', () => {
+    it('should set project billing status', () => {
+      store.commit(types.SET_PROJECT_BILLING_STATUS, true);
+
+      expect(store.state.projectHasBillingEnabled).toBeTruthy();
+    });
+  });
+
+  describe('SET_ZONE', () => {
+    it('should set GCP zone as selectedZone', () => {
+      const zoneToSelect = gapiZonesResponseMock.items[0].name;
+
+      store.commit(types.SET_ZONE, zoneToSelect);
+
+      expect(store.state.selectedZone).toEqual(selectedZoneMock);
+    });
+  });
+
+  describe('SET_MACHINE_TYPE', () => {
+    it('should set GCP machine type as selectedMachineType', () => {
+      const machineTypeToSelect = gapiMachineTypesResponseMock.items[0].name;
+
+      store.commit(types.SET_MACHINE_TYPE, machineTypeToSelect);
+
+      expect(store.state.selectedMachineType).toEqual(selectedMachineTypeMock);
+    });
+  });
+
+  describe('SET_PROJECTS', () => {
+    it('should set Google API Projects response as projects', () => {
+      expect(store.state.projects.length).toEqual(0);
+
+      store.commit(types.SET_PROJECTS, gapiProjectsResponseMock.projects);
+
+      expect(store.state.projects.length).toEqual(gapiProjectsResponseMock.projects.length);
+    });
+  });
+
+  describe('SET_ZONES', () => {
+    it('should set Google API Zones response as zones', () => {
+      expect(store.state.zones.length).toEqual(0);
+
+      store.commit(types.SET_ZONES, gapiZonesResponseMock.items);
+
+      expect(store.state.zones.length).toEqual(gapiZonesResponseMock.items.length);
+    });
+  });
+
+  describe('SET_MACHINE_TYPES', () => {
+    it('should set Google API Machine Types response as machineTypes', () => {
+      expect(store.state.machineTypes.length).toEqual(0);
+
+      store.commit(types.SET_MACHINE_TYPES, gapiMachineTypesResponseMock.items);
+
+      expect(store.state.machineTypes.length).toEqual(gapiMachineTypesResponseMock.items.length);
+    });
+  });
+});
diff --git a/spec/javascripts/projects/gke_cluster_dropdowns/components/gke_machine_type_dropdown_spec.js b/spec/javascripts/projects/gke_cluster_dropdowns/components/gke_machine_type_dropdown_spec.js
deleted file mode 100644
index fdecb823cd2..00000000000
--- a/spec/javascripts/projects/gke_cluster_dropdowns/components/gke_machine_type_dropdown_spec.js
+++ /dev/null
@@ -1,109 +0,0 @@
-import Vue from 'vue';
-import GkeMachineTypeDropdown from '~/projects/gke_cluster_dropdowns/components/gke_machine_type_dropdown.vue';
-import { createStore } from '~/projects/gke_cluster_dropdowns/store';
-import {
-  SET_PROJECT,
-  SET_PROJECT_BILLING_STATUS,
-  SET_ZONE,
-  SET_MACHINE_TYPES,
-} from '~/projects/gke_cluster_dropdowns/store/mutation_types';
-import { mountComponentWithStore } from 'spec/helpers/vue_mount_component_helper';
-import {
-  selectedZoneMock,
-  selectedProjectMock,
-  selectedMachineTypeMock,
-  gapiMachineTypesResponseMock,
-} from '../mock_data';
-
-const componentConfig = {
-  fieldId: 'cluster_provider_gcp_attributes_gcp_machine_type',
-  fieldName: 'cluster[provider_gcp_attributes][gcp_machine_type]',
-};
-
-const LABELS = {
-  LOADING: 'Fetching machine types',
-  DISABLED_NO_PROJECT: 'Select project and zone to choose machine type',
-  DISABLED_NO_ZONE: 'Select zone to choose machine type',
-  DEFAULT: 'Select machine type',
-};
-
-const createComponent = (store, props = componentConfig) => {
-  const Component = Vue.extend(GkeMachineTypeDropdown);
-
-  return mountComponentWithStore(Component, {
-    el: null,
-    props,
-    store,
-  });
-};
-
-describe('GkeMachineTypeDropdown', () => {
-  let vm;
-  let store;
-
-  beforeEach(() => {
-    store = createStore();
-    vm = createComponent(store);
-  });
-
-  afterEach(() => {
-    vm.$destroy();
-  });
-
-  describe('shows various toggle text depending on state', () => {
-    it('returns disabled state toggle text when no project and zone are selected', () => {
-      expect(vm.toggleText).toBe(LABELS.DISABLED_NO_PROJECT);
-    });
-
-    it('returns disabled state toggle text when no zone is selected', () => {
-      vm.$store.commit(SET_PROJECT, selectedProjectMock);
-      vm.$store.commit(SET_PROJECT_BILLING_STATUS, true);
-
-      expect(vm.toggleText).toBe(LABELS.DISABLED_NO_ZONE);
-    });
-
-    it('returns loading toggle text', () => {
-      vm.isLoading = true;
-
-      expect(vm.toggleText).toBe(LABELS.LOADING);
-    });
-
-    it('returns default toggle text', () => {
-      expect(vm.toggleText).toBe(LABELS.DISABLED_NO_PROJECT);
-
-      vm.$store.commit(SET_PROJECT, selectedProjectMock);
-      vm.$store.commit(SET_PROJECT_BILLING_STATUS, true);
-      vm.$store.commit(SET_ZONE, selectedZoneMock);
-
-      expect(vm.toggleText).toBe(LABELS.DEFAULT);
-    });
-
-    it('returns machine type name if machine type selected', () => {
-      vm.setItem(selectedMachineTypeMock);
-
-      expect(vm.toggleText).toBe(selectedMachineTypeMock);
-    });
-  });
-
-  describe('form input', () => {
-    it('reflects new value when dropdown item is clicked', done => {
-      expect(vm.$el.querySelector('input').value).toBe('');
-      vm.$store.commit(SET_MACHINE_TYPES, gapiMachineTypesResponseMock.items);
-
-      return vm
-        .$nextTick()
-        .then(() => {
-          vm.$el.querySelector('.dropdown-content button').click();
-
-          return vm
-            .$nextTick()
-            .then(() => {
-              expect(vm.$el.querySelector('input').value).toBe(selectedMachineTypeMock);
-              done();
-            })
-            .catch(done.fail);
-        })
-        .catch(done.fail);
-    });
-  });
-});
diff --git a/spec/javascripts/projects/gke_cluster_dropdowns/components/gke_project_id_dropdown_spec.js b/spec/javascripts/projects/gke_cluster_dropdowns/components/gke_project_id_dropdown_spec.js
deleted file mode 100644
index 1eb7cb4bd5b..00000000000
--- a/spec/javascripts/projects/gke_cluster_dropdowns/components/gke_project_id_dropdown_spec.js
+++ /dev/null
@@ -1,104 +0,0 @@
-import Vue from 'vue';
-import GkeProjectIdDropdown from '~/projects/gke_cluster_dropdowns/components/gke_project_id_dropdown.vue';
-import { createStore } from '~/projects/gke_cluster_dropdowns/store';
-import { SET_PROJECTS } from '~/projects/gke_cluster_dropdowns/store/mutation_types';
-import { mountComponentWithStore } from 'spec/helpers/vue_mount_component_helper';
-import { emptyProjectMock, selectedProjectMock } from '../mock_data';
-
-const componentConfig = {
-  docsUrl: 'https://console.cloud.google.com/home/dashboard',
-  fieldId: 'cluster_provider_gcp_attributes_gcp_project_id',
-  fieldName: 'cluster[provider_gcp_attributes][gcp_project_id]',
-};
-
-const LABELS = {
-  LOADING: 'Fetching projects',
-  VALIDATING_PROJECT_BILLING: 'Validating project billing status',
-  DEFAULT: 'Select project',
-  EMPTY: 'No projects found',
-};
-
-const createComponent = (store, props = componentConfig) => {
-  const Component = Vue.extend(GkeProjectIdDropdown);
-
-  return mountComponentWithStore(Component, {
-    el: null,
-    props,
-    store,
-  });
-};
-
-describe('GkeProjectIdDropdown', () => {
-  let vm;
-  let store;
-
-  beforeEach(() => {
-    store = createStore();
-    vm = createComponent(store);
-  });
-
-  afterEach(() => {
-    vm.$destroy();
-  });
-
-  describe('toggleText', () => {
-    it('returns loading toggle text', () => {
-      expect(vm.toggleText).toBe(LABELS.LOADING);
-    });
-
-    it('returns project billing validation text', () => {
-      vm.setIsValidatingProjectBilling(true);
-
-      expect(vm.toggleText).toBe(LABELS.VALIDATING_PROJECT_BILLING);
-    });
-
-    it('returns default toggle text', done =>
-      setTimeout(() => {
-        vm.setItem(emptyProjectMock);
-
-        expect(vm.toggleText).toBe(LABELS.DEFAULT);
-
-        done();
-      }));
-
-    it('returns project name if project selected', done =>
-      setTimeout(() => {
-        vm.isLoading = false;
-
-        expect(vm.toggleText).toBe(selectedProjectMock.name);
-
-        done();
-      }));
-
-    it('returns empty toggle text', done =>
-      setTimeout(() => {
-        vm.$store.commit(SET_PROJECTS, null);
-        vm.setItem(emptyProjectMock);
-
-        expect(vm.toggleText).toBe(LABELS.EMPTY);
-
-        done();
-      }));
-  });
-
-  describe('selectItem', () => {
-    it('reflects new value when dropdown item is clicked', done => {
-      expect(vm.$el.querySelector('input').value).toBe('');
-
-      return vm
-        .$nextTick()
-        .then(() => {
-          vm.$el.querySelector('.dropdown-content button').click();
-
-          return vm
-            .$nextTick()
-            .then(() => {
-              expect(vm.$el.querySelector('input').value).toBe(selectedProjectMock.projectId);
-              done();
-            })
-            .catch(done.fail);
-        })
-        .catch(done.fail);
-    });
-  });
-});
diff --git a/spec/javascripts/projects/gke_cluster_dropdowns/components/gke_zone_dropdown_spec.js b/spec/javascripts/projects/gke_cluster_dropdowns/components/gke_zone_dropdown_spec.js
deleted file mode 100644
index 95186e19ca1..00000000000
--- a/spec/javascripts/projects/gke_cluster_dropdowns/components/gke_zone_dropdown_spec.js
+++ /dev/null
@@ -1,94 +0,0 @@
-import Vue from 'vue';
-import GkeZoneDropdown from '~/projects/gke_cluster_dropdowns/components/gke_zone_dropdown.vue';
-import { createStore } from '~/projects/gke_cluster_dropdowns/store';
-import {
-  SET_PROJECT,
-  SET_ZONES,
-  SET_PROJECT_BILLING_STATUS,
-} from '~/projects/gke_cluster_dropdowns/store/mutation_types';
-import { mountComponentWithStore } from 'spec/helpers/vue_mount_component_helper';
-import { selectedZoneMock, selectedProjectMock, gapiZonesResponseMock } from '../mock_data';
-
-const componentConfig = {
-  fieldId: 'cluster_provider_gcp_attributes_gcp_zone',
-  fieldName: 'cluster[provider_gcp_attributes][gcp_zone]',
-};
-
-const LABELS = {
-  LOADING: 'Fetching zones',
-  DISABLED: 'Select project to choose zone',
-  DEFAULT: 'Select zone',
-};
-
-const createComponent = (store, props = componentConfig) => {
-  const Component = Vue.extend(GkeZoneDropdown);
-
-  return mountComponentWithStore(Component, {
-    el: null,
-    props,
-    store,
-  });
-};
-
-describe('GkeZoneDropdown', () => {
-  let vm;
-  let store;
-
-  beforeEach(() => {
-    store = createStore();
-    vm = createComponent(store);
-  });
-
-  afterEach(() => {
-    vm.$destroy();
-  });
-
-  describe('toggleText', () => {
-    it('returns disabled state toggle text', () => {
-      expect(vm.toggleText).toBe(LABELS.DISABLED);
-    });
-
-    it('returns loading toggle text', () => {
-      vm.isLoading = true;
-
-      expect(vm.toggleText).toBe(LABELS.LOADING);
-    });
-
-    it('returns default toggle text', () => {
-      expect(vm.toggleText).toBe(LABELS.DISABLED);
-
-      vm.$store.commit(SET_PROJECT, selectedProjectMock);
-      vm.$store.commit(SET_PROJECT_BILLING_STATUS, true);
-
-      expect(vm.toggleText).toBe(LABELS.DEFAULT);
-    });
-
-    it('returns project name if project selected', () => {
-      vm.setItem(selectedZoneMock);
-
-      expect(vm.toggleText).toBe(selectedZoneMock);
-    });
-  });
-
-  describe('selectItem', () => {
-    it('reflects new value when dropdown item is clicked', done => {
-      expect(vm.$el.querySelector('input').value).toBe('');
-      vm.$store.commit(SET_ZONES, gapiZonesResponseMock.items);
-
-      return vm
-        .$nextTick()
-        .then(() => {
-          vm.$el.querySelector('.dropdown-content button').click();
-
-          return vm
-            .$nextTick()
-            .then(() => {
-              expect(vm.$el.querySelector('input').value).toBe(selectedZoneMock);
-              done();
-            })
-            .catch(done.fail);
-        })
-        .catch(done.fail);
-    });
-  });
-});
diff --git a/spec/javascripts/projects/gke_cluster_dropdowns/helpers.js b/spec/javascripts/projects/gke_cluster_dropdowns/helpers.js
deleted file mode 100644
index 6df511e9157..00000000000
--- a/spec/javascripts/projects/gke_cluster_dropdowns/helpers.js
+++ /dev/null
@@ -1,49 +0,0 @@
-import {
-  gapiProjectsResponseMock,
-  gapiZonesResponseMock,
-  gapiMachineTypesResponseMock,
-} from './mock_data';
-
-// eslint-disable-next-line import/prefer-default-export
-export const gapi = () => ({
-  client: {
-    cloudbilling: {
-      projects: {
-        getBillingInfo: () =>
-          new Promise(resolve => {
-            resolve({
-              result: { billingEnabled: true },
-            });
-          }),
-      },
-    },
-    cloudresourcemanager: {
-      projects: {
-        list: () =>
-          new Promise(resolve => {
-            resolve({
-              result: { ...gapiProjectsResponseMock },
-            });
-          }),
-      },
-    },
-    compute: {
-      zones: {
-        list: () =>
-          new Promise(resolve => {
-            resolve({
-              result: { ...gapiZonesResponseMock },
-            });
-          }),
-      },
-      machineTypes: {
-        list: () =>
-          new Promise(resolve => {
-            resolve({
-              result: { ...gapiMachineTypesResponseMock },
-            });
-          }),
-      },
-    },
-  },
-});
diff --git a/spec/javascripts/projects/gke_cluster_dropdowns/mock_data.js b/spec/javascripts/projects/gke_cluster_dropdowns/mock_data.js
deleted file mode 100644
index d9f5dbc636f..00000000000
--- a/spec/javascripts/projects/gke_cluster_dropdowns/mock_data.js
+++ /dev/null
@@ -1,75 +0,0 @@
-export const emptyProjectMock = {
-  projectId: '',
-  name: '',
-};
-
-export const selectedProjectMock = {
-  projectId: 'gcp-project-123',
-  name: 'gcp-project',
-};
-
-export const selectedZoneMock = 'us-central1-a';
-
-export const selectedMachineTypeMock = 'n1-standard-2';
-
-export const gapiProjectsResponseMock = {
-  projects: [
-    {
-      projectNumber: '1234',
-      projectId: 'gcp-project-123',
-      lifecycleState: 'ACTIVE',
-      name: 'gcp-project',
-      createTime: '2017-12-16T01:48:29.129Z',
-      parent: {
-        type: 'organization',
-        id: '12345',
-      },
-    },
-  ],
-};
-
-export const gapiZonesResponseMock = {
-  kind: 'compute#zoneList',
-  id: 'projects/gitlab-internal-153318/zones',
-  items: [
-    {
-      kind: 'compute#zone',
-      id: '2000',
-      creationTimestamp: '1969-12-31T16:00:00.000-08:00',
-      name: 'us-central1-a',
-      description: 'us-central1-a',
-      status: 'UP',
-      region:
-        'https://www.googleapis.com/compute/v1/projects/gitlab-internal-153318/regions/us-central1',
-      selfLink:
-        'https://www.googleapis.com/compute/v1/projects/gitlab-internal-153318/zones/us-central1-a',
-      availableCpuPlatforms: ['Intel Skylake', 'Intel Broadwell', 'Intel Sandy Bridge'],
-    },
-  ],
-  selfLink: 'https://www.googleapis.com/compute/v1/projects/gitlab-internal-153318/zones',
-};
-
-export const gapiMachineTypesResponseMock = {
-  kind: 'compute#machineTypeList',
-  id: 'projects/gitlab-internal-153318/zones/us-central1-a/machineTypes',
-  items: [
-    {
-      kind: 'compute#machineType',
-      id: '3002',
-      creationTimestamp: '1969-12-31T16:00:00.000-08:00',
-      name: 'n1-standard-2',
-      description: '2 vCPUs, 7.5 GB RAM',
-      guestCpus: 2,
-      memoryMb: 7680,
-      imageSpaceGb: 10,
-      maximumPersistentDisks: 64,
-      maximumPersistentDisksSizeGb: '65536',
-      zone: 'us-central1-a',
-      selfLink:
-        'https://www.googleapis.com/compute/v1/projects/gitlab-internal-153318/zones/us-central1-a/machineTypes/n1-standard-2',
-      isSharedCpu: false,
-    },
-  ],
-  selfLink:
-    'https://www.googleapis.com/compute/v1/projects/gitlab-internal-153318/zones/us-central1-a/machineTypes',
-};
diff --git a/spec/javascripts/projects/gke_cluster_dropdowns/stores/actions_spec.js b/spec/javascripts/projects/gke_cluster_dropdowns/stores/actions_spec.js
deleted file mode 100644
index 9d892b8185b..00000000000
--- a/spec/javascripts/projects/gke_cluster_dropdowns/stores/actions_spec.js
+++ /dev/null
@@ -1,131 +0,0 @@
-import testAction from 'spec/helpers/vuex_action_helper';
-import * as actions from '~/projects/gke_cluster_dropdowns/store/actions';
-import { createStore } from '~/projects/gke_cluster_dropdowns/store';
-import { gapi } from '../helpers';
-import { selectedProjectMock, selectedZoneMock, selectedMachineTypeMock } from '../mock_data';
-
-describe('GCP Cluster Dropdown Store Actions', () => {
-  let store;
-
-  beforeEach(() => {
-    store = createStore();
-  });
-
-  describe('setProject', () => {
-    it('should set project', done => {
-      testAction(
-        actions.setProject,
-        selectedProjectMock,
-        { selectedProject: {} },
-        [{ type: 'SET_PROJECT', payload: selectedProjectMock }],
-        [],
-        done,
-      );
-    });
-  });
-
-  describe('setZone', () => {
-    it('should set zone', done => {
-      testAction(
-        actions.setZone,
-        selectedZoneMock,
-        { selectedZone: '' },
-        [{ type: 'SET_ZONE', payload: selectedZoneMock }],
-        [],
-        done,
-      );
-    });
-  });
-
-  describe('setMachineType', () => {
-    it('should set machine type', done => {
-      testAction(
-        actions.setMachineType,
-        selectedMachineTypeMock,
-        { selectedMachineType: '' },
-        [{ type: 'SET_MACHINE_TYPE', payload: selectedMachineTypeMock }],
-        [],
-        done,
-      );
-    });
-  });
-
-  describe('setIsValidatingProjectBilling', () => {
-    it('should set machine type', done => {
-      testAction(
-        actions.setIsValidatingProjectBilling,
-        true,
-        { isValidatingProjectBilling: null },
-        [{ type: 'SET_IS_VALIDATING_PROJECT_BILLING', payload: true }],
-        [],
-        done,
-      );
-    });
-  });
-
-  describe('async fetch methods', () => {
-    window.gapi = gapi();
-
-    describe('fetchProjects', () => {
-      it('fetches projects from Google API', done => {
-        store
-          .dispatch('fetchProjects')
-          .then(() => {
-            expect(store.state.projects[0].projectId).toEqual(selectedProjectMock.projectId);
-            expect(store.state.projects[0].name).toEqual(selectedProjectMock.name);
-
-            done();
-          })
-          .catch(done.fail);
-      });
-    });
-
-    describe('validateProjectBilling', () => {
-      it('checks project billing status from Google API', done => {
-        testAction(
-          actions.validateProjectBilling,
-          true,
-          {
-            selectedProject: selectedProjectMock,
-            selectedZone: '',
-            selectedMachineType: '',
-            projectHasBillingEnabled: null,
-          },
-          [
-            { type: 'SET_ZONE', payload: '' },
-            { type: 'SET_MACHINE_TYPE', payload: '' },
-            { type: 'SET_PROJECT_BILLING_STATUS', payload: true },
-          ],
-          [{ type: 'setIsValidatingProjectBilling', payload: false }],
-          done,
-        );
-      });
-    });
-
-    describe('fetchZones', () => {
-      it('fetches zones from Google API', done => {
-        store
-          .dispatch('fetchZones')
-          .then(() => {
-            expect(store.state.zones[0].name).toEqual(selectedZoneMock);
-
-            done();
-          })
-          .catch(done.fail);
-      });
-    });
-
-    describe('fetchMachineTypes', () => {
-      it('fetches machine types from Google API', done => {
-        store
-          .dispatch('fetchMachineTypes')
-          .then(() => {
-            expect(store.state.machineTypes[0].name).toEqual(selectedMachineTypeMock);
-
-            done();
-          })
-          .catch(done.fail);
-      });
-    });
-  });
-});
diff --git a/spec/javascripts/projects/gke_cluster_dropdowns/stores/getters_spec.js b/spec/javascripts/projects/gke_cluster_dropdowns/stores/getters_spec.js
deleted file mode 100644
index 6f89158f807..00000000000
--- a/spec/javascripts/projects/gke_cluster_dropdowns/stores/getters_spec.js
+++ /dev/null
@@ -1,65 +0,0 @@
-import * as getters from '~/projects/gke_cluster_dropdowns/store/getters';
-import { selectedProjectMock, selectedZoneMock, selectedMachineTypeMock } from '../mock_data';
-
-describe('GCP Cluster Dropdown Store Getters', () => {
-  let state;
-
-  describe('valid states', () => {
-    beforeEach(() => {
-      state = {
-        selectedProject: selectedProjectMock,
-        selectedZone: selectedZoneMock,
-        selectedMachineType: selectedMachineTypeMock,
-      };
-    });
-
-    describe('hasProject', () => {
-      it('should return true when project is selected', () => {
-        expect(getters.hasProject(state)).toEqual(true);
-      });
-    });
-
-    describe('hasZone', () => {
-      it('should return true when zone is selected', () => {
-        expect(getters.hasZone(state)).toEqual(true);
-      });
-    });
-
-    describe('hasMachineType', () => {
-      it('should return true when machine type is selected', () => {
-        expect(getters.hasMachineType(state)).toEqual(true);
-      });
-    });
-  });
-
-  describe('invalid states', () => {
-    beforeEach(() => {
-      state = {
-        selectedProject: {
-          projectId: '',
-          name: '',
-        },
-        selectedZone: '',
-        selectedMachineType: '',
-      };
-    });
-
-    describe('hasProject', () => {
-      it('should return false when project is not selected', () => {
-        expect(getters.hasProject(state)).toEqual(false);
-      });
-    });
-
-    describe('hasZone', () => {
-      it('should return false when zone is not selected', () => {
-        expect(getters.hasZone(state)).toEqual(false);
-      });
-    });
-
-    describe('hasMachineType', () => {
-      it('should return false when machine type is not selected', () => {
-        expect(getters.hasMachineType(state)).toEqual(false);
-      });
-    });
-  });
-});
diff --git a/spec/javascripts/projects/gke_cluster_dropdowns/stores/mutations_spec.js b/spec/javascripts/projects/gke_cluster_dropdowns/stores/mutations_spec.js
deleted file mode 100644
index 7f8c4f314e4..00000000000
--- a/spec/javascripts/projects/gke_cluster_dropdowns/stores/mutations_spec.js
+++ /dev/null
@@ -1,87 +0,0 @@
-import { createStore } from '~/projects/gke_cluster_dropdowns/store';
-import * as types from '~/projects/gke_cluster_dropdowns/store/mutation_types';
-import {
-  selectedProjectMock,
-  selectedZoneMock,
-  selectedMachineTypeMock,
-  gapiProjectsResponseMock,
-  gapiZonesResponseMock,
-  gapiMachineTypesResponseMock,
-} from '../mock_data';
-
-describe('GCP Cluster Dropdown Store Mutations', () => {
-  let store;
-
-  beforeEach(() => {
-    store = createStore();
-  });
-
-  describe('SET_PROJECT', () => {
-    it('should set GCP project as selectedProject', () => {
-      const projectToSelect = gapiProjectsResponseMock.projects[0];
-
-      store.commit(types.SET_PROJECT, projectToSelect);
-
-      expect(store.state.selectedProject.projectId).toEqual(selectedProjectMock.projectId);
-      expect(store.state.selectedProject.name).toEqual(selectedProjectMock.name);
-    });
-  });
-
-  describe('SET_PROJECT_BILLING_STATUS', () => {
-    it('should set project billing status', () => {
-      store.commit(types.SET_PROJECT_BILLING_STATUS, true);
-
-      expect(store.state.projectHasBillingEnabled).toBeTruthy();
-    });
-  });
-
-  describe('SET_ZONE', () => {
-    it('should set GCP zone as selectedZone', () => {
-      const zoneToSelect = gapiZonesResponseMock.items[0].name;
-
-      store.commit(types.SET_ZONE, zoneToSelect);
-
-      expect(store.state.selectedZone).toEqual(selectedZoneMock);
-    });
-  });
-
-  describe('SET_MACHINE_TYPE', () => {
-    it('should set GCP machine type as selectedMachineType', () => {
-      const machineTypeToSelect = gapiMachineTypesResponseMock.items[0].name;
-
-      store.commit(types.SET_MACHINE_TYPE, machineTypeToSelect);
-
-      expect(store.state.selectedMachineType).toEqual(selectedMachineTypeMock);
-    });
-  });
-
-  describe('SET_PROJECTS', () => {
-    it('should set Google API Projects response as projects', () => {
-      expect(store.state.projects.length).toEqual(0);
-
-      store.commit(types.SET_PROJECTS, gapiProjectsResponseMock.projects);
-
-      expect(store.state.projects.length).toEqual(gapiProjectsResponseMock.projects.length);
-    });
-  });
-
-  describe('SET_ZONES', () => {
-    it('should set Google API Zones response as zones', () => {
-      expect(store.state.zones.length).toEqual(0);
-
-      store.commit(types.SET_ZONES, gapiZonesResponseMock.items);
-
-      expect(store.state.zones.length).toEqual(gapiZonesResponseMock.items.length);
-    });
-  });
-
-  describe('SET_MACHINE_TYPES', () => {
-    it('should set Google API Machine Types response as machineTypes', () => {
-      expect(store.state.machineTypes.length).toEqual(0);
-
-      store.commit(types.SET_MACHINE_TYPES, gapiMachineTypesResponseMock.items);
-
-      expect(store.state.machineTypes.length).toEqual(gapiMachineTypesResponseMock.items.length);
-    });
-  });
-});
-- 
cgit v1.2.1


From 7049b3b6316a8f8974bc349d5db537a2d796d662 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Tue, 27 Aug 2019 06:33:10 -0700
Subject: Document setting admin credentials in QA tests

This makes it possible to test against a real instance that has
different admin credentials than the default.
---
 qa/README.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/qa/README.md b/qa/README.md
index 16e5e730a6b..dede3cd2473 100644
--- a/qa/README.md
+++ b/qa/README.md
@@ -105,6 +105,17 @@ If you need to authenticate as a different user, you can provide the
 GITLAB_USERNAME=jsmith GITLAB_PASSWORD=password bundle exec bin/qa Test::Instance::All https://gitlab.example.com
 ```
 
+Some QA tests require logging in as an admin user. By default, the QA
+tests will use the the same `root` user seeded by the GDK.
+
+If you need to authenticate with different admin credentials, you can
+provide the `GITLAB_ADMIN_USERNAME` and `GITLAB_ADMIN_PASSWORD`
+environment variables:
+
+```
+GITLAB_ADMIN_USERNAME=admin GITLAB_ADMIN_PASSWORD=myadminpassword GITLAB_USERNAME=jsmith GITLAB_PASSWORD=password bundle exec bin/qa Test::Instance::All https://gitlab.example.com
+```
+
 If your user doesn't have permission to default sandbox group
 `gitlab-qa-sandbox`, you could also use another sandbox group by giving
 `GITLAB_SANDBOX_NAME`:
-- 
cgit v1.2.1


From 838e8a94c5fb1782aa2beb1cbc65fa10119f7f39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Tue, 27 Aug 2019 16:05:03 +0200
Subject: Don't set tags for the reports jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 .gitlab/ci/reports.gitlab-ci.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index 905f1ede2c4..2197f916484 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -8,9 +8,6 @@ include:
   extends:
     - .default-retry
     - .except-docs
-  tags:
-    - gitlab-org
-    - docker
 
 code_quality:
   extends: .reports
-- 
cgit v1.2.1


From 75353242e2a2925fa968a3f9a5ad1db051a194cd Mon Sep 17 00:00:00 2001
From: Winnie Hellmann <winnie@gitlab.com>
Date: Tue, 27 Aug 2019 15:11:15 +0000
Subject: Replace prepend_entity with prepend_if_ee

(cherry picked from commit 897a9d308db46b620b738b98f2b0e5630ac7d2dd)
---
 .../initializers/0_inject_enterprise_edition_module.rb | 11 +++++++++--
 lib/api/entities.rb                                    | 18 ++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/config/initializers/0_inject_enterprise_edition_module.rb b/config/initializers/0_inject_enterprise_edition_module.rb
index 39595e23abe..b3ebb44ef25 100644
--- a/config/initializers/0_inject_enterprise_edition_module.rb
+++ b/config/initializers/0_inject_enterprise_edition_module.rb
@@ -3,8 +3,15 @@
 require 'active_support/inflector'
 
 module InjectEnterpriseEditionModule
-  def prepend_if_ee(constant)
-    prepend(constant.constantize) if Gitlab.ee?
+  def prepend_if_ee(constant, with_descendants: false)
+    return unless Gitlab.ee?
+
+    ee_module = constant.constantize
+    prepend(ee_module)
+
+    if with_descendants
+      descendants.each { |descendant| descendant.prepend(ee_module) }
+    end
   end
 
   def extend_if_ee(constant)
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 5e66b4e76a5..6f86adf6a5c 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -1707,3 +1707,21 @@ module API
     end
   end
 end
+
+# rubocop: disable Cop/InjectEnterpriseEditionModule
+API::Entities.prepend_if_ee('EE::API::Entities::Entities')
+::API::Entities::ApplicationSetting.prepend_if_ee('EE::API::Entities::ApplicationSetting')
+::API::Entities::Board.prepend_if_ee('EE::API::Entities::Board')
+::API::Entities::Group.prepend_if_ee('EE::API::Entities::Group', with_descendants: true)
+::API::Entities::GroupDetail.prepend_if_ee('EE::API::Entities::GroupDetail')
+::API::Entities::IssueBasic.prepend_if_ee('EE::API::Entities::IssueBasic', with_descendants: true)
+::API::Entities::List.prepend_if_ee('EE::API::Entities::List')
+::API::Entities::MergeRequestBasic.prepend_if_ee('EE::API::Entities::MergeRequestBasic', with_descendants: true)
+::API::Entities::Namespace.prepend_if_ee('EE::API::Entities::Namespace')
+::API::Entities::Project.prepend_if_ee('EE::API::Entities::Project', with_descendants: true)
+::API::Entities::ProtectedRefAccess.prepend_if_ee('EE::API::Entities::ProtectedRefAccess')
+::API::Entities::UserPublic.prepend_if_ee('EE::API::Entities::UserPublic', with_descendants: true)
+::API::Entities::Todo.prepend_if_ee('EE::API::Entities::Todo')
+::API::Entities::ProtectedBranch.prepend_if_ee('EE::API::Entities::ProtectedBranch')
+::API::Entities::Identity.prepend_if_ee('EE::API::Entities::Identity')
+::API::Entities::UserWithAdmin.prepend_if_ee('EE::API::Entities::UserWithAdmin', with_descendants: true)
-- 
cgit v1.2.1


From 5025da6d305482279f884b19de5e1265271fa9bb Mon Sep 17 00:00:00 2001
From: Aishwarya Subramanian <asubramanian@gitlab.com>
Date: Tue, 27 Aug 2019 20:50:11 +0530
Subject: Moved construction of name to EE namespace

---
 app/services/users/build_service.rb | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/app/services/users/build_service.rb b/app/services/users/build_service.rb
index 614ed734c3e..026bcfcdaf4 100644
--- a/app/services/users/build_service.rb
+++ b/app/services/users/build_service.rb
@@ -87,9 +87,7 @@ module Users
         :password_automatically_set,
         :name,
         :password,
-        :username,
-        :first_name,
-        :last_name
+        :username
       ]
     end
 
-- 
cgit v1.2.1


From 6bbba7017b2f7b995aa972903b8686f9408112da Mon Sep 17 00:00:00 2001
From: Illya Klymov <xanf@xanf.me>
Date: Tue, 27 Aug 2019 18:49:12 +0300
Subject: Refactored Karma spec to Jest for mr_widget_auto_merge_failed

---
 .../ce-xanf-move-auto-merge-failed-to-jest.yml     |  5 ++
 .../states/mr_widget_auto_merge_failed_spec.js     | 55 ++++++++++++++++++++++
 .../states/mr_widget_auto_merge_failed_spec.js     | 47 ------------------
 3 files changed, 60 insertions(+), 47 deletions(-)
 create mode 100644 changelogs/unreleased/ce-xanf-move-auto-merge-failed-to-jest.yml
 create mode 100644 spec/frontend/vue_mr_widget/components/states/mr_widget_auto_merge_failed_spec.js
 delete mode 100644 spec/javascripts/vue_mr_widget/components/states/mr_widget_auto_merge_failed_spec.js

diff --git a/changelogs/unreleased/ce-xanf-move-auto-merge-failed-to-jest.yml b/changelogs/unreleased/ce-xanf-move-auto-merge-failed-to-jest.yml
new file mode 100644
index 00000000000..5a56a668c54
--- /dev/null
+++ b/changelogs/unreleased/ce-xanf-move-auto-merge-failed-to-jest.yml
@@ -0,0 +1,5 @@
+---
+title: Refactored Karma spec to Jest for mr_widget_auto_merge_failed
+merge_request: 32282
+author: Illya Klymov
+type: other
diff --git a/spec/frontend/vue_mr_widget/components/states/mr_widget_auto_merge_failed_spec.js b/spec/frontend/vue_mr_widget/components/states/mr_widget_auto_merge_failed_spec.js
new file mode 100644
index 00000000000..1f4d1e17ea0
--- /dev/null
+++ b/spec/frontend/vue_mr_widget/components/states/mr_widget_auto_merge_failed_spec.js
@@ -0,0 +1,55 @@
+import { shallowMount } from '@vue/test-utils';
+import { GlLoadingIcon } from '@gitlab/ui';
+import AutoMergeFailedComponent from '~/vue_merge_request_widget/components/states/mr_widget_auto_merge_failed.vue';
+import eventHub from '~/vue_merge_request_widget/event_hub';
+
+describe('MRWidgetAutoMergeFailed', () => {
+  let wrapper;
+  const mergeError = 'This is the merge error';
+  const findButton = () => wrapper.find('button');
+
+  const createComponent = (props = {}) => {
+    wrapper = shallowMount(AutoMergeFailedComponent, {
+      sync: false,
+      propsData: { ...props },
+    });
+  };
+
+  beforeEach(() => {
+    createComponent({
+      mr: { mergeError },
+    });
+  });
+
+  afterEach(() => {
+    wrapper.destroy();
+  });
+
+  it('renders failed message', () => {
+    expect(wrapper.text()).toContain('This merge request failed to be merged automatically');
+  });
+
+  it('renders merge error provided', () => {
+    expect(wrapper.text()).toContain(mergeError);
+  });
+
+  it('render refresh button', () => {
+    expect(findButton().text()).toEqual('Refresh');
+  });
+
+  it('emits event and shows loading icon when button is clicked', () => {
+    jest.spyOn(eventHub, '$emit');
+    findButton().trigger('click');
+
+    expect(eventHub.$emit.mock.calls[0][0]).toBe('MRWidgetUpdateRequested');
+
+    return wrapper.vm.$nextTick(() => {
+      expect(findButton().attributes('disabled')).toEqual('disabled');
+      expect(
+        findButton()
+          .find(GlLoadingIcon)
+          .exists(),
+      ).toBe(true);
+    });
+  });
+});
diff --git a/spec/javascripts/vue_mr_widget/components/states/mr_widget_auto_merge_failed_spec.js b/spec/javascripts/vue_mr_widget/components/states/mr_widget_auto_merge_failed_spec.js
deleted file mode 100644
index 55a11a72551..00000000000
--- a/spec/javascripts/vue_mr_widget/components/states/mr_widget_auto_merge_failed_spec.js
+++ /dev/null
@@ -1,47 +0,0 @@
-import Vue from 'vue';
-import autoMergeFailedComponent from '~/vue_merge_request_widget/components/states/mr_widget_auto_merge_failed.vue';
-import eventHub from '~/vue_merge_request_widget/event_hub';
-import mountComponent from 'spec/helpers/vue_mount_component_helper';
-
-describe('MRWidgetAutoMergeFailed', () => {
-  let vm;
-  const mergeError = 'This is the merge error';
-
-  beforeEach(() => {
-    const Component = Vue.extend(autoMergeFailedComponent);
-    vm = mountComponent(Component, {
-      mr: { mergeError },
-    });
-  });
-
-  afterEach(() => {
-    vm.$destroy();
-  });
-
-  it('renders failed message', () => {
-    expect(vm.$el.textContent).toContain('This merge request failed to be merged automatically');
-  });
-
-  it('renders merge error provided', () => {
-    expect(vm.$el.innerText).toContain(mergeError);
-  });
-
-  it('render refresh button', () => {
-    expect(vm.$el.querySelector('button').textContent.trim()).toEqual('Refresh');
-  });
-
-  it('emits event and shows loading icon when button is clicked', done => {
-    spyOn(eventHub, '$emit');
-    vm.$el.querySelector('button').click();
-
-    expect(eventHub.$emit.calls.argsFor(0)[0]).toEqual('MRWidgetUpdateRequested');
-
-    Vue.nextTick(() => {
-      expect(vm.$el.querySelector('button').getAttribute('disabled')).toEqual('disabled');
-      expect(vm.$el.querySelector('button .loading-container span').classList).toContain(
-        'gl-spinner',
-      );
-      done();
-    });
-  });
-});
-- 
cgit v1.2.1


From e17ba8d9e32c9d547ff9ca31056bbf7abd864488 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Tue, 27 Aug 2019 19:13:55 +0200
Subject: Fix a nil error in Gitlab::Danger::Teammate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 lib/gitlab/danger/teammate.rb           | 4 ++--
 spec/lib/gitlab/danger/teammate_spec.rb | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/gitlab/danger/teammate.rb b/lib/gitlab/danger/teammate.rb
index 8ae4ffdadb0..2789706aa3b 100644
--- a/lib/gitlab/danger/teammate.rb
+++ b/lib/gitlab/danger/teammate.rb
@@ -39,9 +39,9 @@ module Gitlab
       def has_capability?(project, category, kind, labels)
         case category
         when :test
-          area = role[/Test Automation Engineer(?:.*?, (\w+))/, 1].downcase
+          area = role[/Test Automation Engineer(?:.*?, (\w+))/, 1]
 
-          area && labels.any?("devops::#{area}") if kind == :reviewer
+          area && labels.any?("devops::#{area.downcase}") if kind == :reviewer
         else
           capabilities(project).include?("#{kind} #{category}")
         end
diff --git a/spec/lib/gitlab/danger/teammate_spec.rb b/spec/lib/gitlab/danger/teammate_spec.rb
index 61b43e343c1..afbc3896a70 100644
--- a/spec/lib/gitlab/danger/teammate_spec.rb
+++ b/spec/lib/gitlab/danger/teammate_spec.rb
@@ -50,6 +50,14 @@ describe Gitlab::Danger::Teammate do
         end
       end
 
+      context 'when role is Test Automation Engineer' do
+        let(:role) { 'Test Automation Engineer' }
+
+        it '#reviewer? returns false' do
+          expect(subject.reviewer?(project, :test, labels)).to be_falsey
+        end
+      end
+
       context 'when role is Test Automation Engineer, Manage' do
         let(:role) { 'Test Automation Engineer, Manage' }
 
-- 
cgit v1.2.1


From c9ed3d738dbda33997c73fe314e1e00bd17c19b6 Mon Sep 17 00:00:00 2001
From: Rainer Kern <rainer@systemkern.com>
Date: Tue, 27 Aug 2019 17:23:14 +0000
Subject: Add example requests for snippets API

---
 doc/api/project_snippets.md | 58 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/doc/api/project_snippets.md b/doc/api/project_snippets.md
index c1588f2292a..bc8219077e4 100644
--- a/doc/api/project_snippets.md
+++ b/doc/api/project_snippets.md
@@ -81,6 +81,27 @@ Parameters:
 - `code` (required) - The content of a snippet
 - `visibility` (required) - The snippet's visibility
 
+Example request:
+
+```bash
+curl --request POST https://gitlab.com/api/v4/projects/:id/snippets \
+     --header "PRIVATE-TOKEN: <your access token>" \
+     --header "Content-Type: application/json" \
+     -d @snippet.json 
+```
+
+`snippet.json` used in the above example request:
+
+```json
+{
+  "title" : "Example Snippet Title",
+  "description" : "More verbose snippet description",
+  "file_name" : "example.txt",
+  "code" : "source code \n with multiple lines\n",
+  "visibility" : "private"
+}
+```
+
 ## Update snippet
 
 Updates an existing project snippet. The user must have permission to change an existing snippet.
@@ -99,6 +120,27 @@ Parameters:
 - `code` (optional) - The content of a snippet
 - `visibility` (optional) - The snippet's visibility
 
+Example request:
+
+```bash
+curl --request PUT https://gitlab.com/api/v4/projects/:id/snippets \
+     --header "PRIVATE-TOKEN: <your_access_token>" \
+     --header "Content-Type: application/json" \
+     -d @snippet.json 
+```
+
+`snippet.json` used in the above example request:
+
+```json
+{
+  "title" : "Updated Snippet Title",
+  "description" : "More verbose snippet description",
+  "file_name" : "new_filename.txt",
+  "code" : "updated source code \n with multiple lines\n",
+  "visibility" : "private"
+}
+```
+
 ## Delete snippet
 
 Deletes an existing project snippet. This returns a `204 No Content` status code if the operation was successfully or `404` if the resource was not found.
@@ -112,6 +154,13 @@ Parameters:
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user
 - `snippet_id` (required) - The ID of a project's snippet
 
+Example request:
+
+```bash
+curl --request DELETE https://gitlab.com/api/v4/projects/:id/snippets \
+     --header "PRIVATE-TOKEN: <your_access_token>"
+```
+
 ## Snippet content
 
 Returns the raw project snippet as plain text.
@@ -125,6 +174,13 @@ Parameters:
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user
 - `snippet_id` (required) - The ID of a project's snippet
 
+Example request:
+
+```bash
+curl --request GET https://gitlab.com/api/v4/projects/:id/snippets/:snippet_id/raw \
+     --header "PRIVATE-TOKEN: <your_access_token>"
+```
+
 ## Get user agent details
 
 > [Introduced][ce-29508] in GitLab 9.4.
@@ -140,6 +196,8 @@ GET /projects/:id/snippets/:snippet_id/user_agent_detail
 | `id`          | Integer | yes      | The ID of a project                  |
 | `snippet_id`  | Integer | yes      | The ID of a snippet                  |
 
+Example request:
+
 ```bash
 curl --request GET --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/projects/1/snippets/2/user_agent_detail
 ```
-- 
cgit v1.2.1


From 9c1feda7a2453237ab0f45789985041bbbdddf78 Mon Sep 17 00:00:00 2001
From: Robert Speicher <rspeicher@gmail.com>
Date: Tue, 27 Aug 2019 11:48:36 -0500
Subject: Assimilate EE-specific CI variables

Having these defined in both CE and EE won't hurt anything.
---
 .gitlab-ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 4c7a8c05b37..27992024265 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -18,8 +18,11 @@ variables:
   GIT_SUBMODULE_STRATEGY: "none"
   GET_SOURCES_ATTEMPTS: "3"
   KNAPSACK_RSPEC_SUITE_REPORT_PATH: knapsack/${CI_PROJECT_NAME}/rspec_report-master.json
+  EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH: knapsack/${CI_PROJECT_NAME}/rspec_report-master-ee.json
   FLAKY_RSPEC_SUITE_REPORT_PATH: rspec_flaky/report-suite.json
   BUILD_ASSETS_IMAGE: "false"
+  ES_JAVA_OPTS: "-Xms256m -Xmx256m"
+  ELASTIC_URL: "http://elastic:changeme@docker.elastic.co-elasticsearch-elasticsearch:9200"
 
 after_script:
   - date
-- 
cgit v1.2.1


From 0c9f77389424b6c5fd8e96b227e9125a13a07cb3 Mon Sep 17 00:00:00 2001
From: Robert Speicher <rspeicher@gmail.com>
Date: Tue, 27 Aug 2019 11:49:22 -0500
Subject: Remove README.md differences

Test coverage badges can be added at the Project level in GitLab and
don't need to be in the README.

The logo was gigantic, unable to be resized, and unnecessary in the
README.
---
 README.md | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 054e2d02461..bfc55f28279 100644
--- a/README.md
+++ b/README.md
@@ -1,14 +1,15 @@
 # GitLab
 
-## Test coverage
-
-- [![Ruby coverage](https://gitlab.com/gitlab-org/gitlab-ce/badges/master/coverage.svg?job=coverage)](https://gitlab-org.gitlab.io/gitlab-ce/coverage-ruby) Ruby
-- [![JavaScript coverage](https://gitlab.com/gitlab-org/gitlab-ce/badges/master/coverage.svg?job=karma)](https://gitlab-org.gitlab.io/gitlab-ce/coverage-javascript) JavaScript
-
 ## Canonical source
 
 The canonical source of GitLab Community Edition is [hosted on GitLab.com](https://gitlab.com/gitlab-org/gitlab-ce/).
 
+The source of GitLab Enterprise Edition is [hosted on GitLab.com](https://gitlab.com/gitlab-org/gitlab-ee).
+
+## Free trial
+
+You can request a free trial of GitLab Ultimate [on our website](https://about.gitlab.com/free-trial/).
+
 ## Open source software to collaborate on code
 
 To see how GitLab looks please see the [features page on our website](https://about.gitlab.com/features/).
@@ -103,7 +104,7 @@ For upgrading information please see our [update page](https://about.gitlab.com/
 
 ## Documentation
 
-All documentation can be found on [docs.gitlab.com/ce/](https://docs.gitlab.com/ce/).
+All documentation can be found on <https://docs.gitlab.com>.
 
 ## Getting help
 
-- 
cgit v1.2.1


From 03c4cb046788fdc267d7a744ebeb9c7ec92699bc Mon Sep 17 00:00:00 2001
From: Robert Speicher <rspeicher@gmail.com>
Date: Tue, 27 Aug 2019 11:57:29 -0500
Subject: Unify PHILOSOPHY.md

---
 PHILOSOPHY.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/PHILOSOPHY.md b/PHILOSOPHY.md
index e966d88ef78..483063731d1 100644
--- a/PHILOSOPHY.md
+++ b/PHILOSOPHY.md
@@ -1 +1,4 @@
-This document is intended to communicate the product philosophy GitLab uses in creating GitLab Community Edition. The principles can be found in the [Product Section of the GitLab Handbook](https://about.gitlab.com/handbook/product/#product-at-gitlab).
\ No newline at end of file
+To learn about the product philosophy GitLab the company uses in creating GitLab
+the product, visit our [Product Handbook page].
+
+[Product Handbook page]: https://about.gitlab.com/handbook/product/#product-at-gitlab
-- 
cgit v1.2.1


From 1f272b193ec32ee434b47d4e9dfeb03fabb95c6f Mon Sep 17 00:00:00 2001
From: Robert Speicher <rspeicher@gmail.com>
Date: Tue, 27 Aug 2019 12:46:42 -0500
Subject: Unify RuboCop configuration

---
 .rubocop.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.rubocop.yml b/.rubocop.yml
index 012f4890c33..c9a895c89f4 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -50,7 +50,9 @@ Style/FrozenStringLiteralComment:
     - 'config/**/*'
     - 'danger/**/*'
     - 'db/**/*'
-    - 'ee/**/*'
+    - 'ee/db/**/*'
+    - 'ee/spec/**/*'
+    - 'ee/lib/tasks/**/*'
     - 'lib/tasks/**/*'
     - 'qa/**/*'
     - 'rubocop/**/*'
@@ -91,6 +93,7 @@ Naming/FileName:
     - JSON
     - LDAP
     - SAML
+    - SSO
     - IO
     - HMAC
     - QA
-- 
cgit v1.2.1


From 5270e7e5af9fdcc8853b541686b6dea48da9c4ac Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Tue, 27 Aug 2019 20:39:17 +0200
Subject: Update GitLab Runner Helm Chart to 0.8.0

---
 app/models/clusters/applications/runner.rb                         | 2 +-
 changelogs/unreleased/update-gitlab-runner-helm-chart-to-0-8-0.yml | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/update-gitlab-runner-helm-chart-to-0-8-0.yml

diff --git a/app/models/clusters/applications/runner.rb b/app/models/clusters/applications/runner.rb
index 6533b7a186e..329250255fd 100644
--- a/app/models/clusters/applications/runner.rb
+++ b/app/models/clusters/applications/runner.rb
@@ -3,7 +3,7 @@
 module Clusters
   module Applications
     class Runner < ApplicationRecord
-      VERSION = '0.7.0'.freeze
+      VERSION = '0.8.0'.freeze
 
       self.table_name = 'clusters_applications_runners'
 
diff --git a/changelogs/unreleased/update-gitlab-runner-helm-chart-to-0-8-0.yml b/changelogs/unreleased/update-gitlab-runner-helm-chart-to-0-8-0.yml
new file mode 100644
index 00000000000..719a273b30c
--- /dev/null
+++ b/changelogs/unreleased/update-gitlab-runner-helm-chart-to-0-8-0.yml
@@ -0,0 +1,5 @@
+---
+title: Update GitLab Runner Helm Chart to 0.8.0
+merge_request: 32289
+author:
+type: other
-- 
cgit v1.2.1


From 3efe6f348cc3e2d3e95b0262ad2a1a59f6af5133 Mon Sep 17 00:00:00 2001
From: Kyle Wiebers <kwiebers@gitlab.com>
Date: Mon, 26 Aug 2019 10:21:35 -0500
Subject: Make sast & dast artifacts browseable

---
 .gitlab/ci/reports.gitlab-ci.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index 905f1ede2c4..a1aa0c430de 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -20,6 +20,10 @@ sast:
   variables:
     SAST_BRAKEMAN_LEVEL: 2
     SAST_EXCLUDED_PATHS: qa,spec,doc
+  artifacts:
+    expire_in: 7 days
+    paths:
+      - gl-sast-report.json
 
 dependency_scanning:
   extends: .reports
@@ -30,3 +34,7 @@ dast:
   dependencies: ["review-deploy"]
   before_script:
     - export DAST_WEBSITE="$(cat review_app_url.txt)"
+  artifacts:
+    expire_in: 7 days
+    paths:
+      - gl-dast-report.json
-- 
cgit v1.2.1


From 98949a13b03ca8602fa019e50eb48119e126ab23 Mon Sep 17 00:00:00 2001
From: Thomas Randolph <trandolph@gitlab.com>
Date: Tue, 27 Aug 2019 19:30:21 +0000
Subject: Round the file title; Add top border to conflict diffs

The file title sometimes overflows its container, which has the same
border-radius. By always rounding the file title, the overflow never
happens, so the corners always look correct.

Everywhere else there are file diffs, there is a top border to complete
the full border around the file.
---
 app/assets/stylesheets/pages/diff.scss             | 28 ++++++++++++++++++++++
 ...icts-file-headers-bad-positioning-on-scroll.yml |  5 ++++
 2 files changed, 33 insertions(+)
 create mode 100644 changelogs/unreleased/60141-mr-resolve-conflicts-file-headers-bad-positioning-on-scroll.yml

diff --git a/app/assets/stylesheets/pages/diff.scss b/app/assets/stylesheets/pages/diff.scss
index 77a2fd6b876..defa1a6c0d5 100644
--- a/app/assets/stylesheets/pages/diff.scss
+++ b/app/assets/stylesheets/pages/diff.scss
@@ -2,8 +2,14 @@
 .diff-file {
   margin-bottom: $gl-padding;
 
+  &.conflict {
+    border-top: 1px solid $border-color;
+  }
+
   .file-title,
   .file-title-flex-parent {
+    border-top-left-radius: $border-radius-default;
+    border-top-right-radius: $border-radius-default;
     cursor: pointer;
 
     @media (min-width: map-get($grid-breakpoints, md)) {
@@ -67,6 +73,28 @@
     }
   }
 
+  @media (min-width: map-get($grid-breakpoints, md)) {
+    &.conflict .file-title,
+    &.conflict .file-title-flex-parent {
+      top: $header-height;
+    }
+
+    .with-performance-bar &.conflict .file-title,
+    .with-performance-bar &.conflict .file-title-flex-parent {
+      top: $header-height + $performance-bar-height;
+    }
+
+    .with-system-header &.conflict .file-title,
+    .with-system-header &.conflict .file-title-flex-parent {
+      top: $header-height + $system-header-height;
+    }
+
+    .with-system-header.with-performance-bar &.conflict .file-title,
+    .with-system-header.with-performance-bar &.conflict .file-title-flex-parent {
+      top: $header-height + $performance-bar-height + $system-header-height;
+    }
+  }
+
   .diff-content {
     background: $white-light;
     color: $gl-text-color;
diff --git a/changelogs/unreleased/60141-mr-resolve-conflicts-file-headers-bad-positioning-on-scroll.yml b/changelogs/unreleased/60141-mr-resolve-conflicts-file-headers-bad-positioning-on-scroll.yml
new file mode 100644
index 00000000000..b6d6d596de9
--- /dev/null
+++ b/changelogs/unreleased/60141-mr-resolve-conflicts-file-headers-bad-positioning-on-scroll.yml
@@ -0,0 +1,5 @@
+---
+title: Fix file header style and position during scroll in a merge conflict resolution
+merge_request: 31991
+author:
+type: fixed
-- 
cgit v1.2.1


From 3b0479bffd6b051884ac94a99f6a4aab58b09d5c Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Tue, 27 Aug 2019 13:00:37 -0700
Subject: Remove trailing whitespace from project snippets API docs

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66677
---
 doc/api/project_snippets.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/api/project_snippets.md b/doc/api/project_snippets.md
index bc8219077e4..58d9d1cd4d8 100644
--- a/doc/api/project_snippets.md
+++ b/doc/api/project_snippets.md
@@ -87,7 +87,7 @@ Example request:
 curl --request POST https://gitlab.com/api/v4/projects/:id/snippets \
      --header "PRIVATE-TOKEN: <your access token>" \
      --header "Content-Type: application/json" \
-     -d @snippet.json 
+     -d @snippet.json
 ```
 
 `snippet.json` used in the above example request:
@@ -126,7 +126,7 @@ Example request:
 curl --request PUT https://gitlab.com/api/v4/projects/:id/snippets \
      --header "PRIVATE-TOKEN: <your_access_token>" \
      --header "Content-Type: application/json" \
-     -d @snippet.json 
+     -d @snippet.json
 ```
 
 `snippet.json` used in the above example request:
-- 
cgit v1.2.1


From 5e0378b31105c88fe05962736921b72bf40a67b3 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Tue, 27 Aug 2019 19:47:00 +0000
Subject: Revert "Merge branch 'nik-api-snippets-fix' into 'master'"

This reverts merge request !28571
---
 doc/api/snippets.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/doc/api/snippets.md b/doc/api/snippets.md
index 1ce0b1e7a62..f90447e124e 100644
--- a/doc/api/snippets.md
+++ b/doc/api/snippets.md
@@ -165,15 +165,15 @@ Parameters:
 |:--------------|:-------|:---------|:---------------------------------------------------|
 | `title`       | string | yes      | Title of a snippet.                                |
 | `file_name`   | string | yes      | Name of a snippet file.                            |
-| `code`     | string | yes      | Content of a snippet.                              |
+| `content`     | string | yes      | Content of a snippet.                              |
 | `description` | string | no       | Description of a snippet.                          |
-| `visibility`  | string | yes       | Snippet's [visibility](#snippet-visibility-level). |
+| `visibility`  | string | no       | Snippet's [visibility](#snippet-visibility-level). |
 
 Example request:
 
 ```sh
 curl --request POST \
-     --data '{"title": "This is a snippet", "code": "Hello world", "description": "Hello World snippet", "file_name": "test.txt", "visibility": "internal" }' \
+     --data '{"title": "This is a snippet", "content": "Hello world", "description": "Hello World snippet", "file_name": "test.txt", "visibility": "internal" }' \
      --header 'Content-Type: application/json' \
      --header "PRIVATE-TOKEN: valid_api_token" \
      https://gitlab.example.com/api/v4/snippets
@@ -222,14 +222,14 @@ Parameters:
 | `title`       | string  | no       | Title of a snippet.                                |
 | `file_name`   | string  | no       | Name of a snippet file.                            |
 | `description` | string  | no       | Description of a snippet.                          |
-| `code`     | string  | no       | Content of a snippet.                              |
+| `content`     | string  | no       | Content of a snippet.                              |
 | `visibility`  | string  | no       | Snippet's [visibility](#snippet-visibility-level). |
 
 Example request:
 
 ```sh
 curl --request PUT \
-     --data '{"title": "foo", "code": "bar"}' \
+     --data '{"title": "foo", "content": "bar"}' \
      --header 'Content-Type: application/json' \
      --header "PRIVATE-TOKEN: valid_api_token" \
      https://gitlab.example.com/api/v4/snippets/1
-- 
cgit v1.2.1


From a0b14c40dcb53ddaa247bdfa92fe91e225bcaba6 Mon Sep 17 00:00:00 2001
From: Luke Duncalfe <lduncalfe@gitlab.com>
Date: Tue, 27 Aug 2019 20:50:26 +0000
Subject: CE-specific changes for designs `user_notes_count`

Notes call `#after_note_created` and `#after_note_destroyed` on their
noteable in callbacks, so the noteable can perform tasks particular to
them, like cache expiry.

This is in preparation of the EE-specific class
`DesignManagement::Design` clearing its `user_notes_count` cache when
its note are created or destroyed.

Refactoring Rspec behaviour testing of a counter caching service into a
shared example.

https://gitlab.com/gitlab-org/gitlab-ee/issues/13353
---
 app/services/base_count_service.rb                 |  2 +-
 spec/services/projects/forks_count_service_spec.rb | 14 +++---
 .../projects/open_issues_count_service_spec.rb     | 13 +++---
 .../open_merge_requests_count_service_spec.rb      | 11 +++--
 spec/services/users/keys_count_service_spec.rb     | 44 +++---------------
 .../services/count_service_shared_examples.rb      | 54 ++++++++++++++++++++++
 6 files changed, 84 insertions(+), 54 deletions(-)
 create mode 100644 spec/support/shared_examples/services/count_service_shared_examples.rb

diff --git a/app/services/base_count_service.rb b/app/services/base_count_service.rb
index ad1647842b8..cfad2dd9265 100644
--- a/app/services/base_count_service.rb
+++ b/app/services/base_count_service.rb
@@ -35,7 +35,7 @@ class BaseCountService
   end
 
   def cache_key
-    raise NotImplementedError, 'cache_key must be implemented and return a String'
+    raise NotImplementedError, 'cache_key must be implemented and return a String, Array, or Hash'
   end
 
   # subclasses can override to add any specific options, such as
diff --git a/spec/services/projects/forks_count_service_spec.rb b/spec/services/projects/forks_count_service_spec.rb
index 7e35648e9ff..1b44782468a 100644
--- a/spec/services/projects/forks_count_service_spec.rb
+++ b/spec/services/projects/forks_count_service_spec.rb
@@ -2,15 +2,17 @@
 
 require 'spec_helper'
 
-describe Projects::ForksCountService do
+describe Projects::ForksCountService, :use_clean_rails_memory_store_caching do
+  let(:project) { build(:project) }
+  subject { described_class.new(project) }
+
+  it_behaves_like 'a counter caching service'
+
   describe '#count' do
     it 'returns the number of forks' do
-      project = build(:project, id: 42)
-      service = described_class.new(project)
-
-      allow(service).to receive(:uncached_count).and_return(1)
+      allow(subject).to receive(:uncached_count).and_return(1)
 
-      expect(service.count).to eq(1)
+      expect(subject.count).to eq(1)
     end
   end
 end
diff --git a/spec/services/projects/open_issues_count_service_spec.rb b/spec/services/projects/open_issues_count_service_spec.rb
index 8efa34765d0..593a4df1f8f 100644
--- a/spec/services/projects/open_issues_count_service_spec.rb
+++ b/spec/services/projects/open_issues_count_service_spec.rb
@@ -2,10 +2,13 @@
 
 require 'spec_helper'
 
-describe Projects::OpenIssuesCountService do
-  describe '#count' do
-    let(:project) { create(:project) }
+describe Projects::OpenIssuesCountService, :use_clean_rails_memory_store_caching do
+  let(:project) { create(:project) }
+  subject { described_class.new(project) }
+
+  it_behaves_like 'a counter caching service'
 
+  describe '#count' do
     context 'when user is nil' do
       it 'does not include confidential issues in the issue count' do
         create(:issue, :opened, project: project)
@@ -53,9 +56,7 @@ describe Projects::OpenIssuesCountService do
       end
     end
 
-    context '#refresh_cache', :use_clean_rails_memory_store_caching do
-      let(:subject) { described_class.new(project) }
-
+    context '#refresh_cache' do
       before do
         create(:issue, :opened, project: project)
         create(:issue, :opened, project: project)
diff --git a/spec/services/projects/open_merge_requests_count_service_spec.rb b/spec/services/projects/open_merge_requests_count_service_spec.rb
index 0d8227f7db5..f9fff4cbd4c 100644
--- a/spec/services/projects/open_merge_requests_count_service_spec.rb
+++ b/spec/services/projects/open_merge_requests_count_service_spec.rb
@@ -2,16 +2,21 @@
 
 require 'spec_helper'
 
-describe Projects::OpenMergeRequestsCountService do
+describe Projects::OpenMergeRequestsCountService, :use_clean_rails_memory_store_caching do
+  set(:project) { create(:project) }
+
+  subject { described_class.new(project) }
+
+  it_behaves_like 'a counter caching service'
+
   describe '#count' do
     it 'returns the number of open merge requests' do
-      project = create(:project)
       create(:merge_request,
              :opened,
              source_project: project,
              target_project: project)
 
-      expect(described_class.new(project).count).to eq(1)
+      expect(subject.count).to eq(1)
     end
   end
 end
diff --git a/spec/services/users/keys_count_service_spec.rb b/spec/services/users/keys_count_service_spec.rb
index bee8380e8b7..6b7493f343f 100644
--- a/spec/services/users/keys_count_service_spec.rb
+++ b/spec/services/users/keys_count_service_spec.rb
@@ -4,7 +4,9 @@ require 'spec_helper'
 
 describe Users::KeysCountService, :use_clean_rails_memory_store_caching do
   let(:user) { create(:user) }
-  let(:service) { described_class.new(user) }
+  subject { described_class.new(user) }
+
+  it_behaves_like 'a counter caching service'
 
   describe '#count' do
     before do
@@ -12,53 +14,19 @@ describe Users::KeysCountService, :use_clean_rails_memory_store_caching do
     end
 
     it 'returns the number of SSH keys as an Integer' do
-      expect(service.count).to eq(1)
-    end
-
-    it 'caches the number of keys in Redis', :request_store do
-      service.delete_cache
-      control_count = ActiveRecord::QueryRecorder.new { service.count }.count
-      service.delete_cache
-
-      expect { 2.times { service.count } }.not_to exceed_query_limit(control_count)
-    end
-  end
-
-  describe '#refresh_cache' do
-    it 'refreshes the Redis cache' do
-      Rails.cache.write(service.cache_key, 10)
-      service.refresh_cache
-
-      expect(Rails.cache.fetch(service.cache_key, raw: true)).to be_zero
-    end
-  end
-
-  describe '#delete_cache' do
-    it 'removes the cache' do
-      service.count
-      service.delete_cache
-
-      expect(Rails.cache.fetch(service.cache_key, raw: true)).to be_nil
+      expect(subject.count).to eq(1)
     end
   end
 
   describe '#uncached_count' do
     it 'returns the number of SSH keys' do
-      expect(service.uncached_count).to be_zero
-    end
-
-    it 'does not cache the number of keys' do
-      recorder = ActiveRecord::QueryRecorder.new do
-        2.times { service.uncached_count }
-      end
-
-      expect(recorder.count).to be > 0
+      expect(subject.uncached_count).to be_zero
     end
   end
 
   describe '#cache_key' do
     it 'returns the cache key' do
-      expect(service.cache_key).to eq("users/key-count-service/#{user.id}")
+      expect(subject.cache_key).to eq("users/key-count-service/#{user.id}")
     end
   end
 end
diff --git a/spec/support/shared_examples/services/count_service_shared_examples.rb b/spec/support/shared_examples/services/count_service_shared_examples.rb
new file mode 100644
index 00000000000..9bea180a778
--- /dev/null
+++ b/spec/support/shared_examples/services/count_service_shared_examples.rb
@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+# The calling spec should use `:use_clean_rails_memory_store_caching`
+# when including this shared example. E.g.:
+#
+#   describe MyCountService, :use_clean_rails_memory_store_caching do
+#     it_behaves_like 'a counter caching service'
+#   end
+shared_examples 'a counter caching service' do
+  describe '#count' do
+    it 'caches the count', :request_store do
+      subject.delete_cache
+      control_count = ActiveRecord::QueryRecorder.new { subject.count }.count
+      subject.delete_cache
+
+      expect { 2.times { subject.count } }.not_to exceed_query_limit(control_count)
+    end
+  end
+
+  describe '#refresh_cache' do
+    it 'refreshes the cache' do
+      original_count = subject.count
+      Rails.cache.write(subject.cache_key, original_count + 1, raw: subject.raw?)
+
+      subject.refresh_cache
+
+      expect(fetch_cache || 0).to eq(original_count)
+    end
+  end
+
+  describe '#delete_cache' do
+    it 'removes the cache' do
+      subject.count
+      subject.delete_cache
+
+      expect(fetch_cache).to be_nil
+    end
+  end
+
+  describe '#uncached_count' do
+    it 'does not cache the count' do
+      subject.delete_cache
+      subject.uncached_count
+
+      expect(fetch_cache).to be_nil
+    end
+  end
+
+  private
+
+  def fetch_cache
+    Rails.cache.read(subject.cache_key, raw: subject.raw?)
+  end
+end
-- 
cgit v1.2.1


From 2022e6799bcbf119ea80145e4993ffdb7bb108e3 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Tue, 27 Aug 2019 06:07:38 -0700
Subject: Makes LFS object linker process OIDs in batches

During a project import, `LfsLinkService` attempts to link `LfsObjects`
that have not already been associated with a project.  It's possible for
a large repo to have thousands of OIDs, which can cause long database
query and parsing times.  By processing a batch of 1000 at a time, we
can reduce that time at the expense of a few more SQL queries.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66274
---
 app/models/lfs_object.rb                           |  1 +
 .../projects/lfs_pointers/lfs_link_service.rb      | 29 ++++++++++++++++++----
 changelogs/unreleased/sh-lfs-object-batches.yml    |  5 ++++
 .../projects/lfs_pointers/lfs_link_service_spec.rb | 18 ++++++++++++++
 4 files changed, 48 insertions(+), 5 deletions(-)
 create mode 100644 changelogs/unreleased/sh-lfs-object-batches.yml

diff --git a/app/models/lfs_object.rb b/app/models/lfs_object.rb
index 79a376ff0fd..40695a97d97 100644
--- a/app/models/lfs_object.rb
+++ b/app/models/lfs_object.rb
@@ -2,6 +2,7 @@
 
 class LfsObject < ApplicationRecord
   include AfterCommitQueue
+  include EachBatch
   include ObjectStorage::BackgroundMove
 
   has_many :lfs_objects_projects, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
diff --git a/app/services/projects/lfs_pointers/lfs_link_service.rb b/app/services/projects/lfs_pointers/lfs_link_service.rb
index e3c956250f0..38de2af9c1e 100644
--- a/app/services/projects/lfs_pointers/lfs_link_service.rb
+++ b/app/services/projects/lfs_pointers/lfs_link_service.rb
@@ -4,6 +4,8 @@
 module Projects
   module LfsPointers
     class LfsLinkService < BaseService
+      BATCH_SIZE = 1000
+
       # Accept an array of oids to link
       #
       # Returns an array with the oid of the existent lfs objects
@@ -18,16 +20,33 @@ module Projects
 
       # rubocop: disable CodeReuse/ActiveRecord
       def link_existing_lfs_objects(oids)
-        existent_lfs_objects = LfsObject.where(oid: oids)
+        all_existing_objects = []
+        iterations = 0
+
+        LfsObject.where(oid: oids).each_batch(of: BATCH_SIZE) do |existent_lfs_objects|
+          next unless existent_lfs_objects.any?
+
+          iterations += 1
+          not_linked_lfs_objects = existent_lfs_objects.where.not(id: project.all_lfs_objects)
+          project.all_lfs_objects << not_linked_lfs_objects
 
-        return [] unless existent_lfs_objects.any?
+          all_existing_objects += existent_lfs_objects.pluck(:oid)
+        end
 
-        not_linked_lfs_objects = existent_lfs_objects.where.not(id: project.all_lfs_objects)
-        project.all_lfs_objects << not_linked_lfs_objects
+        log_lfs_link_results(all_existing_objects.count, iterations)
 
-        existent_lfs_objects.pluck(:oid)
+        all_existing_objects
       end
       # rubocop: enable CodeReuse/ActiveRecord
+
+      def log_lfs_link_results(lfs_objects_linked_count, iterations)
+        Gitlab::Import::Logger.info(
+          class: self.class.name,
+          project_id: project.id,
+          project_path: project.full_path,
+          lfs_objects_linked_count: lfs_objects_linked_count,
+          iterations: iterations)
+      end
     end
   end
 end
diff --git a/changelogs/unreleased/sh-lfs-object-batches.yml b/changelogs/unreleased/sh-lfs-object-batches.yml
new file mode 100644
index 00000000000..09043e286be
--- /dev/null
+++ b/changelogs/unreleased/sh-lfs-object-batches.yml
@@ -0,0 +1,5 @@
+---
+title: Makes LFS object linker process OIDs in batches
+merge_request: 32268
+author:
+type: performance
diff --git a/spec/services/projects/lfs_pointers/lfs_link_service_spec.rb b/spec/services/projects/lfs_pointers/lfs_link_service_spec.rb
index 849601c4a63..66233787d3a 100644
--- a/spec/services/projects/lfs_pointers/lfs_link_service_spec.rb
+++ b/spec/services/projects/lfs_pointers/lfs_link_service_spec.rb
@@ -30,5 +30,23 @@ describe Projects::LfsPointers::LfsLinkService do
 
       expect(subject.execute(new_oid_list.keys)).to eq linked
     end
+
+    it 'links in batches' do
+      stub_const("#{described_class}::BATCH_SIZE", 3)
+
+      expect(Gitlab::Import::Logger)
+        .to receive(:info)
+        .with(class: described_class.name,
+              project_id: project.id,
+              project_path: project.full_path,
+              lfs_objects_linked_count: 7,
+              iterations: 3)
+
+      lfs_objects = create_list(:lfs_object, 7)
+      linked = subject.execute(lfs_objects.pluck(:oid))
+
+      expect(project.all_lfs_objects.count).to eq 9
+      expect(linked.size).to eq 7
+    end
   end
 end
-- 
cgit v1.2.1


From 57064514837ab3b03f246382765b3371792f6ffe Mon Sep 17 00:00:00 2001
From: Russell Dickenson <rdickenson@gitlab.com>
Date: Wed, 28 Aug 2019 00:52:52 +0000
Subject: Change reference to Mattermost versions.

Changed reference to Mattermost versions, so that it's clear which
menu navigation path applies.
---
 doc/user/project/integrations/mattermost.md | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/doc/user/project/integrations/mattermost.md b/doc/user/project/integrations/mattermost.md
index 6e0f39956d3..c240b6cb6b4 100644
--- a/doc/user/project/integrations/mattermost.md
+++ b/doc/user/project/integrations/mattermost.md
@@ -13,8 +13,13 @@ To enable Mattermost integration you must create an incoming webhook integration
 1. Choose a display name, description and channel, those can be overridden on GitLab.
 1. Save it, copy the **Webhook URL**, we'll need this later for GitLab.
 
-There might be some cases that Incoming Webhooks are blocked by admin, ask your mattermost admin to enable
-it on **Mattermost System Console > Integrations > Integration Management**, or on **Mattermost System Console > Integrations > Custom Integrations** in Mattermost versions 5.11 and earlier.
+Incoming Webhooks might be blocked on your Mattermost instance. Ask your Mattermost admin
+to enable it on:
+
+- **Mattermost System Console > Integrations > Integration Management** in Mattermost
+  versions 5.12 and later.
+- **Mattermost System Console > Integrations > Custom Integrations** in Mattermost
+  versions 5.11 and earlier.
 
 Display name override is not enabled by default, you need to ask your admin to enable it on that same section.
 
-- 
cgit v1.2.1


From 88f63242fbd2b6778af49b6ff09c53f7b1bac27c Mon Sep 17 00:00:00 2001
From: Eugenia Grieff <egrieff@gitlab.com>
Date: Wed, 28 Aug 2019 01:01:49 +0000
Subject: Update group permissions table documentation

---
 doc/user/permissions.md | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/doc/user/permissions.md b/doc/user/permissions.md
index 80d1bf992ec..c28a5e49ec4 100644
--- a/doc/user/permissions.md
+++ b/doc/user/permissions.md
@@ -204,27 +204,29 @@ Any user can remove themselves from a group, unless they are the last Owner of
 the group. The following table depicts the various user permission levels in a
 group.
 
-| Action                                          | Guest | Reporter | Developer | Maintainer | Owner |
-|-------------------------------------------------|-------|----------|-----------|------------|-------|
-| Browse group                                    | ✓     | ✓        | ✓         | ✓          | ✓     |
-| View Insights charts **(ULTIMATE)**             | ✓     | ✓        | ✓         | ✓          | ✓     |
-| View group epic **(ULTIMATE)**                  | ✓     | ✓        | ✓         | ✓          | ✓     |
-| Create/edit group epic **(ULTIMATE)**           |       | ✓        | ✓         | ✓          | ✓     |
-| Manage group labels                             |       | ✓        | ✓         | ✓          | ✓     |
-| Create project in group                         |       |          | ✓         | ✓          | ✓     |
-| Create/edit/delete group milestones             |       |          | ✓         | ✓          | ✓     |
-| Enable/disable a dependency proxy **(PREMIUM)** |       |          | ✓         | ✓          | ✓     |
-| Use security dashboard **(ULTIMATE)**           |       |          | ✓         | ✓          | ✓     |
-| Create subgroup                                 |       |          |           | ✓ (1)      | ✓     |
-| Edit group                                      |       |          |           |            | ✓     |
-| Manage group members                            |       |          |           |            | ✓     |
-| Remove group                                    |       |          |           |            | ✓     |
-| Delete group epic **(ULTIMATE)**                |       |          |           |            | ✓     |
-| View group Audit Events                         |       |          |           |            | ✓     |
-| Disable notification emails                     |       |          |           |            | ✓     |
+| Action                                                 | Guest | Reporter | Developer | Maintainer | Owner |
+|--------------------------------------------------------|-------|----------|-----------|------------|-------|
+| Browse group                                           | ✓     | ✓        | ✓         | ✓          | ✓     |
+| View Insights charts **(ULTIMATE)**                    | ✓     | ✓        | ✓         | ✓          | ✓     |
+| View group epic **(ULTIMATE)**                         | ✓     | ✓        | ✓         | ✓          | ✓     |
+| Create/edit group epic **(ULTIMATE)**                  |       | ✓        | ✓         | ✓          | ✓     |
+| Manage group labels                                    |       | ✓        | ✓         | ✓          | ✓     |
+| Create project in group                                |       |          | ✓         | ✓          | ✓     |
+| Create/edit/delete group milestones                    |       |          | ✓         | ✓          | ✓     |
+| Enable/disable a dependency proxy **(PREMIUM)**        |       |          | ✓         | ✓          | ✓     |
+| Use security dashboard **(ULTIMATE)**                  |       |          | ✓         | ✓          | ✓     |
+| Create subgroup                                        |       |          |           | ✓ (1)      | ✓     |
+| Edit group                                             |       |          |           |            | ✓     |
+| Manage group members                                   |       |          |           |            | ✓     |
+| Remove group                                           |       |          |           |            | ✓     |
+| Delete group epic **(ULTIMATE)**                       |       |          |           |            | ✓     |
+| Edit epic comments (posted by any user) **(ULTIMATE)** |       |          |           | ✓ (2)      | ✓ (2) |
+| View group Audit Events                                |       |          |           |            | ✓     |
+| Disable notification emails                            |       |          |           |            | ✓     |
 
 - (1): Groups can be set to [allow either Owners or Owners and
   Maintainers to create subgroups](group/subgroups/index.md#creating-a-subgroup)
+- (2): Introduced in GitLab 12.2.
 
 ### Subgroup permissions
 
-- 
cgit v1.2.1


From 4ca32c2b55519aa2b7852c879ad700e8fa290f80 Mon Sep 17 00:00:00 2001
From: Arun Kumar Mohan <arunmohandm@gmail.com>
Date: Thu, 27 Jun 2019 00:56:08 -0500
Subject: Add Issue and Merge Request titles to Todo items

Only displays the todo body if the todo has a note.
This is to avoid redundant Issue or Merge Request titles
displayed both in the Todo title and body.
---
 app/assets/stylesheets/pages/todos.scss            | 16 +++++-----
 app/helpers/todos_helper.rb                        | 18 ++++++++++-
 app/models/todo.rb                                 |  4 +--
 app/views/dashboard/todos/_todo.html.haml          | 34 ++++++++++++--------
 .../unreleased/todos-include-issue-mr-titles.yml   |  5 +++
 locale/gitlab.pot                                  |  3 ++
 .../dashboard/todos/todos_filtering_spec.rb        | 12 ++++----
 .../features/dashboard/todos/todos_sorting_spec.rb | 36 +++++++++++-----------
 spec/features/dashboard/todos/todos_spec.rb        | 18 +++++------
 spec/models/todo_spec.rb                           |  4 +--
 10 files changed, 90 insertions(+), 60 deletions(-)
 create mode 100644 changelogs/unreleased/todos-include-issue-mr-titles.yml

diff --git a/app/assets/stylesheets/pages/todos.scss b/app/assets/stylesheets/pages/todos.scss
index 7b64c67ae34..ece0ac04baf 100644
--- a/app/assets/stylesheets/pages/todos.scss
+++ b/app/assets/stylesheets/pages/todos.scss
@@ -72,12 +72,7 @@
   @include transition(opacity);
 
   .todo-title {
-    display: flex;
-
     > .title-item {
-      flex: 0 0 auto;
-      margin: 0 2px;
-
       &:first-child {
         margin-left: 0;
       }
@@ -105,8 +100,12 @@
     font-size: 14px;
   }
 
-  .action-name {
-    font-weight: $gl-font-weight-normal;
+  .todo-label,
+  .todo-project {
+    a {
+      color: $blue-600;
+      font-weight: $gl-font-weight-normal;
+    }
   }
 
   .todo-body {
@@ -170,7 +169,7 @@
   }
 }
 
-@include media-breakpoint-down(xs) {
+@include media-breakpoint-down(sm) {
   .todo {
     .avatar {
       display: none;
@@ -179,7 +178,6 @@
 
   .todo-item {
     .todo-title {
-      flex-flow: row wrap;
       margin-bottom: 10px;
 
       .todo-label {
diff --git a/app/helpers/todos_helper.rb b/app/helpers/todos_helper.rb
index 38142bc68cb..f5333bb332e 100644
--- a/app/helpers/todos_helper.rb
+++ b/app/helpers/todos_helper.rb
@@ -33,7 +33,23 @@ module TodosHelper
         todo.target_reference
       end
 
-    link_to text, todo_target_path(todo), class: 'has-tooltip', title: todo.target.title
+    link_to text, todo_target_path(todo)
+  end
+
+  def todo_target_title(todo)
+    if todo.target
+      "\"#{todo.target.title}\""
+    else
+      ""
+    end
+  end
+
+  def todo_parent_path(todo)
+    if todo.parent.is_a?(Group)
+      link_to todo.parent.name, group_path(todo.parent)
+    else
+      link_to_project(todo.project)
+    end
   end
 
   def todo_target_type_name(todo)
diff --git a/app/models/todo.rb b/app/models/todo.rb
index 240c91da5b6..1ec04189482 100644
--- a/app/models/todo.rb
+++ b/app/models/todo.rb
@@ -186,9 +186,9 @@ class Todo < ApplicationRecord
 
   def target_reference
     if for_commit?
-      target.reference_link_text(full: true)
+      target.reference_link_text
     else
-      target.to_reference(full: true)
+      target.to_reference
     end
   end
 
diff --git a/app/views/dashboard/todos/_todo.html.haml b/app/views/dashboard/todos/_todo.html.haml
index 8cdfc7369a0..fdb71d3a221 100644
--- a/app/views/dashboard/todos/_todo.html.haml
+++ b/app/views/dashboard/todos/_todo.html.haml
@@ -2,41 +2,49 @@
   .todo-avatar
     = author_avatar(todo, size: 40)
 
-  .todo-item.todo-block
-    .todo-title.title
+  .todo-item.todo-block.align-self-center
+    .todo-title
       - unless todo.build_failed? || todo.unmergeable?
         = todo_target_state_pill(todo)
 
-        .title-item.author-name
+        %span.title-item.author-name.bold
           - if todo.author
             = link_to_author(todo, self_added: todo.self_added?)
           - else
             (removed)
 
-      .title-item.action-name
+      %span.title-item.action-name
         = todo_action_name(todo)
 
-      .title-item.todo-label
+      %span.title-item.todo-label.todo-target-link
         - if todo.target
           = todo_target_link(todo)
         - else
-          (removed)
+          = _("(removed)")
+
+      %span.title-item.todo-target-title
+        = todo_target_title(todo)
+
+      %span.title-item.todo-project.todo-label
+        at
+        = todo_parent_path(todo)
 
       - if todo.self_assigned?
-        .title-item.action-name
+        %span.title-item.action-name
           to yourself
 
-      .title-item
+      %span.title-item
         &middot;
 
-      .title-item
+      %span.title-item.todo-timestamp
         #{time_ago_with_tooltip(todo.created_at)}
         = todo_due_date(todo)
 
-    .todo-body
-      .todo-note.break-word
-        .md
-          = first_line_in_markdown(todo, :body, 150, project: todo.project)
+    - if todo.note.present?
+      .todo-body
+        .todo-note.break-word
+          .md
+            = first_line_in_markdown(todo, :body, 150, project: todo.project)
 
   - if todo.pending?
     .todo-actions
diff --git a/changelogs/unreleased/todos-include-issue-mr-titles.yml b/changelogs/unreleased/todos-include-issue-mr-titles.yml
new file mode 100644
index 00000000000..a9fb9116070
--- /dev/null
+++ b/changelogs/unreleased/todos-include-issue-mr-titles.yml
@@ -0,0 +1,5 @@
+---
+title: Add Issue and Merge Request titles to Todo items
+merge_request: 30435
+author: Arun Kumar Mohan
+type: changed
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 0568bdbdfca..0cd177f99f6 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -309,6 +309,9 @@ msgstr ""
 msgid "(external source)"
 msgstr ""
 
+msgid "(removed)"
+msgstr ""
+
 msgid "+ %{amount} more"
 msgstr ""
 
diff --git a/spec/features/dashboard/todos/todos_filtering_spec.rb b/spec/features/dashboard/todos/todos_filtering_spec.rb
index f273e416597..efa163042f9 100644
--- a/spec/features/dashboard/todos/todos_filtering_spec.rb
+++ b/spec/features/dashboard/todos/todos_filtering_spec.rb
@@ -31,9 +31,9 @@ describe 'Dashboard > User filters todos', :js do
   end
 
   it 'displays all todos without a filter' do
-    expect(page).to have_content issue1.to_reference(full: true)
-    expect(page).to have_content merge_request.to_reference(full: true)
-    expect(page).to have_content issue2.to_reference(full: true)
+    expect(page).to have_content issue1.to_reference(full: false)
+    expect(page).to have_content merge_request.to_reference(full: false)
+    expect(page).to have_content issue2.to_reference(full: false)
   end
 
   it 'filters by project' do
@@ -58,9 +58,9 @@ describe 'Dashboard > User filters todos', :js do
 
     wait_for_requests
 
-    expect(page).to     have_content issue1.to_reference(full: true)
-    expect(page).to     have_content merge_request.to_reference(full: true)
-    expect(page).not_to have_content issue2.to_reference(full: true)
+    expect(page).to     have_content "issue #{issue1.to_reference} \"issue\" at #{group1.name} / project_1"
+    expect(page).to     have_content "merge request #{merge_request.to_reference}"
+    expect(page).not_to have_content "issue #{issue2.to_reference} \"issue\" at #{group2.name} / project_3"
   end
 
   context 'Author filter' do
diff --git a/spec/features/dashboard/todos/todos_sorting_spec.rb b/spec/features/dashboard/todos/todos_sorting_spec.rb
index 3870c661784..421a66c6d48 100644
--- a/spec/features/dashboard/todos/todos_sorting_spec.rb
+++ b/spec/features/dashboard/todos/todos_sorting_spec.rb
@@ -42,33 +42,33 @@ describe 'Dashboard > User sorts todos' do
       click_link 'Last created'
 
       results_list = page.find('.todos-list')
-      expect(results_list.all('p')[0]).to have_content('merge_request_1')
-      expect(results_list.all('p')[1]).to have_content('issue_1')
-      expect(results_list.all('p')[2]).to have_content('issue_3')
-      expect(results_list.all('p')[3]).to have_content('issue_2')
-      expect(results_list.all('p')[4]).to have_content('issue_4')
+      expect(results_list.all('.todo-title')[0]).to have_content('merge_request_1')
+      expect(results_list.all('.todo-title')[1]).to have_content('issue_1')
+      expect(results_list.all('.todo-title')[2]).to have_content('issue_3')
+      expect(results_list.all('.todo-title')[3]).to have_content('issue_2')
+      expect(results_list.all('.todo-title')[4]).to have_content('issue_4')
     end
 
     it 'sorts with newest created todos first' do
       click_link 'Oldest created'
 
       results_list = page.find('.todos-list')
-      expect(results_list.all('p')[0]).to have_content('issue_4')
-      expect(results_list.all('p')[1]).to have_content('issue_2')
-      expect(results_list.all('p')[2]).to have_content('issue_3')
-      expect(results_list.all('p')[3]).to have_content('issue_1')
-      expect(results_list.all('p')[4]).to have_content('merge_request_1')
+      expect(results_list.all('.todo-title')[0]).to have_content('issue_4')
+      expect(results_list.all('.todo-title')[1]).to have_content('issue_2')
+      expect(results_list.all('.todo-title')[2]).to have_content('issue_3')
+      expect(results_list.all('.todo-title')[3]).to have_content('issue_1')
+      expect(results_list.all('.todo-title')[4]).to have_content('merge_request_1')
     end
 
     it 'sorts by label priority' do
       click_link 'Label priority'
 
       results_list = page.find('.todos-list')
-      expect(results_list.all('p')[0]).to have_content('issue_3')
-      expect(results_list.all('p')[1]).to have_content('merge_request_1')
-      expect(results_list.all('p')[2]).to have_content('issue_1')
-      expect(results_list.all('p')[3]).to have_content('issue_2')
-      expect(results_list.all('p')[4]).to have_content('issue_4')
+      expect(results_list.all('.todo-title')[0]).to have_content('issue_3')
+      expect(results_list.all('.todo-title')[1]).to have_content('merge_request_1')
+      expect(results_list.all('.todo-title')[2]).to have_content('issue_1')
+      expect(results_list.all('.todo-title')[3]).to have_content('issue_2')
+      expect(results_list.all('.todo-title')[4]).to have_content('issue_4')
     end
   end
 
@@ -93,9 +93,9 @@ describe 'Dashboard > User sorts todos' do
       click_link 'Label priority'
 
       results_list = page.find('.todos-list')
-      expect(results_list.all('p')[0]).to have_content('issue_1')
-      expect(results_list.all('p')[1]).to have_content('issue_2')
-      expect(results_list.all('p')[2]).to have_content('merge_request_1')
+      expect(results_list.all('.todo-title')[0]).to have_content('issue_1')
+      expect(results_list.all('.todo-title')[1]).to have_content('issue_2')
+      expect(results_list.all('.todo-title')[2]).to have_content('merge_request_1')
     end
   end
 end
diff --git a/spec/features/dashboard/todos/todos_spec.rb b/spec/features/dashboard/todos/todos_spec.rb
index b98a04b0bda..867281da1e6 100644
--- a/spec/features/dashboard/todos/todos_spec.rb
+++ b/spec/features/dashboard/todos/todos_spec.rb
@@ -3,10 +3,10 @@
 require 'spec_helper'
 
 describe 'Dashboard Todos' do
-  let(:user)    { create(:user) }
+  let(:user)    { create(:user, username: 'john') }
   let(:author)  { create(:user) }
   let(:project) { create(:project, :public) }
-  let(:issue)   { create(:issue, due_date: Date.today) }
+  let(:issue)   { create(:issue, due_date: Date.today, title: "Fix bug") }
 
   context 'User does not have todos' do
     before do
@@ -135,7 +135,7 @@ describe 'Dashboard Todos' do
 
       it 'shows issue assigned to yourself message' do
         page.within('.js-todos-all') do
-          expect(page).to have_content("You assigned issue #{issue.to_reference(full: true)} to yourself")
+          expect(page).to have_content("You assigned issue #{issue.to_reference} \"Fix bug\" at #{project.namespace.owner_name} / #{project.name} to yourself")
         end
       end
     end
@@ -148,7 +148,7 @@ describe 'Dashboard Todos' do
 
       it 'shows you added a todo message' do
         page.within('.js-todos-all') do
-          expect(page).to have_content("You added a todo for issue #{issue.to_reference(full: true)}")
+          expect(page).to have_content("You added a todo for issue #{issue.to_reference} \"Fix bug\" at #{project.namespace.owner_name} / #{project.name}")
           expect(page).not_to have_content('to yourself')
         end
       end
@@ -162,7 +162,7 @@ describe 'Dashboard Todos' do
 
       it 'shows you mentioned yourself message' do
         page.within('.js-todos-all') do
-          expect(page).to have_content("You mentioned yourself on issue #{issue.to_reference(full: true)}")
+          expect(page).to have_content("You mentioned yourself on issue #{issue.to_reference} \"Fix bug\" at #{project.namespace.owner_name} / #{project.name}")
           expect(page).not_to have_content('to yourself')
         end
       end
@@ -176,14 +176,14 @@ describe 'Dashboard Todos' do
 
       it 'shows you directly addressed yourself message' do
         page.within('.js-todos-all') do
-          expect(page).to have_content("You directly addressed yourself on issue #{issue.to_reference(full: true)}")
+          expect(page).to have_content("You directly addressed yourself on issue #{issue.to_reference} \"Fix bug\" at #{project.namespace.owner_name} / #{project.name}")
           expect(page).not_to have_content('to yourself')
         end
       end
     end
 
     context 'approval todo' do
-      let(:merge_request) { create(:merge_request) }
+      let(:merge_request) { create(:merge_request, title: "Fixes issue") }
 
       before do
         create(:todo, :approval_required, user: user, project: project, target: merge_request, author: user)
@@ -192,7 +192,7 @@ describe 'Dashboard Todos' do
 
       it 'shows you set yourself as an approver message' do
         page.within('.js-todos-all') do
-          expect(page).to have_content("You set yourself as an approver for merge request #{merge_request.to_reference(full: true)}")
+          expect(page).to have_content("You set yourself as an approver for merge request #{merge_request.to_reference} \"Fixes issue\" at #{project.namespace.owner_name} / #{project.name}")
           expect(page).not_to have_content('to yourself')
         end
       end
@@ -354,7 +354,7 @@ describe 'Dashboard Todos' do
     it 'links to the pipelines for the merge request' do
       href = pipelines_project_merge_request_path(project, todo.target)
 
-      expect(page).to have_link "merge request #{todo.target.to_reference(full: true)}", href: href
+      expect(page).to have_link "merge request #{todo.target.to_reference}", href: href
     end
   end
 end
diff --git a/spec/models/todo_spec.rb b/spec/models/todo_spec.rb
index 9aeef7c3b4b..ce17704acbd 100644
--- a/spec/models/todo_spec.rb
+++ b/spec/models/todo_spec.rb
@@ -121,12 +121,12 @@ describe Todo do
       subject.target_type = 'Commit'
       subject.commit_id = commit.id
 
-      expect(subject.target_reference).to eq commit.reference_link_text(full: true)
+      expect(subject.target_reference).to eq commit.reference_link_text(full: false)
     end
 
     it 'returns full reference for issuables' do
       subject.target = issue
-      expect(subject.target_reference).to eq issue.to_reference(full: true)
+      expect(subject.target_reference).to eq issue.to_reference(full: false)
     end
   end
 
-- 
cgit v1.2.1


From e3569c70b9f65b6267a565f521daec5c2f8ee987 Mon Sep 17 00:00:00 2001
From: Mark Lapierre <mlapierre@gitlab.com>
Date: Tue, 27 Aug 2019 14:14:02 +1000
Subject: Commit to current branch by default

When using the Web IDE
---
 app/assets/javascripts/ide/components/commit_sidebar/actions.vue | 6 +++++-
 qa/qa/page/project/web_ide/edit.rb                               | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/app/assets/javascripts/ide/components/commit_sidebar/actions.vue b/app/assets/javascripts/ide/components/commit_sidebar/actions.vue
index 8b356ee6e97..549324831e9 100644
--- a/app/assets/javascripts/ide/components/commit_sidebar/actions.vue
+++ b/app/assets/javascripts/ide/components/commit_sidebar/actions.vue
@@ -69,7 +69,11 @@ export default {
       :disabled="currentBranch && !currentBranch.can_push"
       :title="$options.currentBranchPermissionsTooltip"
     >
-      <span class="ide-radio-label" v-html="commitToCurrentBranchText"> </span>
+      <span
+        class="ide-radio-label"
+        data-qa-selector="commit_to_current_branch_radio"
+        v-html="commitToCurrentBranchText"
+      ></span>
     </radio-group>
     <radio-group
       :value="$options.commitToNewBranch"
diff --git a/qa/qa/page/project/web_ide/edit.rb b/qa/qa/page/project/web_ide/edit.rb
index 37bca97fec7..7541baed467 100644
--- a/qa/qa/page/project/web_ide/edit.rb
+++ b/qa/qa/page/project/web_ide/edit.rb
@@ -34,6 +34,10 @@ module QA
             element :dropdown_filter_input
           end
 
+          view 'app/assets/javascripts/ide/components/commit_sidebar/actions.vue' do
+            element :commit_to_current_branch_radio
+          end
+
           view 'app/assets/javascripts/ide/components/commit_sidebar/form.vue' do
             element :begin_commit_button
             element :commit_button
@@ -104,7 +108,7 @@ module QA
             # animation is still in process even when the buttons have the
             # expected visibility.
             commit_success_msg_shown = retry_until do
-              uncheck_element :start_new_mr_checkbox
+              click_element :commit_to_current_branch_radio
               click_element :commit_button
 
               wait(reload: false) do
-- 
cgit v1.2.1


From fa674fa5e624a2bae7bc07ab28df0ede4edfef36 Mon Sep 17 00:00:00 2001
From: Doug Stull <dstull@gitlab.com>
Date: Wed, 28 Aug 2019 01:29:52 +0000
Subject: Rename dev, org, com helper

---
 lib/gitlab.rb           |  2 +-
 spec/lib/gitlab_spec.rb | 27 +++++++++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/lib/gitlab.rb b/lib/gitlab.rb
index d9d8dcf7900..e8b938e46b1 100644
--- a/lib/gitlab.rb
+++ b/lib/gitlab.rb
@@ -55,7 +55,7 @@ module Gitlab
     SUBDOMAIN_REGEX === Gitlab.config.gitlab.url
   end
 
-  def self.dev_env_or_com?
+  def self.dev_env_org_or_com?
     Rails.env.development? || org? || com?
   end
 
diff --git a/spec/lib/gitlab_spec.rb b/spec/lib/gitlab_spec.rb
index cbc5649fc09..1fc363460ae 100644
--- a/spec/lib/gitlab_spec.rb
+++ b/spec/lib/gitlab_spec.rb
@@ -98,6 +98,33 @@ describe Gitlab do
     end
   end
 
+  describe '.dev_env_org_or_com?' do
+    it 'is true when on .com' do
+      allow(described_class).to receive_messages(com?: true, org?: false)
+
+      expect(described_class.dev_env_org_or_com?).to eq true
+    end
+
+    it 'is true when org' do
+      allow(described_class).to receive_messages(com?: false, org?: true)
+
+      expect(described_class.dev_env_org_or_com?).to eq true
+    end
+
+    it 'is true when dev env' do
+      allow(described_class).to receive_messages(com?: false, org?: false)
+      allow(Rails).to receive(:env).and_return(ActiveSupport::StringInquirer.new('development'))
+
+      expect(described_class.dev_env_org_or_com?).to eq true
+    end
+
+    it 'is false when not dev, org or com' do
+      allow(described_class).to receive_messages(com?: false, org?: false)
+
+      expect(described_class.dev_env_org_or_com?).to eq false
+    end
+  end
+
   describe '.ee?' do
     before do
       described_class.instance_variable_set(:@is_ee, nil)
-- 
cgit v1.2.1


From 9c6b35e370583db382fe260c288cd8694b561c3a Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Wed, 28 Aug 2019 01:32:09 +0000
Subject: Resolving minor formatting issues in gitlab-basics

---
 doc/gitlab-basics/add-merge-request.md    | 2 --
 doc/gitlab-basics/create-project.md       | 2 +-
 doc/gitlab-basics/create-your-ssh-keys.md | 2 +-
 3 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/doc/gitlab-basics/add-merge-request.md b/doc/gitlab-basics/add-merge-request.md
index 1a6a26152fa..28f32fefb95 100644
--- a/doc/gitlab-basics/add-merge-request.md
+++ b/doc/gitlab-basics/add-merge-request.md
@@ -12,8 +12,6 @@ check the [merge requests documentation](../user/project/merge_requests/index.md
 you can watch our [GitLab Flow video](https://www.youtube.com/watch?v=InKNIvky2KE) for
 a quick overview of working with merge requests.
 
----
-
 1. Before you start, you should have already [created a branch](create-branch.md)
    and [pushed your changes](start-using-git.md#send-changes-to-gitlabcom) to GitLab.
 1. Go to the project where you'd like to merge your changes and click on the
diff --git a/doc/gitlab-basics/create-project.md b/doc/gitlab-basics/create-project.md
index 8bbaf5d1927..18565daa900 100644
--- a/doc/gitlab-basics/create-project.md
+++ b/doc/gitlab-basics/create-project.md
@@ -2,7 +2,7 @@
 type: howto
 ---
 
-# Creating projects
+# Create a project
 
 Most work in GitLab is done within a [Project](../user/project/index.md). Files and
 code are saved in projects, and most features are used within the scope of projects.
diff --git a/doc/gitlab-basics/create-your-ssh-keys.md b/doc/gitlab-basics/create-your-ssh-keys.md
index 338b96374aa..98f2679c9d6 100644
--- a/doc/gitlab-basics/create-your-ssh-keys.md
+++ b/doc/gitlab-basics/create-your-ssh-keys.md
@@ -5,7 +5,7 @@ type: howto
 # Create and add your SSH public key
 
 It is best practice to use [Git over SSH instead of Git over HTTP](https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols).
-In order to use SSH, you will need to
+In order to use SSH, you will need to:
 
 1. [Create an SSH key pair](#creating-your-ssh-key-pair) on your local computer.
 1. [Add the key to GitLab](#adding-your-ssh-public-key-to-gitlab).
-- 
cgit v1.2.1


From 740cbc5acdfbf5a515cff709c425c1dccaa4f8ce Mon Sep 17 00:00:00 2001
From: Scott Stern <sstern@gitlab.com>
Date: Wed, 28 Aug 2019 02:39:39 +0000
Subject: Ss/add board name to page title

---
 app/views/shared/boards/_show.html.haml                   | 2 +-
 changelogs/unreleased/ss-add-board-name-to-page-title.yml | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/ss-add-board-name-to-page-title.yml

diff --git a/app/views/shared/boards/_show.html.haml b/app/views/shared/boards/_show.html.haml
index 4f0be117035..93fc839a371 100644
--- a/app/views/shared/boards/_show.html.haml
+++ b/app/views/shared/boards/_show.html.haml
@@ -4,7 +4,7 @@
 - @no_container = true
 - @content_class = "issue-boards-content js-focus-mode-board"
 - breadcrumb_title _("Issue Boards")
-- page_title _("Boards")
+- page_title("#{board.name}", _("Boards"))
 
 - content_for :page_specific_javascripts do
 
diff --git a/changelogs/unreleased/ss-add-board-name-to-page-title.yml b/changelogs/unreleased/ss-add-board-name-to-page-title.yml
new file mode 100644
index 00000000000..8a04972fa32
--- /dev/null
+++ b/changelogs/unreleased/ss-add-board-name-to-page-title.yml
@@ -0,0 +1,5 @@
+---
+title: Added board name to page title in boards view
+merge_request:
+author:
+type: other
-- 
cgit v1.2.1


From db18cefbe7ca1d80afe597f9580ffa251063499d Mon Sep 17 00:00:00 2001
From: Daniel Gruesso <dgruesso@gitlab.com>
Date: Wed, 28 Aug 2019 04:29:30 +0000
Subject: Remove eks from adding an existing cluster section

---
 doc/user/project/clusters/index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/user/project/clusters/index.md b/doc/user/project/clusters/index.md
index cf3a3fef79f..3bde0a375c6 100644
--- a/doc/user/project/clusters/index.md
+++ b/doc/user/project/clusters/index.md
@@ -199,7 +199,7 @@ To add an existing Kubernetes cluster to your project:
      kubectl cluster-info | grep 'Kubernetes master' | awk '/http/ {print $NF}'
      ```
 
-   - **CA certificate** (required) - A valid Kubernetes certificate is needed to authenticate to the EKS cluster. We will use the certificate created by default.
+   - **CA certificate** (required) - A valid Kubernetes certificate is needed to authenticate to the cluster. We will use the certificate created by default.
      - List the secrets with `kubectl get secrets`, and one should named similar to
       `default-token-xxxxx`. Copy that token name for use below.
      - Get the certificate by running this command:
-- 
cgit v1.2.1


From 72544449cfb8e35b8c044f5bfd08a2fae2253408 Mon Sep 17 00:00:00 2001
From: Igor Drozdov <idrozdov@gitlab.com>
Date: Mon, 26 Aug 2019 02:55:00 +0300
Subject: Change the way totalNotes is calculated

totalNotes is only used to prerender a number of
skeleton containers until real notes are loaded

issuable.discussions makes multiple requests, so
too expensive for this

This commit uses mere notes for this and sends
actual totalNotes number if it's less than 10;
otherwise it sends 10 - it allows us to avoid
bunch of skeleton prerenderings, which are not
necessary since they doesn't fit into the whole
screen and disappear quite fast
---
 app/assets/javascripts/notes/components/notes_app.vue |  4 ++--
 app/helpers/notes_helper.rb                           |  4 +++-
 app/models/concerns/noteable.rb                       |  4 ++++
 spec/javascripts/notes/mock_data.js                   |  2 +-
 spec/models/concerns/noteable_spec.rb                 | 18 ++++++++++++++++++
 5 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/app/assets/javascripts/notes/components/notes_app.vue b/app/assets/javascripts/notes/components/notes_app.vue
index a0695f9e191..16a0fb3f33a 100644
--- a/app/assets/javascripts/notes/components/notes_app.vue
+++ b/app/assets/javascripts/notes/components/notes_app.vue
@@ -75,9 +75,9 @@ export default {
     },
     allDiscussions() {
       if (this.isLoading) {
-        const totalNotes = parseInt(this.notesData.totalNotes, 10) || 0;
+        const prerenderedNotesCount = parseInt(this.notesData.prerenderedNotesCount, 10) || 0;
 
-        return new Array(totalNotes).fill({
+        return new Array(prerenderedNotesCount).fill({
           isSkeletonNote: true,
         });
       }
diff --git a/app/helpers/notes_helper.rb b/app/helpers/notes_helper.rb
index 2e31a5e2ed4..4e88b379e16 100644
--- a/app/helpers/notes_helper.rb
+++ b/app/helpers/notes_helper.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 module NotesHelper
+  MAX_PRERENDERED_NOTES = 10
+
   def note_target_fields(note)
     if note.noteable
       hidden_field_tag(:target_type, note.noteable.class.name.underscore) +
@@ -169,7 +171,7 @@ module NotesHelper
       closePath: close_issuable_path(issuable),
       reopenPath: reopen_issuable_path(issuable),
       notesPath: notes_url,
-      totalNotes: issuable.discussions.length,
+      prerenderedNotesCount: issuable.capped_notes_count(MAX_PRERENDERED_NOTES),
       lastFetchedAt: Time.now.to_i
     }
   end
diff --git a/app/models/concerns/noteable.rb b/app/models/concerns/noteable.rb
index 4b428b0af83..6a44bc7c401 100644
--- a/app/models/concerns/noteable.rb
+++ b/app/models/concerns/noteable.rb
@@ -73,6 +73,10 @@ module Noteable
       .discussions(self)
   end
 
+  def capped_notes_count(max)
+    notes.limit(max).count
+  end
+
   def grouped_diff_discussions(*args)
     # Doesn't use `discussion_notes`, because this may include commit diff notes
     # besides MR diff notes, that we do not want to display on the MR Changes tab.
diff --git a/spec/javascripts/notes/mock_data.js b/spec/javascripts/notes/mock_data.js
index 5f81a168498..3812d46f838 100644
--- a/spec/javascripts/notes/mock_data.js
+++ b/spec/javascripts/notes/mock_data.js
@@ -8,7 +8,7 @@ export const notesDataMock = {
   notesPath: '/gitlab-org/gitlab-ce/noteable/issue/98/notes',
   quickActionsDocsPath: '/help/user/project/quick_actions',
   registerPath: '/users/sign_in?redirect_to_referer=yes#register-pane',
-  totalNotes: 1,
+  prerenderedNotesCount: 1,
   closePath: '/twitter/flight/issues/9.json?issue%5Bstate_event%5D=close',
   reopenPath: '/twitter/flight/issues/9.json?issue%5Bstate_event%5D=reopen',
   canAwardEmoji: true,
diff --git a/spec/models/concerns/noteable_spec.rb b/spec/models/concerns/noteable_spec.rb
index e17b98536fa..929b5f52c7c 100644
--- a/spec/models/concerns/noteable_spec.rb
+++ b/spec/models/concerns/noteable_spec.rb
@@ -272,4 +272,22 @@ describe Noteable do
       expect(described_class.resolvable_types).to include('MergeRequest')
     end
   end
+
+  describe '#capped_notes_count' do
+    context 'notes number < 10' do
+      it 'the number of notes is returned' do
+        expect(subject.capped_notes_count(10)).to eq(9)
+      end
+    end
+
+    context 'notes number > 10' do
+      before do
+        create_list(:note, 2, project: project, noteable: subject)
+      end
+
+      it '10 is returned' do
+        expect(subject.capped_notes_count(10)).to eq(10)
+      end
+    end
+  end
 end
-- 
cgit v1.2.1


From 46f7674733c6289e7ced13fb86f66de792ff5eac Mon Sep 17 00:00:00 2001
From: Evan Read <eread@gitlab.com>
Date: Wed, 28 Aug 2019 15:57:20 +1000
Subject: Edit limit text

---
 doc/security/rack_attack.md  | 9 +++++----
 doc/user/gitlab_com/index.md | 9 +++++----
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/doc/security/rack_attack.md b/doc/security/rack_attack.md
index 4ad5fd0d16c..09d29bf3446 100644
--- a/doc/security/rack_attack.md
+++ b/doc/security/rack_attack.md
@@ -77,11 +77,12 @@ authentication requests were received in a 3-minute period from a single IP addr
 This applies only to Git requests and container registry (`/jwt/auth`) requests
 (combined).
 
-This limit is reset by requests that authenticate successfully. For example, 29
-failed authentication requests followed by 1 successful request, followed by 29
-more failed authentication requests would not trigger a ban.
+This limit:
 
-JWT requests authenticated by gitlab-ci-token are excluded from this limit.
+- Is reset by requests that authenticate successfully. For example, 29
+  failed authentication requests followed by 1 successful request, followed by 29
+  more failed authentication requests would not trigger a ban.
+- Does not apply to JWT requests authenticated by `gitlab-ci-token`.
 
 No response headers are provided.
 
diff --git a/doc/user/gitlab_com/index.md b/doc/user/gitlab_com/index.md
index 8f1048260f2..72beb38fe76 100644
--- a/doc/user/gitlab_com/index.md
+++ b/doc/user/gitlab_com/index.md
@@ -320,11 +320,12 @@ authentication requests were received in a 3-minute period from a single IP addr
 This applies only to Git requests and container registry (`/jwt/auth`) requests
 (combined).
 
-This limit is reset by requests that authenticate successfully. For example, 29
-failed authentication requests followed by 1 successful request, followed by 29
-more failed authentication requests would not trigger a ban.
+This limit:
 
-JWT requests authenticated by gitlab-ci-token are excluded from this limit.
+- Is reset by requests that authenticate successfully. For example, 29
+  failed authentication requests followed by 1 successful request, followed by 29
+  more failed authentication requests would not trigger a ban.
+- Does not apply to JWT requests authenticated by `gitlab-ci-token`.
 
 No response headers are provided.
 
-- 
cgit v1.2.1


From 59847ef0ac3e4409f6053a019121a5c7cd698812 Mon Sep 17 00:00:00 2001
From: Evan Read <eread@gitlab.com>
Date: Wed, 28 Aug 2019 05:57:25 +0000
Subject: Fixes Introduced in text for our renderer

---
 doc/administration/integration/plantuml.md         |  3 +--
 doc/ci/runners/README.md                           |  3 +--
 doc/ci/yaml/README.md                              |  5 ++--
 doc/user/admin_area/settings/terms.md              |  3 +--
 doc/user/admin_area/settings/third_party_offers.md |  3 +--
 doc/user/clusters/applications.md                  |  3 +--
 doc/user/project/integrations/prometheus.md        | 30 ++++++++++++++--------
 doc/workflow/issue_weight.md                       |  5 ++--
 8 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/doc/administration/integration/plantuml.md b/doc/administration/integration/plantuml.md
index 16a193550a1..df6c554decb 100644
--- a/doc/administration/integration/plantuml.md
+++ b/doc/administration/integration/plantuml.md
@@ -1,7 +1,6 @@
 # PlantUML & GitLab
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/8537) in
-> GitLab 8.16.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/8537) in GitLab 8.16.
 
 When [PlantUML](http://plantuml.com) integration is enabled and configured in
 GitLab we are able to create simple diagrams in AsciiDoc and Markdown documents
diff --git a/doc/ci/runners/README.md b/doc/ci/runners/README.md
index 269bd5c3428..abb503c6516 100644
--- a/doc/ci/runners/README.md
+++ b/doc/ci/runners/README.md
@@ -156,8 +156,7 @@ An admin can enable/disable a specific Runner for projects:
 
 ## Protected Runners
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/13194)
-> in GitLab 10.0.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/13194) in GitLab 10.0.
 
 You can protect Runners from revealing sensitive information.
 Whenever a Runner is protected, the Runner picks only jobs created on
diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md
index 1368764bcf8..06dceeb37d4 100644
--- a/doc/ci/yaml/README.md
+++ b/doc/ci/yaml/README.md
@@ -1899,9 +1899,8 @@ job1:
 
 ### `retry`
 
-> [Introduced][ce-12909] in GitLab 9.5.
-> [Behaviour expanded](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/21758)
-> in GitLab 11.5 to control on which failures to retry.
+> - [Introduced][ce-12909] in GitLab 9.5.
+> - [Behaviour expanded](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/21758) in GitLab 11.5 to control on which failures to retry.
 
 `retry` allows you to configure how many times a job is going to be retried in
 case of a failure.
diff --git a/doc/user/admin_area/settings/terms.md b/doc/user/admin_area/settings/terms.md
index baf219ac9c7..0b5f9a13b03 100644
--- a/doc/user/admin_area/settings/terms.md
+++ b/doc/user/admin_area/settings/terms.md
@@ -4,8 +4,7 @@ type: reference
 
 # Enforce accepting Terms of Service **(CORE ONLY)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/18570)
-> in [GitLab Core](https://about.gitlab.com/pricing/) 10.8
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/18570) in [GitLab Core](https://about.gitlab.com/pricing/) 10.8.
 
 An admin can enforce acceptance of a terms of service and privacy policy. When this option is enabled, new and existing users must accept the terms.
 
diff --git a/doc/user/admin_area/settings/third_party_offers.md b/doc/user/admin_area/settings/third_party_offers.md
index ca26147b287..50dea8f50a2 100644
--- a/doc/user/admin_area/settings/third_party_offers.md
+++ b/doc/user/admin_area/settings/third_party_offers.md
@@ -4,8 +4,7 @@ type: reference
 
 # Third party offers **(CORE ONLY)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/20379)
-> in [GitLab Core](https://about.gitlab.com/pricing/) 11.1
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/20379) in [GitLab Core](https://about.gitlab.com/pricing/) 11.1.
 
 Within GitLab, we inform users of available third-party offers they might find valuable in order
 to enhance the development of their projects. An example is the Google Cloud Platform free credit
diff --git a/doc/user/clusters/applications.md b/doc/user/clusters/applications.md
index 096730f800c..743d708399c 100644
--- a/doc/user/clusters/applications.md
+++ b/doc/user/clusters/applications.md
@@ -225,8 +225,7 @@ file.
 
 ## Upgrading applications
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/24789)
-in GitLab 11.8.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/24789) in GitLab 11.8.
 
 The applications below can be upgraded.
 
diff --git a/doc/user/project/integrations/prometheus.md b/doc/user/project/integrations/prometheus.md
index a80332adc46..d13592559b9 100644
--- a/doc/user/project/integrations/prometheus.md
+++ b/doc/user/project/integrations/prometheus.md
@@ -19,7 +19,7 @@ Once enabled, GitLab will automatically detect metrics from known services in th
 
 ### Managed Prometheus on Kubernetes
 
-> **Note**: [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/issues/28916) in GitLab 10.5
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/issues/28916) in GitLab 10.5.
 
 GitLab can seamlessly deploy and manage Prometheus on a [connected Kubernetes cluster](../clusters/index.md), making monitoring of your apps easy.
 
@@ -271,7 +271,7 @@ Note the following properties:
 
 ### Downloading data as CSV
 
-Data from Prometheus charts on the metrics dashboard can be downloaded as CSV. 
+Data from Prometheus charts on the metrics dashboard can be downloaded as CSV.
 
 ![Downloading as CSV](img/download_as_csv.png)
 
@@ -342,15 +342,21 @@ If the metric exceeds the threshold of the alert for over 5 minutes, an email wi
 
 ## Determining the performance impact of a merge
 
-> [Introduced][ce-10408] in GitLab 9.2.
-> GitLab 9.3 added the [numeric comparison](https://gitlab.com/gitlab-org/gitlab-ce/issues/27439) of the 30 minute averages.
-> Requires [Kubernetes](prometheus_library/kubernetes.md) metrics
+> - [Introduced][ce-10408] in GitLab 9.2.
+> - GitLab 9.3 added the [numeric comparison](https://gitlab.com/gitlab-org/gitlab-ce/issues/27439) of the 30 minute averages.
 
 Developers can view the performance impact of their changes within the merge
-request workflow. When a source branch has been deployed to an environment, a sparkline and numeric comparison of the average memory consumption will appear. On the sparkline, a dot
-indicates when the current changes were deployed, with up to 30 minutes of
-performance data displayed before and after. The comparison shows the difference between the 30 minute average before and after the deployment. This information is updated after
-each commit has been deployed.
+request workflow.
+
+NOTE: **Note:**
+Requires [Kubernetes](prometheus_library/kubernetes.md) metrics.
+
+When a source branch has been deployed to an environment, a sparkline and
+numeric comparison of the average memory consumption will appear. On the
+sparkline, a dot indicates when the current changes were deployed, with up to 30 minutes of
+performance data displayed before and after. The comparison shows the difference
+between the 30 minute average before and after the deployment. This information
+is updated after each commit has been deployed.
 
 Once merged and the target branch has been redeployed, the metrics will switch
 to show the new environments this revision has been deployed to.
@@ -363,13 +369,15 @@ Prometheus server.
 ## Embedding metric charts within GitLab Flavored Markdown
 
 > [Introduced][ce-29691] in GitLab 12.2.
-> Requires [Kubernetes](prometheus_library/kubernetes.md) metrics.
 
 It is possible to display metrics charts within [GitLab Flavored Markdown](../../markdown.md#gitlab-flavored-markdown-gfm).
 
+NOTE: **Note:**
+Requires [Kubernetes](prometheus_library/kubernetes.md) metrics.
+
 To display a metric chart, include a link of the form `https://<root_url>/<project>/environments/<environment_id>/metrics`.
 
-A single chart may also be embedded. You can generate a link to the chart via the dropdown located on the right side of the chart:  
+A single chart may also be embedded. You can generate a link to the chart via the dropdown located on the right side of the chart:
 
 ![Generate Link To Chart](img/generate_link_to_chart.png)
 
diff --git a/doc/workflow/issue_weight.md b/doc/workflow/issue_weight.md
index a80519f0748..291646a430e 100644
--- a/doc/workflow/issue_weight.md
+++ b/doc/workflow/issue_weight.md
@@ -1,7 +1,6 @@
-# Issue Weight **(STARTER)**
+# Issue weight **(STARTER)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/76)
-> in [GitLab Starter](https://about.gitlab.com/pricing/) 8.3.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/76) in [GitLab Starter](https://about.gitlab.com/pricing/) 8.3.
 
 When you have a lot of issues, it can be hard to get an overview.
 By adding a weight to each issue, you can get a better idea of how much time,
-- 
cgit v1.2.1


From d7d218628fe60400cbb6ca937f79315f363e872e Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Wed, 28 Aug 2019 06:06:34 +0000
Subject: Fix markdown in various docs

Clean up issues that may cause the docs-lint
test to fail, such as trailing whitespace, no
EOF newline, blockquotes, etc
---
 .../auth/how_to_configure_ldap_gitlab_ce/index.md  |  4 ++--
 doc/administration/auth/okta.md                    | 16 ++++++-------
 doc/administration/geo/disaster_recovery/index.md  |  2 +-
 .../geo/replication/troubleshooting.md             |  4 ++--
 doc/administration/gitaly/index.md                 | 17 +++++++-------
 doc/administration/high_availability/gitlab.md     | 27 +++++++++++-----------
 doc/administration/pages/source.md                 | 16 -------------
 doc/administration/raketasks/github_import.md      |  2 +-
 doc/administration/raketasks/ldap.md               |  4 ----
 doc/administration/raketasks/maintenance.md        |  4 ++--
 doc/administration/raketasks/uploads/migrate.md    |  2 +-
 .../troubleshooting/elasticsearch.md               |  6 ++---
 doc/administration/troubleshooting/sidekiq.md      | 15 ++++++------
 doc/api/graphql/reference/index.md                 |  1 -
 doc/ci/directed_acyclic_graph/index.md             |  2 +-
 doc/ci/jenkins/index.md                            |  8 +++----
 .../merge_trains/index.md                          |  2 +-
 doc/ci/services/mysql.md                           |  4 ++--
 doc/ci/triggers/README.md                          |  5 ++--
 doc/development/contributing/index.md              |  2 +-
 doc/development/documentation/styleguide.md        |  5 ----
 doc/development/fe_guide/performance.md            |  2 +-
 doc/development/i18n/translation.md                |  1 -
 doc/development/new_fe_guide/dependencies.md       |  2 +-
 .../new_fe_guide/development/testing.md            |  1 -
 .../testing_guide/end_to_end/quick_start_guide.md  |  2 +-
 .../testing_guide/end_to_end/style_guide.md        |  2 +-
 doc/development/testing_guide/review_apps.md       |  2 +-
 doc/development/testing_guide/testing_levels.md    |  2 +-
 29 files changed, 68 insertions(+), 94 deletions(-)

diff --git a/doc/administration/auth/how_to_configure_ldap_gitlab_ce/index.md b/doc/administration/auth/how_to_configure_ldap_gitlab_ce/index.md
index 86dd398343b..7c14d4004db 100644
--- a/doc/administration/auth/how_to_configure_ldap_gitlab_ce/index.md
+++ b/doc/administration/auth/how_to_configure_ldap_gitlab_ce/index.md
@@ -32,7 +32,7 @@ For example, [Active Directory](https://technet.microsoft.com/en-us/library/hh83
 
 We won't cover the installation and configuration of Windows Server or Active Directory Domain Services in this tutorial. There are a number of resources online to guide you through this process:
 
-- Install Windows Server 2012  - (_technet.microsoft.com_) - [Installing Windows Server 2012 ](https://technet.microsoft.com/en-us/library/jj134246(v=ws.11).aspx)
+- Install Windows Server 2012  - (_technet.microsoft.com_) - [Installing Windows Server 2012](https://technet.microsoft.com/en-us/library/jj134246(v=ws.11).aspx)
 
 - Install Active Directory Domain Services (AD DS) (_technet.microsoft.com_)- [Install Active Directory Domain Services](https://technet.microsoft.com/windows-server-docs/identity/ad-ds/deploy/install-active-directory-domain-services--level-100-#BKMK_PS)
 
@@ -249,7 +249,7 @@ After configuring LDAP, basic authentication will be available. Users can then l
 
 Users that are removed from the LDAP base group (e.g `OU=GitLab INT,DC=GitLab,DC=org`) will be **blocked** in GitLab. [More information](../ldap.md#security) on LDAP security.
 
-If `allow_username_or_email_login` is enabled in the LDAP configuration, GitLab will ignore everything after the first '@' in the LDAP username used on login. Example: The username `` jon.doe@example.com `` is converted to `jon.doe` when authenticating with the LDAP server. Disable this setting if you use `userPrincipalName` as the `uid`.
+If `allow_username_or_email_login` is enabled in the LDAP configuration, GitLab will ignore everything after the first '@' in the LDAP username used on login. Example: The username `jon.doe@example.com` is converted to `jon.doe` when authenticating with the LDAP server. Disable this setting if you use `userPrincipalName` as the `uid`.
 
 ## LDAP extended features on GitLab EE
 
diff --git a/doc/administration/auth/okta.md b/doc/administration/auth/okta.md
index 5524c3ba092..41745e8caae 100644
--- a/doc/administration/auth/okta.md
+++ b/doc/administration/auth/okta.md
@@ -98,20 +98,20 @@ Now that the Okta app is configured, it's time to enable it in GitLab.
    >**Notes:**
    >
    >- Change the value for `assertion_consumer_service_url` to match the HTTPS endpoint
-      of GitLab (append `users/auth/saml/callback` to the HTTPS URL of your GitLab
-      installation to generate the correct value).
+   >  of GitLab (append `users/auth/saml/callback` to the HTTPS URL of your GitLab
+   >  installation to generate the correct value).
    >
    >- To get the `idp_cert_fingerprint` fingerprint, first download the
-      certificate from the Okta app you registered and then run:
-      `openssl x509 -in okta.cert -noout -fingerprint`. Substitute `okta.cert`
-      with the location of your certificate.
+   >  certificate from the Okta app you registered and then run:
+   >  `openssl x509 -in okta.cert -noout -fingerprint`. Substitute `okta.cert`
+   >  with the location of your certificate.
    >
    >- Change the value of `idp_sso_target_url`, with the value of the
-      **Identity Provider Single Sign-On URL** from the step when you
-      configured the Okta app.
+   >  **Identity Provider Single Sign-On URL** from the step when you
+   >  configured the Okta app.
    >
    >- Change the value of `issuer` to the value of the **Audience Restriction** from your Okta app configuration. This will identify GitLab
-      to the IdP.
+   >  to the IdP.
    >
    >- Leave `name_identifier_format` as-is.
 
diff --git a/doc/administration/geo/disaster_recovery/index.md b/doc/administration/geo/disaster_recovery/index.md
index ba95843b0b0..407539885a6 100644
--- a/doc/administration/geo/disaster_recovery/index.md
+++ b/doc/administration/geo/disaster_recovery/index.md
@@ -297,7 +297,7 @@ for another **primary** node. All the old replication settings will be overwritt
 
 ## Troubleshooting
 
-### I followed the disaster recovery instructions and now two-factor auth is broken!
+### I followed the disaster recovery instructions and now two-factor auth is broken
 
 The setup instructions for Geo prior to 10.5 failed to replicate the
 `otp_key_base` secret, which is used to encrypt the two-factor authentication
diff --git a/doc/administration/geo/replication/troubleshooting.md b/doc/administration/geo/replication/troubleshooting.md
index fe1557fd8b5..3ae92b07736 100644
--- a/doc/administration/geo/replication/troubleshooting.md
+++ b/doc/administration/geo/replication/troubleshooting.md
@@ -538,7 +538,7 @@ can simply reset the existing tracking database with:
 sudo gitlab-rake geo:db:reset
 ```
 
-### Geo node has a database that is writable which is an indication it is not configured for replication with the primary node.
+### Geo node has a database that is writable which is an indication it is not configured for replication with the primary node
 
 This error refers to a problem with the database replica on a **secondary** node,
 which Geo expects to have access to. It usually means, either:
@@ -552,7 +552,7 @@ PostgreSQL instances:
 - A read-only replica of the **primary** node.
 - A regular, writable instance that holds replication metadata. That is, the Geo tracking database.
 
-### Geo node does not appear to be replicating the database from the primary node.
+### Geo node does not appear to be replicating the database from the primary node
 
 The most common problems that prevent the database from replicating correctly are:
 
diff --git a/doc/administration/gitaly/index.md b/doc/administration/gitaly/index.md
index daec5f14e36..eab4b2c6eea 100644
--- a/doc/administration/gitaly/index.md
+++ b/doc/administration/gitaly/index.md
@@ -185,7 +185,7 @@ Check the directory layout on your Gitaly server to be sure.
    ```
 
 1. Append the following to `/etc/gitlab/gitlab.rb` for each respective server:
-   
+
    For `gitaly1.internal`:
 
    ```
@@ -194,7 +194,7 @@ Check the directory layout on your Gitaly server to be sure.
      { 'name' => 'storage1' },
    ]
    ```
-   
+
    For `gitaly2.internal`:
 
    ```
@@ -226,7 +226,7 @@ Check the directory layout on your Gitaly server to be sure.
    ```
 
 1. Append the following to `/home/git/gitaly/config.toml` for each respective server:
-   
+
    For `gitaly1.internal`:
 
    ```toml
@@ -236,7 +236,7 @@ Check the directory layout on your Gitaly server to be sure.
    [[storage]]
    name = 'storage1'
    ```
-   
+
    For `gitaly2.internal`:
 
    ```toml
@@ -262,12 +262,12 @@ Additionally, you need to
 [disable Rugged if previously manually enabled](../high_availability/nfs.md#improving-nfs-performance-with-gitlab).
 
 We assume that your `gitaly1.internal` Gitaly server can be reached at
-`gitaly1.internal:8075` from your GitLab server, and that Gitaly server 
+`gitaly1.internal:8075` from your GitLab server, and that Gitaly server
 can read and write to `/mnt/gitlab/default` and `/mnt/gitlab/storage1`.
 
 We assume also that your `gitaly2.internal` Gitaly server can be reached at
-`gitaly2.internal:8075` from your GitLab server, and that Gitaly server 
-can read and write to `/mnt/gitlab/storage2`. 
+`gitaly2.internal:8075` from your GitLab server, and that Gitaly server
+can read and write to `/mnt/gitlab/storage2`.
 
 **For Omnibus GitLab**
 
@@ -540,6 +540,7 @@ gitaly['concurrency'] = [
   }
 ]
 ```
+
 This will limit the number of in-flight RPC calls for the given RPC's.
 The limit is applied per repository. In the example above, each on the
 Gitaly server can have at most 20 simultaneous PostUploadPack calls in
@@ -729,4 +730,4 @@ To remove the proxy setting, run the following commands (depending on which vari
 ```bash
 unset http_proxy
 unset https_proxy
-```
\ No newline at end of file
+```
diff --git a/doc/administration/high_availability/gitlab.md b/doc/administration/high_availability/gitlab.md
index 8818a9606de..0d1dd06871a 100644
--- a/doc/administration/high_availability/gitlab.md
+++ b/doc/administration/high_availability/gitlab.md
@@ -4,9 +4,9 @@ type: reference
 
 # Configuring GitLab for Scaling and High Availability
 
-> **Note:** There is some additional configuration near the bottom for
-  additional GitLab application servers. It's important to read and understand
-  these additional steps before proceeding with GitLab installation.
+NOTE: **Note:** There is some additional configuration near the bottom for
+additional GitLab application servers. It's important to read and understand
+these additional steps before proceeding with GitLab installation.
 
 1. If necessary, install the NFS client utility packages using the following
    commands:
@@ -82,19 +82,19 @@ type: reference
 
 1. [Enable monitoring](#enable-monitoring)
 
-   > **Note:** To maintain uniformity of links across HA clusters, the `external_url`
+   NOTE: **Note:** To maintain uniformity of links across HA clusters, the `external_url`
    on the first application server as well as the additional application
    servers should point to the external url that users will use to access GitLab.
    In a typical HA setup, this will be the url of the load balancer which will
    route traffic to all GitLab application servers in the HA cluster.
-   >
-   > **Note:** When you specify `https` in the `external_url`, as in the example
+
+   NOTE: **Note:** When you specify `https` in the `external_url`, as in the example
    above, GitLab assumes you have SSL certificates in `/etc/gitlab/ssl/`. If
    certificates are not present, Nginx will fail to start. See
    [Nginx documentation](https://docs.gitlab.com/omnibus/settings/nginx.html#enable-https)
    for more information.
-   >
-   > **Note:** It is best to set the `uid` and `gid`s prior to the initial reconfigure
+
+   NOTE: **Note:** It is best to set the `uid` and `gid`s prior to the initial reconfigure
    of GitLab. Omnibus will not recursively `chown` directories if set after the initial reconfigure.
 
 ## First GitLab application server
@@ -105,8 +105,8 @@ Do not run this on additional application servers.
 1. Initialize the database by running `sudo gitlab-rake gitlab:setup`.
 1. Run `sudo gitlab-ctl reconfigure` to compile the configuration.
 
-> **WARNING:** Only run this setup task on **NEW** GitLab instances because it
-  will wipe any existing data.
+   CAUTION: **WARNING:** Only run this setup task on **NEW** GitLab instances because it
+   will wipe any existing data.
 
 ## Extra configuration for additional GitLab application servers
 
@@ -173,9 +173,10 @@ If you enable Monitoring, it must be enabled on **all** GitLab servers.
 
 1. Run `sudo gitlab-ctl reconfigure` to compile the configuration.
 
-> **Warning:** After changing `unicorn['listen']` in `gitlab.rb`, and running `sudo gitlab-ctl reconfigure`,
-  it can take an extended period of time for unicorn to complete reloading after receiving a `HUP`.
-  For more information, see the [issue](https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4401).
+   CAUTION: **Warning:**
+   After changing `unicorn['listen']` in `gitlab.rb`, and running `sudo gitlab-ctl reconfigure`,
+   it can take an extended period of time for unicorn to complete reloading after receiving a `HUP`.
+   For more information, see the [issue](https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4401).
 
 ## Troubleshooting
 
diff --git a/doc/administration/pages/source.md b/doc/administration/pages/source.md
index c77a1a9638f..fdfde22647d 100644
--- a/doc/administration/pages/source.md
+++ b/doc/administration/pages/source.md
@@ -343,21 +343,6 @@ world. Custom domains and TLS are supported.
 1. Restart NGINX
 1. [Restart GitLab][restart]
 
-## Change storage path
-
-Follow the steps below to change the default path where GitLab Pages' contents
-are stored.
-
-1. Pages are stored by default in `/var/opt/gitlab/gitlab-rails/shared/pages`.
-   If you wish to store them in another location you must set it up in
-   `/etc/gitlab/gitlab.rb`:
-
-   ```ruby
-   gitlab_rails['pages_path'] = "/mnt/storage/pages"
-   ```
-
-1. [Reconfigure GitLab][reconfigure]
-
 ## NGINX caveats
 
 >**Note:**
@@ -468,7 +453,6 @@ than GitLab to prevent XSS attacks.
 [NGINX configs]: https://gitlab.com/gitlab-org/gitlab-ee/tree/8-5-stable-ee/lib/support/nginx
 [pages-readme]: https://gitlab.com/gitlab-org/gitlab-pages/blob/master/README.md
 [pages-userguide]: ../../user/project/pages/index.md
-[reconfigure]: ../restart_gitlab.md#omnibus-gitlab-reconfigure
 [restart]: ../restart_gitlab.md#installations-from-source
 [gitlab-pages]: https://gitlab.com/gitlab-org/gitlab-pages/tree/v0.4.0
 [gl-example]: https://gitlab.com/gitlab-org/gitlab-ce/blob/master/lib/support/init.d/gitlab.default.example
diff --git a/doc/administration/raketasks/github_import.md b/doc/administration/raketasks/github_import.md
index ccd9c0afb1d..f8eecc97c33 100644
--- a/doc/administration/raketasks/github_import.md
+++ b/doc/administration/raketasks/github_import.md
@@ -1,6 +1,6 @@
 # GitHub import
 
->  [Introduced]( https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/10308) in GitLab 9.1.
+> [Introduced]( https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/10308) in GitLab 9.1.
 
 In order to retrieve and import GitHub repositories, you will need a
 [GitHub personal access token](https://github.com/settings/tokens).
diff --git a/doc/administration/raketasks/ldap.md b/doc/administration/raketasks/ldap.md
index e880d76e756..d0ebe272b6d 100644
--- a/doc/administration/raketasks/ldap.md
+++ b/doc/administration/raketasks/ldap.md
@@ -19,8 +19,6 @@ sudo gitlab-rake gitlab:ldap:check
 sudo -u git -H bundle exec rake gitlab:ldap:check RAILS_ENV=production
 ```
 
-------
-
 By default, the task will return a sample of 100 LDAP users. Change this
 limit by passing a number to the check task:
 
@@ -135,8 +133,6 @@ What is the old provider? Ex. 'ldapmain': ldapmain
 What is the new provider? Ex. 'ldapcustom': ldapmycompany
 ```
 
-------
-
 This tasks also accepts the `force` environment variable which will skip the
 confirmation dialog:
 
diff --git a/doc/administration/raketasks/maintenance.md b/doc/administration/raketasks/maintenance.md
index 8d0b5b42515..89335fcd2a8 100644
--- a/doc/administration/raketasks/maintenance.md
+++ b/doc/administration/raketasks/maintenance.md
@@ -260,7 +260,7 @@ To check the status of migrations, you can use the following rake task:
 sudo gitlab-rake db:migrate:status
 ```
 
-This will output a table with a `Status` of `up` or `down` for 
+This will output a table with a `Status` of `up` or `down` for
 each Migration ID.
 
 ```bash
@@ -269,4 +269,4 @@ database: gitlabhq_production
  Status   Migration ID    Migration Name
 --------------------------------------------------
    up     migration_id    migration_name
-```
\ No newline at end of file
+```
diff --git a/doc/administration/raketasks/uploads/migrate.md b/doc/administration/raketasks/uploads/migrate.md
index 86e8b763f51..d9b4c9b3369 100644
--- a/doc/administration/raketasks/uploads/migrate.md
+++ b/doc/administration/raketasks/uploads/migrate.md
@@ -108,7 +108,7 @@ sudo -u git -H bundle exec rake "gitlab:uploads:migrate[FileUploader, MergeReque
 
 > Introduced in GitLab 12.3.
 
-To migrate all uploads created by legacy uploaders, run: 
+To migrate all uploads created by legacy uploaders, run:
 
 ```shell
 bundle exec rake gitlab:uploads:legacy:migrate
diff --git a/doc/administration/troubleshooting/elasticsearch.md b/doc/administration/troubleshooting/elasticsearch.md
index c4a7ba01fae..13b9c30b29d 100644
--- a/doc/administration/troubleshooting/elasticsearch.md
+++ b/doc/administration/troubleshooting/elasticsearch.md
@@ -266,9 +266,9 @@ ElasticSearch administrator.
 
 Generally speaking, ensure:
 
-* The ElasticSearch server **is not** running on the same node as GitLab.
-* The ElasticSearch server have enough RAM and CPU cores.
-* That sharding **is** being used.
+- The ElasticSearch server **is not** running on the same node as GitLab.
+- The ElasticSearch server have enough RAM and CPU cores.
+- That sharding **is** being used.
 
 Going into some more detail here, if ElasticSearch is running on the same server as GitLab, resource contention is **very** likely to occur. Ideally, ElasticSearch, which requires ample resources, should be running on its own server (maybe coupled with logstash and kibana).
 
diff --git a/doc/administration/troubleshooting/sidekiq.md b/doc/administration/troubleshooting/sidekiq.md
index 9b016c64e29..c41edb5dbfc 100644
--- a/doc/administration/troubleshooting/sidekiq.md
+++ b/doc/administration/troubleshooting/sidekiq.md
@@ -96,8 +96,9 @@ corresponding Ruby code where this is happening.
 `gdb` can be another effective tool for debugging Sidekiq. It gives you a little
 more interactive way to look at each thread and see what's causing problems.
 
-> **Note:** Attaching to a process with `gdb` will suspends the normal operation
-  of the process (Sidekiq will not process jobs while `gdb` is attached).
+NOTE: **Note:**
+Attaching to a process with `gdb` will suspends the normal operation
+of the process (Sidekiq will not process jobs while `gdb` is attached).
 
 Start by attaching to the Sidekiq PID:
 
@@ -280,10 +281,10 @@ has number of drawbacks, as mentioned in [Why Ruby’s Timeout is dangerous (and
 
 > This is where the implications get interesting, and terrifying. This means that an exception can get raised:
 >
-> * during a network request (ok, as long as the surrounding code is prepared to catch Timeout::Error)
-> * during the cleanup for the network request
-> * during a rescue block
-> * while creating an object to save to the database afterwards
-> * in any of your code, regardless of whether it could have possibly raised an exception before
+> - during a network request (ok, as long as the surrounding code is prepared to catch Timeout::Error)
+> - during the cleanup for the network request
+> - during a rescue block
+> - while creating an object to save to the database afterwards
+> - in any of your code, regardless of whether it could have possibly raised an exception before
 >
 > Nobody writes code to defend against an exception being raised on literally any line. That’s not even possible. So Thread.raise is  basically like a sneak attack on your code that could result in almost anything. It would probably be okay if it were pure-functional code that did not modify any state. But this is Ruby, so that’s unlikely :)
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index d99a4c37d72..e87270f884a 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -516,4 +516,3 @@ The API can be explored interactively using the [GraphiQL IDE](../index.md#graph
 | `username` | String! |  |
 | `avatarUrl` | String! |  |
 | `webUrl` | String! |  |
-
diff --git a/doc/ci/directed_acyclic_graph/index.md b/doc/ci/directed_acyclic_graph/index.md
index 1c38c08b7cb..60e3120ba33 100644
--- a/doc/ci/directed_acyclic_graph/index.md
+++ b/doc/ci/directed_acyclic_graph/index.md
@@ -36,7 +36,7 @@ It has a pipeline that looks like the following:
 | ----- | ---- | ------ |
 | build_a | test_a | deploy_a |
 | build_b | test_b | deploy_b |
-| build_c | test_c | deploy_c | 
+| build_c | test_c | deploy_c |
 | build_d | test_d | deploy_d |
 
 Using a DAG, you can relate the `_a` jobs to each other separately from the `_b` jobs,
diff --git a/doc/ci/jenkins/index.md b/doc/ci/jenkins/index.md
index f8a3fab88e3..ace1204511e 100644
--- a/doc/ci/jenkins/index.md
+++ b/doc/ci/jenkins/index.md
@@ -32,7 +32,7 @@ There are some high level differences between the products worth mentioning:
 
 ## Groovy vs. YAML
 
-Jenkins Pipelines are based on [Groovy](https://groovy-lang.org/), so the pipeline specification is written as code. 
+Jenkins Pipelines are based on [Groovy](https://groovy-lang.org/), so the pipeline specification is written as code.
 GitLab works a bit differently, we use the more highly structured [YAML](https://yaml.org/) format, which
 places scripting elements inside of `script:` blocks separate from the pipeline specification itself.
 
@@ -56,7 +56,7 @@ rspec:
     - .in-docker
   script:
     - rake rspec
-```      
+```
 
 ## Artifact publishing
 
@@ -143,7 +143,7 @@ default:
 
 GitLab CI also lets you define stages, but is a little bit more free-form to configure. The GitLab [`stages` keyword](../yaml/README.md#stages)
 is a top level setting that enumerates the list of stages, but you are not required to nest individual jobs underneath
-the `stages` section. Any job defined in the `.gitlab-ci.yml` can be made a part of any stage through use of the 
+the `stages` section. Any job defined in the `.gitlab-ci.yml` can be made a part of any stage through use of the
 [`stage:` keyword](../yaml/README.md#stage).
 
 Note that, unless otherwise specified, every pipeline is instantiated with a `build`, `test`, and `deploy` stage
@@ -229,4 +229,4 @@ our very powerful [`only/except` rules system](../yaml/README.md#onlyexcept-basi
 ```yaml
 my_job:
   only: branches
-```
\ No newline at end of file
+```
diff --git a/doc/ci/merge_request_pipelines/pipelines_for_merged_results/merge_trains/index.md b/doc/ci/merge_request_pipelines/pipelines_for_merged_results/merge_trains/index.md
index 80a1c264bc4..7998b0452be 100644
--- a/doc/ci/merge_request_pipelines/pipelines_for_merged_results/merge_trains/index.md
+++ b/doc/ci/merge_request_pipelines/pipelines_for_merged_results/merge_trains/index.md
@@ -141,4 +141,4 @@ please ask administrator to execute the following commands:
 > sudo gitlab-rails console                         # Login to Rails console of GitLab instance.
 > Feature.enabled?(:merge_trains_enabled)           # Check if it's enabled or not.
 > Feature.disable(:merge_trains_enabled)            # Disable the feature flag.
-```
\ No newline at end of file
+```
diff --git a/doc/ci/services/mysql.md b/doc/ci/services/mysql.md
index 9ea113969c8..ce69a7df885 100644
--- a/doc/ci/services/mysql.md
+++ b/doc/ci/services/mysql.md
@@ -27,8 +27,8 @@ variables:
 
 NOTE: **Note:**
 The `MYSQL_DATABASE` and `MYSQL_ROOT_PASSWORD` variables can't be set in the GitLab UI.
-To set them, assign them to a variable [in the UI](../variables/README.md#via-the-ui), 
-and then assign that variable to the 
+To set them, assign them to a variable [in the UI](../variables/README.md#via-the-ui),
+and then assign that variable to the
 `MYSQL_DATABASE` and `MYSQL_ROOT_PASSWORD` variables in your `.gitlab-ci.yml`.
 
 And then configure your application to use the database, for example:
diff --git a/doc/ci/triggers/README.md b/doc/ci/triggers/README.md
index 2a382f18038..f62a4660713 100644
--- a/doc/ci/triggers/README.md
+++ b/doc/ci/triggers/README.md
@@ -58,8 +58,7 @@ Read more about the [pipelines trigger API][trigapi].
 
 #### When a pipeline depends on the artifacts of another pipeline **(PREMIUM)**
 
-> The use of `CI_JOB_TOKEN` in the artifacts download API was [introduced][ee-2346]
-  in [GitLab Premium][ee] 9.5.
+> The use of `CI_JOB_TOKEN` in the artifacts download API was [introduced][ee-2346] in [GitLab Premium][ee] 9.5.
 
 With the introduction of dependencies between different projects, one of
 them may need to access artifacts created by a previous one. This process
@@ -271,7 +270,7 @@ Old triggers, created before GitLab 9.0 will be marked as legacy.
 
 Triggers with the legacy label do not have an associated user and only have
 access to the current project. They are considered deprecated and will be
-removed with one of the future versions of GitLab. 
+removed with one of the future versions of GitLab.
 
 [ee-2017]: https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/2017
 [ee-2346]: https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/2346
diff --git a/doc/development/contributing/index.md b/doc/development/contributing/index.md
index 3637a08c3cd..887f17b05b8 100644
--- a/doc/development/contributing/index.md
+++ b/doc/development/contributing/index.md
@@ -65,7 +65,7 @@ Sign up for the mailing list, answer GitLab questions on StackOverflow or
 respond in the IRC channel. You can also sign up on [CodeTriage][codetriage] to help with
 the remaining issues on the GitHub issue tracker.
 
-## I want to contribute!
+## I want to contribute
 
 If you want to contribute to GitLab,
 [issues with the `Accepting merge requests` label](issue_workflow.md#label-for-community-contributors)
diff --git a/doc/development/documentation/styleguide.md b/doc/development/documentation/styleguide.md
index c1e3eb9680b..bfcda1dd7fc 100644
--- a/doc/development/documentation/styleguide.md
+++ b/doc/development/documentation/styleguide.md
@@ -783,8 +783,6 @@ For multiple paragraphs, use the symbol `>` before every line:
 >
 > - This is a list item
 > - Second item in the list
->
-> ### This is an `h3`
 ```
 
 Which renders to:
@@ -795,9 +793,6 @@ Which renders to:
 >
 > - This is a list item
 > - Second item in the list
->
-> ### This is an `h3`
->{:.no_toc}
 
 ## Terms
 
diff --git a/doc/development/fe_guide/performance.md b/doc/development/fe_guide/performance.md
index 676bce32998..3a8ea04407f 100644
--- a/doc/development/fe_guide/performance.md
+++ b/doc/development/fe_guide/performance.md
@@ -81,7 +81,7 @@ bundle and included on the page.
 > can find this out by inspecting `document.body.dataset.page` within your
 > browser's developer console while on any page within gitlab.
 
-#### Important Considerations:
+#### Important Considerations
 
 - **Keep Entry Points Lite:**
   Page-specific javascript entry points should be as lite as possible.  These
diff --git a/doc/development/i18n/translation.md b/doc/development/i18n/translation.md
index 62be3786549..15b1af1aa8f 100644
--- a/doc/development/i18n/translation.md
+++ b/doc/development/i18n/translation.md
@@ -92,4 +92,3 @@ To propose additions to the glossary please
 In French, the "écriture inclusive" is now over (see on [Legifrance](https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000036068906&categorieLien=id)).
 So, to include both genders, write “Utilisateurs et utilisatrices” instead of “Utilisateur·rice·s”.
 When space is missing, the male gender should be used alone.
-
diff --git a/doc/development/new_fe_guide/dependencies.md b/doc/development/new_fe_guide/dependencies.md
index 8a6930acd37..161ffb1fb57 100644
--- a/doc/development/new_fe_guide/dependencies.md
+++ b/doc/development/new_fe_guide/dependencies.md
@@ -1,6 +1,6 @@
 # Dependencies
 
-## Adding Dependencies.
+## Adding Dependencies
 
 GitLab uses `yarn` to manage dependencies. These dependencies are defined in
 two groups within `package.json`, `dependencies` and `devDependencies`. For
diff --git a/doc/development/new_fe_guide/development/testing.md b/doc/development/new_fe_guide/development/testing.md
index e0d413b748b..b990425ca3c 100644
--- a/doc/development/new_fe_guide/development/testing.md
+++ b/doc/development/new_fe_guide/development/testing.md
@@ -3,4 +3,3 @@ redirect_to: '../../testing_guide/frontend_testing.md'
 ---
 
 This document was moved to [another location](../../testing_guide/frontend_testing.md).
-
diff --git a/doc/development/testing_guide/end_to_end/quick_start_guide.md b/doc/development/testing_guide/end_to_end/quick_start_guide.md
index e1df8be8b6f..d52d6db38b9 100644
--- a/doc/development/testing_guide/end_to_end/quick_start_guide.md
+++ b/doc/development/testing_guide/end_to_end/quick_start_guide.md
@@ -10,7 +10,7 @@ It's important to understand that end-to-end tests of isolated features, such as
 
 If you don't exactly understand what we mean by **not everything needs to happen through the GUI,** please make sure you've read the [best practices](best_practices.md) before moving on.
 
-## This document covers the following items:
+## This document covers the following items
 
 - [0.](#0-are-end-to-end-tests-needed) Identifying if end-to-end tests are really needed
 - [1.](#1-identifying-the-devops-stage) Identifying the [DevOps stage](https://about.gitlab.com/stages-devops-lifecycle/) of the feature that you are going to cover with end-to-end tests
diff --git a/doc/development/testing_guide/end_to_end/style_guide.md b/doc/development/testing_guide/end_to_end/style_guide.md
index 97560e616a1..54ed3f34c89 100644
--- a/doc/development/testing_guide/end_to_end/style_guide.md
+++ b/doc/development/testing_guide/end_to_end/style_guide.md
@@ -141,4 +141,4 @@ Resource::MergeRequest.fabricate! do |merge_request_page|
 end
 ```
 
-> Besides the advantage of having a standard in place, by following this standard we also write shorter lines of code.
\ No newline at end of file
+> Besides the advantage of having a standard in place, by following this standard we also write shorter lines of code.
diff --git a/doc/development/testing_guide/review_apps.md b/doc/development/testing_guide/review_apps.md
index 11449712a04..28a60660995 100644
--- a/doc/development/testing_guide/review_apps.md
+++ b/doc/development/testing_guide/review_apps.md
@@ -132,7 +132,7 @@ to prevent other pods from being scheduled on this node pool.
 This is to ensure Tiller isn't affected by "noisy" neighbors that could put
 their node under pressure.
 
-## How to:
+## How to
 
 ### Log into my Review App
 
diff --git a/doc/development/testing_guide/testing_levels.md b/doc/development/testing_guide/testing_levels.md
index 0090c84cbf0..1aee306f492 100644
--- a/doc/development/testing_guide/testing_levels.md
+++ b/doc/development/testing_guide/testing_levels.md
@@ -126,7 +126,7 @@ possible).
 | ---------- | -------------- | ----- |
 | `spec/features/` | [Capybara] + [RSpec] | If your test has the `:js` metadata, the browser driver will be [Poltergeist], otherwise it's using [RackTest]. |
 
-### Consider **not** writing a system test!
+### Consider **not** writing a system test
 
 If we're confident that the low-level components work well (and we should be if
 we have enough Unit & Integration tests), we shouldn't need to duplicate their
-- 
cgit v1.2.1


From 295b1b4d02b1ce68ed88a52837f560abae66036f Mon Sep 17 00:00:00 2001
From: Achilleas Pipinellis <axil@gitlab.com>
Date: Wed, 28 Aug 2019 08:10:00 +0200
Subject: Remove a section for a now fixed bug

Those guidelines where based on
https://gitlab.com/gitlab-org/gitlab-docs/issues/311 which seems
to be fixed.
---
 doc/development/documentation/styleguide.md | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/doc/development/documentation/styleguide.md b/doc/development/documentation/styleguide.md
index c1e3eb9680b..6f76b506400 100644
--- a/doc/development/documentation/styleguide.md
+++ b/doc/development/documentation/styleguide.md
@@ -506,15 +506,6 @@ Example:
 For more information, see the [confidential issue](../../user/project/issues/confidential_issues.md) `https://gitlab.com/gitlab-org/gitlab-ce/issues/<issue_number>`.
 ```
 
-### Unlinking emails
-
-By default, all email addresses will render in an email tag on docs.gitlab.com.
-To escape the code block and unlink email addresses, use two backticks:
-
-```md
-`` example@email.com ``
-```
-
 ## Navigation
 
 To indicate the steps of navigation through the UI:
-- 
cgit v1.2.1


From 67cd422bc0e0f7e811e00559a92dd438a1ec9a6d Mon Sep 17 00:00:00 2001
From: Evan Read <eread@gitlab.com>
Date: Wed, 28 Aug 2019 06:22:49 +0000
Subject: Edit Feature Flags topic

---
 doc/user/project/operations/feature_flags.md | 31 ++++++++++++++++------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/doc/user/project/operations/feature_flags.md b/doc/user/project/operations/feature_flags.md
index 75b0623e6b0..6536a1a0a4b 100644
--- a/doc/user/project/operations/feature_flags.md
+++ b/doc/user/project/operations/feature_flags.md
@@ -85,7 +85,7 @@ NOTE: **NOTE**
 We'd highly recommend you to use the [Environment](../../../ci/environments.md)
 feature in order to quickly assess which flag is enabled per environment.
 
-## Rollout Strategy
+## Rollout strategy
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/8240) in GitLab 12.2.
 
@@ -97,33 +97,38 @@ However, a feature will be enabled for 50% of logged-in users if the matching en
 
 ### All users
 
-Enables the feature for all users.
-
-**All users** is implemented using the Unleash [default](https://unleash.github.io/docs/activation_strategy#default) activation strategy.
+Enables the feature for all users. It is implemented using the Unleash
+[`default`](https://unleash.github.io/docs/activation_strategy#default)
+activation strategy.
 
 ### Percent rollout (logged in users)
 
-**Percent rollout (logged in users)** enables the feature for a percentage of authenticated users. Set a value of 15%, for example, to enable the feature for 15% of authenticated users.
+Enables the feature for a percentage of authenticated users. It is
+implemented using the Unleash
+[`gradualRolloutUserId`](https://unleash.github.io/docs/activation_strategy#gradualrolloutuserid)
+activation strategy.
+
+Set a value of 15%, for example, to enable the feature for 15% of authenticated users.
 
 A rollout percentage may be between 0% and 100%.
 
 CAUTION: **Caution:**
-If this strategy is selected, then the Unleash client **must** be given a user id for the feature to be enabled. See the [Ruby example](#ruby-application-example) below.
+If this strategy is selected, then the Unleash client **must** be given a user
+ID for the feature to be enabled. See the [Ruby example](#ruby-application-example) below.
 
-**Percent rollout (logged in users)** is implemented using the Unleash [gradualRolloutUserId](https://unleash.github.io/docs/activation_strategy#gradualrolloutuserid) activation strategy.
-
-## Target Users
+## Target users
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/8240) in GitLab 12.2.
 
-A feature flag may be enabled for a list of target users.
+A feature flag may be enabled for a list of target users. It is implemented
+using the Unleash [`userWithId`](https://unleash.github.io/docs/activation_strategy#userwithid)
+activation strategy.
 
 ![Feature flag target users](img/target_users_v12_2.png)
 
 CAUTION: **Caution:**
-The Unleash client **must** be given a user id for the feature to be enabled for target users. See the [Ruby example](#ruby-application-example) below.
-
-**Target users** is implemented using the Unleash [userWithId](https://unleash.github.io/docs/activation_strategy#userwithid) activation strategy.
+The Unleash client **must** be given a user ID for the feature to be enabled for
+target users. See the [Ruby example](#ruby-application-example) below.
 
 ## Integrating with your application
 
-- 
cgit v1.2.1


From 4f2ac51644754f9a4d4df697ac8984180b0bfdca Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Thu, 22 Aug 2019 11:42:16 +0200
Subject: Add Rubocop check to avoid using `be_success`

Prevent using `be_success` call in controller specs to avoid
getting following deprecation warning:

```
DEPRECATION WARNING: The success? predicate is deprecated and
will be removed in Rails 6.0.
Please use successful? as provided by Rack::Response::Helpers.
```
---
 rubocop/cop/rspec/be_success_matcher.rb           | 50 +++++++++++++++
 rubocop/rubocop.rb                                |  1 +
 rubocop/spec_helpers.rb                           | 46 ++++++++++++++
 spec/rubocop/cop/rspec/be_success_matcher_spec.rb | 77 +++++++++++++++++++++++
 4 files changed, 174 insertions(+)
 create mode 100644 rubocop/cop/rspec/be_success_matcher.rb
 create mode 100644 rubocop/spec_helpers.rb
 create mode 100644 spec/rubocop/cop/rspec/be_success_matcher_spec.rb

diff --git a/rubocop/cop/rspec/be_success_matcher.rb b/rubocop/cop/rspec/be_success_matcher.rb
new file mode 100644
index 00000000000..a137e2dba69
--- /dev/null
+++ b/rubocop/cop/rspec/be_success_matcher.rb
@@ -0,0 +1,50 @@
+require_relative '../../spec_helpers'
+
+module RuboCop
+  module Cop
+    module RSpec
+      # This cop checks for `be_success` usage in controller specs
+      #
+      # @example
+      #
+      #   # bad
+      #   it "responds with success" do
+      #     expect(response).to be_success
+      #   end
+      #
+      #   it { is_expected.to be_success }
+      #
+      #   # good
+      #   it "responds with success" do
+      #     expect(response).to be_successful
+      #   end
+      #
+      #   it { is_expected.to be_successful }
+      #
+      class BeSuccessMatcher < RuboCop::Cop::Cop
+        include SpecHelpers
+
+        MESSAGE = "Don't use deprecated `success?` method, use `successful?` instead.".freeze
+
+        def_node_search :expect_to_be_success?, <<~PATTERN
+          (send (send nil? :expect (send nil? ...)) :to (send nil? :be_success))
+        PATTERN
+
+        def_node_search :is_expected_to_be_success?, <<~PATTERN
+          (send (send nil? :is_expected) :to (send nil? :be_success))
+        PATTERN
+
+        def be_success_usage?(node)
+          expect_to_be_success?(node) || is_expected_to_be_success?(node)
+        end
+
+        def on_send(node)
+          return unless in_controller_spec?(node)
+          return unless be_success_usage?(node)
+
+          add_offense(node, location: :expression, message: MESSAGE)
+        end
+      end
+    end
+  end
+end
diff --git a/rubocop/rubocop.rb b/rubocop/rubocop.rb
index d1328c4eb38..c342df6d6c9 100644
--- a/rubocop/rubocop.rb
+++ b/rubocop/rubocop.rb
@@ -31,6 +31,7 @@ require_relative 'cop/migration/timestamps'
 require_relative 'cop/migration/update_column_in_batches'
 require_relative 'cop/migration/update_large_table'
 require_relative 'cop/project_path_helper'
+require_relative 'cop/rspec/be_success_matcher'
 require_relative 'cop/rspec/env_assignment'
 require_relative 'cop/rspec/factories_in_migration_specs'
 require_relative 'cop/rspec/top_level_describe_path'
diff --git a/rubocop/spec_helpers.rb b/rubocop/spec_helpers.rb
new file mode 100644
index 00000000000..b38dc3f8cdb
--- /dev/null
+++ b/rubocop/spec_helpers.rb
@@ -0,0 +1,46 @@
+module RuboCop
+  module SpecHelpers
+    SPEC_HELPERS = %w[fast_spec_helper.rb rails_helper.rb spec_helper.rb].freeze
+    MIGRATION_SPEC_DIRECTORIES = ['spec/migrations', 'spec/lib/gitlab/background_migration'].freeze
+    CONTROLLER_SPEC_DIRECTORIES = ['spec/controllers', 'spec/support/shared_examples/controllers'].freeze
+
+    # Returns true if the given node originated from the spec directory.
+    def in_spec?(node)
+      path = node.location.expression.source_buffer.name
+      pwd = RuboCop::PathUtil.pwd
+
+      !SPEC_HELPERS.include?(File.basename(path)) &&
+        path.start_with?(File.join(pwd, 'spec'), File.join(pwd, 'ee', 'spec'))
+    end
+
+    def migration_directories
+      @migration_directories ||= MIGRATION_SPEC_DIRECTORIES.map do |dir|
+        pwd = RuboCop::PathUtil.pwd
+        [File.join(pwd, dir), File.join(pwd, 'ee', dir)]
+      end.flatten
+    end
+
+    # Returns true if the given node originated from a migration spec.
+    def in_migration_spec?(node)
+      path = node.location.expression.source_buffer.name
+
+      in_spec?(node) &&
+        path.start_with?(*migration_directories)
+    end
+
+    def controller_directories
+      @controller_directories ||= CONTROLLER_SPEC_DIRECTORIES.map do |dir|
+        pwd = RuboCop::PathUtil.pwd
+        [File.join(pwd, dir), File.join(pwd, 'ee', dir)]
+      end.flatten
+    end
+
+    # Returns true if the given node originated from a controller spec.
+    def in_controller_spec?(node)
+      path = node.location.expression.source_buffer.name
+
+      in_spec?(node) &&
+        path.start_with?(*controller_directories)
+    end
+  end
+end
diff --git a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
new file mode 100644
index 00000000000..fcb5791ef57
--- /dev/null
+++ b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
@@ -0,0 +1,77 @@
+require 'spec_helper'
+
+require 'rubocop'
+require 'rubocop/rspec/support'
+
+require_relative '../../../../rubocop/cop/rspec/be_success_matcher'
+
+describe RuboCop::Cop::RSpec::BeSuccessMatcher do
+  include CopHelper
+
+  OFFENSE_CALL_EXPECT_TO_BE_SUCCESS = %(expect(response).to be_success).freeze
+  OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS = %(is_expected.to be_success).freeze
+  CALL_EXPECT_TO_BE_SUCCESSFUL = %(expect(response).to be_successful).freeze
+  CALL_IS_EXPECTED_TO_BE_SUCCESSFUL = %(is_expected.to be_successful).freeze
+
+  let(:source_file) { 'spec/foo_spec.rb' }
+
+  subject(:cop) { described_class.new }
+
+  shared_examples 'an offensive be_success call' do |content|
+    it "registers an offense for `#{content}`" do
+      inspect_source(content, source_file)
+
+      expect(cop.offenses.size).to eq(1)
+      expect(cop.offenses.map(&:line)).to eq([1])
+      expect(cop.highlights).to eq([content])
+    end
+  end
+
+  context 'in a controller spec file' do
+    before do
+      allow(cop).to receive(:in_controller_spec?).and_return(true)
+    end
+
+    context "using expect(response).to be_success call" do
+      it_behaves_like 'an offensive be_success call', OFFENSE_CALL_EXPECT_TO_BE_SUCCESS
+    end
+
+    context "using is_expected.to be_success call" do
+      it_behaves_like 'an offensive be_success call', OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS
+    end
+
+    context "using expect(response).to be_successful" do
+      it "does not register an offense" do
+        inspect_source(CALL_EXPECT_TO_BE_SUCCESSFUL)
+
+        expect(cop.offenses.size).to eq(0)
+      end
+    end
+
+    context "using is_expected.to be_successful" do
+      it "does not register an offense" do
+        inspect_source(CALL_IS_EXPECTED_TO_BE_SUCCESSFUL)
+
+        expect(cop.offenses.size).to eq(0)
+      end
+    end
+  end
+
+  context 'outside of a controller spec file' do
+    context "using expect(response).to be_success call" do
+      it "does not register an offense" do
+        inspect_source(OFFENSE_CALL_EXPECT_TO_BE_SUCCESS)
+
+        expect(cop.offenses.size).to eq(0)
+      end
+    end
+
+    context "using is_expected.to be_success call" do
+      it "does not register an offense" do
+        inspect_source(OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS)
+
+        expect(cop.offenses.size).to eq(0)
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 3a71ab523ebe9e8d30aabbf12e659eb75036d0b5 Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Thu, 22 Aug 2019 11:57:33 +0200
Subject: Autocorrect `be_success` to `be_successful`

---
 rubocop/cop/rspec/be_success_matcher.rb           |  6 ++++++
 spec/rubocop/cop/rspec/be_success_matcher_spec.rb | 10 ++++++++++
 2 files changed, 16 insertions(+)

diff --git a/rubocop/cop/rspec/be_success_matcher.rb b/rubocop/cop/rspec/be_success_matcher.rb
index a137e2dba69..4ca1a7190b0 100644
--- a/rubocop/cop/rspec/be_success_matcher.rb
+++ b/rubocop/cop/rspec/be_success_matcher.rb
@@ -44,6 +44,12 @@ module RuboCop
 
           add_offense(node, location: :expression, message: MESSAGE)
         end
+
+        def autocorrect(node)
+          lambda do |corrector|
+            corrector.insert_after(node.loc.expression, "ful")
+          end
+        end
       end
     end
   end
diff --git a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
index fcb5791ef57..0d86553af36 100644
--- a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
+++ b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
@@ -27,6 +27,14 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
     end
   end
 
+  shared_examples 'an autocorrected be_success call' do |content, autocorrected_content|
+    it "registers an offense for `#{content}` and autocorrects it to `#{autocorrected_content}`" do
+      autocorrected = autocorrect_source(content, source_file)
+
+      expect(autocorrected).to eql(autocorrected_content)
+    end
+  end
+
   context 'in a controller spec file' do
     before do
       allow(cop).to receive(:in_controller_spec?).and_return(true)
@@ -34,10 +42,12 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
 
     context "using expect(response).to be_success call" do
       it_behaves_like 'an offensive be_success call', OFFENSE_CALL_EXPECT_TO_BE_SUCCESS
+      it_behaves_like 'an autocorrected be_success call', OFFENSE_CALL_EXPECT_TO_BE_SUCCESS, CALL_EXPECT_TO_BE_SUCCESSFUL
     end
 
     context "using is_expected.to be_success call" do
       it_behaves_like 'an offensive be_success call', OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS
+      it_behaves_like 'an autocorrected be_success call', OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS, CALL_IS_EXPECTED_TO_BE_SUCCESSFUL
     end
 
     context "using expect(response).to be_successful" do
-- 
cgit v1.2.1


From d40b7ea37534e57d134b9a5e1268aa87d53c513d Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Thu, 22 Aug 2019 12:14:30 +0200
Subject: Enable frozen string literal

---
 rubocop/cop/rspec/be_success_matcher.rb           | 2 ++
 spec/rubocop/cop/rspec/be_success_matcher_spec.rb | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/rubocop/cop/rspec/be_success_matcher.rb b/rubocop/cop/rspec/be_success_matcher.rb
index 4ca1a7190b0..9ab344a3762 100644
--- a/rubocop/cop/rspec/be_success_matcher.rb
+++ b/rubocop/cop/rspec/be_success_matcher.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../spec_helpers'
 
 module RuboCop
diff --git a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
index 0d86553af36..26044b1ef24 100644
--- a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
+++ b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 require 'rubocop'
-- 
cgit v1.2.1


From e1b8b93207ccbe3221f5c8e0447d17582f14a0db Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Fri, 23 Aug 2019 09:33:33 +0200
Subject: Replace double quotes with single quotes

---
 rubocop/cop/rspec/be_success_matcher.rb           |  4 ++--
 spec/rubocop/cop/rspec/be_success_matcher_spec.rb | 18 +++++++++---------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/rubocop/cop/rspec/be_success_matcher.rb b/rubocop/cop/rspec/be_success_matcher.rb
index 9ab344a3762..18bcfa6d582 100644
--- a/rubocop/cop/rspec/be_success_matcher.rb
+++ b/rubocop/cop/rspec/be_success_matcher.rb
@@ -26,7 +26,7 @@ module RuboCop
       class BeSuccessMatcher < RuboCop::Cop::Cop
         include SpecHelpers
 
-        MESSAGE = "Don't use deprecated `success?` method, use `successful?` instead.".freeze
+        MESSAGE = 'Do not use deprecated `success?` method, use `successful?` instead.'.freeze
 
         def_node_search :expect_to_be_success?, <<~PATTERN
           (send (send nil? :expect (send nil? ...)) :to (send nil? :be_success))
@@ -49,7 +49,7 @@ module RuboCop
 
         def autocorrect(node)
           lambda do |corrector|
-            corrector.insert_after(node.loc.expression, "ful")
+            corrector.insert_after(node.loc.expression, 'ful')
           end
         end
       end
diff --git a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
index 26044b1ef24..b55e63ec7f0 100644
--- a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
+++ b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
@@ -42,17 +42,17 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
       allow(cop).to receive(:in_controller_spec?).and_return(true)
     end
 
-    context "using expect(response).to be_success call" do
+    context 'using expect(response).to be_success call' do
       it_behaves_like 'an offensive be_success call', OFFENSE_CALL_EXPECT_TO_BE_SUCCESS
       it_behaves_like 'an autocorrected be_success call', OFFENSE_CALL_EXPECT_TO_BE_SUCCESS, CALL_EXPECT_TO_BE_SUCCESSFUL
     end
 
-    context "using is_expected.to be_success call" do
+    context 'using is_expected.to be_success call' do
       it_behaves_like 'an offensive be_success call', OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS
       it_behaves_like 'an autocorrected be_success call', OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS, CALL_IS_EXPECTED_TO_BE_SUCCESSFUL
     end
 
-    context "using expect(response).to be_successful" do
+    context 'using expect(response).to be_successful' do
       it "does not register an offense" do
         inspect_source(CALL_EXPECT_TO_BE_SUCCESSFUL)
 
@@ -60,8 +60,8 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
       end
     end
 
-    context "using is_expected.to be_successful" do
-      it "does not register an offense" do
+    context 'using is_expected.to be_successful' do
+      it 'does not register an offense' do
         inspect_source(CALL_IS_EXPECTED_TO_BE_SUCCESSFUL)
 
         expect(cop.offenses.size).to eq(0)
@@ -70,16 +70,16 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
   end
 
   context 'outside of a controller spec file' do
-    context "using expect(response).to be_success call" do
-      it "does not register an offense" do
+    context 'using expect(response).to be_success call' do
+      it 'does not register an offense' do
         inspect_source(OFFENSE_CALL_EXPECT_TO_BE_SUCCESS)
 
         expect(cop.offenses.size).to eq(0)
       end
     end
 
-    context "using is_expected.to be_success call" do
-      it "does not register an offense" do
+    context 'using is_expected.to be_success call' do
+      it 'does not register an offense' do
         inspect_source(OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS)
 
         expect(cop.offenses.size).to eq(0)
-- 
cgit v1.2.1


From 23da356dd1a048ca86c95960fb0b76df914f9087 Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Fri, 23 Aug 2019 10:57:46 +0200
Subject: Refactor BeSuccessMatcher specs

---
 spec/rubocop/cop/rspec/be_success_matcher_spec.rb | 61 ++++++++++-------------
 1 file changed, 25 insertions(+), 36 deletions(-)

diff --git a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
index b55e63ec7f0..9965b8ddf86 100644
--- a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
+++ b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
@@ -10,10 +10,16 @@ require_relative '../../../../rubocop/cop/rspec/be_success_matcher'
 describe RuboCop::Cop::RSpec::BeSuccessMatcher do
   include CopHelper
 
-  OFFENSE_CALL_EXPECT_TO_BE_SUCCESS = %(expect(response).to be_success).freeze
-  OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS = %(is_expected.to be_success).freeze
-  CALL_EXPECT_TO_BE_SUCCESSFUL = %(expect(response).to be_successful).freeze
-  CALL_IS_EXPECTED_TO_BE_SUCCESSFUL = %(is_expected.to be_successful).freeze
+  CODE_EXAMPLES = [
+    {
+      bad: %(expect(response).to be_success).freeze,
+      good: %(expect(response).to be_successful).freeze
+    },
+    {
+      bad: %(is_expected.to be_success).freeze,
+      good: %(is_expected.to be_successful).freeze
+    }
+  ]
 
   let(:source_file) { 'spec/foo_spec.rb' }
 
@@ -42,47 +48,30 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
       allow(cop).to receive(:in_controller_spec?).and_return(true)
     end
 
-    context 'using expect(response).to be_success call' do
-      it_behaves_like 'an offensive be_success call', OFFENSE_CALL_EXPECT_TO_BE_SUCCESS
-      it_behaves_like 'an autocorrected be_success call', OFFENSE_CALL_EXPECT_TO_BE_SUCCESS, CALL_EXPECT_TO_BE_SUCCESSFUL
-    end
-
-    context 'using is_expected.to be_success call' do
-      it_behaves_like 'an offensive be_success call', OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS
-      it_behaves_like 'an autocorrected be_success call', OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS, CALL_IS_EXPECTED_TO_BE_SUCCESSFUL
-    end
-
-    context 'using expect(response).to be_successful' do
-      it "does not register an offense" do
-        inspect_source(CALL_EXPECT_TO_BE_SUCCESSFUL)
-
-        expect(cop.offenses.size).to eq(0)
+    CODE_EXAMPLES.each do |code_example|
+      context "using #{code_example[:bad]} call" do
+        it_behaves_like 'an offensive be_success call', code_example[:bad]
+        it_behaves_like 'an autocorrected be_success call', code_example[:bad], code_example[:good]
       end
-    end
 
-    context 'using is_expected.to be_successful' do
-      it 'does not register an offense' do
-        inspect_source(CALL_IS_EXPECTED_TO_BE_SUCCESSFUL)
+      context "using #{code_example[:good]} call" do
+        it "does not register an offense" do
+          inspect_source(code_example[:good])
 
-        expect(cop.offenses.size).to eq(0)
+          expect(cop.offenses.size).to eq(0)
+        end
       end
     end
   end
 
   context 'outside of a controller spec file' do
-    context 'using expect(response).to be_success call' do
-      it 'does not register an offense' do
-        inspect_source(OFFENSE_CALL_EXPECT_TO_BE_SUCCESS)
-
-        expect(cop.offenses.size).to eq(0)
-      end
-    end
-
-    context 'using is_expected.to be_success call' do
-      it 'does not register an offense' do
-        inspect_source(OFFENSE_CALL_IS_EXPECTED_TO_BE_SUCCESS)
+    CODE_EXAMPLES.each do |code_example|
+      context "using #{code_example[:bad]} call" do
+        it 'does not register an offense' do
+          inspect_source(code_example[:bad])
 
-        expect(cop.offenses.size).to eq(0)
+          expect(cop.offenses.size).to eq(0)
+        end
       end
     end
   end
-- 
cgit v1.2.1


From b61d26f496a2041d7124fd3280031deda3cf5a43 Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Fri, 23 Aug 2019 11:05:50 +0200
Subject: Add support of not_to/to_not to BeSuccessMatcher

BeSuccessMatcher now supports following examples:

```
expect(response).to be_success
expect(response).to_not be_success
expect(response).not_to be_success

is_expected.to be_success
is_expected.to_not be_success
is_expected.not_to be_success
```
---
 rubocop/cop/rspec/be_success_matcher.rb           |  4 ++--
 spec/rubocop/cop/rspec/be_success_matcher_spec.rb | 20 ++++++++++++++++++--
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/rubocop/cop/rspec/be_success_matcher.rb b/rubocop/cop/rspec/be_success_matcher.rb
index 18bcfa6d582..ca937a8ee9f 100644
--- a/rubocop/cop/rspec/be_success_matcher.rb
+++ b/rubocop/cop/rspec/be_success_matcher.rb
@@ -29,11 +29,11 @@ module RuboCop
         MESSAGE = 'Do not use deprecated `success?` method, use `successful?` instead.'.freeze
 
         def_node_search :expect_to_be_success?, <<~PATTERN
-          (send (send nil? :expect (send nil? ...)) :to (send nil? :be_success))
+          (send (send nil? :expect (send nil? ...)) {:to :not_to :to_not} (send nil? :be_success))
         PATTERN
 
         def_node_search :is_expected_to_be_success?, <<~PATTERN
-          (send (send nil? :is_expected) :to (send nil? :be_success))
+          (send (send nil? :is_expected) {:to :not_to :to_not} (send nil? :be_success))
         PATTERN
 
         def be_success_usage?(node)
diff --git a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
index 9965b8ddf86..95f08a61557 100644
--- a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
+++ b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
@@ -15,11 +15,27 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
       bad: %(expect(response).to be_success).freeze,
       good: %(expect(response).to be_successful).freeze
     },
+    {
+      bad: %(expect(response).to_not be_success).freeze,
+      good: %(expect(response).to_not be_successful).freeze
+    },
+    {
+      bad: %(expect(response).not_to be_success).freeze,
+      good: %(expect(response).not_to be_successful).freeze
+    },
     {
       bad: %(is_expected.to be_success).freeze,
       good: %(is_expected.to be_successful).freeze
+    },
+    {
+      bad: %(is_expected.to_not be_success).freeze,
+      good: %(is_expected.to_not be_successful).freeze
+    },
+    {
+      bad: %(is_expected.not_to be_success).freeze,
+      good: %(is_expected.not_to be_successful).freeze
     }
-  ]
+  ].freeze
 
   let(:source_file) { 'spec/foo_spec.rb' }
 
@@ -55,7 +71,7 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
       end
 
       context "using #{code_example[:good]} call" do
-        it "does not register an offense" do
+        it 'does not register an offense' do
           inspect_source(code_example[:good])
 
           expect(cop.offenses.size).to eq(0)
-- 
cgit v1.2.1


From 99b27e69510e83006d4dd2e5ecc5c555409aa4a0 Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Mon, 26 Aug 2019 10:04:54 +0200
Subject: Utilize Rubocop's Include for BeSuccessMatcher

Use Rubocop's Include
instead of manually checking the matcher in controllers specs.
---
 .rubocop.yml                                      |  8 ++++++
 rubocop/cop/rspec/be_success_matcher.rb           |  1 -
 rubocop/spec_helpers.rb                           | 16 -----------
 spec/rubocop/cop/rspec/be_success_matcher_spec.rb | 34 ++++++-----------------
 4 files changed, 16 insertions(+), 43 deletions(-)

diff --git a/.rubocop.yml b/.rubocop.yml
index 012f4890c33..1319752fc9c 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -265,3 +265,11 @@ RSpec/EnvAssignment:
     - 'ee/spec/**/rails_helper.rb'
     - 'spec/**/spec_helper.rb'
     - 'ee/spec/**/spec_helper.rb'
+RSpec/BeSuccessMatcher:
+  Enabled: true
+  Include:
+    - 'spec/controllers/**/*'
+    - 'ee/spec/controllers/**/*'
+    - 'spec/support/shared_examples/controllers/**/*'
+    - 'ee/spec/support/shared_examples/controllers/**/*'
+    - 'spec/support/controllers/**/*'
diff --git a/rubocop/cop/rspec/be_success_matcher.rb b/rubocop/cop/rspec/be_success_matcher.rb
index ca937a8ee9f..0b7d737f4e2 100644
--- a/rubocop/cop/rspec/be_success_matcher.rb
+++ b/rubocop/cop/rspec/be_success_matcher.rb
@@ -41,7 +41,6 @@ module RuboCop
         end
 
         def on_send(node)
-          return unless in_controller_spec?(node)
           return unless be_success_usage?(node)
 
           add_offense(node, location: :expression, message: MESSAGE)
diff --git a/rubocop/spec_helpers.rb b/rubocop/spec_helpers.rb
index b38dc3f8cdb..ecd77c4351d 100644
--- a/rubocop/spec_helpers.rb
+++ b/rubocop/spec_helpers.rb
@@ -2,7 +2,6 @@ module RuboCop
   module SpecHelpers
     SPEC_HELPERS = %w[fast_spec_helper.rb rails_helper.rb spec_helper.rb].freeze
     MIGRATION_SPEC_DIRECTORIES = ['spec/migrations', 'spec/lib/gitlab/background_migration'].freeze
-    CONTROLLER_SPEC_DIRECTORIES = ['spec/controllers', 'spec/support/shared_examples/controllers'].freeze
 
     # Returns true if the given node originated from the spec directory.
     def in_spec?(node)
@@ -27,20 +26,5 @@ module RuboCop
       in_spec?(node) &&
         path.start_with?(*migration_directories)
     end
-
-    def controller_directories
-      @controller_directories ||= CONTROLLER_SPEC_DIRECTORIES.map do |dir|
-        pwd = RuboCop::PathUtil.pwd
-        [File.join(pwd, dir), File.join(pwd, 'ee', dir)]
-      end.flatten
-    end
-
-    # Returns true if the given node originated from a controller spec.
-    def in_controller_spec?(node)
-      path = node.location.expression.source_buffer.name
-
-      in_spec?(node) &&
-        path.start_with?(*controller_directories)
-    end
   end
 end
diff --git a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
index 95f08a61557..77aff7c9dcc 100644
--- a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
+++ b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
@@ -59,35 +59,17 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
     end
   end
 
-  context 'in a controller spec file' do
-    before do
-      allow(cop).to receive(:in_controller_spec?).and_return(true)
+  CODE_EXAMPLES.each do |code_example|
+    context "using #{code_example[:bad]} call" do
+      it_behaves_like 'an offensive be_success call', code_example[:bad]
+      it_behaves_like 'an autocorrected be_success call', code_example[:bad], code_example[:good]
     end
 
-    CODE_EXAMPLES.each do |code_example|
-      context "using #{code_example[:bad]} call" do
-        it_behaves_like 'an offensive be_success call', code_example[:bad]
-        it_behaves_like 'an autocorrected be_success call', code_example[:bad], code_example[:good]
-      end
-
-      context "using #{code_example[:good]} call" do
-        it 'does not register an offense' do
-          inspect_source(code_example[:good])
-
-          expect(cop.offenses.size).to eq(0)
-        end
-      end
-    end
-  end
-
-  context 'outside of a controller spec file' do
-    CODE_EXAMPLES.each do |code_example|
-      context "using #{code_example[:bad]} call" do
-        it 'does not register an offense' do
-          inspect_source(code_example[:bad])
+    context "using #{code_example[:good]} call" do
+      it 'does not register an offense' do
+        inspect_source(code_example[:good])
 
-          expect(cop.offenses.size).to eq(0)
-        end
+        expect(cop.offenses.size).to eq(0)
       end
     end
   end
-- 
cgit v1.2.1


From 17385f4dc42d86d7606e3359b9db82cb43d5e534 Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Mon, 26 Aug 2019 15:13:41 +0200
Subject: Refactor BeSuccessMatcher specs for readability

---
 .rubocop.yml                                      |  1 +
 rubocop/cop/rspec/be_success_matcher.rb           |  2 +-
 spec/rubocop/cop/rspec/be_success_matcher_spec.rb | 65 +++++++++++------------
 3 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/.rubocop.yml b/.rubocop.yml
index 1319752fc9c..573f2fbb6c6 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -273,3 +273,4 @@ RSpec/BeSuccessMatcher:
     - 'spec/support/shared_examples/controllers/**/*'
     - 'ee/spec/support/shared_examples/controllers/**/*'
     - 'spec/support/controllers/**/*'
+    - 'ee/spec/support/controllers/**/*'
diff --git a/rubocop/cop/rspec/be_success_matcher.rb b/rubocop/cop/rspec/be_success_matcher.rb
index 0b7d737f4e2..07dad061613 100644
--- a/rubocop/cop/rspec/be_success_matcher.rb
+++ b/rubocop/cop/rspec/be_success_matcher.rb
@@ -26,7 +26,7 @@ module RuboCop
       class BeSuccessMatcher < RuboCop::Cop::Cop
         include SpecHelpers
 
-        MESSAGE = 'Do not use deprecated `success?` method, use `successful?` instead.'.freeze
+        MESSAGE = 'Do not use deprecated `success?` method, use `successful?` instead.'
 
         def_node_search :expect_to_be_success?, <<~PATTERN
           (send (send nil? :expect (send nil? ...)) {:to :not_to :to_not} (send nil? :be_success))
diff --git a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
index 77aff7c9dcc..0b4e9853dae 100644
--- a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
+++ b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
@@ -10,33 +10,6 @@ require_relative '../../../../rubocop/cop/rspec/be_success_matcher'
 describe RuboCop::Cop::RSpec::BeSuccessMatcher do
   include CopHelper
 
-  CODE_EXAMPLES = [
-    {
-      bad: %(expect(response).to be_success).freeze,
-      good: %(expect(response).to be_successful).freeze
-    },
-    {
-      bad: %(expect(response).to_not be_success).freeze,
-      good: %(expect(response).to_not be_successful).freeze
-    },
-    {
-      bad: %(expect(response).not_to be_success).freeze,
-      good: %(expect(response).not_to be_successful).freeze
-    },
-    {
-      bad: %(is_expected.to be_success).freeze,
-      good: %(is_expected.to be_successful).freeze
-    },
-    {
-      bad: %(is_expected.to_not be_success).freeze,
-      good: %(is_expected.to_not be_successful).freeze
-    },
-    {
-      bad: %(is_expected.not_to be_success).freeze,
-      good: %(is_expected.not_to be_successful).freeze
-    }
-  ].freeze
-
   let(:source_file) { 'spec/foo_spec.rb' }
 
   subject(:cop) { described_class.new }
@@ -59,18 +32,44 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
     end
   end
 
-  CODE_EXAMPLES.each do |code_example|
-    context "using #{code_example[:bad]} call" do
-      it_behaves_like 'an offensive be_success call', code_example[:bad]
-      it_behaves_like 'an autocorrected be_success call', code_example[:bad], code_example[:good]
+  shared_examples 'cop' do |good:, bad:|
+    context "using #{bad} call" do
+      it_behaves_like 'an offensive be_success call', bad
+      it_behaves_like 'an autocorrected be_success call', bad, good
     end
 
-    context "using #{code_example[:good]} call" do
+    context "using #{good} call" do
       it 'does not register an offense' do
-        inspect_source(code_example[:good])
+        inspect_source(good)
 
         expect(cop.offenses.size).to eq(0)
       end
     end
   end
+
+  describe 'using different code examples' do
+    it_behaves_like 'cop',
+      bad: 'expect(response).to be_success',
+      good: 'expect(response).to be_successful'
+
+    it_behaves_like 'cop',
+      bad: 'expect(response).to_not be_success',
+      good: 'expect(response).to_not be_successful'
+
+    it_behaves_like 'cop',
+      bad: 'expect(response).not_to be_success',
+      good: 'expect(response).not_to be_successful'
+
+    it_behaves_like 'cop',
+      bad: 'is_expected.to be_success',
+      good: 'is_expected.to be_successful'
+
+    it_behaves_like 'cop',
+      bad: 'is_expected.to_not be_success',
+      good: 'is_expected.to_not be_successful'
+
+    it_behaves_like 'cop',
+      bad: 'is_expected.not_to be_success',
+      good: 'is_expected.not_to be_successful'
+  end
 end
-- 
cgit v1.2.1


From 0fee944741ab24071417230d0acc5dbc93e96a0b Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Tue, 27 Aug 2019 07:30:17 +0200
Subject: Inline shared examples for BeSuccessMatcher

Former shared examples were used only once.
Inlining them makes tests more clear.
---
 spec/rubocop/cop/rspec/be_success_matcher_spec.rb | 71 ++++++++++-------------
 1 file changed, 31 insertions(+), 40 deletions(-)

diff --git a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
index 0b4e9853dae..a8512ae97ad 100644
--- a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
+++ b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
@@ -14,62 +14,53 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
 
   subject(:cop) { described_class.new }
 
-  shared_examples 'an offensive be_success call' do |content|
-    it "registers an offense for `#{content}`" do
-      inspect_source(content, source_file)
-
-      expect(cop.offenses.size).to eq(1)
-      expect(cop.offenses.map(&:line)).to eq([1])
-      expect(cop.highlights).to eq([content])
-    end
-  end
+  shared_examples 'cop' do |good:, bad:|
+    context "using #{bad} call" do
+      it "registers an offense for `#{bad}`" do
+        inspect_source(bad, source_file)
 
-  shared_examples 'an autocorrected be_success call' do |content, autocorrected_content|
-    it "registers an offense for `#{content}` and autocorrects it to `#{autocorrected_content}`" do
-      autocorrected = autocorrect_source(content, source_file)
+        expect(cop.offenses.size).to eq(1)
+        expect(cop.offenses.map(&:line)).to eq([1])
+        expect(cop.highlights).to eq([bad])
+      end
 
-      expect(autocorrected).to eql(autocorrected_content)
-    end
-  end
+      it "registers an offense for `#{bad}` and autocorrects it to `#{good}`" do
+        autocorrected = autocorrect_source(bad, source_file)
 
-  shared_examples 'cop' do |good:, bad:|
-    context "using #{bad} call" do
-      it_behaves_like 'an offensive be_success call', bad
-      it_behaves_like 'an autocorrected be_success call', bad, good
+        expect(autocorrected).to eql(good)
+      end
     end
 
     context "using #{good} call" do
       it 'does not register an offense' do
         inspect_source(good)
 
-        expect(cop.offenses.size).to eq(0)
+        expect(cop.offenses).to be_empty
       end
     end
   end
 
-  describe 'using different code examples' do
-    it_behaves_like 'cop',
-      bad: 'expect(response).to be_success',
-      good: 'expect(response).to be_successful'
+  it_behaves_like 'cop',
+    bad: 'expect(response).to be_success',
+    good: 'expect(response).to be_successful'
 
-    it_behaves_like 'cop',
-      bad: 'expect(response).to_not be_success',
-      good: 'expect(response).to_not be_successful'
+  it_behaves_like 'cop',
+    bad: 'expect(response).to_not be_success',
+    good: 'expect(response).to_not be_successful'
 
-    it_behaves_like 'cop',
-      bad: 'expect(response).not_to be_success',
-      good: 'expect(response).not_to be_successful'
+  it_behaves_like 'cop',
+    bad: 'expect(response).not_to be_success',
+    good: 'expect(response).not_to be_successful'
 
-    it_behaves_like 'cop',
-      bad: 'is_expected.to be_success',
-      good: 'is_expected.to be_successful'
+  it_behaves_like 'cop',
+    bad: 'is_expected.to be_success',
+    good: 'is_expected.to be_successful'
 
-    it_behaves_like 'cop',
-      bad: 'is_expected.to_not be_success',
-      good: 'is_expected.to_not be_successful'
+  it_behaves_like 'cop',
+    bad: 'is_expected.to_not be_success',
+    good: 'is_expected.to_not be_successful'
 
-    it_behaves_like 'cop',
-      bad: 'is_expected.not_to be_success',
-      good: 'is_expected.not_to be_successful'
-  end
+  it_behaves_like 'cop',
+    bad: 'is_expected.not_to be_success',
+    good: 'is_expected.not_to be_successful'
 end
-- 
cgit v1.2.1


From 69dbc5a5270a2b00bc2e359af37d6176748db400 Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Wed, 28 Aug 2019 08:48:14 +0200
Subject: Remove Rubocop::SpecHelper file

---
 rubocop/cop/rspec/be_success_matcher.rb           |  4 ---
 rubocop/spec_helpers.rb                           | 30 -----------------------
 spec/rubocop/cop/rspec/be_success_matcher_spec.rb |  3 ---
 3 files changed, 37 deletions(-)
 delete mode 100644 rubocop/spec_helpers.rb

diff --git a/rubocop/cop/rspec/be_success_matcher.rb b/rubocop/cop/rspec/be_success_matcher.rb
index 07dad061613..dce9604b3d7 100644
--- a/rubocop/cop/rspec/be_success_matcher.rb
+++ b/rubocop/cop/rspec/be_success_matcher.rb
@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require_relative '../../spec_helpers'
-
 module RuboCop
   module Cop
     module RSpec
@@ -24,8 +22,6 @@ module RuboCop
       #   it { is_expected.to be_successful }
       #
       class BeSuccessMatcher < RuboCop::Cop::Cop
-        include SpecHelpers
-
         MESSAGE = 'Do not use deprecated `success?` method, use `successful?` instead.'
 
         def_node_search :expect_to_be_success?, <<~PATTERN
diff --git a/rubocop/spec_helpers.rb b/rubocop/spec_helpers.rb
deleted file mode 100644
index ecd77c4351d..00000000000
--- a/rubocop/spec_helpers.rb
+++ /dev/null
@@ -1,30 +0,0 @@
-module RuboCop
-  module SpecHelpers
-    SPEC_HELPERS = %w[fast_spec_helper.rb rails_helper.rb spec_helper.rb].freeze
-    MIGRATION_SPEC_DIRECTORIES = ['spec/migrations', 'spec/lib/gitlab/background_migration'].freeze
-
-    # Returns true if the given node originated from the spec directory.
-    def in_spec?(node)
-      path = node.location.expression.source_buffer.name
-      pwd = RuboCop::PathUtil.pwd
-
-      !SPEC_HELPERS.include?(File.basename(path)) &&
-        path.start_with?(File.join(pwd, 'spec'), File.join(pwd, 'ee', 'spec'))
-    end
-
-    def migration_directories
-      @migration_directories ||= MIGRATION_SPEC_DIRECTORIES.map do |dir|
-        pwd = RuboCop::PathUtil.pwd
-        [File.join(pwd, dir), File.join(pwd, 'ee', dir)]
-      end.flatten
-    end
-
-    # Returns true if the given node originated from a migration spec.
-    def in_migration_spec?(node)
-      path = node.location.expression.source_buffer.name
-
-      in_spec?(node) &&
-        path.start_with?(*migration_directories)
-    end
-  end
-end
diff --git a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
index a8512ae97ad..17408a696de 100644
--- a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
+++ b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
@@ -2,9 +2,6 @@
 
 require 'spec_helper'
 
-require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/rspec/be_success_matcher'
 
 describe RuboCop::Cop::RSpec::BeSuccessMatcher do
-- 
cgit v1.2.1


From a83f68baa792a7b086c229dc42c6fc5702d2e410 Mon Sep 17 00:00:00 2001
From: Achilleas Pipinellis <axil@gitlab.com>
Date: Wed, 28 Aug 2019 06:48:58 +0000
Subject: Rename all filenames and occurrences to License Compliance

- New redirect doc/user/application_security/license_compliance/index.md
- Renaming of images.
- Some links that were pointing to the old location are fixed.
---
 doc/README.md                                      |   2 +-
 doc/ci/README.md                                   |   2 +-
 doc/ci/examples/license_management.md              |   4 +-
 doc/ci/yaml/README.md                              |   2 +-
 doc/development/go_guide/index.md                  |   2 +-
 doc/topics/autodevops/index.md                     |   2 +-
 .../license_compliance/img/license_compliance.png  | Bin 0 -> 5184 bytes
 .../img/license_compliance_add_license.png         | Bin 0 -> 24247 bytes
 .../img/license_compliance_decision.png            | Bin 0 -> 5975 bytes
 .../img/license_compliance_pipeline_tab.png        | Bin 0 -> 12115 bytes
 .../img/license_compliance_search.png              | Bin 0 -> 28237 bytes
 .../img/license_compliance_settings.png            | Bin 0 -> 44790 bytes
 .../license_compliance/index.md                    | 243 ++++++++++++++++++++
 .../license_management/img/license_management.png  | Bin 5184 -> 0 bytes
 .../img/license_management_add_license.png         | Bin 24247 -> 0 bytes
 .../img/license_management_decision.png            | Bin 5975 -> 0 bytes
 .../img/license_management_pipeline_tab.png        | Bin 12115 -> 0 bytes
 .../img/license_management_search.png              | Bin 28237 -> 0 bytes
 .../img/license_management_settings.png            | Bin 44790 -> 0 bytes
 .../license_management/index.md                    | 244 +--------------------
 doc/user/project/index.md                          |   2 +-
 doc/user/project/merge_requests/index.md           |   4 +-
 .../project/merge_requests/license_management.md   |   4 +-
 23 files changed, 257 insertions(+), 254 deletions(-)
 create mode 100644 doc/user/application_security/license_compliance/img/license_compliance.png
 create mode 100644 doc/user/application_security/license_compliance/img/license_compliance_add_license.png
 create mode 100644 doc/user/application_security/license_compliance/img/license_compliance_decision.png
 create mode 100644 doc/user/application_security/license_compliance/img/license_compliance_pipeline_tab.png
 create mode 100644 doc/user/application_security/license_compliance/img/license_compliance_search.png
 create mode 100644 doc/user/application_security/license_compliance/img/license_compliance_settings.png
 create mode 100644 doc/user/application_security/license_compliance/index.md
 delete mode 100644 doc/user/application_security/license_management/img/license_management.png
 delete mode 100644 doc/user/application_security/license_management/img/license_management_add_license.png
 delete mode 100644 doc/user/application_security/license_management/img/license_management_decision.png
 delete mode 100644 doc/user/application_security/license_management/img/license_management_pipeline_tab.png
 delete mode 100644 doc/user/application_security/license_management/img/license_management_search.png
 delete mode 100644 doc/user/application_security/license_management/img/license_management_settings.png

diff --git a/doc/README.md b/doc/README.md
index f12c06199c2..9a0252cc334 100644
--- a/doc/README.md
+++ b/doc/README.md
@@ -358,7 +358,7 @@ The following documentation relates to the DevOps **Secure** stage:
 | [Dependency Scanning](user/application_security/dependency_scanning/index.md) **(ULTIMATE)**          | Analyze your dependencies for known vulnerabilities.                   |
 | [Dynamic Application Security Testing (DAST)](user/application_security/dast/index.md) **(ULTIMATE)** | Analyze running web applications for known vulnerabilities.            |
 | [Group Security Dashboard](user/application_security/security_dashboard/index.md) **(ULTIMATE)**      | View vulnerabilities in all the projects in a group and its subgroups. |
-| [License Compliance](user/application_security/license_management/index.md) **(ULTIMATE)**            | Search your project's dependencies for their licenses.                 |
+| [License Compliance](user/application_security/license_compliance/index.md) **(ULTIMATE)**            | Search your project's dependencies for their licenses.                 |
 | [Project Security Dashboard](user/application_security/security_dashboard/index.md) **(ULTIMATE)**    | View the latest security reports for your project.                     |
 | [Static Application Security Testing (SAST)](user/application_security/sast/index.md) **(ULTIMATE)**  | Analyze source code for known vulnerabilities.                         |
 
diff --git a/doc/ci/README.md b/doc/ci/README.md
index 4be13204227..90d0e6a7dc6 100644
--- a/doc/ci/README.md
+++ b/doc/ci/README.md
@@ -131,7 +131,7 @@ Its feature set is listed on the table below according to DevOps stages.
 | **Secure** ||
 | [Container Scanning](../user/application_security/container_scanning/index.md) **(ULTIMATE)** | Check your Docker containers for known vulnerabilities.|
 | [Dependency Scanning](../user/application_security/dependency_scanning/index.md) **(ULTIMATE)** | Analyze your dependencies for known vulnerabilities. |
-| [License Compliance](../user/application_security/license_management/index.md) **(ULTIMATE)** | Search your project dependencies for their licenses. |
+| [License Compliance](../user/application_security/license_compliance/index.md) **(ULTIMATE)** | Search your project dependencies for their licenses. |
 | [Security Test reports](../user/project/merge_requests/index.md#security-reports-ultimate) **(ULTIMATE)** | Check for app vulnerabilities. |
 
 ## Examples
diff --git a/doc/ci/examples/license_management.md b/doc/ci/examples/license_management.md
index 53e38111bf3..0d12c9a20f2 100644
--- a/doc/ci/examples/license_management.md
+++ b/doc/ci/examples/license_management.md
@@ -1,5 +1,5 @@
 ---
-redirect_to: '../../user/application_security/license_management/index.md'
+redirect_to: '../../user/application_security/license_compliance/index.md'
 ---
 
-This document was moved to [another location](../../user/application_security/license_management/index.md).
+This document was moved to [another location](../../user/application_security/license_compliance/index.md).
diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md
index 06dceeb37d4..7a60dedc206 100644
--- a/doc/ci/yaml/README.md
+++ b/doc/ci/yaml/README.md
@@ -1699,7 +1699,7 @@ dashboards.
 
 > Introduced in GitLab 11.5. Requires GitLab Runner 11.5 and above.
 
-The `license_management` report collects [Licenses](../../user/project/merge_requests/license_management.md)
+The `license_management` report collects [Licenses](../../user/application_security/license_compliance/index.md)
 as artifacts.
 
 The collected License Compliance report will be uploaded to GitLab as an artifact and will
diff --git a/doc/development/go_guide/index.md b/doc/development/go_guide/index.md
index 83444093f9c..2df0e846671 100644
--- a/doc/development/go_guide/index.md
+++ b/doc/development/go_guide/index.md
@@ -94,7 +94,7 @@ become available, you will be able to share job templates like this
 Dependencies should be kept to the minimum. The introduction of a new
 dependency should be argued in the merge request, as per our [Approval
 Guidelines](../code_review.md#approval-guidelines). Both [License
-Management](../../user/project/merge_requests/license_management.md)
+Management](../../user/application_security/license_compliance/index.md)
 **(ULTIMATE)** and [Dependency
 Scanning](../../user/application_security/dependency_scanning/index.md)
 **(ULTIMATE)** should be activated on all projects to ensure new dependencies
diff --git a/doc/topics/autodevops/index.md b/doc/topics/autodevops/index.md
index 6021e8cff1d..19d8a6b5e2b 100644
--- a/doc/topics/autodevops/index.md
+++ b/doc/topics/autodevops/index.md
@@ -414,7 +414,7 @@ report is created, it's uploaded as an artifact which you can later download and
 check out.
 
 Any licenses are also shown in the merge request widget. Read more how
-[License Compliance works](../../user/application_security/license_management/index.md).
+[License Compliance works](../../user/application_security/license_compliance/index.md).
 
 ### Auto Container Scanning **(ULTIMATE)**
 
diff --git a/doc/user/application_security/license_compliance/img/license_compliance.png b/doc/user/application_security/license_compliance/img/license_compliance.png
new file mode 100644
index 00000000000..cdce6b5fe38
Binary files /dev/null and b/doc/user/application_security/license_compliance/img/license_compliance.png differ
diff --git a/doc/user/application_security/license_compliance/img/license_compliance_add_license.png b/doc/user/application_security/license_compliance/img/license_compliance_add_license.png
new file mode 100644
index 00000000000..c9a5dc14c57
Binary files /dev/null and b/doc/user/application_security/license_compliance/img/license_compliance_add_license.png differ
diff --git a/doc/user/application_security/license_compliance/img/license_compliance_decision.png b/doc/user/application_security/license_compliance/img/license_compliance_decision.png
new file mode 100644
index 00000000000..fbf90bec7fd
Binary files /dev/null and b/doc/user/application_security/license_compliance/img/license_compliance_decision.png differ
diff --git a/doc/user/application_security/license_compliance/img/license_compliance_pipeline_tab.png b/doc/user/application_security/license_compliance/img/license_compliance_pipeline_tab.png
new file mode 100644
index 00000000000..80ffca815b9
Binary files /dev/null and b/doc/user/application_security/license_compliance/img/license_compliance_pipeline_tab.png differ
diff --git a/doc/user/application_security/license_compliance/img/license_compliance_search.png b/doc/user/application_security/license_compliance/img/license_compliance_search.png
new file mode 100644
index 00000000000..b3ffd8d95a1
Binary files /dev/null and b/doc/user/application_security/license_compliance/img/license_compliance_search.png differ
diff --git a/doc/user/application_security/license_compliance/img/license_compliance_settings.png b/doc/user/application_security/license_compliance/img/license_compliance_settings.png
new file mode 100644
index 00000000000..2e3e8888e93
Binary files /dev/null and b/doc/user/application_security/license_compliance/img/license_compliance_settings.png differ
diff --git a/doc/user/application_security/license_compliance/index.md b/doc/user/application_security/license_compliance/index.md
new file mode 100644
index 00000000000..f74b958cf67
--- /dev/null
+++ b/doc/user/application_security/license_compliance/index.md
@@ -0,0 +1,243 @@
+---
+type: reference, howto
+---
+
+# License Compliance **(ULTIMATE)**
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5483) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.0.
+
+## Overview
+
+If you are using [GitLab CI/CD](../../../ci/README.md), you can search your project dependencies for their licenses
+using License Compliance.
+
+You can take advantage of License Compliance by either [including the job](#configuration)
+in your existing `.gitlab-ci.yml` file or by implicitly using
+[Auto License Compliance](../../../topics/autodevops/index.md#auto-license-compliance-ultimate)
+that is provided by [Auto DevOps](../../../topics/autodevops/index.md).
+
+GitLab checks the License Compliance report, compares the licenses between the
+source and target branches, and shows the information right on the merge request.
+Blacklisted licenses will be clearly visible with an `x` red icon next to them
+as well as new licenses which need a decision from you. In addition, you can
+[manually approve or blacklist](#project-policies-for-license-compliance)
+licenses in your project's settings.
+
+NOTE: **Note:**
+If the license compliance report doesn't have anything to compare to, no information
+will be displayed in the merge request area. That is the case when you add the
+`license_management` job in your `.gitlab-ci.yml` for the first time.
+Consecutive merge requests will have something to compare to and the license
+compliance report will be shown properly.
+
+![License Compliance Widget](img/license_compliance.png)
+
+If you are a project or group Maintainer, you can click on a license to be given
+the choice to approve it or blacklist it.
+
+![License approval decision](img/license_compliance_decision.png)
+
+## Use cases
+
+It helps you find what licenses your project uses in its dependencies, and decide for each of then
+whether to allow it or forbid it. For example, your application is using an external (open source)
+library whose license is incompatible with yours.
+
+## Supported languages and package managers
+
+The following languages and package managers are supported.
+
+| Language   | Package managers                                                  | Scan Tool                                                |
+|------------|-------------------------------------------------------------------|----------------------------------------------------------|
+| JavaScript | [Bower](https://bower.io/), [npm](https://www.npmjs.com/), [yarn](https://yarnpkg.com/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)) |[License Finder](https://github.com/pivotal/LicenseFinder)|
+| Go         | [Godep](https://github.com/tools/godep), go get ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)), gvt ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)), glide ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)), dep ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)), trash ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))  and govendor ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)), [go mod](https://github.com/golang/go/wiki/Modules) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))   |[License Finder](https://github.com/pivotal/LicenseFinder)|
+| Java       | [Gradle](https://gradle.org/), [Maven](https://maven.apache.org/) |[License Finder](https://github.com/pivotal/LicenseFinder)|
+| .NET       | [Nuget](https://www.nuget.org/)                                   |[License Finder](https://github.com/pivotal/LicenseFinder)|
+| Python     | [pip](https://pip.pypa.io/en/stable/)                             |[License Finder](https://github.com/pivotal/LicenseFinder)|
+| Ruby       | [gem](https://rubygems.org/)                                      |[License Finder](https://github.com/pivotal/LicenseFinder)|
+| Erlang     | [rebar](https://www.rebar3.org/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))|[License Finder](https://github.com/pivotal/LicenseFinder)|
+| Objective-C, Swift | [Carthage](https://github.com/Carthage/Carthage) , [CocoaPods v0.39 and below](https://cocoapods.org/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))  |[License Finder](https://github.com/pivotal/LicenseFinder)|
+| Elixir     | [mix](https://elixir-lang.org/getting-started/mix-otp/introduction-to-mix.html) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)) |[License Finder](https://github.com/pivotal/LicenseFinder)|
+| C++/C      | [conan](https://conan.io/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))|[License Finder](https://github.com/pivotal/LicenseFinder)|
+| Scala      | [sbt](https://www.scala-sbt.org/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))|[License Finder](https://github.com/pivotal/LicenseFinder)|
+| Rust       | [cargo](https://crates.io/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))|[License Finder](https://github.com/pivotal/LicenseFinder)|
+| PHP        | [composer](https://getcomposer.org/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))|[License Finder](https://github.com/pivotal/LicenseFinder)|
+
+## Requirements
+
+To run a License Compliance scanning job, you need GitLab Runner with the
+[`docker` executor](https://docs.gitlab.com/runner/executors/docker.html).
+
+## Configuration
+
+For GitLab 11.9 and later, to enable License Compliance, you must
+[include](../../../ci/yaml/README.md#includetemplate) the
+[`License-Management.gitlab-ci.yml` template](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/lib/gitlab/ci/templates/Security/License-Management.gitlab-ci.yml)
+that's provided as a part of your GitLab installation.
+For GitLab versions earlier than 11.9, you can copy and use the job as defined
+that template.
+
+Add the following to your `.gitlab-ci.yml` file:
+
+```yaml
+include:
+  template: License-Management.gitlab-ci.yml
+```
+
+The included template will create a `license_management` job in your CI/CD pipeline
+and scan your dependencies to find their licenses.
+
+The results will be saved as a
+[License Compliance report artifact](../../../ci/yaml/README.md#artifactsreportslicense_management-ultimate)
+that you can later download and analyze. Due to implementation limitations, we
+always take the latest License Compliance artifact available. Behind the scenes, the
+[GitLab License Compliance Docker image](https://gitlab.com/gitlab-org/security-products/license-management)
+is used to detect the languages/frameworks and in turn analyzes the licenses.
+
+The License Compliance settings can be changed through environment variables by using the
+[`variables`](../../../ci/yaml/README.md#variables) parameter in `.gitlab-ci.yml`. These variables are documented in the [License Compliance documentation](https://gitlab.com/gitlab-org/security-products/license-management#settings).
+
+### Installing custom dependencies
+
+> Introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.4.
+
+The `license_management` image already embeds many auto-detection scripts, languages,
+and packages. Nevertheless, it's almost impossible to cover all cases for all projects.
+That's why sometimes it's necessary to install extra packages, or to have extra steps
+in the project automated setup, like the download and installation of a certificate.
+For that, a `LICENSE_MANAGEMENT_SETUP_CMD` environment variable can be passed to the container,
+with the required commands to run before the license detection.
+
+If present, this variable will override the setup step necessary to install all the packages
+of your application (e.g.: for a project with a `Gemfile`, the setup step could be
+`bundle install`).
+
+For example:
+
+```yaml
+include:
+  template: License-Management.gitlab-ci.yml
+
+variables:
+  LICENSE_MANAGEMENT_SETUP_CMD: sh my-custom-install-script.sh
+```
+
+In this example, `my-custom-install-script.sh` is a shell script at the root
+directory of your project.
+
+### Overriding the template
+
+If you want to override the job definition (for example, change properties like
+`variables` or `dependencies`), you need to declare a `license_management` job
+after the template inclusion and specify any additional keys under it. For example:
+
+```yaml
+include:
+  template: License-Management.gitlab-ci.yml
+
+license_management:
+  variables:
+    CI_DEBUG_TRACE: "true"
+```
+
+### Configuring Maven projects
+
+The License Compliance tool provides a `MAVEN_CLI_OPTS` environment variable which can hold
+the command line arguments to pass to the `mvn install` command which is executed under the hood.
+Feel free to use it for the customization of Maven execution. For example:
+
+```yaml
+include:
+  template: License-Management.gitlab-ci.yml
+
+license_management:
+  variables:
+    MAVEN_CLI_OPTS: --debug
+```
+
+`mvn install` runs through all of the [build life cycle](http://maven.apache.org/guides/introduction/introduction-to-the-lifecycle.html)
+stages prior to `install`, including `test`. Running unit tests is not directly
+necessary for the license scanning purposes and consumes time, so it's skipped
+by having the default value of `MAVEN_CLI_OPTS` as `-DskipTests`. If you want
+to supply custom `MAVEN_CLI_OPTS` and skip tests at the same time, don't forget
+to explicitly add `-DskipTests` to your options.
+If you still need to run tests during `mvn install`, add `-DskipTests=false` to
+`MAVEN_CLI_OPTS`.
+
+### Selecting the version of Python
+
+> - [Introduced](https://gitlab.com/gitlab-org/security-products/license-management/merge_requests/36) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.0.
+> - In GitLab 12.2, Python 3.5 became the default.
+
+License Compliance uses Python 3.5 and pip 19.1 by default.
+If your project requires Python 2, you can switch to Python 2.7 and pip 10.0
+by setting the `LM_PYTHON_VERSION` environment variable to `2`.
+
+```yaml
+include:
+  template: License-Management.gitlab-ci.yml
+
+license_management:
+  variables:
+    LM_PYTHON_VERSION: 2
+```
+
+## Project policies for License Compliance
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5940) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.4.
+
+From the project's settings:
+
+- The list of licenses and their status can be managed.
+- Licenses can be manually approved or blacklisted.
+
+To approve or blacklist a license:
+
+1. Either use the **Manage licenses** button in the merge request widget, or
+   navigate to the project's **Settings > CI/CD** and expand the
+   **License Compliance** section.
+1. Click the **Add a license** button.
+
+   ![License Compliance Add License](img/license_compliance_add_license.png)
+
+1. In the **License name** dropdown, either:
+   - Select one of the available licenses. You can search for licenses in the field
+     at the top of the list.
+   - Enter arbitrary text in the field at the top of the list. This will cause the text to be
+     added as a license name to the list.
+1. Select the **Approve** or **Blacklist** radio button to approve or blacklist respectively
+   the selected license.
+
+To modify an existing license:
+
+1. In the **License Compliance** list, click the **Approved/Declined** dropdown to change it to the desired status.
+
+   ![License Compliance Settings](img/license_compliance_settings.png)
+
+Searching for Licenses:
+
+1. Use the **Search** box to search for a specific license.
+
+   ![License Compliance Search](img/license_compliance_search.png)
+
+## License Compliance report under pipelines
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5491) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.2.
+
+From your project's left sidebar, navigate to **CI/CD > Pipelines** and click on the
+pipeline ID that has a `license_management` job to see the Licenses tab with the listed
+licenses (if any).
+
+![License Compliance Pipeline Tab](img/license_compliance_pipeline_tab.png)
+
+<!-- ## Troubleshooting
+
+Include any troubleshooting steps that you can foresee. If you know beforehand what issues
+one might have when setting this up, or when something is changed, or on upgrading, it's
+important to describe those, too. Think of things that may go wrong and include them here.
+This is important to minimize requests for support, and to avoid doc comments with
+questions that you know someone might ask.
+
+Each scenario can be a third-level heading, e.g. `### Getting error message X`.
+If you have none to add when creating a doc, leave this section in place
+but commented out to help encourage others to add to it in the future. -->
diff --git a/doc/user/application_security/license_management/img/license_management.png b/doc/user/application_security/license_management/img/license_management.png
deleted file mode 100644
index cdce6b5fe38..00000000000
Binary files a/doc/user/application_security/license_management/img/license_management.png and /dev/null differ
diff --git a/doc/user/application_security/license_management/img/license_management_add_license.png b/doc/user/application_security/license_management/img/license_management_add_license.png
deleted file mode 100644
index c9a5dc14c57..00000000000
Binary files a/doc/user/application_security/license_management/img/license_management_add_license.png and /dev/null differ
diff --git a/doc/user/application_security/license_management/img/license_management_decision.png b/doc/user/application_security/license_management/img/license_management_decision.png
deleted file mode 100644
index fbf90bec7fd..00000000000
Binary files a/doc/user/application_security/license_management/img/license_management_decision.png and /dev/null differ
diff --git a/doc/user/application_security/license_management/img/license_management_pipeline_tab.png b/doc/user/application_security/license_management/img/license_management_pipeline_tab.png
deleted file mode 100644
index 80ffca815b9..00000000000
Binary files a/doc/user/application_security/license_management/img/license_management_pipeline_tab.png and /dev/null differ
diff --git a/doc/user/application_security/license_management/img/license_management_search.png b/doc/user/application_security/license_management/img/license_management_search.png
deleted file mode 100644
index b3ffd8d95a1..00000000000
Binary files a/doc/user/application_security/license_management/img/license_management_search.png and /dev/null differ
diff --git a/doc/user/application_security/license_management/img/license_management_settings.png b/doc/user/application_security/license_management/img/license_management_settings.png
deleted file mode 100644
index 2e3e8888e93..00000000000
Binary files a/doc/user/application_security/license_management/img/license_management_settings.png and /dev/null differ
diff --git a/doc/user/application_security/license_management/index.md b/doc/user/application_security/license_management/index.md
index 44b2671930e..319da2c3a6e 100644
--- a/doc/user/application_security/license_management/index.md
+++ b/doc/user/application_security/license_management/index.md
@@ -1,245 +1,5 @@
 ---
-type: reference, howto
+redirect_to: ../license_compliance/index.md
 ---
 
-# License Compliance **(ULTIMATE)**
-
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5483)
-in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.0.
-
-## Overview
-
-If you are using [GitLab CI/CD](../../../ci/README.md), you can search your project dependencies for their licenses
-using License Compliance.
-
-You can take advantage of License Compliance by either [including the job](#configuration)
-in your existing `.gitlab-ci.yml` file or by implicitly using
-[Auto License Compliance](../../../topics/autodevops/index.md#auto-license-compliance-ultimate)
-that is provided by [Auto DevOps](../../../topics/autodevops/index.md).
-
-GitLab checks the License Compliance report, compares the licenses between the
-source and target branches, and shows the information right on the merge request.
-Blacklisted licenses will be clearly visible with an `x` red icon next to them
-as well as new licenses which need a decision from you. In addition, you can
-[manually approve or blacklist](#project-policies-for-license-compliance)
-licenses in your project's settings.
-
-NOTE: **Note:**
-If the license management report doesn't have anything to compare to, no information
-will be displayed in the merge request area. That is the case when you add the
-`license_management` job in your `.gitlab-ci.yml` for the first time.
-Consecutive merge requests will have something to compare to and the license
-management report will be shown properly.
-
-![License Compliance Widget](img/license_management.png)
-
-If you are a project or group Maintainer, you can click on a license to be given
-the choice to approve it or blacklist it.
-
-![License approval decision](img/license_management_decision.png)
-
-## Use cases
-
-It helps you find what licenses your project uses in its dependencies, and decide for each of then
-whether to allow it or forbid it. For example, your application is using an external (open source)
-library whose license is incompatible with yours.
-
-## Supported languages and package managers
-
-The following languages and package managers are supported.
-
-| Language   | Package managers                                                  | Scan Tool                                                |
-|------------|-------------------------------------------------------------------|----------------------------------------------------------|
-| JavaScript | [Bower](https://bower.io/), [npm](https://www.npmjs.com/), [yarn](https://yarnpkg.com/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)) |[License Finder](https://github.com/pivotal/LicenseFinder)|
-| Go         | [Godep](https://github.com/tools/godep), go get ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)), gvt ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)), glide ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)), dep ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)), trash ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))  and govendor ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)), [go mod](https://github.com/golang/go/wiki/Modules) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))   |[License Finder](https://github.com/pivotal/LicenseFinder)|
-| Java       | [Gradle](https://gradle.org/), [Maven](https://maven.apache.org/) |[License Finder](https://github.com/pivotal/LicenseFinder)|
-| .NET       | [Nuget](https://www.nuget.org/)                                   |[License Finder](https://github.com/pivotal/LicenseFinder)|
-| Python     | [pip](https://pip.pypa.io/en/stable/)                             |[License Finder](https://github.com/pivotal/LicenseFinder)|
-| Ruby       | [gem](https://rubygems.org/)                                      |[License Finder](https://github.com/pivotal/LicenseFinder)|
-| Erlang     | [rebar](https://www.rebar3.org/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))|[License Finder](https://github.com/pivotal/LicenseFinder)|
-| Objective-C, Swift | [Carthage](https://github.com/Carthage/Carthage) , [CocoaPods v0.39 and below](https://cocoapods.org/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))  |[License Finder](https://github.com/pivotal/LicenseFinder)|
-| Elixir     | [mix](https://elixir-lang.org/getting-started/mix-otp/introduction-to-mix.html) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types)) |[License Finder](https://github.com/pivotal/LicenseFinder)|
-| C++/C      | [conan](https://conan.io/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))|[License Finder](https://github.com/pivotal/LicenseFinder)|
-| Scala      | [sbt](https://www.scala-sbt.org/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))|[License Finder](https://github.com/pivotal/LicenseFinder)|
-| Rust       | [cargo](https://crates.io/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))|[License Finder](https://github.com/pivotal/LicenseFinder)|
-| PHP        | [composer](https://getcomposer.org/) ([experimental support](https://github.com/pivotal/LicenseFinder#experimental-project-types))|[License Finder](https://github.com/pivotal/LicenseFinder)|
-
-## Requirements
-
-To run a License Compliance scanning job, you need GitLab Runner with the
-[`docker` executor](https://docs.gitlab.com/runner/executors/docker.html).
-
-## Configuration
-
-For GitLab 11.9 and later, to enable License Compliance, you must
-[include](../../../ci/yaml/README.md#includetemplate) the
-[`License-Management.gitlab-ci.yml` template](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/lib/gitlab/ci/templates/Security/License-Management.gitlab-ci.yml)
-that's provided as a part of your GitLab installation.
-For GitLab versions earlier than 11.9, you can copy and use the job as defined
-that template.
-
-Add the following to your `.gitlab-ci.yml` file:
-
-```yaml
-include:
-  template: License-Management.gitlab-ci.yml
-```
-
-The included template will create a `license_management` job in your CI/CD pipeline
-and scan your dependencies to find their licenses.
-
-The results will be saved as a
-[License Compliance report artifact](../../../ci/yaml/README.md#artifactsreportslicense_management-ultimate)
-that you can later download and analyze. Due to implementation limitations, we
-always take the latest License Compliance artifact available. Behind the scenes, the
-[GitLab License Compliance Docker image](https://gitlab.com/gitlab-org/security-products/license-management)
-is used to detect the languages/frameworks and in turn analyzes the licenses.
-
-The License Compliance settings can be changed through environment variables by using the
-[`variables`](../../../ci/yaml/README.md#variables) parameter in `.gitlab-ci.yml`. These variables are documented in the [License Compliance documentation](https://gitlab.com/gitlab-org/security-products/license-management#settings).
-
-### Installing custom dependencies
-
-> Introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.4.
-
-The `license_management` image already embeds many auto-detection scripts, languages,
-and packages. Nevertheless, it's almost impossible to cover all cases for all projects.
-That's why sometimes it's necessary to install extra packages, or to have extra steps
-in the project automated setup, like the download and installation of a certificate.
-For that, a `LICENSE_MANAGEMENT_SETUP_CMD` environment variable can be passed to the container,
-with the required commands to run before the license detection.
-
-If present, this variable will override the setup step necessary to install all the packages
-of your application (e.g.: for a project with a `Gemfile`, the setup step could be
-`bundle install`).
-
-For example:
-
-```yaml
-include:
-  template: License-Management.gitlab-ci.yml
-
-variables:
-  LICENSE_MANAGEMENT_SETUP_CMD: sh my-custom-install-script.sh
-```
-
-In this example, `my-custom-install-script.sh` is a shell script at the root
-directory of your project.
-
-### Overriding the template
-
-If you want to override the job definition (for example, change properties like
-`variables` or `dependencies`), you need to declare a `license_management` job
-after the template inclusion and specify any additional keys under it. For example:
-
-```yaml
-include:
-  template: License-Management.gitlab-ci.yml
-
-license_management:
-  variables:
-    CI_DEBUG_TRACE: "true"
-```
-
-### Configuring Maven projects
-
-The License Compliance tool provides a `MAVEN_CLI_OPTS` environment variable which can hold
-the command line arguments to pass to the `mvn install` command which is executed under the hood.
-Feel free to use it for the customization of Maven execution. For example:
-
-```yaml
-include:
-  template: License-Management.gitlab-ci.yml
-
-license_management:
-  variables:
-    MAVEN_CLI_OPTS: --debug
-```
-
-`mvn install` runs through all of the [build life cycle](http://maven.apache.org/guides/introduction/introduction-to-the-lifecycle.html)
-stages prior to `install`, including `test`. Running unit tests is not directly
-necessary for the license scanning purposes and consumes time, so it's skipped
-by having the default value of `MAVEN_CLI_OPTS` as `-DskipTests`. If you want
-to supply custom `MAVEN_CLI_OPTS` and skip tests at the same time, don't forget
-to explicitly add `-DskipTests` to your options.
-If you still need to run tests during `mvn install`, add `-DskipTests=false` to
-`MAVEN_CLI_OPTS`.
-
-### Selecting the version of Python
-
-> [Introduced](https://gitlab.com/gitlab-org/security-products/license-management/merge_requests/36) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.0.
-
-License Compliance uses Python 3.5 and pip 19.1 by default.
-If your project requires Python 2, you can switch to Python 2.7 and pip 10.0
-by setting the `LM_PYTHON_VERSION` environment variable to `2`.
-
-```yaml
-include:
-  template: License-Management.gitlab-ci.yml
-
-license_management:
-  variables:
-    LM_PYTHON_VERSION: 2
-```
-
-## Project policies for License Compliance
-
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5940)
-in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.4.
-
-From the project's settings:
-
-- The list of licenses and their status can be managed.
-- Licenses can be manually approved or blacklisted.
-
-To approve or blacklist a license:
-
-1. Either use the **Manage licenses** button in the merge request widget, or
-   navigate to the project's **Settings > CI/CD** and expand the
-   **License Compliance** section.
-1. Click the **Add a license** button.
-
-   ![License Compliance Add License](img/license_management_add_license.png)
-
-1. In the **License name** dropdown, either:
-   - Select one of the available licenses. You can search for licenses in the field
-     at the top of the list.
-   - Enter arbitrary text in the field at the top of the list. This will cause the text to be
-     added as a license name to the list.
-1. Select the **Approve** or **Blacklist** radio button to approve or blacklist respectively
-   the selected license.
-
-To modify an existing license:
-
-1. In the **License Compliance** list, click the **Approved/Declined** dropdown to change it to the desired status.
-
-   ![License Compliance Settings](img/license_management_settings.png)
-
-Searching for Licenses:
-
-1. Use the **Search** box to search for a specific license.
-
-   ![License Compliance Search](img/license_management_search.png)
-
-## License Compliance report under pipelines
-
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5491)
-in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.2.
-
-From your project's left sidebar, navigate to **CI/CD > Pipelines** and click on the
-pipeline ID that has a `license_management` job to see the Licenses tab with the listed
-licenses (if any).
-
-![License Compliance Pipeline Tab](img/license_management_pipeline_tab.png)
-
-<!-- ## Troubleshooting
-
-Include any troubleshooting steps that you can foresee. If you know beforehand what issues
-one might have when setting this up, or when something is changed, or on upgrading, it's
-important to describe those, too. Think of things that may go wrong and include them here.
-This is important to minimize requests for support, and to avoid doc comments with
-questions that you know someone might ask.
-
-Each scenario can be a third-level heading, e.g. `### Getting error message X`.
-If you have none to add when creating a doc, leave this section in place
-but commented out to help encourage others to add to it in the future. -->
+This document was moved to [another location](../license_compliance/index.md).
diff --git a/doc/user/project/index.md b/doc/user/project/index.md
index 64c4066683b..c63d5308536 100644
--- a/doc/user/project/index.md
+++ b/doc/user/project/index.md
@@ -98,7 +98,7 @@ When you create a project in GitLab, you'll have access to a large number of
 - [Maven packages](packages/maven_repository.md): your private Maven repository in GitLab. **(PREMIUM)**
 - [NPM packages](packages/npm_registry.md): your private NPM package registry in GitLab. **(PREMIUM)**
 - [Code owners](code_owners.md): specify code owners for certain files **(STARTER)**
-- [License Compliance](../application_security/license_management/index.md): approve and blacklist licenses for projects. **(ULTIMATE)**
+- [License Compliance](../application_security/license_compliance/index.md): approve and blacklist licenses for projects. **(ULTIMATE)**
 - [Dependency List](../application_security/dependency_list/index.md): view project dependencies. **(ULTIMATE)**
 
 ### Project integrations
diff --git a/doc/user/project/merge_requests/index.md b/doc/user/project/merge_requests/index.md
index 04db54872d3..a94057dc3a1 100644
--- a/doc/user/project/merge_requests/index.md
+++ b/doc/user/project/merge_requests/index.md
@@ -41,7 +41,7 @@ With **[GitLab Enterprise Edition][ee]**, you can also:
 - View the deployment process across projects with [Multi-Project Pipelines](../../../ci/multi_project_pipelines.md) **(PREMIUM)**
 - Request [approvals](merge_request_approvals.md) from your managers **(STARTER)**
 - Analyze the impact of your changes with [Code Quality reports](code_quality.md) **(STARTER)**
-- Manage the licenses of your dependencies with [License Compliance](../../application_security/license_management/index.md) **(ULTIMATE)**
+- Manage the licenses of your dependencies with [License Compliance](../../application_security/license_compliance/index.md) **(ULTIMATE)**
 - Analyze your source code for vulnerabilities with [Static Application Security Testing](../../application_security/sast/index.md) **(ULTIMATE)**
 - Analyze your running web applications for vulnerabilities with [Dynamic Application Security Testing](../../application_security/dast/index.md) **(ULTIMATE)**
 - Analyze your dependencies for vulnerabilities with [Dependency Scanning](../../application_security/dependency_scanning/index.md) **(ULTIMATE)**
@@ -57,7 +57,7 @@ A. Consider you are a software developer working in a team:
 1. You gather feedback from your team
 1. You work on the implementation optimizing code with [Code Quality reports](code_quality.md) **(STARTER)**
 1. You verify your changes with [JUnit test reports](../../../ci/junit_test_reports.md) in GitLab CI/CD
-1. You avoid using dependencies whose license is not compatible with your project with [License Compliance reports](license_management.md) **(ULTIMATE)**
+1. You avoid using dependencies whose license is not compatible with your project with [License Compliance reports](../../application_security/license_compliance/index.md) **(ULTIMATE)**
 1. You request the [approval](#merge-request-approvals-starter) from your manager
 1. Your manager pushes a commit with their final review, [approves the merge request](merge_request_approvals.md), and set it to [merge when pipeline succeeds](#merge-when-pipeline-succeeds) (Merge Request Approvals are available in GitLab Starter)
 1. Your changes get deployed to production with [manual actions](../../../ci/yaml/README.md#whenmanual) for GitLab CI/CD
diff --git a/doc/user/project/merge_requests/license_management.md b/doc/user/project/merge_requests/license_management.md
index 93116ebd7c6..df5bd073ade 100644
--- a/doc/user/project/merge_requests/license_management.md
+++ b/doc/user/project/merge_requests/license_management.md
@@ -1,5 +1,5 @@
 ---
-redirect_to: '../../application_security/license_management/index.md'
+redirect_to: '../../application_security/license_compliance/index.md'
 ---
 
-This document was moved to [another location](../../application_security/license_management/index.md).
+This document was moved to [another location](../../application_security/license_compliance/index.md).
-- 
cgit v1.2.1


From 150976833548a98ddfc41178e16024aa6112f518 Mon Sep 17 00:00:00 2001
From: Jeremy Jackson <jjackson@gitlab.com>
Date: Wed, 28 Aug 2019 06:52:14 +0000
Subject: Changes snowplow to use cookies for sessions

This also restructures how and where the configuration for
Snowplow lives.
---
 app/assets/javascripts/main.js           |  2 +
 app/assets/javascripts/tracking.js       | 28 ++++++++++
 app/views/layouts/_snowplow.html.haml    | 21 +-------
 lib/gitlab/snowplow_tracker.rb           | 35 -------------
 lib/gitlab/tracking.rb                   | 44 ++++++++++++++++
 spec/frontend/tracking_spec.js           | 46 +++++++++++++++--
 spec/lib/gitlab/snowplow_tracker_spec.rb | 45 ----------------
 spec/lib/gitlab/tracking_spec.rb         | 88 ++++++++++++++++++++++++++++++++
 8 files changed, 204 insertions(+), 105 deletions(-)
 delete mode 100644 lib/gitlab/snowplow_tracker.rb
 create mode 100644 lib/gitlab/tracking.rb
 delete mode 100644 spec/lib/gitlab/snowplow_tracker_spec.rb
 create mode 100644 spec/lib/gitlab/tracking_spec.rb

diff --git a/app/assets/javascripts/main.js b/app/assets/javascripts/main.js
index 39f2097c174..0ddf40b0405 100644
--- a/app/assets/javascripts/main.js
+++ b/app/assets/javascripts/main.js
@@ -35,6 +35,7 @@ import initPerformanceBar from './performance_bar';
 import initSearchAutocomplete from './search_autocomplete';
 import GlFieldErrors from './gl_field_errors';
 import initUserPopovers from './user_popovers';
+import { initUserTracking } from './tracking';
 import { __ } from './locale';
 
 import 'ee_else_ce/main_ee';
@@ -94,6 +95,7 @@ function deferredInitialisation() {
   initLogoAnimation();
   initUsagePingConsent();
   initUserPopovers();
+  initUserTracking();
 
   if (document.querySelector('.search')) initSearchAutocomplete();
 
diff --git a/app/assets/javascripts/tracking.js b/app/assets/javascripts/tracking.js
index a852f937eec..03281b5ef49 100644
--- a/app/assets/javascripts/tracking.js
+++ b/app/assets/javascripts/tracking.js
@@ -1,5 +1,23 @@
 import $ from 'jquery';
 
+const DEFAULT_SNOWPLOW_OPTIONS = {
+  namespace: 'gl',
+  hostname: window.location.hostname,
+  cookieDomain: window.location.hostname,
+  appId: '',
+  userFingerprint: false,
+  respectDoNotTrack: true,
+  forceSecureTracker: true,
+  eventMethod: 'post',
+  contexts: { webPage: true },
+  // Page tracking tracks a single event when the page loads.
+  pageTrackingEnabled: false,
+  // Activity tracking tracks when a user is still interacting with the page.
+  // Events like scrolling and mouse movements are used to determine if the
+  // user has the tab active and is still actively engaging.
+  activityTrackingEnabled: false,
+};
+
 const extractData = (el, opts = {}) => {
   const { trackEvent, trackLabel = '', trackProperty = '' } = el.dataset;
   let trackValue = el.dataset.trackValue || el.value || '';
@@ -71,3 +89,13 @@ export default class Tracking {
     };
   }
 }
+
+export function initUserTracking() {
+  if (!Tracking.enabled()) return;
+
+  const opts = Object.assign({}, DEFAULT_SNOWPLOW_OPTIONS, window.snowplowOptions);
+  window.snowplow('newTracker', opts.namespace, opts.hostname, opts);
+
+  if (opts.activityTrackingEnabled) window.snowplow('enableActivityTracking', 30, 30);
+  if (opts.pageTrackingEnabled) window.snowplow('trackPageView'); // must be after enableActivityTracking
+}
diff --git a/app/views/layouts/_snowplow.html.haml b/app/views/layouts/_snowplow.html.haml
index 5f5c5e984c5..d7ff5ad1094 100644
--- a/app/views/layouts/_snowplow.html.haml
+++ b/app/views/layouts/_snowplow.html.haml
@@ -7,23 +7,4 @@
     };p[i].q=p[i].q||[];n=l.createElement(o);g=l.getElementsByTagName(o)[0];n.async=1;
     n.src=w;g.parentNode.insertBefore(n,g)}}(window,document,"script","#{asset_url('snowplow/sp.js')}","snowplow"));
 
-    window.snowplow('newTracker', '#{Gitlab::SnowplowTracker::NAMESPACE}', '#{Gitlab::CurrentSettings.snowplow_collector_hostname}', {
-      appId: '#{Gitlab::CurrentSettings.snowplow_site_id}',
-      cookieDomain: '#{Gitlab::CurrentSettings.snowplow_cookie_domain}',
-      userFingerprint: false,
-      respectDoNotTrack: true,
-      forceSecureTracker: true,
-      post: true,
-      contexts: { webPage: true },
-      stateStorageStrategy: "localStorage"
-    });
-
-    window.snowplow('enableActivityTracking', 30, 30);
-    window.snowplow('trackPageView');
-
-- return unless Feature.enabled?(:additional_snowplow_tracking, @group)
-
-= javascript_tag nonce: true do
-  :plain
-    window.snowplow('enableFormTracking');
-    window.snowplow('enableLinkClickTracking');
+    window.snowplowOptions = #{Gitlab::Tracking.snowplow_options(@group).to_json}
diff --git a/lib/gitlab/snowplow_tracker.rb b/lib/gitlab/snowplow_tracker.rb
deleted file mode 100644
index 9f12513e09e..00000000000
--- a/lib/gitlab/snowplow_tracker.rb
+++ /dev/null
@@ -1,35 +0,0 @@
-# frozen_string_literal: true
-
-require 'snowplow-tracker'
-
-module Gitlab
-  module SnowplowTracker
-    NAMESPACE = 'cf'
-
-    class << self
-      def track_event(category, action, label: nil, property: nil, value: nil, context: nil)
-        tracker&.track_struct_event(category, action, label, property, value, context, Time.now.to_i)
-      end
-
-      private
-
-      def tracker
-        return unless enabled?
-
-        @tracker ||= ::SnowplowTracker::Tracker.new(emitter, subject, NAMESPACE, Gitlab::CurrentSettings.snowplow_site_id)
-      end
-
-      def subject
-        ::SnowplowTracker::Subject.new
-      end
-
-      def emitter
-        ::SnowplowTracker::Emitter.new(Gitlab::CurrentSettings.snowplow_collector_hostname)
-      end
-
-      def enabled?
-        Gitlab::CurrentSettings.snowplow_enabled?
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/tracking.rb b/lib/gitlab/tracking.rb
new file mode 100644
index 00000000000..ef669b03c87
--- /dev/null
+++ b/lib/gitlab/tracking.rb
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'snowplow-tracker'
+
+module Gitlab
+  module Tracking
+    SNOWPLOW_NAMESPACE = 'gl'
+
+    class << self
+      def enabled?
+        Gitlab::CurrentSettings.snowplow_enabled?
+      end
+
+      def event(category, action, label: nil, property: nil, value: nil, context: nil)
+        return unless enabled?
+
+        snowplow.track_struct_event(category, action, label, property, value, context, Time.now.to_i)
+      end
+
+      def snowplow_options(group)
+        additional_features = Feature.enabled?(:additional_snowplow_tracking, group)
+        {
+          namespace: SNOWPLOW_NAMESPACE,
+          hostname: Gitlab::CurrentSettings.snowplow_collector_hostname,
+          cookie_domain: Gitlab::CurrentSettings.snowplow_cookie_domain,
+          app_id: Gitlab::CurrentSettings.snowplow_site_id,
+          page_tracking_enabled: additional_features,
+          activity_tracking_enabled: additional_features
+        }.transform_keys! { |key| key.to_s.camelize(:lower).to_sym }
+      end
+
+      private
+
+      def snowplow
+        @snowplow ||= SnowplowTracker::Tracker.new(
+          SnowplowTracker::Emitter.new(Gitlab::CurrentSettings.snowplow_collector_hostname),
+          SnowplowTracker::Subject.new,
+          SNOWPLOW_NAMESPACE,
+          Gitlab::CurrentSettings.snowplow_site_id
+        )
+      end
+    end
+  end
+end
diff --git a/spec/frontend/tracking_spec.js b/spec/frontend/tracking_spec.js
index 0e862c683d3..7c98a1a66c9 100644
--- a/spec/frontend/tracking_spec.js
+++ b/spec/frontend/tracking_spec.js
@@ -1,20 +1,56 @@
 import $ from 'jquery';
 import { setHTMLFixture } from './helpers/fixtures';
 
-import Tracking from '~/tracking';
+import Tracking, { initUserTracking } from '~/tracking';
 
 describe('Tracking', () => {
+  let snowplowSpy;
+
   beforeEach(() => {
     window.snowplow = window.snowplow || (() => {});
+    window.snowplowOptions = {
+      namespace: '_namespace_',
+      hostname: 'app.gitfoo.com',
+      cookieDomain: '.gitfoo.com',
+    };
+    snowplowSpy = jest.spyOn(window, 'snowplow');
   });
 
-  describe('.event', () => {
-    let snowplowSpy = null;
+  describe('initUserTracking', () => {
+    it('calls through to get a new tracker with the expected options', () => {
+      initUserTracking();
+      expect(snowplowSpy).toHaveBeenCalledWith('newTracker', '_namespace_', 'app.gitfoo.com', {
+        namespace: '_namespace_',
+        hostname: 'app.gitfoo.com',
+        cookieDomain: '.gitfoo.com',
+        appId: '',
+        userFingerprint: false,
+        respectDoNotTrack: true,
+        forceSecureTracker: true,
+        eventMethod: 'post',
+        contexts: { webPage: true },
+        activityTrackingEnabled: false,
+        pageTrackingEnabled: false,
+      });
+    });
 
-    beforeEach(() => {
-      snowplowSpy = jest.spyOn(window, 'snowplow');
+    it('should activate features based on what has been enabled', () => {
+      initUserTracking();
+      expect(snowplowSpy).not.toHaveBeenCalledWith('enableActivityTracking', 30, 30);
+      expect(snowplowSpy).not.toHaveBeenCalledWith('trackPageView');
+
+      window.snowplowOptions = Object.assign({}, window.snowplowOptions, {
+        activityTrackingEnabled: true,
+        pageTrackingEnabled: true,
+      });
+
+      initUserTracking();
+      expect(snowplowSpy).toHaveBeenCalledWith('enableActivityTracking', 30, 30);
+      expect(snowplowSpy).toHaveBeenCalledWith('trackPageView');
     });
+  });
 
+  describe('.event', () => {
     afterEach(() => {
       window.doNotTrack = undefined;
       navigator.doNotTrack = undefined;
diff --git a/spec/lib/gitlab/snowplow_tracker_spec.rb b/spec/lib/gitlab/snowplow_tracker_spec.rb
deleted file mode 100644
index 073a33e5973..00000000000
--- a/spec/lib/gitlab/snowplow_tracker_spec.rb
+++ /dev/null
@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-require 'spec_helper'
-
-describe Gitlab::SnowplowTracker do
-  let(:timestamp) { Time.utc(2017, 3, 22) }
-
-  around do |example|
-    Timecop.freeze(timestamp) { example.run }
-  end
-
-  subject { described_class.track_event('epics', 'action', property: 'what', value: 'doit') }
-
-  context '.track_event' do
-    context 'when Snowplow tracker is disabled' do
-      it 'does not track the event' do
-        expect(SnowplowTracker::Tracker).not_to receive(:new)
-
-        subject
-      end
-    end
-
-    context 'when Snowplow tracker is enabled' do
-      before do
-        stub_application_setting(snowplow_enabled: true)
-        stub_application_setting(snowplow_site_id: 'awesome gitlab')
-        stub_application_setting(snowplow_collector_hostname: 'url.com')
-      end
-
-      it 'tracks the event' do
-        tracker = double
-
-        expect(::SnowplowTracker::Tracker).to receive(:new)
-          .with(
-            an_instance_of(::SnowplowTracker::Emitter),
-            an_instance_of(::SnowplowTracker::Subject),
-            'cf', 'awesome gitlab'
-          ).and_return(tracker)
-        expect(tracker).to receive(:track_struct_event)
-          .with('epics', 'action', nil, 'what', 'doit', nil, timestamp.to_i)
-
-        subject
-      end
-    end
-  end
-end
diff --git a/spec/lib/gitlab/tracking_spec.rb b/spec/lib/gitlab/tracking_spec.rb
new file mode 100644
index 00000000000..f14e74427e1
--- /dev/null
+++ b/spec/lib/gitlab/tracking_spec.rb
@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+require 'spec_helper'
+
+describe Gitlab::Tracking do
+  let(:timestamp) { Time.utc(2017, 3, 22) }
+
+  before do
+    stub_application_setting(snowplow_enabled: true)
+    stub_application_setting(snowplow_collector_hostname: 'gitfoo.com')
+    stub_application_setting(snowplow_cookie_domain: '.gitfoo.com')
+    stub_application_setting(snowplow_site_id: '_abc123_')
+  end
+
+  describe '.snowplow_options' do
+    subject(&method(:described_class))
+
+    it 'returns useful client options' do
+      expect(subject.snowplow_options(nil)).to eq(
+        namespace: 'gl',
+        hostname: 'gitfoo.com',
+        cookieDomain: '.gitfoo.com',
+        appId: '_abc123_',
+        pageTrackingEnabled: true,
+        activityTrackingEnabled: true
+      )
+    end
+
+    it 'enables features using feature flags' do
+      stub_feature_flags(additional_snowplow_tracking: true)
+      allow(Feature).to receive(:enabled?).with(
+        :additional_snowplow_tracking,
+        '_group_'
+      ).and_return(false)
+
+      expect(subject.snowplow_options('_group_')).to include(
+        pageTrackingEnabled: false,
+        activityTrackingEnabled: false
+      )
+    end
+  end
+
+  describe '.event' do
+    subject(&method(:described_class))
+
+    around do |example|
+      Timecop.freeze(timestamp) { example.run }
+    end
+
+    it 'can track events' do
+      tracker = double
+
+      expect(SnowplowTracker::Emitter).to receive(:new).with(
+        'gitfoo.com'
+      ).and_return('_emitter_')
+
+      expect(SnowplowTracker::Tracker).to receive(:new).with(
+        '_emitter_',
+        an_instance_of(SnowplowTracker::Subject),
+        'gl',
+        '_abc123_'
+      ).and_return(tracker)
+
+      expect(tracker).to receive(:track_struct_event).with(
+        'category',
+        'action',
+        '_label_',
+        '_property_',
+        '_value_',
+        '_context_',
+        timestamp.to_i
+      )
+
+      subject.event('category', 'action',
+        label: '_label_',
+        property: '_property_',
+        value: '_value_',
+        context: '_context_'
+      )
+    end
+
+    it 'does not track when not enabled' do
+      stub_application_setting(snowplow_enabled: false)
+      expect(SnowplowTracker::Tracker).not_to receive(:new)
+
+      subject.event('epics', 'action', property: 'what', value: 'doit')
+    end
+  end
+end
-- 
cgit v1.2.1


From 24493c50232b6109bbcc680ada32dfe832201a67 Mon Sep 17 00:00:00 2001
From: Vitali Tatarintev <vtatarintev@gitlab.com>
Date: Wed, 28 Aug 2019 08:55:46 +0200
Subject: Replace it_behaves_like with include_examples

Improve specs output readability by replacing
`it_behaves_like` with `include_examples`
in `BeSuccessMatcher`
---
 spec/rubocop/cop/rspec/be_success_matcher_spec.rb | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
index 17408a696de..12aa7d1643e 100644
--- a/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
+++ b/spec/rubocop/cop/rspec/be_success_matcher_spec.rb
@@ -13,7 +13,7 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
 
   shared_examples 'cop' do |good:, bad:|
     context "using #{bad} call" do
-      it "registers an offense for `#{bad}`" do
+      it 'registers an offense' do
         inspect_source(bad, source_file)
 
         expect(cop.offenses.size).to eq(1)
@@ -21,7 +21,7 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
         expect(cop.highlights).to eq([bad])
       end
 
-      it "registers an offense for `#{bad}` and autocorrects it to `#{good}`" do
+      it "autocorrects it to `#{good}`" do
         autocorrected = autocorrect_source(bad, source_file)
 
         expect(autocorrected).to eql(good)
@@ -37,27 +37,27 @@ describe RuboCop::Cop::RSpec::BeSuccessMatcher do
     end
   end
 
-  it_behaves_like 'cop',
+  include_examples 'cop',
     bad: 'expect(response).to be_success',
     good: 'expect(response).to be_successful'
 
-  it_behaves_like 'cop',
+  include_examples 'cop',
     bad: 'expect(response).to_not be_success',
     good: 'expect(response).to_not be_successful'
 
-  it_behaves_like 'cop',
+  include_examples 'cop',
     bad: 'expect(response).not_to be_success',
     good: 'expect(response).not_to be_successful'
 
-  it_behaves_like 'cop',
+  include_examples 'cop',
     bad: 'is_expected.to be_success',
     good: 'is_expected.to be_successful'
 
-  it_behaves_like 'cop',
+  include_examples 'cop',
     bad: 'is_expected.to_not be_success',
     good: 'is_expected.to_not be_successful'
 
-  it_behaves_like 'cop',
+  include_examples 'cop',
     bad: 'is_expected.not_to be_success',
     good: 'is_expected.not_to be_successful'
 end
-- 
cgit v1.2.1


From 29ce13e9992c296fbb2c4ad2706f53e491143d3e Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Tue, 27 Aug 2019 22:48:24 -0700
Subject: Fix moving issues API failing when text includes commit URLs

When a issue is moved from one project to another, all associated
Markdown text is rewritten in the context of the new project. If the
note contained a link to a commit URL, `CommitRewriter#rewrite` would
fail because `Commit#link_reference_pattern` would match `nil` `commit`
values in the HTML generated from the Markdown. These `nil` values were
passed along to `Project#commits_by` because `Commit#reference_valid?`
was always returning `true`.

To prevent this issue from happening, we tighten up the check for
`Commit#reference_valid?` to look for valid SHA values.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66666
---
 app/models/commit.rb                            |  7 ++++++-
 changelogs/unreleased/sh-fix-issue-move-api.yml |  5 +++++
 spec/lib/gitlab/gfm/reference_rewriter_spec.rb  | 17 +++++++++++++++++
 spec/models/commit_spec.rb                      | 18 ++++++++++++++++++
 4 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/sh-fix-issue-move-api.yml

diff --git a/app/models/commit.rb b/app/models/commit.rb
index 0889ce7e287..1470b50f396 100644
--- a/app/models/commit.rb
+++ b/app/models/commit.rb
@@ -35,6 +35,7 @@ class Commit
 
   MIN_SHA_LENGTH = Gitlab::Git::Commit::MIN_SHA_LENGTH
   COMMIT_SHA_PATTERN = /\h{#{MIN_SHA_LENGTH},40}/.freeze
+  EXACT_COMMIT_SHA_PATTERN = /\A#{COMMIT_SHA_PATTERN}\z/.freeze
   # Used by GFM to match and present link extensions on node texts and hrefs.
   LINK_EXTENSION_PATTERN = /(patch)/.freeze
 
@@ -90,7 +91,7 @@ class Commit
     end
 
     def valid_hash?(key)
-      !!(/\A#{COMMIT_SHA_PATTERN}\z/ =~ key)
+      !!(EXACT_COMMIT_SHA_PATTERN =~ key)
     end
 
     def lazy(project, oid)
@@ -139,6 +140,10 @@ class Commit
     '@'
   end
 
+  def self.reference_valid?(reference)
+    !!(reference =~ EXACT_COMMIT_SHA_PATTERN)
+  end
+
   # Pattern used to extract commit references from text
   #
   # This pattern supports cross-project references.
diff --git a/changelogs/unreleased/sh-fix-issue-move-api.yml b/changelogs/unreleased/sh-fix-issue-move-api.yml
new file mode 100644
index 00000000000..e98d04b02d9
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-issue-move-api.yml
@@ -0,0 +1,5 @@
+---
+title: Fix moving issues API failing when text includes commit URLs
+merge_request: 32317
+author:
+type: fixed
diff --git a/spec/lib/gitlab/gfm/reference_rewriter_spec.rb b/spec/lib/gitlab/gfm/reference_rewriter_spec.rb
index 4d2f08f95fc..790b0428d19 100644
--- a/spec/lib/gitlab/gfm/reference_rewriter_spec.rb
+++ b/spec/lib/gitlab/gfm/reference_rewriter_spec.rb
@@ -102,6 +102,23 @@ describe Gitlab::Gfm::ReferenceRewriter do
       end
     end
 
+    context 'with a commit' do
+      let(:old_project) { create(:project, :repository, name: 'old-project', group: group) }
+      let(:commit) { old_project.commit }
+
+      context 'reference to an absolute URL to a commit' do
+        let(:text) { Gitlab::UrlBuilder.build(commit) }
+
+        it { is_expected.to eq(text) }
+      end
+
+      context 'reference to a commit' do
+        let(:text) { commit.id }
+
+        it { is_expected.to eq("#{old_project_ref}@#{text}") }
+      end
+    end
+
     context 'reference contains project milestone' do
       let!(:milestone) do
         create(:milestone, title: '9.0', project: old_project)
diff --git a/spec/models/commit_spec.rb b/spec/models/commit_spec.rb
index 7b35c2ffd36..5ef824b9950 100644
--- a/spec/models/commit_spec.rb
+++ b/spec/models/commit_spec.rb
@@ -192,6 +192,24 @@ describe Commit do
     end
   end
 
+  describe '.reference_valid?' do
+    using RSpec::Parameterized::TableSyntax
+
+    where(:ref, :result) do
+      '1234567' | true
+      '123456' | false
+      '1' | false
+      '0' * 40 | true
+      'c1acaa58bbcbc3eafe538cb8274ba387047b69f8' | true
+      'H1acaa58bbcbc3eafe538cb8274ba387047b69f8' | false
+      nil | false
+    end
+
+    with_them do
+      it { expect(described_class.reference_valid?(ref)).to eq(result) }
+    end
+  end
+
   describe '#reference_link_text' do
     let(:project) { create(:project, :repository, path: 'sample-project') }
 
-- 
cgit v1.2.1


From 65272b9e546308b999156a48801acb4b577d4f98 Mon Sep 17 00:00:00 2001
From: Arun Kumar Mohan <arunmohandm@gmail.com>
Date: Wed, 28 Aug 2019 02:16:29 -0500
Subject: Remove unnecessary CSS class

---
 app/views/groups/_group_admin_settings.html.haml                  | 2 +-
 app/views/groups/settings/_permissions.html.haml                  | 2 +-
 app/views/projects/_merge_request_merge_checks_settings.html.haml | 2 +-
 app/views/projects/_merge_request_merge_method_settings.html.haml | 6 +++---
 app/views/projects/settings/ci_cd/_form.html.haml                 | 4 ++--
 spec/views/groups/edit.html.haml_spec.rb                          | 2 +-
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/app/views/groups/_group_admin_settings.html.haml b/app/views/groups/_group_admin_settings.html.haml
index 733cb36cc3d..c3c7d102b28 100644
--- a/app/views/groups/_group_admin_settings.html.haml
+++ b/app/views/groups/_group_admin_settings.html.haml
@@ -9,7 +9,7 @@
           Allow projects within this group to use Git LFS
           = link_to icon('question-circle'), help_page_path('workflow/lfs/manage_large_binaries_with_git_lfs')
         %br/
-        %span.descr This setting can be overridden in each project.
+        %span This setting can be overridden in each project.
 .form-group.row
   .col-sm-2.col-form-label
     = f.label s_('ProjectCreationLevel|Allowed to create projects')
diff --git a/app/views/groups/settings/_permissions.html.haml b/app/views/groups/settings/_permissions.html.haml
index 94a938021f9..f5ba10c107c 100644
--- a/app/views/groups/settings/_permissions.html.haml
+++ b/app/views/groups/settings/_permissions.html.haml
@@ -14,7 +14,7 @@
           %span.d-block
             - group_link = link_to @group.name, group_path(@group)
             = s_('GroupSettings|Prevent sharing a project within %{group} with other groups').html_safe % { group: group_link }
-          %span.descr.text-muted= share_with_group_lock_help_text(@group)
+          %span.js-descr.text-muted= share_with_group_lock_help_text(@group)
 
     .form-group.append-bottom-default
       .form-check
diff --git a/app/views/projects/_merge_request_merge_checks_settings.html.haml b/app/views/projects/_merge_request_merge_checks_settings.html.haml
index c21d333f21a..d3fcb52422b 100644
--- a/app/views/projects/_merge_request_merge_checks_settings.html.haml
+++ b/app/views/projects/_merge_request_merge_checks_settings.html.haml
@@ -7,7 +7,7 @@
     = form.check_box :only_allow_merge_if_pipeline_succeeds, class: 'form-check-input'
     = form.label :only_allow_merge_if_pipeline_succeeds, class: 'form-check-label' do
       = s_('ProjectSettings|Pipelines must succeed')
-      .descr.text-secondary
+      .text-secondary
         = s_('ProjectSettings|Pipelines need to be configured to enable this feature.')
         = link_to icon('question-circle'),
           help_page_path('ci/merge_request_pipelines/index.md',
diff --git a/app/views/projects/_merge_request_merge_method_settings.html.haml b/app/views/projects/_merge_request_merge_method_settings.html.haml
index 47c311f42d0..1be7f7bb418 100644
--- a/app/views/projects/_merge_request_merge_method_settings.html.haml
+++ b/app/views/projects/_merge_request_merge_method_settings.html.haml
@@ -7,14 +7,14 @@
     = form.radio_button :merge_method, :merge, class: "js-merge-method-radio form-check-input"
     = label_tag :project_merge_method_merge, class: 'form-check-label' do
       = s_('ProjectSettings|Merge commit')
-      .descr.text-secondary
+      .text-secondary
         = s_('ProjectSettings|Every merge creates a merge commit')
 
   .form-check.mb-2
     = form.radio_button :merge_method, :rebase_merge, class: "js-merge-method-radio form-check-input"
     = label_tag :project_merge_method_rebase_merge, class: 'form-check-label' do
       = s_('ProjectSettings|Merge commit with semi-linear history')
-      .descr.text-secondary
+      .text-secondary
         = s_('ProjectSettings|Every merge creates a merge commit')
         %br
         = s_('ProjectSettings|Fast-forward merges only')
@@ -25,7 +25,7 @@
     = form.radio_button :merge_method, :ff, class: "js-merge-method-radio qa-radio-button-merge-ff form-check-input"
     = label_tag :project_merge_method_ff, class: 'form-check-label' do
       = s_('ProjectSettings|Fast-forward merge')
-      .descr.text-secondary
+      .text-secondary
         = s_('ProjectSettings|No merge commits are created')
         %br
         = s_('ProjectSettings|Fast-forward merges only')
diff --git a/app/views/projects/settings/ci_cd/_form.html.haml b/app/views/projects/settings/ci_cd/_form.html.haml
index 498a9744783..430d6071468 100644
--- a/app/views/projects/settings/ci_cd/_form.html.haml
+++ b/app/views/projects/settings/ci_cd/_form.html.haml
@@ -14,14 +14,14 @@
             = f.label :build_allow_git_fetch_false, class: 'form-check-label' do
               %strong git clone
               %br
-              %span.descr
+              %span
                 = _("Slower but makes sure the project workspace is pristine as it clones the repository from scratch for every job")
           .form-check
             = f.radio_button :build_allow_git_fetch, 'true', { class: 'form-check-input' }
             = f.label :build_allow_git_fetch_true, class: 'form-check-label' do
               %strong git fetch
               %br
-              %span.descr
+              %span
                 = _("Faster as it re-uses the project workspace (falling back to clone if it doesn't exist)")
 
         %hr
diff --git a/spec/views/groups/edit.html.haml_spec.rb b/spec/views/groups/edit.html.haml_spec.rb
index 47804411b9d..0da3470433c 100644
--- a/spec/views/groups/edit.html.haml_spec.rb
+++ b/spec/views/groups/edit.html.haml_spec.rb
@@ -23,7 +23,7 @@ describe 'groups/edit.html.haml' do
         render
 
         expect(rendered).to have_content("Prevent sharing a project within #{test_group.name} with other groups")
-        expect(rendered).to have_css('.descr', text: 'help text here')
+        expect(rendered).to have_css('.js-descr', text: 'help text here')
         expect(rendered).to have_field('group_share_with_group_lock', checkbox_options)
       end
     end
-- 
cgit v1.2.1


From eab1dcd13218e4ee9d4bc9e9c1c0e702e437a526 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jes=C3=BAs=20Carmona=20Garrido?= <erduende@fastmail.es>
Date: Wed, 28 Aug 2019 08:06:12 +0000
Subject: Update Textile documentation link

---
 doc/user/project/repository/index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/user/project/repository/index.md b/doc/user/project/repository/index.md
index bd966185c94..a838f06b2fd 100644
--- a/doc/user/project/repository/index.md
+++ b/doc/user/project/repository/index.md
@@ -73,7 +73,7 @@ according to the markup language.
 | [Markdown](../../markdown.md) | `mdown`, `mkd`, `mkdn`, `md`, `markdown` |
 | [reStructuredText](http://docutils.sourceforge.net/rst.html) | `rst` |
 | [AsciiDoc](../../asciidoc.md) | `adoc`, `ad`, `asciidoc` |
-| [Textile](https://txstyle.org/) | `textile` |
+| [Textile](https://textile-lang.com/) | `textile` |
 | [rdoc](http://rdoc.sourceforge.net/doc/index.html)  | `rdoc` |
 | [Orgmode](https://orgmode.org/) | `org` |
 | [creole](http://www.wikicreole.org/) | `creole` |
-- 
cgit v1.2.1


From 748b89ee948c9b2123e86da40c46b71ae27ede80 Mon Sep 17 00:00:00 2001
From: Payton Burdette <pburdette@gitlab.com>
Date: Wed, 28 Aug 2019 08:39:47 +0000
Subject: Remove token field from runners edit form

Add changelog entry

Remove unnecessary test checking for form value

Translations updated for gitlab.pot

Use proper format on changelog entry
---
 app/views/shared/runners/_form.html.haml           | 5 -----
 changelogs/unreleased/35060-remove-token-field.yml | 5 +++++
 locale/gitlab.pot                                  | 3 ---
 spec/features/admin/admin_runners_spec.rb          | 4 ----
 4 files changed, 5 insertions(+), 12 deletions(-)
 create mode 100644 changelogs/unreleased/35060-remove-token-field.yml

diff --git a/app/views/shared/runners/_form.html.haml b/app/views/shared/runners/_form.html.haml
index 559b5aa9c1e..24b4eae0c58 100644
--- a/app/views/shared/runners/_form.html.haml
+++ b/app/views/shared/runners/_form.html.haml
@@ -25,11 +25,6 @@
         .form-check
           = f.check_box :locked, { class: 'form-check-input' }
           %label.light{ for: :runner_locked }= _('When a runner is locked, it cannot be assigned to other projects')
-  .form-group.row
-    = label_tag :token, class: 'col-form-label col-sm-2' do
-      = _('Token')
-    .col-sm-10
-      = f.text_field :token, class: 'form-control', readonly: true
   .form-group.row
     = label_tag :ip_address, class: 'col-form-label col-sm-2' do
       = _('IP Address')
diff --git a/changelogs/unreleased/35060-remove-token-field.yml b/changelogs/unreleased/35060-remove-token-field.yml
new file mode 100644
index 00000000000..93a7b459dd8
--- /dev/null
+++ b/changelogs/unreleased/35060-remove-token-field.yml
@@ -0,0 +1,5 @@
+---
+title: Remove token field from runners edit form
+merge_request: 32231
+author:
+type: fixed
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index c8827c683f8..12138d2db3a 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -12115,9 +12115,6 @@ msgstr ""
 msgid "Toggles :%{name}: emoji award."
 msgstr ""
 
-msgid "Token"
-msgstr ""
-
 msgid "Tomorrow"
 msgstr ""
 
diff --git a/spec/features/admin/admin_runners_spec.rb b/spec/features/admin/admin_runners_spec.rb
index 4ad90c96558..0d5f5df71b6 100644
--- a/spec/features/admin/admin_runners_spec.rb
+++ b/spec/features/admin/admin_runners_spec.rb
@@ -282,10 +282,6 @@ describe "Admin Runners" do
       visit admin_runner_path(runner)
     end
 
-    describe 'runner info' do
-      it { expect(find_field('runner_token').value).to eq runner.token }
-    end
-
     describe 'projects' do
       it 'contains project names' do
         expect(page).to have_content(@project1.full_name)
-- 
cgit v1.2.1


From 0cdd69ed5f78cd47d39e8af51f3a3c233f15dce6 Mon Sep 17 00:00:00 2001
From: David Wilkins <dwilkins@gitlab.com>
Date: Wed, 28 Aug 2019 09:37:05 +0000
Subject: Apply bindings to querys from QueryRecorder

- local tests that assume certain parameters to queries from
  QueryRecorder fail. These same tests don't fail in the runners,
  and I can't tell why. This fixes the local failures
---
 spec/support/helpers/query_recorder.rb | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/spec/support/helpers/query_recorder.rb b/spec/support/helpers/query_recorder.rb
index d936dc6de41..9d47a0c23df 100644
--- a/spec/support/helpers/query_recorder.rb
+++ b/spec/support/helpers/query_recorder.rb
@@ -8,7 +8,10 @@ module ActiveRecord
       @log = []
       @cached = []
       @skip_cached = skip_cached
-      ActiveSupport::Notifications.subscribed(method(:callback), 'sql.active_record', &block)
+      # force replacement of bind parameters to give tests the ability to check for ids
+      ActiveRecord::Base.connection.unprepared_statement do
+        ActiveSupport::Notifications.subscribed(method(:callback), 'sql.active_record', &block)
+      end
     end
 
     def show_backtrace(values)
-- 
cgit v1.2.1


From 7f15dacb5504b0ba7f9eb73e8a60e494e3473274 Mon Sep 17 00:00:00 2001
From: Arun Kumar Mohan <arunmohandm@gmail.com>
Date: Wed, 28 Aug 2019 04:05:37 -0500
Subject: Remove csslab

---
 app/assets/stylesheets/csslab.scss                      | 1 -
 app/assets/stylesheets/framework/typography.scss        | 2 +-
 app/views/layouts/_head.html.haml                       | 1 -
 app/views/projects/blob/_blob.html.haml                 | 2 +-
 app/views/projects/blob/preview.html.haml               | 2 +-
 app/views/projects/blob/viewers/_markup.html.haml       | 2 +-
 app/views/projects/snippets/show.html.haml              | 2 +-
 app/views/projects/wikis/show.html.haml                 | 2 +-
 config/application.rb                                   | 1 -
 doc/development/ee_features.md                          | 2 --
 package.json                                            | 1 -
 spec/features/projects/files/user_browses_files_spec.rb | 1 -
 vendor/licenses.csv                                     | 1 -
 yarn.lock                                               | 9 +--------
 14 files changed, 7 insertions(+), 22 deletions(-)
 delete mode 100644 app/assets/stylesheets/csslab.scss

diff --git a/app/assets/stylesheets/csslab.scss b/app/assets/stylesheets/csslab.scss
deleted file mode 100644
index 87c59cd42c0..00000000000
--- a/app/assets/stylesheets/csslab.scss
+++ /dev/null
@@ -1 +0,0 @@
-@import "@gitlab/csslab/dist/css/csslab-slim";
diff --git a/app/assets/stylesheets/framework/typography.scss b/app/assets/stylesheets/framework/typography.scss
index c201605e83d..afcc7f8a1db 100644
--- a/app/assets/stylesheets/framework/typography.scss
+++ b/app/assets/stylesheets/framework/typography.scss
@@ -2,7 +2,7 @@
  * Apply Markup (Markdown/AsciiDoc) typography
  *
  */
-.md:not(.use-csslab) {
+.md {
   color: $gl-text-color;
   word-wrap: break-word;
 
diff --git a/app/views/layouts/_head.html.haml b/app/views/layouts/_head.html.haml
index 271b73326fa..68abfd3f61f 100644
--- a/app/views/layouts/_head.html.haml
+++ b/app/views/layouts/_head.html.haml
@@ -36,7 +36,6 @@
   = stylesheet_link_tag "print", media: "print"
   = stylesheet_link_tag "test", media: "all" if Rails.env.test?
   = stylesheet_link_tag 'performance_bar' if performance_bar_enabled?
-  = stylesheet_link_tag 'csslab' if Feature.enabled?(:csslab)
 
   = stylesheet_link_tag "highlight/themes/#{user_color_scheme}", media: "all"
 
diff --git a/app/views/projects/blob/_blob.html.haml b/app/views/projects/blob/_blob.html.haml
index 95c5eb32c7f..cf273aab108 100644
--- a/app/views/projects/blob/_blob.html.haml
+++ b/app/views/projects/blob/_blob.html.haml
@@ -9,6 +9,6 @@
   = render "projects/blob/auxiliary_viewer", blob: blob
 
 #blob-content-holder.blob-content-holder
-  %article.file-holder{ class: ('use-csslab' if Feature.enabled?(:csslab)) }
+  %article.file-holder
     = render 'projects/blob/header', blob: blob
     = render 'projects/blob/content', blob: blob
diff --git a/app/views/projects/blob/preview.html.haml b/app/views/projects/blob/preview.html.haml
index 3e893343165..46e76e4d175 100644
--- a/app/views/projects/blob/preview.html.haml
+++ b/app/views/projects/blob/preview.html.haml
@@ -1,5 +1,5 @@
 - if markup?(@blob.name)
-  .file-content.md.md-file{ class: ('use-csslab' if Feature.enabled?(:csslab)) }
+  .file-content.md.md-file
     = markup(@blob.name, @content)
 - else
   .diff-file
diff --git a/app/views/projects/blob/viewers/_markup.html.haml b/app/views/projects/blob/viewers/_markup.html.haml
index abc74b66e90..c71df29354b 100644
--- a/app/views/projects/blob/viewers/_markup.html.haml
+++ b/app/views/projects/blob/viewers/_markup.html.haml
@@ -1,4 +1,4 @@
 - blob = viewer.blob
 - context = blob.respond_to?(:rendered_markup) ? { rendered: blob.rendered_markup } : {}
-.file-content.md.md-file{ class: ('use-csslab' if Feature.enabled?(:csslab)) }
+.file-content.md.md-file
   = markup(blob.name, blob.data, context)
diff --git a/app/views/projects/snippets/show.html.haml b/app/views/projects/snippets/show.html.haml
index da48cb207a4..f495b4eaf30 100644
--- a/app/views/projects/snippets/show.html.haml
+++ b/app/views/projects/snippets/show.html.haml
@@ -6,7 +6,7 @@
 = render 'shared/snippets/header'
 
 .project-snippets
-  %article.file-holder.snippet-file-content{ class: ('use-csslab' if Feature.enabled?(:csslab)) }
+  %article.file-holder.snippet-file-content
     = render 'shared/snippets/blob'
 
   .row-content-block.top-block.content-component-block
diff --git a/app/views/projects/wikis/show.html.haml b/app/views/projects/wikis/show.html.haml
index c6197fe576e..51b7f2dd4b4 100644
--- a/app/views/projects/wikis/show.html.haml
+++ b/app/views/projects/wikis/show.html.haml
@@ -26,7 +26,7 @@
     = (s_("WikiHistoricalPage|You can view the %{most_recent_link} or browse the %{history_link}.") % { most_recent_link: most_recent_link, history_link: history_link }).html_safe
 
 .prepend-top-default.append-bottom-default
-  .md.md-file{ class: ('use-csslab' if Feature.enabled?(:csslab)) }
+  .md.md-file
     = render_wiki_content(@page)
 
 = render 'sidebar'
diff --git a/config/application.rb b/config/application.rb
index 294ed470298..81889561473 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -165,7 +165,6 @@ module Gitlab
     config.assets.precompile << "locale/**/app.js"
     config.assets.precompile << "emoji_sprites.css"
     config.assets.precompile << "errors.css"
-    config.assets.precompile << "csslab.css"
 
     config.assets.precompile << "highlight/themes/*.css"
 
diff --git a/doc/development/ee_features.md b/doc/development/ee_features.md
index 1358851f3cd..391361a4b8f 100644
--- a/doc/development/ee_features.md
+++ b/doc/development/ee_features.md
@@ -1047,8 +1047,6 @@ code base.  Examples of backports include the following:
 
 Here is a workflow to make sure those changes end up backported safely into CE too.
 
-(This approach does not refer to changes introduced via [csslab](https://gitlab.com/gitlab-org/csslab/).)
-
 1. **Make your changes in the EE branch.** If possible, keep a separated commit (to be squashed) to help backporting and review.
 1. **Open merge request to EE project.**
 1. **Apply the changes you made to CE files in a branch of the CE project.** (Tip: Use `patch` with the diff from your commit in EE branch)
diff --git a/package.json b/package.json
index 8fa34cdea28..91770a9747d 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,6 @@
     "@babel/plugin-syntax-dynamic-import": "^7.2.0",
     "@babel/plugin-syntax-import-meta": "^7.2.0",
     "@babel/preset-env": "^7.5.5",
-    "@gitlab/csslab": "^1.9.0",
     "@gitlab/svgs": "^1.70.0",
     "@gitlab/ui": "5.19.0",
     "@gitlab/visual-review-tools": "^1.0.0",
diff --git a/spec/features/projects/files/user_browses_files_spec.rb b/spec/features/projects/files/user_browses_files_spec.rb
index a090461261b..0b3f905b5de 100644
--- a/spec/features/projects/files/user_browses_files_spec.rb
+++ b/spec/features/projects/files/user_browses_files_spec.rb
@@ -14,7 +14,6 @@ describe "User browses files" do
 
   before do
     stub_feature_flags(vue_file_list: false)
-    stub_feature_flags(csslab: false)
     sign_in(user)
   end
 
diff --git a/vendor/licenses.csv b/vendor/licenses.csv
index 0c445aeac88..20aacff75fd 100644
--- a/vendor/licenses.csv
+++ b/vendor/licenses.csv
@@ -67,7 +67,6 @@
 @babel/template,7.1.2,MIT
 @babel/traverse,7.1.0,MIT
 @babel/types,7.1.2,MIT
-@gitlab/csslab,1.8.0,MIT
 @gitlab/svgs,1.41.0,MIT
 @gitlab/ui,1.15.0,MIT
 @sindresorhus/is,0.7.0,MIT
diff --git a/yarn.lock b/yarn.lock
index 712cdace0d7..0070d03c6e4 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -964,13 +964,6 @@
     exec-sh "^0.3.2"
     minimist "^1.2.0"
 
-"@gitlab/csslab@^1.9.0":
-  version "1.9.0"
-  resolved "https://registry.yarnpkg.com/@gitlab/csslab/-/csslab-1.9.0.tgz#22fca5b1a30cbd9ca46fc6f9485ecbaba4dc300c"
-  integrity sha512-Zjayzokm7E2wgxUR/pxIMocdiBB5XHt2PEemdzD8qD+aQmMpMxSyIEMQk5Jq0Wgv+Rd5WXTolTw3kmb9l8ZeJg==
-  dependencies:
-    bootstrap "^4.1.3"
-
 "@gitlab/eslint-config@^1.6.0":
   version "1.6.0"
   resolved "https://registry.yarnpkg.com/@gitlab/eslint-config/-/eslint-config-1.6.0.tgz#1fd247d6ab477d53d4c330e05f007e3afa303689"
@@ -2280,7 +2273,7 @@ bootstrap-vue@2.0.0-rc.27:
     portal-vue "^2.1.5"
     vue-functional-data-merge "^3.1.0"
 
-bootstrap@4.3.1, bootstrap@^4.1.3, bootstrap@^4.3.1:
+bootstrap@4.3.1, bootstrap@^4.3.1:
   version "4.3.1"
   resolved "https://registry.yarnpkg.com/bootstrap/-/bootstrap-4.3.1.tgz#280ca8f610504d99d7b6b4bfc4b68cec601704ac"
   integrity sha512-rXqOmH1VilAt2DyPzluTi2blhk17bO7ef+zLLPlWvG494pDxcM234pJ8wTc/6R40UWizAIIMgxjvxZg5kmsbag==
-- 
cgit v1.2.1


From a3edfab1a9fcfdab56d2f2d29fa9f72ce0455ee4 Mon Sep 17 00:00:00 2001
From: jakeburden <jburden@gitlab.com>
Date: Wed, 21 Aug 2019 14:58:04 -0400
Subject: Show correct deployment date for a manual job

Only display time if the job has deployed

Update JS tests for displaying job deployment time

Simplify boolean check in deployedDate
---
 .../environments/components/environment_item.vue     | 20 +++++---------------
 app/views/projects/deployments/_deployment.html.haml |  3 ++-
 ...s-shows-incorrect-deployment-date-for-manual-.yml |  6 ++++++
 .../environments/environment_item_spec.js            |  5 ++---
 4 files changed, 15 insertions(+), 19 deletions(-)
 create mode 100644 changelogs/unreleased/56130-operations-environments-shows-incorrect-deployment-date-for-manual-.yml

diff --git a/app/assets/javascripts/environments/components/environment_item.vue b/app/assets/javascripts/environments/components/environment_item.vue
index 95e1e8af9b3..1d4a6e64f9d 100644
--- a/app/assets/javascripts/environments/components/environment_item.vue
+++ b/app/assets/javascripts/environments/components/environment_item.vue
@@ -111,12 +111,7 @@ export default {
      * @returns {Boolean|Undefined}
      */
     canShowDate() {
-      return (
-        this.model &&
-        this.model.last_deployment &&
-        this.model.last_deployment.deployable &&
-        this.model.last_deployment.deployable !== undefined
-      );
+      return this.model && this.model.last_deployment && this.model.last_deployment.deployed_at;
     },
 
     /**
@@ -124,14 +119,9 @@ export default {
      *
      * @returns {String}
      */
-    createdDate() {
-      if (
-        this.model &&
-        this.model.last_deployment &&
-        this.model.last_deployment.deployable &&
-        this.model.last_deployment.deployable.created_at
-      ) {
-        return timeagoInstance.format(this.model.last_deployment.deployable.created_at);
+    deployedDate() {
+      if (this.canShowDate) {
+        return timeagoInstance.format(this.model.last_deployment.deployed_at);
       }
       return '';
     },
@@ -547,7 +537,7 @@ export default {
     <div v-if="!model.isFolder" class="table-section section-10" role="gridcell">
       <div role="rowheader" class="table-mobile-header">{{ s__('Environments|Updated') }}</div>
       <span v-if="canShowDate" class="environment-created-date-timeago table-mobile-content">
-        {{ createdDate }}
+        {{ deployedDate }}
       </span>
     </div>
 
diff --git a/app/views/projects/deployments/_deployment.html.haml b/app/views/projects/deployments/_deployment.html.haml
index a11e23b6daa..1dd85c89fd0 100644
--- a/app/views/projects/deployments/_deployment.html.haml
+++ b/app/views/projects/deployments/_deployment.html.haml
@@ -22,7 +22,8 @@
 
   .table-section.section-15{ role: 'gridcell' }
     .table-mobile-header{ role: 'rowheader' }= _("Created")
-    %span.table-mobile-content= time_ago_with_tooltip(deployment.created_at)
+    - if deployment.deployed_at
+      %span.table-mobile-content= time_ago_with_tooltip(deployment.deployed_at)
 
   .table-section.section-20.table-button-footer{ role: 'gridcell' }
     .btn-group.table-action-buttons
diff --git a/changelogs/unreleased/56130-operations-environments-shows-incorrect-deployment-date-for-manual-.yml b/changelogs/unreleased/56130-operations-environments-shows-incorrect-deployment-date-for-manual-.yml
new file mode 100644
index 00000000000..92f25ac07e2
--- /dev/null
+++ b/changelogs/unreleased/56130-operations-environments-shows-incorrect-deployment-date-for-manual-.yml
@@ -0,0 +1,6 @@
+---
+title: Update the timestamp in Operations > Environments to show correct deployment
+  date for manual deploy jobs
+merge_request: 32072
+author:
+type: fixed
diff --git a/spec/javascripts/environments/environment_item_spec.js b/spec/javascripts/environments/environment_item_spec.js
index 388d7063d13..f9ee4648128 100644
--- a/spec/javascripts/environments/environment_item_spec.js
+++ b/spec/javascripts/environments/environment_item_spec.js
@@ -106,6 +106,7 @@ describe('Environment item', () => {
               play_path: '/play',
             },
           ],
+          deployed_at: '2016-11-29T18:11:58.430Z',
         },
         has_stop_action: true,
         environment_path: 'root/ci-folders/environments/31',
@@ -139,9 +140,7 @@ describe('Environment item', () => {
 
       it('should render last deployment date', () => {
         const timeagoInstance = new timeago(); // eslint-disable-line
-        const formatedDate = timeagoInstance.format(
-          environment.last_deployment.deployable.created_at,
-        );
+        const formatedDate = timeagoInstance.format(environment.last_deployment.deployed_at);
 
         expect(
           component.$el.querySelector('.environment-created-date-timeago').textContent,
-- 
cgit v1.2.1


From c9b4dc677abdebc02ecac4dca65a759d3f07b2a0 Mon Sep 17 00:00:00 2001
From: Patrick Derichs <pderichs@gitlab.com>
Date: Fri, 9 Aug 2019 14:54:57 +0200
Subject: Filter out old system notes for epics

---
 app/controllers/concerns/issuable_actions.rb                        | 2 +-
 app/controllers/concerns/notes_actions.rb                           | 2 +-
 app/models/note.rb                                                  | 4 ++++
 .../security-epic-notes-api-reveals-historical-info-ce-master.yml   | 5 +++++
 lib/api/discussions.rb                                              | 2 +-
 lib/api/helpers/notes_helpers.rb                                    | 6 +++---
 lib/api/notes.rb                                                    | 2 +-
 7 files changed, 16 insertions(+), 7 deletions(-)
 create mode 100644 changelogs/unreleased/security-epic-notes-api-reveals-historical-info-ce-master.yml

diff --git a/app/controllers/concerns/issuable_actions.rb b/app/controllers/concerns/issuable_actions.rb
index b86e4451a7e..1d6a1be402c 100644
--- a/app/controllers/concerns/issuable_actions.rb
+++ b/app/controllers/concerns/issuable_actions.rb
@@ -110,7 +110,7 @@ module IssuableActions
     end
 
     notes = prepare_notes_for_rendering(notes)
-    notes = notes.reject { |n| n.cross_reference_not_visible_for?(current_user) }
+    notes = notes.select { |n| n.visible_for?(current_user) }
 
     discussions = Discussion.build_collection(notes, issuable)
 
diff --git a/app/controllers/concerns/notes_actions.rb b/app/controllers/concerns/notes_actions.rb
index d2a961efff7..80be7095ed3 100644
--- a/app/controllers/concerns/notes_actions.rb
+++ b/app/controllers/concerns/notes_actions.rb
@@ -29,7 +29,7 @@ module NotesActions
     end
 
     notes = prepare_notes_for_rendering(notes)
-    notes = notes.reject { |n| n.cross_reference_not_visible_for?(current_user) }
+    notes = notes.select { |n| n.visible_for?(current_user) }
 
     notes_json[:notes] =
       if use_note_serializer?
diff --git a/app/models/note.rb b/app/models/note.rb
index a12d1eb7243..fae66ce7e4a 100644
--- a/app/models/note.rb
+++ b/app/models/note.rb
@@ -331,6 +331,10 @@ class Note < ApplicationRecord
     cross_reference? && !all_referenced_mentionables_allowed?(user)
   end
 
+  def visible_for?(user)
+    !cross_reference_not_visible_for?(user)
+  end
+
   def award_emoji?
     can_be_award_emoji? && contains_emoji_only?
   end
diff --git a/changelogs/unreleased/security-epic-notes-api-reveals-historical-info-ce-master.yml b/changelogs/unreleased/security-epic-notes-api-reveals-historical-info-ce-master.yml
new file mode 100644
index 00000000000..c639098721e
--- /dev/null
+++ b/changelogs/unreleased/security-epic-notes-api-reveals-historical-info-ce-master.yml
@@ -0,0 +1,5 @@
+---
+title: Filter out old system notes for epics in notes api endpoint response
+merge_request:
+author:
+type: security
diff --git a/lib/api/discussions.rb b/lib/api/discussions.rb
index 6c1acc3963f..9125207167c 100644
--- a/lib/api/discussions.rb
+++ b/lib/api/discussions.rb
@@ -239,7 +239,7 @@ module API
         # because notes are redacted if they point to projects that
         # cannot be accessed by the user.
         notes = prepare_notes_for_rendering(notes)
-        notes.reject { |n| n.cross_reference_not_visible_for?(current_user) }
+        notes.select { |n| n.visible_for?(current_user) }
       end
       # rubocop: enable CodeReuse/ActiveRecord
     end
diff --git a/lib/api/helpers/notes_helpers.rb b/lib/api/helpers/notes_helpers.rb
index b2bf6bf7417..f445834323d 100644
--- a/lib/api/helpers/notes_helpers.rb
+++ b/lib/api/helpers/notes_helpers.rb
@@ -12,7 +12,7 @@ module API
       end
 
       def update_note(noteable, note_id)
-        note = noteable.notes.find(params[:note_id])
+        note = noteable.notes.find(note_id)
 
         authorize! :admin_note, note
 
@@ -61,8 +61,8 @@ module API
       end
 
       def get_note(noteable, note_id)
-        note = noteable.notes.with_metadata.find(params[:note_id])
-        can_read_note = !note.cross_reference_not_visible_for?(current_user)
+        note = noteable.notes.with_metadata.find(note_id)
+        can_read_note = note.visible_for?(current_user)
 
         if can_read_note
           present note, with: Entities::Note
diff --git a/lib/api/notes.rb b/lib/api/notes.rb
index 84563d66ee8..16fca9acccb 100644
--- a/lib/api/notes.rb
+++ b/lib/api/notes.rb
@@ -42,7 +42,7 @@ module API
           # array returned, but this is really a edge-case.
           notes = paginate(raw_notes)
           notes = prepare_notes_for_rendering(notes)
-          notes = notes.reject { |n| n.cross_reference_not_visible_for?(current_user) }
+          notes = notes.select { |note| note.visible_for?(current_user) }
           present notes, with: Entities::Note
         end
         # rubocop: enable CodeReuse/ActiveRecord
-- 
cgit v1.2.1


From 59995d15886b831f2483dfaa8e0c46372aa76eb0 Mon Sep 17 00:00:00 2001
From: Patrick Derichs <pderichs@gitlab.com>
Date: Wed, 28 Aug 2019 12:09:45 +0200
Subject: Return NO_ACCESS if user is nil

---
 app/models/group.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/app/models/group.rb b/app/models/group.rb
index 6c868b1d1f0..61a4802a6ee 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -365,6 +365,8 @@ class Group < Namespace
   end
 
   def max_member_access_for_user(user)
+    return GroupMember::NO_ACCESS unless user
+
     return GroupMember::OWNER if user.admin?
 
     members_with_parents
-- 
cgit v1.2.1


From 4fea485ec4d8187d0f875c38ee4eee7b537dbeea Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Tue, 27 Aug 2019 17:04:27 +0800
Subject: Use `stub_full_request` to fix spec failure

Also change test URL sequest to .test TLD
---
 spec/factories/sequences.rb            |  2 +-
 spec/models/ci/pipeline_spec.rb        |  5 +++--
 spec/services/web_hook_service_spec.rb | 33 ++++++++++++++++++++-------------
 3 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/spec/factories/sequences.rb b/spec/factories/sequences.rb
index b6f2d6d8389..17b54d69372 100644
--- a/spec/factories/sequences.rb
+++ b/spec/factories/sequences.rb
@@ -7,7 +7,7 @@ FactoryBot.define do
   sequence(:email_alias) { |n| "user.alias#{n}@example.org" }
   sequence(:title) { |n| "My title #{n}" }
   sequence(:filename) { |n| "filename-#{n}.rb" }
-  sequence(:url) { |n| "http://example#{n}.org" }
+  sequence(:url) { |n| "http://example#{n}.test" }
   sequence(:label_title) { |n| "label#{n}" }
   sequence(:branch) { |n| "my-branch-#{n}" }
   sequence(:past_time) { |n| 4.hours.ago + (2 * n).seconds }
diff --git a/spec/models/ci/pipeline_spec.rb b/spec/models/ci/pipeline_spec.rb
index 78be4a8131a..7d84d094bdf 100644
--- a/spec/models/ci/pipeline_spec.rb
+++ b/spec/models/ci/pipeline_spec.rb
@@ -4,6 +4,7 @@ require 'spec_helper'
 
 describe Ci::Pipeline, :mailer do
   include ProjectForksHelper
+  include StubRequests
 
   let(:user) { create(:user) }
   set(:project) { create(:project) }
@@ -2504,7 +2505,7 @@ describe Ci::Pipeline, :mailer do
       let(:enabled) { true }
 
       before do
-        WebMock.stub_request(:post, hook.url)
+        stub_full_request(hook.url, method: :post)
       end
 
       context 'with multiple builds' do
@@ -2558,7 +2559,7 @@ describe Ci::Pipeline, :mailer do
         end
 
         def have_requested_pipeline_hook(status)
-          have_requested(:post, hook.url).with do |req|
+          have_requested(:post, stubbed_hostname(hook.url)).with do |req|
             json_body = JSON.parse(req.body)
             json_body['object_attributes']['status'] == status &&
               json_body['builds'].length == 2
diff --git a/spec/services/web_hook_service_spec.rb b/spec/services/web_hook_service_spec.rb
index 50167a2e059..2a4368868d5 100644
--- a/spec/services/web_hook_service_spec.rb
+++ b/spec/services/web_hook_service_spec.rb
@@ -55,31 +55,38 @@ describe WebHookService do
   describe '#execute' do
     before do
       project.hooks << [project_hook]
-
-      WebMock.stub_request(:post, project_hook.url)
     end
 
     context 'when token is defined' do
       let(:project_hook) { create(:project_hook, :token) }
 
       it 'POSTs to the webhook URL' do
+        stub_full_request(project_hook.url, method: :post)
+
         service_instance.execute
-        expect(WebMock).to have_requested(:post, project_hook.url).with(
+
+        expect(WebMock).to have_requested(:post, stubbed_hostname(project_hook.url)).with(
           headers: headers.merge({ 'X-Gitlab-Token' => project_hook.token })
         ).once
       end
     end
 
     it 'POSTs to the webhook URL' do
+      stub_full_request(project_hook.url, method: :post)
+
       service_instance.execute
-      expect(WebMock).to have_requested(:post, project_hook.url).with(
+
+      expect(WebMock).to have_requested(:post, stubbed_hostname(project_hook.url)).with(
         headers: headers
       ).once
     end
 
     it 'POSTs the data as JSON' do
+      stub_full_request(project_hook.url, method: :post)
+
       service_instance.execute
-      expect(WebMock).to have_requested(:post, project_hook.url).with(
+
+      expect(WebMock).to have_requested(:post, stubbed_hostname(project_hook.url)).with(
         headers: headers
       ).once
     end
@@ -115,7 +122,7 @@ describe WebHookService do
     end
 
     it 'catches exceptions' do
-      WebMock.stub_request(:post, project_hook.url).to_raise(StandardError.new('Some error'))
+      stub_full_request(project_hook.url, method: :post).to_raise(StandardError.new('Some error'))
 
       expect { service_instance.execute }.to raise_error(StandardError)
     end
@@ -125,20 +132,20 @@ describe WebHookService do
       exceptions.each do |exception_class|
         exception = exception_class.new('Exception message')
 
-        WebMock.stub_request(:post, project_hook.url).to_raise(exception)
+        stub_full_request(project_hook.url, method: :post).to_raise(exception)
         expect(service_instance.execute).to eq({ status: :error, message: exception.to_s })
         expect { service_instance.execute }.not_to raise_error
       end
     end
 
     it 'handles 200 status code' do
-      WebMock.stub_request(:post, project_hook.url).to_return(status: 200, body: 'Success')
+      stub_full_request(project_hook.url, method: :post).to_return(status: 200, body: 'Success')
 
       expect(service_instance.execute).to include({ status: :success, http_status: 200, message: 'Success' })
     end
 
     it 'handles 2xx status codes' do
-      WebMock.stub_request(:post, project_hook.url).to_return(status: 201, body: 'Success')
+      stub_full_request(project_hook.url, method: :post).to_return(status: 201, body: 'Success')
 
       expect(service_instance.execute).to include({ status: :success, http_status: 201, message: 'Success' })
     end
@@ -148,7 +155,7 @@ describe WebHookService do
 
       context 'with success' do
         before do
-          WebMock.stub_request(:post, project_hook.url).to_return(status: 200, body: 'Success')
+          stub_full_request(project_hook.url, method: :post).to_return(status: 200, body: 'Success')
           service_instance.execute
         end
 
@@ -165,7 +172,7 @@ describe WebHookService do
 
       context 'with exception' do
         before do
-          WebMock.stub_request(:post, project_hook.url).to_raise(SocketError.new('Some HTTP Post error'))
+          stub_full_request(project_hook.url, method: :post).to_raise(SocketError.new('Some HTTP Post error'))
           service_instance.execute
         end
 
@@ -182,7 +189,7 @@ describe WebHookService do
 
       context 'with unsafe response body' do
         before do
-          WebMock.stub_request(:post, project_hook.url).to_return(status: 200, body: "\xBB")
+          stub_full_request(project_hook.url, method: :post).to_return(status: 200, body: "\xBB")
           service_instance.execute
         end
 
@@ -202,7 +209,7 @@ describe WebHookService do
         let(:service_instance) { described_class.new(service_hook, data, 'service_hook') }
 
         before do
-          WebMock.stub_request(:post, service_hook.url).to_return(status: 200, body: 'Success')
+          stub_full_request(service_hook.url, method: :post).to_return(status: 200, body: 'Success')
         end
 
         it { expect { service_instance.execute }.not_to change(WebHookLog, :count) }
-- 
cgit v1.2.1


From 2266d565437c808338fd6e5b047dd3e2c3c20185 Mon Sep 17 00:00:00 2001
From: Stefan Schmalzhaf <stefanschmalzhaf@gmx.de>
Date: Wed, 28 Aug 2019 13:09:10 +0000
Subject: Docs: Update Screenshots for protected tags and branches.

---
 .../project/img/protected_branches_devs_can_push.png    | Bin 11221 -> 0 bytes
 .../img/protected_branches_devs_can_push_v12_3.png      | Bin 0 -> 11941 bytes
 doc/user/project/img/protected_branches_list.png        | Bin 6933 -> 0 bytes
 doc/user/project/img/protected_branches_list_v12_3.png  | Bin 0 -> 8774 bytes
 doc/user/project/img/protected_branches_page.png        | Bin 7199 -> 0 bytes
 doc/user/project/img/protected_branches_page_v12_3.png  | Bin 0 -> 9445 bytes
 doc/user/project/img/protected_tags_list.png            | Bin 7227 -> 0 bytes
 doc/user/project/img/protected_tags_list_v12_3.png      | Bin 0 -> 4395 bytes
 doc/user/project/img/protected_tags_page.png            | Bin 13813 -> 0 bytes
 doc/user/project/img/protected_tags_page_v12_3.png      | Bin 0 -> 10431 bytes
 .../project/img/protected_tags_permissions_dropdown.png | Bin 7770 -> 0 bytes
 .../img/protected_tags_permissions_dropdown_v12_3.png   | Bin 0 -> 4517 bytes
 doc/user/project/protected_branches.md                  |   6 +++---
 doc/user/project/protected_tags.md                      |   6 +++---
 14 files changed, 6 insertions(+), 6 deletions(-)
 delete mode 100644 doc/user/project/img/protected_branches_devs_can_push.png
 create mode 100644 doc/user/project/img/protected_branches_devs_can_push_v12_3.png
 delete mode 100644 doc/user/project/img/protected_branches_list.png
 create mode 100644 doc/user/project/img/protected_branches_list_v12_3.png
 delete mode 100644 doc/user/project/img/protected_branches_page.png
 create mode 100644 doc/user/project/img/protected_branches_page_v12_3.png
 delete mode 100644 doc/user/project/img/protected_tags_list.png
 create mode 100644 doc/user/project/img/protected_tags_list_v12_3.png
 delete mode 100644 doc/user/project/img/protected_tags_page.png
 create mode 100644 doc/user/project/img/protected_tags_page_v12_3.png
 delete mode 100644 doc/user/project/img/protected_tags_permissions_dropdown.png
 create mode 100644 doc/user/project/img/protected_tags_permissions_dropdown_v12_3.png

diff --git a/doc/user/project/img/protected_branches_devs_can_push.png b/doc/user/project/img/protected_branches_devs_can_push.png
deleted file mode 100644
index b537839c00b..00000000000
Binary files a/doc/user/project/img/protected_branches_devs_can_push.png and /dev/null differ
diff --git a/doc/user/project/img/protected_branches_devs_can_push_v12_3.png b/doc/user/project/img/protected_branches_devs_can_push_v12_3.png
new file mode 100644
index 00000000000..adc03a41abb
Binary files /dev/null and b/doc/user/project/img/protected_branches_devs_can_push_v12_3.png differ
diff --git a/doc/user/project/img/protected_branches_list.png b/doc/user/project/img/protected_branches_list.png
deleted file mode 100644
index 495ce4d7b6f..00000000000
Binary files a/doc/user/project/img/protected_branches_list.png and /dev/null differ
diff --git a/doc/user/project/img/protected_branches_list_v12_3.png b/doc/user/project/img/protected_branches_list_v12_3.png
new file mode 100644
index 00000000000..365d8d99e5a
Binary files /dev/null and b/doc/user/project/img/protected_branches_list_v12_3.png differ
diff --git a/doc/user/project/img/protected_branches_page.png b/doc/user/project/img/protected_branches_page.png
deleted file mode 100644
index 9b10991f62e..00000000000
Binary files a/doc/user/project/img/protected_branches_page.png and /dev/null differ
diff --git a/doc/user/project/img/protected_branches_page_v12_3.png b/doc/user/project/img/protected_branches_page_v12_3.png
new file mode 100644
index 00000000000..17f19642552
Binary files /dev/null and b/doc/user/project/img/protected_branches_page_v12_3.png differ
diff --git a/doc/user/project/img/protected_tags_list.png b/doc/user/project/img/protected_tags_list.png
deleted file mode 100644
index 6c5295e0f4b..00000000000
Binary files a/doc/user/project/img/protected_tags_list.png and /dev/null differ
diff --git a/doc/user/project/img/protected_tags_list_v12_3.png b/doc/user/project/img/protected_tags_list_v12_3.png
new file mode 100644
index 00000000000..6a30f615f2f
Binary files /dev/null and b/doc/user/project/img/protected_tags_list_v12_3.png differ
diff --git a/doc/user/project/img/protected_tags_page.png b/doc/user/project/img/protected_tags_page.png
deleted file mode 100644
index 5f8a2106cd1..00000000000
Binary files a/doc/user/project/img/protected_tags_page.png and /dev/null differ
diff --git a/doc/user/project/img/protected_tags_page_v12_3.png b/doc/user/project/img/protected_tags_page_v12_3.png
new file mode 100644
index 00000000000..841e19af8a7
Binary files /dev/null and b/doc/user/project/img/protected_tags_page_v12_3.png differ
diff --git a/doc/user/project/img/protected_tags_permissions_dropdown.png b/doc/user/project/img/protected_tags_permissions_dropdown.png
deleted file mode 100644
index 77098eeb591..00000000000
Binary files a/doc/user/project/img/protected_tags_permissions_dropdown.png and /dev/null differ
diff --git a/doc/user/project/img/protected_tags_permissions_dropdown_v12_3.png b/doc/user/project/img/protected_tags_permissions_dropdown_v12_3.png
new file mode 100644
index 00000000000..913d4725d53
Binary files /dev/null and b/doc/user/project/img/protected_tags_permissions_dropdown_v12_3.png differ
diff --git a/doc/user/project/protected_branches.md b/doc/user/project/protected_branches.md
index 7a79cdbcaee..8423b962948 100644
--- a/doc/user/project/protected_branches.md
+++ b/doc/user/project/protected_branches.md
@@ -34,11 +34,11 @@ that the `master` branch is protected by default.
 1. From the **Branch** dropdown menu, select the branch you want to protect and
    click **Protect**. In the screenshot below, we chose the `develop` branch.
 
-   ![Protected branches page](img/protected_branches_page.png)
+   ![Protected branches page](img/protected_branches_page_v12_3.png)
 
 1. Once done, the protected branch will appear in the "Protected branches" list.
 
-   ![Protected branches list](img/protected_branches_list.png)
+   ![Protected branches list](img/protected_branches_list_v12_3.png)
 
 ## Using the Allowed to merge and Allowed to push settings
 
@@ -65,7 +65,7 @@ You can set the "Allowed to push" and "Allowed to merge" options while creating
 a protected branch or afterwards by selecting the option you want from the
 dropdown list in the "Already protected" area.
 
-![Developers can push](img/protected_branches_devs_can_push.png)
+![Developers can push](img/protected_branches_devs_can_push_v12_3.png)
 
 If you don't choose any of those options while creating a protected branch,
 they are set to "Maintainers" by default.
diff --git a/doc/user/project/protected_tags.md b/doc/user/project/protected_tags.md
index 5cc3b8a7fc3..9651c8824ab 100644
--- a/doc/user/project/protected_tags.md
+++ b/doc/user/project/protected_tags.md
@@ -24,15 +24,15 @@ To protect a tag, you need to have at least Maintainer permission level.
 
 1. From the **Tag** dropdown menu, select the tag you want to protect or type and click **Create wildcard**. In the screenshot below, we chose to protect all tags matching `v*`:
 
-   ![Protected tags page](img/protected_tags_page.png)
+   ![Protected tags page](img/protected_tags_page_v12_3.png)
 
 1. From the **Allowed to create** dropdown, select who will have permission to create matching tags and then click **Protect**:
 
-   ![Allowed to create tags dropdown](img/protected_tags_permissions_dropdown.png)
+   ![Allowed to create tags dropdown](img/protected_tags_permissions_dropdown_v12_3.png)
 
 1. Once done, the protected tag will appear in the **Protected tags** list:
 
-   ![Protected tags list](img/protected_tags_list.png)
+   ![Protected tags list](img/protected_tags_list_v12_3.png)
 
 ## Wildcard protected tags
 
-- 
cgit v1.2.1


From 55d28efa1f1fb0d2ce074ac3ebecf6d4e67aaa90 Mon Sep 17 00:00:00 2001
From: Adam Hegyi <ahegyi@gitlab.com>
Date: Wed, 28 Aug 2019 13:38:50 +0000
Subject: Adding NOT NULL constraint to private_profile

This change sets NOT NULL constraint to users.private profile.

closes https://gitlab.com/gitlab-org/gitlab-ce/issues/57538
---
 ...ot-null-constraint-on-users-private-profile.yml |  5 +++++
 ...080128_set_not_null_on_users_private_profile.rb | 26 ++++++++++++++++++++++
 db/schema.rb                                       |  2 +-
 spec/models/user_spec.rb                           |  2 +-
 4 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/57538-not-null-constraint-on-users-private-profile.yml
 create mode 100644 db/post_migrate/20190725080128_set_not_null_on_users_private_profile.rb

diff --git a/changelogs/unreleased/57538-not-null-constraint-on-users-private-profile.yml b/changelogs/unreleased/57538-not-null-constraint-on-users-private-profile.yml
new file mode 100644
index 00000000000..bcbd8e3f11e
--- /dev/null
+++ b/changelogs/unreleased/57538-not-null-constraint-on-users-private-profile.yml
@@ -0,0 +1,5 @@
+---
+title: Setting NOT NULL constraint to users.private_profile column
+merge_request: 14838
+author:
+type: other
diff --git a/db/post_migrate/20190725080128_set_not_null_on_users_private_profile.rb b/db/post_migrate/20190725080128_set_not_null_on_users_private_profile.rb
new file mode 100644
index 00000000000..db42e949d3f
--- /dev/null
+++ b/db/post_migrate/20190725080128_set_not_null_on_users_private_profile.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class SetNotNullOnUsersPrivateProfile < ActiveRecord::Migration[5.1]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    Gitlab::BackgroundMigration.steal('MigrateNullPrivateProfileToFalse')
+
+    # rubocop:disable Migration/UpdateLargeTable
+    # rubocop:disable Migration/UpdateColumnInBatches
+    # Data has been migrated previously, count should be close to 0
+    update_column_in_batches(:users, :private_profile, false) do |table, query|
+      query.where(table[:private_profile].eq(nil))
+    end
+
+    change_column_null :users, :private_profile, false
+  end
+
+  def down
+    change_column_null :users, :private_profile, true
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index f30dad3d030..6c6c2796b9a 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -3499,7 +3499,7 @@ ActiveRecord::Schema.define(version: 2019_08_20_163320) do
     t.integer "theme_id", limit: 2
     t.integer "accepted_term_id"
     t.string "feed_token"
-    t.boolean "private_profile", default: false
+    t.boolean "private_profile", default: false, null: false
     t.boolean "include_private_contributions"
     t.string "commit_email"
     t.boolean "auditor", default: false, null: false
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 8338d2b5b39..f1408194250 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -1176,7 +1176,7 @@ describe User do
         expect(user.can_create_group).to eq(Gitlab.config.gitlab.default_can_create_group)
         expect(user.theme_id).to eq(Gitlab.config.gitlab.default_theme)
         expect(user.external).to be_falsey
-        expect(user.private_profile).to eq false
+        expect(user.private_profile).to eq(false)
       end
     end
 
-- 
cgit v1.2.1


From 59c0c7d1ad5d216bbca725455ddb78d43c1e2f8f Mon Sep 17 00:00:00 2001
From: Hordur Freyr Yngvason <hfyngvason@gitlab.com>
Date: Wed, 28 Aug 2019 13:42:20 +0000
Subject: Add docs for new log file

---
 doc/administration/logs.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/doc/administration/logs.md b/doc/administration/logs.md
index 9030c941cad..9b1efb610f8 100644
--- a/doc/administration/logs.md
+++ b/doc/administration/logs.md
@@ -338,3 +338,12 @@ installations from source.
 [repocheck]: repository_checks.md
 [Rack Attack]: ../security/rack_attack.md
 [Rate Limit]: ../user/admin_area/settings/rate_limits_on_raw_endpoints.md
+
+## `database_load_balancing.log`
+
+Introduced in GitLab 12.3 for observability of [Database Load
+Balancing](https://docs.gitlab.com/ee/administration/database_load_balancing.html)
+when enabled. This file lives in
+`/var/log/gitlab/gitlab-rails/database_load_balancing.log` for Omnibus GitLab
+packages or in `/home/git/gitlab/log/database_load_balancing.log` for
+installations from source.
-- 
cgit v1.2.1


From e4fbd94cf5eba0b103bd97627d822f2014dfe474 Mon Sep 17 00:00:00 2001
From: Victor Zagorodny <vzagorodny@gitlab.com>
Date: Wed, 28 Aug 2019 14:26:42 +0000
Subject: Update CE files for GSD projects filter

A new param with_security_reports was added to
GET /groups/:id/projects API and the code to
support this logic in GroupProjectsFinder and
Project model. Also, a DB index was added to
ci_job_artifacts table to speed up the search
of security reports artifacts for projects
---
 app/finders/group_projects_finder.rb               | 12 ++++----
 app/models/ci/job_artifact.rb                      |  2 ++
 app/models/project.rb                              |  1 +
 ...artifacts_on_project_id_for_security_reports.rb | 22 +++++++++++++++
 db/schema.rb                                       |  3 +-
 doc/api/groups.md                                  |  1 +
 .../security_dashboard/index.md                    |  3 ++
 lib/api/groups.rb                                  |  1 +
 lib/api/helpers.rb                                 | 33 ++++++++++++++--------
 lib/api/helpers/groups_helpers.rb                  |  7 +++++
 .../group_projects_finder_shared_contexts.rb       |  3 +-
 11 files changed, 70 insertions(+), 18 deletions(-)
 create mode 100644 db/migrate/20190828083843_add_index_to_ci_job_artifacts_on_project_id_for_security_reports.rb

diff --git a/app/finders/group_projects_finder.rb b/app/finders/group_projects_finder.rb
index 4155b6af8da..5e0dbbfca2e 100644
--- a/app/finders/group_projects_finder.rb
+++ b/app/finders/group_projects_finder.rb
@@ -23,8 +23,12 @@ class GroupProjectsFinder < ProjectsFinder
   attr_reader :group, :options
 
   def initialize(group:, params: {}, options: {}, current_user: nil, project_ids_relation: nil)
-    super(params: params, current_user: current_user, project_ids_relation: project_ids_relation)
-    @group   = group
+    super(
+      params: params,
+      current_user: current_user,
+      project_ids_relation: project_ids_relation
+    )
+    @group = group
     @options = options
   end
 
@@ -84,15 +88,13 @@ class GroupProjectsFinder < ProjectsFinder
     options.fetch(:include_subgroups, false)
   end
 
-  # rubocop: disable CodeReuse/ActiveRecord
   def owned_projects
     if include_subgroups?
-      Project.where(namespace_id: group.self_and_descendants.select(:id))
+      Project.for_group_and_its_subgroups(group)
     else
       group.projects
     end
   end
-  # rubocop: enable CodeReuse/ActiveRecord
 
   def shared_projects
     group.shared_projects
diff --git a/app/models/ci/job_artifact.rb b/app/models/ci/job_artifact.rb
index e132cb045e2..b4497d8af09 100644
--- a/app/models/ci/job_artifact.rb
+++ b/app/models/ci/job_artifact.rb
@@ -87,6 +87,8 @@ module Ci
 
     scope :expired, -> (limit) { where('expire_at < ?', Time.now).limit(limit) }
 
+    scope :scoped_project, -> { where('ci_job_artifacts.project_id = projects.id') }
+
     delegate :filename, :exists?, :open, to: :file
 
     enum file_type: {
diff --git a/app/models/project.rb b/app/models/project.rb
index 66d5286196e..c67c5c7bc8c 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -497,6 +497,7 @@ class Project < ApplicationRecord
   # We require an alias to the project_mirror_data_table in order to use import_state in our queries
   scope :joins_import_state, -> { joins("INNER JOIN project_mirror_data import_state ON import_state.project_id = projects.id") }
   scope :for_group, -> (group) { where(group: group) }
+  scope :for_group_and_its_subgroups, ->(group) { where(namespace_id: group.self_and_descendants.select(:id)) }
 
   class << self
     # Searches for a list of projects based on the query given in `query`.
diff --git a/db/migrate/20190828083843_add_index_to_ci_job_artifacts_on_project_id_for_security_reports.rb b/db/migrate/20190828083843_add_index_to_ci_job_artifacts_on_project_id_for_security_reports.rb
new file mode 100644
index 00000000000..5253f25aab4
--- /dev/null
+++ b/db/migrate/20190828083843_add_index_to_ci_job_artifacts_on_project_id_for_security_reports.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class AddIndexToCiJobArtifactsOnProjectIdForSecurityReports < ActiveRecord::Migration[5.2]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_index :ci_job_artifacts,
+                         :project_id,
+                         name: "index_ci_job_artifacts_on_project_id_for_security_reports",
+                         where: "file_type IN (5, 6, 7, 8)"
+  end
+
+  def down
+    remove_concurrent_index :ci_job_artifacts,
+                            :project_id,
+                            name: "index_ci_job_artifacts_on_project_id_for_security_reports"
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 6c6c2796b9a..88a7ff77ab4 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2019_08_20_163320) do
+ActiveRecord::Schema.define(version: 2019_08_28_083843) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "pg_trgm"
@@ -658,6 +658,7 @@ ActiveRecord::Schema.define(version: 2019_08_20_163320) do
     t.index ["file_store"], name: "index_ci_job_artifacts_on_file_store"
     t.index ["job_id", "file_type"], name: "index_ci_job_artifacts_on_job_id_and_file_type", unique: true
     t.index ["project_id"], name: "index_ci_job_artifacts_on_project_id"
+    t.index ["project_id"], name: "index_ci_job_artifacts_on_project_id_for_security_reports", where: "(file_type = ANY (ARRAY[5, 6, 7, 8]))"
   end
 
   create_table "ci_job_variables", force: :cascade do |t|
diff --git a/doc/api/groups.md b/doc/api/groups.md
index 0d500f783aa..d7f5b1b463b 100644
--- a/doc/api/groups.md
+++ b/doc/api/groups.md
@@ -158,6 +158,7 @@ Parameters:
 | `with_shared`                 | boolean        | no       | Include projects shared to this group. Default is `true` |
 | `include_subgroups`           | boolean        | no       | Include projects in subgroups of this group. Default is `false` |
 | `with_custom_attributes`      | boolean        | no       | Include [custom attributes](custom_attributes.md) in response (admins only) |
+| `with_security_reports`       | boolean        | no       | **(ULTIMATE)** Return only projects that have security reports artifacts present in any of their builds. This means "projects with security reports enabled". Default is `false` |
 
 Example response:
 
diff --git a/doc/user/application_security/security_dashboard/index.md b/doc/user/application_security/security_dashboard/index.md
index ac8c1ac0354..314f7c1766f 100644
--- a/doc/user/application_security/security_dashboard/index.md
+++ b/doc/user/application_security/security_dashboard/index.md
@@ -62,6 +62,9 @@ Once you're on the dashboard, at the top you should see a series of filters for:
 - Report type
 - Project
 
+NOTE: **Note:**
+The dashboard only shows projects with [security reports](#supported-reports) enabled in a group. 
+
 ![dashboard with action buttons and metrics](img/group_security_dashboard.png)
 
 Selecting one or more filters will filter the results in this page.
diff --git a/lib/api/groups.rb b/lib/api/groups.rb
index f545f33c06b..0bcd09d3977 100644
--- a/lib/api/groups.rb
+++ b/lib/api/groups.rb
@@ -216,6 +216,7 @@ module API
 
         use :pagination
         use :with_custom_attributes
+        use :optional_projects_params
       end
       get ":id/projects" do
         projects = find_group_projects(params)
diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index 1aa6dc44bf7..5755f4b8d74 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -416,17 +416,7 @@ module API
     # rubocop: enable CodeReuse/ActiveRecord
 
     def project_finder_params
-      finder_params = { without_deleted: true }
-      finder_params[:owned] = true if params[:owned].present?
-      finder_params[:non_public] = true if params[:membership].present?
-      finder_params[:starred] = true if params[:starred].present?
-      finder_params[:visibility_level] = Gitlab::VisibilityLevel.level_value(params[:visibility]) if params[:visibility]
-      finder_params[:archived] = archived_param unless params[:archived].nil?
-      finder_params[:search] = params[:search] if params[:search]
-      finder_params[:user] = params.delete(:user) if params[:user]
-      finder_params[:custom_attributes] = params[:custom_attributes] if params[:custom_attributes]
-      finder_params[:min_access_level] = params[:min_access_level] if params[:min_access_level]
-      finder_params
+      project_finder_params_ce.merge(project_finder_params_ee)
     end
 
     # file helpers
@@ -461,6 +451,27 @@ module API
       end
     end
 
+    protected
+
+    def project_finder_params_ce
+      finder_params = { without_deleted: true }
+      finder_params[:owned] = true if params[:owned].present?
+      finder_params[:non_public] = true if params[:membership].present?
+      finder_params[:starred] = true if params[:starred].present?
+      finder_params[:visibility_level] = Gitlab::VisibilityLevel.level_value(params[:visibility]) if params[:visibility]
+      finder_params[:archived] = archived_param unless params[:archived].nil?
+      finder_params[:search] = params[:search] if params[:search]
+      finder_params[:user] = params.delete(:user) if params[:user]
+      finder_params[:custom_attributes] = params[:custom_attributes] if params[:custom_attributes]
+      finder_params[:min_access_level] = params[:min_access_level] if params[:min_access_level]
+      finder_params
+    end
+
+    # Overridden in EE
+    def project_finder_params_ee
+      {}
+    end
+
     private
 
     # rubocop:disable Gitlab/ModuleWithInstanceVariables
diff --git a/lib/api/helpers/groups_helpers.rb b/lib/api/helpers/groups_helpers.rb
index 2c33d79f6c8..6af12828ca5 100644
--- a/lib/api/helpers/groups_helpers.rb
+++ b/lib/api/helpers/groups_helpers.rb
@@ -28,6 +28,13 @@ module API
         use :optional_params_ce
         use :optional_params_ee
       end
+
+      params :optional_projects_params_ee do
+      end
+
+      params :optional_projects_params do
+        use :optional_projects_params_ee
+      end
     end
   end
 end
diff --git a/spec/support/shared_contexts/finders/group_projects_finder_shared_contexts.rb b/spec/support/shared_contexts/finders/group_projects_finder_shared_contexts.rb
index 38f6011646e..e7fee7239fc 100644
--- a/spec/support/shared_contexts/finders/group_projects_finder_shared_contexts.rb
+++ b/spec/support/shared_contexts/finders/group_projects_finder_shared_contexts.rb
@@ -6,9 +6,10 @@ RSpec.shared_context 'GroupProjectsFinder context' do
   let(:group) { create(:group) }
   let(:subgroup) { create(:group, parent: group) }
   let(:current_user) { create(:user) }
+  let(:params) { {} }
   let(:options) { {} }
 
-  let(:finder) { described_class.new(group: group, current_user: current_user, options: options) }
+  let(:finder) { described_class.new(group: group, current_user: current_user, params: params, options: options) }
 
   let!(:public_project) { create(:project, :public, group: group, path: '1') }
   let!(:private_project) { create(:project, :private, group: group, path: '2') }
-- 
cgit v1.2.1


From c10a328ec575a09ce5dcfd7012591dbdfdaf7cda Mon Sep 17 00:00:00 2001
From: Yorick Peterse <yorick@yorickpeterse.com>
Date: Wed, 28 Aug 2019 16:32:40 +0200
Subject: Don't use ee/.gitlab/ for CI config files

These files are not available in CE, resulting in CI pipeline failures
when trying to include these files. Since the job is already configured
to only run on EE, we can just include it in both CE and EE.
---
 .gitlab-ci.yml                              |  1 +
 .gitlab/ci/ee-specific-checks.gitlab-ci.yml | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 .gitlab/ci/ee-specific-checks.gitlab-ci.yml

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 27992024265..5b5527284d3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -41,3 +41,4 @@ include:
   - local: .gitlab/ci/setup.gitlab-ci.yml
   - local: .gitlab/ci/test-metadata.gitlab-ci.yml
   - local: .gitlab/ci/yaml.gitlab-ci.yml
+  - local: .gitlab/ci/ee-specific-checks.gitlab-ci.yml
diff --git a/.gitlab/ci/ee-specific-checks.gitlab-ci.yml b/.gitlab/ci/ee-specific-checks.gitlab-ci.yml
new file mode 100644
index 00000000000..babb89b4606
--- /dev/null
+++ b/.gitlab/ci/ee-specific-checks.gitlab-ci.yml
@@ -0,0 +1,22 @@
+.ee-specific-check:
+  extends: .default-tags
+  dependencies: []
+  only:
+    - branches@gitlab-org/gitlab-ee
+  except:
+    - master
+    - tags
+    - /[\d-]+-stable(-ee)?/
+    - /[\d-]+-auto-deploy-\d{7}/
+    - /^security-/
+    - /\bce\-to\-ee\b/
+
+ee-files-location-check:
+  extends: .ee-specific-check
+  script:
+    - scripts/ee-files-location-check
+
+ee-specific-lines-check:
+  extends: .ee-specific-check
+  script:
+    - scripts/ee-specific-lines-check
-- 
cgit v1.2.1


From 5445f71e608b7dd5dac068006a578b32fabdf6ac Mon Sep 17 00:00:00 2001
From: Yorick Peterse <yorick@yorickpeterse.com>
Date: Wed, 28 Aug 2019 17:20:06 +0200
Subject: Fix InjectEnterpriseEditionModule cop for qa/

This ensures the InjectEnterpriseEditionModule cop is able to detect the
prepend patterns used in the qa/ directory. Previously it would not
detect them as all EE QA modules reside in QA::EE, and not the top-level
EE namespace.
---
 rubocop/cop/inject_enterprise_edition_module.rb       |  2 +-
 .../cop/inject_enterprise_edition_module_spec.rb      | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/rubocop/cop/inject_enterprise_edition_module.rb b/rubocop/cop/inject_enterprise_edition_module.rb
index e0e1b2d6c7d..6f007e667f2 100644
--- a/rubocop/cop/inject_enterprise_edition_module.rb
+++ b/rubocop/cop/inject_enterprise_edition_module.rb
@@ -24,7 +24,7 @@ module RuboCop
 
         # We use `match?` here instead of RuboCop's AST matching, as this makes
         # it far easier to handle nested constants such as `EE::Foo::Bar::Baz`.
-        line.match?(/(\s|\()('|")?(::)?EE::/)
+        line.match?(/(\s|\()('|")?(::)?(QA::)?EE::/)
       end
 
       def on_send(node)
diff --git a/spec/rubocop/cop/inject_enterprise_edition_module_spec.rb b/spec/rubocop/cop/inject_enterprise_edition_module_spec.rb
index 27df42c0aee..ce20d494542 100644
--- a/spec/rubocop/cop/inject_enterprise_edition_module_spec.rb
+++ b/spec/rubocop/cop/inject_enterprise_edition_module_spec.rb
@@ -19,6 +19,15 @@ describe RuboCop::Cop::InjectEnterpriseEditionModule do
     SOURCE
   end
 
+  it 'flags the use of `prepend_if_ee QA::EE` in the middle of a file' do
+    expect_offense(<<~SOURCE)
+    class Foo
+      prepend_if_ee 'QA::EE::Foo'
+      ^^^^^^^^^^^^^^^^^^^^^^^^^^^ Injecting EE modules must be done on the last line of this file, outside of any class or module definitions
+    end
+    SOURCE
+  end
+
   it 'does not flag the use of `prepend_if_ee EEFoo` in the middle of a file' do
     expect_no_offenses(<<~SOURCE)
     class Foo
@@ -176,6 +185,16 @@ describe RuboCop::Cop::InjectEnterpriseEditionModule do
     SOURCE
   end
 
+  it 'disallows the use of prepend to inject a QA::EE module' do
+    expect_offense(<<~SOURCE)
+    class Foo
+    end
+
+    Foo.prepend(QA::EE::Foo)
+    ^^^^^^^^^^^^^^^^^^^^^^^^ EE modules must be injected using `include_if_ee`, `extend_if_ee`, or `prepend_if_ee`
+    SOURCE
+  end
+
   it 'disallows the use of extend to inject an EE module' do
     expect_offense(<<~SOURCE)
     class Foo
-- 
cgit v1.2.1


From 23c1cfcc110b52c1060f35a4a4a7816fb38adc6c Mon Sep 17 00:00:00 2001
From: Sean McGivern <sean@gitlab.com>
Date: Tue, 6 Aug 2019 16:04:43 +0100
Subject: Return warnings for performance bar from backend

For each DetailedView subclass, we add a `warnings` array to:

1. The top-level response.
2. Each individual call under the `details` key.

We use the `.thresholds` hash on the DetailedView to determine what's a
warning. If that hash is empty (the default), then the warnings array
will always be empty.
---
 lib/peek/views/active_record.rb            | 18 +++++++
 lib/peek/views/detailed_view.rb            | 45 +++++++++++++----
 lib/peek/views/gitaly.rb                   | 18 +++++++
 lib/peek/views/rugged.rb                   |  2 +-
 spec/lib/peek/views/detailed_view_spec.rb  | 81 ++++++++++++++++++++++++++++++
 spec/lib/peek/views/redis_detailed_spec.rb |  8 +--
 6 files changed, 156 insertions(+), 16 deletions(-)
 create mode 100644 spec/lib/peek/views/detailed_view_spec.rb

diff --git a/lib/peek/views/active_record.rb b/lib/peek/views/active_record.rb
index 2d78818630d..a35783c1971 100644
--- a/lib/peek/views/active_record.rb
+++ b/lib/peek/views/active_record.rb
@@ -3,6 +3,24 @@
 module Peek
   module Views
     class ActiveRecord < DetailedView
+      DEFAULT_THRESHOLDS = {
+        calls: 100,
+        duration: 3,
+        individual_call: 1
+      }.freeze
+
+      THRESHOLDS = {
+        production: {
+          calls: 100,
+          duration: 15,
+          individual_call: 5
+        }
+      }.freeze
+
+      def self.thresholds
+        @thresholds ||= THRESHOLDS.fetch(Rails.env.to_sym, DEFAULT_THRESHOLDS)
+      end
+
       private
 
       def setup_subscribers
diff --git a/lib/peek/views/detailed_view.rb b/lib/peek/views/detailed_view.rb
index f4ca1cb5075..4f3eddaf11b 100644
--- a/lib/peek/views/detailed_view.rb
+++ b/lib/peek/views/detailed_view.rb
@@ -3,11 +3,16 @@
 module Peek
   module Views
     class DetailedView < View
+      def self.thresholds
+        {}
+      end
+
       def results
         {
-          duration: formatted_duration,
+          duration: format_duration(duration),
           calls: calls,
-          details: details
+          details: details,
+          warnings: warnings
         }
       end
 
@@ -18,30 +23,48 @@ module Peek
       private
 
       def duration
-        detail_store.map { |entry| entry[:duration] }.sum # rubocop:disable CodeReuse/ActiveRecord
+        detail_store.map { |entry| entry[:duration] }.sum * 1000 # rubocop:disable CodeReuse/ActiveRecord
       end
 
       def calls
         detail_store.count
       end
 
+      def details
+        call_details
+          .sort { |a, b| b[:duration] <=> a[:duration] }
+          .map(&method(:format_call_details))
+      end
+
+      def warnings
+        [
+          warning_for(calls, self.class.thresholds[:calls], label: "#{key} calls"),
+          warning_for(duration, self.class.thresholds[:duration], label: "#{key} duration")
+        ].flatten.compact
+      end
+
       def call_details
         detail_store
       end
 
       def format_call_details(call)
-        call.merge(duration: (call[:duration] * 1000).round(3))
-      end
+        duration = (call[:duration] * 1000).round(3)
 
-      def details
-        call_details
-          .sort { |a, b| b[:duration] <=> a[:duration] }
-          .map(&method(:format_call_details))
+        call.merge(duration: duration,
+                   warnings: warning_for(duration, self.class.thresholds[:individual_call]))
       end
 
-      def formatted_duration
-        ms = duration * 1000
+      def warning_for(actual, threshold, label: nil)
+        if threshold && actual > threshold
+          prefix = "#{label}: " if label
+
+          ["#{prefix}#{actual} over #{threshold}"]
+        else
+          []
+        end
+      end
 
+      def format_duration(ms)
         if ms >= 1000
           "%.2fms" % ms
         else
diff --git a/lib/peek/views/gitaly.rb b/lib/peek/views/gitaly.rb
index 6ad6ddfd89d..f669feae254 100644
--- a/lib/peek/views/gitaly.rb
+++ b/lib/peek/views/gitaly.rb
@@ -3,6 +3,24 @@
 module Peek
   module Views
     class Gitaly < DetailedView
+      DEFAULT_THRESHOLDS = {
+        calls: 30,
+        duration: 1,
+        individual_call: 0.5
+      }.freeze
+
+      THRESHOLDS = {
+        production: {
+          calls: 30,
+          duration: 1,
+          individual_call: 0.5
+        }
+      }.freeze
+
+      def self.thresholds
+        @thresholds ||= THRESHOLDS.fetch(Rails.env.to_sym, DEFAULT_THRESHOLDS)
+      end
+
       private
 
       def duration
diff --git a/lib/peek/views/rugged.rb b/lib/peek/views/rugged.rb
index 18b3f422852..3ed54a010f8 100644
--- a/lib/peek/views/rugged.rb
+++ b/lib/peek/views/rugged.rb
@@ -12,7 +12,7 @@ module Peek
       private
 
       def duration
-        ::Gitlab::RuggedInstrumentation.query_time
+        ::Gitlab::RuggedInstrumentation.query_time_ms
       end
 
       def calls
diff --git a/spec/lib/peek/views/detailed_view_spec.rb b/spec/lib/peek/views/detailed_view_spec.rb
new file mode 100644
index 00000000000..d8660a55ea9
--- /dev/null
+++ b/spec/lib/peek/views/detailed_view_spec.rb
@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require 'fast_spec_helper'
+
+describe Peek::Views::DetailedView, :request_store do
+  context 'when a class defines thresholds' do
+    let(:threshold_view) do
+      Class.new(described_class) do
+        def self.thresholds
+          {
+            calls: 1,
+            duration: 10,
+            individual_call: 5
+          }
+        end
+
+        def key
+          'threshold-view'
+        end
+      end.new
+    end
+
+    context 'when the results exceed the calls threshold' do
+      before do
+        allow(threshold_view)
+          .to receive(:detail_store).and_return([{ duration: 0.001 }, { duration: 0.001 }])
+      end
+
+      it 'adds a warning to the results key' do
+        expect(threshold_view.results).to include(warnings: [a_string_matching('threshold-view calls')])
+      end
+    end
+
+    context 'when the results exceed the duration threshold' do
+      before do
+        allow(threshold_view)
+          .to receive(:detail_store).and_return([{ duration: 0.011 }])
+      end
+
+      it 'adds a warning to the results key' do
+        expect(threshold_view.results).to include(warnings: [a_string_matching('threshold-view duration')])
+      end
+    end
+
+    context 'when a single call exceeds the duration threshold' do
+      before do
+        allow(threshold_view)
+          .to receive(:detail_store).and_return([{ duration: 0.001 }, { duration: 0.006 }])
+      end
+
+      it 'adds a warning to that call detail entry' do
+        expect(threshold_view.results)
+          .to include(details: a_collection_containing_exactly(
+            { duration: 1.0, warnings: [] },
+                       { duration: 6.0, warnings: ['6.0 over 5'] }
+          ))
+      end
+    end
+  end
+
+  context 'when a view does not define thresholds' do
+    let(:no_threshold_view) { Class.new(described_class).new }
+
+    before do
+      allow(no_threshold_view)
+        .to receive(:detail_store).and_return([{ duration: 100 }, { duration: 100 }])
+    end
+
+    it 'does not add warnings to the top level' do
+      expect(no_threshold_view.results).to include(warnings: [])
+    end
+
+    it 'does not add warnings to call details entries' do
+      expect(no_threshold_view.results)
+        .to include(details: a_collection_containing_exactly(
+          { duration: 100000, warnings: [] },
+                     { duration: 100000, warnings: [] }
+        ))
+    end
+  end
+end
diff --git a/spec/lib/peek/views/redis_detailed_spec.rb b/spec/lib/peek/views/redis_detailed_spec.rb
index 61096e6c69e..fa9532226f2 100644
--- a/spec/lib/peek/views/redis_detailed_spec.rb
+++ b/spec/lib/peek/views/redis_detailed_spec.rb
@@ -21,10 +21,10 @@ describe Peek::Views::RedisDetailed, :request_store do
 
       expect(subject.results[:details].count).to eq(1)
       expect(subject.results[:details].first)
-        .to eq({
-                 cmd: expected,
-                 duration: 1000
-               })
+        .to include({
+                      cmd: expected,
+                      duration: 1000
+                    })
     end
   end
 
-- 
cgit v1.2.1


From 9bfb012a56918e3412ce767c19f5f9ca2329a78c Mon Sep 17 00:00:00 2001
From: Sean McGivern <sean@gitlab.com>
Date: Fri, 23 Aug 2019 13:05:38 +0100
Subject: Add top-level warnings key to performance bar response

This key is useful to reduce the amount of logic needed on the frontend:
if `has_warnings` is true, then the frontend knows that the request in
question has warnings for some metric.
---
 config/initializers/peek.rb                        |  1 +
 .../performance_bar/with_top_level_warnings.rb     | 19 ++++++++++++++
 .../with_top_level_warnings_spec.rb                | 29 ++++++++++++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100644 lib/gitlab/performance_bar/with_top_level_warnings.rb
 create mode 100644 spec/lib/gitlab/performance_bar/with_top_level_warnings_spec.rb

diff --git a/config/initializers/peek.rb b/config/initializers/peek.rb
index f9055285e5c..a3810be70b2 100644
--- a/config/initializers/peek.rb
+++ b/config/initializers/peek.rb
@@ -1,6 +1,7 @@
 require 'peek/adapters/redis'
 
 Peek::Adapters::Redis.prepend ::Gitlab::PerformanceBar::RedisAdapterWhenPeekEnabled
+Peek.singleton_class.prepend ::Gitlab::PerformanceBar::WithTopLevelWarnings
 
 Rails.application.config.peek.adapter = :redis, { client: ::Redis.new(Gitlab::Redis::Cache.params) }
 
diff --git a/lib/gitlab/performance_bar/with_top_level_warnings.rb b/lib/gitlab/performance_bar/with_top_level_warnings.rb
new file mode 100644
index 00000000000..fb5c5c5959d
--- /dev/null
+++ b/lib/gitlab/performance_bar/with_top_level_warnings.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module PerformanceBar
+    module WithTopLevelWarnings
+      def results
+        results = super
+
+        results.merge(has_warnings: has_warnings?(results))
+      end
+
+      def has_warnings?(results)
+        results[:data].any? do |_, value|
+          value[:warnings].present?
+        end
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/performance_bar/with_top_level_warnings_spec.rb b/spec/lib/gitlab/performance_bar/with_top_level_warnings_spec.rb
new file mode 100644
index 00000000000..3b92261f0fe
--- /dev/null
+++ b/spec/lib/gitlab/performance_bar/with_top_level_warnings_spec.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'fast_spec_helper'
+require 'rspec-parameterized'
+
+describe Gitlab::PerformanceBar::WithTopLevelWarnings do
+  using RSpec::Parameterized::TableSyntax
+
+  subject { Module.new }
+
+  before do
+    subject.singleton_class.prepend(described_class)
+  end
+
+  describe '#has_warnings?' do
+    where(:has_warnings, :results) do
+      false | { data: {} }
+      false | { data: { gitaly: { warnings: [] } } }
+      true  | { data: { gitaly: { warnings: [1] } } }
+      true  | { data: { gitaly: { warnings: [] }, redis: { warnings: [1] } } }
+    end
+
+    with_them do
+      it do
+        expect(subject.has_warnings?(results)).to eq(has_warnings)
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 864bd12be4a91aadaed9674c3f454015dfda4edd Mon Sep 17 00:00:00 2001
From: Jacopo <beschi.jacopo@gmail.com>
Date: Wed, 19 Jun 2019 11:51:15 +0200
Subject: Uses projects_authorizations.access_level in MembersFinder

---
 app/finders/members_finder.rb                      | 35 ++++++++++++-----
 ...ll-project-group-members-returns-duplicates.yml |  5 +++
 spec/finders/members_finder_spec.rb                | 44 +++++++++++++++++++---
 3 files changed, 69 insertions(+), 15 deletions(-)
 create mode 100644 changelogs/unreleased/62284-follow-up-from-resolve-api-to-get-all-project-group-members-returns-duplicates.yml

diff --git a/app/finders/members_finder.rb b/app/finders/members_finder.rb
index f730b015c0a..e8c7f9622a9 100644
--- a/app/finders/members_finder.rb
+++ b/app/finders/members_finder.rb
@@ -60,15 +60,32 @@ class MembersFinder
     # We're interested in a list of members without duplicates by user_id.
     # We prefer project members over group members, project members should go first.
     <<~SQL
-        SELECT DISTINCT ON (user_id, invite_email) member_union.*
-        FROM (#{union.to_sql}) AS member_union
-        ORDER BY user_id,
-          invite_email,
-          CASE
-            WHEN type = 'ProjectMember' THEN 1
-            WHEN type = 'GroupMember' THEN 2
-            ELSE 3
-          END
+          SELECT DISTINCT ON (user_id, invite_email) #{member_columns}
+          FROM (#{union.to_sql}) AS #{member_union_table}
+          LEFT JOIN users on users.id = member_union.user_id
+          LEFT JOIN project_authorizations on project_authorizations.user_id = users.id
+               AND
+               project_authorizations.project_id = #{project.id}
+          ORDER BY user_id,
+            invite_email,
+            CASE
+              WHEN type = 'ProjectMember' THEN 1
+              WHEN type = 'GroupMember' THEN 2
+              ELSE 3
+            END
     SQL
   end
+
+  def member_union_table
+    'member_union'
+  end
+
+  def member_columns
+    Member.column_names.map do |column_name|
+      # fallback to members.access_level when project_authorizations.access_level is missing
+      next "COALESCE(#{ProjectAuthorization.table_name}.access_level, #{member_union_table}.access_level) access_level" if column_name == 'access_level'
+
+      "#{member_union_table}.#{column_name}"
+    end.join(',')
+  end
 end
diff --git a/changelogs/unreleased/62284-follow-up-from-resolve-api-to-get-all-project-group-members-returns-duplicates.yml b/changelogs/unreleased/62284-follow-up-from-resolve-api-to-get-all-project-group-members-returns-duplicates.yml
new file mode 100644
index 00000000000..0c73f73c297
--- /dev/null
+++ b/changelogs/unreleased/62284-follow-up-from-resolve-api-to-get-all-project-group-members-returns-duplicates.yml
@@ -0,0 +1,5 @@
+---
+title: Uses projects_authorizations.access_level in MembersFinder
+merge_request: 28887
+author: Jacopo Beschi @jacopo-beschi
+type: fixed
diff --git a/spec/finders/members_finder_spec.rb b/spec/finders/members_finder_spec.rb
index 4203f58fe81..6920fb4e572 100644
--- a/spec/finders/members_finder_spec.rb
+++ b/spec/finders/members_finder_spec.rb
@@ -17,11 +17,10 @@ describe MembersFinder, '#execute' do
 
     result = described_class.new(project, user2).execute
 
-    expect(result.to_a).to match_array([member1, member2, member3])
+    expect(result).to contain_exactly(member1, member2, member3)
   end
 
-  it 'includes nested group members if asked' do
-    project = create(:project, namespace: group)
+  it 'includes nested group members if asked', :nested_groups do
     nested_group.request_access(user1)
     member1 = group.add_maintainer(user2)
     member2 = nested_group.add_maintainer(user3)
@@ -29,7 +28,28 @@ describe MembersFinder, '#execute' do
 
     result = described_class.new(project, user2).execute(include_descendants: true)
 
-    expect(result.to_a).to match_array([member1, member2, member3])
+    expect(result).to contain_exactly(member1, member2, member3)
+  end
+
+  it 'returns the members.access_level when the user is invited', :nested_groups do
+    member_invite = create(:project_member, :invited, project: project, invite_email: create(:user).email)
+    member1 = group.add_maintainer(user2)
+
+    result = described_class.new(project, user2).execute(include_descendants: true)
+
+    expect(result).to contain_exactly(member1, member_invite)
+    expect(result.last.access_level).to eq(member_invite.access_level)
+  end
+
+  it 'returns the highest access_level for the user', :nested_groups do
+    member1 = project.add_guest(user1)
+    group.add_developer(user1)
+    nested_group.add_reporter(user1)
+
+    result = described_class.new(project, user1).execute(include_descendants: true)
+
+    expect(result).to contain_exactly(member1)
+    expect(result.first.access_level).to eq(Gitlab::Access::DEVELOPER)
   end
 
   context 'when include_invited_groups_members == true' do
@@ -37,8 +57,8 @@ describe MembersFinder, '#execute' do
 
     set(:linked_group) { create(:group, :public, :access_requestable) }
     set(:nested_linked_group) { create(:group, parent: linked_group) }
-    set(:linked_group_member) { linked_group.add_developer(user1) }
-    set(:nested_linked_group_member) { nested_linked_group.add_developer(user2) }
+    set(:linked_group_member) { linked_group.add_guest(user1) }
+    set(:nested_linked_group_member) { nested_linked_group.add_guest(user2) }
 
     it 'includes all the invited_groups members including members inherited from ancestor groups' do
       create(:project_group_link, project: project, group: nested_linked_group)
@@ -60,5 +80,17 @@ describe MembersFinder, '#execute' do
 
       expect(subject).to contain_exactly(linked_group_member)
     end
+
+    context 'when the user is a member of invited group and ancestor groups' do
+      it 'returns the highest access_level for the user limited by project_group_link.group_access', :nested_groups do
+        create(:project_group_link, project: project, group: nested_linked_group, group_access: Gitlab::Access::REPORTER)
+        nested_linked_group.add_developer(user1)
+
+        result = subject
+
+        expect(result).to contain_exactly(linked_group_member, nested_linked_group_member)
+        expect(result.first.access_level).to eq(Gitlab::Access::REPORTER)
+      end
+    end
   end
 end
-- 
cgit v1.2.1


From 5725b56c9e4be64fc539f3ec69f3b4b283bb50a2 Mon Sep 17 00:00:00 2001
From: Vladimir Shushlin <vshushlin@gitlab.com>
Date: Wed, 28 Aug 2019 15:53:27 +0000
Subject: Upgrade pages to 1.8.0

---
 GITLAB_PAGES_VERSION                     | 2 +-
 changelogs/unreleased/bump-pages-1-8.yml | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/bump-pages-1-8.yml

diff --git a/GITLAB_PAGES_VERSION b/GITLAB_PAGES_VERSION
index 943f9cbc4ec..27f9cd322bb 100644
--- a/GITLAB_PAGES_VERSION
+++ b/GITLAB_PAGES_VERSION
@@ -1 +1 @@
-1.7.1
+1.8.0
diff --git a/changelogs/unreleased/bump-pages-1-8.yml b/changelogs/unreleased/bump-pages-1-8.yml
new file mode 100644
index 00000000000..0201ff0fd5f
--- /dev/null
+++ b/changelogs/unreleased/bump-pages-1-8.yml
@@ -0,0 +1,5 @@
+---
+title: Upgrade pages to 1.8.0
+merge_request: 32334
+author:
+type: other
-- 
cgit v1.2.1


From edbd4cebdbfedb27be66aa080b6315c7000de555 Mon Sep 17 00:00:00 2001
From: Kyle Wiebers <kwiebers@gitlab.com>
Date: Wed, 28 Aug 2019 11:11:32 -0500
Subject: Set dast job to extend .review-only

---
 .gitlab/ci/reports.gitlab-ci.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index efe33049939..5622cd232ca 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -26,7 +26,9 @@ dependency_scanning:
   extends: .reports
 
 dast:
-  extends: .reports
+  extends:
+    - .reports
+    - .review-only
   stage: qa
   dependencies: ["review-deploy"]
   before_script:
-- 
cgit v1.2.1


From e369dee8a5b08192fe7e64d3c5b5d3461a48722e Mon Sep 17 00:00:00 2001
From: Andrew Newdigate <andrew@gitlab.com>
Date: Wed, 28 Aug 2019 16:29:17 +0000
Subject: Rename Labkit::Tracing::GRPCInterceptor to GRPC::ClientInterceptor

The original name has been deprecated
---
 lib/gitlab/gitaly_client.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/gitlab/gitaly_client.rb b/lib/gitlab/gitaly_client.rb
index 201db9fec26..d65c0d3e78d 100644
--- a/lib/gitlab/gitaly_client.rb
+++ b/lib/gitlab/gitaly_client.rb
@@ -50,7 +50,7 @@ module Gitlab
     def self.interceptors
       return [] unless Labkit::Tracing.enabled?
 
-      [Labkit::Tracing::GRPCInterceptor.instance]
+      [Labkit::Tracing::GRPC::ClientInterceptor.instance]
     end
     private_class_method :interceptors
 
-- 
cgit v1.2.1


From 85d88d67cca58945aa6d4835bf3a518f12019e3a Mon Sep 17 00:00:00 2001
From: Jacob Vosmaer <jacob@gitlab.com>
Date: Wed, 28 Aug 2019 16:51:17 +0000
Subject: Support Gitaly feature flags in workhorse

---
 GITLAB_WORKHORSE_VERSION                    |  2 +-
 lib/gitlab/workhorse.rb                     |  6 ++++--
 spec/lib/gitlab/workhorse_spec.rb           | 13 +++++++++++++
 spec/requests/api/project_snapshots_spec.rb |  7 +++++++
 4 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/GITLAB_WORKHORSE_VERSION b/GITLAB_WORKHORSE_VERSION
index 3b6825376ad..e5c15102d9b 100644
--- a/GITLAB_WORKHORSE_VERSION
+++ b/GITLAB_WORKHORSE_VERSION
@@ -1 +1 @@
-8.8.0
+8.9.0
diff --git a/lib/gitlab/workhorse.rb b/lib/gitlab/workhorse.rb
index 3b77fe838ae..29087d26007 100644
--- a/lib/gitlab/workhorse.rb
+++ b/lib/gitlab/workhorse.rb
@@ -34,7 +34,8 @@ module Gitlab
           GitConfigOptions: [],
           GitalyServer: {
             address: Gitlab::GitalyClient.address(project.repository_storage),
-            token: Gitlab::GitalyClient.token(project.repository_storage)
+            token: Gitlab::GitalyClient.token(project.repository_storage),
+            features: Feature::Gitaly.server_feature_flags
           }
         }
 
@@ -250,7 +251,8 @@ module Gitlab
       def gitaly_server_hash(repository)
         {
           address: Gitlab::GitalyClient.address(repository.project.repository_storage),
-          token: Gitlab::GitalyClient.token(repository.project.repository_storage)
+          token: Gitlab::GitalyClient.token(repository.project.repository_storage),
+          features: Feature::Gitaly.server_feature_flags
         }
       end
 
diff --git a/spec/lib/gitlab/workhorse_spec.rb b/spec/lib/gitlab/workhorse_spec.rb
index 5c5ff46112f..98421cd12d3 100644
--- a/spec/lib/gitlab/workhorse_spec.rb
+++ b/spec/lib/gitlab/workhorse_spec.rb
@@ -14,6 +14,12 @@ describe Gitlab::Workhorse do
     [key, command, params]
   end
 
+  before do
+    allow(Feature::Gitaly).to receive(:server_feature_flags).and_return({
+      'gitaly-feature-foobar' => 'true'
+    })
+  end
+
   describe ".send_git_archive" do
     let(:ref) { 'master' }
     let(:format) { 'zip' }
@@ -41,6 +47,7 @@ describe Gitlab::Workhorse do
         expected_params = metadata.merge(
           'GitalyRepository' => repository.gitaly_repository.to_h,
           'GitalyServer' => {
+            features: { 'gitaly-feature-foobar' => 'true' },
             address: Gitlab::GitalyClient.address(project.repository_storage),
             token: Gitlab::GitalyClient.token(project.repository_storage)
           }
@@ -69,6 +76,7 @@ describe Gitlab::Workhorse do
         expect(command).to eq('git-archive')
         expect(params).to eq({
           'GitalyServer' => {
+            features: { 'gitaly-feature-foobar' => 'true' },
             address: Gitlab::GitalyClient.address(project.repository_storage),
             token: Gitlab::GitalyClient.token(project.repository_storage)
           },
@@ -117,6 +125,7 @@ describe Gitlab::Workhorse do
       expect(command).to eq("git-format-patch")
       expect(params).to eq({
         'GitalyServer' => {
+          features: { 'gitaly-feature-foobar' => 'true' },
           address: Gitlab::GitalyClient.address(project.repository_storage),
           token: Gitlab::GitalyClient.token(project.repository_storage)
         },
@@ -178,6 +187,7 @@ describe Gitlab::Workhorse do
       expect(command).to eq("git-diff")
       expect(params).to eq({
         'GitalyServer' => {
+          features: { 'gitaly-feature-foobar' => 'true' },
           address: Gitlab::GitalyClient.address(project.repository_storage),
           token: Gitlab::GitalyClient.token(project.repository_storage)
         },
@@ -315,6 +325,7 @@ describe Gitlab::Workhorse do
       let(:gitaly_params) do
         {
           GitalyServer: {
+            features: { 'gitaly-feature-foobar' => 'true' },
             address: Gitlab::GitalyClient.address('default'),
             token: Gitlab::GitalyClient.token('default')
           }
@@ -463,6 +474,7 @@ describe Gitlab::Workhorse do
       expect(command).to eq('git-blob')
       expect(params).to eq({
         'GitalyServer' => {
+          features: { 'gitaly-feature-foobar' => 'true' },
           address: Gitlab::GitalyClient.address(project.repository_storage),
           token: Gitlab::GitalyClient.token(project.repository_storage)
         },
@@ -504,6 +516,7 @@ describe Gitlab::Workhorse do
       expect(command).to eq('git-snapshot')
       expect(params).to eq(
         'GitalyServer' => {
+          'features' => { 'gitaly-feature-foobar' => 'true' },
           'address' => Gitlab::GitalyClient.address(project.repository_storage),
           'token' => Gitlab::GitalyClient.token(project.repository_storage)
         },
diff --git a/spec/requests/api/project_snapshots_spec.rb b/spec/requests/api/project_snapshots_spec.rb
index 44b5ee1f130..2857715cdbe 100644
--- a/spec/requests/api/project_snapshots_spec.rb
+++ b/spec/requests/api/project_snapshots_spec.rb
@@ -6,6 +6,12 @@ describe API::ProjectSnapshots do
   let(:project) { create(:project) }
   let(:admin) { create(:admin) }
 
+  before do
+    allow(Feature::Gitaly).to receive(:server_feature_flags).and_return({
+      'gitaly-feature-foobar' => 'true'
+    })
+  end
+
   describe 'GET /projects/:id/snapshot' do
     def expect_snapshot_response_for(repository)
       type, params = workhorse_send_data
@@ -13,6 +19,7 @@ describe API::ProjectSnapshots do
       expect(type).to eq('git-snapshot')
       expect(params).to eq(
         'GitalyServer' => {
+          'features' => { 'gitaly-feature-foobar' => 'true' },
           'address' => Gitlab::GitalyClient.address(repository.project.repository_storage),
           'token' => Gitlab::GitalyClient.token(repository.project.repository_storage)
         },
-- 
cgit v1.2.1


From b57839da46db1b2805de7b2efb957f3ed4b6b5b8 Mon Sep 17 00:00:00 2001
From: Kemais Ehlers <kemais_ehlers@byu.edu>
Date: Wed, 28 Aug 2019 16:53:20 +0000
Subject: Fix top-nav search bar dropdown on xl displays

---
 app/assets/stylesheets/framework/variables.scss     |  2 +-
 app/assets/stylesheets/pages/search.scss            | 10 +++++-----
 changelogs/unreleased/fix-search-input-dropdown.yml |  5 +++++
 3 files changed, 11 insertions(+), 6 deletions(-)
 create mode 100644 changelogs/unreleased/fix-search-input-dropdown.yml

diff --git a/app/assets/stylesheets/framework/variables.scss b/app/assets/stylesheets/framework/variables.scss
index 9871771542d..7a3fd2adfbb 100644
--- a/app/assets/stylesheets/framework/variables.scss
+++ b/app/assets/stylesheets/framework/variables.scss
@@ -529,7 +529,7 @@ $award-emoji-width-xs: 90%;
  */
 $search-input-border-color: rgba($blue-400, 0.8);
 $search-input-width: 200px;
-$search-input-active-width: 320px;
+$search-input-xl-width: 320px;
 $location-icon-color: #e7e9ed;
 
 /*
diff --git a/app/assets/stylesheets/pages/search.scss b/app/assets/stylesheets/pages/search.scss
index 58e46cfb70f..74380ec995a 100644
--- a/app/assets/stylesheets/pages/search.scss
+++ b/app/assets/stylesheets/pages/search.scss
@@ -48,6 +48,10 @@ input[type='checkbox']:hover {
       background-color ease-in-out $default-transition-duration,
       width ease-in-out $default-transition-duration;
 
+    @include media-breakpoint-up(xl) {
+      width: $search-input-xl-width;
+    }
+
     &:hover {
       box-shadow: none;
     }
@@ -116,7 +120,7 @@ input[type='checkbox']:hover {
       overflow: auto;
 
       @include media-breakpoint-up(xl) {
-        width: $search-input-active-width;
+        width: $search-input-xl-width;
       }
     }
 
@@ -131,10 +135,6 @@ input[type='checkbox']:hover {
       border-color: $blue-300;
       box-shadow: none;
 
-      @include media-breakpoint-up(xl) {
-        width: $search-input-active-width;
-      }
-
       .search-input-wrap {
         .search-icon,
         .clear-icon {
diff --git a/changelogs/unreleased/fix-search-input-dropdown.yml b/changelogs/unreleased/fix-search-input-dropdown.yml
new file mode 100644
index 00000000000..a86f7eacfdb
--- /dev/null
+++ b/changelogs/unreleased/fix-search-input-dropdown.yml
@@ -0,0 +1,5 @@
+---
+title: Fix top-nav search bar dropdown on xl displays
+merge_request: 31864
+author: Kemais Ehlers
+type: fixed
-- 
cgit v1.2.1


From b752182943bf878f4bbdf43a8d194cae6da8e6af Mon Sep 17 00:00:00 2001
From: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Date: Wed, 28 Aug 2019 18:37:53 +0000
Subject: Update CHANGELOG.md for 12.2.3

[ci skip]
---
 CHANGELOG.md | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 08cccd1768b..8e343c4fd39 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,34 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 12.2.3
+
+### Security (22 changes)
+
+- Ensure only authorised users can create notes on Merge Requests and Issues.
+- Gitaly: ignore git redirects.
+- Add :login_recaptcha_protection_enabled setting to prevent bots from brute-force attacks.
+- Speed up regexp in namespace format by failing fast after reaching maximum namespace depth.
+- Limit the size of issuable description and comments.
+- Send TODOs for comments on commits correctly.
+- Restrict MergeRequests#test_reports to authenticated users with read-access on Builds.
+- Added image proxy to mitigate potential stealing of IP addresses.
+- Filter out old system notes for epics in notes api endpoint response.
+- Avoid exposing unaccessible repo data upon GFM post processing.
+- Fix HTML injection for label description.
+- Make sure HTML text is always escaped when replacing label/milestone references.
+- Prevent DNS rebind on JIRA service integration.
+- Use admin_group authorization in Groups::RunnersController.
+- Prevent disclosure of merge request ID via email.
+- Show cross-referenced MR-id in issues' activities only to authorized users.
+- Enforce max chars and max render time in markdown math.
+- Check permissions before responding in MergeController#pipeline_status.
+- Remove EXIF from users/personal snippet uploads.
+- Fix project import restricted visibility bypass via API.
+- Fix weak session management by clearing password reset tokens after login (username/email) are updated.
+- Fix SSRF via DNS rebinding in Kubernetes Integration.
+
+
 ## 12.2.2
 
 ### Security (22 changes)
-- 
cgit v1.2.1


From ade2a5a6443461b98d90e34e53dc34142594667e Mon Sep 17 00:00:00 2001
From: Nathan Friend <nathan@gitlab.com>
Date: Wed, 28 Aug 2019 16:13:07 -0300
Subject: Add id to release block

This commit adds an id attribute to release blocks to allow them to be
targeted as anchor links.
---
 app/assets/javascripts/releases/components/release_block.vue | 2 +-
 spec/javascripts/releases/components/release_block_spec.js   | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/releases/components/release_block.vue b/app/assets/javascripts/releases/components/release_block.vue
index 7580c2d0ad0..88b6b4732b1 100644
--- a/app/assets/javascripts/releases/components/release_block.vue
+++ b/app/assets/javascripts/releases/components/release_block.vue
@@ -53,7 +53,7 @@ export default {
 };
 </script>
 <template>
-  <div class="card">
+  <div :id="release.tag_name" class="card">
     <div class="card-body">
       <h2 class="card-title mt-0">
         {{ release.name }}
diff --git a/spec/javascripts/releases/components/release_block_spec.js b/spec/javascripts/releases/components/release_block_spec.js
index f761a18e326..fdf23f3f69d 100644
--- a/spec/javascripts/releases/components/release_block_spec.js
+++ b/spec/javascripts/releases/components/release_block_spec.js
@@ -88,6 +88,10 @@ describe('Release block', () => {
     vm.$destroy();
   });
 
+  it("renders the block with an id equal to the release's tag name", () => {
+    expect(vm.$el.id).toBe('18.04');
+  });
+
   it('renders release name', () => {
     expect(vm.$el.textContent).toContain(release.name);
   });
-- 
cgit v1.2.1


From 3a34a2dcd6d05644739996d190c3586ba23f5d49 Mon Sep 17 00:00:00 2001
From: Illya Klymov <xanf@xanf.me>
Date: Tue, 27 Aug 2019 17:44:01 +0300
Subject: Refactored Karma spec to Jest for file_icon

---
 .../vue_shared/components/file_icon_spec.js        | 75 ++++++++++++++++++
 .../vue_shared/components/file_icon_spec.js        | 92 ----------------------
 2 files changed, 75 insertions(+), 92 deletions(-)
 create mode 100644 spec/frontend/vue_shared/components/file_icon_spec.js
 delete mode 100644 spec/javascripts/vue_shared/components/file_icon_spec.js

diff --git a/spec/frontend/vue_shared/components/file_icon_spec.js b/spec/frontend/vue_shared/components/file_icon_spec.js
new file mode 100644
index 00000000000..328eec0a80a
--- /dev/null
+++ b/spec/frontend/vue_shared/components/file_icon_spec.js
@@ -0,0 +1,75 @@
+import { shallowMount } from '@vue/test-utils';
+import { GlLoadingIcon } from '@gitlab/ui';
+import FileIcon from '~/vue_shared/components/file_icon.vue';
+import Icon from '~/vue_shared/components/icon.vue';
+
+describe('File Icon component', () => {
+  let wrapper;
+  const findIcon = () => wrapper.find('svg');
+  const getIconName = () =>
+    findIcon()
+      .find('use')
+      .element.getAttribute('xlink:href')
+      .replace(`${gon.sprite_file_icons}#`, '');
+
+  const createComponent = (props = {}) => {
+    wrapper = shallowMount(FileIcon, {
+      sync: false,
+      propsData: { ...props },
+    });
+  };
+
+  afterEach(() => {
+    wrapper.destroy();
+  });
+
+  it('should render a span element and an icon', () => {
+    createComponent({
+      fileName: 'test.js',
+    });
+
+    expect(wrapper.element.tagName).toEqual('SPAN');
+    expect(findIcon().exists()).toBeDefined();
+  });
+
+  it.each`
+    fileName        | iconName
+    ${'test.js'}    | ${'javascript'}
+    ${'test.png'}   | ${'image'}
+    ${'webpack.js'} | ${'webpack'}
+  `('should render a $iconName icon based on file ending', ({ fileName, iconName }) => {
+    createComponent({ fileName });
+    expect(getIconName()).toBe(iconName);
+  });
+
+  it('should render a standard folder icon', () => {
+    createComponent({
+      fileName: 'js',
+      folder: true,
+    });
+
+    expect(findIcon().exists()).toBe(false);
+    expect(wrapper.find(Icon).props('cssClasses')).toContain('folder-icon');
+  });
+
+  it('should render a loading icon', () => {
+    createComponent({
+      fileName: 'test.js',
+      loading: true,
+    });
+
+    expect(wrapper.find(GlLoadingIcon).exists()).toBe(true);
+  });
+
+  it('should add a special class and a size class', () => {
+    const size = 120;
+    createComponent({
+      fileName: 'test.js',
+      cssClasses: 'extraclasses',
+      size,
+    });
+
+    expect(findIcon().classes()).toContain(`s${size}`);
+    expect(findIcon().classes()).toContain('extraclasses');
+  });
+});
diff --git a/spec/javascripts/vue_shared/components/file_icon_spec.js b/spec/javascripts/vue_shared/components/file_icon_spec.js
deleted file mode 100644
index 1f61e19fa84..00000000000
--- a/spec/javascripts/vue_shared/components/file_icon_spec.js
+++ /dev/null
@@ -1,92 +0,0 @@
-import Vue from 'vue';
-import fileIcon from '~/vue_shared/components/file_icon.vue';
-import mountComponent from 'spec/helpers/vue_mount_component_helper';
-
-describe('File Icon component', () => {
-  let vm;
-  let FileIcon;
-
-  beforeEach(() => {
-    FileIcon = Vue.extend(fileIcon);
-  });
-
-  afterEach(() => {
-    vm.$destroy();
-  });
-
-  it('should render a span element with an svg', () => {
-    vm = mountComponent(FileIcon, {
-      fileName: 'test.js',
-    });
-
-    expect(vm.$el.tagName).toEqual('SPAN');
-    expect(vm.$el.querySelector('span > svg')).toBeDefined();
-  });
-
-  it('should render a javascript icon based on file ending', () => {
-    vm = mountComponent(FileIcon, {
-      fileName: 'test.js',
-    });
-
-    expect(vm.$el.firstChild.firstChild.getAttribute('xlink:href')).toBe(
-      `${gon.sprite_file_icons}#javascript`,
-    );
-  });
-
-  it('should render a image icon based on file ending', () => {
-    vm = mountComponent(FileIcon, {
-      fileName: 'test.png',
-    });
-
-    expect(vm.$el.firstChild.firstChild.getAttribute('xlink:href')).toBe(
-      `${gon.sprite_file_icons}#image`,
-    );
-  });
-
-  it('should render a webpack icon based on file namer', () => {
-    vm = mountComponent(FileIcon, {
-      fileName: 'webpack.js',
-    });
-
-    expect(vm.$el.firstChild.firstChild.getAttribute('xlink:href')).toBe(
-      `${gon.sprite_file_icons}#webpack`,
-    );
-  });
-
-  it('should render a standard folder icon', () => {
-    vm = mountComponent(FileIcon, {
-      fileName: 'js',
-      folder: true,
-    });
-
-    expect(vm.$el.querySelector('span > svg > use').getAttribute('xlink:href')).toBe(
-      `${gon.sprite_file_icons}#folder`,
-    );
-  });
-
-  it('should render a loading icon', () => {
-    vm = mountComponent(FileIcon, {
-      fileName: 'test.js',
-      loading: true,
-    });
-
-    const { classList } = vm.$el.querySelector('.loading-container span');
-
-    expect(classList.contains('gl-spinner')).toEqual(true);
-  });
-
-  it('should add a special class and a size class', () => {
-    vm = mountComponent(FileIcon, {
-      fileName: 'test.js',
-      cssClasses: 'extraclasses',
-      size: 120,
-    });
-
-    const { classList } = vm.$el.firstChild;
-    const containsSizeClass = classList.contains('s120');
-    const containsCustomClass = classList.contains('extraclasses');
-
-    expect(containsSizeClass).toBe(true);
-    expect(containsCustomClass).toBe(true);
-  });
-});
-- 
cgit v1.2.1


From 8f6a433c416f8fb052468f4ecf1141afd5e5ef6b Mon Sep 17 00:00:00 2001
From: Felipe Artur <fcardozo@gitlab.com>
Date: Wed, 28 Aug 2019 20:18:40 +0000
Subject: Save board lists collapsed setting

Persists if a board list is collapsed for each user.
---
 app/controllers/boards/lists_controller.rb         | 24 +++---
 app/models/list.rb                                 | 54 ++++++++++++-
 app/models/list_user_preference.rb                 | 10 +++
 app/services/boards/lists/list_service.rb          |  2 +-
 app/services/boards/lists/update_service.rb        | 56 ++++++++++++++
 changelogs/unreleased/issue_40630.yml              |  5 ++
 .../20190822181528_create_list_user_preferences.rb | 16 ++++
 db/schema.rb                                       | 13 ++++
 spec/controllers/boards/lists_controller_spec.rb   | 44 +++++++++++
 spec/lib/gitlab/import_export/all_models.yml       |  1 +
 spec/models/list_spec.rb                           | 79 +++++++++++++++++++
 spec/models/list_user_preference_spec.rb           | 22 ++++++
 spec/services/boards/lists/list_service_spec.rb    |  6 +-
 spec/services/boards/lists/update_service_spec.rb  | 89 ++++++++++++++++++++++
 14 files changed, 406 insertions(+), 15 deletions(-)
 create mode 100644 app/models/list_user_preference.rb
 create mode 100644 app/services/boards/lists/update_service.rb
 create mode 100644 changelogs/unreleased/issue_40630.yml
 create mode 100644 db/migrate/20190822181528_create_list_user_preferences.rb
 create mode 100644 spec/models/list_user_preference_spec.rb
 create mode 100644 spec/services/boards/lists/update_service_spec.rb

diff --git a/app/controllers/boards/lists_controller.rb b/app/controllers/boards/lists_controller.rb
index ccd02144671..08b4748d7e1 100644
--- a/app/controllers/boards/lists_controller.rb
+++ b/app/controllers/boards/lists_controller.rb
@@ -4,7 +4,7 @@ module Boards
   class ListsController < Boards::ApplicationController
     include BoardsResponses
 
-    before_action :authorize_admin_list, only: [:create, :update, :destroy, :generate]
+    before_action :authorize_admin_list, only: [:create, :destroy, :generate]
     before_action :authorize_read_list, only: [:index]
     skip_before_action :authenticate_user!, only: [:index]
 
@@ -15,7 +15,7 @@ module Boards
     end
 
     def create
-      list = Boards::Lists::CreateService.new(board.parent, current_user, list_params).execute(board)
+      list = Boards::Lists::CreateService.new(board.parent, current_user, create_list_params).execute(board)
 
       if list.valid?
         render json: serialize_as_json(list)
@@ -26,12 +26,13 @@ module Boards
 
     def update
       list = board.lists.movable.find(params[:id])
-      service = Boards::Lists::MoveService.new(board_parent, current_user, move_params)
+      service = Boards::Lists::UpdateService.new(board_parent, current_user, update_list_params)
+      result = service.execute(list)
 
-      if service.execute(list)
+      if result[:status] == :success
         head :ok
       else
-        head :unprocessable_entity
+        head result[:http_status]
       end
     end
 
@@ -50,7 +51,8 @@ module Boards
       service = Boards::Lists::GenerateService.new(board_parent, current_user)
 
       if service.execute(board)
-        render json: serialize_as_json(board.lists.movable)
+        lists = board.lists.movable.preload_associations(current_user)
+        render json: serialize_as_json(lists)
       else
         head :unprocessable_entity
       end
@@ -62,12 +64,12 @@ module Boards
       %i[label_id]
     end
 
-    def list_params
+    def create_list_params
       params.require(:list).permit(list_creation_attrs)
     end
 
-    def move_params
-      params.require(:list).permit(:position)
+    def update_list_params
+      params.require(:list).permit(:collapsed, :position)
     end
 
     def serialize_as_json(resource)
@@ -78,7 +80,9 @@ module Boards
       {
         only: [:id, :list_type, :position],
         methods: [:title],
-        label: true
+        label: true,
+        collapsed: true,
+        current_user: current_user
       }
     end
   end
diff --git a/app/models/list.rb b/app/models/list.rb
index ccadd39bda2..ae7085f05a7 100644
--- a/app/models/list.rb
+++ b/app/models/list.rb
@@ -1,9 +1,11 @@
 # frozen_string_literal: true
 
 class List < ApplicationRecord
+  include Importable
+
   belongs_to :board
   belongs_to :label
-  include Importable
+  has_many :list_user_preferences
 
   enum list_type: { backlog: 0, label: 1, closed: 2, assignee: 3, milestone: 4 }
 
@@ -16,9 +18,24 @@ class List < ApplicationRecord
 
   scope :destroyable, -> { where(list_type: list_types.slice(*destroyable_types).values) }
   scope :movable, -> { where(list_type: list_types.slice(*movable_types).values) }
-  scope :preload_associations, -> { preload(:board, :label) }
+
+  scope :preload_associations, -> (user) do
+    preload(:board, label: :priorities)
+      .with_preferences_for(user)
+  end
+
   scope :ordered, -> { order(:list_type, :position) }
 
+  # Loads list with preferences for given user
+  # if preferences exists for user or not
+  scope :with_preferences_for, -> (user) do
+    return unless user
+
+    includes(:list_user_preferences).where(list_user_preferences: { user_id: [user.id, nil] })
+  end
+
+  alias_method :preferences, :list_user_preferences
+
   class << self
     def destroyable_types
       [:label]
@@ -29,6 +46,31 @@ class List < ApplicationRecord
     end
   end
 
+  def preferences_for(user)
+    return preferences.build unless user
+
+    if preferences.loaded?
+      preloaded_preferences_for(user)
+    else
+      preferences.find_or_initialize_by(user: user)
+    end
+  end
+
+  def preloaded_preferences_for(user)
+    user_preferences =
+      preferences.find do |preference|
+        preference.user_id == user.id
+      end
+
+    user_preferences || preferences.build(user: user)
+  end
+
+  def update_preferences_for(user, preferences = {})
+    return unless user
+
+    preferences_for(user).update(preferences)
+  end
+
   def destroyable?
     self.class.destroyable_types.include?(list_type&.to_sym)
   end
@@ -43,6 +85,14 @@ class List < ApplicationRecord
 
   def as_json(options = {})
     super(options).tap do |json|
+      json[:collapsed] = false
+
+      if options.key?(:collapsed)
+        preferences = preferences_for(options[:current_user])
+
+        json[:collapsed] = preferences.collapsed?
+      end
+
       if options.key?(:label)
         json[:label] = label.as_json(
           project: board.project,
diff --git a/app/models/list_user_preference.rb b/app/models/list_user_preference.rb
new file mode 100644
index 00000000000..fe1cc7d5425
--- /dev/null
+++ b/app/models/list_user_preference.rb
@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class ListUserPreference < ApplicationRecord
+  belongs_to :user
+  belongs_to :list
+
+  validates :user, presence: true
+  validates :list, presence: true
+  validates :user_id, uniqueness: { scope: :list_id, message: "should have only one list preference per user" }
+end
diff --git a/app/services/boards/lists/list_service.rb b/app/services/boards/lists/list_service.rb
index 5cf5f14a55b..1f20ec8df9e 100644
--- a/app/services/boards/lists/list_service.rb
+++ b/app/services/boards/lists/list_service.rb
@@ -6,7 +6,7 @@ module Boards
       def execute(board)
         board.lists.create(list_type: :backlog) unless board.lists.backlog.exists?
 
-        board.lists.preload_associations
+        board.lists.preload_associations(current_user)
       end
     end
   end
diff --git a/app/services/boards/lists/update_service.rb b/app/services/boards/lists/update_service.rb
new file mode 100644
index 00000000000..2ddeb6f0bd8
--- /dev/null
+++ b/app/services/boards/lists/update_service.rb
@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Boards
+  module Lists
+    class UpdateService < Boards::BaseService
+      def execute(list)
+        return not_authorized if preferences? && !can_read?(list)
+        return not_authorized if position? && !can_admin?(list)
+
+        if update_preferences(list) || update_position(list)
+          success(list: list)
+        else
+          error(list.errors.messages, 422)
+        end
+      end
+
+      def update_preferences(list)
+        return unless preferences?
+
+        list.update_preferences_for(current_user, preferences)
+      end
+
+      def update_position(list)
+        return unless position?
+
+        move_service = Boards::Lists::MoveService.new(parent, current_user, params)
+
+        move_service.execute(list)
+      end
+
+      def preferences
+        { collapsed: Gitlab::Utils.to_boolean(params[:collapsed]) }
+      end
+
+      def not_authorized
+        error("Not authorized", 403)
+      end
+
+      def preferences?
+        params.has_key?(:collapsed)
+      end
+
+      def position?
+        params.has_key?(:position)
+      end
+
+      def can_read?(list)
+        Ability.allowed?(current_user, :read_list, parent)
+      end
+
+      def can_admin?(list)
+        Ability.allowed?(current_user, :admin_list, parent)
+      end
+    end
+  end
+end
diff --git a/changelogs/unreleased/issue_40630.yml b/changelogs/unreleased/issue_40630.yml
new file mode 100644
index 00000000000..61cc773d5a9
--- /dev/null
+++ b/changelogs/unreleased/issue_40630.yml
@@ -0,0 +1,5 @@
+---
+title: Save collapsed option for board lists in database
+merge_request: 31069
+author:
+type: added
diff --git a/db/migrate/20190822181528_create_list_user_preferences.rb b/db/migrate/20190822181528_create_list_user_preferences.rb
new file mode 100644
index 00000000000..a7993818b50
--- /dev/null
+++ b/db/migrate/20190822181528_create_list_user_preferences.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class CreateListUserPreferences < ActiveRecord::Migration[5.2]
+  DOWNTIME = false
+
+  def change
+    create_table :list_user_preferences do |t|
+      t.references :user, index: true, null: false, foreign_key: { on_delete: :cascade }
+      t.references :list, index: true, null: false, foreign_key: { on_delete: :cascade }
+      t.timestamps_with_timezone null: false
+      t.boolean :collapsed
+    end
+
+    add_index :list_user_preferences, [:user_id, :list_id], unique: true
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 88a7ff77ab4..454ea939a6f 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1922,6 +1922,17 @@ ActiveRecord::Schema.define(version: 2019_08_28_083843) do
     t.datetime "updated_at"
   end
 
+  create_table "list_user_preferences", force: :cascade do |t|
+    t.bigint "user_id", null: false
+    t.bigint "list_id", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
+    t.boolean "collapsed"
+    t.index ["list_id"], name: "index_list_user_preferences_on_list_id"
+    t.index ["user_id", "list_id"], name: "index_list_user_preferences_on_user_id_and_list_id", unique: true
+    t.index ["user_id"], name: "index_list_user_preferences_on_user_id"
+  end
+
   create_table "lists", id: :serial, force: :cascade do |t|
     t.integer "board_id", null: false
     t.integer "label_id"
@@ -3880,6 +3891,8 @@ ActiveRecord::Schema.define(version: 2019_08_28_083843) do
   add_foreign_key "labels", "projects", name: "fk_7de4989a69", on_delete: :cascade
   add_foreign_key "lfs_file_locks", "projects", on_delete: :cascade
   add_foreign_key "lfs_file_locks", "users", on_delete: :cascade
+  add_foreign_key "list_user_preferences", "lists", on_delete: :cascade
+  add_foreign_key "list_user_preferences", "users", on_delete: :cascade
   add_foreign_key "lists", "boards", name: "fk_0d3f677137", on_delete: :cascade
   add_foreign_key "lists", "labels", name: "fk_7a5553d60f", on_delete: :cascade
   add_foreign_key "lists", "milestones", on_delete: :cascade
diff --git a/spec/controllers/boards/lists_controller_spec.rb b/spec/controllers/boards/lists_controller_spec.rb
index 418ca6f3210..1e8a8145b35 100644
--- a/spec/controllers/boards/lists_controller_spec.rb
+++ b/spec/controllers/boards/lists_controller_spec.rb
@@ -30,6 +30,21 @@ describe Boards::ListsController do
       expect(json_response.length).to eq 3
     end
 
+    it 'avoids n+1 queries when serializing lists' do
+      list_1 = create(:list, board: board)
+      list_1.update_preferences_for(user, { collapsed: true })
+
+      control_count = ActiveRecord::QueryRecorder.new { read_board_list user: user, board: board }.count
+
+      list_2 = create(:list, board: board)
+      list_2.update_preferences_for(user, { collapsed: true })
+
+      list_3 = create(:list, board: board)
+      list_3.update_preferences_for(user, { collapsed: true })
+
+      expect { read_board_list user: user, board: board }.not_to exceed_query_limit(control_count)
+    end
+
     context 'with unauthorized user' do
       let(:unauth_user) { create(:user) }
 
@@ -154,6 +169,22 @@ describe Boards::ListsController do
       end
     end
 
+    context 'with collapsed preference' do
+      it 'saves collapsed preference for user' do
+        save_setting user: user, board: board, list: planning, setting: { collapsed: true }
+
+        expect(planning.preferences_for(user).collapsed).to eq(true)
+        expect(response).to have_gitlab_http_status(200)
+      end
+
+      it 'saves not collapsed preference for user' do
+        save_setting user: user, board: board, list: planning, setting: { collapsed: false }
+
+        expect(planning.preferences_for(user).collapsed).to eq(false)
+        expect(response).to have_gitlab_http_status(200)
+      end
+    end
+
     def move(user:, board:, list:, position:)
       sign_in(user)
 
@@ -166,6 +197,19 @@ describe Boards::ListsController do
 
       patch :update, params: params, as: :json
     end
+
+    def save_setting(user:, board:, list:, setting: {})
+      sign_in(user)
+
+      params = { namespace_id: project.namespace.to_param,
+                 project_id: project,
+                 board_id: board.to_param,
+                 id: list.to_param,
+                 list: setting,
+                 format: :json }
+
+      patch :update, params: params, as: :json
+    end
   end
 
   describe 'DELETE destroy' do
diff --git a/spec/lib/gitlab/import_export/all_models.yml b/spec/lib/gitlab/import_export/all_models.yml
index 3c6b17c10ec..ec4a6ef05b9 100644
--- a/spec/lib/gitlab/import_export/all_models.yml
+++ b/spec/lib/gitlab/import_export/all_models.yml
@@ -483,3 +483,4 @@ lists:
 - milestone
 - board
 - label
+- list_user_preferences
diff --git a/spec/models/list_spec.rb b/spec/models/list_spec.rb
index 18d4549977c..2429cd408a6 100644
--- a/spec/models/list_spec.rb
+++ b/spec/models/list_spec.rb
@@ -81,4 +81,83 @@ describe List do
       expect(subject.title).to eq 'Closed'
     end
   end
+
+  describe '#update_preferences_for' do
+    let(:user) { create(:user) }
+    let(:list) { create(:list) }
+
+    context 'when user is present' do
+      context 'when there are no preferences for user' do
+        it 'creates new user preferences' do
+          expect { list.update_preferences_for(user, collapsed: true) }.to change { ListUserPreference.count }.by(1)
+          expect(list.preferences_for(user).collapsed).to eq(true)
+        end
+      end
+
+      context 'when there are preferences for user' do
+        it 'updates user preferences' do
+          list.update_preferences_for(user, collapsed: false)
+
+          expect { list.update_preferences_for(user, collapsed: true) }.not_to change { ListUserPreference.count }
+          expect(list.preferences_for(user).collapsed).to eq(true)
+        end
+      end
+
+      context 'when user is nil' do
+        it 'does not create user preferences' do
+          expect { list.update_preferences_for(nil, collapsed: true) }.not_to change { ListUserPreference.count }
+        end
+      end
+    end
+  end
+
+  describe '#preferences_for' do
+    let(:user) { create(:user) }
+    let(:list) { create(:list) }
+
+    context 'when user is nil' do
+      it 'returns not persisted preferences' do
+        preferences = list.preferences_for(nil)
+
+        expect(preferences.persisted?).to eq(false)
+        expect(preferences.list_id).to eq(list.id)
+        expect(preferences.user_id).to be_nil
+      end
+    end
+
+    context 'when a user preference already exists' do
+      before do
+        list.update_preferences_for(user, collapsed: true)
+      end
+
+      it 'loads preference for user' do
+        preferences = list.preferences_for(user)
+
+        expect(preferences).to be_persisted
+        expect(preferences.collapsed).to eq(true)
+      end
+
+      context 'when preferences are already loaded for user' do
+        it 'gets preloaded user preferences' do
+          fetched_list = described_class.where(id: list.id).with_preferences_for(user).first
+
+          expect(fetched_list).to receive(:preloaded_preferences_for).with(user).and_call_original
+
+          preferences = fetched_list.preferences_for(user)
+
+          expect(preferences.collapsed).to eq(true)
+        end
+      end
+    end
+
+    context 'when preferences for user does not exist' do
+      it 'returns not persisted preferences' do
+        preferences = list.preferences_for(user)
+
+        expect(preferences.persisted?).to eq(false)
+        expect(preferences.user_id).to eq(user.id)
+        expect(preferences.list_id).to eq(list.id)
+      end
+    end
+  end
 end
diff --git a/spec/models/list_user_preference_spec.rb b/spec/models/list_user_preference_spec.rb
new file mode 100644
index 00000000000..1335a3700dc
--- /dev/null
+++ b/spec/models/list_user_preference_spec.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe ListUserPreference do
+  set(:user) { create(:user) }
+  set(:list) { create(:list) }
+
+  before do
+    list.update_preferences_for(user, { collapsed: true })
+  end
+
+  describe 'relationships' do
+    it { is_expected.to belong_to(:list) }
+    it { is_expected.to belong_to(:user) }
+
+    it do
+      is_expected.to validate_uniqueness_of(:user_id).scoped_to(:list_id)
+                       .with_message("should have only one list preference per user")
+    end
+  end
+end
diff --git a/spec/services/boards/lists/list_service_spec.rb b/spec/services/boards/lists/list_service_spec.rb
index 2ebfd295fa2..2535f339495 100644
--- a/spec/services/boards/lists/list_service_spec.rb
+++ b/spec/services/boards/lists/list_service_spec.rb
@@ -3,13 +3,15 @@
 require 'spec_helper'
 
 describe Boards::Lists::ListService do
+  let(:user) { create(:user) }
+
   describe '#execute' do
     context 'when board parent is a project' do
       let(:project) { create(:project) }
       let(:board) { create(:board, project: project) }
       let(:label) { create(:label, project: project) }
       let!(:list) { create(:list, board: board, label: label) }
-      let(:service) { described_class.new(project, double) }
+      let(:service) { described_class.new(project, user) }
 
       it_behaves_like 'lists list service'
     end
@@ -19,7 +21,7 @@ describe Boards::Lists::ListService do
       let(:board) { create(:board, group: group) }
       let(:label) { create(:group_label, group: group) }
       let!(:list) { create(:list, board: board, label: label) }
-      let(:service) { described_class.new(group, double) }
+      let(:service) { described_class.new(group, user) }
 
       it_behaves_like 'lists list service'
     end
diff --git a/spec/services/boards/lists/update_service_spec.rb b/spec/services/boards/lists/update_service_spec.rb
new file mode 100644
index 00000000000..f28bbab941a
--- /dev/null
+++ b/spec/services/boards/lists/update_service_spec.rb
@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Boards::Lists::UpdateService do
+  let(:user) { create(:user) }
+  let!(:list) { create(:list, board: board, position: 0) }
+
+  shared_examples 'moving list' do
+    context 'when user can admin list' do
+      it 'calls Lists::MoveService to update list position' do
+        board.parent.add_developer(user)
+        service = described_class.new(board.parent, user, position: 1)
+
+        expect(Boards::Lists::MoveService).to receive(:new).with(board.parent, user, { position: 1 }).and_call_original
+        expect_any_instance_of(Boards::Lists::MoveService).to receive(:execute).with(list)
+
+        service.execute(list)
+      end
+    end
+
+    context 'when user cannot admin list' do
+      it 'does not call Lists::MoveService to update list position' do
+        service = described_class.new(board.parent, user, position: 1)
+
+        expect(Boards::Lists::MoveService).not_to receive(:new)
+
+        service.execute(list)
+      end
+    end
+  end
+
+  shared_examples 'updating list preferences' do
+    context 'when user can read list' do
+      it 'updates list preference for user' do
+        board.parent.add_guest(user)
+        service = described_class.new(board.parent, user, collapsed: true)
+
+        service.execute(list)
+
+        expect(list.preferences_for(user).collapsed).to eq(true)
+      end
+    end
+
+    context 'when user cannot read list' do
+      it 'does not update list preference for user' do
+        service = described_class.new(board.parent, user, collapsed: true)
+
+        service.execute(list)
+
+        expect(list.preferences_for(user).collapsed).to be_nil
+      end
+    end
+  end
+
+  describe '#execute' do
+    context 'when position parameter is present' do
+      context 'for projects' do
+        it_behaves_like 'moving list' do
+          let(:project) { create(:project, :private) }
+          let(:board) { create(:board, project: project) }
+        end
+      end
+
+      context 'for groups' do
+        it_behaves_like 'moving list' do
+          let(:group) { create(:group, :private) }
+          let(:board) { create(:board, group: group) }
+        end
+      end
+    end
+
+    context 'when collapsed parameter is present' do
+      context 'for projects' do
+        it_behaves_like 'updating list preferences' do
+          let(:project) { create(:project, :private) }
+          let(:board) { create(:board, project: project) }
+        end
+      end
+
+      context 'for groups' do
+        it_behaves_like 'updating list preferences' do
+          let(:group) { create(:group, :private) }
+          let(:board) { create(:board, group: group) }
+        end
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 8db6c4c6e770be30e3c49b842c501d66e427c4d9 Mon Sep 17 00:00:00 2001
From: Igor <idrozdov@gitlab.com>
Date: Wed, 28 Aug 2019 21:09:22 +0000
Subject: Reduce the number of SQL requests on MR-show

- Extract MR fields for notes into a separate serializer
- Check if pipelines are empty via count
---
 .../projects/merge_requests_controller.rb          |  1 +
 app/serializers/merge_request_noteable_entity.rb   | 53 ++++++++++++++++++++++
 .../merge_request_poll_widget_entity.rb            | 10 ----
 app/serializers/merge_request_serializer.rb        |  2 +
 app/serializers/merge_request_widget_entity.rb     | 12 -----
 app/views/projects/merge_requests/show.html.haml   | 13 +++---
 .../id-optimize-sql-requests-mr-show.yml           |  5 ++
 .../schemas/entities/merge_request_noteable.json   | 28 ++++++++++++
 .../entities/merge_request_poll_widget.json        |  8 ++--
 .../api/schemas/entities/merge_request_widget.json |  3 --
 spec/serializers/merge_request_serializer_spec.rb  |  8 ++++
 11 files changed, 107 insertions(+), 36 deletions(-)
 create mode 100644 app/serializers/merge_request_noteable_entity.rb
 create mode 100644 changelogs/unreleased/id-optimize-sql-requests-mr-show.yml
 create mode 100644 spec/fixtures/api/schemas/entities/merge_request_noteable.json

diff --git a/app/controllers/projects/merge_requests_controller.rb b/app/controllers/projects/merge_requests_controller.rb
index f4cc0a5851b..d492c5227cf 100644
--- a/app/controllers/projects/merge_requests_controller.rb
+++ b/app/controllers/projects/merge_requests_controller.rb
@@ -46,6 +46,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
         @noteable = @merge_request
         @commits_count = @merge_request.commits_count
         @issuable_sidebar = serializer.represent(@merge_request, serializer: 'sidebar')
+        @current_user_data = UserSerializer.new(project: @project).represent(current_user, {}, MergeRequestUserEntity).to_json
 
         set_pipeline_variables
 
diff --git a/app/serializers/merge_request_noteable_entity.rb b/app/serializers/merge_request_noteable_entity.rb
new file mode 100644
index 00000000000..e22be6880bb
--- /dev/null
+++ b/app/serializers/merge_request_noteable_entity.rb
@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+class MergeRequestNoteableEntity < Grape::Entity
+  include RequestAwareEntity
+
+  # Currently this attr is exposed to be used in app/assets/javascripts/notes/stores/getters.js
+  # in order to determine whether a noteable is an issue or an MR
+  expose :merge_params
+
+  expose :state
+  expose :source_branch
+  expose :target_branch
+  expose :diff_head_sha
+
+  expose :create_note_path do |merge_request|
+    project_notes_path(merge_request.project, target_type: 'merge_request', target_id: merge_request.id)
+  end
+
+  expose :preview_note_path do |merge_request|
+    preview_markdown_path(merge_request.project, target_type: 'MergeRequest', target_id: merge_request.iid)
+  end
+
+  expose :supports_suggestion?, as: :can_receive_suggestion
+
+  expose :create_issue_to_resolve_discussions_path do |merge_request|
+    presenter(merge_request).create_issue_to_resolve_discussions_path
+  end
+
+  expose :new_blob_path do |merge_request|
+    if presenter(merge_request).can_push_to_source_branch?
+      project_new_blob_path(merge_request.source_project, merge_request.source_branch)
+    end
+  end
+
+  expose :current_user do
+    expose :can_create_note do |merge_request|
+      can?(current_user, :create_note, merge_request)
+    end
+
+    expose :can_update do |merge_request|
+      can?(current_user, :update_merge_request, merge_request)
+    end
+  end
+
+  private
+
+  delegate :current_user, to: :request
+
+  def presenter(merge_request)
+    @presenters ||= {}
+    @presenters[merge_request] ||= MergeRequestPresenter.new(merge_request, current_user: current_user) # rubocop: disable CodeReuse/Presenter
+  end
+end
diff --git a/app/serializers/merge_request_poll_widget_entity.rb b/app/serializers/merge_request_poll_widget_entity.rb
index 65132b4b215..cd33ffa702a 100644
--- a/app/serializers/merge_request_poll_widget_entity.rb
+++ b/app/serializers/merge_request_poll_widget_entity.rb
@@ -65,8 +65,6 @@ class MergeRequestPollWidgetEntity < IssuableEntity
     end
   end
 
-  expose :supports_suggestion?, as: :can_receive_suggestion
-
   expose :create_issue_to_resolve_discussions_path do |merge_request|
     presenter(merge_request).create_issue_to_resolve_discussions_path
   end
@@ -84,17 +82,9 @@ class MergeRequestPollWidgetEntity < IssuableEntity
       presenter(merge_request).can_cherry_pick_on_current_merge_request?
     end
 
-    expose :can_create_note do |merge_request|
-      can?(current_user, :create_note, merge_request)
-    end
-
     expose :can_create_issue do |merge_request|
       can?(current_user, :create_issue, merge_request.project)
     end
-
-    expose :can_update do |merge_request|
-      can?(current_user, :update_merge_request, merge_request)
-    end
   end
 
   expose :can_push_to_source_branch do |merge_request|
diff --git a/app/serializers/merge_request_serializer.rb b/app/serializers/merge_request_serializer.rb
index bd2e682a122..aa67cd1f39e 100644
--- a/app/serializers/merge_request_serializer.rb
+++ b/app/serializers/merge_request_serializer.rb
@@ -13,6 +13,8 @@ class MergeRequestSerializer < BaseSerializer
         MergeRequestSidebarExtrasEntity
       when 'basic'
         MergeRequestBasicEntity
+      when 'noteable'
+        MergeRequestNoteableEntity
       else
         # fallback to widget for old poll requests without `serializer` set
         MergeRequestWidgetEntity
diff --git a/app/serializers/merge_request_widget_entity.rb b/app/serializers/merge_request_widget_entity.rb
index c8088608cb0..2f2c42a7387 100644
--- a/app/serializers/merge_request_widget_entity.rb
+++ b/app/serializers/merge_request_widget_entity.rb
@@ -3,10 +3,6 @@
 class MergeRequestWidgetEntity < Grape::Entity
   include RequestAwareEntity
 
-  # Currently this attr is exposed to be used in app/assets/javascripts/notes/stores/getters.js
-  # in order to determine whether a noteable is an issue or an MR
-  expose :merge_params
-
   expose :source_project_full_path do |merge_request|
     merge_request.source_project&.full_path
   end
@@ -35,18 +31,10 @@ class MergeRequestWidgetEntity < Grape::Entity
     cached_widget_project_json_merge_request_path(merge_request.target_project, merge_request, format: :json)
   end
 
-  expose :create_note_path do |merge_request|
-    project_notes_path(merge_request.project, target_type: 'merge_request', target_id: merge_request.id)
-  end
-
   expose :commit_change_content_path do |merge_request|
     commit_change_content_project_merge_request_path(merge_request.project, merge_request)
   end
 
-  expose :preview_note_path do |merge_request|
-    preview_markdown_path(merge_request.project, target_type: 'MergeRequest', target_id: merge_request.iid)
-  end
-
   expose :conflicts_docs_path do |merge_request|
     help_page_path('user/project/merge_requests/resolve_conflicts.md')
   end
diff --git a/app/views/projects/merge_requests/show.html.haml b/app/views/projects/merge_requests/show.html.haml
index af3bd8dcd69..ea166d622eb 100644
--- a/app/views/projects/merge_requests/show.html.haml
+++ b/app/views/projects/merge_requests/show.html.haml
@@ -6,6 +6,7 @@
 - page_description @merge_request.description
 - page_card_attributes @merge_request.card_attributes
 - suggest_changes_help_path = help_page_path('user/discussions/index.md', anchor: 'suggest-changes')
+- number_of_pipelines = @pipelines.size
 
 .merge-request{ data: { mr_action: j(params[:tab].presence || 'show'), url: merge_request_path(@merge_request, format: :json), project_path: project_path(@merge_request.project), lock_version: @merge_request.lock_version } }
   = render "projects/merge_requests/mr_title"
@@ -41,11 +42,11 @@
               = tab_link_for @merge_request, :commits do
                 = _("Commits")
                 %span.badge.badge-pill= @commits_count
-          - if @pipelines.any?
+          - if number_of_pipelines.nonzero?
             %li.pipelines-tab
               = tab_link_for @merge_request, :pipelines do
                 = _("Pipelines")
-                %span.badge.badge-pill.js-pipelines-mr-count= @pipelines.size
+                %span.badge.badge-pill.js-pipelines-mr-count= number_of_pipelines
           %li.diffs-tab.qa-diffs-tab
             = tab_link_for @merge_request, :diffs do
               = _("Changes")
@@ -63,21 +64,21 @@
             %script.js-notes-data{ type: "application/json" }= initial_notes_data(true).to_json.html_safe
             .issuable-discussion.js-vue-notes-event
               #js-vue-mr-discussions{ data: { notes_data: notes_data(@merge_request).to_json,
-                noteable_data: serialize_issuable(@merge_request),
+                noteable_data: serialize_issuable(@merge_request, serializer: 'noteable'),
                 noteable_type: 'MergeRequest',
                 target_type: 'merge_request',
                 help_page_path: suggest_changes_help_path,
-                current_user_data: UserSerializer.new(project: @project).represent(current_user, {}, MergeRequestUserEntity).to_json} }
+                current_user_data: @current_user_data} }
 
       #commits.commits.tab-pane
         -# This tab is always loaded via AJAX
       #pipelines.pipelines.tab-pane
-        - if @pipelines.any?
+        - if number_of_pipelines.nonzero?
           = render 'projects/commit/pipelines_list', disable_initialization: true, endpoint: pipelines_project_merge_request_path(@project, @merge_request)
       #js-diffs-app.diffs.tab-pane{ data: { "is-locked" => @merge_request.discussion_locked?,
         endpoint: diffs_project_merge_request_path(@project, @merge_request, 'json', request.query_parameters),
         help_page_path: suggest_changes_help_path,
-        current_user_data: UserSerializer.new(project: @project).represent(current_user, {}, MergeRequestUserEntity).to_json,
+        current_user_data: @current_user_data,
         project_path: project_path(@merge_request.project),
         changes_empty_state_illustration: image_path('illustrations/merge_request_changes_empty.svg'),
         is_fluid_layout: fluid_layout.to_s,
diff --git a/changelogs/unreleased/id-optimize-sql-requests-mr-show.yml b/changelogs/unreleased/id-optimize-sql-requests-mr-show.yml
new file mode 100644
index 00000000000..8b171a96316
--- /dev/null
+++ b/changelogs/unreleased/id-optimize-sql-requests-mr-show.yml
@@ -0,0 +1,5 @@
+---
+title: Reduce the number of SQL requests on MR-show
+merge_request: 32192
+author:
+type: performance
diff --git a/spec/fixtures/api/schemas/entities/merge_request_noteable.json b/spec/fixtures/api/schemas/entities/merge_request_noteable.json
new file mode 100644
index 00000000000..88b0fecc24c
--- /dev/null
+++ b/spec/fixtures/api/schemas/entities/merge_request_noteable.json
@@ -0,0 +1,28 @@
+{
+  "type": "object",
+  "properties" : {
+    "merge_params": { "type": ["object", "null"] },
+    "state": { "type": "string" },
+    "source_branch": { "type": "string" },
+    "target_branch": { "type": "string" },
+    "diff_head_sha": { "type": "string" },
+    "create_note_path": { "type": ["string", "null"] },
+    "preview_note_path": { "type": ["string", "null"] },
+    "create_issue_to_resolve_discussions_path": { "type": ["string", "null"] },
+    "new_blob_path": { "type": ["string", "null"] },
+    "can_receive_suggestion": { "type": "boolean" },
+    "current_user": {
+      "type": "object",
+      "required": [
+        "can_create_note",
+        "can_update"
+      ],
+      "properties": {
+        "can_create_note": { "type": "boolean" },
+        "can_update": { "type": "boolean" }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}
diff --git a/spec/fixtures/api/schemas/entities/merge_request_poll_widget.json b/spec/fixtures/api/schemas/entities/merge_request_poll_widget.json
index 2052892dfa3..1eda0e12920 100644
--- a/spec/fixtures/api/schemas/entities/merge_request_poll_widget.json
+++ b/spec/fixtures/api/schemas/entities/merge_request_poll_widget.json
@@ -24,22 +24,20 @@
     "ci_status": { "type": ["string", "null"] },
     "cancel_auto_merge_path": { "type": ["string", "null"] },
     "test_reports_path": { "type": ["string", "null"] },
-    "can_receive_suggestion": { "type": "boolean" },
     "create_issue_to_resolve_discussions_path": { "type": ["string", "null"] },
     "current_user": {
       "type": "object",
       "required": [
         "can_remove_source_branch",
         "can_revert_on_current_merge_request",
-        "can_cherry_pick_on_current_merge_request"
+        "can_cherry_pick_on_current_merge_request",
+        "can_create_issue"
       ],
       "properties": {
         "can_remove_source_branch": { "type": "boolean" },
         "can_revert_on_current_merge_request": { "type": ["boolean", "null"] },
         "can_cherry_pick_on_current_merge_request": { "type": ["boolean", "null"] },
-        "can_create_note": { "type": "boolean" },
-        "can_create_issue": { "type": "boolean" },
-        "can_update": { "type": "boolean" }
+        "can_create_issue": { "type": "boolean" }
       },
       "additionalProperties": false
     },
diff --git a/spec/fixtures/api/schemas/entities/merge_request_widget.json b/spec/fixtures/api/schemas/entities/merge_request_widget.json
index 779a47222b7..e2df7952d8f 100644
--- a/spec/fixtures/api/schemas/entities/merge_request_widget.json
+++ b/spec/fixtures/api/schemas/entities/merge_request_widget.json
@@ -5,7 +5,6 @@
     { "$ref": "merge_request_poll_widget.json" },
     {
       "properties" : {
-        "merge_params": { "type": ["object", "null"] },
         "source_project_full_path": { "type": ["string", "null"]},
         "target_project_full_path": { "type": ["string", "null"]},
         "email_patches_path": { "type": "string" },
@@ -13,9 +12,7 @@
         "merge_request_basic_path": { "type": "string" },
         "merge_request_widget_path": { "type": "string" },
         "merge_request_cached_widget_path": { "type": "string" },
-        "create_note_path": { "type": ["string", "null"] },
         "commit_change_content_path": { "type": "string" },
-        "preview_note_path": { "type": ["string", "null"] },
         "conflicts_docs_path": { "type": ["string", "null"] },
         "merge_request_pipelines_docs_path": { "type": ["string", "null"] },
         "ci_environments_status_path": { "type": "string" },
diff --git a/spec/serializers/merge_request_serializer_spec.rb b/spec/serializers/merge_request_serializer_spec.rb
index 276e0f6ff3d..d1483c3c41e 100644
--- a/spec/serializers/merge_request_serializer_spec.rb
+++ b/spec/serializers/merge_request_serializer_spec.rb
@@ -41,6 +41,14 @@ describe MergeRequestSerializer do
     end
   end
 
+  context 'noteable merge request serialization' do
+    let(:serializer) { 'noteable' }
+
+    it 'matches noteable merge request json schema' do
+      expect(json_entity).to match_schema('entities/merge_request_noteable', strict: true)
+    end
+  end
+
   context 'no serializer' do
     let(:serializer) { nil }
 
-- 
cgit v1.2.1


From 057df5a3f4f828fab9c0c2de08b0e53e424b99f7 Mon Sep 17 00:00:00 2001
From: Sean McGivern <sean@gitlab.com>
Date: Tue, 27 Aug 2019 12:00:34 +0100
Subject: Do not persist translated system notes

---
 app/services/system_note_service.rb                            | 10 ++++++----
 .../63262-notes-are-persisted-with-the-user-s-locale.yml       |  5 +++++
 spec/services/system_note_service_spec.rb                      |  7 +++++++
 3 files changed, 18 insertions(+), 4 deletions(-)
 create mode 100644 changelogs/unreleased/63262-notes-are-persisted-with-the-user-s-locale.yml

diff --git a/app/services/system_note_service.rb b/app/services/system_note_service.rb
index ee7223d6349..1b48b20e28b 100644
--- a/app/services/system_note_service.rb
+++ b/app/services/system_note_service.rb
@@ -67,7 +67,7 @@ module SystemNoteService
     create_note(NoteSummary.new(noteable, project, author, body, action: 'assignee'))
   end
 
-  # Called when the assignees of an Issue is changed or removed
+  # Called when the assignees of an issuable is changed or removed
   #
   # issuable - Issuable object (responds to assignees)
   # project  - Project owning noteable
@@ -88,10 +88,12 @@ module SystemNoteService
   def change_issuable_assignees(issuable, project, author, old_assignees)
     unassigned_users = old_assignees - issuable.assignees
     added_users = issuable.assignees.to_a - old_assignees
-
     text_parts = []
-    text_parts << "assigned to #{added_users.map(&:to_reference).to_sentence}" if added_users.any?
-    text_parts << "unassigned #{unassigned_users.map(&:to_reference).to_sentence}" if unassigned_users.any?
+
+    Gitlab::I18n.with_default_locale do
+      text_parts << "assigned to #{added_users.map(&:to_reference).to_sentence}" if added_users.any?
+      text_parts << "unassigned #{unassigned_users.map(&:to_reference).to_sentence}" if unassigned_users.any?
+    end
 
     body = text_parts.join(' and ')
 
diff --git a/changelogs/unreleased/63262-notes-are-persisted-with-the-user-s-locale.yml b/changelogs/unreleased/63262-notes-are-persisted-with-the-user-s-locale.yml
new file mode 100644
index 00000000000..e55beb9db09
--- /dev/null
+++ b/changelogs/unreleased/63262-notes-are-persisted-with-the-user-s-locale.yml
@@ -0,0 +1,5 @@
+---
+title: Do not translate system notes into author's language
+merge_request: 32264
+author:
+type: fixed
diff --git a/spec/services/system_note_service_spec.rb b/spec/services/system_note_service_spec.rb
index f46f9633c1c..910fe3b50b7 100644
--- a/spec/services/system_note_service_spec.rb
+++ b/spec/services/system_note_service_spec.rb
@@ -212,6 +212,13 @@ describe SystemNoteService do
       expect(build_note([assignee, assignee1, assignee2], [assignee, assignee1])).to eq \
         "unassigned @#{assignee2.username}"
     end
+
+    it 'builds a correct phrase when the locale is different' do
+      Gitlab::I18n.with_locale('pt-BR') do
+        expect(build_note([assignee, assignee1, assignee2], [assignee3])).to eq \
+          "assigned to @#{assignee3.username} and unassigned @#{assignee.username}, @#{assignee1.username}, and @#{assignee2.username}"
+      end
+    end
   end
 
   describe '.change_milestone' do
-- 
cgit v1.2.1


From 50342028aa9eecaa0b9bbf7e4161b2a5eb90dcfa Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 28 Aug 2019 14:12:37 -0700
Subject: Simplify internal post receive messages

Instead of sending varied data to Gitaly, and making Gitaly construct
various messages, build the messages first and have Gitaly print
either basic messages or alert messages, in the order they come.

Depends on https://gitlab.com/gitlab-org/gitaly/merge_requests/1410
---
 lib/api/entities.rb                                |  12 ++
 lib/api/helpers/internal_helpers.rb                |   8 +-
 lib/api/internal.rb                                |  23 ++--
 lib/gitlab/internal_post_receive/response.rb       |  51 +++++++++
 .../gitlab/internal_post_receive/response_spec.rb  | 121 +++++++++++++++++++++
 spec/requests/api/internal_spec.rb                 |  64 +++++++----
 6 files changed, 238 insertions(+), 41 deletions(-)
 create mode 100644 lib/gitlab/internal_post_receive/response.rb
 create mode 100644 spec/lib/gitlab/internal_post_receive/response_spec.rb

diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 6f86adf6a5c..88be76d3c78 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -1705,6 +1705,18 @@ module API
     class ClusterGroup < Cluster
       expose :group, using: Entities::BasicGroupDetails
     end
+
+    module InternalPostReceive
+      class Message < Grape::Entity
+        expose :message
+        expose :type
+      end
+
+      class Response < Grape::Entity
+        expose :messages, using: Message
+        expose :reference_counter_decreased
+      end
+    end
   end
 end
 
diff --git a/lib/api/helpers/internal_helpers.rb b/lib/api/helpers/internal_helpers.rb
index 9afe6c5b027..6b438235258 100644
--- a/lib/api/helpers/internal_helpers.rb
+++ b/lib/api/helpers/internal_helpers.rb
@@ -44,8 +44,6 @@ module API
       end
 
       def process_mr_push_options(push_options, project, user, changes)
-        output = {}
-
         Gitlab::QueryLimiting.whitelist('https://gitlab.com/gitlab-org/gitlab-ce/issues/61359')
 
         service = ::MergeRequests::PushOptionsHandlerService.new(
@@ -56,15 +54,13 @@ module API
         ).execute
 
         if service.errors.present?
-          output[:warnings] = push_options_warning(service.errors.join("\n\n"))
+          push_options_warning(service.errors.join("\n\n"))
         end
-
-        output
       end
 
       def push_options_warning(warning)
         options = Array.wrap(params[:push_options]).map { |p| "'#{p}'" }.join(' ')
-        "Error encountered with push options #{options}: #{warning}"
+        "WARNINGS:\nError encountered with push options #{options}: #{warning}"
       end
 
       def redis_ping
diff --git a/lib/api/internal.rb b/lib/api/internal.rb
index 224aaaaf006..088ea5bd79a 100644
--- a/lib/api/internal.rb
+++ b/lib/api/internal.rb
@@ -256,25 +256,26 @@ module API
       post '/post_receive' do
         status 200
 
-        output = {} # Messages to gitlab-shell
+        response = Gitlab::InternalPostReceive::Response.new
         user = identify(params[:identifier])
         project = Gitlab::GlRepository.parse(params[:gl_repository]).first
         push_options = Gitlab::PushOptions.new(params[:push_options])
 
+        response.reference_counter_decreased = Gitlab::ReferenceCounter.new(params[:gl_repository]).decrease
+
         PostReceive.perform_async(params[:gl_repository], params[:identifier],
           params[:changes], push_options.as_json)
 
         mr_options = push_options.get(:merge_request)
-        output.merge!(process_mr_push_options(mr_options, project, user, params[:changes])) if mr_options.present?
+        if mr_options.present?
+          message = process_mr_push_options(mr_options, project, user, params[:changes])
+          response.add_alert_message(message)
+        end
 
         broadcast_message = BroadcastMessage.current&.last&.message
-        reference_counter_decreased = Gitlab::ReferenceCounter.new(params[:gl_repository]).decrease
+        response.add_alert_message(broadcast_message)
 
-        output.merge!(
-          broadcast_message: broadcast_message,
-          reference_counter_decreased: reference_counter_decreased,
-          merge_request_urls: merge_request_urls
-        )
+        response.add_merge_request_urls(merge_request_urls)
 
         # A user is not guaranteed to be returned; an orphaned write deploy
         # key could be used
@@ -282,11 +283,11 @@ module API
           redirect_message = Gitlab::Checks::ProjectMoved.fetch_message(user.id, project.id)
           project_created_message = Gitlab::Checks::ProjectCreated.fetch_message(user.id, project.id)
 
-          output[:redirected_message] = redirect_message if redirect_message
-          output[:project_created_message] = project_created_message if project_created_message
+          response.add_basic_message(redirect_message)
+          response.add_basic_message(project_created_message)
         end
 
-        output
+        present response, with: Entities::InternalPostReceive::Response
       end
     end
   end
diff --git a/lib/gitlab/internal_post_receive/response.rb b/lib/gitlab/internal_post_receive/response.rb
new file mode 100644
index 00000000000..7e7ec2aa45c
--- /dev/null
+++ b/lib/gitlab/internal_post_receive/response.rb
@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module InternalPostReceive
+    class Response
+      attr_accessor :reference_counter_decreased
+      attr_reader :messages
+
+      Message = Struct.new(:message, :type) do
+        def self.basic(text)
+          new(text, :basic)
+        end
+
+        def self.alert(text)
+          new(text, :alert)
+        end
+      end
+
+      def initialize
+        @messages = []
+        @reference_counter_decreased = false
+      end
+
+      def add_merge_request_urls(urls_data)
+        urls_data.each do |url_data|
+          add_merge_request_url(url_data)
+        end
+      end
+
+      def add_merge_request_url(url_data)
+        message = if url_data[:new_merge_request]
+                    "To create a merge request for #{url_data[:branch_name]}, visit:"
+                  else
+                    "View merge request for #{url_data[:branch_name]}:"
+                  end
+
+        message += "\n  #{url_data[:url]}"
+
+        add_basic_message(message)
+      end
+
+      def add_basic_message(text)
+        @messages << Message.basic(text) if text.present?
+      end
+
+      def add_alert_message(text)
+        @messages.unshift(Message.alert(text)) if text.present?
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/internal_post_receive/response_spec.rb b/spec/lib/gitlab/internal_post_receive/response_spec.rb
new file mode 100644
index 00000000000..f43762c9248
--- /dev/null
+++ b/spec/lib/gitlab/internal_post_receive/response_spec.rb
@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::InternalPostReceive::Response do
+  subject { described_class.new }
+
+  describe '#add_merge_request_urls' do
+    context 'when there are urls_data' do
+      it 'adds a message for each merge request URL' do
+        urls_data = [
+          { new_merge_request: false, branch_name: 'foo', url: 'http://example.com/foo/bar/merge_requests/1' },
+          { new_merge_request: true, branch_name: 'bar', url: 'http://example.com/foo/bar/merge_requests/new?merge_request%5Bsource_branch%5D=bar' }
+        ]
+
+        subject.add_merge_request_urls(urls_data)
+
+        expected = [a_kind_of(described_class::Message), a_kind_of(described_class::Message)]
+        expect(subject.messages).to match(expected)
+      end
+    end
+  end
+
+  describe '#add_merge_request_url' do
+    context 'when :new_merge_request is false' do
+      it 'adds a basic message to view the existing merge request' do
+        url_data = { new_merge_request: false, branch_name: 'foo', url: 'http://example.com/foo/bar/merge_requests/1' }
+
+        subject.add_merge_request_url(url_data)
+
+        message = <<~MESSAGE.strip
+          View merge request for foo:
+            http://example.com/foo/bar/merge_requests/1
+        MESSAGE
+
+        expect(subject.messages.first.message).to eq(message)
+        expect(subject.messages.first.type).to eq(:basic)
+      end
+    end
+
+    context 'when :new_merge_request is true' do
+      it 'adds a basic message to create a new merge request' do
+        url_data = { new_merge_request: true, branch_name: 'bar', url: 'http://example.com/foo/bar/merge_requests/new?merge_request%5Bsource_branch%5D=bar' }
+
+        subject.add_merge_request_url(url_data)
+
+        message = <<~MESSAGE.strip
+          To create a merge request for bar, visit:
+            http://example.com/foo/bar/merge_requests/new?merge_request%5Bsource_branch%5D=bar
+        MESSAGE
+
+        expect(subject.messages.first.message).to eq(message)
+        expect(subject.messages.first.type).to eq(:basic)
+      end
+    end
+  end
+
+  describe '#add_basic_message' do
+    context 'when text is present' do
+      it 'adds a basic message' do
+        subject.add_basic_message('hello')
+
+        expect(subject.messages.first.message).to eq('hello')
+        expect(subject.messages.first.type).to eq(:basic)
+      end
+    end
+
+    context 'when text is blank' do
+      it 'does not add a message' do
+        subject.add_basic_message(' ')
+
+        expect(subject.messages).to be_blank
+      end
+    end
+  end
+
+  describe '#add_alert_message' do
+    context 'when text is present' do
+      it 'adds a alert message' do
+        subject.add_alert_message('hello')
+
+        expect(subject.messages.first.message).to eq('hello')
+        expect(subject.messages.first.type).to eq(:alert)
+      end
+    end
+
+    context 'when text is blank' do
+      it 'does not add a message' do
+        subject.add_alert_message(' ')
+
+        expect(subject.messages).to be_blank
+      end
+    end
+  end
+
+  describe '#reference_counter_decreased' do
+    context 'initially' do
+      it 'reference_counter_decreased is set to false' do
+        expect(subject.reference_counter_decreased).to eq(false)
+      end
+    end
+  end
+
+  describe '#reference_counter_decreased=' do
+    context 'when the argument is truthy' do
+      it 'reference_counter_decreased is truthy' do
+        subject.reference_counter_decreased = true
+
+        expect(subject.reference_counter_decreased).to be_truthy
+      end
+    end
+
+    context 'when the argument is falsey' do
+      it 'reference_counter_decreased is falsey' do
+        subject.reference_counter_decreased = false
+
+        expect(subject.reference_counter_decreased).to be_falsey
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/internal_spec.rb b/spec/requests/api/internal_spec.rb
index 3ab1818bebb..c94f6d22e74 100644
--- a/spec/requests/api/internal_spec.rb
+++ b/spec/requests/api/internal_spec.rb
@@ -925,19 +925,20 @@ describe API::Internal do
     it 'returns link to create new merge request' do
       post api('/internal/post_receive'), params: valid_params
 
-      expect(json_response['merge_request_urls']).to match [{
-        "branch_name" => branch_name,
-        "url" => "http://#{Gitlab.config.gitlab.host}/#{project.full_path}/merge_requests/new?merge_request%5Bsource_branch%5D=#{branch_name}",
-        "new_merge_request" => true
-      }]
+      message = <<~MESSAGE.strip
+        To create a merge request for #{branch_name}, visit:
+          http://#{Gitlab.config.gitlab.host}/#{project.full_path}/merge_requests/new?merge_request%5Bsource_branch%5D=#{branch_name}
+      MESSAGE
+
+      expect(json_response['messages']).to include(build_basic_message(message))
     end
 
-    it 'returns empty array if printing_merge_request_link_enabled is false' do
+    it 'returns no merge request messages if printing_merge_request_link_enabled is false' do
       project.update!(printing_merge_request_link_enabled: false)
 
       post api('/internal/post_receive'), params: valid_params
 
-      expect(json_response['merge_request_urls']).to eq([])
+      expect(json_response['messages']).to be_blank
     end
 
     it 'does not invoke MergeRequests::PushOptionsHandlerService' do
@@ -968,11 +969,12 @@ describe API::Internal do
       it 'links to the newly created merge request' do
         post api('/internal/post_receive'), params: valid_params
 
-        expect(json_response['merge_request_urls']).to match [{
-          'branch_name' => branch_name,
-          'url' => "http://#{Gitlab.config.gitlab.host}/#{project.full_path}/merge_requests/1",
-          'new_merge_request' => false
-        }]
+        message = <<~MESSAGE.strip
+          View merge request for #{branch_name}:
+            http://#{Gitlab.config.gitlab.host}/#{project.full_path}/merge_requests/1
+        MESSAGE
+
+        expect(json_response['messages']).to include(build_basic_message(message))
       end
 
       it 'adds errors on the service instance to warnings' do
@@ -982,7 +984,8 @@ describe API::Internal do
 
         post api('/internal/post_receive'), params: valid_params
 
-        expect(json_response['warnings']).to eq('Error encountered with push options \'merge_request.create\': my error')
+        message = "WARNINGS:\nError encountered with push options 'merge_request.create': my error"
+        expect(json_response['messages']).to include(build_alert_message(message))
       end
 
       it 'adds ActiveRecord errors on invalid MergeRequest records to warnings' do
@@ -995,38 +998,39 @@ describe API::Internal do
 
         post api('/internal/post_receive'), params: valid_params
 
-        expect(json_response['warnings']).to eq('Error encountered with push options \'merge_request.create\': my error')
+        message = "WARNINGS:\nError encountered with push options 'merge_request.create': my error"
+        expect(json_response['messages']).to include(build_alert_message(message))
       end
     end
 
     context 'broadcast message exists' do
       let!(:broadcast_message) { create(:broadcast_message, starts_at: 1.day.ago, ends_at: 1.day.from_now ) }
 
-      it 'returns one broadcast message' do
+      it 'outputs a broadcast message' do
         post api('/internal/post_receive'), params: valid_params
 
         expect(response).to have_gitlab_http_status(200)
-        expect(json_response['broadcast_message']).to eq(broadcast_message.message)
+        expect(json_response['messages']).to include(build_alert_message(broadcast_message.message))
       end
     end
 
     context 'broadcast message does not exist' do
-      it 'returns empty string' do
+      it 'does not output a broadcast message' do
         post api('/internal/post_receive'), params: valid_params
 
         expect(response).to have_gitlab_http_status(200)
-        expect(json_response['broadcast_message']).to eq(nil)
+        expect(has_alert_messages?(json_response['messages'])).to be_falsey
       end
     end
 
     context 'nil broadcast message' do
-      it 'returns empty string' do
+      it 'does not output a broadcast message' do
         allow(BroadcastMessage).to receive(:current).and_return(nil)
 
         post api('/internal/post_receive'), params: valid_params
 
         expect(response).to have_gitlab_http_status(200)
-        expect(json_response['broadcast_message']).to eq(nil)
+        expect(has_alert_messages?(json_response['messages'])).to be_falsey
       end
     end
 
@@ -1038,8 +1042,7 @@ describe API::Internal do
         post api('/internal/post_receive'), params: valid_params
 
         expect(response).to have_gitlab_http_status(200)
-        expect(json_response["redirected_message"]).to be_present
-        expect(json_response["redirected_message"]).to eq(project_moved.message)
+        expect(json_response['messages']).to include(build_basic_message(project_moved.message))
       end
     end
 
@@ -1051,8 +1054,7 @@ describe API::Internal do
         post api('/internal/post_receive'), params: valid_params
 
         expect(response).to have_gitlab_http_status(200)
-        expect(json_response["project_created_message"]).to be_present
-        expect(json_response["project_created_message"]).to eq(project_created.message)
+        expect(json_response['messages']).to include(build_basic_message(project_created.message))
       end
     end
 
@@ -1172,4 +1174,18 @@ describe API::Internal do
       }
     )
   end
+
+  def build_alert_message(message)
+    { 'type' => 'alert', 'message' => message }
+  end
+
+  def build_basic_message(message)
+    { 'type' => 'basic', 'message' => message }
+  end
+
+  def has_alert_messages?(messages)
+    messages.any? do |message|
+      message['type'] == 'alert'
+    end
+  end
 end
-- 
cgit v1.2.1


From 1dec74808cca3d78c904f645659384b525c72337 Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Tue, 20 Aug 2019 01:17:28 +1200
Subject: Add index to improve query performance

For Environment.deployed_to_cluster
---
 changelogs/unreleased/cluster_deployments.yml           |  5 +++++
 ...819131155_add_cluster_status_index_to_deployments.rb | 17 +++++++++++++++++
 db/schema.rb                                            |  1 +
 3 files changed, 23 insertions(+)
 create mode 100644 changelogs/unreleased/cluster_deployments.yml
 create mode 100644 db/migrate/20190819131155_add_cluster_status_index_to_deployments.rb

diff --git a/changelogs/unreleased/cluster_deployments.yml b/changelogs/unreleased/cluster_deployments.yml
new file mode 100644
index 00000000000..d854d16ea72
--- /dev/null
+++ b/changelogs/unreleased/cluster_deployments.yml
@@ -0,0 +1,5 @@
+---
+title: Add index to improve group cluster deployments query performance
+merge_request: 31988
+author:
+type: other
diff --git a/db/migrate/20190819131155_add_cluster_status_index_to_deployments.rb b/db/migrate/20190819131155_add_cluster_status_index_to_deployments.rb
new file mode 100644
index 00000000000..bfa91e33558
--- /dev/null
+++ b/db/migrate/20190819131155_add_cluster_status_index_to_deployments.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddClusterStatusIndexToDeployments < ActiveRecord::Migration[5.2]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_index :deployments, [:cluster_id, :status]
+  end
+
+  def down
+    remove_concurrent_index :deployments, [:cluster_id, :status]
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 454ea939a6f..14029486dfe 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1146,6 +1146,7 @@ ActiveRecord::Schema.define(version: 2019_08_28_083843) do
     t.integer "status", limit: 2, null: false
     t.datetime_with_timezone "finished_at"
     t.integer "cluster_id"
+    t.index ["cluster_id", "status"], name: "index_deployments_on_cluster_id_and_status"
     t.index ["cluster_id"], name: "index_deployments_on_cluster_id"
     t.index ["created_at"], name: "index_deployments_on_created_at"
     t.index ["deployable_type", "deployable_id"], name: "index_deployments_on_deployable_type_and_deployable_id"
-- 
cgit v1.2.1


From 3ed555f3c980ef7c21efd17cabc06a8037643787 Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Mon, 26 Aug 2019 21:11:41 +1200
Subject: Remove redundant index

Now we have cluster_id, state index, we don't the cluster_id index as
well.
---
 ...0190826090628_remove_redundant_deployments_index.rb | 18 ++++++++++++++++++
 db/schema.rb                                           |  1 -
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 db/migrate/20190826090628_remove_redundant_deployments_index.rb

diff --git a/db/migrate/20190826090628_remove_redundant_deployments_index.rb b/db/migrate/20190826090628_remove_redundant_deployments_index.rb
new file mode 100644
index 00000000000..6b009c17d64
--- /dev/null
+++ b/db/migrate/20190826090628_remove_redundant_deployments_index.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class RemoveRedundantDeploymentsIndex < ActiveRecord::Migration[5.2]
+  include Gitlab::Database::MigrationHelpers
+
+  # Set this constant to true if this migration requires downtime.
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    remove_concurrent_index :deployments, :cluster_id
+  end
+
+  def down
+    add_concurrent_index :deployments, :cluster_id
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 14029486dfe..54774b0a65b 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1147,7 +1147,6 @@ ActiveRecord::Schema.define(version: 2019_08_28_083843) do
     t.datetime_with_timezone "finished_at"
     t.integer "cluster_id"
     t.index ["cluster_id", "status"], name: "index_deployments_on_cluster_id_and_status"
-    t.index ["cluster_id"], name: "index_deployments_on_cluster_id"
     t.index ["created_at"], name: "index_deployments_on_created_at"
     t.index ["deployable_type", "deployable_id"], name: "index_deployments_on_deployable_type_and_deployable_id"
     t.index ["environment_id", "id"], name: "index_deployments_on_environment_id_and_id"
-- 
cgit v1.2.1


From 88cf7591c7bc38b7dbd70085ea3b93813acc14f8 Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Thu, 22 Aug 2019 13:48:29 +0800
Subject: Fix dropdown closing when mouseup is outside

Changes the document event listener to listen to
mousedown instead of click
---
 app/assets/javascripts/droplab/drop_lab.js                  | 4 ++--
 changelogs/unreleased/fix-dropdown-closing.yml              | 5 +++++
 spec/support/features/discussion_comments_shared_example.rb | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)
 create mode 100644 changelogs/unreleased/fix-dropdown-closing.yml

diff --git a/app/assets/javascripts/droplab/drop_lab.js b/app/assets/javascripts/droplab/drop_lab.js
index 1339e28d8b8..33c05404493 100644
--- a/app/assets/javascripts/droplab/drop_lab.js
+++ b/app/assets/javascripts/droplab/drop_lab.js
@@ -60,7 +60,7 @@ class DropLab {
 
   addEvents() {
     this.eventWrapper.documentClicked = this.documentClicked.bind(this);
-    document.addEventListener('click', this.eventWrapper.documentClicked);
+    document.addEventListener('mousedown', this.eventWrapper.documentClicked);
   }
 
   documentClicked(e) {
@@ -74,7 +74,7 @@ class DropLab {
   }
 
   removeEvents() {
-    document.removeEventListener('click', this.eventWrapper.documentClicked);
+    document.removeEventListener('mousedown', this.eventWrapper.documentClicked);
   }
 
   changeHookList(trigger, list, plugins, config) {
diff --git a/changelogs/unreleased/fix-dropdown-closing.yml b/changelogs/unreleased/fix-dropdown-closing.yml
new file mode 100644
index 00000000000..5ce3a6b478e
--- /dev/null
+++ b/changelogs/unreleased/fix-dropdown-closing.yml
@@ -0,0 +1,5 @@
+---
+title: Fix dropdowns closing when click is released outside the dropdown
+merge_request: 32084
+author:
+type: fixed
diff --git a/spec/support/features/discussion_comments_shared_example.rb b/spec/support/features/discussion_comments_shared_example.rb
index 5590bf0fb7e..f070243f111 100644
--- a/spec/support/features/discussion_comments_shared_example.rb
+++ b/spec/support/features/discussion_comments_shared_example.rb
@@ -73,7 +73,7 @@ shared_examples 'thread comments' do |resource_name|
       expect(page).not_to have_selector menu_selector
 
       find(toggle_selector).click
-      execute_script("document.querySelector('body').click()")
+      find("#{form_selector} .note-textarea").click
 
       expect(page).not_to have_selector menu_selector
     end
-- 
cgit v1.2.1


From 55d0df7a9f106687a2a252cf70b403bfebb9942c Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Wed, 28 Aug 2019 16:17:41 +0800
Subject: Fix issue due notification emails threading

It should not be a start to a new thread but rather
a reply to an existing thread
---
 app/mailers/emails/issues.rb                             |  2 +-
 ...-due-notification-emails-are-threaded-incorrectly.yml |  5 +++++
 spec/mailers/notify_spec.rb                              | 16 ++++++++++++++++
 3 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/66524-issue-due-notification-emails-are-threaded-incorrectly.yml

diff --git a/app/mailers/emails/issues.rb b/app/mailers/emails/issues.rb
index f3a3203f7ad..542085ea307 100644
--- a/app/mailers/emails/issues.rb
+++ b/app/mailers/emails/issues.rb
@@ -11,7 +11,7 @@ module Emails
     def issue_due_email(recipient_id, issue_id, reason = nil)
       setup_issue_mail(issue_id, recipient_id)
 
-      mail_new_thread(@issue, issue_thread_options(@issue.author_id, recipient_id, reason))
+      mail_answer_thread(@issue, issue_thread_options(@issue.author_id, recipient_id, reason))
     end
 
     def new_mention_in_issue_email(recipient_id, issue_id, updated_by_user_id, reason = nil)
diff --git a/changelogs/unreleased/66524-issue-due-notification-emails-are-threaded-incorrectly.yml b/changelogs/unreleased/66524-issue-due-notification-emails-are-threaded-incorrectly.yml
new file mode 100644
index 00000000000..a6a0ba4b4f4
--- /dev/null
+++ b/changelogs/unreleased/66524-issue-due-notification-emails-are-threaded-incorrectly.yml
@@ -0,0 +1,5 @@
+---
+title: Fix issue due notification emails not being threaded correctly
+merge_request: 32325
+author:
+type: fixed
diff --git a/spec/mailers/notify_spec.rb b/spec/mailers/notify_spec.rb
index 6cba7df114c..56fa26d5f23 100644
--- a/spec/mailers/notify_spec.rb
+++ b/spec/mailers/notify_spec.rb
@@ -187,6 +187,22 @@ describe Notify do
         end
       end
 
+      describe 'that are due soon' do
+        subject { described_class.issue_due_email(recipient.id, issue.id) }
+
+        before do
+          issue.update(due_date: Date.tomorrow)
+        end
+
+        it_behaves_like 'an answer to an existing thread with reply-by-email enabled' do
+          let(:model) { issue }
+        end
+        it_behaves_like 'it should show Gmail Actions View Issue link'
+        it_behaves_like 'an unsubscribeable thread'
+        it_behaves_like 'appearance header and footer enabled'
+        it_behaves_like 'appearance header and footer not enabled'
+      end
+
       describe 'status changed' do
         let(:status) { 'closed' }
         subject { described_class.issue_status_changed_email(recipient.id, issue.id, status, current_user.id) }
-- 
cgit v1.2.1


From 7a2bc31e38892f2d064b75710e37d6b3a31a3a03 Mon Sep 17 00:00:00 2001
From: Mark Lapierre <mlapierre@gitlab.com>
Date: Mon, 12 Aug 2019 15:03:10 +1000
Subject: Backport changes from EE

https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/8186
---
 .../javascripts/ide/components/error_message.vue   |  2 +-
 .../javascripts/ide/components/panes/right.vue     |  3 +-
 qa/qa.rb                                           |  5 ++
 qa/qa/page/component/web_ide/alert.rb              | 27 +++++++++
 qa/qa/page/project/web_ide/edit.rb                 |  3 +
 qa/qa/resource/project.rb                          |  1 +
 qa/qa/resource/repository/commit.rb                | 66 ++++++++++++++++++++++
 qa/qa/resource/runner.rb                           | 36 ++++++------
 qa/qa/service/runner.rb                            | 27 ++++++++-
 .../4_verify/runner/register_runner_spec.rb        |  4 +-
 .../deploy_key/clone_using_deploy_key_spec.rb      |  2 +-
 11 files changed, 153 insertions(+), 23 deletions(-)
 create mode 100644 qa/qa/page/component/web_ide/alert.rb
 create mode 100644 qa/qa/resource/repository/commit.rb

diff --git a/app/assets/javascripts/ide/components/error_message.vue b/app/assets/javascripts/ide/components/error_message.vue
index 22113692968..500f6737839 100644
--- a/app/assets/javascripts/ide/components/error_message.vue
+++ b/app/assets/javascripts/ide/components/error_message.vue
@@ -44,7 +44,7 @@ export default {
 
 <template>
   <div class="flash-container flash-container-page" @click="clickFlash">
-    <div class="flash-alert">
+    <div class="flash-alert" data-qa-selector="flash_alert">
       <span v-html="message.text"> </span>
       <button
         v-if="message.action"
diff --git a/app/assets/javascripts/ide/components/panes/right.vue b/app/assets/javascripts/ide/components/panes/right.vue
index 2e6bd85feec..200391282e7 100644
--- a/app/assets/javascripts/ide/components/panes/right.vue
+++ b/app/assets/javascripts/ide/components/panes/right.vue
@@ -89,7 +89,7 @@ export default {
 </script>
 
 <template>
-  <div class="multi-file-commit-panel ide-right-sidebar">
+  <div class="multi-file-commit-panel ide-right-sidebar" data-qa-selector="ide_right_sidebar">
     <resizable-panel
       v-show="isOpen"
       :collapsible="false"
@@ -120,6 +120,7 @@ export default {
             }"
             data-container="body"
             data-placement="left"
+            :data-qa-selector="`${tab.title.toLowerCase()}_tab_button`"
             class="ide-sidebar-link is-right"
             type="button"
             @click="clickTab($event, tab)"
diff --git a/qa/qa.rb b/qa/qa.rb
index 8be2a289422..f9d4a8a2dba 100644
--- a/qa/qa.rb
+++ b/qa/qa.rb
@@ -73,6 +73,7 @@ module QA
     end
 
     module Repository
+      autoload :Commit, 'qa/resource/repository/commit'
       autoload :Push, 'qa/resource/repository/push'
       autoload :ProjectPush, 'qa/resource/repository/project_push'
       autoload :WikiPush, 'qa/resource/repository/wiki_push'
@@ -339,6 +340,10 @@ module QA
       module Issuable
         autoload :Common, 'qa/page/component/issuable/common'
       end
+
+      module WebIDE
+        autoload :Alert, 'qa/page/component/web_ide/alert'
+      end
     end
   end
 
diff --git a/qa/qa/page/component/web_ide/alert.rb b/qa/qa/page/component/web_ide/alert.rb
new file mode 100644
index 00000000000..0f0623d5ebf
--- /dev/null
+++ b/qa/qa/page/component/web_ide/alert.rb
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module QA
+  module Page
+    module Component
+      module WebIDE
+        module Alert
+          def self.prepended(page)
+            page.module_eval do
+              view 'app/assets/javascripts/ide/components/error_message.vue' do
+                element :flash_alert
+              end
+            end
+          end
+
+          def has_no_alert?(message = nil)
+            return has_no_element?(:flash_alert) if message.nil?
+
+            within_element(:flash_alert) do
+              has_no_text?(message)
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/page/project/web_ide/edit.rb b/qa/qa/page/project/web_ide/edit.rb
index b5a36862389..2b52e854858 100644
--- a/qa/qa/page/project/web_ide/edit.rb
+++ b/qa/qa/page/project/web_ide/edit.rb
@@ -5,6 +5,7 @@ module QA
     module Project
       module WebIDE
         class Edit < Page::Base
+          prepend Page::Component::WebIDE::Alert
           include Page::Component::DropdownFilter
 
           view 'app/assets/javascripts/ide/components/activity_bar.vue' do
@@ -114,3 +115,5 @@ module QA
     end
   end
 end
+
+QA::Page::Project::WebIDE::Edit.prepend_if_ee('QA::EE::Page::Component::WebIDE::WebTerminalPanel')
diff --git a/qa/qa/resource/project.rb b/qa/qa/resource/project.rb
index 93a82094776..4a29a14c5c2 100644
--- a/qa/qa/resource/project.rb
+++ b/qa/qa/resource/project.rb
@@ -15,6 +15,7 @@ module QA
       attribute :add_name_uuid
       attribute :description
       attribute :standalone
+      attribute :runners_token
 
       attribute :group do
         Group.fabricate!
diff --git a/qa/qa/resource/repository/commit.rb b/qa/qa/resource/repository/commit.rb
new file mode 100644
index 00000000000..61c2ad6bfc0
--- /dev/null
+++ b/qa/qa/resource/repository/commit.rb
@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module QA
+  module Resource
+    module Repository
+      class Commit < Base
+        attr_accessor :author_email,
+                      :author_name,
+                      :branch,
+                      :commit_message,
+                      :file_path,
+                      :sha
+
+        attribute :project do
+          Project.fabricate! do |resource|
+            resource.name = 'project-with-commit'
+          end
+        end
+
+        def initialize
+          @commit_message = 'QA Test - Commit message'
+        end
+
+        def files=(files)
+          if !files.is_a?(Array) ||
+              files.empty? ||
+              files.any? { |file| !file.has_key?(:file_path) || !file.has_key?(:content) }
+            raise ArgumentError, "Please provide an array of hashes e.g.: [{file_path: 'file1', content: 'foo'}]"
+          end
+
+          @files = files
+        end
+
+        def resource_web_url(resource)
+          super
+        rescue ResourceURLMissingError
+          # this particular resource does not expose a web_url property
+        end
+
+        def api_get_path
+          "#{api_post_path}/#{@sha}"
+        end
+
+        def api_post_path
+          "/projects/#{CGI.escape(project.path_with_namespace)}/repository/commits"
+        end
+
+        def api_post_body
+          {
+            branch: @branch || "master",
+            author_email: @author_email || Runtime::User.default_email,
+            author_name: @author_name || Runtime::User.username,
+            commit_message: commit_message,
+            actions: actions
+          }
+        end
+
+        def actions
+          @files.map do |file|
+            file.merge({ action: "create" })
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/resource/runner.rb b/qa/qa/resource/runner.rb
index 3344ad3360a..9c2e138bade 100644
--- a/qa/qa/resource/runner.rb
+++ b/qa/qa/resource/runner.rb
@@ -6,9 +6,10 @@ module QA
   module Resource
     class Runner < Base
       attr_writer :name, :tags, :image
+      attr_accessor :config
 
       attribute :project do
-        Project.fabricate! do |resource|
+        Project.fabricate_via_api! do |resource|
           resource.name = 'project-with-ci-cd'
           resource.description = 'Project with CI/CD Pipelines'
         end
@@ -26,24 +27,27 @@ module QA
         @image || 'gitlab/gitlab-runner:alpine'
       end
 
-      def fabricate!
-        project.visit!
-
-        Page::Project::Menu.perform(&:go_to_ci_cd_settings)
-
+      def fabricate_via_api!
         Service::Runner.new(name).tap do |runner|
-          Page::Project::Settings::CICD.perform do |settings|
-            settings.expand_runners_settings do |runners|
-              runner.pull
-              runner.token = runners.registration_token
-              runner.address = runners.coordinator_address
-              runner.tags = tags
-              runner.image = image
-              runner.register!
-            end
-          end
+          runner.pull
+          runner.token = project.runners_token
+          runner.address = Runtime::Scenario.gitlab_address
+          runner.tags = tags
+          runner.image = image
+          runner.config = config if config
+          runner.run_untagged = true
+          runner.register!
         end
       end
+
+      def api_get_path
+      end
+
+      def api_post_path
+      end
+
+      def api_post_body
+      end
     end
   end
 end
diff --git a/qa/qa/service/runner.rb b/qa/qa/service/runner.rb
index 03b234f7a56..6fc5984b12a 100644
--- a/qa/qa/service/runner.rb
+++ b/qa/qa/service/runner.rb
@@ -7,13 +7,25 @@ module QA
     class Runner
       include Service::Shellout
 
-      attr_accessor :token, :address, :tags, :image
+      attr_accessor :token, :address, :tags, :image, :run_untagged
+      attr_writer :config
 
       def initialize(name)
         @image = 'gitlab/gitlab-runner:alpine'
         @name = name || "qa-runner-#{SecureRandom.hex(4)}"
         @network = Runtime::Scenario.attributes[:network] || 'test'
         @tags = %w[qa test]
+        @run_untagged = false
+      end
+
+      def config
+        @config ||= <<~END
+          concurrent = 1
+          check_interval = 0
+
+          [session_server]
+            session_timeout = 1800
+        END
       end
 
       def network
@@ -32,19 +44,30 @@ module QA
         shell <<~CMD.tr("\n", ' ')
           docker run -d --rm --entrypoint=/bin/sh
           --network #{network} --name #{@name}
+          -p 8093:8093
           -e CI_SERVER_URL=#{@address}
           -e REGISTER_NON_INTERACTIVE=true
           -e REGISTRATION_TOKEN=#{@token}
           -e RUNNER_EXECUTOR=shell
           -e RUNNER_TAG_LIST=#{@tags.join(',')}
           -e RUNNER_NAME=#{@name}
-          #{@image} -c 'gitlab-runner register && gitlab-runner run'
+          #{@image} -c "#{register_command}"
         CMD
       end
 
       def remove!
         shell "docker rm -f #{@name}"
       end
+
+      private
+
+      def register_command
+        <<~CMD
+          printf '#{config.chomp.gsub(/\n/, "\\n").gsub('"', '\"')}' > /etc/gitlab-runner/config.toml &&
+          gitlab-runner register --run-untagged=#{@run_untagged} &&
+          gitlab-runner run
+        CMD
+      end
     end
   end
 end
diff --git a/qa/qa/specs/features/browser_ui/4_verify/runner/register_runner_spec.rb b/qa/qa/specs/features/browser_ui/4_verify/runner/register_runner_spec.rb
index 33744236dd4..900ddcb7f59 100644
--- a/qa/qa/specs/features/browser_ui/4_verify/runner/register_runner_spec.rb
+++ b/qa/qa/specs/features/browser_ui/4_verify/runner/register_runner_spec.rb
@@ -15,11 +15,11 @@ module QA
 
         Resource::Runner.fabricate! do |runner|
           runner.name = executor
-        end
+        end.project.visit!
 
+        Page::Project::Menu.perform(&:go_to_ci_cd_settings)
         Page::Project::Settings::CICD.perform do |settings|
           sleep 5 # Runner should register within 5 seconds
-          settings.refresh
 
           settings.expand_runners_settings do |page|
             expect(page).to have_content(executor)
diff --git a/qa/qa/specs/features/browser_ui/6_release/deploy_key/clone_using_deploy_key_spec.rb b/qa/qa/specs/features/browser_ui/6_release/deploy_key/clone_using_deploy_key_spec.rb
index f6411d8c5ad..141166f6971 100644
--- a/qa/qa/specs/features/browser_ui/6_release/deploy_key/clone_using_deploy_key_spec.rb
+++ b/qa/qa/specs/features/browser_ui/6_release/deploy_key/clone_using_deploy_key_spec.rb
@@ -17,7 +17,7 @@ module QA
 
         @repository_location = @project.repository_ssh_location
 
-        Resource::Runner.fabricate_via_browser_ui! do |resource|
+        Resource::Runner.fabricate_via_api! do |resource|
           resource.project = @project
           resource.name = @runner_name
           resource.tags = %w[qa docker]
-- 
cgit v1.2.1


From 27b0a870ec1864dff58efcb02e9f1a8cb4e7e02a Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Thu, 29 Aug 2019 05:22:27 +0000
Subject: Update a few redirected links

---
 doc/development/ux_guide/animation.md     | 4 ++--
 doc/development/ux_guide/illustrations.md | 4 ++--
 doc/user/project/import/tfvc.md           | 2 +-
 doc/user/project/operations/tracing.md    | 6 +++---
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/doc/development/ux_guide/animation.md b/doc/development/ux_guide/animation.md
index a998ab74a96..0f7a24042bb 100644
--- a/doc/development/ux_guide/animation.md
+++ b/doc/development/ux_guide/animation.md
@@ -1,5 +1,5 @@
 ---
-redirect_to: 'https://design.gitlab.com/product-foundations/motion'
+redirect_to: 'https://design.gitlab.com/product-foundations/motion/'
 ---
 
-The content of this document was moved into the [GitLab Design System](https://design.gitlab.com/product-foundations/motion).
+The content of this document was moved into the [GitLab Design System](https://design.gitlab.com/product-foundations/motion/).
diff --git a/doc/development/ux_guide/illustrations.md b/doc/development/ux_guide/illustrations.md
index 3592d25c95d..815f870f8c5 100644
--- a/doc/development/ux_guide/illustrations.md
+++ b/doc/development/ux_guide/illustrations.md
@@ -1,5 +1,5 @@
 ---
-redirect_to: 'https://design.gitlab.com/product-foundations/illustration'
+redirect_to: 'https://design.gitlab.com/product-foundations/illustration/'
 ---
 
-The content of this document was moved into the [GitLab Design System](https://design.gitlab.com/product-foundations/illustration).
+The content of this document was moved into the [GitLab Design System](https://design.gitlab.com/product-foundations/illustration/).
diff --git a/doc/user/project/import/tfvc.md b/doc/user/project/import/tfvc.md
index 375522b77d0..9b148224e10 100644
--- a/doc/user/project/import/tfvc.md
+++ b/doc/user/project/import/tfvc.md
@@ -6,7 +6,7 @@ type: concepts
 
 Team Foundation Server (TFS), renamed [Azure DevOps Server](https://azure.microsoft.com/en-us/services/devops/server/)
 in 2019, is a set of tools developed by Microsoft which also includes
-[Team Foundation Version Control](https://docs.microsoft.com/en-us/azure/devops/repos/tfvc/overview)
+[Team Foundation Version Control](https://docs.microsoft.com/en-us/azure/devops/repos/tfvc/overview?view=azure-devops)
 (TFVC), a centralized version control system similar to Git.
 
 In this document, we focus on the TFVC to Git migration.
diff --git a/doc/user/project/operations/tracing.md b/doc/user/project/operations/tracing.md
index b92d2e49839..3fb3be3c21f 100644
--- a/doc/user/project/operations/tracing.md
+++ b/doc/user/project/operations/tracing.md
@@ -17,8 +17,8 @@ systems.
 ### Deploying Jaeger
 
 To learn more about deploying Jaeger, read the official
-[Getting Started documentation](https://www.jaegertracing.io/docs/1.13/getting-started/).
-There is an easy to use [all-in-one Docker image](https://www.jaegertracing.io/docs/1.13/getting-started/#AllinoneDockerimage),
+[Getting Started documentation](https://www.jaegertracing.io/docs/latest/getting-started/).
+There is an easy to use [all-in-one Docker image](https://www.jaegertracing.io/docs/latest/getting-started/#AllinoneDockerimage),
 as well as deployment options for [Kubernetes](https://github.com/jaegertracing/jaeger-kubernetes)
 and [OpenShift](https://github.com/jaegertracing/jaeger-openshift).
 
@@ -27,7 +27,7 @@ and [OpenShift](https://github.com/jaegertracing/jaeger-openshift).
 GitLab provides an easy way to open the Jaeger UI from within your project:
 
 1. [Set up Jaeger](#deploying-jaeger) and configure your application using one of the
-   [client libraries](https://www.jaegertracing.io/docs/1.13/client-libraries/).
+   [client libraries](https://www.jaegertracing.io/docs/latest/client-libraries/).
 1. Navigate to your project's **Settings > Operations** and provide the Jaeger URL.
 1. Click **Save changes** for the changes to take effect.
 1. You can now visit **Operations > Tracing** in your project's sidebar and
-- 
cgit v1.2.1


From 680f437715dcf7a8871aa997559cf57362b43217 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Tue, 27 Aug 2019 10:31:59 -0700
Subject: Fix snippets API not working with visibility level

When a restricted visibility level of `private` is set in the instance,
creating a snippet with the `visibility` level would always fail.
This happened because:

1. `params[:visibility]` was a string (e.g. "public")
2. `CreateSnippetService` and `UpdateSnippetService` only looked
   at `params[:visibility_level]`, which was `nil`.

To fix this, we:

1. Make `CreateSnippetService` look at the newly-built
   `snippet.visibility_level`, since the right value is assigned by the
   `VisibilityLevel#visibility=` method.
2. Modify `UpdateSnippetService` to handle both `visibility_level` and
`visibility` parameters.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66050
---
 app/services/base_service.rb                       |  4 ++
 app/services/create_snippet_service.rb             |  2 +-
 app/services/groups/create_service.rb              |  4 --
 app/services/update_snippet_service.rb             |  2 +-
 .../unreleased/sh-fix-snippet-visibility-api.yml   |  5 ++
 spec/requests/api/project_snippets_spec.rb         | 25 ++++++++-
 spec/requests/api/snippets_spec.rb                 | 63 ++++++++++++++++------
 spec/services/create_snippet_service_spec.rb       | 13 +++++
 spec/services/update_snippet_service_spec.rb       | 15 +++++-
 9 files changed, 108 insertions(+), 25 deletions(-)
 create mode 100644 changelogs/unreleased/sh-fix-snippet-visibility-api.yml

diff --git a/app/services/base_service.rb b/app/services/base_service.rb
index 3e968c8f707..c39edd5c114 100644
--- a/app/services/base_service.rb
+++ b/app/services/base_service.rb
@@ -44,6 +44,10 @@ class BaseService
     model.errors.add(:visibility_level, "#{level_name} has been restricted by your GitLab administrator")
   end
 
+  def visibility_level
+    params[:visibility].is_a?(String) ? Gitlab::VisibilityLevel.level_value(params[:visibility]) : params[:visibility_level]
+  end
+
   private
 
   def error(message, http_status = nil)
diff --git a/app/services/create_snippet_service.rb b/app/services/create_snippet_service.rb
index 6e5bf823cc7..0aa76df35ba 100644
--- a/app/services/create_snippet_service.rb
+++ b/app/services/create_snippet_service.rb
@@ -12,7 +12,7 @@ class CreateSnippetService < BaseService
                 PersonalSnippet.new(params)
               end
 
-    unless Gitlab::VisibilityLevel.allowed_for?(current_user, params[:visibility_level])
+    unless Gitlab::VisibilityLevel.allowed_for?(current_user, snippet.visibility_level)
       deny_visibility_level(snippet)
       return snippet
     end
diff --git a/app/services/groups/create_service.rb b/app/services/groups/create_service.rb
index e78e5d5fc2c..1dd22d7a3ae 100644
--- a/app/services/groups/create_service.rb
+++ b/app/services/groups/create_service.rb
@@ -68,9 +68,5 @@ module Groups
 
       true
     end
-
-    def visibility_level
-      params[:visibility].present? ? Gitlab::VisibilityLevel.level_value(params[:visibility]) : params[:visibility_level]
-    end
   end
 end
diff --git a/app/services/update_snippet_service.rb b/app/services/update_snippet_service.rb
index 2969c360de5..a294812ef9e 100644
--- a/app/services/update_snippet_service.rb
+++ b/app/services/update_snippet_service.rb
@@ -12,7 +12,7 @@ class UpdateSnippetService < BaseService
 
   def execute
     # check that user is allowed to set specified visibility_level
-    new_visibility = params[:visibility_level]
+    new_visibility = visibility_level
 
     if new_visibility && new_visibility.to_i != snippet.visibility_level
       unless Gitlab::VisibilityLevel.allowed_for?(current_user, new_visibility)
diff --git a/changelogs/unreleased/sh-fix-snippet-visibility-api.yml b/changelogs/unreleased/sh-fix-snippet-visibility-api.yml
new file mode 100644
index 00000000000..5cfb9cdedc0
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-snippet-visibility-api.yml
@@ -0,0 +1,5 @@
+---
+title: Fix snippets API not working with visibility level
+merge_request: 32286
+author:
+type: fixed
diff --git a/spec/requests/api/project_snippets_spec.rb b/spec/requests/api/project_snippets_spec.rb
index 29f69b6ce20..a543ef8de78 100644
--- a/spec/requests/api/project_snippets_spec.rb
+++ b/spec/requests/api/project_snippets_spec.rb
@@ -96,6 +96,28 @@ describe API::ProjectSnippets do
       }
     end
 
+    context 'with a regular user' do
+      let(:user) { create(:user) }
+
+      before do
+        project.add_developer(user)
+        stub_application_setting(restricted_visibility_levels: [Gitlab::VisibilityLevel::PUBLIC, Gitlab::VisibilityLevel::PRIVATE])
+        params['visibility'] = 'internal'
+      end
+
+      it 'creates a new snippet' do
+        post api("/projects/#{project.id}/snippets/", user), params: params
+
+        expect(response).to have_gitlab_http_status(201)
+        snippet = ProjectSnippet.find(json_response['id'])
+        expect(snippet.content).to eq(params[:code])
+        expect(snippet.description).to eq(params[:description])
+        expect(snippet.title).to eq(params[:title])
+        expect(snippet.file_name).to eq(params[:file_name])
+        expect(snippet.visibility_level).to eq(Snippet::INTERNAL)
+      end
+    end
+
     it 'creates a new snippet' do
       post api("/projects/#{project.id}/snippets/", admin), params: params
 
@@ -167,12 +189,13 @@ describe API::ProjectSnippets do
       new_content = 'New content'
       new_description = 'New description'
 
-      put api("/projects/#{snippet.project.id}/snippets/#{snippet.id}/", admin), params: { code: new_content, description: new_description }
+      put api("/projects/#{snippet.project.id}/snippets/#{snippet.id}/", admin), params: { code: new_content, description: new_description, visibility: 'private' }
 
       expect(response).to have_gitlab_http_status(200)
       snippet.reload
       expect(snippet.content).to eq(new_content)
       expect(snippet.description).to eq(new_description)
+      expect(snippet.visibility).to eq('private')
     end
 
     it 'returns 404 for invalid snippet id' do
diff --git a/spec/requests/api/snippets_spec.rb b/spec/requests/api/snippets_spec.rb
index d600076e9fb..cc05b8d5b45 100644
--- a/spec/requests/api/snippets_spec.rb
+++ b/spec/requests/api/snippets_spec.rb
@@ -193,18 +193,32 @@ describe API::Snippets do
       }
     end
 
-    it 'creates a new snippet' do
-      expect do
-        post api("/snippets/", user), params: params
-      end.to change { PersonalSnippet.count }.by(1)
+    shared_examples 'snippet creation' do
+      it 'creates a new snippet' do
+        expect do
+          post api("/snippets/", user), params: params
+        end.to change { PersonalSnippet.count }.by(1)
+
+        expect(response).to have_gitlab_http_status(201)
+        expect(json_response['title']).to eq(params[:title])
+        expect(json_response['description']).to eq(params[:description])
+        expect(json_response['file_name']).to eq(params[:file_name])
+        expect(json_response['visibility']).to eq(params[:visibility])
+      end
+    end
+
+    context 'with restricted visibility settings' do
+      before do
+        stub_application_setting(restricted_visibility_levels:
+                                   [Gitlab::VisibilityLevel::INTERNAL,
+                                    Gitlab::VisibilityLevel::PRIVATE])
+      end
 
-      expect(response).to have_gitlab_http_status(201)
-      expect(json_response['title']).to eq(params[:title])
-      expect(json_response['description']).to eq(params[:description])
-      expect(json_response['file_name']).to eq(params[:file_name])
-      expect(json_response['visibility']).to eq(params[:visibility])
+      it_behaves_like 'snippet creation'
     end
 
+    it_behaves_like 'snippet creation'
+
     it 'returns 400 for missing parameters' do
       params.delete(:title)
 
@@ -253,18 +267,33 @@ describe API::Snippets do
       create(:personal_snippet, author: user, visibility_level: visibility_level)
     end
 
-    it 'updates snippet' do
-      new_content = 'New content'
-      new_description = 'New description'
+    shared_examples 'snippet updates' do
+      it 'updates a snippet' do
+        new_content = 'New content'
+        new_description = 'New description'
 
-      put api("/snippets/#{snippet.id}", user), params: { content: new_content, description: new_description }
+        put api("/snippets/#{snippet.id}", user), params: { content: new_content, description: new_description, visibility: 'internal' }
 
-      expect(response).to have_gitlab_http_status(200)
-      snippet.reload
-      expect(snippet.content).to eq(new_content)
-      expect(snippet.description).to eq(new_description)
+        expect(response).to have_gitlab_http_status(200)
+        snippet.reload
+        expect(snippet.content).to eq(new_content)
+        expect(snippet.description).to eq(new_description)
+        expect(snippet.visibility).to eq('internal')
+      end
     end
 
+    context 'with restricted visibility settings' do
+      before do
+        stub_application_setting(restricted_visibility_levels:
+                                   [Gitlab::VisibilityLevel::PUBLIC,
+                                    Gitlab::VisibilityLevel::PRIVATE])
+      end
+
+      it_behaves_like 'snippet updates'
+    end
+
+    it_behaves_like 'snippet updates'
+
     it 'returns 404 for invalid snippet id' do
       put api("/snippets/1234", user), params: { title: 'foo' }
 
diff --git a/spec/services/create_snippet_service_spec.rb b/spec/services/create_snippet_service_spec.rb
index 9b83f65a17e..7d2491b3a49 100644
--- a/spec/services/create_snippet_service_spec.rb
+++ b/spec/services/create_snippet_service_spec.rb
@@ -34,6 +34,19 @@ describe CreateSnippetService do
       expect(snippet.errors.any?).to be_falsey
       expect(snippet.visibility_level).to eq(Gitlab::VisibilityLevel::PUBLIC)
     end
+
+    describe "when visibility level is passed as a string" do
+      before do
+        @opts[:visibility] = 'internal'
+        @opts.delete(:visibility_level)
+      end
+
+      it "assigns the correct visibility level" do
+        snippet = create_snippet(nil, @user, @opts)
+        expect(snippet.errors.any?).to be_falsey
+        expect(snippet.visibility_level).to eq(Gitlab::VisibilityLevel::INTERNAL)
+      end
+    end
   end
 
   describe 'usage counter' do
diff --git a/spec/services/update_snippet_service_spec.rb b/spec/services/update_snippet_service_spec.rb
index 0678f54c195..19b35dca6a7 100644
--- a/spec/services/update_snippet_service_spec.rb
+++ b/spec/services/update_snippet_service_spec.rb
@@ -32,12 +32,25 @@ describe UpdateSnippetService do
       expect(@snippet.visibility_level).to eq(old_visibility)
     end
 
-    it 'admins should be able to update to pubic visibility' do
+    it 'admins should be able to update to public visibility' do
       old_visibility = @snippet.visibility_level
       update_snippet(@project, @admin, @snippet, @opts)
       expect(@snippet.visibility_level).not_to eq(old_visibility)
       expect(@snippet.visibility_level).to eq(Gitlab::VisibilityLevel::PUBLIC)
     end
+
+    describe "when visibility level is passed as a string" do
+      before do
+        @opts[:visibility] = 'internal'
+        @opts.delete(:visibility_level)
+      end
+
+      it "assigns the correct visibility level" do
+        update_snippet(@project, @user, @snippet, @opts)
+        expect(@snippet.errors.any?).to be_falsey
+        expect(@snippet.visibility_level).to eq(Gitlab::VisibilityLevel::INTERNAL)
+      end
+    end
   end
 
   describe 'usage counter' do
-- 
cgit v1.2.1


From fc52421b552dace1a8d1410adc23b7bfddc5a580 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Tue, 27 Aug 2019 12:52:27 -0700
Subject: Standardize use of `content` parameter in snippets API

There was some confusion over whether `code` or `content` is the right
parameter for snippets. Internally, the database stores
`content`. However:

1. Project snippets use `code`. `code` gets remapped in `content` in
`lib/api/project_snippets.rb`.

2. Personal snippets use `content`.

To unify these APIs, allow an alias of `content` to work for project
snippets.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/66673
---
 .../sh-support-content-for-snippets-api.yml        |  5 +++
 lib/api/project_snippets.rb                        | 14 +++++---
 spec/requests/api/project_snippets_spec.rb         | 42 ++++++++++++++++++++++
 3 files changed, 56 insertions(+), 5 deletions(-)
 create mode 100644 changelogs/unreleased/sh-support-content-for-snippets-api.yml

diff --git a/changelogs/unreleased/sh-support-content-for-snippets-api.yml b/changelogs/unreleased/sh-support-content-for-snippets-api.yml
new file mode 100644
index 00000000000..60a5d98da46
--- /dev/null
+++ b/changelogs/unreleased/sh-support-content-for-snippets-api.yml
@@ -0,0 +1,5 @@
+---
+title: Standardize use of `content` parameter in snippets API
+merge_request: 32296
+author:
+type: changed
diff --git a/lib/api/project_snippets.rb b/lib/api/project_snippets.rb
index a607df411a6..b4545295d54 100644
--- a/lib/api/project_snippets.rb
+++ b/lib/api/project_snippets.rb
@@ -51,16 +51,18 @@ module API
       params do
         requires :title, type: String, desc: 'The title of the snippet'
         requires :file_name, type: String, desc: 'The file name of the snippet'
-        requires :code, type: String, allow_blank: false, desc: 'The content of the snippet'
+        optional :code, type: String, allow_blank: false, desc: 'The content of the snippet (deprecated in favor of "content")'
+        optional :content, type: String, allow_blank: false, desc: 'The content of the snippet'
         optional :description, type: String, desc: 'The description of a snippet'
         requires :visibility, type: String,
                               values: Gitlab::VisibilityLevel.string_values,
                               desc: 'The visibility of the snippet'
+        mutually_exclusive :code, :content
       end
       post ":id/snippets" do
         authorize! :create_project_snippet, user_project
-        snippet_params = declared_params.merge(request: request, api: true)
-        snippet_params[:content] = snippet_params.delete(:code)
+        snippet_params = declared_params(include_missing: false).merge(request: request, api: true)
+        snippet_params[:content] = snippet_params.delete(:code) if snippet_params[:code].present?
 
         snippet = CreateSnippetService.new(user_project, current_user, snippet_params).execute
 
@@ -80,12 +82,14 @@ module API
         requires :snippet_id, type: Integer, desc: 'The ID of a project snippet'
         optional :title, type: String, desc: 'The title of the snippet'
         optional :file_name, type: String, desc: 'The file name of the snippet'
-        optional :code, type: String, allow_blank: false, desc: 'The content of the snippet'
+        optional :code, type: String, allow_blank: false, desc: 'The content of the snippet (deprecated in favor of "content")'
+        optional :content, type: String, allow_blank: false, desc: 'The content of the snippet'
         optional :description, type: String, desc: 'The description of a snippet'
         optional :visibility, type: String,
                               values: Gitlab::VisibilityLevel.string_values,
                               desc: 'The visibility of the snippet'
-        at_least_one_of :title, :file_name, :code, :visibility_level
+        at_least_one_of :title, :file_name, :code, :content, :visibility_level
+        mutually_exclusive :code, :content
       end
       # rubocop: disable CodeReuse/ActiveRecord
       put ":id/snippets/:snippet_id" do
diff --git a/spec/requests/api/project_snippets_spec.rb b/spec/requests/api/project_snippets_spec.rb
index 29f69b6ce20..5ee46f7fc31 100644
--- a/spec/requests/api/project_snippets_spec.rb
+++ b/spec/requests/api/project_snippets_spec.rb
@@ -108,6 +108,29 @@ describe API::ProjectSnippets do
       expect(snippet.visibility_level).to eq(Snippet::PUBLIC)
     end
 
+    it 'creates a new snippet with content parameter' do
+      params[:content] = params.delete(:code)
+
+      post api("/projects/#{project.id}/snippets/", admin), params: params
+
+      expect(response).to have_gitlab_http_status(201)
+      snippet = ProjectSnippet.find(json_response['id'])
+      expect(snippet.content).to eq(params[:content])
+      expect(snippet.description).to eq(params[:description])
+      expect(snippet.title).to eq(params[:title])
+      expect(snippet.file_name).to eq(params[:file_name])
+      expect(snippet.visibility_level).to eq(Snippet::PUBLIC)
+    end
+
+    it 'returns 400 when both code and content parameters specified' do
+      params[:content] = params[:code]
+
+      post api("/projects/#{project.id}/snippets/", admin), params: params
+
+      expect(response).to have_gitlab_http_status(400)
+      expect(json_response['error']).to eq('code, content are mutually exclusive')
+    end
+
     it 'returns 400 for missing parameters' do
       params.delete(:title)
 
@@ -175,6 +198,25 @@ describe API::ProjectSnippets do
       expect(snippet.description).to eq(new_description)
     end
 
+    it 'updates snippet with content parameter' do
+      new_content = 'New content'
+      new_description = 'New description'
+
+      put api("/projects/#{snippet.project.id}/snippets/#{snippet.id}/", admin), params: { content: new_content, description: new_description }
+
+      expect(response).to have_gitlab_http_status(200)
+      snippet.reload
+      expect(snippet.content).to eq(new_content)
+      expect(snippet.description).to eq(new_description)
+    end
+
+    it 'returns 400 when both code and content parameters specified' do
+      put api("/projects/#{snippet.project.id}/snippets/1234", admin), params: { code: 'some content', content: 'other content' }
+
+      expect(response).to have_gitlab_http_status(400)
+      expect(json_response['error']).to eq('code, content are mutually exclusive')
+    end
+
     it 'returns 404 for invalid snippet id' do
       put api("/projects/#{snippet.project.id}/snippets/1234", admin), params: { title: 'foo' }
 
-- 
cgit v1.2.1


From 05ec97d40379b7ff9767dcc1a7fd8216cf79ec60 Mon Sep 17 00:00:00 2001
From: Mark Florian <553096-markrian@users.noreply.gitlab.com>
Date: Thu, 29 Aug 2019 06:43:25 +0000
Subject: Apply review suggestions

- Reword relationship between Jest/Karma/Jasmine
- Prefer inline URLs, per the [docs]

[docs]: https://docs.gitlab.com/ee/development/documentation/styleguide.html#links
---
 doc/development/testing_guide/index.md | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/doc/development/testing_guide/index.md b/doc/development/testing_guide/index.md
index 96e8c30a679..173471e3af8 100644
--- a/doc/development/testing_guide/index.md
+++ b/doc/development/testing_guide/index.md
@@ -13,7 +13,7 @@ importance.
 
 GitLab is built on top of [Ruby on Rails](https://rubyonrails.org/), and we're using [RSpec] for all
 the backend tests, with [Capybara] for end-to-end integration testing.
-On the frontend side, we're using [Karma] and [Jasmine] for JavaScript unit and
+On the frontend side, we're using [Jest](https://jestjs.io/) and [Karma](http://karma-runner.github.io/)/[Jasmine](https://jasmine.github.io/) for JavaScript unit and
 integration testing.
 
 Following are two great articles that everyone should read to understand what
@@ -64,6 +64,4 @@ Everything you should know about how to run end-to-end tests using
 
 [RSpec]: https://github.com/rspec/rspec-rails#feature-specs
 [Capybara]: https://github.com/teamcapybara/capybara
-[Karma]: http://karma-runner.github.io/
-[Jasmine]: https://jasmine.github.io/
 [gitlab-qa]: https://gitlab.com/gitlab-org/gitlab-qa
-- 
cgit v1.2.1


From 20055fa68b09adf0dd8b2274efcbd861dcfcab2a Mon Sep 17 00:00:00 2001
From: Justin Boyson <jboyson@gitlab.com>
Date: Thu, 29 Aug 2019 06:53:08 +0000
Subject: Remove checkbox styling

---
 app/assets/stylesheets/framework/forms.scss | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/app/assets/stylesheets/framework/forms.scss b/app/assets/stylesheets/framework/forms.scss
index 821e6691fe4..69ef116043a 100644
--- a/app/assets/stylesheets/framework/forms.scss
+++ b/app/assets/stylesheets/framework/forms.scss
@@ -245,27 +245,3 @@ label {
 .input-group-text {
   max-height: $input-height;
 }
-
-.gl-form-checkbox {
-  align-items: baseline;
-  margin-right: 1rem;
-  margin-bottom: 0.25rem;
-
-  .form-check-input {
-    margin-right: 0;
-  }
-
-  .form-check-label {
-    padding-left: $gl-padding-8;
-  }
-
-  &.form-check-inline .form-check-input {
-    align-self: flex-start;
-    height: 1.5 * $gl-font-size;
-  }
-
-  .form-check-input:disabled,
-  .form-check-input:disabled ~ .form-check-label {
-    cursor: not-allowed;
-  }
-}
-- 
cgit v1.2.1


From e301dfced6b91c4f81374fdd4d489f82b719ddc1 Mon Sep 17 00:00:00 2001
From: Lee Tickett <lee@tickett.net>
Date: Thu, 29 Aug 2019 07:01:24 +0000
Subject: Revert "DB change, migratoin and changelog"

This reverts commit af5242ecb682189c5d8276e1ab1ffe5ce844f2e5.
---
 app/views/projects/milestones/_form.html.haml                  | 2 +-
 changelogs/unreleased/new-project-milestone-primary-button.yml | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/new-project-milestone-primary-button.yml

diff --git a/app/views/projects/milestones/_form.html.haml b/app/views/projects/milestones/_form.html.haml
index 5cc6b5a173b..e1797e6db2a 100644
--- a/app/views/projects/milestones/_form.html.haml
+++ b/app/views/projects/milestones/_form.html.haml
@@ -21,7 +21,7 @@
 
   .form-actions
     - if @milestone.new_record?
-      = f.submit _('Create milestone'), class: 'btn-create btn qa-milestone-create-button'
+      = f.submit _('Create milestone'), class: 'btn-success btn qa-milestone-create-button'
       = link_to _('Cancel'), project_milestones_path(@project), class: 'btn btn-cancel'
     - else
       = f.submit _('Save changes'), class: 'btn-success btn'
diff --git a/changelogs/unreleased/new-project-milestone-primary-button.yml b/changelogs/unreleased/new-project-milestone-primary-button.yml
new file mode 100644
index 00000000000..ac0305a2e21
--- /dev/null
+++ b/changelogs/unreleased/new-project-milestone-primary-button.yml
@@ -0,0 +1,5 @@
+---
+title: New project milestone primary button
+merge_request: 32355
+author: Lee Tickett
+type: fixed
-- 
cgit v1.2.1


From c08191e0d5565fd191f4dec54520994ea473ea8d Mon Sep 17 00:00:00 2001
From: Patrick Bajao <ebajao@gitlab.com>
Date: Fri, 23 Aug 2019 13:53:40 +0800
Subject: Remove the fallback path from gitlab-ce

---
 lib/gitlab/shell.rb           |  86 +-------
 spec/lib/gitlab/shell_spec.rb | 485 ++++++++----------------------------------
 2 files changed, 89 insertions(+), 482 deletions(-)

diff --git a/lib/gitlab/shell.rb b/lib/gitlab/shell.rb
index 0fa17b3f559..9e813968093 100644
--- a/lib/gitlab/shell.rb
+++ b/lib/gitlab/shell.rb
@@ -165,16 +165,7 @@ module Gitlab
     def add_key(key_id, key_content)
       return unless self.authorized_keys_enabled?
 
-      if shell_out_for_gitlab_keys?
-        gitlab_shell_fast_execute([
-          gitlab_shell_keys_path,
-          'add-key',
-          key_id,
-          strip_key(key_content)
-        ])
-      else
-        gitlab_authorized_keys.add_key(key_id, key_content)
-      end
+      gitlab_authorized_keys.add_key(key_id, key_content)
     end
 
     # Batch-add keys to authorized_keys
@@ -184,19 +175,7 @@ module Gitlab
     def batch_add_keys(keys)
       return unless self.authorized_keys_enabled?
 
-      if shell_out_for_gitlab_keys?
-        begin
-          IO.popen("#{gitlab_shell_keys_path} batch-add-keys", 'w') do |io|
-            add_keys_to_io(keys, io)
-          end
-
-          $?.success?
-        rescue Error
-          false
-        end
-      else
-        gitlab_authorized_keys.batch_add_keys(keys)
-      end
+      gitlab_authorized_keys.batch_add_keys(keys)
     end
 
     # Remove ssh key from authorized_keys
@@ -207,11 +186,7 @@ module Gitlab
     def remove_key(id, _ = nil)
       return unless self.authorized_keys_enabled?
 
-      if shell_out_for_gitlab_keys?
-        gitlab_shell_fast_execute([gitlab_shell_keys_path, 'rm-key', id])
-      else
-        gitlab_authorized_keys.rm_key(id)
-      end
+      gitlab_authorized_keys.rm_key(id)
     end
 
     # Remove all ssh keys from gitlab shell
@@ -222,11 +197,7 @@ module Gitlab
     def remove_all_keys
       return unless self.authorized_keys_enabled?
 
-      if shell_out_for_gitlab_keys?
-        gitlab_shell_fast_execute([gitlab_shell_keys_path, 'clear'])
-      else
-        gitlab_authorized_keys.clear
-      end
+      gitlab_authorized_keys.clear
     end
 
     # Remove ssh keys from gitlab shell that are not in the DB
@@ -341,14 +312,6 @@ module Gitlab
       File.join(Gitlab.config.repositories.storages[storage].legacy_disk_path, dir_name)
     end
 
-    def gitlab_shell_projects_path
-      File.join(gitlab_shell_path, 'bin', 'gitlab-projects')
-    end
-
-    def gitlab_shell_keys_path
-      File.join(gitlab_shell_path, 'bin', 'gitlab-keys')
-    end
-
     def authorized_keys_enabled?
       # Return true if nil to ensure the authorized_keys methods work while
       # fixing the authorized_keys file during migration.
@@ -359,35 +322,6 @@ module Gitlab
 
     private
 
-    def shell_out_for_gitlab_keys?
-      Gitlab.config.gitlab_shell.authorized_keys_file.blank?
-    end
-
-    def gitlab_shell_fast_execute(cmd)
-      output, status = gitlab_shell_fast_execute_helper(cmd)
-
-      return true if status.zero?
-
-      Rails.logger.error("gitlab-shell failed with error #{status}: #{output}") # rubocop:disable Gitlab/RailsLogger
-      false
-    end
-
-    def gitlab_shell_fast_execute_raise_error(cmd, vars = {})
-      output, status = gitlab_shell_fast_execute_helper(cmd, vars)
-
-      raise Error, output unless status.zero?
-
-      true
-    end
-
-    def gitlab_shell_fast_execute_helper(cmd, vars = {})
-      vars.merge!(ENV.to_h.slice(*GITLAB_SHELL_ENV_VARS))
-
-      # Don't pass along the entire parent environment to prevent gitlab-shell
-      # from wasting I/O by searching through GEM_PATH
-      Bundler.with_original_env { Popen.popen(cmd, nil, vars) }
-    end
-
     def git_timeout
       Gitlab.config.gitlab_shell.git_timeout
     end
@@ -407,16 +341,8 @@ module Gitlab
     def batch_read_key_ids(batch_size: 100, &block)
       return unless self.authorized_keys_enabled?
 
-      if shell_out_for_gitlab_keys?
-        IO.popen("#{gitlab_shell_keys_path} list-key-ids") do |key_id_stream|
-          key_id_stream.lazy.each_slice(batch_size) do |lines|
-            yield(lines.map { |l| l.chomp.to_i })
-          end
-        end
-      else
-        gitlab_authorized_keys.list_key_ids.lazy.each_slice(batch_size) do |key_ids|
-          yield(key_ids)
-        end
+      gitlab_authorized_keys.list_key_ids.lazy.each_slice(batch_size) do |key_ids|
+        yield(key_ids)
       end
     end
 
diff --git a/spec/lib/gitlab/shell_spec.rb b/spec/lib/gitlab/shell_spec.rb
index 0ba16b93ee7..fe4853fd819 100644
--- a/spec/lib/gitlab/shell_spec.rb
+++ b/spec/lib/gitlab/shell_spec.rb
@@ -52,38 +52,14 @@ describe Gitlab::Shell do
 
   describe '#add_key' do
     context 'when authorized_keys_enabled is true' do
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-          allow(gitlab_shell)
-            .to receive(:gitlab_shell_keys_path)
-            .and_return(:gitlab_shell_keys_path)
-        end
-
-        it 'calls #gitlab_shell_fast_execute with add-key command' do
-          expect(gitlab_shell)
-            .to receive(:gitlab_shell_fast_execute)
-            .with([
-              :gitlab_shell_keys_path,
-              'add-key',
-              'key-123',
-              'ssh-rsa foobar'
-            ])
-
-          gitlab_shell.add_key('key-123', 'ssh-rsa foobar trailing garbage')
-        end
-      end
-
-      context 'authorized_keys_file set' do
-        it 'calls Gitlab::AuthorizedKeys#add_key with id and key' do
-          expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
+      it 'calls Gitlab::AuthorizedKeys#add_key with id and key' do
+        expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
 
-          expect(gitlab_authorized_keys)
-            .to receive(:add_key)
-            .with('key-123', 'ssh-rsa foobar')
+        expect(gitlab_authorized_keys)
+          .to receive(:add_key)
+          .with('key-123', 'ssh-rsa foobar')
 
-          gitlab_shell.add_key('key-123', 'ssh-rsa foobar')
-        end
+        gitlab_shell.add_key('key-123', 'ssh-rsa foobar')
       end
     end
 
@@ -92,24 +68,10 @@ describe Gitlab::Shell do
         stub_application_setting(authorized_keys_enabled: false)
       end
 
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-        end
+      it 'does nothing' do
+        expect(Gitlab::AuthorizedKeys).not_to receive(:new)
 
-        it 'does nothing' do
-          expect(gitlab_shell).not_to receive(:gitlab_shell_fast_execute)
-
-          gitlab_shell.add_key('key-123', 'ssh-rsa foobar trailing garbage')
-        end
-      end
-
-      context 'authorized_keys_file set' do
-        it 'does nothing' do
-          expect(Gitlab::AuthorizedKeys).not_to receive(:new)
-
-          gitlab_shell.add_key('key-123', 'ssh-rsa foobar trailing garbage')
-        end
+        gitlab_shell.add_key('key-123', 'ssh-rsa foobar trailing garbage')
       end
     end
 
@@ -118,38 +80,14 @@ describe Gitlab::Shell do
         stub_application_setting(authorized_keys_enabled: nil)
       end
 
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-          allow(gitlab_shell)
-            .to receive(:gitlab_shell_keys_path)
-            .and_return(:gitlab_shell_keys_path)
-        end
-
-        it 'calls #gitlab_shell_fast_execute with add-key command' do
-          expect(gitlab_shell)
-            .to receive(:gitlab_shell_fast_execute)
-            .with([
-              :gitlab_shell_keys_path,
-              'add-key',
-              'key-123',
-              'ssh-rsa foobar'
-            ])
-
-          gitlab_shell.add_key('key-123', 'ssh-rsa foobar trailing garbage')
-        end
-      end
-
-      context 'authorized_keys_file set' do
-        it 'calls Gitlab::AuthorizedKeys#add_key with id and key' do
-          expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
+      it 'calls Gitlab::AuthorizedKeys#add_key with id and key' do
+        expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
 
-          expect(gitlab_authorized_keys)
-            .to receive(:add_key)
-            .with('key-123', 'ssh-rsa foobar')
+        expect(gitlab_authorized_keys)
+          .to receive(:add_key)
+          .with('key-123', 'ssh-rsa foobar')
 
-          gitlab_shell.add_key('key-123', 'ssh-rsa foobar')
-        end
+        gitlab_shell.add_key('key-123', 'ssh-rsa foobar')
       end
     end
   end
@@ -158,50 +96,14 @@ describe Gitlab::Shell do
     let(:keys) { [double(shell_id: 'key-123', key: 'ssh-rsa foobar')] }
 
     context 'when authorized_keys_enabled is true' do
-      context 'authorized_keys_file not set' do
-        let(:io) { double }
-
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-        end
-
-        context 'valid keys' do
-          before do
-            allow(gitlab_shell)
-              .to receive(:gitlab_shell_keys_path)
-              .and_return(:gitlab_shell_keys_path)
-          end
-
-          it 'calls gitlab-keys with batch-add-keys command' do
-            expect(IO)
-              .to receive(:popen)
-              .with("gitlab_shell_keys_path batch-add-keys", 'w')
-              .and_yield(io)
-
-            expect(io).to receive(:puts).with("key-123\tssh-rsa foobar")
-            expect(gitlab_shell.batch_add_keys(keys)).to be_truthy
-          end
-        end
-
-        context 'invalid keys' do
-          let(:keys) { [double(shell_id: 'key-123', key: "ssh-rsa A\tSDFA\nSGADG")] }
-
-          it 'catches failure and returns false' do
-            expect(gitlab_shell.batch_add_keys(keys)).to be_falsey
-          end
-        end
-      end
+      it 'calls Gitlab::AuthorizedKeys#batch_add_keys with keys to be added' do
+        expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
 
-      context 'authorized_keys_file set' do
-        it 'calls Gitlab::AuthorizedKeys#batch_add_keys with keys to be added' do
-          expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
+        expect(gitlab_authorized_keys)
+          .to receive(:batch_add_keys)
+          .with(keys)
 
-          expect(gitlab_authorized_keys)
-            .to receive(:batch_add_keys)
-            .with(keys)
-
-          gitlab_shell.batch_add_keys(keys)
-        end
+        gitlab_shell.batch_add_keys(keys)
       end
     end
 
@@ -210,24 +112,10 @@ describe Gitlab::Shell do
         stub_application_setting(authorized_keys_enabled: false)
       end
 
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-        end
-
-        it 'does nothing' do
-          expect(IO).not_to receive(:popen)
-
-          gitlab_shell.batch_add_keys(keys)
-        end
-      end
-
-      context 'authorized_keys_file set' do
-        it 'does nothing' do
-          expect(Gitlab::AuthorizedKeys).not_to receive(:new)
+      it 'does nothing' do
+        expect(Gitlab::AuthorizedKeys).not_to receive(:new)
 
-          gitlab_shell.batch_add_keys(keys)
-        end
+        gitlab_shell.batch_add_keys(keys)
       end
     end
 
@@ -236,72 +124,25 @@ describe Gitlab::Shell do
         stub_application_setting(authorized_keys_enabled: nil)
       end
 
-      context 'authorized_keys_file not set' do
-        let(:io) { double }
+      it 'calls Gitlab::AuthorizedKeys#batch_add_keys with keys to be added' do
+        expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
 
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-          allow(gitlab_shell)
-            .to receive(:gitlab_shell_keys_path)
-            .and_return(:gitlab_shell_keys_path)
-        end
-
-        it 'calls gitlab-keys with batch-add-keys command' do
-          expect(IO)
-            .to receive(:popen)
-            .with("gitlab_shell_keys_path batch-add-keys", 'w')
-            .and_yield(io)
+        expect(gitlab_authorized_keys)
+          .to receive(:batch_add_keys)
+          .with(keys)
 
-          expect(io).to receive(:puts).with("key-123\tssh-rsa foobar")
-
-          gitlab_shell.batch_add_keys(keys)
-        end
-      end
-
-      context 'authorized_keys_file set' do
-        it 'calls Gitlab::AuthorizedKeys#batch_add_keys with keys to be added' do
-          expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
-
-          expect(gitlab_authorized_keys)
-            .to receive(:batch_add_keys)
-            .with(keys)
-
-          gitlab_shell.batch_add_keys(keys)
-        end
+        gitlab_shell.batch_add_keys(keys)
       end
     end
   end
 
   describe '#remove_key' do
     context 'when authorized_keys_enabled is true' do
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-          allow(gitlab_shell)
-            .to receive(:gitlab_shell_keys_path)
-            .and_return(:gitlab_shell_keys_path)
-        end
-
-        it 'calls #gitlab_shell_fast_execute with rm-key command' do
-          expect(gitlab_shell)
-            .to receive(:gitlab_shell_fast_execute)
-            .with([
-              :gitlab_shell_keys_path,
-              'rm-key',
-              'key-123'
-            ])
-
-          gitlab_shell.remove_key('key-123')
-        end
-      end
+      it 'calls Gitlab::AuthorizedKeys#rm_key with the key to be removed' do
+        expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
+        expect(gitlab_authorized_keys).to receive(:rm_key).with('key-123')
 
-      context 'authorized_keys_file not set' do
-        it 'calls Gitlab::AuthorizedKeys#rm_key with the key to be removed' do
-          expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
-          expect(gitlab_authorized_keys).to receive(:rm_key).with('key-123')
-
-          gitlab_shell.remove_key('key-123')
-        end
+        gitlab_shell.remove_key('key-123')
       end
     end
 
@@ -310,24 +151,10 @@ describe Gitlab::Shell do
         stub_application_setting(authorized_keys_enabled: false)
       end
 
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-        end
-
-        it 'does nothing' do
-          expect(gitlab_shell).not_to receive(:gitlab_shell_fast_execute)
+      it 'does nothing' do
+        expect(Gitlab::AuthorizedKeys).not_to receive(:new)
 
-          gitlab_shell.remove_key('key-123')
-        end
-      end
-
-      context 'authorized_keys_file set' do
-        it 'does nothing' do
-          expect(Gitlab::AuthorizedKeys).not_to receive(:new)
-
-          gitlab_shell.remove_key('key-123')
-        end
+        gitlab_shell.remove_key('key-123')
       end
     end
 
@@ -336,64 +163,22 @@ describe Gitlab::Shell do
         stub_application_setting(authorized_keys_enabled: nil)
       end
 
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-          allow(gitlab_shell)
-            .to receive(:gitlab_shell_keys_path)
-            .and_return(:gitlab_shell_keys_path)
-        end
-
-        it 'calls #gitlab_shell_fast_execute with rm-key command' do
-          expect(gitlab_shell)
-            .to receive(:gitlab_shell_fast_execute)
-            .with([
-              :gitlab_shell_keys_path,
-              'rm-key',
-              'key-123'
-            ])
-
-          gitlab_shell.remove_key('key-123')
-        end
-      end
-
-      context 'authorized_keys_file not set' do
-        it 'calls Gitlab::AuthorizedKeys#rm_key with the key to be removed' do
-          expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
-          expect(gitlab_authorized_keys).to receive(:rm_key).with('key-123')
+      it 'calls Gitlab::AuthorizedKeys#rm_key with the key to be removed' do
+        expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
+        expect(gitlab_authorized_keys).to receive(:rm_key).with('key-123')
 
-          gitlab_shell.remove_key('key-123')
-        end
+        gitlab_shell.remove_key('key-123')
       end
     end
   end
 
   describe '#remove_all_keys' do
     context 'when authorized_keys_enabled is true' do
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-          allow(gitlab_shell)
-            .to receive(:gitlab_shell_keys_path)
-            .and_return(:gitlab_shell_keys_path)
-        end
+      it 'calls Gitlab::AuthorizedKeys#clear' do
+        expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
+        expect(gitlab_authorized_keys).to receive(:clear)
 
-        it 'calls #gitlab_shell_fast_execute with clear command' do
-          expect(gitlab_shell)
-            .to receive(:gitlab_shell_fast_execute)
-            .with([:gitlab_shell_keys_path, 'clear'])
-
-          gitlab_shell.remove_all_keys
-        end
-      end
-
-      context 'authorized_keys_file set' do
-        it 'calls Gitlab::AuthorizedKeys#clear' do
-          expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
-          expect(gitlab_authorized_keys).to receive(:clear)
-
-          gitlab_shell.remove_all_keys
-        end
+        gitlab_shell.remove_all_keys
       end
     end
 
@@ -402,24 +187,10 @@ describe Gitlab::Shell do
         stub_application_setting(authorized_keys_enabled: false)
       end
 
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-        end
-
-        it 'does nothing' do
-          expect(gitlab_shell).not_to receive(:gitlab_shell_fast_execute)
+      it 'does nothing' do
+        expect(Gitlab::AuthorizedKeys).not_to receive(:new)
 
-          gitlab_shell.remove_all_keys
-        end
-      end
-
-      context 'authorized_keys_file set' do
-        it 'does nothing' do
-          expect(Gitlab::AuthorizedKeys).not_to receive(:new)
-
-          gitlab_shell.remove_all_keys
-        end
+        gitlab_shell.remove_all_keys
       end
     end
 
@@ -428,163 +199,73 @@ describe Gitlab::Shell do
         stub_application_setting(authorized_keys_enabled: nil)
       end
 
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-          allow(gitlab_shell)
-            .to receive(:gitlab_shell_keys_path)
-            .and_return(:gitlab_shell_keys_path)
-        end
-
-        it 'calls #gitlab_shell_fast_execute with clear command' do
-          expect(gitlab_shell)
-            .to receive(:gitlab_shell_fast_execute)
-            .with([:gitlab_shell_keys_path, 'clear'])
+      it 'calls Gitlab::AuthorizedKeys#clear' do
+        expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
+        expect(gitlab_authorized_keys).to receive(:clear)
 
-          gitlab_shell.remove_all_keys
-        end
-      end
-
-      context 'authorized_keys_file set' do
-        it 'calls Gitlab::AuthorizedKeys#clear' do
-          expect(Gitlab::AuthorizedKeys).to receive(:new).and_return(gitlab_authorized_keys)
-          expect(gitlab_authorized_keys).to receive(:clear)
-
-          gitlab_shell.remove_all_keys
-        end
+        gitlab_shell.remove_all_keys
       end
     end
   end
 
   describe '#remove_keys_not_found_in_db' do
     context 'when keys are in the file that are not in the DB' do
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-          gitlab_shell.remove_all_keys
-          gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
-          gitlab_shell.add_key('key-9876', 'ssh-rsa ASDFASDF')
-          @another_key = create(:key) # this one IS in the DB
-        end
-
-        it 'removes the keys' do
-          expect(gitlab_shell).to receive(:remove_key).with('key-1234')
-          expect(gitlab_shell).to receive(:remove_key).with('key-9876')
-          expect(gitlab_shell).not_to receive(:remove_key).with("key-#{@another_key.id}")
-
-          gitlab_shell.remove_keys_not_found_in_db
-        end
+      before do
+        gitlab_shell.remove_all_keys
+        gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
+        gitlab_shell.add_key('key-9876', 'ssh-rsa ASDFASDF')
+        @another_key = create(:key) # this one IS in the DB
       end
 
-      context 'authorized_keys_file set' do
-        before do
-          gitlab_shell.remove_all_keys
-          gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
-          gitlab_shell.add_key('key-9876', 'ssh-rsa ASDFASDF')
-          @another_key = create(:key) # this one IS in the DB
-        end
-
-        it 'removes the keys' do
-          expect(gitlab_shell).to receive(:remove_key).with('key-1234')
-          expect(gitlab_shell).to receive(:remove_key).with('key-9876')
-          expect(gitlab_shell).not_to receive(:remove_key).with("key-#{@another_key.id}")
+      it 'removes the keys' do
+        expect(gitlab_shell).to receive(:remove_key).with('key-1234')
+        expect(gitlab_shell).to receive(:remove_key).with('key-9876')
+        expect(gitlab_shell).not_to receive(:remove_key).with("key-#{@another_key.id}")
 
-          gitlab_shell.remove_keys_not_found_in_db
-        end
+        gitlab_shell.remove_keys_not_found_in_db
       end
     end
 
     context 'when keys there are duplicate keys in the file that are not in the DB' do
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-          gitlab_shell.remove_all_keys
-          gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
-          gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
-        end
-
-        it 'removes the keys' do
-          expect(gitlab_shell).to receive(:remove_key).with('key-1234')
-
-          gitlab_shell.remove_keys_not_found_in_db
-        end
+      before do
+        gitlab_shell.remove_all_keys
+        gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
+        gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
       end
 
-      context 'authorized_keys_file set' do
-        before do
-          gitlab_shell.remove_all_keys
-          gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
-          gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
-        end
-
-        it 'removes the keys' do
-          expect(gitlab_shell).to receive(:remove_key).with('key-1234')
+      it 'removes the keys' do
+        expect(gitlab_shell).to receive(:remove_key).with('key-1234')
 
-          gitlab_shell.remove_keys_not_found_in_db
-        end
+        gitlab_shell.remove_keys_not_found_in_db
       end
     end
 
     context 'when keys there are duplicate keys in the file that ARE in the DB' do
-      context 'authorized_keys_file not set' do
-        before do
-          stub_gitlab_shell_setting(authorized_keys_file: nil)
-          gitlab_shell.remove_all_keys
-          @key = create(:key)
-          gitlab_shell.add_key(@key.shell_id, @key.key)
-        end
-
-        it 'does not remove the key' do
-          expect(gitlab_shell).not_to receive(:remove_key).with("key-#{@key.id}")
-
-          gitlab_shell.remove_keys_not_found_in_db
-        end
+      before do
+        gitlab_shell.remove_all_keys
+        @key = create(:key)
+        gitlab_shell.add_key(@key.shell_id, @key.key)
       end
 
-      context 'authorized_keys_file set' do
-        before do
-          gitlab_shell.remove_all_keys
-          @key = create(:key)
-          gitlab_shell.add_key(@key.shell_id, @key.key)
-        end
-
-        it 'does not remove the key' do
-          expect(gitlab_shell).not_to receive(:remove_key).with("key-#{@key.id}")
+      it 'does not remove the key' do
+        expect(gitlab_shell).not_to receive(:remove_key).with("key-#{@key.id}")
 
-          gitlab_shell.remove_keys_not_found_in_db
-        end
+        gitlab_shell.remove_keys_not_found_in_db
       end
     end
 
     unless ENV['CI'] # Skip in CI, it takes 1 minute
       context 'when the first batch can be skipped, but the next batch has keys that are not in the DB' do
-        context 'authorized_keys_file not set' do
-          before do
-            stub_gitlab_shell_setting(authorized_keys_file: nil)
-            gitlab_shell.remove_all_keys
-            100.times { |i| create(:key) } # first batch is all in the DB
-            gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
-          end
-
-          it 'removes the keys not in the DB' do
-            expect(gitlab_shell).to receive(:remove_key).with('key-1234')
-
-            gitlab_shell.remove_keys_not_found_in_db
-          end
+        before do
+          gitlab_shell.remove_all_keys
+          100.times { |i| create(:key) } # first batch is all in the DB
+          gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
         end
 
-        context 'authorized_keys_file set' do
-          before do
-            gitlab_shell.remove_all_keys
-            100.times { |i| create(:key) } # first batch is all in the DB
-            gitlab_shell.add_key('key-1234', 'ssh-rsa ASDFASDF')
-          end
-
-          it 'removes the keys not in the DB' do
-            expect(gitlab_shell).to receive(:remove_key).with('key-1234')
+        it 'removes the keys not in the DB' do
+          expect(gitlab_shell).to receive(:remove_key).with('key-1234')
 
-            gitlab_shell.remove_keys_not_found_in_db
-          end
+          gitlab_shell.remove_keys_not_found_in_db
         end
       end
     end
-- 
cgit v1.2.1


From 95ffd22f07d821f223388bd60a287365d3b7d8f6 Mon Sep 17 00:00:00 2001
From: Patrick Bajao <ebajao@gitlab.com>
Date: Fri, 23 Aug 2019 13:57:22 +0800
Subject: Set default authorized_keys_file

This is the same as gitlab-shell's default. This is to ensure
that it's always set.

It needs to be the same as gitlab-shell's default because we
don't set a default value in omnibus-gitlab. If users don't
set the value of that config in their install and they upgraded,
we must ensure that it's still going to point to the same
authorized keys file.
---
 config/initializers/1_settings.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index 81433b620bc..4160f488a7a 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -515,7 +515,7 @@ Settings['sidekiq']['log_format'] ||= 'default'
 Settings['gitlab_shell'] ||= Settingslogic.new({})
 Settings.gitlab_shell['path']           = Settings.absolute(Settings.gitlab_shell['path'] || Settings.gitlab['user_home'] + '/gitlab-shell/')
 Settings.gitlab_shell['hooks_path']     = :deprecated_use_gitlab_shell_path_instead
-Settings.gitlab_shell['authorized_keys_file'] ||= nil
+Settings.gitlab_shell['authorized_keys_file'] ||= File.join(Dir.home, '.ssh', 'authorized_keys')
 Settings.gitlab_shell['secret_file'] ||= Rails.root.join('.gitlab_shell_secret')
 Settings.gitlab_shell['receive_pack']   = true if Settings.gitlab_shell['receive_pack'].nil?
 Settings.gitlab_shell['upload_pack']    = true if Settings.gitlab_shell['upload_pack'].nil?
-- 
cgit v1.2.1


From 0e33f16b5f93382214f806737d3fcf5e065c5447 Mon Sep 17 00:00:00 2001
From: Patrick Bajao <ebajao@gitlab.com>
Date: Tue, 27 Aug 2019 12:33:48 +0800
Subject: Add system check for authorized_keys file perm

This check is being removed from gitlab-shell as the file
is now being managed by gitlab-rails.
---
 lib/gitlab/authorized_keys.rb                      | 21 ++++++---
 .../app/authorized_keys_permission_check.rb        | 37 ++++++++++++++++
 lib/system_check/rake_task/app_task.rb             |  3 +-
 spec/lib/gitlab/authorized_keys_spec.rb            | 34 +++++++++++++++
 .../app/authorized_keys_permission_check_spec.rb   | 50 ++++++++++++++++++++++
 5 files changed, 138 insertions(+), 7 deletions(-)
 create mode 100644 lib/system_check/app/authorized_keys_permission_check.rb
 create mode 100644 spec/lib/system_check/app/authorized_keys_permission_check_spec.rb

diff --git a/lib/gitlab/authorized_keys.rb b/lib/gitlab/authorized_keys.rb
index 3fe72f5fd43..ca9b65b7c44 100644
--- a/lib/gitlab/authorized_keys.rb
+++ b/lib/gitlab/authorized_keys.rb
@@ -13,6 +13,15 @@ module Gitlab
       @logger = logger
     end
 
+    # Checks if the file is accessible or not
+    #
+    # @return [Boolean]
+    def accessible?
+      open_authorized_keys_file('r') { true }
+    rescue Errno::ENOENT, Errno::EACCES
+      false
+    end
+
     # Add id and its key to the authorized_keys file
     #
     # @param [String] id identifier of key prefixed by `key-`
@@ -102,10 +111,14 @@ module Gitlab
       []
     end
 
+    def file
+      @file ||= Gitlab.config.gitlab_shell.authorized_keys_file
+    end
+
     private
 
     def lock(timeout = 10)
-      File.open("#{authorized_keys_file}.lock", "w+") do |f|
+      File.open("#{file}.lock", "w+") do |f|
         f.flock File::LOCK_EX
         Timeout.timeout(timeout) { yield }
       ensure
@@ -114,7 +127,7 @@ module Gitlab
     end
 
     def open_authorized_keys_file(mode)
-      File.open(authorized_keys_file, mode, 0o600) do |file|
+      File.open(file, mode, 0o600) do |file|
         file.chmod(0o600)
         yield file
       end
@@ -141,9 +154,5 @@ module Gitlab
     def strip(key)
       key.split(/[ ]+/)[0, 2].join(' ')
     end
-
-    def authorized_keys_file
-      Gitlab.config.gitlab_shell.authorized_keys_file
-    end
   end
 end
diff --git a/lib/system_check/app/authorized_keys_permission_check.rb b/lib/system_check/app/authorized_keys_permission_check.rb
new file mode 100644
index 00000000000..1c581f88abc
--- /dev/null
+++ b/lib/system_check/app/authorized_keys_permission_check.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module SystemCheck
+  module App
+    class AuthorizedKeysPermissionCheck < SystemCheck::BaseCheck
+      set_name 'Is authorized keys file accessible?'
+      set_skip_reason 'skipped (authorized keys not enabled)'
+
+      def skip?
+        !authorized_keys_enabled?
+      end
+
+      def check?
+        authorized_keys.accessible?
+      end
+
+      def show_error
+        try_fixing_it([
+          "sudo chmod 700 #{File.dirname(authorized_keys.file)}",
+          "touch #{authorized_keys.file}",
+          "sudo chmod 600 #{authorized_keys.file}"
+        ])
+        fix_and_rerun
+      end
+
+      private
+
+      def authorized_keys_enabled?
+        Gitlab::CurrentSettings.current_application_settings.authorized_keys_enabled
+      end
+
+      def authorized_keys
+        @authorized_keys ||= Gitlab::AuthorizedKeys.new
+      end
+    end
+  end
+end
diff --git a/lib/system_check/rake_task/app_task.rb b/lib/system_check/rake_task/app_task.rb
index cc32feb8604..e98cee510ff 100644
--- a/lib/system_check/rake_task/app_task.rb
+++ b/lib/system_check/rake_task/app_task.rb
@@ -30,7 +30,8 @@ module SystemCheck
           SystemCheck::App::RubyVersionCheck,
           SystemCheck::App::GitVersionCheck,
           SystemCheck::App::GitUserDefaultSSHConfigCheck,
-          SystemCheck::App::ActiveUsersCheck
+          SystemCheck::App::ActiveUsersCheck,
+          SystemCheck::App::AuthorizedKeysPermissionCheck
         ]
       end
     end
diff --git a/spec/lib/gitlab/authorized_keys_spec.rb b/spec/lib/gitlab/authorized_keys_spec.rb
index 42bc509eeef..85d1cc3aaa3 100644
--- a/spec/lib/gitlab/authorized_keys_spec.rb
+++ b/spec/lib/gitlab/authorized_keys_spec.rb
@@ -7,6 +7,40 @@ describe Gitlab::AuthorizedKeys do
 
   subject { described_class.new(logger) }
 
+  describe '#accessible?' do
+    context 'authorized_keys file exists' do
+      before do
+        create_authorized_keys_fixture
+      end
+
+      after do
+        delete_authorized_keys_file
+      end
+
+      context 'can open file' do
+        it 'returns true' do
+          expect(subject.accessible?).to eq(true)
+        end
+      end
+
+      context 'cannot open file' do
+        before do
+          allow(File).to receive(:open).and_raise(Errno::EACCES)
+        end
+
+        it 'returns false' do
+          expect(subject.accessible?).to eq(false)
+        end
+      end
+    end
+
+    context 'authorized_keys file does not exist' do
+      it 'returns false' do
+        expect(subject.accessible?).to eq(false)
+      end
+    end
+  end
+
   describe '#add_key' do
     context 'authorized_keys file exists' do
       before do
diff --git a/spec/lib/system_check/app/authorized_keys_permission_check_spec.rb b/spec/lib/system_check/app/authorized_keys_permission_check_spec.rb
new file mode 100644
index 00000000000..0aa3539e2bd
--- /dev/null
+++ b/spec/lib/system_check/app/authorized_keys_permission_check_spec.rb
@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe SystemCheck::App::AuthorizedKeysPermissionCheck do
+  subject { described_class.new }
+
+  describe '#skip?' do
+    context 'authorized keys enabled' do
+      it 'returns false' do
+        expect(subject.skip?).to eq(false)
+      end
+    end
+
+    context 'authorized keys not enabled' do
+      before do
+        stub_application_setting(authorized_keys_enabled: false)
+      end
+
+      it 'returns true' do
+        expect(subject.skip?).to eq(true)
+      end
+    end
+  end
+
+  describe '#check?' do
+    let(:authorized_keys) { double }
+
+    before do
+      allow(Gitlab::AuthorizedKeys).to receive(:new).and_return(authorized_keys)
+      allow(authorized_keys).to receive(:accessible?).and_return(accessible?)
+    end
+
+    context 'authorized keys is accessible' do
+      let(:accessible?) { true }
+
+      it 'returns true' do
+        expect(subject.check?).to eq(true)
+      end
+    end
+
+    context 'authorized keys is not accessible' do
+      let(:accessible?) { false }
+
+      it 'returns false' do
+        expect(subject.check?).to eq(false)
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From b047359de5b365022d63b8da10a3a87f3ad92397 Mon Sep 17 00:00:00 2001
From: Patrick Bajao <ebajao@gitlab.com>
Date: Thu, 29 Aug 2019 12:21:59 +0800
Subject: Refactor specs to use one-liner expectation

---
 spec/lib/gitlab/authorized_keys_spec.rb            | 81 ++++++++++++----------
 .../app/authorized_keys_permission_check_spec.rb   | 27 +++-----
 2 files changed, 54 insertions(+), 54 deletions(-)

diff --git a/spec/lib/gitlab/authorized_keys_spec.rb b/spec/lib/gitlab/authorized_keys_spec.rb
index 85d1cc3aaa3..0aeccc256ca 100644
--- a/spec/lib/gitlab/authorized_keys_spec.rb
+++ b/spec/lib/gitlab/authorized_keys_spec.rb
@@ -5,9 +5,11 @@ require 'spec_helper'
 describe Gitlab::AuthorizedKeys do
   let(:logger) { double('logger').as_null_object }
 
-  subject { described_class.new(logger) }
+  subject(:authorized_keys) { described_class.new(logger) }
 
   describe '#accessible?' do
+    subject { authorized_keys.accessible? }
+
     context 'authorized_keys file exists' do
       before do
         create_authorized_keys_fixture
@@ -18,9 +20,7 @@ describe Gitlab::AuthorizedKeys do
       end
 
       context 'can open file' do
-        it 'returns true' do
-          expect(subject.accessible?).to eq(true)
-        end
+        it { is_expected.to be_truthy }
       end
 
       context 'cannot open file' do
@@ -28,21 +28,23 @@ describe Gitlab::AuthorizedKeys do
           allow(File).to receive(:open).and_raise(Errno::EACCES)
         end
 
-        it 'returns false' do
-          expect(subject.accessible?).to eq(false)
-        end
+        it { is_expected.to be_falsey }
       end
     end
 
     context 'authorized_keys file does not exist' do
-      it 'returns false' do
-        expect(subject.accessible?).to eq(false)
-      end
+      it { is_expected.to be_falsey }
     end
   end
 
   describe '#add_key' do
+    let(:id) { 'key-741' }
+
+    subject { authorized_keys.add_key(id, key) }
+
     context 'authorized_keys file exists' do
+      let(:key) { 'ssh-rsa AAAAB3NzaDAxx2E trailing garbage' }
+
       before do
         create_authorized_keys_fixture
       end
@@ -55,19 +57,20 @@ describe Gitlab::AuthorizedKeys do
         auth_line = "command=\"#{Gitlab.config.gitlab_shell.path}/bin/gitlab-shell key-741\",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaDAxx2E"
 
         expect(logger).to receive(:info).with('Adding key (key-741): ssh-rsa AAAAB3NzaDAxx2E')
-        expect(subject.add_key('key-741', 'ssh-rsa AAAAB3NzaDAxx2E trailing garbage'))
-          .to be_truthy
+        expect(subject).to be_truthy
         expect(File.read(tmp_authorized_keys_path)).to eq("existing content\n#{auth_line}\n")
       end
     end
 
     context 'authorized_keys file does not exist' do
+      let(:key) { 'ssh-rsa AAAAB3NzaDAxx2E' }
+
       before do
         delete_authorized_keys_file
       end
 
       it 'creates the file' do
-        expect(subject.add_key('key-741', 'ssh-rsa AAAAB3NzaDAxx2E')).to be_truthy
+        expect(subject).to be_truthy
         expect(File.exist?(tmp_authorized_keys_path)).to be_truthy
       end
     end
@@ -81,6 +84,8 @@ describe Gitlab::AuthorizedKeys do
       ]
     end
 
+    subject { authorized_keys.batch_add_keys(keys) }
+
     context 'authorized_keys file exists' do
       before do
         create_authorized_keys_fixture
@@ -96,7 +101,7 @@ describe Gitlab::AuthorizedKeys do
 
         expect(logger).to receive(:info).with('Adding key (key-12): ssh-dsa ASDFASGADG')
         expect(logger).to receive(:info).with('Adding key (key-123): ssh-rsa GFDGDFSGSDFG')
-        expect(subject.batch_add_keys(keys)).to be_truthy
+        expect(subject).to be_truthy
         expect(File.read(tmp_authorized_keys_path)).to eq("existing content\n#{auth_line1}\n#{auth_line2}\n")
       end
 
@@ -104,7 +109,7 @@ describe Gitlab::AuthorizedKeys do
         let(:keys) { [double(shell_id: 'key-123', key: "ssh-rsa A\tSDFA\nSGADG")] }
 
         it "doesn't add keys" do
-          expect(subject.batch_add_keys(keys)).to be_falsey
+          expect(subject).to be_falsey
           expect(File.read(tmp_authorized_keys_path)).to eq("existing content\n")
         end
       end
@@ -116,16 +121,28 @@ describe Gitlab::AuthorizedKeys do
       end
 
       it 'creates the file' do
-        expect(subject.batch_add_keys(keys)).to be_truthy
+        expect(subject).to be_truthy
         expect(File.exist?(tmp_authorized_keys_path)).to be_truthy
       end
     end
   end
 
   describe '#rm_key' do
+    let(:key) { 'key-741' }
+
+    subject { authorized_keys.rm_key(key) }
+
     context 'authorized_keys file exists' do
+      let(:other_line) { "command=\"#{Gitlab.config.gitlab_shell.path}/bin/gitlab-shell key-742\",options ssh-rsa AAAAB3NzaDAxx2E" }
+      let(:delete_line) { "command=\"#{Gitlab.config.gitlab_shell.path}/bin/gitlab-shell key-741\",options ssh-rsa AAAAB3NzaDAxx2E" }
+
       before do
         create_authorized_keys_fixture
+
+        File.open(tmp_authorized_keys_path, 'a') do |auth_file|
+          auth_file.puts delete_line
+          auth_file.puts other_line
+        end
       end
 
       after do
@@ -133,16 +150,10 @@ describe Gitlab::AuthorizedKeys do
       end
 
       it "removes the right line" do
-        other_line = "command=\"#{Gitlab.config.gitlab_shell.path}/bin/gitlab-shell key-742\",options ssh-rsa AAAAB3NzaDAxx2E"
-        delete_line = "command=\"#{Gitlab.config.gitlab_shell.path}/bin/gitlab-shell key-741\",options ssh-rsa AAAAB3NzaDAxx2E"
         erased_line = delete_line.gsub(/./, '#')
-        File.open(tmp_authorized_keys_path, 'a') do |auth_file|
-          auth_file.puts delete_line
-          auth_file.puts other_line
-        end
 
         expect(logger).to receive(:info).with('Removing key (key-741)')
-        expect(subject.rm_key('key-741')).to be_truthy
+        expect(subject).to be_truthy
         expect(File.read(tmp_authorized_keys_path)).to eq("existing content\n#{erased_line}\n#{other_line}\n")
       end
     end
@@ -152,13 +163,13 @@ describe Gitlab::AuthorizedKeys do
         delete_authorized_keys_file
       end
 
-      it 'returns false' do
-        expect(subject.rm_key('key-741')).to be_falsey
-      end
+      it { is_expected.to be_falsey }
     end
   end
 
   describe '#clear' do
+    subject { authorized_keys.clear }
+
     context 'authorized_keys file exists' do
       before do
         create_authorized_keys_fixture
@@ -168,9 +179,7 @@ describe Gitlab::AuthorizedKeys do
         delete_authorized_keys_file
       end
 
-      it "returns true" do
-        expect(subject.clear).to be_truthy
-      end
+      it { is_expected.to be_truthy }
     end
 
     context 'authorized_keys file does not exist' do
@@ -178,13 +187,13 @@ describe Gitlab::AuthorizedKeys do
         delete_authorized_keys_file
       end
 
-      it "still returns true" do
-        expect(subject.clear).to be_truthy
-      end
+      it { is_expected.to be_truthy }
     end
   end
 
   describe '#list_key_ids' do
+    subject { authorized_keys.list_key_ids }
+
     context 'authorized_keys file exists' do
       before do
         create_authorized_keys_fixture(
@@ -197,9 +206,7 @@ describe Gitlab::AuthorizedKeys do
         delete_authorized_keys_file
       end
 
-      it 'returns array of key IDs' do
-        expect(subject.list_key_ids).to eq([1, 2, 3, 9000])
-      end
+      it { is_expected.to eq([1, 2, 3, 9000]) }
     end
 
     context 'authorized_keys file does not exist' do
@@ -207,9 +214,7 @@ describe Gitlab::AuthorizedKeys do
         delete_authorized_keys_file
       end
 
-      it 'returns an empty array' do
-        expect(subject.list_key_ids).to be_empty
-      end
+      it { is_expected.to be_empty }
     end
   end
 
diff --git a/spec/lib/system_check/app/authorized_keys_permission_check_spec.rb b/spec/lib/system_check/app/authorized_keys_permission_check_spec.rb
index 0aa3539e2bd..ac216c1860c 100644
--- a/spec/lib/system_check/app/authorized_keys_permission_check_spec.rb
+++ b/spec/lib/system_check/app/authorized_keys_permission_check_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe SystemCheck::App::AuthorizedKeysPermissionCheck do
-  subject { described_class.new }
+  subject(:system_check) { described_class.new }
 
   describe '#skip?' do
+    subject { system_check.skip? }
+
     context 'authorized keys enabled' do
-      it 'returns false' do
-        expect(subject.skip?).to eq(false)
-      end
+      it { is_expected.to eq(false) }
     end
 
     context 'authorized keys not enabled' do
@@ -17,34 +17,29 @@ describe SystemCheck::App::AuthorizedKeysPermissionCheck do
         stub_application_setting(authorized_keys_enabled: false)
       end
 
-      it 'returns true' do
-        expect(subject.skip?).to eq(true)
-      end
+      it { is_expected.to eq(true) }
     end
   end
 
   describe '#check?' do
-    let(:authorized_keys) { double }
+    subject { system_check.check? }
 
     before do
-      allow(Gitlab::AuthorizedKeys).to receive(:new).and_return(authorized_keys)
-      allow(authorized_keys).to receive(:accessible?).and_return(accessible?)
+      expect_next_instance_of(Gitlab::AuthorizedKeys) do |instance|
+        allow(instance).to receive(:accessible?) { accessible? }
+      end
     end
 
     context 'authorized keys is accessible' do
       let(:accessible?) { true }
 
-      it 'returns true' do
-        expect(subject.check?).to eq(true)
-      end
+      it { is_expected.to eq(true) }
     end
 
     context 'authorized keys is not accessible' do
       let(:accessible?) { false }
 
-      it 'returns false' do
-        expect(subject.check?).to eq(false)
-      end
+      it { is_expected.to eq(false) }
     end
   end
 end
-- 
cgit v1.2.1


From a1ec2ad0b2638f084dffbe804b681c96dc6dadb8 Mon Sep 17 00:00:00 2001
From: Patrick Bajao <ebajao@gitlab.com>
Date: Thu, 29 Aug 2019 16:28:22 +0800
Subject: Auto create authorized_keys file if doesn't exist

Utilize the auto repair functionality of system checks.
---
 lib/gitlab/authorized_keys.rb                      |  9 ++++++
 .../app/authorized_keys_permission_check.rb        |  4 +++
 spec/lib/gitlab/authorized_keys_spec.rb            | 35 ++++++++++++++++++++++
 .../app/authorized_keys_permission_check_spec.rb   | 22 ++++++++++++++
 4 files changed, 70 insertions(+)

diff --git a/lib/gitlab/authorized_keys.rb b/lib/gitlab/authorized_keys.rb
index ca9b65b7c44..820a78b653c 100644
--- a/lib/gitlab/authorized_keys.rb
+++ b/lib/gitlab/authorized_keys.rb
@@ -22,6 +22,15 @@ module Gitlab
       false
     end
 
+    # Creates the authorized_keys file if it doesn't exist
+    #
+    # @return [Boolean]
+    def create
+      open_authorized_keys_file(File::CREAT) { true }
+    rescue Errno::EACCES
+      false
+    end
+
     # Add id and its key to the authorized_keys file
     #
     # @param [String] id identifier of key prefixed by `key-`
diff --git a/lib/system_check/app/authorized_keys_permission_check.rb b/lib/system_check/app/authorized_keys_permission_check.rb
index 1c581f88abc..1246a6875a3 100644
--- a/lib/system_check/app/authorized_keys_permission_check.rb
+++ b/lib/system_check/app/authorized_keys_permission_check.rb
@@ -14,6 +14,10 @@ module SystemCheck
         authorized_keys.accessible?
       end
 
+      def repair!
+        authorized_keys.create
+      end
+
       def show_error
         try_fixing_it([
           "sudo chmod 700 #{File.dirname(authorized_keys.file)}",
diff --git a/spec/lib/gitlab/authorized_keys_spec.rb b/spec/lib/gitlab/authorized_keys_spec.rb
index 0aeccc256ca..adf36cf1050 100644
--- a/spec/lib/gitlab/authorized_keys_spec.rb
+++ b/spec/lib/gitlab/authorized_keys_spec.rb
@@ -37,6 +37,41 @@ describe Gitlab::AuthorizedKeys do
     end
   end
 
+  describe '#create' do
+    subject { authorized_keys.create }
+
+    context 'authorized_keys file exists' do
+      before do
+        create_authorized_keys_fixture
+      end
+
+      after do
+        delete_authorized_keys_file
+      end
+
+      it { is_expected.to be_truthy }
+    end
+
+    context 'authorized_keys file does not exist' do
+      after do
+        delete_authorized_keys_file
+      end
+
+      it 'creates authorized_keys file' do
+        expect(subject).to be_truthy
+        expect(File.exist?(tmp_authorized_keys_path)).to be_truthy
+      end
+    end
+
+    context 'cannot create file' do
+      before do
+        allow(File).to receive(:open).and_raise(Errno::EACCES)
+      end
+
+      it { is_expected.to be_falsey }
+    end
+  end
+
   describe '#add_key' do
     let(:id) { 'key-741' }
 
diff --git a/spec/lib/system_check/app/authorized_keys_permission_check_spec.rb b/spec/lib/system_check/app/authorized_keys_permission_check_spec.rb
index ac216c1860c..1a8123c3f0a 100644
--- a/spec/lib/system_check/app/authorized_keys_permission_check_spec.rb
+++ b/spec/lib/system_check/app/authorized_keys_permission_check_spec.rb
@@ -42,4 +42,26 @@ describe SystemCheck::App::AuthorizedKeysPermissionCheck do
       it { is_expected.to eq(false) }
     end
   end
+
+  describe '#repair!' do
+    subject { system_check.repair! }
+
+    before do
+      expect_next_instance_of(Gitlab::AuthorizedKeys) do |instance|
+        allow(instance).to receive(:create) { created }
+      end
+    end
+
+    context 'authorized_keys file created' do
+      let(:created) { true }
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'authorized_keys file is not created' do
+      let(:created) { false }
+
+      it { is_expected.to eq(false) }
+    end
+  end
 end
-- 
cgit v1.2.1


From bea43ed6db95c02ca224bf63c8d455aaea973b52 Mon Sep 17 00:00:00 2001
From: Evan Read <eread@gitlab.com>
Date: Thu, 29 Aug 2019 08:41:11 +0000
Subject: Make Auto DevOps requirements easier to read

---
 doc/topics/autodevops/index.md | 46 ++++++++++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 17 deletions(-)

diff --git a/doc/topics/autodevops/index.md b/doc/topics/autodevops/index.md
index 19d8a6b5e2b..87dae0e7e1f 100644
--- a/doc/topics/autodevops/index.md
+++ b/doc/topics/autodevops/index.md
@@ -95,33 +95,45 @@ Auto DevOps.
 
 To make full use of Auto DevOps, you will need:
 
-- **GitLab Runner** (needed for all stages) - Your Runner needs to be
-  configured to be able to run Docker. Generally this means using the
-  [Docker](https://docs.gitlab.com/runner/executors/docker.html) or [Kubernetes
-  executor](https://docs.gitlab.com/runner/executors/kubernetes.html), with
+- **GitLab Runner** (for all stages)
+
+  Your Runner needs to be configured to be able to run Docker. Generally this
+  means using the either the [Docker](https://docs.gitlab.com/runner/executors/docker.html)
+  or [Kubernetes](https://docs.gitlab.com/runner/executors/kubernetes.html) executors, with
   [privileged mode enabled](https://docs.gitlab.com/runner/executors/docker.html#use-docker-in-docker-with-privileged-mode).
+
   The Runners do not need to be installed in the Kubernetes cluster, but the
   Kubernetes executor is easy to use and is automatically autoscaling.
   Docker-based Runners can be configured to autoscale as well, using [Docker
-  Machine](https://docs.gitlab.com/runner/install/autoscaling.html). Runners
-  should be registered as [shared Runners](../../ci/runners/README.md#registering-a-shared-runner)
+  Machine](https://docs.gitlab.com/runner/install/autoscaling.html).
+
+  Runners should be registered as [shared Runners](../../ci/runners/README.md#registering-a-shared-runner)
   for the entire GitLab instance, or [specific Runners](../../ci/runners/README.md#registering-a-specific-runner)
   that are assigned to specific projects.
-- **Base domain** (needed for Auto Review Apps and Auto Deploy) - You will need
-  a domain configured with wildcard DNS which is going to be used by all of your
-  Auto DevOps applications. [Read the specifics](#auto-devops-base-domain).
-- **Kubernetes** (needed for Auto Review Apps, Auto Deploy, and Auto Monitoring) -
-  To enable deployments, you will need Kubernetes 1.5+. You will need a [Kubernetes cluster][kubernetes-clusters]
-  for the project.
-  - **A load balancer** - You can use NGINX ingress by deploying it to your
-    Kubernetes cluster using the
-    [`nginx-ingress`](https://github.com/kubernetes/charts/tree/master/stable/nginx-ingress)
-    Helm chart.
-- **Prometheus** (needed for Auto Monitoring) - To enable Auto Monitoring, you
+- **Base domain** (for Auto Review Apps and Auto Deploy)
+
+  You will need a domain configured with wildcard DNS which is going to be used
+  by all of your Auto DevOps applications.
+
+  Read the [specifics](#auto-devops-base-domain).
+- **Kubernetes** (for Auto Review Apps, Auto Deploy, and Auto Monitoring)
+
+  To enable deployments, you will need:
+
+  - Kubernetes 1.5+.
+  - A [Kubernetes cluster][kubernetes-clusters] for the project.
+  - A load balancer. You can use NGINX ingress by deploying it to your
+    Kubernetes cluster by either:
+    - Using the [`nginx-ingress`](https://github.com/kubernetes/charts/tree/master/stable/nginx-ingress) Helm chart.
+    - Installing the Ingress [GitLab Managed App](../../user/clusters/applications.md#ingress).
+- **Prometheus** (for Auto Monitoring)
+
+  To enable Auto Monitoring, you
   will need Prometheus installed somewhere (inside or outside your cluster) and
   configured to scrape your Kubernetes cluster. To get response metrics
   (in addition to system metrics), you need to
   [configure Prometheus to monitor NGINX](../../user/project/integrations/prometheus_library/nginx_ingress.md#configuring-nginx-ingress-monitoring).
+
   The [Prometheus service](../../user/project/integrations/prometheus.md)
   integration needs to be enabled for the project, or enabled as a
   [default service template](../../user/project/integrations/services_templates.md)
-- 
cgit v1.2.1


From 1e2f46f864fcb3defb231a52e0eb06de2449366d Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Thu, 29 Aug 2019 08:50:59 +0000
Subject: Fix capitalization in more docs

Fix capitalization in docs for works like GitLab, Git
Omnibus, etc
---
 .../corporate_contributor_license_agreement.md     |  2 +-
 doc/migrate_ci_to_ce/README.md                     |  4 +--
 doc/push_rules/push_rules.md                       |  6 ++--
 doc/security/information_exclusivity.md            |  2 +-
 doc/update/patch_versions.md                       |  6 ++--
 doc/update/upgrading_from_ce_to_ee.md              |  3 +-
 doc/update/upgrading_from_source.md                | 17 +++++----
 doc/update/upgrading_postgresql_using_slony.md     |  2 +-
 doc/user/markdown.md                               |  4 +--
 doc/user/reserved_names.md                         | 42 +++++++++++-----------
 doc/workflow/git_annex.md                          | 12 +++----
 doc/workflow/releases.md                           |  8 ++---
 doc/workflow/time_tracking.md                      |  2 +-
 doc/workflow/timezone.md                           |  2 +-
 14 files changed, 55 insertions(+), 57 deletions(-)

diff --git a/doc/legal/corporate_contributor_license_agreement.md b/doc/legal/corporate_contributor_license_agreement.md
index 8c1f4a126b1..c8782a2cfc2 100644
--- a/doc/legal/corporate_contributor_license_agreement.md
+++ b/doc/legal/corporate_contributor_license_agreement.md
@@ -16,7 +16,7 @@ You accept and agree to the following terms and conditions for Your present and
 
   Subject to the terms and conditions of this Agreement, You hereby grant to GitLab B.V. and to recipients of software distributed by GitLab B.V. a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by You that are necessarily infringed by Your Contribution(s) alone or by combination of Your Contribution(s) with the Work to which such Contribution(s) was submitted. If any entity institutes patent litigation against You or any other entity (including a cross-claim or counterclaim in a lawsuit) alleging that your Contribution, or the Work to which you have contributed, constitutes direct or contributory patent infringement, then any patent licenses granted to that entity under this Agreement for that Contribution or Work shall terminate as of the date such litigation is filed.
 
-  You represent that You are legally entitled to grant the above license. You represent further that each of Your employees is authorized to submit Contributions on Your behalf, but excluding employees that are designated in writing by You as "Not authorized to submit Contributions on behalf of (name of Your corporation here)." Such designations of exclusion for unauthorized employees are to be submitted via email to legal@gitlab.com. It is Your responsibility to notify GitLab B.V. when any change is required to the list of designated employees excluded from submitting Contributions on Your behalf. Such notification should also be sent via email to legal@gitlab.com.
+  You represent that You are legally entitled to grant the above license. You represent further that each of Your employees is authorized to submit Contributions on Your behalf, but excluding employees that are designated in writing by You as "Not authorized to submit Contributions on behalf of (name of Your corporation here)." Such designations of exclusion for unauthorized employees are to be submitted via email to `legal@gitlab.com`. It is Your responsibility to notify GitLab B.V. when any change is required to the list of designated employees excluded from submitting Contributions on Your behalf. Such notification should also be sent via email to `legal@gitlab.com`.
 
 - **Contributions:**
 
diff --git a/doc/migrate_ci_to_ce/README.md b/doc/migrate_ci_to_ce/README.md
index 2b8379141c3..50e491f29a2 100644
--- a/doc/migrate_ci_to_ce/README.md
+++ b/doc/migrate_ci_to_ce/README.md
@@ -32,7 +32,7 @@ upgrade to 8.0 until you finish the migration procedure.
 
 ## Before upgrading
 
-If you have GitLab CI installed using omnibus-gitlab packages but **you don't want to migrate your existing data**:
+If you have GitLab CI installed using Omnibus GitLab packages but **you don't want to migrate your existing data**:
 
 ```bash
 mv /var/opt/gitlab/gitlab-ci/builds /var/opt/gitlab/gitlab-ci/builds.$(date +%s)
@@ -353,7 +353,7 @@ Errno::EACCES: Permission denied @ rb_sysopen - config/secrets.yml
 This can happen if you are updating from versions prior to 7.13 straight to 8.0.
 The fix for this is to update to Omnibus 7.14 first and then update it to 8.0.
 
-### Permission denied when accessing /var/opt/gitlab/gitlab-ci/builds
+### Permission denied when accessing `/var/opt/gitlab/gitlab-ci/builds`
 
 To fix that issue you have to change builds/ folder permission before doing final backup:
 
diff --git a/doc/push_rules/push_rules.md b/doc/push_rules/push_rules.md
index b1754131e76..7455b577af7 100644
--- a/doc/push_rules/push_rules.md
+++ b/doc/push_rules/push_rules.md
@@ -10,7 +10,7 @@ regular expressions to reject pushes based on commit contents, branch names or f
 ## Overview
 
 GitLab already offers [protected branches][protected-branches], but there are
-cases when you need some specific rules like preventing git tag removal or
+cases when you need some specific rules like preventing Git tag removal or
 enforcing a special format for commit messages.
 
 Push rules are essentially [pre-receive Git hooks][hooks] that are easy to
@@ -27,7 +27,7 @@ Every push rule could have its own use case, but let's consider some examples.
 Let's assume you have the following requirements for your workflow:
 
 - every commit should reference a Jira issue, for example: `Refactored css. Fixes JIRA-123.`
-- users should not be able to remove git tags with `git push`
+- users should not be able to remove Git tags with `git push`
 
 All you need to do is write a simple regular expression that requires the mention
 of a Jira issue in the commit message, like `JIRA\-\d+`.
@@ -64,7 +64,7 @@ The following options are available.
 
 | Push rule | GitLab version | Description |
 | --------- | :------------: | ----------- |
-| Removal of tags with `git push` | **Starter** 7.10 | Forbid users to remove git tags with `git push`. Tags will still be able to be deleted through the web UI. |
+| Removal of tags with `git push` | **Starter** 7.10 | Forbid users to remove Git tags with `git push`. Tags will still be able to be deleted through the web UI. |
 | Check whether author is a GitLab user | **Starter** 7.10 | Restrict commits by author (email) to existing GitLab users. |
 | Committer restriction | **Premium** 10.2 | GitLab will reject any commit that was not committed by the current authenticated user |
 | Check whether commit is signed through GPG | **Premium** 10.1 | Reject commit when it is not signed through GPG. Read [signing commits with GPG][signing-commits]. |
diff --git a/doc/security/information_exclusivity.md b/doc/security/information_exclusivity.md
index 749ccf924b5..7c3d7284f25 100644
--- a/doc/security/information_exclusivity.md
+++ b/doc/security/information_exclusivity.md
@@ -15,7 +15,7 @@ another project that is under their control, or onto another server.
 Therefore, it is impossible to build access controls that prevent the
 intentional sharing of source code by users that have access to the source code.
 
-This is an inherent feature of a DVCS. All git management systems have this
+This is an inherent feature of a DVCS. All Git management systems have this
 limitation.
 
 You can take steps to prevent unintentional sharing and information
diff --git a/doc/update/patch_versions.md b/doc/update/patch_versions.md
index 6a41c6aec32..3c9fcbf7c7d 100644
--- a/doc/update/patch_versions.md
+++ b/doc/update/patch_versions.md
@@ -64,7 +64,7 @@ sudo -u git -H bundle exec rake gettext:po_to_json RAILS_ENV=production
 sudo -u git -H bundle exec rake yarn:install gitlab:assets:clean gitlab:assets:compile cache:clear RAILS_ENV=production NODE_ENV=production NODE_OPTIONS="--max_old_space_size=4096"
 ```
 
-### 4. Update gitlab-workhorse to the corresponding version
+### 4. Update GitLab Workhorse to the corresponding version
 
 ```bash
 cd /home/git/gitlab
@@ -80,7 +80,7 @@ cd /home/git/gitlab
 sudo -u git -H bundle exec rake "gitlab:gitaly:install[/home/git/gitaly,/home/git/repositories]" RAILS_ENV=production
 ```
 
-### 6. Update gitlab-shell to the corresponding version
+### 6. Update GitLab Shell to the corresponding version
 
 ```bash
 cd /home/git/gitlab-shell
@@ -90,7 +90,7 @@ sudo -u git -H git checkout v$(</home/git/gitlab/GITLAB_SHELL_VERSION) -b v$(</h
 sudo -u git -H sh -c 'if [ -x bin/compile ]; then bin/compile; fi'
 ```
 
-### 7. Update gitlab-pages to the corresponding version (skip if not using pages)
+### 7. Update GitLab Pages to the corresponding version (skip if not using pages)
 
 ```bash
 cd /home/git/gitlab-pages
diff --git a/doc/update/upgrading_from_ce_to_ee.md b/doc/update/upgrading_from_ce_to_ee.md
index 49e2fb2568e..9ac73725f87 100644
--- a/doc/update/upgrading_from_ce_to_ee.md
+++ b/doc/update/upgrading_from_ce_to_ee.md
@@ -17,7 +17,7 @@ GitLab edition you are using (Community or Enterprise), see the
 
 This guide assumes you have a correctly configured and tested installation of
 GitLab Community Edition. If you run into any trouble or if you have any
-questions please contact us at [support@gitlab.com].
+questions please contact us at `support@gitlab.com`.
 
 In all examples, replace `EE_BRANCH` with the Enterprise Edition branch for the
 version you are using, and `CE_BRANCH` with the Community Edition branch.
@@ -131,5 +131,4 @@ Example:
 Additional instructions here.
 -->
 
-[support@gitlab.com]: mailto:support@gitlab.com
 [old-ee-upgrade-docs]: https://gitlab.com/gitlab-org/gitlab-ee/tree/11-8-stable-ee/doc/update
diff --git a/doc/update/upgrading_from_source.md b/doc/update/upgrading_from_source.md
index f6b64dcf694..890a5ec8698 100644
--- a/doc/update/upgrading_from_source.md
+++ b/doc/update/upgrading_from_source.md
@@ -118,7 +118,7 @@ sudo ln -sf /usr/local/go/bin/{go,godoc,gofmt} /usr/local/bin/
 rm go1.11.10.linux-amd64.tar.gz
 ```
 
-### 6. Update git
+### 6. Update Git
 
 NOTE: **Note:**
 GitLab 11.11 and higher only supports Git 2.21.x and newer, and
@@ -186,7 +186,7 @@ cd /home/git/gitlab
 sudo -u git -H git checkout BRANCH-ee
 ```
 
-### 8. Update gitlab-shell
+### 8. Update GitLab Shell
 
 ```bash
 cd /home/git/gitlab-shell
@@ -196,9 +196,9 @@ sudo -u git -H git checkout v$(</home/git/gitlab/GITLAB_SHELL_VERSION)
 sudo -u git -H bin/compile
 ```
 
-### 9. Update gitlab-workhorse
+### 9. Update GitLab Workhorse
 
-Install and compile gitlab-workhorse. GitLab-Workhorse uses
+Install and compile GitLab Workhorse. GitLab Workhorse uses
 [GNU Make](https://www.gnu.org/software/make/).
 If you are not using Linux you may have to run `gmake` instead of
 `make` below.
@@ -222,11 +222,11 @@ sudo -u git -H git checkout v$(</home/git/gitlab/GITALY_SERVER_VERSION)
 sudo -u git -H make
 ```
 
-### 11. Update gitlab-pages
+### 11. Update GitLab Pages
 
 #### Only needed if you use GitLab Pages
 
-Install and compile gitlab-pages. GitLab-Pages uses
+Install and compile GitLab Pages. GitLab Pages uses
 [GNU Make](https://www.gnu.org/software/make/).
 If you are not using Linux you may have to run `gmake` instead of
 `make` below.
@@ -273,8 +273,8 @@ longer handles setting it.
 
 If you are using Apache instead of NGINX please see the updated [Apache templates].
 Also note that because Apache does not support upstreams behind Unix sockets you
-will need to let gitlab-workhorse listen on a TCP port. You can do this
-via [/etc/default/gitlab].
+will need to let GitLab Workhorse listen on a TCP port. You can do this
+via [`/etc/default/gitlab`](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/lib/support/init.d/gitlab.default.example#L38).
 
 #### SMTP configuration
 
@@ -404,4 +404,3 @@ If you have more than one backup `*.tar` file(s) please add `BACKUP=timestamp_of
 [gl-example]: https://gitlab.com/gitlab-org/gitlab-ce/blob/master/lib/support/init.d/gitlab.default.example
 [smtp_settings.rb.sample]: https://gitlab.com/gitlab-org/gitlab-ce/blob/master/config/initializers/smtp_settings.rb.sample#L13
 [Apache templates]: https://gitlab.com/gitlab-org/gitlab-recipes/tree/master/web-server/apache
-[/etc/default/gitlab]: https://gitlab.com/gitlab-org/gitlab-ce/blob/master/lib/support/init.d/gitlab.default.example#L38
diff --git a/doc/update/upgrading_postgresql_using_slony.md b/doc/update/upgrading_postgresql_using_slony.md
index 835166837a8..cf3a389b149 100644
--- a/doc/update/upgrading_postgresql_using_slony.md
+++ b/doc/update/upgrading_postgresql_using_slony.md
@@ -77,7 +77,7 @@ make
 make install
 ```
 
-This assumes you have installed GitLab into /opt/gitlab.
+This assumes you have installed GitLab into `/opt/gitlab`.
 
 To test if Slony is installed properly, run the following commands:
 
diff --git a/doc/user/markdown.md b/doc/user/markdown.md
index 840e1856dd9..edf2fedab3c 100644
--- a/doc/user/markdown.md
+++ b/doc/user/markdown.md
@@ -1148,7 +1148,7 @@ GFM will autolink almost any URL you put into your text:
 - https://google.com/
 - ftp://ftp.us.debian.org/debian/
 - smb://foo/bar/baz
-- irc://irc.freenode.net/gitlab
+- irc://irc.freenode.net/
 - http://localhost:3000
 ```
 
@@ -1156,7 +1156,7 @@ GFM will autolink almost any URL you put into your text:
 - <https://google.com/>
 - <ftp://ftp.us.debian.org/debian/>
 - <smb://foo/bar/baz>
-- <irc://irc.freenode.net/gitlab>
+- <irc://irc.freenode.net/>
 - <http://localhost:3000>
 
 ### Lists
diff --git a/doc/user/reserved_names.md b/doc/user/reserved_names.md
index 68532ccee65..45ece5f048e 100644
--- a/doc/user/reserved_names.md
+++ b/doc/user/reserved_names.md
@@ -14,27 +14,27 @@ For a list of words that are not allowed to be used as group or project names, s
 
 It is currently not possible to create a project with the following names:
 
-- \-
-- badges
-- blame
-- blob
-- builds
-- commits
-- create
-- create_dir
-- edit
-- environments/folders
-- files
-- find_file
-- gitlab-lfs/objects
-- info/lfs/objects
-- new
-- preview
-- raw
-- refs
-- tree
-- update
-- wikis
+- `\-`
+- `badges`
+- `blame`
+- `blob`
+- `builds`
+- `commits`
+- `create`
+- `create_dir`
+- `edit`
+- `environments/folders`
+- `files`
+- `find_file`
+- `gitlab-lfs/objects`
+- `info/lfs/objects`
+- `new`
+- `preview`
+- `raw`
+- `refs`
+- `tree`
+- `update`
+- `wikis`
 
 ## Reserved group names
 
diff --git a/doc/workflow/git_annex.md b/doc/workflow/git_annex.md
index cdc38a5b7eb..c3865aa953b 100644
--- a/doc/workflow/git_annex.md
+++ b/doc/workflow/git_annex.md
@@ -2,7 +2,7 @@
 
 > **Warning:** GitLab has [completely
 removed][deprecate-annex-issue] in GitLab 9.0 (2017/03/22).
-Read through the [migration guide from git-annex to git-lfs][guide].
+Read through the [migration guide from git-annex to Git LFS][guide].
 
 The biggest limitation of Git, compared to some older centralized version
 control systems, has been the maximum size of the repositories.
@@ -51,7 +51,7 @@ sudo yum install epel-release && sudo yum install git-annex
 
 ### Configuration for Omnibus packages
 
-For omnibus-gitlab packages, only one configuration setting is needed.
+For Omnibus GitLab packages, only one configuration setting is needed.
 The Omnibus package will internally set the correct options in all locations.
 
 1. In `/etc/gitlab/gitlab.rb` add the following line:
@@ -67,7 +67,7 @@ The Omnibus package will internally set the correct options in all locations.
 There are 2 settings to enable git-annex on your GitLab server.
 
 One is located in `config/gitlab.yml` of the GitLab repository and the other
-one is located in `config.yml` of gitlab-shell.
+one is located in `config.yml` of GitLab Shell.
 
 1. In `config/gitlab.yml` add or edit the following lines:
 
@@ -76,7 +76,7 @@ one is located in `config.yml` of gitlab-shell.
      git_annex_enabled: true
    ```
 
-1. In `config.yml` of gitlab-shell add or edit the following lines:
+1. In `config.yml` of GitLab Shell add or edit the following lines:
 
    ```yaml
    git_annex_enabled: true
@@ -184,7 +184,7 @@ access files of projects you have access to (developer, maintainer, or owner rol
 
 Internally GitLab uses [GitLab Shell] to handle SSH access and this was a great
 integration point for `git-annex`.
-There is a setting in gitlab-shell so you can disable GitLab Annex support
+There is a setting in GitLab Shell so you can disable GitLab Annex support
 if you want to.
 
 ## Troubleshooting tips
@@ -200,7 +200,7 @@ searching for your distribution.
 Although there is no general guide for `git-annex` errors, there are a few tips
 on how to go around the warnings.
 
-### git-annex-shell: Not a git-annex or gcrypt repository
+### `git-annex-shell: Not a git-annex or gcrypt repository`
 
 This warning can appear on the initial `git annex sync --content` and is caused
 by differences in `git-annex-shell`. You can read more about it
diff --git a/doc/workflow/releases.md b/doc/workflow/releases.md
index 00cddda24a4..1fd63a556c6 100644
--- a/doc/workflow/releases.md
+++ b/doc/workflow/releases.md
@@ -3,20 +3,20 @@
 NOTE: In GitLab 11.7, we introduced the full fledged [Releases](../user/project/releases/index.md)
 feature. You can still create release notes on this page, but the new method is preferred.
 
-You can add release notes to any git tag using the notes feature. Release notes
+You can add release notes to any Git tag using the notes feature. Release notes
 behave like any other markdown form in GitLab so you can write text and
 drag-n-drop files to it. Release notes are stored in GitLab's database.
 
 There are several ways to add release notes:
 
-- In the interface, when you create a new git tag
-- In the interface, by adding a note to an existing git tag
+- In the interface, when you create a new Git tag
+- In the interface, by adding a note to an existing Git tag
 - Using the GitLab API
 
 ## New tag page with release notes text area
 
 ![new_tag](releases/new_tag.png)
 
-## Tags page with button to add or edit release notes for existing git tag
+## Tags page with button to add or edit release notes for existing Git tag
 
 ![tags](releases/tags.png)
diff --git a/doc/workflow/time_tracking.md b/doc/workflow/time_tracking.md
index fad853f8a44..3d9f015b1fe 100644
--- a/doc/workflow/time_tracking.md
+++ b/doc/workflow/time_tracking.md
@@ -84,4 +84,4 @@ With this option enabled, `75h` is displayed instead of `1w 4d 3h`.
 
 ## Other interesting links
 
-- [Time Tracking landing page on about.gitlab.com](https://about.gitlab.com/solutions/time-tracking/)
+- [Time Tracking landing page in the GitLab handbook](https://about.gitlab.com/solutions/time-tracking/)
diff --git a/doc/workflow/timezone.md b/doc/workflow/timezone.md
index 60a4d0f19de..4101f891484 100644
--- a/doc/workflow/timezone.md
+++ b/doc/workflow/timezone.md
@@ -17,7 +17,7 @@ For Omnibus installations, run `gitlab-rake time:zones:all`.
 NOTE: **Note:**
 Currently, this rake task does not list timezones in TZInfo format required by GitLab Omnibus during a reconfigure: [#58672](https://gitlab.com/gitlab-org/gitlab-ce/issues/58672).
 
-## Changing time zone in omnibus installations
+## Changing time zone in Omnibus installations
 
 GitLab defaults its time zone to UTC. It has a global timezone configuration parameter in `/etc/gitlab/gitlab.rb`.
 
-- 
cgit v1.2.1


From b49104f754a43714efa4875ad702f3517af6848d Mon Sep 17 00:00:00 2001
From: Samantha Ming <sming@gitlab.com>
Date: Thu, 29 Aug 2019 09:00:54 +0000
Subject: Update documentation screenshot

---
 .../img/approvals_premium_project_edit_v12_3.png    | Bin 24542 -> 21908 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/doc/user/project/merge_requests/img/approvals_premium_project_edit_v12_3.png b/doc/user/project/merge_requests/img/approvals_premium_project_edit_v12_3.png
index 32b9a3b9ce4..bbb131e86e9 100644
Binary files a/doc/user/project/merge_requests/img/approvals_premium_project_edit_v12_3.png and b/doc/user/project/merge_requests/img/approvals_premium_project_edit_v12_3.png differ
-- 
cgit v1.2.1


From 8a5aa52813b8aa54ea3de2a860dc853038fac616 Mon Sep 17 00:00:00 2001
From: Nailia Iskhakova <niskhakova@gitlab.com>
Date: Thu, 29 Aug 2019 09:30:04 +0000
Subject: Add E2E spec to ensure that issue closes

Add E2E spec to test that issue closes with commit message
---
 app/views/projects/commit/_commit_box.html.haml    |  2 +-
 .../shared/issuable/_close_reopen_button.html.haml |  2 +-
 app/views/shared/issuable/_nav.html.haml           |  2 +-
 qa/qa/page/project/commit/show.rb                  |  5 ++
 qa/qa/page/project/issue/index.rb                  |  8 +++
 qa/qa/page/project/issue/show.rb                   |  4 ++
 .../browser_ui/2_plan/issue/close_issue_spec.rb    | 57 ++++++++++++++++++++++
 7 files changed, 77 insertions(+), 3 deletions(-)
 create mode 100644 qa/qa/specs/features/browser_ui/2_plan/issue/close_issue_spec.rb

diff --git a/app/views/projects/commit/_commit_box.html.haml b/app/views/projects/commit/_commit_box.html.haml
index a766dd51463..6c77036a85b 100644
--- a/app/views/projects/commit/_commit_box.html.haml
+++ b/app/views/projects/commit/_commit_box.html.haml
@@ -5,7 +5,7 @@
     = render partial: 'signature', object: @commit.signature
     %strong
       #{ s_('CommitBoxTitle|Commit') }
-      %span.commit-sha= @commit.short_id
+      %span.commit-sha{ data: { qa_selector: 'commit_sha_content' } }= @commit.short_id
     = clipboard_button(text: @commit.id, title: _('Copy commit SHA to clipboard'))
     %span.d-none.d-sm-inline= _('authored')
     #{time_ago_with_tooltip(@commit.authored_date)}
diff --git a/app/views/shared/issuable/_close_reopen_button.html.haml b/app/views/shared/issuable/_close_reopen_button.html.haml
index 4f6a71b6071..875cacd1f4f 100644
--- a/app/views/shared/issuable/_close_reopen_button.html.haml
+++ b/app/views/shared/issuable/_close_reopen_button.html.haml
@@ -9,7 +9,7 @@
               class: "d-none d-sm-none d-md-block btn btn-grouped btn-close js-btn-issue-action #{issuable_button_visibility(issuable, true)}", title: "Close #{display_issuable_type}"
   - if can_reopen
     = link_to "Reopen #{display_issuable_type}", reopen_issuable_path(issuable), method: button_method,
-              class: "d-none d-sm-none d-md-block btn btn-grouped btn-reopen js-btn-issue-action #{issuable_button_visibility(issuable, false)}", title: "Reopen #{display_issuable_type}"
+              class: "d-none d-sm-none d-md-block btn btn-grouped btn-reopen js-btn-issue-action #{issuable_button_visibility(issuable, false)}", title: "Reopen #{display_issuable_type}", data: { qa_selector: 'reopen_issue_button' }
 - else
   - if can_update && !are_close_and_open_buttons_hidden
     = render 'shared/issuable/close_reopen_report_toggle', issuable: issuable
diff --git a/app/views/shared/issuable/_nav.html.haml b/app/views/shared/issuable/_nav.html.haml
index 71123740ee4..93408e0bfc0 100644
--- a/app/views/shared/issuable/_nav.html.haml
+++ b/app/views/shared/issuable/_nav.html.haml
@@ -17,7 +17,7 @@
         #{issuables_state_counter_text(type, :closed, display_count)}
   - else
     %li{ class: active_when(params[:state] == 'closed') }>
-      = link_to page_filter_path(state: 'closed'), id: 'state-closed', title: 'Filter by issues that are currently closed.', data: { state: 'closed' } do
+      = link_to page_filter_path(state: 'closed'), id: 'state-closed', title: 'Filter by issues that are currently closed.', data: { state: 'closed', qa_selector: 'closed_issues_link' } do
         #{issuables_state_counter_text(type, :closed, display_count)}
 
   = render 'shared/issuable/nav_links/all', page_context_word: page_context_word, counter: issuables_state_counter_text(type, :all, display_count)
diff --git a/qa/qa/page/project/commit/show.rb b/qa/qa/page/project/commit/show.rb
index 9770b8a657c..ba09dd1b92a 100644
--- a/qa/qa/page/project/commit/show.rb
+++ b/qa/qa/page/project/commit/show.rb
@@ -9,6 +9,7 @@ module QA
             element :options_button
             element :email_patches
             element :plain_diff
+            element :commit_sha_content
           end
 
           def select_email_patches
@@ -20,6 +21,10 @@ module QA
             click_element :options_button
             click_element :plain_diff
           end
+
+          def commit_sha
+            find_element(:commit_sha_content).text
+          end
         end
       end
     end
diff --git a/qa/qa/page/project/issue/index.rb b/qa/qa/page/project/issue/index.rb
index c4383951ec4..45270bca623 100644
--- a/qa/qa/page/project/issue/index.rb
+++ b/qa/qa/page/project/issue/index.rb
@@ -9,9 +9,17 @@ module QA
             element :issue_link, 'link_to issue.title' # rubocop:disable QA/ElementWithPattern
           end
 
+          view 'app/views/shared/issuable/_nav.html.haml' do
+            element :closed_issues_link
+          end
+
           def click_issue_link(title)
             click_link(title)
           end
+
+          def click_closed_issues_link
+            click_element :closed_issues_link
+          end
         end
       end
     end
diff --git a/qa/qa/page/project/issue/show.rb b/qa/qa/page/project/issue/show.rb
index 45dad9bc0ae..1402d935cc7 100644
--- a/qa/qa/page/project/issue/show.rb
+++ b/qa/qa/page/project/issue/show.rb
@@ -37,6 +37,10 @@ module QA
             element :dropdown_menu_labels
           end
 
+          view 'app/views/shared/issuable/_close_reopen_button.html.haml' do
+            element :reopen_issue_button
+          end
+
           # Adds a comment to an issue
           # attachment option should be an absolute path
           def comment(text, attachment: nil, filter: :all_activities)
diff --git a/qa/qa/specs/features/browser_ui/2_plan/issue/close_issue_spec.rb b/qa/qa/specs/features/browser_ui/2_plan/issue/close_issue_spec.rb
new file mode 100644
index 00000000000..7b6a3579af0
--- /dev/null
+++ b/qa/qa/specs/features/browser_ui/2_plan/issue/close_issue_spec.rb
@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module QA
+  context 'Plan' do
+    describe 'Close issue' do
+      let(:issue_title) { 'issue title' }
+      let(:commit_message) { 'Closes' }
+
+      before do
+        Runtime::Browser.visit(:gitlab, Page::Main::Login)
+        Page::Main::Login.perform(&:sign_in_using_credentials)
+
+        issue = Resource::Issue.fabricate_via_api! do |issue|
+          issue.title = issue_title
+        end
+
+        @project = issue.project
+        @issue_id = issue.api_response[:iid]
+
+        # Initial commit should be pushed because
+        # the very first commit to the project doesn't close the issue
+        # https://gitlab.com/gitlab-org/gitlab-ce/issues/38965
+        push_commit('Initial commit')
+      end
+
+      it 'user closes an issue by pushing commit' do
+        push_commit("#{commit_message} ##{@issue_id}", false)
+
+        @project.visit!
+        Page::Project::Show.perform do |show|
+          show.click_commit(commit_message)
+        end
+        commit_sha = Page::Project::Commit::Show.perform(&:commit_sha)
+
+        Page::Project::Menu.perform(&:click_issues)
+        Page::Project::Issue::Index.perform do |index|
+          index.click_closed_issues_link
+          index.click_issue_link(issue_title)
+        end
+
+        Page::Project::Issue::Show.perform do |show|
+          expect(show).to have_element(:reopen_issue_button)
+          expect(show).to have_content("closed via commit #{commit_sha}")
+        end
+      end
+
+      def push_commit(commit_message, new_branch = true)
+        Resource::Repository::ProjectPush.fabricate! do |push|
+          push.commit_message = commit_message
+          push.new_branch = new_branch
+          push.file_content = commit_message
+          push.project = @project
+        end
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 7e145fd6e3c5fa9a27a75ca9f1f25c6226129fac Mon Sep 17 00:00:00 2001
From: "Balasankar \"Balu\" C" <balasankar@gitlab.com>
Date: Thu, 29 Aug 2019 16:27:09 +0530
Subject: Use new location for gitlab-runner helm charts

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>
---
 app/assets/javascripts/clusters/stores/clusters_store.js     | 2 +-
 changelogs/unreleased/runner-chart-repo-use-new-location.yml | 5 +++++
 doc/user/clusters/applications.md                            | 2 +-
 spec/frontend/clusters/components/application_row_spec.js    | 2 +-
 spec/frontend/clusters/stores/clusters_store_spec.js         | 2 +-
 5 files changed, 9 insertions(+), 4 deletions(-)
 create mode 100644 changelogs/unreleased/runner-chart-repo-use-new-location.yml

diff --git a/app/assets/javascripts/clusters/stores/clusters_store.js b/app/assets/javascripts/clusters/stores/clusters_store.js
index ada5a49e246..772f16cab4e 100644
--- a/app/assets/javascripts/clusters/stores/clusters_store.js
+++ b/app/assets/javascripts/clusters/stores/clusters_store.js
@@ -55,7 +55,7 @@ export default class ClusterStore {
           ...applicationInitialState,
           title: s__('ClusterIntegration|GitLab Runner'),
           version: null,
-          chartRepo: 'https://gitlab.com/charts/gitlab-runner',
+          chartRepo: 'https://gitlab.com/gitlab-org/charts/gitlab-runner',
           updateAvailable: null,
           updateSuccessful: false,
           updateFailed: false,
diff --git a/changelogs/unreleased/runner-chart-repo-use-new-location.yml b/changelogs/unreleased/runner-chart-repo-use-new-location.yml
new file mode 100644
index 00000000000..790e5704c04
--- /dev/null
+++ b/changelogs/unreleased/runner-chart-repo-use-new-location.yml
@@ -0,0 +1,5 @@
+---
+title: Use new location for gitlab-runner helm charts
+merge_request: 32384
+author:
+type: other
diff --git a/doc/user/clusters/applications.md b/doc/user/clusters/applications.md
index 743d708399c..40ed0db4c57 100644
--- a/doc/user/clusters/applications.md
+++ b/doc/user/clusters/applications.md
@@ -103,7 +103,7 @@ implications](../project/clusters/index.md#security-implications) before doing s
 
 NOTE: **Note:**
 The
-[runner/gitlab-runner](https://gitlab.com/charts/gitlab-runner)
+[runner/gitlab-runner](https://gitlab.com/gitlab-org/charts/gitlab-runner)
 chart is used to install this application with a
 [`values.yaml`](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/vendor/runner/values.yaml)
 file.
diff --git a/spec/frontend/clusters/components/application_row_spec.js b/spec/frontend/clusters/components/application_row_spec.js
index 9f127ccb690..41da4125a20 100644
--- a/spec/frontend/clusters/components/application_row_spec.js
+++ b/spec/frontend/clusters/components/application_row_spec.js
@@ -371,7 +371,7 @@ describe('Application Row', () => {
 
     it('contains a link to the chart repo if application has been updated', () => {
       const version = '0.1.45';
-      const chartRepo = 'https://gitlab.com/charts/gitlab-runner';
+      const chartRepo = 'https://gitlab.com/gitlab-org/charts/gitlab-runner';
       vm = mountComponent(ApplicationRow, {
         ...DEFAULT_APPLICATION_STATE,
         status: APPLICATION_STATUS.INSTALLED,
diff --git a/spec/frontend/clusters/stores/clusters_store_spec.js b/spec/frontend/clusters/stores/clusters_store_spec.js
index f2cc413512d..c168bce7a4e 100644
--- a/spec/frontend/clusters/stores/clusters_store_spec.js
+++ b/spec/frontend/clusters/stores/clusters_store_spec.js
@@ -86,7 +86,7 @@ describe('Clusters Store', () => {
             requestReason: null,
             version: mockResponseData.applications[2].version,
             updateAvailable: mockResponseData.applications[2].update_available,
-            chartRepo: 'https://gitlab.com/charts/gitlab-runner',
+            chartRepo: 'https://gitlab.com/gitlab-org/charts/gitlab-runner',
             installed: false,
             installFailed: false,
             updateFailed: false,
-- 
cgit v1.2.1


From c3a43cc82a4c4cc0d42c10ca09fc0cf0c7fe9c8b Mon Sep 17 00:00:00 2001
From: James Ramsay <james@jramsay.com.au>
Date: Wed, 28 Aug 2019 12:00:45 +0300
Subject: Remove bad url from partial clone docs

---
 doc/topics/git/partial_clone.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/topics/git/partial_clone.md b/doc/topics/git/partial_clone.md
index ea4223355d8..c9a5430b2c6 100644
--- a/doc/topics/git/partial_clone.md
+++ b/doc/topics/git/partial_clone.md
@@ -112,7 +112,7 @@ enabled on the Git server:
    git init
 
    # Add the remote
-   git remote add origin git@gitlab.com/example/jumbo-repo
+   git remote add origin <url>
 
    # Enable partial clone support for the remote
    git config --local extensions.partialClone origin
-- 
cgit v1.2.1


From 2eaa95e3a6f73bd7c009c4654b950ca5bda5a866 Mon Sep 17 00:00:00 2001
From: Bian Jiaping <ssbianjp@gmail.com>
Date: Thu, 29 Aug 2019 19:47:41 +0800
Subject: Fix job event webhook documentation inconsistency with its actual
 request body

---
 doc/user/project/integrations/webhooks.md | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/doc/user/project/integrations/webhooks.md b/doc/user/project/integrations/webhooks.md
index 84adb9637fc..ed0458ebc0f 100644
--- a/doc/user/project/integrations/webhooks.md
+++ b/doc/user/project/integrations/webhooks.md
@@ -1181,20 +1181,20 @@ X-Gitlab-Event: Job Hook
 
 ```json
 {
-  "object_kind": "job",
+  "object_kind": "build",
   "ref": "gitlab-script-trigger",
   "tag": false,
   "before_sha": "2293ada6b400935a1378653304eaf6221e0fdb8f",
   "sha": "2293ada6b400935a1378653304eaf6221e0fdb8f",
-  "job_id": 1977,
-  "job_name": "test",
-  "job_stage": "test",
-  "job_status": "created",
-  "job_started_at": null,
-  "job_finished_at": null,
-  "job_duration": null,
-  "job_allow_failure": false,
-  "job_failure_reason": "script_failure",
+  "build_id": 1977,
+  "build_name": "test",
+  "build_stage": "test",
+  "build_status": "created",
+  "build_started_at": null,
+  "build_finished_at": null,
+  "build_duration": null,
+  "build_allow_failure": false,
+  "build_failure_reason": "script_failure",
   "project_id": 380,
   "project_name": "gitlab-org/gitlab-test",
   "user": {
-- 
cgit v1.2.1


From ec2756974ed3e797a5ae7d9aa1fd7c982605c950 Mon Sep 17 00:00:00 2001
From: Olena Horal-Koretska <ohoralkoretska@gitlab.com>
Date: Thu, 29 Aug 2019 12:21:28 +0000
Subject: Fixed embedded metrics tooltip inconsistent styling

---
 app/assets/stylesheets/framework/typography.scss             | 12 +++++++++++-
 .../unreleased/65063-Embeded-metrics-inconsistent-styles.yml |  5 +++++
 2 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/65063-Embeded-metrics-inconsistent-styles.yml

diff --git a/app/assets/stylesheets/framework/typography.scss b/app/assets/stylesheets/framework/typography.scss
index afcc7f8a1db..33caac4d725 100644
--- a/app/assets/stylesheets/framework/typography.scss
+++ b/app/assets/stylesheets/framework/typography.scss
@@ -384,8 +384,18 @@
       @extend .fa-exclamation-circle;
     }
   }
-}
 
+  .prometheus-graph-embed {
+    h3.popover-header {
+      /** Override <h3> .popover-header
+      * as embed metrics do not follow the same
+      * style as default md <h3> (which are deeply nested)
+      */
+      margin: 0;
+      font-size: $gl-font-size-small;
+    }
+  }
+}
 
 /**
  * Headers
diff --git a/changelogs/unreleased/65063-Embeded-metrics-inconsistent-styles.yml b/changelogs/unreleased/65063-Embeded-metrics-inconsistent-styles.yml
new file mode 100644
index 00000000000..126cf29afc0
--- /dev/null
+++ b/changelogs/unreleased/65063-Embeded-metrics-inconsistent-styles.yml
@@ -0,0 +1,5 @@
+---
+title: Fixed embeded metrics tooltip inconsistent styling
+merge_request: 31517
+author:
+type: fixed
-- 
cgit v1.2.1


From a3704b3657f8749e40634c7fa3fd97a6a74a866e Mon Sep 17 00:00:00 2001
From: NeroBurner <pyro4hell@gmail.com>
Date: Wed, 24 Jul 2019 13:28:11 +0000
Subject: docs: add docker-in-docker from registry example

- use specific docker version 19.03.1 in example
---
 doc/ci/docker/using_docker_build.md | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/doc/ci/docker/using_docker_build.md b/doc/ci/docker/using_docker_build.md
index 2cbad5f101c..7c173970324 100644
--- a/doc/ci/docker/using_docker_build.md
+++ b/doc/ci/docker/using_docker_build.md
@@ -575,6 +575,42 @@ For private and internal projects:
   docker login -u $CI_DEPLOY_USER -p $CI_DEPLOY_PASSWORD $CI_REGISTRY
   ```
 
+### Using docker-in-docker image from Container Registry
+
+If you want to use your own Docker images for docker-in-docker there are a few things you need to do in addition to the steps in the [docker-in-docker](#use-docker-in-docker-workflow-with-docker-executor) section:
+
+1. Update the `image` and `service` to point to your registry.
+1. Add a service [alias](https://docs.gitlab.com/ee/ci/yaml/#servicesalias)
+
+Below is an example of how your `.gitlab-ci.yml` should look like, assuming you have it configured with [TLS enabled](#tls-enabled):
+
+```yaml
+ build:
+   image: $CI_REGISTRY/group/project/docker:19.03.1
+   services:
+     - name: $CI_REGISTRY/group/project/docker:19.03.1-dind
+       alias: docker
+   variables:
+     # Specify to Docker where to create the certificates, Docker will
+     # create them automatically on boot, and will create
+     # `/certs/client` that will be shared between the service and
+     # build container.
+     DOCKER_TLS_CERTDIR: "/certs"
+     DOCKER_DRIVER: overlay2
+   stage: build
+   script:
+     - docker build -t my-docker-image .
+     - docker run my-docker-image /script/to/run/tests
+```
+
+If you forget to set the service alias the `docker:19.03.1` image won't find the 
+`dind` service, and an error like the following is thrown:
+
+```sh
+$ docker info
+error during connect: Get http://docker:2376/v1.39/info: dial tcp: lookup docker on 192.168.0.1:53: no such host
+```
+
 ### Container Registry examples
 
 If you're using docker-in-docker on your Runners, this is how your `.gitlab-ci.yml`
-- 
cgit v1.2.1


From e84398ba641466cc137fde668984f27f13e9b100 Mon Sep 17 00:00:00 2001
From: Yorick Peterse <yorick@yorickpeterse.com>
Date: Wed, 28 Aug 2019 17:43:45 +0200
Subject: Backport EE changes to the qa/ directory

Now that the qa/ directory uses the X_if_ee methods we can backport all
these lines to CE.
---
 qa/qa/page/admin/menu.rb                              | 2 ++
 qa/qa/page/dashboard/projects.rb                      | 2 ++
 qa/qa/page/file/show.rb                               | 2 ++
 qa/qa/page/merge_request/show.rb                      | 2 ++
 qa/qa/page/profile/menu.rb                            | 2 ++
 qa/qa/page/project/issue/index.rb                     | 2 ++
 qa/qa/page/project/issue/show.rb                      | 2 ++
 qa/qa/page/project/menu.rb                            | 2 ++
 qa/qa/page/project/new.rb                             | 2 ++
 qa/qa/page/project/operations/kubernetes/show.rb      | 2 ++
 qa/qa/page/project/pipeline/show.rb                   | 2 ++
 qa/qa/page/project/settings/main.rb                   | 2 ++
 qa/qa/page/project/settings/mirroring_repositories.rb | 2 ++
 qa/qa/page/project/settings/protected_branches.rb     | 2 ++
 qa/qa/page/project/show.rb                            | 2 ++
 qa/qa/runtime/env.rb                                  | 2 ++
 qa/qa/scenario/test/sanity/selectors.rb               | 2 ++
 17 files changed, 34 insertions(+)

diff --git a/qa/qa/page/admin/menu.rb b/qa/qa/page/admin/menu.rb
index a520fb546c8..7c214da8486 100644
--- a/qa/qa/page/admin/menu.rb
+++ b/qa/qa/page/admin/menu.rb
@@ -83,3 +83,5 @@ module QA
     end
   end
 end
+
+QA::Page::Admin::Menu.prepend_if_ee('QA::EE::Page::Admin::Menu')
diff --git a/qa/qa/page/dashboard/projects.rb b/qa/qa/page/dashboard/projects.rb
index 0c23d7cffbb..378ac793f7b 100644
--- a/qa/qa/page/dashboard/projects.rb
+++ b/qa/qa/page/dashboard/projects.rb
@@ -29,3 +29,5 @@ module QA
     end
   end
 end
+
+QA::Page::Dashboard::Projects.prepend_if_ee('QA::EE::Page::Dashboard::Projects')
diff --git a/qa/qa/page/file/show.rb b/qa/qa/page/file/show.rb
index 92f9181f99d..f5f44909f25 100644
--- a/qa/qa/page/file/show.rb
+++ b/qa/qa/page/file/show.rb
@@ -32,3 +32,5 @@ module QA
     end
   end
 end
+
+QA::Page::File::Show.prepend_if_ee('QA::EE::Page::File::Show')
diff --git a/qa/qa/page/merge_request/show.rb b/qa/qa/page/merge_request/show.rb
index 6a415b56e50..72f8e1c3ef0 100644
--- a/qa/qa/page/merge_request/show.rb
+++ b/qa/qa/page/merge_request/show.rb
@@ -187,3 +187,5 @@ module QA
     end
   end
 end
+
+QA::Page::MergeRequest::Show.prepend_if_ee('QA::EE::Page::MergeRequest::Show')
diff --git a/qa/qa/page/profile/menu.rb b/qa/qa/page/profile/menu.rb
index 2d503499e13..99a795a23ef 100644
--- a/qa/qa/page/profile/menu.rb
+++ b/qa/qa/page/profile/menu.rb
@@ -34,3 +34,5 @@ module QA
     end
   end
 end
+
+QA::Page::Profile::Menu.prepend_if_ee('QA::EE::Page::Profile::Menu')
diff --git a/qa/qa/page/project/issue/index.rb b/qa/qa/page/project/issue/index.rb
index c4383951ec4..a630c7373bd 100644
--- a/qa/qa/page/project/issue/index.rb
+++ b/qa/qa/page/project/issue/index.rb
@@ -17,3 +17,5 @@ module QA
     end
   end
 end
+
+QA::Page::Project::Issue::Index.prepend_if_ee('QA::EE::Page::Project::Issue::Index')
diff --git a/qa/qa/page/project/issue/show.rb b/qa/qa/page/project/issue/show.rb
index 45dad9bc0ae..2fb947436be 100644
--- a/qa/qa/page/project/issue/show.rb
+++ b/qa/qa/page/project/issue/show.rb
@@ -108,3 +108,5 @@ module QA
     end
   end
 end
+
+QA::Page::Project::Issue::Show.prepend_if_ee('QA::EE::Page::Project::Issue::Show')
diff --git a/qa/qa/page/project/menu.rb b/qa/qa/page/project/menu.rb
index 838d59b59cb..a9226927741 100644
--- a/qa/qa/page/project/menu.rb
+++ b/qa/qa/page/project/menu.rb
@@ -39,3 +39,5 @@ module QA
     end
   end
 end
+
+QA::Page::Project::Menu.prepend_if_ee('QA::EE::Page::Project::SubMenus::SecurityCompliance')
diff --git a/qa/qa/page/project/new.rb b/qa/qa/page/project/new.rb
index 64aab9be056..d0e8011d82d 100644
--- a/qa/qa/page/project/new.rb
+++ b/qa/qa/page/project/new.rb
@@ -73,3 +73,5 @@ module QA
     end
   end
 end
+
+QA::Page::Project::New.prepend_if_ee('QA::EE::Page::Project::New')
diff --git a/qa/qa/page/project/operations/kubernetes/show.rb b/qa/qa/page/project/operations/kubernetes/show.rb
index eb30e0ea02a..fa276f15b8a 100644
--- a/qa/qa/page/project/operations/kubernetes/show.rb
+++ b/qa/qa/page/project/operations/kubernetes/show.rb
@@ -53,3 +53,5 @@ module QA
     end
   end
 end
+
+QA::Page::Project::Operations::Kubernetes::Show.prepend_if_ee('QA::EE::Page::Project::Operations::Kubernetes::Show')
diff --git a/qa/qa/page/project/pipeline/show.rb b/qa/qa/page/project/pipeline/show.rb
index 284d0957eb8..3dca47a57e9 100644
--- a/qa/qa/page/project/pipeline/show.rb
+++ b/qa/qa/page/project/pipeline/show.rb
@@ -60,3 +60,5 @@ module QA::Page
     end
   end
 end
+
+QA::Page::Project::Pipeline::Show.prepend_if_ee('QA::EE::Page::Project::Pipeline::Show')
diff --git a/qa/qa/page/project/settings/main.rb b/qa/qa/page/project/settings/main.rb
index dbbe62e3b1d..a196fc0123a 100644
--- a/qa/qa/page/project/settings/main.rb
+++ b/qa/qa/page/project/settings/main.rb
@@ -41,3 +41,5 @@ module QA
     end
   end
 end
+
+QA::Page::Project::Settings::Main.prepend_if_ee('QA::EE::Page::Project::Settings::Main')
diff --git a/qa/qa/page/project/settings/mirroring_repositories.rb b/qa/qa/page/project/settings/mirroring_repositories.rb
index 831166f6373..e3afaceda80 100644
--- a/qa/qa/page/project/settings/mirroring_repositories.rb
+++ b/qa/qa/page/project/settings/mirroring_repositories.rb
@@ -89,3 +89,5 @@ module QA
     end
   end
 end
+
+QA::Page::Project::Settings::MirroringRepositories.prepend_if_ee('QA::EE::Page::Project::Settings::MirroringRepositories')
diff --git a/qa/qa/page/project/settings/protected_branches.rb b/qa/qa/page/project/settings/protected_branches.rb
index 903b0979614..1e707f1d315 100644
--- a/qa/qa/page/project/settings/protected_branches.rb
+++ b/qa/qa/page/project/settings/protected_branches.rb
@@ -73,3 +73,5 @@ module QA
     end
   end
 end
+
+QA::Page::Project::Settings::ProtectedBranches.prepend_if_ee('QA::EE::Page::Project::Settings::ProtectedBranches')
diff --git a/qa/qa/page/project/show.rb b/qa/qa/page/project/show.rb
index 9fd668f812b..850a96d87b0 100644
--- a/qa/qa/page/project/show.rb
+++ b/qa/qa/page/project/show.rb
@@ -131,3 +131,5 @@ module QA
     end
   end
 end
+
+QA::Page::Project.prepend_if_ee('QA::EE::Page::Project::Show')
diff --git a/qa/qa/runtime/env.rb b/qa/qa/runtime/env.rb
index b184eeb1701..594e5712ab2 100644
--- a/qa/qa/runtime/env.rb
+++ b/qa/qa/runtime/env.rb
@@ -233,3 +233,5 @@ module QA
     end
   end
 end
+
+QA::Runtime::Env.extend_if_ee('QA::EE::Runtime::Env')
diff --git a/qa/qa/scenario/test/sanity/selectors.rb b/qa/qa/scenario/test/sanity/selectors.rb
index 632a0f5f2a9..99497cbe0ad 100644
--- a/qa/qa/scenario/test/sanity/selectors.rb
+++ b/qa/qa/scenario/test/sanity/selectors.rb
@@ -56,3 +56,5 @@ module QA
     end
   end
 end
+
+QA::Scenario::Test::Sanity::Selectors.prepend_if_ee('QA::EE::Scenario::Test::Sanity::Selectors')
-- 
cgit v1.2.1


From 3e46c74efd1dfa257eda35200eafda7fd13013d6 Mon Sep 17 00:00:00 2001
From: Mathieu Parent <math.parent@gmail.com>
Date: Thu, 18 Jul 2019 17:36:27 +0200
Subject: Settings API: Sort settings

---
 doc/api/settings.md | 35 ++++++++++++++++++-----------------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/doc/api/settings.md b/doc/api/settings.md
index 710b63c9a2f..1275ccfeddb 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -184,8 +184,8 @@ are listed in the descriptions of the relevant settings.
 | `akismet_enabled`                        | boolean          | no                                   | (**If enabled, requires:** `akismet_api_key`) Enable or disable akismet spam protection. |
 | `allow_group_owners_to_manage_ldap`      | boolean          | no                                   | **(PREMIUM)** Set to `true` to allow group owners to manage LDAP |
 | `allow_local_requests_from_hooks_and_services` | boolean    | no                                   | (Deprecated: Use `allow_local_requests_from_web_hooks_and_services` instead) Allow requests to the local network from hooks and services. |
-| `allow_local_requests_from_web_hooks_and_services` | boolean    | no                                   | Allow requests to the local network from web hooks and services. |
 | `allow_local_requests_from_system_hooks` | boolean    | no                                   | Allow requests to the local network from system hooks. |
+| `allow_local_requests_from_web_hooks_and_services` | boolean    | no                                   | Allow requests to the local network from web hooks and services. |
 | `authorized_keys_enabled`                | boolean          | no                                   | By default, we write to the `authorized_keys` file to support Git over SSH without additional configuration. GitLab can be optimized to authenticate SSH keys via the database file. Only disable this if you have configured your OpenSSH server to use the AuthorizedKeysCommand. |
 | `auto_devops_domain`                     | string           | no                                   | Specify a domain to use by default for every project's Auto Review Apps and Auto Deploy stages. |
 | `auto_devops_enabled`                    | boolean          | no                                   | Enable Auto DevOps for projects by default. It will automatically build, test, and deploy applications based on a predefined CI/CD configuration. |
@@ -196,41 +196,41 @@ are listed in the descriptions of the relevant settings.
 | `default_artifacts_expire_in`            | string           | no                                   | Set the default expiration time for each job's artifacts. |
 | `default_branch_protection`              | integer          | no                                   | Determine if developers can push to master. Can take: `0` _(not protected, both developers and maintainers can push new commits, force push, or delete the branch)_, `1` _(partially protected, developers and maintainers can push new commits, but cannot force push or delete the branch)_ or `2` _(fully protected, developers cannot push new commits, but maintainers can; no-one can force push or delete the branch)_ as a parameter. Default is `2`. |
 | `default_group_visibility`               | string           | no                                   | What visibility level new groups receive. Can take `private`, `internal` and `public` as a parameter. Default is `private`. |
-| `default_project_visibility`             | string           | no                                   | What visibility level new projects receive. Can take `private`, `internal` and `public` as a parameter. Default is `private`. |
 | `default_projects_limit`                 | integer          | no                                   | Project limit per user. Default is `100000`. |
+| `default_project_visibility`             | string           | no                                   | What visibility level new projects receive. Can take `private`, `internal` and `public` as a parameter. Default is `private`. |
 | `default_snippet_visibility`             | string           | no                                   | What visibility level new snippets receive. Can take `private`, `internal` and `public` as a parameter. Default is `private`. |
 | `disabled_oauth_sign_in_sources`         | array of strings | no                                   | Disabled OAuth sign-in sources. |
 | `domain_blacklist`                       | array of strings | required by: `domain_blacklist_enabled` | Users with e-mail addresses that match these domain(s) will NOT be able to sign-up. Wildcards allowed. Use separate lines for multiple entries. Ex: `domain.com`, `*.domain.com`. |
 | `domain_blacklist_enabled`               | boolean          | no                                   | (**If enabled, requires:** `domain_blacklist`) Allows blocking sign-ups from emails from specific domains. |
 | `domain_whitelist`                       | array of strings | no                                   | Force people to use only corporate emails for sign-up. Default is `null`, meaning there is no restriction. |
-| `outbound_local_requests_whitelist`      | array of strings | no                                   | Define a list of trusted domains or ip addresses to which local requests are allowed when local requests for hooks and services are disabled.
 | `dsa_key_restriction`                    | integer          | no                                   | The minimum allowed bit length of an uploaded DSA key. Default is `0` (no restriction). `-1` disables DSA keys. |
 | `ecdsa_key_restriction`                  | integer          | no                                   | The minimum allowed curve size (in bits) of an uploaded ECDSA key. Default is `0` (no restriction). `-1` disables ECDSA keys. |
 | `ed25519_key_restriction`                | integer          | no                                   | The minimum allowed curve size (in bits) of an uploaded ED25519 key. Default is `0` (no restriction). `-1` disables ED25519 keys. |
-| `elasticsearch_aws`                      | boolean          | no                                   | **(PREMIUM)** Enable the use of AWS hosted Elasticsearch |
 | `elasticsearch_aws_access_key`           | string           | no                                   | **(PREMIUM)** AWS IAM access key |
+| `elasticsearch_aws`                      | boolean          | no                                   | **(PREMIUM)** Enable the use of AWS hosted Elasticsearch |
 | `elasticsearch_aws_region`               | string           | no                                   | **(PREMIUM)** The AWS region the elasticsearch domain is configured |
 | `elasticsearch_aws_secret_access_key`    | string           | no                                   | **(PREMIUM)** AWS IAM secret access key |
 | `elasticsearch_experimental_indexer`     | boolean          | no                                   | **(PREMIUM)** Use the experimental elasticsearch indexer. More info: <https://gitlab.com/gitlab-org/gitlab-elasticsearch-indexer> |
 | `elasticsearch_indexing`                 | boolean          | no                                   | **(PREMIUM)** Enable Elasticsearch indexing |
-| `elasticsearch_search`                   | boolean          | no                                   | **(PREMIUM)** Enable Elasticsearch search |
-| `elasticsearch_url`                      | string           | no                                   | **(PREMIUM)** The url to use for connecting to Elasticsearch. Use a comma-separated list to support cluster (e.g., `http://localhost:9200, http://localhost:9201"`). If your Elasticsearch instance is password protected, pass the `username:password` in the URL (e.g., `http://<username>:<password>@<elastic_host>:9200/`). |
 | `elasticsearch_limit_indexing`           | boolean          | no                                   | **(PREMIUM)** Limit Elasticsearch to index certain namespaces and projects |
-| `elasticsearch_project_ids`              | array of integers | no                                  | **(PREMIUM)** The projects to index via Elasticsearch if `elasticsearch_limit_indexing` is enabled. |
 | `elasticsearch_namespace_ids`            | array of integers | no                                  | **(PREMIUM)** The namespaces to index via Elasticsearch if `elasticsearch_limit_indexing` is enabled. |
+| `elasticsearch_project_ids`              | array of integers | no                                  | **(PREMIUM)** The projects to index via Elasticsearch if `elasticsearch_limit_indexing` is enabled. |
+| `elasticsearch_search`                   | boolean          | no                                   | **(PREMIUM)** Enable Elasticsearch search |
+| `elasticsearch_url`                      | string           | no                                   | **(PREMIUM)** The url to use for connecting to Elasticsearch. Use a comma-separated list to support cluster (e.g., `http://localhost:9200, http://localhost:9201"`). If your Elasticsearch instance is password protected, pass the `username:password` in the URL (e.g., `http://<username>:<password>@<elastic_host>:9200/`). |
 | `email_additional_text`                  | string           | no                                   | **(PREMIUM)** Additional text added to the bottom of every email for legal/auditing/compliance reasons |
 | `email_author_in_body`                   | boolean          | no                                   | Some email servers do not support overriding the email sender name. Enable this option to include the name of the author of the issue, merge request or comment in the email body instead. |
 | `enabled_git_access_protocol`            | string           | no                                   | Enabled protocols for Git access. Allowed values are: `ssh`, `http`, and `nil` to allow both protocols. |
 | `enforce_terms`                          | boolean          | no                                   | (**If enabled, requires:** `terms`) Enforce application ToS to all users. |
 | `external_auth_client_cert`              | string           | no                                   | **(PREMIUM)** (**If enabled, requires:** `external_auth_client_key`) The certificate to use to authenticate with the external authorization service |
-| `external_auth_client_key`               | string           | required by: `external_auth_client_cert` | **(PREMIUM)** Private key for the certificate when authentication is required for the external authorization service, this is encrypted when stored |
 | `external_auth_client_key_pass`          | string           | no                                   | **(PREMIUM)** Passphrase to use for the private key when authenticating with the external service this is encrypted when stored |
-| `external_authorization_service_enabled` | boolean          | no                                   | **(PREMIUM)** (**If enabled, requires:** `external_authorization_service_default_label`, `external_authorization_service_timeout` and `external_authorization_service_url` )  Enable using an external authorization service for accessing projects |
+| `external_auth_client_key`               | string           | required by: `external_auth_client_cert` | **(PREMIUM)** Private key for the certificate when authentication is required for the external authorization service, this is encrypted when stored |
 | `external_authorization_service_default_label` | string     | required by: `external_authorization_service_enabled` | **(PREMIUM)** The default classification label to use when requesting authorization and no classification label has been specified on the project |
+| `external_authorization_service_enabled` | boolean          | no                                   | **(PREMIUM)** (**If enabled, requires:** `external_authorization_service_default_label`, `external_authorization_service_timeout` and `external_authorization_service_url` )  Enable using an external authorization service for accessing projects |
 | `external_authorization_service_timeout` | float            | required by: `external_authorization_service_enabled` | **(PREMIUM)** The timeout after which an authorization request is aborted, in seconds. When a request times out, access is denied to the user. (min: 0.001, max: 10, step: 0.001) |
 | `external_authorization_service_url`     | string           | required by: `external_authorization_service_enabled` | **(PREMIUM)** URL to which authorization requests will be directed |
 | `file_template_project_id`               | integer          | no                                   | **(PREMIUM)** The ID of a project to load custom file templates from |
 | `first_day_of_week`                      | integer          | no                                   | Start day of the week for calendar views and date pickers. Valid values are `0` (default) for Sunday, `1` for Monday, and `6` for Saturday. |
+| `geo_node_allowed_ips`                   | string           | yes                                  | **(PREMIUM)** Comma-separated list of IPs and CIDRs of allowed secondary nodes. For example, `1.1.1.1, 2.2.2.0/24`. |
 | `geo_status_timeout`                     | integer          | no                                   | **(PREMIUM)** The amount of seconds after which a request to get a secondary node status will time out. |
 | `gitaly_timeout_default`                 | integer          | no                                   | Default Gitaly timeout, in seconds. This timeout is not enforced for Git fetch/push operations or Sidekiq jobs. Set to `0` to disable timeouts. |
 | `gitaly_timeout_fast`                    | integer          | no                                   | Gitaly fast operation timeout, in seconds. Some Gitaly operations are expected to be fast. If they exceed this threshold, there may be a problem with a storage shard and 'failing fast' can help maintain the stability of the GitLab instance. Set to `0` to disable timeouts. |
@@ -249,8 +249,9 @@ are listed in the descriptions of the relevant settings.
 | `housekeeping_gc_period`                 | integer          | required by: `housekeeping_enabled`  | Number of Git pushes after which `git gc` is run. |
 | `housekeeping_incremental_repack_period` | integer          | required by: `housekeeping_enabled`  | Number of Git pushes after which an incremental `git repack` is run. |
 | `html_emails_enabled`                    | boolean          | no                                   | Enable HTML emails. |
-| `instance_statistics_visibility_private` | boolean          | no                                   | When set to `true` Instance statistics will only be available to admins. |
 | `import_sources`                         | array of strings | no                                   | Sources to allow project import from, possible values: `github`, `bitbucket`, `gitlab`, `google_code`, `fogbugz`, `git`, and `gitlab_project`. |
+| `instance_statistics_visibility_private` | boolean          | no                                   | When set to `true` Instance statistics will only be available to admins. |
+| `local_markdown_version`                 | integer          | no                                   | Increase this value when any cached markdown should be invalidated. |
 | `max_artifacts_size`                     | integer          | no                                   | Maximum artifacts size in MB |
 | `max_attachment_size`                    | integer          | no                                   | Limit attachment size in MB |
 | `max_pages_size`                         | integer          | no                                   | Maximum size of pages repositories in MB |
@@ -266,6 +267,7 @@ are listed in the descriptions of the relevant settings.
 | `mirror_capacity_threshold`              | integer          | no                                   | **(PREMIUM)** Minimum capacity to be available before scheduling more mirrors preemptively |
 | `mirror_max_capacity`                    | integer          | no                                   | **(PREMIUM)** Maximum number of mirrors that can be synchronizing at the same time. |
 | `mirror_max_delay`                       | integer          | no                                   | **(PREMIUM)** Maximum time (in minutes) between updates that a mirror can have when scheduled to synchronize. |
+| `outbound_local_requests_whitelist`      | array of strings | no                                   | Define a list of trusted domains or ip addresses to which local requests are allowed when local requests for hooks and services are disabled.
 | `pages_domain_verification_enabled`      | boolean          | no                                   | Require users to prove ownership of custom domains. Domain verification is an essential security measure for public GitLab sites. Users are required to demonstrate they control a domain before it is enabled. |
 | `password_authentication_enabled_for_git` | boolean         | no                                   | Enable authentication for Git over HTTP(S) via a GitLab account password. Default is `true`. |
 | `password_authentication_enabled_for_web` | boolean         | no                                   | Enable authentication for the web interface via a GitLab account password. Default is `true`. |
@@ -292,13 +294,17 @@ are listed in the descriptions of the relevant settings.
 | `shared_runners_enabled`                 | boolean          | no                                   | (**If enabled, requires:** `shared_runners_text` and `shared_runners_minutes`) Enable shared runners for new projects. |
 | `shared_runners_minutes`                 | integer          | required by: `shared_runners_enabled` | **(PREMIUM)** Set the maximum number of pipeline minutes that a group can use on shared Runners per month. |
 | `shared_runners_text`                    | string           | required by: `shared_runners_enabled` | Shared runners text. |
-| `sign_in_text`                           | string           | no                                   | Text on the login page. |
 | `signin_enabled`                         | string           | no                                   | (Deprecated: Use `password_authentication_enabled_for_web` instead) Flag indicating if password authentication is enabled for the web interface. |
+| `sign_in_text`                           | string           | no                                   | Text on the login page. |
 | `signup_enabled`                         | boolean          | no                                   | Enable registration. Default is `true`. |
 | `slack_app_enabled`                      | boolean          | no                                   | **(PREMIUM)** (**If enabled, requires:** `slack_app_id`, `slack_app_secret` and `slack_app_secret`) Enable Slack app. |
 | `slack_app_id`                           | string           | required by: `slack_app_enabled`      | **(PREMIUM)** The app id of the Slack-app. |
 | `slack_app_secret`                       | string           | required by: `slack_app_enabled`      | **(PREMIUM)** The app secret of the Slack-app. |
 | `slack_app_verification_token`           | string           | required by: `slack_app_enabled`      | **(PREMIUM)** The verification token of the Slack-app. |
+| `snowplow_collector_hostname`            | string           | required by: `snowplow_enabled`      | The Snowplow collector hostname. (e.g. `snowplow.trx.gitlab.net`) |
+| `snowplow_cookie_domain`                 | string           | no                                   | The Snowplow cookie domain. (e.g. `.gitlab.com`) |
+| `snowplow_enabled`                       | boolean          | no                                   | Enable snowplow tracking. |
+| `snowplow_site_id`                       | string           | no                                   | The Snowplow site name / application id. (e.g. `gitlab`) |
 | `terminal_max_session_time`              | integer          | no                                   | Maximum time for web terminal websocket connection (in seconds). Set to `0` for unlimited time. |
 | `terms`                                  | text             | required by: `enforce_terms`         | (**Required by:** `enforce_terms`) Markdown content for the ToS. |
 | `throttle_authenticated_api_enabled`     | boolean          | no                                   | (**If enabled, requires:** `throttle_authenticated_api_period_in_seconds` and `throttle_authenticated_api_requests_per_period`) Enable authenticated API request rate limit. Helps reduce request volume (e.g. from crawlers or abusive bots). |
@@ -320,9 +326,4 @@ are listed in the descriptions of the relevant settings.
 | `user_oauth_applications`                | boolean          | no                                   | Allow users to register any application to use GitLab as an OAuth provider. |
 | `user_show_add_ssh_key_message`          | boolean          | no                                   | When set to `false` disable the "You won't be able to pull or push project code via SSH" warning shown to users with no uploaded SSH key. |
 | `version_check_enabled`                  | boolean          | no                                   | Let GitLab inform you when an update is available. |
-| `local_markdown_version`                 | integer          | no                                   | Increase this value when any cached markdown should be invalidated. |
-| `snowplow_enabled`                       | boolean          | no                                   | Enable snowplow tracking. |
-| `snowplow_collector_hostname`            | string           | required by: `snowplow_enabled`      | The Snowplow collector hostname. (e.g. `snowplow.trx.gitlab.net`) |
-| `snowplow_site_id`                       | string           | no                                   | The Snowplow site name / application id. (e.g. `gitlab`) |
-| `snowplow_cookie_domain`                 | string           | no                                   | The Snowplow cookie domain. (e.g. `.gitlab.com`) |
-| `geo_node_allowed_ips`                   | string           | yes                                  | **(PREMIUM)** Comma-separated list of IPs and CIDRs of allowed secondary nodes. For example, `1.1.1.1, 2.2.2.0/24`. |
+
-- 
cgit v1.2.1


From 7893d07ce9e1bcb08f5fff03ca974e1969675018 Mon Sep 17 00:00:00 2001
From: Mathieu Parent <math.parent@gmail.com>
Date: Thu, 18 Jul 2019 17:34:43 +0200
Subject: Settings API: Document the missing import_sources

---
 doc/api/settings.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/api/settings.md b/doc/api/settings.md
index 1275ccfeddb..101c4e82d87 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -249,7 +249,8 @@ are listed in the descriptions of the relevant settings.
 | `housekeeping_gc_period`                 | integer          | required by: `housekeeping_enabled`  | Number of Git pushes after which `git gc` is run. |
 | `housekeeping_incremental_repack_period` | integer          | required by: `housekeeping_enabled`  | Number of Git pushes after which an incremental `git repack` is run. |
 | `html_emails_enabled`                    | boolean          | no                                   | Enable HTML emails. |
-| `import_sources`                         | array of strings | no                                   | Sources to allow project import from, possible values: `github`, `bitbucket`, `gitlab`, `google_code`, `fogbugz`, `git`, and `gitlab_project`. |
+| `import_sources`                         | array of strings | no                                   | Sources to allow project import from, possible values: `github`, `bitbucket`, `bitbucket_server`, `gitlab`, `google_code`, `fogbugz`, `git`, `gitlab_project`, `gitea`, `manifest`, and `phabricator`. |
+
 | `instance_statistics_visibility_private` | boolean          | no                                   | When set to `true` Instance statistics will only be available to admins. |
 | `local_markdown_version`                 | integer          | no                                   | Increase this value when any cached markdown should be invalidated. |
 | `max_artifacts_size`                     | integer          | no                                   | Maximum artifacts size in MB |
-- 
cgit v1.2.1


From 7f8c6c4ac9cc10966f27981baf22d8471db0f06a Mon Sep 17 00:00:00 2001
From: Mathieu Parent <math.parent@gmail.com>
Date: Thu, 18 Jul 2019 18:07:22 +0200
Subject: Settings API: Document undocumented settings

---
 doc/api/settings.md | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/doc/api/settings.md b/doc/api/settings.md
index 101c4e82d87..63f20925d5e 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -157,6 +157,7 @@ these parameters:
 - `external_authorization_service_timeout`
 - `file_template_project_id`
 - `geo_node_allowed_ips`
+- `geo_status_timeout`
 
 Example responses: **(PREMIUM ONLY)**
 
@@ -186,20 +187,25 @@ are listed in the descriptions of the relevant settings.
 | `allow_local_requests_from_hooks_and_services` | boolean    | no                                   | (Deprecated: Use `allow_local_requests_from_web_hooks_and_services` instead) Allow requests to the local network from hooks and services. |
 | `allow_local_requests_from_system_hooks` | boolean    | no                                   | Allow requests to the local network from system hooks. |
 | `allow_local_requests_from_web_hooks_and_services` | boolean    | no                                   | Allow requests to the local network from web hooks and services. |
+| `archive_builds_in_human_readable`       | string           | no                                   | Set the duration for which the jobs will be considered as old and expired. Once that time passes, the jobs will be archived and no longer able to be retried. Make it empty to never expire jobs. It has to be no less than 1 day, for example: <code>15 days</code>, <code>1 month</code>, <code>2 years</code>. |
 | `authorized_keys_enabled`                | boolean          | no                                   | By default, we write to the `authorized_keys` file to support Git over SSH without additional configuration. GitLab can be optimized to authenticate SSH keys via the database file. Only disable this if you have configured your OpenSSH server to use the AuthorizedKeysCommand. |
 | `auto_devops_domain`                     | string           | no                                   | Specify a domain to use by default for every project's Auto Review Apps and Auto Deploy stages. |
 | `auto_devops_enabled`                    | boolean          | no                                   | Enable Auto DevOps for projects by default. It will automatically build, test, and deploy applications based on a predefined CI/CD configuration. |
 | `check_namespace_plan`                   | boolean          | no                                   | **(PREMIUM)** Enabling this will make only licensed EE features available to projects if the project namespace's plan includes the feature or if the project is public. |
 | `clientside_sentry_dsn`                  | string           | required by: `clientside_sentry_enabled` | Clientside Sentry Data Source Name. |
 | `clientside_sentry_enabled`              | boolean          | no                                   | (**If enabled, requires:** `clientside_sentry_dsn`) Enable Sentry error reporting for the client side. |
+| `commit_email_hostname`                  | string           | no                                   | Custom hostname (for private commit emails). |
 | `container_registry_token_expire_delay`  | integer          | no                                   | Container Registry token duration in minutes. |
 | `default_artifacts_expire_in`            | string           | no                                   | Set the default expiration time for each job's artifacts. |
 | `default_branch_protection`              | integer          | no                                   | Determine if developers can push to master. Can take: `0` _(not protected, both developers and maintainers can push new commits, force push, or delete the branch)_, `1` _(partially protected, developers and maintainers can push new commits, but cannot force push or delete the branch)_ or `2` _(fully protected, developers cannot push new commits, but maintainers can; no-one can force push or delete the branch)_ as a parameter. Default is `2`. |
 | `default_group_visibility`               | string           | no                                   | What visibility level new groups receive. Can take `private`, `internal` and `public` as a parameter. Default is `private`. |
+| `default_project_creation`               | integer          | no                                   | Default project creation protection. Can take: `0` _(No one)_, `1` _(Maintainers)_ or `2` _(Developers + Maintainers)_|
 | `default_projects_limit`                 | integer          | no                                   | Project limit per user. Default is `100000`. |
 | `default_project_visibility`             | string           | no                                   | What visibility level new projects receive. Can take `private`, `internal` and `public` as a parameter. Default is `private`. |
 | `default_snippet_visibility`             | string           | no                                   | What visibility level new snippets receive. Can take `private`, `internal` and `public` as a parameter. Default is `private`. |
+| `diff_max_patch_bytes`                   | integer          | no                                   | Maximum diff patch size (Bytes). |
 | `disabled_oauth_sign_in_sources`         | array of strings | no                                   | Disabled OAuth sign-in sources. |
+| `dns_rebinding_protection_enabled`       | boolean          | no                                   | Enforce DNS rebinding attack protection. |
 | `domain_blacklist`                       | array of strings | required by: `domain_blacklist_enabled` | Users with e-mail addresses that match these domain(s) will NOT be able to sign-up. Wildcards allowed. Use separate lines for multiple entries. Ex: `domain.com`, `*.domain.com`. |
 | `domain_blacklist_enabled`               | boolean          | no                                   | (**If enabled, requires:** `domain_blacklist`) Allows blocking sign-ups from emails from specific domains. |
 | `domain_whitelist`                       | array of strings | no                                   | Force people to use only corporate emails for sign-up. Default is `null`, meaning there is no restriction. |
@@ -235,6 +241,8 @@ are listed in the descriptions of the relevant settings.
 | `gitaly_timeout_default`                 | integer          | no                                   | Default Gitaly timeout, in seconds. This timeout is not enforced for Git fetch/push operations or Sidekiq jobs. Set to `0` to disable timeouts. |
 | `gitaly_timeout_fast`                    | integer          | no                                   | Gitaly fast operation timeout, in seconds. Some Gitaly operations are expected to be fast. If they exceed this threshold, there may be a problem with a storage shard and 'failing fast' can help maintain the stability of the GitLab instance. Set to `0` to disable timeouts. |
 | `gitaly_timeout_medium`                  | integer          | no                                   | Medium Gitaly timeout, in seconds. This should be a value between the Fast and the Default timeout. Set to `0` to disable timeouts. |
+| `grafana_enabled`                        | boolean          | no                                   | Enable Grafana. |
+| `grafana_url`                            | string           | no                                   | Grafana URL. |
 | `gravatar_enabled`                       | boolean          | no                                   | Enable Gravatar. |
 | `hashed_storage_enabled`                 | boolean          | no                                   | Create new projects using hashed storage paths: Enable immutable, hash-based paths and repository names to store repositories on disk. This prevents repositories from having to be moved or renamed when the Project URL changes and may improve disk I/O performance. (EXPERIMENTAL) |
 | `help_page_hide_commercial_content`      | boolean          | no                                   | Hide marketing-related entries from help. |
@@ -280,10 +288,12 @@ are listed in the descriptions of the relevant settings.
 | `polling_interval_multiplier`            | decimal          | no                                   | Interval multiplier used by endpoints that perform polling. Set to `0` to disable polling. |
 | `project_export_enabled`                 | boolean          | no                                   | Enable project export. |
 | `prometheus_metrics_enabled`             | boolean          | no                                   | Enable prometheus metrics. |
+| `protected_ci_variables`                 | boolean          | no                                   | Environment variables are protected by default. |
 | `pseudonymizer_enabled`                  | boolean          | no                                   | **(PREMIUM)** When enabled, GitLab will run a background job that will produce pseudonymized CSVs of the GitLab database that will be uploaded to your configured object storage directory.
 | `recaptcha_enabled`                      | boolean          | no                                   | (**If enabled, requires:** `recaptcha_private_key` and `recaptcha_site_key`) Enable recaptcha. |
 | `recaptcha_private_key`                  | string           | required by: `recaptcha_enabled`     | Private key for recaptcha. |
 | `recaptcha_site_key`                     | string           | required by: `recaptcha_enabled`     | Site key for recaptcha. |
+| `receive_max_input_size`                 | integer          | no                                   | Maximum push size (MB) |
 | `repository_checks_enabled`              | boolean          | no                                   | GitLab will periodically run `git fsck` in all project and wiki repositories to look for silent disk corruption issues. |
 | `repository_size_limit`                  | integer          | no                                   | **(PREMIUM)** Size limit per repository (MB) |
 | `repository_storages`                    | array of strings | no                                   | A list of names of enabled storage paths, taken from `gitlab.yml`. New projects will be created in one of these stores, chosen at random. |
@@ -324,7 +334,8 @@ are listed in the descriptions of the relevant settings.
 | `unique_ips_limit_time_window`           | integer          | required by: `unique_ips_limit_enabled` | How many seconds an IP will be counted towards the limit. |
 | `usage_ping_enabled`                     | boolean          | no                                   | Every week GitLab will report license usage back to GitLab, Inc. |
 | `user_default_external`                  | boolean          | no                                   | Newly registered users will be external by default. |
+| `user_default_internal_regex`            | string           | no                                   | Specify an e-mail address regex pattern to identify default internal users. |
 | `user_oauth_applications`                | boolean          | no                                   | Allow users to register any application to use GitLab as an OAuth provider. |
 | `user_show_add_ssh_key_message`          | boolean          | no                                   | When set to `false` disable the "You won't be able to pull or push project code via SSH" warning shown to users with no uploaded SSH key. |
 | `version_check_enabled`                  | boolean          | no                                   | Let GitLab inform you when an update is available. |
-
+| `web_ide_clientside_preview_enabled`     | boolean          | no                                   | Client side evaluation (allow live previews of JavaScript projects in the Web IDE using CodeSandbox client side evaluation). |
-- 
cgit v1.2.1


From 31c8ca6defd36bd08209ecc8c5913631c316ce37 Mon Sep 17 00:00:00 2001
From: Mathieu Parent <math.parent@gmail.com>
Date: Thu, 18 Jul 2019 18:07:22 +0200
Subject: Settings API: Remove sentry settings

See !28447
---
 doc/api/settings.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/doc/api/settings.md b/doc/api/settings.md
index 63f20925d5e..f6b0770e65c 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -192,8 +192,6 @@ are listed in the descriptions of the relevant settings.
 | `auto_devops_domain`                     | string           | no                                   | Specify a domain to use by default for every project's Auto Review Apps and Auto Deploy stages. |
 | `auto_devops_enabled`                    | boolean          | no                                   | Enable Auto DevOps for projects by default. It will automatically build, test, and deploy applications based on a predefined CI/CD configuration. |
 | `check_namespace_plan`                   | boolean          | no                                   | **(PREMIUM)** Enabling this will make only licensed EE features available to projects if the project namespace's plan includes the feature or if the project is public. |
-| `clientside_sentry_dsn`                  | string           | required by: `clientside_sentry_enabled` | Clientside Sentry Data Source Name. |
-| `clientside_sentry_enabled`              | boolean          | no                                   | (**If enabled, requires:** `clientside_sentry_dsn`) Enable Sentry error reporting for the client side. |
 | `commit_email_hostname`                  | string           | no                                   | Custom hostname (for private commit emails). |
 | `container_registry_token_expire_delay`  | integer          | no                                   | Container Registry token duration in minutes. |
 | `default_artifacts_expire_in`            | string           | no                                   | Set the default expiration time for each job's artifacts. |
-- 
cgit v1.2.1


From f30dff78b50bf8773a915a64fb9ccedc3795a22c Mon Sep 17 00:00:00 2001
From: Mathieu Parent <math.parent@gmail.com>
Date: Thu, 18 Jul 2019 18:07:22 +0200
Subject: Settings API: External authentication moved to core

See #57131.
---
 doc/api/settings.md | 26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/doc/api/settings.md b/doc/api/settings.md
index f6b0770e65c..70cb08ee3aa 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -121,6 +121,10 @@ Example response:
   "domain_whitelist": [],
   "domain_blacklist_enabled" : false,
   "domain_blacklist" : [],
+  "external_authorization_service_enabled": true,
+  "external_authorization_service_url": "https://authorize.me",
+  "external_authorization_service_default_label": "default",
+  "external_authorization_service_timeout": 0.5,
   "user_oauth_applications": true,
   "after_sign_out_path": "",
   "container_registry_token_expire_delay": 5,
@@ -151,10 +155,6 @@ Example response:
 Users on GitLab [Premium or Ultimate](https://about.gitlab.com/pricing/) may also see
 these parameters:
 
-- `external_authorization_service_enabled`
-- `external_authorization_service_url`
-- `external_authorization_service_default_label`
-- `external_authorization_service_timeout`
 - `file_template_project_id`
 - `geo_node_allowed_ips`
 - `geo_status_timeout`
@@ -162,10 +162,6 @@ these parameters:
 Example responses: **(PREMIUM ONLY)**
 
 ```json
-  "external_authorization_service_enabled": true,
-  "external_authorization_service_url": "https://authorize.me",
-  "external_authorization_service_default_label": "default",
-  "external_authorization_service_timeout": 0.5,
   "file_template_project_id": 1,
   "geo_node_allowed_ips": "0.0.0.0/0, ::/0"
 ```
@@ -225,13 +221,13 @@ are listed in the descriptions of the relevant settings.
 | `email_author_in_body`                   | boolean          | no                                   | Some email servers do not support overriding the email sender name. Enable this option to include the name of the author of the issue, merge request or comment in the email body instead. |
 | `enabled_git_access_protocol`            | string           | no                                   | Enabled protocols for Git access. Allowed values are: `ssh`, `http`, and `nil` to allow both protocols. |
 | `enforce_terms`                          | boolean          | no                                   | (**If enabled, requires:** `terms`) Enforce application ToS to all users. |
-| `external_auth_client_cert`              | string           | no                                   | **(PREMIUM)** (**If enabled, requires:** `external_auth_client_key`) The certificate to use to authenticate with the external authorization service |
-| `external_auth_client_key_pass`          | string           | no                                   | **(PREMIUM)** Passphrase to use for the private key when authenticating with the external service this is encrypted when stored |
-| `external_auth_client_key`               | string           | required by: `external_auth_client_cert` | **(PREMIUM)** Private key for the certificate when authentication is required for the external authorization service, this is encrypted when stored |
-| `external_authorization_service_default_label` | string     | required by: `external_authorization_service_enabled` | **(PREMIUM)** The default classification label to use when requesting authorization and no classification label has been specified on the project |
-| `external_authorization_service_enabled` | boolean          | no                                   | **(PREMIUM)** (**If enabled, requires:** `external_authorization_service_default_label`, `external_authorization_service_timeout` and `external_authorization_service_url` )  Enable using an external authorization service for accessing projects |
-| `external_authorization_service_timeout` | float            | required by: `external_authorization_service_enabled` | **(PREMIUM)** The timeout after which an authorization request is aborted, in seconds. When a request times out, access is denied to the user. (min: 0.001, max: 10, step: 0.001) |
-| `external_authorization_service_url`     | string           | required by: `external_authorization_service_enabled` | **(PREMIUM)** URL to which authorization requests will be directed |
+| `external_auth_client_cert`              | string           | no                                   | (**If enabled, requires:** `external_auth_client_key`) The certificate to use to authenticate with the external authorization service |
+| `external_auth_client_key_pass`          | string           | no                                   | Passphrase to use for the private key when authenticating with the external service this is encrypted when stored |
+| `external_auth_client_key`               | string           | required by: `external_auth_client_cert` | Private key for the certificate when authentication is required for the external authorization service, this is encrypted when stored |
+| `external_authorization_service_default_label` | string     | required by: `external_authorization_service_enabled` | The default classification label to use when requesting authorization and no classification label has been specified on the project |
+| `external_authorization_service_enabled` | boolean          | no                                   | (**If enabled, requires:** `external_authorization_service_default_label`, `external_authorization_service_timeout` and `external_authorization_service_url` )  Enable using an external authorization service for accessing projects |
+| `external_authorization_service_timeout` | float            | required by: `external_authorization_service_enabled` | The timeout after which an authorization request is aborted, in seconds. When a request times out, access is denied to the user. (min: 0.001, max: 10, step: 0.001) |
+| `external_authorization_service_url`     | string           | required by: `external_authorization_service_enabled` | URL to which authorization requests will be directed |
 | `file_template_project_id`               | integer          | no                                   | **(PREMIUM)** The ID of a project to load custom file templates from |
 | `first_day_of_week`                      | integer          | no                                   | Start day of the week for calendar views and date pickers. Valid values are `0` (default) for Sunday, `1` for Monday, and `6` for Saturday. |
 | `geo_node_allowed_ips`                   | string           | yes                                  | **(PREMIUM)** Comma-separated list of IPs and CIDRs of allowed secondary nodes. For example, `1.1.1.1, 2.2.2.0/24`. |
-- 
cgit v1.2.1


From 0020cb5ff42cd763127fc3357ca6aa7f08ea115f Mon Sep 17 00:00:00 2001
From: Achilleas Pipinellis <axil@gitlab.com>
Date: Wed, 7 Aug 2019 18:12:00 +0000
Subject: Apply suggestion to doc/api/settings.md

---
 doc/api/settings.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/api/settings.md b/doc/api/settings.md
index 70cb08ee3aa..a369b7851a4 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -287,7 +287,7 @@ are listed in the descriptions of the relevant settings.
 | `recaptcha_enabled`                      | boolean          | no                                   | (**If enabled, requires:** `recaptcha_private_key` and `recaptcha_site_key`) Enable recaptcha. |
 | `recaptcha_private_key`                  | string           | required by: `recaptcha_enabled`     | Private key for recaptcha. |
 | `recaptcha_site_key`                     | string           | required by: `recaptcha_enabled`     | Site key for recaptcha. |
-| `receive_max_input_size`                 | integer          | no                                   | Maximum push size (MB) |
+| `receive_max_input_size`                 | integer          | no                                   | Maximum push size (MB). |
 | `repository_checks_enabled`              | boolean          | no                                   | GitLab will periodically run `git fsck` in all project and wiki repositories to look for silent disk corruption issues. |
 | `repository_size_limit`                  | integer          | no                                   | **(PREMIUM)** Size limit per repository (MB) |
 | `repository_storages`                    | array of strings | no                                   | A list of names of enabled storage paths, taken from `gitlab.yml`. New projects will be created in one of these stores, chosen at random. |
-- 
cgit v1.2.1


From cffbf290a0c49b127a571b9b3ea0b692bc911db5 Mon Sep 17 00:00:00 2001
From: Ruchika Jain <jain.ruchika56@gmail.com>
Date: Thu, 29 Aug 2019 14:52:08 +0000
Subject: Removed the word located and inserted the word at

---
 doc/user/gitlab_com/index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/user/gitlab_com/index.md b/doc/user/gitlab_com/index.md
index 72beb38fe76..548e029f81f 100644
--- a/doc/user/gitlab_com/index.md
+++ b/doc/user/gitlab_com/index.md
@@ -337,7 +337,7 @@ GitLab.com does not currently use these settings.
 
 In addition to the GitLab Enterprise Edition Omnibus install, GitLab.com uses
 the following applications and settings to achieve scale. All settings are
-located publicly available [chef cookbooks](https://gitlab.com/gitlab-cookbooks).
+publicly available at [chef cookbooks](https://gitlab.com/gitlab-cookbooks).
 
 ### ELK
 
-- 
cgit v1.2.1


From 5ac5108dbf7b84c48128e4a44a9d22c3b760a09e Mon Sep 17 00:00:00 2001
From: Tao Wang <twang2218@gmail.com>
Date: Thu, 14 Jun 2018 18:47:38 +1000
Subject: Externalize strings from 'app/views/projects/services'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Tao Wang <twang2218@gmail.com>
Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 app/views/projects/services/_form.html.haml        |   2 +-
 app/views/projects/services/_index.html.haml       |  12 +--
 app/views/projects/services/edit.html.haml         |   6 +-
 .../_detailed_help.html.haml                       |  28 ++---
 .../mattermost_slash_commands/_help.html.haml      |   8 +-
 .../_installation_info.html.haml                   |   2 +-
 .../services/slack_slash_commands/_help.html.haml  |  44 ++++----
 locale/gitlab.pot                                  | 120 +++++++++++++++++++++
 8 files changed, 166 insertions(+), 56 deletions(-)

diff --git a/app/views/projects/services/_form.html.haml b/app/views/projects/services/_form.html.haml
index de1b95692d6..2f277e8147a 100644
--- a/app/views/projects/services/_form.html.haml
+++ b/app/views/projects/services/_form.html.haml
@@ -15,7 +15,7 @@
         .footer-block.row-content-block
           = service_save_button(@service)
           &nbsp;
-          = link_to 'Cancel', project_settings_integrations_path(@project), class: 'btn btn-cancel'
+          = link_to _('Cancel'), project_settings_integrations_path(@project), class: 'btn btn-cancel'
 
 - if lookup_context.template_exists?('show', "projects/services/#{@service.to_param}", true)
   %hr
diff --git a/app/views/projects/services/_index.html.haml b/app/views/projects/services/_index.html.haml
index 16e48814578..7748a7a6a8e 100644
--- a/app/views/projects/services/_index.html.haml
+++ b/app/views/projects/services/_index.html.haml
@@ -1,8 +1,8 @@
 .row.prepend-top-default.append-bottom-default
   .col-lg-4
     %h4.prepend-top-0
-      Project services
-    %p Project services allow you to integrate GitLab with other applications
+      = s_("ProjectService|Project services")
+    %p= s_("ProjectService|Project services allow you to integrate GitLab with other applications")
   .col-lg-8
     %table.table
       %colgroup
@@ -13,12 +13,12 @@
       %thead
         %tr
           %th
-          %th Service
-          %th.d-none.d-sm-block Description
-          %th Last edit
+          %th= s_("ProjectService|Service")
+          %th.d-none.d-sm-block= _("Description")
+          %th= s_("ProjectService|Last edit")
       - @services.sort_by(&:title).each do |service|
         %tr
-          %td{ "aria-label" => "#{service.title}: status " + (service.activated? ? "on" : "off") }
+          %td{ "aria-label" => (service.activated? ? s_("ProjectService|%{service_title}: status on") : s_("ProjectService|%{service_title}: status off")) % { service_title: service.title } }
             = boolean_to_icon service.activated?
           %td
             = link_to edit_project_service_path(@project, service.to_param) do
diff --git a/app/views/projects/services/edit.html.haml b/app/views/projects/services/edit.html.haml
index df1fd583670..fc20bc52d1c 100644
--- a/app/views/projects/services/edit.html.haml
+++ b/app/views/projects/services/edit.html.haml
@@ -1,6 +1,6 @@
-- breadcrumb_title "Integrations"
-- page_title @service.title, "Services"
-- add_to_breadcrumbs("Settings", edit_project_path(@project))
+- breadcrumb_title s_("ProjectService|Integrations")
+- page_title @service.title, s_("ProjectService|Services")
+- add_to_breadcrumbs(s_("ProjectService|Settings"), edit_project_path(@project))
 
 = render 'deprecated_message' if @service.deprecation_message
 
diff --git a/app/views/projects/services/mattermost_slash_commands/_detailed_help.html.haml b/app/views/projects/services/mattermost_slash_commands/_detailed_help.html.haml
index 82c1d57c97e..395df502ddb 100644
--- a/app/views/projects/services/mattermost_slash_commands/_detailed_help.html.haml
+++ b/app/views/projects/services/mattermost_slash_commands/_detailed_help.html.haml
@@ -1,6 +1,6 @@
-- run_actions_text = "Perform common operations on GitLab project: #{@project.full_name}"
+- run_actions_text = s_("ProjectService|Perform common operations on GitLab project: %{project_name}") % { project_name: @project.full_name }
 
-%p To set up this service:
+%p= s_("ProjectService|To set up this service:")
 %ul.list-unstyled.indent-list
   %li
     1.
@@ -18,67 +18,67 @@
 
 .help-form
   .form-group
-    = label_tag :display_name, 'Display name', class: 'col-12 col-form-label label-bold'
+    = label_tag :display_name, _('Display name'), class: 'col-12 col-form-label label-bold'
     .col-12.input-group
       = text_field_tag :display_name, "GitLab / #{@project.full_name}", class: 'form-control form-control-sm', readonly: 'readonly'
       .input-group-append
         = clipboard_button(target: '#display_name', class: 'input-group-text')
 
   .form-group
-    = label_tag :description, 'Description', class: 'col-12 col-form-label  label-bold'
+    = label_tag :description, _('Description'), class: 'col-12 col-form-label  label-bold'
     .col-12.input-group
       = text_field_tag :description, run_actions_text, class: 'form-control form-control-sm', readonly: 'readonly'
       .input-group-append
         = clipboard_button(target: '#description', class: 'input-group-text')
 
   .form-group
-    = label_tag nil, 'Command trigger word', class: 'col-12 col-form-label label-bold'
+    = label_tag nil, s_('MattermostService|Command trigger word'), class: 'col-12 col-form-label label-bold'
     .col-12
-      %p Fill in the word that works best for your team.
+      %p= s_('MattermostService|Fill in the word that works best for your team.')
       %p
-        Suggestions:
+        = s_('MattermostService|Suggestions:')
         %code= 'gitlab'
         %code= @project.path # Path contains no spaces, but dashes
         %code= @project.full_path
 
   .form-group
-    = label_tag :request_url, 'Request URL', class: 'col-12 col-form-label label-bold'
+    = label_tag :request_url, s_('MattermostService|Request URL'), class: 'col-12 col-form-label label-bold'
     .col-12.input-group
       = text_field_tag :request_url, service_trigger_url(subject), class: 'form-control form-control-sm', readonly: 'readonly'
       .input-group-append
         = clipboard_button(target: '#request_url', class: 'input-group-text')
 
   .form-group
-    = label_tag nil, 'Request method', class: 'col-12 col-form-label label-bold'
+    = label_tag nil, s_('MattermostService|Request method'), class: 'col-12 col-form-label label-bold'
     .col-12 POST
 
   .form-group
-    = label_tag :response_username, 'Response username', class: 'col-12 col-form-label label-bold'
+    = label_tag :response_username, s_('MattermostService|Response username'), class: 'col-12 col-form-label label-bold'
     .col-12.input-group
       = text_field_tag :response_username, 'GitLab', class: 'form-control form-control-sm', readonly: 'readonly'
       .input-group-append
         = clipboard_button(target: '#response_username', class: 'input-group-text')
 
   .form-group
-    = label_tag :response_icon, 'Response icon', class: 'col-12 col-form-label label-bold'
+    = label_tag :response_icon, s_('MattermostService|Response icon'), class: 'col-12 col-form-label label-bold'
     .col-12.input-group
       = text_field_tag :response_icon, asset_url('gitlab_logo.png'), class: 'form-control form-control-sm', readonly: 'readonly'
       .input-group-append
         = clipboard_button(target: '#response_icon', class: 'input-group-text')
 
   .form-group
-    = label_tag nil, 'Autocomplete', class: 'col-12 col-form-label label-bold'
+    = label_tag nil, _('Autocomplete'), class: 'col-12 col-form-label label-bold'
     .col-12 Yes
 
   .form-group
-    = label_tag :autocomplete_hint, 'Autocomplete hint', class: 'col-12 col-12 col-form-label label-bold'
+    = label_tag :autocomplete_hint, _('Autocomplete hint'), class: 'col-12 col-12 col-form-label label-bold'
     .col-12.input-group
       = text_field_tag :autocomplete_hint, '[help]', class: 'form-control form-control-sm', readonly: 'readonly'
       .input-group-append
         = clipboard_button(target: '#autocomplete_hint', class: 'input-group-text')
 
   .form-group
-    = label_tag :autocomplete_description, 'Autocomplete description', class: 'col-12 col-form-label label-bold'
+    = label_tag :autocomplete_description, _('Autocomplete description'), class: 'col-12 col-form-label label-bold'
     .col-12.input-group
       = text_field_tag :autocomplete_description, run_actions_text, class: 'form-control form-control-sm', readonly: 'readonly'
       .input-group-append
diff --git a/app/views/projects/services/mattermost_slash_commands/_help.html.haml b/app/views/projects/services/mattermost_slash_commands/_help.html.haml
index f51dd581d29..cc005dd69b7 100644
--- a/app/views/projects/services/mattermost_slash_commands/_help.html.haml
+++ b/app/views/projects/services/mattermost_slash_commands/_help.html.haml
@@ -3,14 +3,12 @@
 .info-well
   .well-segment
     %p
-      This service allows users to perform common operations on this
-      project by entering slash commands in Mattermost.
+      = s_("MattermostService|This service allows users to perform common operations on this project by entering slash commands in Mattermost.")
       = link_to help_page_path('user/project/integrations/mattermost_slash_commands.md'), target: '_blank' do
-        View documentation
+        = _("View documentation")
         = sprite_icon('external-link', size: 16)
     %p.inline
-      See list of available commands in Mattermost after setting up this service,
-      by entering
+      = s_("MattermostService|See list of available commands in Mattermost after setting up this service, by entering")
     %kbd.inline /&lt;trigger&gt; help
     - unless enabled || @service.template?
       = render 'projects/services/mattermost_slash_commands/detailed_help', subject: @service
diff --git a/app/views/projects/services/mattermost_slash_commands/_installation_info.html.haml b/app/views/projects/services/mattermost_slash_commands/_installation_info.html.haml
index 2da8e5428ec..aee81ea744a 100644
--- a/app/views/projects/services/mattermost_slash_commands/_installation_info.html.haml
+++ b/app/views/projects/services/mattermost_slash_commands/_installation_info.html.haml
@@ -4,4 +4,4 @@
       .col-sm-9.offset-sm-3
         = link_to new_project_mattermost_path(@project), class: 'btn btn-lg' do
           = custom_icon('mattermost_logo', size: 15)
-          Add to Mattermost
+          = s_("MattermostService|Add to Mattermost")
diff --git a/app/views/projects/services/slack_slash_commands/_help.html.haml b/app/views/projects/services/slack_slash_commands/_help.html.haml
index 9b7732abc62..7f6717e298c 100644
--- a/app/views/projects/services/slack_slash_commands/_help.html.haml
+++ b/app/views/projects/services/slack_slash_commands/_help.html.haml
@@ -4,17 +4,15 @@
 .info-well
   .well-segment
     %p
-      This service allows users to perform common operations on this
-      project by entering slash commands in Slack.
+      = s_("SlackService|This service allows users to perform common operations on this project by entering slash commands in Slack.")
       = link_to help_page_path('user/project/integrations/slack_slash_commands.md'), target: '_blank' do
-        View documentation
+        = _("View documentation")
         = sprite_icon('external-link', size: 16)
     %p.inline
-      See list of available commands in Slack after setting up this service,
-      by entering
+      = s_("SlackService|See list of available commands in Slack after setting up this service, by entering")
     %kbd.inline /&lt;command&gt; help
     - unless @service.template?
-      %p To set up this service:
+      %p= _("To set up this service:")
       %ul.list-unstyled.indent-list
         %li
           1.
@@ -27,11 +25,11 @@
 
       .help-form
         .form-group
-          = label_tag nil, 'Command', class: 'col-12 col-form-label label-bold'
+          = label_tag nil, _('Command'), class: 'col-12 col-form-label label-bold'
           .col-12
-            %p Fill in the word that works best for your team.
+            %p= s_('SlackService|Fill in the word that works best for your team.')
             %p
-              Suggestions:
+              = _("Suggestions:")
               %code= 'gitlab'
               %code= @project.path # Path contains no spaces, but dashes
               %code= @project.full_path
@@ -44,44 +42,44 @@
               = clipboard_button(target: '#url', class: 'input-group-text')
 
         .form-group
-          = label_tag nil, 'Method', class: 'col-12 col-form-label label-bold'
+          = label_tag nil, _('Method'), class: 'col-12 col-form-label label-bold'
           .col-12 POST
 
         .form-group
-          = label_tag :customize_name, 'Customize name', class: 'col-12 col-form-label label-bold'
+          = label_tag :customize_name, _('Customize name'), class: 'col-12 col-form-label label-bold'
           .col-12.input-group
             = text_field_tag :customize_name, 'GitLab', class: 'form-control form-control-sm', readonly: 'readonly'
             .input-group-append
               = clipboard_button(target: '#customize_name', class: 'input-group-text')
 
         .form-group
-          = label_tag nil, 'Customize icon', class: 'col-12 col-form-label label-bold'
+          = label_tag nil, _('Customize icon'), class: 'col-12 col-form-label label-bold'
           .col-12
             = image_tag(asset_url('slash-command-logo.png'), width: 36, height: 36, class: 'mr-3')
-            = link_to('Download image', asset_url('gitlab_logo.png'), class: 'btn btn-sm', target: '_blank', rel: 'noopener noreferrer')
+            = link_to(_('Download image'), asset_url('gitlab_logo.png'), class: 'btn btn-sm', target: '_blank', rel: 'noopener noreferrer')
 
         .form-group
-          = label_tag nil, 'Autocomplete', class: 'col-12 col-form-label label-bold'
+          = label_tag nil, _('Autocomplete'), class: 'col-12 col-form-label label-bold'
           .col-12 Show this command in the autocomplete list
 
         .form-group
-          = label_tag :autocomplete_description, 'Autocomplete description', class: 'col-12 col-form-label label-bold'
+          = label_tag :autocomplete_description, _('Autocomplete description'), class: 'col-12 col-form-label label-bold'
           .col-12.input-group
             = text_field_tag :autocomplete_description, run_actions_text, class: 'form-control form-control-sm', readonly: 'readonly'
             .input-group-append
               = clipboard_button(target: '#autocomplete_description', class: 'input-group-text')
 
         .form-group
-          = label_tag :autocomplete_usage_hint, 'Autocomplete usage hint', class: 'col-12 col-form-label label-bold'
+          = label_tag :autocomplete_usage_hint, _('Autocomplete usage hint'), class: 'col-12 col-form-label label-bold'
           .col-12.input-group
             = text_field_tag :autocomplete_usage_hint, '[help]', class: 'form-control form-control-sm', readonly: 'readonly'
             .input-group-append
               = clipboard_button(target: '#autocomplete_usage_hint', class: 'input-group-text')
 
         .form-group
-          = label_tag :descriptive_label, 'Descriptive label', class: 'col-12 col-form-label label-bold'
+          = label_tag :descriptive_label, _('Descriptive label'), class: 'col-12 col-form-label label-bold'
           .col-12.input-group
-            = text_field_tag :descriptive_label, 'Perform common operations on GitLab project', class: 'form-control form-control-sm', readonly: 'readonly'
+            = text_field_tag :descriptive_label, _('Perform common operations on GitLab project'), class: 'form-control form-control-sm', readonly: 'readonly'
             .input-group-append
               = clipboard_button(target: '#descriptive_label', class: 'input-group-text')
 
@@ -89,12 +87,6 @@
 
       %ul.list-unstyled.indent-list
         %li
-          2. Paste the
-          %strong Token
-          into the field below
+          = s_("SlackService|2. Paste the <strong>Token</strong> into the field below").html_safe
         %li
-          3. Select the
-          %strong Active
-          checkbox, press
-          %strong Save changes
-          and start using GitLab inside Slack!
+          = s_("SlackService|3. Select the <strong>Active</strong> checkbox, press <strong>Save changes</strong> and start using GitLab inside Slack!").html_safe
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 12138d2db3a..2c85693a06a 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -1516,6 +1516,18 @@ msgstr ""
 msgid "AutoDevOps|The Auto DevOps pipeline has been enabled and will be used if no alternative CI configuration file is found. %{more_information_link}"
 msgstr ""
 
+msgid "Autocomplete"
+msgstr ""
+
+msgid "Autocomplete description"
+msgstr ""
+
+msgid "Autocomplete hint"
+msgstr ""
+
+msgid "Autocomplete usage hint"
+msgstr ""
+
 msgid "Automatic certificate management using %{lets_encrypt_link_start}Let's Encrypt%{lets_encrypt_link_end}"
 msgstr ""
 
@@ -2974,6 +2986,9 @@ msgstr ""
 msgid "ComboSearch is not defined"
 msgstr ""
 
+msgid "Command"
+msgstr ""
+
 msgid "Command line instructions"
 msgstr ""
 
@@ -3611,9 +3626,15 @@ msgstr ""
 msgid "Customize how Google Code email addresses and usernames are imported into GitLab. In the next step, you'll be able to select the projects you want to import."
 msgstr ""
 
+msgid "Customize icon"
+msgstr ""
+
 msgid "Customize language and region related settings."
 msgstr ""
 
+msgid "Customize name"
+msgstr ""
+
 msgid "Customize your pipeline configuration, view your pipeline status and coverage report."
 msgstr ""
 
@@ -3964,6 +3985,9 @@ msgstr ""
 msgid "Description:"
 msgstr ""
 
+msgid "Descriptive label"
+msgstr ""
+
 msgid "Deselect all"
 msgstr ""
 
@@ -4075,6 +4099,9 @@ msgstr ""
 msgid "Dismiss Cycle Analytics introduction box"
 msgstr ""
 
+msgid "Display name"
+msgstr ""
+
 msgid "Do you want to customize how Google Code email addresses and usernames are imported into GitLab?"
 msgstr ""
 
@@ -4120,6 +4147,9 @@ msgstr ""
 msgid "Download export"
 msgstr ""
 
+msgid "Download image"
+msgstr ""
+
 msgid "Download source code"
 msgstr ""
 
@@ -6834,6 +6864,36 @@ msgstr ""
 msgid "Marks this issue as a duplicate of %{duplicate_reference}."
 msgstr ""
 
+msgid "MattermostService|Add to Mattermost"
+msgstr ""
+
+msgid "MattermostService|Command trigger word"
+msgstr ""
+
+msgid "MattermostService|Fill in the word that works best for your team."
+msgstr ""
+
+msgid "MattermostService|Request URL"
+msgstr ""
+
+msgid "MattermostService|Request method"
+msgstr ""
+
+msgid "MattermostService|Response icon"
+msgstr ""
+
+msgid "MattermostService|Response username"
+msgstr ""
+
+msgid "MattermostService|See list of available commands in Mattermost after setting up this service, by entering"
+msgstr ""
+
+msgid "MattermostService|Suggestions:"
+msgstr ""
+
+msgid "MattermostService|This service allows users to perform common operations on this project by entering slash commands in Mattermost."
+msgstr ""
+
 msgid "Max access level"
 msgstr ""
 
@@ -7011,6 +7071,9 @@ msgstr ""
 msgid "Messages"
 msgstr ""
 
+msgid "Method"
+msgstr ""
+
 msgid "Metrics"
 msgstr ""
 
@@ -7930,6 +7993,9 @@ msgstr ""
 msgid "Perform advanced options such as changing path, transferring, or removing the group."
 msgstr ""
 
+msgid "Perform common operations on GitLab project"
+msgstr ""
+
 msgid "Performance optimization"
 msgstr ""
 
@@ -8887,6 +8953,39 @@ msgstr ""
 msgid "ProjectSelect|Search for project"
 msgstr ""
 
+msgid "ProjectService|%{service_title}: status off"
+msgstr ""
+
+msgid "ProjectService|%{service_title}: status on"
+msgstr ""
+
+msgid "ProjectService|Integrations"
+msgstr ""
+
+msgid "ProjectService|Last edit"
+msgstr ""
+
+msgid "ProjectService|Perform common operations on GitLab project: %{project_name}"
+msgstr ""
+
+msgid "ProjectService|Project services"
+msgstr ""
+
+msgid "ProjectService|Project services allow you to integrate GitLab with other applications"
+msgstr ""
+
+msgid "ProjectService|Service"
+msgstr ""
+
+msgid "ProjectService|Services"
+msgstr ""
+
+msgid "ProjectService|Settings"
+msgstr ""
+
+msgid "ProjectService|To set up this service:"
+msgstr ""
+
 msgid "ProjectSettings|Additional merge request capabilities that influence how and when merges will be performed"
 msgstr ""
 
@@ -10414,6 +10513,21 @@ msgstr ""
 msgid "Size and domain settings for static websites"
 msgstr ""
 
+msgid "SlackService|2. Paste the <strong>Token</strong> into the field below"
+msgstr ""
+
+msgid "SlackService|3. Select the <strong>Active</strong> checkbox, press <strong>Save changes</strong> and start using GitLab inside Slack!"
+msgstr ""
+
+msgid "SlackService|Fill in the word that works best for your team."
+msgstr ""
+
+msgid "SlackService|See list of available commands in Slack after setting up this service, by entering"
+msgstr ""
+
+msgid "SlackService|This service allows users to perform common operations on this project by entering slash commands in Slack."
+msgstr ""
+
 msgid "Slower but makes sure the project workspace is pristine as it clones the repository from scratch for every job"
 msgstr ""
 
@@ -10987,6 +11101,9 @@ msgstr ""
 msgid "SuggestedColors|Very pale orange"
 msgstr ""
 
+msgid "Suggestions:"
+msgstr ""
+
 msgid "Sunday"
 msgstr ""
 
@@ -12043,6 +12160,9 @@ msgstr ""
 msgid "To see all the user's personal access tokens you must impersonate them first."
 msgstr ""
 
+msgid "To set up this service:"
+msgstr ""
+
 msgid "To specify the notification level per project of a group you belong to, you need to visit project page and change notification level there."
 msgstr ""
 
-- 
cgit v1.2.1


From e5be205a2384435a67ccff72f8b33df37efd54e7 Mon Sep 17 00:00:00 2001
From: Wolfgang Faust <wolfgangmcq@gmail.com>
Date: Thu, 29 Aug 2019 15:53:01 +0000
Subject: Make some buttons green again

Fix missing .btn-success class on the following buttons:
* 'Create milestone' button
* Secondary button on profile tabs

`btn-create` was an old class which was was removed in !23232
and replaced with `btn-success`,
but these two seem to have been missed in the process.
---
 app/views/shared/empty_states/_profile_tabs.html.haml      | 2 +-
 changelogs/unreleased/fix-create-milestone-btn-success.yml | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/fix-create-milestone-btn-success.yml

diff --git a/app/views/shared/empty_states/_profile_tabs.html.haml b/app/views/shared/empty_states/_profile_tabs.html.haml
index 6da40e1b059..98a5a5953d0 100644
--- a/app/views/shared/empty_states/_profile_tabs.html.haml
+++ b/app/views/shared/empty_states/_profile_tabs.html.haml
@@ -12,7 +12,7 @@
           %p= current_user_empty_message_description
 
         - if secondary_button_link.present?
-          = link_to secondary_button_label, secondary_button_link, class: 'btn btn-create btn-inverted'
+          = link_to secondary_button_label, secondary_button_link, class: 'btn btn-success btn-inverted'
 
         = link_to primary_button_label, primary_button_link, class: 'btn btn-success'
       - else
diff --git a/changelogs/unreleased/fix-create-milestone-btn-success.yml b/changelogs/unreleased/fix-create-milestone-btn-success.yml
new file mode 100644
index 00000000000..a1b1d305ce3
--- /dev/null
+++ b/changelogs/unreleased/fix-create-milestone-btn-success.yml
@@ -0,0 +1,5 @@
+---
+title: Fix style of secondary profile tab buttons.
+merge_request: 32010
+author: Wolfgang Faust
+type: fixed
-- 
cgit v1.2.1


From 72390953da802311180f53b6a646d80bc1da2849 Mon Sep 17 00:00:00 2001
From: Lee Tickett <lee@tickett.net>
Date: Thu, 29 Aug 2019 16:19:07 +0000
Subject: Handle invalid mirror url

---
 app/models/remote_mirror.rb                         | 1 +
 app/views/projects/mirrors/_mirror_repos.html.haml  | 2 +-
 changelogs/unreleased/handle-invalid-mirror-url.yml | 5 +++++
 locale/gitlab.pot                                   | 3 +++
 spec/models/remote_mirror_spec.rb                   | 7 +++++++
 5 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/handle-invalid-mirror-url.yml

diff --git a/app/models/remote_mirror.rb b/app/models/remote_mirror.rb
index c9ee0653d86..41e63986286 100644
--- a/app/models/remote_mirror.rb
+++ b/app/models/remote_mirror.rb
@@ -200,6 +200,7 @@ class RemoteMirror < ApplicationRecord
     result.password = '*****' if result.password
     result.user = '*****' if result.user && result.user != 'git' # tokens or other data may be saved as user
     result.to_s
+  rescue URI::Error
   end
 
   def ensure_remote!
diff --git a/app/views/projects/mirrors/_mirror_repos.html.haml b/app/views/projects/mirrors/_mirror_repos.html.haml
index 6f8a93fbcf5..84f0900d9c1 100644
--- a/app/views/projects/mirrors/_mirror_repos.html.haml
+++ b/app/views/projects/mirrors/_mirror_repos.html.haml
@@ -50,7 +50,7 @@
             - @project.remote_mirrors.each_with_index do |mirror, index|
               - next if mirror.new_record?
               %tr.qa-mirrored-repository-row.rspec-mirrored-repository-row{ class: ('bg-secondary' if mirror.disabled?) }
-                %td.qa-mirror-repository-url= mirror.safe_url
+                %td.qa-mirror-repository-url= mirror.safe_url || _('Invalid URL')
                 %td= _('Push')
                 %td
                   = mirror.last_update_started_at.present? ? time_ago_with_tooltip(mirror.last_update_started_at) : _('Never')
diff --git a/changelogs/unreleased/handle-invalid-mirror-url.yml b/changelogs/unreleased/handle-invalid-mirror-url.yml
new file mode 100644
index 00000000000..c72707a2cad
--- /dev/null
+++ b/changelogs/unreleased/handle-invalid-mirror-url.yml
@@ -0,0 +1,5 @@
+---
+title: Handle invalid mirror url
+merge_request: 32353
+author: Lee Tickett
+type: fixed
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 12138d2db3a..51e00d6e0d2 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -6110,6 +6110,9 @@ msgstr ""
 msgid "Invalid Login or password"
 msgstr ""
 
+msgid "Invalid URL"
+msgstr ""
+
 msgid "Invalid date"
 msgstr ""
 
diff --git a/spec/models/remote_mirror_spec.rb b/spec/models/remote_mirror_spec.rb
index 7edeb56efe2..f8d6e500e10 100644
--- a/spec/models/remote_mirror_spec.rb
+++ b/spec/models/remote_mirror_spec.rb
@@ -40,6 +40,13 @@ describe RemoteMirror, :mailer do
         expect(remote_mirror).to be_invalid
         expect(remote_mirror.errors[:url].first).to include('Requests to the local network are not allowed')
       end
+
+      it 'returns a nil safe_url' do
+        remote_mirror = build(:remote_mirror, url: 'http://[0:0:0:0:ffff:123.123.123.123]/foo.git')
+
+        expect(remote_mirror.url).to eq('http://[0:0:0:0:ffff:123.123.123.123]/foo.git')
+        expect(remote_mirror.safe_url).to be_nil
+      end
     end
   end
 
-- 
cgit v1.2.1


From a79459822dd67b6fada3dc0072e1c9496373b280 Mon Sep 17 00:00:00 2001
From: Lukas 'Eipi' Eipert <leipert@gitlab.com>
Date: Thu, 29 Aug 2019 16:34:41 +0000
Subject: Update GitLab Packages

---
 package.json |  4 ++--
 yarn.lock    | 18 +++++++++---------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/package.json b/package.json
index 50cd5f36d20..c3168fc9071 100644
--- a/package.json
+++ b/package.json
@@ -36,8 +36,8 @@
     "@babel/plugin-syntax-dynamic-import": "^7.2.0",
     "@babel/plugin-syntax-import-meta": "^7.2.0",
     "@babel/preset-env": "^7.5.5",
-    "@gitlab/svgs": "^1.70.0",
-    "@gitlab/ui": "5.19.0",
+    "@gitlab/svgs": "^1.71.0",
+    "@gitlab/ui": "5.20.1",
     "@gitlab/visual-review-tools": "^1.0.0",
     "apollo-cache-inmemory": "^1.5.1",
     "apollo-client": "^2.5.1",
diff --git a/yarn.lock b/yarn.lock
index c4fe112d833..2a11e66e2b5 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -991,15 +991,15 @@
   dependencies:
     vue-eslint-parser "^6.0.4"
 
-"@gitlab/svgs@^1.70.0":
-  version "1.70.0"
-  resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.70.0.tgz#bdae478148c15d955fc06e69fd5d5ecae8298943"
-  integrity sha512-0uV9fgTwe17Fyy0hTcrsGX2jJuCrz3uRIe8yffuqc6pbQrSfYJyN66mfCCB45wq8lKTgOB5q0qcUyJx3RQEcKg==
-
-"@gitlab/ui@5.19.0":
-  version "5.19.0"
-  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-5.19.0.tgz#ef5431e0e91eb4009a30edcf49a40716cc2570d9"
-  integrity sha512-gCeTymtVzzO2uOWZGIweLM5JcHq3TN1QwP61CXw7b9Lp5A2MysRb8upehtR5d4JLOf/GQg8rHQB26uRvUc+AXQ==
+"@gitlab/svgs@^1.71.0":
+  version "1.71.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.71.0.tgz#c8e6e8f500ea91e5cbba4ac08df533fb2e622a00"
+  integrity sha512-kkeNic/FFwaqKnzwio4NE7whBOZ/toRJ8cS0587DBotajAzSYhph5ij4TCY2GTjPa33zIJ5OUr/k90C0Kr71hQ==
+
+"@gitlab/ui@5.20.1":
+  version "5.20.1"
+  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-5.20.1.tgz#a7d479f2a19988eacd90a4864183f0c49ddd310f"
+  integrity sha512-fbqs5ncnqItgmXLlK4/ZoXwW+6DGBf+/nub2agoIT4EocwYGtrmAB8V+ybEcRrJVG8YpkCGt6R4lD24VrATWTw==
   dependencies:
     "@babel/standalone" "^7.0.0"
     "@gitlab/vue-toasted" "^1.2.1"
-- 
cgit v1.2.1


From 34d142e593827df932651aaacebcd3914ba7d923 Mon Sep 17 00:00:00 2001
From: George Koltsov <koltsov.george@gmail.com>
Date: Thu, 29 Aug 2019 16:49:22 +0000
Subject: Allow project feature permissions to be overridden during import

---
 app/models/project.rb                               |  2 ++
 .../georgekoltsov-13698-override-params.yml         |  5 +++++
 .../import_export/project_tree_restorer_spec.rb     | 21 +++++++++++++++++++++
 3 files changed, 28 insertions(+)
 create mode 100644 changelogs/unreleased/georgekoltsov-13698-override-params.yml

diff --git a/app/models/project.rb b/app/models/project.rb
index c67c5c7bc8c..8f568a5b840 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -61,6 +61,8 @@ class Project < ApplicationRecord
 
   delegate :feature_available?, :builds_enabled?, :wiki_enabled?,
            :merge_requests_enabled?, :issues_enabled?, :pages_enabled?, :public_pages?,
+           :merge_requests_access_level, :issues_access_level, :wiki_access_level,
+           :snippets_access_level, :builds_access_level, :repository_access_level,
            to: :project_feature, allow_nil: true
 
   delegate :base_dir, :disk_path, :ensure_storage_path_exists, to: :storage
diff --git a/changelogs/unreleased/georgekoltsov-13698-override-params.yml b/changelogs/unreleased/georgekoltsov-13698-override-params.yml
new file mode 100644
index 00000000000..1bbde160e18
--- /dev/null
+++ b/changelogs/unreleased/georgekoltsov-13698-override-params.yml
@@ -0,0 +1,5 @@
+---
+title: Allow project feature permissions to be overridden during import with override_params
+merge_request: 32348
+author:
+type: fixed
diff --git a/spec/lib/gitlab/import_export/project_tree_restorer_spec.rb b/spec/lib/gitlab/import_export/project_tree_restorer_spec.rb
index d6e1fbaa979..0aef4887c75 100644
--- a/spec/lib/gitlab/import_export/project_tree_restorer_spec.rb
+++ b/spec/lib/gitlab/import_export/project_tree_restorer_spec.rb
@@ -396,6 +396,27 @@ describe Gitlab::ImportExport::ProjectTreeRestorer do
 
         expect(project.lfs_enabled).to be_falsey
       end
+
+      it 'overrides project feature access levels' do
+        access_level_keys = project.project_feature.attributes.keys.select { |a| a =~ /_access_level/ }
+
+        # `pages_access_level` is not included, since it is not available in the public API
+        # and has a dependency on project's visibility level
+        # see ProjectFeature model
+        access_level_keys.delete('pages_access_level')
+
+        disabled_access_levels = Hash[access_level_keys.collect { |item| [item, 'disabled'] }]
+
+        project.create_import_data(data: { override_params: disabled_access_levels })
+
+        restored_project_json
+
+        aggregate_failures do
+          access_level_keys.each do |key|
+            expect(project.public_send(key)).to eq(ProjectFeature::DISABLED)
+          end
+        end
+      end
     end
 
     context 'with a project that has a group' do
-- 
cgit v1.2.1


From c6ccc07f48c7c1f9da43ecd82015500a4340544d Mon Sep 17 00:00:00 2001
From: Nick Thomas <nick@gitlab.com>
Date: Thu, 29 Aug 2019 18:04:52 +0100
Subject: Revert "Cache branch and tag names as Redis sets"

This reverts commit 0eff75fa2b6691b6fba31fcc2842f51debd249a9.
---
 app/models/repository.rb                           | 12 ++--
 .../unreleased/64251-branch-name-set-cache.yml     |  5 --
 lib/gitlab/repository_cache_adapter.rb             | 53 ---------------
 lib/gitlab/repository_set_cache.rb                 | 67 -------------------
 spec/lib/gitlab/repository_cache_adapter_spec.rb   |  7 +-
 spec/lib/gitlab/repository_set_cache_spec.rb       | 75 ----------------------
 spec/models/repository_spec.rb                     | 52 ++++-----------
 7 files changed, 17 insertions(+), 254 deletions(-)
 delete mode 100644 changelogs/unreleased/64251-branch-name-set-cache.yml
 delete mode 100644 lib/gitlab/repository_set_cache.rb
 delete mode 100644 spec/lib/gitlab/repository_set_cache_spec.rb

diff --git a/app/models/repository.rb b/app/models/repository.rb
index b957b9b0bdd..6f63cd32da4 100644
--- a/app/models/repository.rb
+++ b/app/models/repository.rb
@@ -239,13 +239,13 @@ class Repository
   def branch_exists?(branch_name)
     return false unless raw_repository
 
-    branch_names_include?(branch_name)
+    branch_names.include?(branch_name)
   end
 
   def tag_exists?(tag_name)
     return false unless raw_repository
 
-    tag_names_include?(tag_name)
+    tag_names.include?(tag_name)
   end
 
   def ref_exists?(ref)
@@ -565,10 +565,10 @@ class Repository
   end
 
   delegate :branch_names, to: :raw_repository
-  cache_method_as_redis_set :branch_names, fallback: []
+  cache_method :branch_names, fallback: []
 
   delegate :tag_names, to: :raw_repository
-  cache_method_as_redis_set :tag_names, fallback: []
+  cache_method :tag_names, fallback: []
 
   delegate :branch_count, :tag_count, :has_visible_content?, to: :raw_repository
   cache_method :branch_count, fallback: 0
@@ -1130,10 +1130,6 @@ class Repository
     @cache ||= Gitlab::RepositoryCache.new(self)
   end
 
-  def redis_set_cache
-    @redis_set_cache ||= Gitlab::RepositorySetCache.new(self)
-  end
-
   def request_store_cache
     @request_store_cache ||= Gitlab::RepositoryCache.new(self, backend: Gitlab::SafeRequestStore)
   end
diff --git a/changelogs/unreleased/64251-branch-name-set-cache.yml b/changelogs/unreleased/64251-branch-name-set-cache.yml
deleted file mode 100644
index 6ce4bdf5e43..00000000000
--- a/changelogs/unreleased/64251-branch-name-set-cache.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Cache branch and tag names as Redis sets
-merge_request: 30476
-author:
-type: performance
diff --git a/lib/gitlab/repository_cache_adapter.rb b/lib/gitlab/repository_cache_adapter.rb
index 75503ee1789..e40c366ed02 100644
--- a/lib/gitlab/repository_cache_adapter.rb
+++ b/lib/gitlab/repository_cache_adapter.rb
@@ -23,37 +23,6 @@ module Gitlab
         end
       end
 
-      # Caches and strongly memoizes the method as a Redis Set.
-      #
-      # This only works for methods that do not take any arguments. The method
-      # should return an Array of Strings to be cached.
-      #
-      # In addition to overriding the named method, a "name_include?" method is
-      # defined. This uses the "SISMEMBER" query to efficiently check membership
-      # without needing to load the entire set into memory.
-      #
-      # name     - The name of the method to be cached.
-      # fallback - A value to fall back to if the repository does not exist, or
-      #            in case of a Git error. Defaults to nil.
-      def cache_method_as_redis_set(name, fallback: nil)
-        uncached_name = alias_uncached_method(name)
-
-        define_method(name) do
-          cache_method_output_as_redis_set(name, fallback: fallback) do
-            __send__(uncached_name) # rubocop:disable GitlabSecurity/PublicSend
-          end
-        end
-
-        define_method("#{name}_include?") do |value|
-          # If the cache isn't populated, we can't rely on it
-          return redis_set_cache.include?(name, value) if redis_set_cache.exist?(name)
-
-          # Since we have to pull all branch names to populate the cache, use
-          # the data we already have to answer the query just this once
-          __send__(name).include?(value) # rubocop:disable GitlabSecurity/PublicSend
-        end
-      end
-
       # Caches truthy values from the method. All values are strongly memoized,
       # and cached in RequestStore.
       #
@@ -115,11 +84,6 @@ module Gitlab
       raise NotImplementedError
     end
 
-    # RepositorySetCache to be used. Should be overridden by the including class
-    def redis_set_cache
-      raise NotImplementedError
-    end
-
     # List of cached methods. Should be overridden by the including class
     def cached_methods
       raise NotImplementedError
@@ -136,18 +100,6 @@ module Gitlab
       end
     end
 
-    # Caches and strongly memoizes the supplied block as a Redis Set. The result
-    # will be provided as a sorted array.
-    #
-    # name     - The name of the method to be cached.
-    # fallback - A value to fall back to if the repository does not exist, or
-    #            in case of a Git error. Defaults to nil.
-    def cache_method_output_as_redis_set(name, fallback: nil, &block)
-      memoize_method_output(name, fallback: fallback) do
-        redis_set_cache.fetch(name, &block).sort
-      end
-    end
-
     # Caches truthy values from the supplied block. All values are strongly
     # memoized, and cached in RequestStore.
     #
@@ -202,7 +154,6 @@ module Gitlab
         clear_memoization(memoizable_name(name))
       end
 
-      expire_redis_set_method_caches(methods)
       expire_request_store_method_caches(methods)
     end
 
@@ -218,10 +169,6 @@ module Gitlab
       end
     end
 
-    def expire_redis_set_method_caches(methods)
-      methods.each { |name| redis_set_cache.expire(name) }
-    end
-
     # All cached repository methods depend on the existence of a Git repository,
     # so if the repository doesn't exist, we already know not to call it.
     def fallback_early?(method_name)
diff --git a/lib/gitlab/repository_set_cache.rb b/lib/gitlab/repository_set_cache.rb
deleted file mode 100644
index fb634328a95..00000000000
--- a/lib/gitlab/repository_set_cache.rb
+++ /dev/null
@@ -1,67 +0,0 @@
-# frozen_string_literal: true
-
-# Interface to the Redis-backed cache store for keys that use a Redis set
-module Gitlab
-  class RepositorySetCache
-    attr_reader :repository, :namespace, :expires_in
-
-    def initialize(repository, extra_namespace: nil, expires_in: 2.weeks)
-      @repository = repository
-      @namespace = "#{repository.full_path}:#{repository.project.id}"
-      @namespace = "#{@namespace}:#{extra_namespace}" if extra_namespace
-      @expires_in = expires_in
-    end
-
-    def cache_key(type)
-      [type, namespace, 'set'].join(':')
-    end
-
-    def expire(key)
-      with { |redis| redis.del(cache_key(key)) }
-    end
-
-    def exist?(key)
-      with { |redis| redis.exists(cache_key(key)) }
-    end
-
-    def read(key)
-      with { |redis| redis.smembers(cache_key(key)) }
-    end
-
-    def write(key, value)
-      full_key = cache_key(key)
-
-      with do |redis|
-        redis.multi do
-          redis.del(full_key)
-
-          # Splitting into groups of 1000 prevents us from creating a too-long
-          # Redis command
-          value.in_groups_of(1000, false) { |subset| redis.sadd(full_key, subset) }
-
-          redis.expire(full_key, expires_in)
-        end
-      end
-
-      value
-    end
-
-    def fetch(key, &block)
-      if exist?(key)
-        read(key)
-      else
-        write(key, yield)
-      end
-    end
-
-    def include?(key, value)
-      with { |redis| redis.sismember(cache_key(key), value) }
-    end
-
-    private
-
-    def with(&blk)
-      Gitlab::Redis::Cache.with(&blk) # rubocop:disable CodeReuse/ActiveRecord
-    end
-  end
-end
diff --git a/spec/lib/gitlab/repository_cache_adapter_spec.rb b/spec/lib/gitlab/repository_cache_adapter_spec.rb
index fd1338b55a6..808eb865a21 100644
--- a/spec/lib/gitlab/repository_cache_adapter_spec.rb
+++ b/spec/lib/gitlab/repository_cache_adapter_spec.rb
@@ -6,7 +6,6 @@ describe Gitlab::RepositoryCacheAdapter do
   let(:project) { create(:project, :repository) }
   let(:repository) { project.repository }
   let(:cache) { repository.send(:cache) }
-  let(:redis_set_cache) { repository.send(:redis_set_cache) }
 
   describe '#cache_method_output', :use_clean_rails_memory_store_caching do
     let(:fallback) { 10 }
@@ -209,11 +208,9 @@ describe Gitlab::RepositoryCacheAdapter do
   describe '#expire_method_caches' do
     it 'expires the caches of the given methods' do
       expect(cache).to receive(:expire).with(:rendered_readme)
-      expect(cache).to receive(:expire).with(:branch_names)
-      expect(redis_set_cache).to receive(:expire).with(:rendered_readme)
-      expect(redis_set_cache).to receive(:expire).with(:branch_names)
+      expect(cache).to receive(:expire).with(:gitignore)
 
-      repository.expire_method_caches(%i(rendered_readme branch_names))
+      repository.expire_method_caches(%i(rendered_readme gitignore))
     end
 
     it 'does not expire caches for non-existent methods' do
diff --git a/spec/lib/gitlab/repository_set_cache_spec.rb b/spec/lib/gitlab/repository_set_cache_spec.rb
deleted file mode 100644
index 87e51f801e5..00000000000
--- a/spec/lib/gitlab/repository_set_cache_spec.rb
+++ /dev/null
@@ -1,75 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-describe Gitlab::RepositorySetCache, :clean_gitlab_redis_cache do
-  let(:project) { create(:project) }
-  let(:repository) { project.repository }
-  let(:namespace) { "#{repository.full_path}:#{project.id}" }
-  let(:cache) { described_class.new(repository) }
-
-  describe '#cache_key' do
-    subject { cache.cache_key(:foo) }
-
-    it 'includes the namespace' do
-      is_expected.to eq("foo:#{namespace}:set")
-    end
-
-    context 'with a given namespace' do
-      let(:extra_namespace) { 'my:data' }
-      let(:cache) { described_class.new(repository, extra_namespace: extra_namespace) }
-
-      it 'includes the full namespace' do
-        is_expected.to eq("foo:#{namespace}:#{extra_namespace}:set")
-      end
-    end
-  end
-
-  describe '#expire' do
-    it 'expires the given key from the cache' do
-      cache.write(:foo, ['value'])
-
-      expect(cache.read(:foo)).to contain_exactly('value')
-      expect(cache.expire(:foo)).to eq(1)
-      expect(cache.read(:foo)).to be_empty
-    end
-  end
-
-  describe '#exist?' do
-    it 'checks whether the key exists' do
-      expect(cache.exist?(:foo)).to be(false)
-
-      cache.write(:foo, ['value'])
-
-      expect(cache.exist?(:foo)).to be(true)
-    end
-  end
-
-  describe '#fetch' do
-    let(:blk) { -> { ['block value'] } }
-
-    subject { cache.fetch(:foo, &blk) }
-
-    it 'fetches the key from the cache when filled' do
-      cache.write(:foo, ['value'])
-
-      is_expected.to contain_exactly('value')
-    end
-
-    it 'writes the value of the provided block when empty' do
-      cache.expire(:foo)
-
-      is_expected.to contain_exactly('block value')
-      expect(cache.read(:foo)).to contain_exactly('block value')
-    end
-  end
-
-  describe '#include?' do
-    it 'checks inclusion in the Redis set' do
-      cache.write(:foo, ['value'])
-
-      expect(cache.include?(:foo, 'value')).to be(true)
-      expect(cache.include?(:foo, 'bar')).to be(false)
-    end
-  end
-end
diff --git a/spec/models/repository_spec.rb b/spec/models/repository_spec.rb
index 79395fcc994..419e1dc2459 100644
--- a/spec/models/repository_spec.rb
+++ b/spec/models/repository_spec.rb
@@ -1223,66 +1223,36 @@ describe Repository do
   end
 
   describe '#branch_exists?' do
-    let(:branch) { repository.root_ref }
+    it 'uses branch_names' do
+      allow(repository).to receive(:branch_names).and_return(['foobar'])
 
-    subject { repository.branch_exists?(branch) }
-
-    it 'delegates to branch_names when the cache is empty' do
-      repository.expire_branches_cache
-
-      expect(repository).to receive(:branch_names).and_call_original
-      is_expected.to eq(true)
-    end
-
-    it 'uses redis set caching when the cache is filled' do
-      repository.branch_names # ensure the branch name cache is filled
-
-      expect(repository)
-        .to receive(:branch_names_include?)
-        .with(branch)
-        .and_call_original
-
-      is_expected.to eq(true)
+      expect(repository.branch_exists?('foobar')).to eq(true)
+      expect(repository.branch_exists?('master')).to eq(false)
     end
   end
 
   describe '#tag_exists?' do
-    let(:tag) { repository.tags.first.name }
-
-    subject { repository.tag_exists?(tag) }
-
-    it 'delegates to tag_names when the cache is empty' do
-      repository.expire_tags_cache
-
-      expect(repository).to receive(:tag_names).and_call_original
-      is_expected.to eq(true)
-    end
-
-    it 'uses redis set caching when the cache is filled' do
-      repository.tag_names # ensure the tag name cache is filled
-
-      expect(repository)
-        .to receive(:tag_names_include?)
-        .with(tag)
-        .and_call_original
+    it 'uses tag_names' do
+      allow(repository).to receive(:tag_names).and_return(['foobar'])
 
-      is_expected.to eq(true)
+      expect(repository.tag_exists?('foobar')).to eq(true)
+      expect(repository.tag_exists?('master')).to eq(false)
     end
   end
 
-  describe '#branch_names', :clean_gitlab_redis_cache do
+  describe '#branch_names', :use_clean_rails_memory_store_caching do
     let(:fake_branch_names) { ['foobar'] }
 
     it 'gets cached across Repository instances' do
       allow(repository.raw_repository).to receive(:branch_names).once.and_return(fake_branch_names)
 
-      expect(repository.branch_names).to match_array(fake_branch_names)
+      expect(repository.branch_names).to eq(fake_branch_names)
 
       fresh_repository = Project.find(project.id).repository
       expect(fresh_repository.object_id).not_to eq(repository.object_id)
 
       expect(fresh_repository.raw_repository).not_to receive(:branch_names)
-      expect(fresh_repository.branch_names).to match_array(fake_branch_names)
+      expect(fresh_repository.branch_names).to eq(fake_branch_names)
     end
   end
 
-- 
cgit v1.2.1


From 1cec47ec1a9ebba716a5396b560bf7efc3319020 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Cunha?= <j.a.cunha@gmail.com>
Date: Thu, 29 Aug 2019 17:21:35 +0000
Subject: DRY check progress services

Extract duplicated code from two similar classes into a parent one.
---
 .../check_installation_progress_service.rb         | 35 +--------------
 .../applications/check_progress_service.rb         | 50 ++++++++++++++++++++++
 .../check_uninstall_progress_service.rb            | 33 ++------------
 .../check_installation_progress_service_spec.rb    | 16 +++----
 .../check_uninstall_progress_service_spec.rb       | 10 ++---
 5 files changed, 68 insertions(+), 76 deletions(-)
 create mode 100644 app/services/clusters/applications/check_progress_service.rb

diff --git a/app/services/clusters/applications/check_installation_progress_service.rb b/app/services/clusters/applications/check_installation_progress_service.rb
index 3c6803d24e6..65d08966802 100644
--- a/app/services/clusters/applications/check_installation_progress_service.rb
+++ b/app/services/clusters/applications/check_installation_progress_service.rb
@@ -2,24 +2,7 @@
 
 module Clusters
   module Applications
-    class CheckInstallationProgressService < BaseHelmService
-      def execute
-        return unless operation_in_progress?
-
-        case installation_phase
-        when Gitlab::Kubernetes::Pod::SUCCEEDED
-          on_success
-        when Gitlab::Kubernetes::Pod::FAILED
-          on_failed
-        else
-          check_timeout
-        end
-      rescue Kubeclient::HttpError => e
-        log_error(e)
-
-        app.make_errored!("Kubernetes error: #{e.error_code}")
-      end
-
+    class CheckInstallationProgressService < CheckProgressService
       private
 
       def operation_in_progress?
@@ -32,10 +15,6 @@ module Clusters
         remove_installation_pod
       end
 
-      def on_failed
-        app.make_errored!("Operation failed. Check pod logs for #{pod_name} for more details.")
-      end
-
       def check_timeout
         if timed_out?
           begin
@@ -54,18 +33,6 @@ module Clusters
       def timed_out?
         Time.now.utc - app.updated_at.utc > ClusterWaitForAppInstallationWorker::TIMEOUT
       end
-
-      def remove_installation_pod
-        helm_api.delete_pod!(pod_name)
-      end
-
-      def installation_phase
-        helm_api.status(pod_name)
-      end
-
-      def installation_errors
-        helm_api.log(pod_name)
-      end
     end
   end
 end
diff --git a/app/services/clusters/applications/check_progress_service.rb b/app/services/clusters/applications/check_progress_service.rb
new file mode 100644
index 00000000000..4a07b955f8e
--- /dev/null
+++ b/app/services/clusters/applications/check_progress_service.rb
@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Clusters
+  module Applications
+    class CheckProgressService < BaseHelmService
+      def execute
+        return unless operation_in_progress?
+
+        case pod_phase
+        when Gitlab::Kubernetes::Pod::SUCCEEDED
+          on_success
+        when Gitlab::Kubernetes::Pod::FAILED
+          on_failed
+        else
+          check_timeout
+        end
+      rescue Kubeclient::HttpError => e
+        log_error(e)
+
+        app.make_errored!(_('Kubernetes error: %{error_code}') % { error_code: e.error_code })
+      end
+
+      private
+
+      def operation_in_progress?
+        raise NotImplementedError
+      end
+
+      def on_success
+        raise NotImplementedError
+      end
+
+      def pod_name
+        raise NotImplementedError
+      end
+
+      def on_failed
+        app.make_errored!(_('Operation failed. Check pod logs for %{pod_name} for more details.') % { pod_name: pod_name })
+      end
+
+      def timed_out?
+        raise NotImplementedError
+      end
+
+      def pod_phase
+        helm_api.status(pod_name)
+      end
+    end
+  end
+end
diff --git a/app/services/clusters/applications/check_uninstall_progress_service.rb b/app/services/clusters/applications/check_uninstall_progress_service.rb
index e51d84ef052..6a618d61c4f 100644
--- a/app/services/clusters/applications/check_uninstall_progress_service.rb
+++ b/app/services/clusters/applications/check_uninstall_progress_service.rb
@@ -2,26 +2,13 @@
 
 module Clusters
   module Applications
-    class CheckUninstallProgressService < BaseHelmService
-      def execute
-        return unless app.uninstalling?
-
-        case installation_phase
-        when Gitlab::Kubernetes::Pod::SUCCEEDED
-          on_success
-        when Gitlab::Kubernetes::Pod::FAILED
-          on_failed
-        else
-          check_timeout
-        end
-      rescue Kubeclient::HttpError => e
-        log_error(e)
+    class CheckUninstallProgressService < CheckProgressService
+      private
 
-        app.make_errored!(_('Kubernetes error: %{error_code}') % { error_code: e.error_code })
+      def operation_in_progress?
+        app.uninstalling?
       end
 
-      private
-
       def on_success
         app.post_uninstall
         app.destroy!
@@ -31,10 +18,6 @@ module Clusters
         remove_installation_pod
       end
 
-      def on_failed
-        app.make_errored!(_('Operation failed. Check pod logs for %{pod_name} for more details.') % { pod_name: pod_name })
-      end
-
       def check_timeout
         if timed_out?
           app.make_errored!(_('Operation timed out. Check pod logs for %{pod_name} for more details.') % { pod_name: pod_name })
@@ -50,14 +33,6 @@ module Clusters
       def timed_out?
         Time.now.utc - app.updated_at.utc > WaitForUninstallAppWorker::TIMEOUT
       end
-
-      def remove_installation_pod
-        helm_api.delete_pod!(pod_name)
-      end
-
-      def installation_phase
-        helm_api.status(pod_name)
-      end
     end
   end
 end
diff --git a/spec/services/clusters/applications/check_installation_progress_service_spec.rb b/spec/services/clusters/applications/check_installation_progress_service_spec.rb
index a54bd85a11a..464a67649ff 100644
--- a/spec/services/clusters/applications/check_installation_progress_service_spec.rb
+++ b/spec/services/clusters/applications/check_installation_progress_service_spec.rb
@@ -14,7 +14,7 @@ describe Clusters::Applications::CheckInstallationProgressService, '#execute' do
     let(:phase) { a_phase }
 
     before do
-      expect(service).to receive(:installation_phase).once.and_return(phase)
+      expect(service).to receive(:pod_phase).once.and_return(phase)
     end
 
     context "when phase is #{a_phase}" do
@@ -44,7 +44,7 @@ describe Clusters::Applications::CheckInstallationProgressService, '#execute' do
       before do
         application.update!(cluster: cluster)
 
-        expect(service).to receive(:installation_phase).and_raise(error)
+        expect(service).to receive(:pod_phase).and_raise(error)
       end
 
       include_examples 'logs kubernetes errors' do
@@ -77,7 +77,7 @@ describe Clusters::Applications::CheckInstallationProgressService, '#execute' do
     context 'when installation POD succeeded' do
       let(:phase) { Gitlab::Kubernetes::Pod::SUCCEEDED }
       before do
-        expect(service).to receive(:installation_phase).once.and_return(phase)
+        expect(service).to receive(:pod_phase).once.and_return(phase)
       end
 
       it 'removes the installation POD' do
@@ -101,7 +101,7 @@ describe Clusters::Applications::CheckInstallationProgressService, '#execute' do
       let(:errors) { 'test installation failed' }
 
       before do
-        expect(service).to receive(:installation_phase).once.and_return(phase)
+        expect(service).to receive(:pod_phase).once.and_return(phase)
       end
 
       it 'make the application errored' do
@@ -116,7 +116,7 @@ describe Clusters::Applications::CheckInstallationProgressService, '#execute' do
       let(:application) { create(:clusters_applications_helm, :timed_out, :updating) }
 
       before do
-        expect(service).to receive(:installation_phase).once.and_return(phase)
+        expect(service).to receive(:pod_phase).once.and_return(phase)
       end
 
       it 'make the application errored' do
@@ -138,7 +138,7 @@ describe Clusters::Applications::CheckInstallationProgressService, '#execute' do
     context 'when installation POD succeeded' do
       let(:phase) { Gitlab::Kubernetes::Pod::SUCCEEDED }
       before do
-        expect(service).to receive(:installation_phase).once.and_return(phase)
+        expect(service).to receive(:pod_phase).once.and_return(phase)
       end
 
       it 'removes the installation POD' do
@@ -162,7 +162,7 @@ describe Clusters::Applications::CheckInstallationProgressService, '#execute' do
       let(:errors) { 'test installation failed' }
 
       before do
-        expect(service).to receive(:installation_phase).once.and_return(phase)
+        expect(service).to receive(:pod_phase).once.and_return(phase)
       end
 
       it 'make the application errored' do
@@ -177,7 +177,7 @@ describe Clusters::Applications::CheckInstallationProgressService, '#execute' do
       let(:application) { create(:clusters_applications_helm, :timed_out) }
 
       before do
-        expect(service).to receive(:installation_phase).once.and_return(phase)
+        expect(service).to receive(:pod_phase).once.and_return(phase)
       end
 
       it 'make the application errored' do
diff --git a/spec/services/clusters/applications/check_uninstall_progress_service_spec.rb b/spec/services/clusters/applications/check_uninstall_progress_service_spec.rb
index a948b442441..1a9f7089c3d 100644
--- a/spec/services/clusters/applications/check_uninstall_progress_service_spec.rb
+++ b/spec/services/clusters/applications/check_uninstall_progress_service_spec.rb
@@ -20,7 +20,7 @@ describe Clusters::Applications::CheckUninstallProgressService do
     let(:phase) { a_phase }
 
     before do
-      expect(service).to receive(:installation_phase).once.and_return(phase)
+      expect(service).to receive(:pod_phase).once.and_return(phase)
     end
 
     context "when phase is #{a_phase}" do
@@ -47,7 +47,7 @@ describe Clusters::Applications::CheckUninstallProgressService do
     context 'when installation POD succeeded' do
       let(:phase) { Gitlab::Kubernetes::Pod::SUCCEEDED }
       before do
-        expect(service).to receive(:installation_phase).once.and_return(phase)
+        expect(service).to receive(:pod_phase).once.and_return(phase)
       end
 
       it 'removes the installation POD' do
@@ -95,7 +95,7 @@ describe Clusters::Applications::CheckUninstallProgressService do
       let(:errors) { 'test installation failed' }
 
       before do
-        expect(service).to receive(:installation_phase).once.and_return(phase)
+        expect(service).to receive(:pod_phase).once.and_return(phase)
       end
 
       it 'make the application errored' do
@@ -110,7 +110,7 @@ describe Clusters::Applications::CheckUninstallProgressService do
       let(:application) { create(:clusters_applications_prometheus, :timed_out, :uninstalling) }
 
       before do
-        expect(service).to receive(:installation_phase).once.and_return(phase)
+        expect(service).to receive(:pod_phase).once.and_return(phase)
       end
 
       it 'make the application errored' do
@@ -131,7 +131,7 @@ describe Clusters::Applications::CheckUninstallProgressService do
       before do
         application.update!(cluster: cluster)
 
-        expect(service).to receive(:installation_phase).and_raise(error)
+        expect(service).to receive(:pod_phase).and_raise(error)
       end
 
       include_examples 'logs kubernetes errors' do
-- 
cgit v1.2.1


From e9509a8aec75d6a07790a83cf4d635a613f636ca Mon Sep 17 00:00:00 2001
From: Scott Hampton <shampton@gitlab.com>
Date: Thu, 29 Aug 2019 18:06:05 +0000
Subject: Lock down visual-review-tools version

Remove the caret from the visual-review-tools
version so that we don't accidentally
introduce bugs on new releases.
---
 package.json | 2 +-
 yarn.lock    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index c3168fc9071..482f5cc7349 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "@babel/preset-env": "^7.5.5",
     "@gitlab/svgs": "^1.71.0",
     "@gitlab/ui": "5.20.1",
-    "@gitlab/visual-review-tools": "^1.0.0",
+    "@gitlab/visual-review-tools": "1.0.0",
     "apollo-cache-inmemory": "^1.5.1",
     "apollo-client": "^2.5.1",
     "apollo-link": "^1.2.11",
diff --git a/yarn.lock b/yarn.lock
index 2a11e66e2b5..78f9b461c36 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1014,7 +1014,7 @@
     vue "^2.6.10"
     vue-loader "^15.4.2"
 
-"@gitlab/visual-review-tools@^1.0.0":
+"@gitlab/visual-review-tools@1.0.0":
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/@gitlab/visual-review-tools/-/visual-review-tools-1.0.0.tgz#6012e0a19797c1f5dad34ccf4dacdaf38e400a73"
   integrity sha512-xMvz9IwrXisQ1MH+Tj6lfbQcQSiQy88nTPuQV6OTLBGuV+vIQeVwXeIkQeTKuSpd0GqZvigPdRqxyQCa3blpIg==
-- 
cgit v1.2.1


From 3c019fa1d4dc647d89f751e8975f0f07c31ccfc6 Mon Sep 17 00:00:00 2001
From: Maneschi Romain <rmaneschi@gmail.com>
Date: Thu, 29 Aug 2019 18:24:32 +0000
Subject: make test of note app with comments disabled dry

---
 .../unreleased/62673-clean-note-app-tests.yml      |  5 ++++
 spec/frontend/notes/components/note_app_spec.js    | 31 +++++++++++-----------
 2 files changed, 20 insertions(+), 16 deletions(-)
 create mode 100644 changelogs/unreleased/62673-clean-note-app-tests.yml

diff --git a/changelogs/unreleased/62673-clean-note-app-tests.yml b/changelogs/unreleased/62673-clean-note-app-tests.yml
new file mode 100644
index 00000000000..abfcf8fe364
--- /dev/null
+++ b/changelogs/unreleased/62673-clean-note-app-tests.yml
@@ -0,0 +1,5 @@
+---
+title: make test of note app with comments disabled dry
+merge_request: 32383
+author: Romain Maneschi
+type: other
diff --git a/spec/frontend/notes/components/note_app_spec.js b/spec/frontend/notes/components/note_app_spec.js
index ff833d2c899..02fd30d5a15 100644
--- a/spec/frontend/notes/components/note_app_spec.js
+++ b/spec/frontend/notes/components/note_app_spec.js
@@ -133,32 +133,31 @@ describe('note_app', () => {
       );
     });
 
-    it('should not render form when commenting is disabled', () => {
-      wrapper.destroy();
+    it('should render form comment button as disabled', () => {
+      expect(wrapper.find('.js-note-new-discussion').attributes('disabled')).toEqual('disabled');
+    });
 
-      store.state.commentsDisabled = true;
-      wrapper = mountComponent();
-      return waitForDiscussionsRequest().then(() => {
-        expect(wrapper.find('.js-main-target-form').exists()).toBe(false);
-      });
+    it('updates discussions badge', () => {
+      expect(document.querySelector('.js-discussions-count').textContent).toEqual('2');
     });
+  });
 
-    it('should render discussion filter note `commentsDisabled` is true', () => {
-      wrapper.destroy();
+  describe('render with comments disabled', () => {
+    beforeEach(() => {
+      setFixtures('<div class="js-discussions-count"></div>');
 
+      Vue.http.interceptors.push(mockData.individualNoteInterceptor);
       store.state.commentsDisabled = true;
       wrapper = mountComponent();
-      return waitForDiscussionsRequest().then(() => {
-        expect(wrapper.find('.js-discussion-filter-note').exists()).toBe(true);
-      });
+      return waitForDiscussionsRequest();
     });
 
-    it('should render form comment button as disabled', () => {
-      expect(wrapper.find('.js-note-new-discussion').attributes('disabled')).toEqual('disabled');
+    it('should not render form when commenting is disabled', () => {
+      expect(wrapper.find('.js-main-target-form').exists()).toBe(false);
     });
 
-    it('updates discussions badge', () => {
-      expect(document.querySelector('.js-discussions-count').textContent).toEqual('2');
+    it('should render discussion filter note `commentsDisabled` is true', () => {
+      expect(wrapper.find('.js-discussion-filter-note').exists()).toBe(true);
     });
   });
 
-- 
cgit v1.2.1


From cc704112b39660ca12a0dc3faee81fdedb6f24cf Mon Sep 17 00:00:00 2001
From: Yuping Zuo <2669120-zypA13510@users.noreply.gitlab.com>
Date: Thu, 29 Aug 2019 18:56:22 +0000
Subject: fix: show preferred commit email in empty project page

---
 app/helpers/projects_helper.rb       |  2 +-
 spec/helpers/projects_helper_spec.rb | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/app/helpers/projects_helper.rb b/app/helpers/projects_helper.rb
index 33bf2d57fae..14f947a03a3 100644
--- a/app/helpers/projects_helper.rb
+++ b/app/helpers/projects_helper.rb
@@ -448,7 +448,7 @@ module ProjectsHelper
 
   def git_user_email
     if current_user
-      current_user.email
+      current_user.commit_email
     else
       "your@email.com"
     end
diff --git a/spec/helpers/projects_helper_spec.rb b/spec/helpers/projects_helper_spec.rb
index 29c43d1977e..d2a4ce6540d 100644
--- a/spec/helpers/projects_helper_spec.rb
+++ b/spec/helpers/projects_helper_spec.rb
@@ -549,6 +549,42 @@ describe ProjectsHelper do
     end
   end
 
+  describe '#git_user_email' do
+    context 'not logged-in' do
+      before do
+        allow(helper).to receive(:current_user).and_return(nil)
+      end
+
+      it 'returns your@email.com' do
+        expect(helper.send(:git_user_email)).to eq('your@email.com')
+      end
+    end
+
+    context 'user logged in' do
+      let(:user) { create(:user) }
+      before do
+        allow(helper).to receive(:current_user).and_return(user)
+      end
+
+      context 'user has no configured commit email' do
+        it 'returns the primary email' do
+          expect(helper.send(:git_user_email)).to eq(user.email)
+        end
+      end
+
+      context 'user has a configured commit email' do
+        before do
+          confirmed_email = create(:email, :confirmed, user: user)
+          user.update(commit_email: confirmed_email)
+        end
+
+        it 'returns the commit email' do
+          expect(helper.send(:git_user_email)).to eq(user.commit_email)
+        end
+      end
+    end
+  end
+
   describe 'show_xcode_link' do
     let!(:project) { create(:project) }
     let(:mac_ua) { 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36' }
-- 
cgit v1.2.1


From f6c7e38040492db018943e537e30a7dd10e46120 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Wed, 28 Aug 2019 21:57:54 -0700
Subject: Make it harder to delete issuables accidentally

Previously submitting a DELETE request to an issuable URL would be
enough to destroy it, but this should require human confirmation.  We
now require that the `destroy_confirm` parameter is set to a truthy
value before this can complete.

In addition, we log a Sentry error if a deletion arrived without
confirmation.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/62387
---
 .../javascripts/issue_show/components/app.vue      |  4 +--
 .../issue_show/components/edit_actions.vue         |  2 +-
 .../javascripts/issue_show/services/index.js       |  4 +--
 app/controllers/concerns/issuable_actions.rb       | 28 +++++++++++++++++++++
 app/views/shared/issuable/_form.html.haml          |  2 +-
 .../unreleased/sh-add-delete-confirmation.yml      |  5 ++++
 .../controllers/projects/issues_controller_spec.rb | 29 ++++++++++++++++++++--
 .../projects/merge_requests_controller_spec.rb     | 22 ++++++++++++++--
 .../issue_show/components/edit_actions_spec.js     |  2 +-
 9 files changed, 87 insertions(+), 11 deletions(-)
 create mode 100644 changelogs/unreleased/sh-add-delete-confirmation.yml

diff --git a/app/assets/javascripts/issue_show/components/app.vue b/app/assets/javascripts/issue_show/components/app.vue
index 9ca38d6bbfa..88975c2cc73 100644
--- a/app/assets/javascripts/issue_show/components/app.vue
+++ b/app/assets/javascripts/issue_show/components/app.vue
@@ -300,9 +300,9 @@ export default {
       this.closeRecaptcha();
     },
 
-    deleteIssuable() {
+    deleteIssuable(payload) {
       this.service
-        .deleteIssuable()
+        .deleteIssuable(payload)
         .then(res => res.data)
         .then(data => {
           // Stop the poll so we don't get 404's with the issuable not existing
diff --git a/app/assets/javascripts/issue_show/components/edit_actions.vue b/app/assets/javascripts/issue_show/components/edit_actions.vue
index eb51a074f84..ce867f16acf 100644
--- a/app/assets/javascripts/issue_show/components/edit_actions.vue
+++ b/app/assets/javascripts/issue_show/components/edit_actions.vue
@@ -55,7 +55,7 @@ export default {
       if (window.confirm(confirmMessage)) {
         this.deleteLoading = true;
 
-        eventHub.$emit('delete.issuable');
+        eventHub.$emit('delete.issuable', { destroy_confirm: true });
       }
     },
   },
diff --git a/app/assets/javascripts/issue_show/services/index.js b/app/assets/javascripts/issue_show/services/index.js
index 9546eb22c27..3c8334bee50 100644
--- a/app/assets/javascripts/issue_show/services/index.js
+++ b/app/assets/javascripts/issue_show/services/index.js
@@ -10,8 +10,8 @@ export default class Service {
     return axios.get(this.realtimeEndpoint);
   }
 
-  deleteIssuable() {
-    return axios.delete(this.endpoint);
+  deleteIssuable(payload) {
+    return axios.delete(this.endpoint, { params: payload });
   }
 
   updateIssuable(data) {
diff --git a/app/controllers/concerns/issuable_actions.rb b/app/controllers/concerns/issuable_actions.rb
index b86e4451a7e..05d865916af 100644
--- a/app/controllers/concerns/issuable_actions.rb
+++ b/app/controllers/concerns/issuable_actions.rb
@@ -6,6 +6,7 @@ module IssuableActions
 
   included do
     before_action :authorize_destroy_issuable!, only: :destroy
+    before_action :check_destroy_confirmation!, only: :destroy
     before_action :authorize_admin_issuable!, only: :bulk_update
     before_action only: :show do
       push_frontend_feature_flag(:scoped_labels, default_enabled: true)
@@ -91,6 +92,33 @@ module IssuableActions
     end
   end
 
+  def check_destroy_confirmation!
+    return true if params[:destroy_confirm]
+
+    error_message = "Destroy confirmation not provided for #{issuable.human_class_name}"
+    exception = RuntimeError.new(error_message)
+    Gitlab::Sentry.track_acceptable_exception(
+      exception,
+      extra: {
+        project_path: issuable.project.full_path,
+        issuable_type: issuable.class.name,
+        issuable_id: issuable.id
+      }
+    )
+
+    index_path = polymorphic_path([parent, issuable.class])
+
+    respond_to do |format|
+      format.html do
+        flash[:notice] = error_message
+        redirect_to index_path
+      end
+      format.json do
+        render json: { errors: error_message }, status: :unprocessable_entity
+      end
+    end
+  end
+
   def bulk_update
     result = Issuable::BulkUpdateService.new(current_user, bulk_update_params).execute(resource_name)
     quantity = result[:count]
diff --git a/app/views/shared/issuable/_form.html.haml b/app/views/shared/issuable/_form.html.haml
index 214e87052da..04a70e406ca 100644
--- a/app/views/shared/issuable/_form.html.haml
+++ b/app/views/shared/issuable/_form.html.haml
@@ -66,7 +66,7 @@
       = link_to 'Cancel', polymorphic_path([@project.namespace.becomes(Namespace), @project, issuable.class]), class: 'btn btn-cancel'
     - else
       - if can?(current_user, :"destroy_#{issuable.to_ability_name}", @project)
-        = link_to 'Delete', polymorphic_path([@project.namespace.becomes(Namespace), @project, issuable]), data: { confirm: "#{issuable.human_class_name} will be removed! Are you sure?" }, method: :delete, class: 'btn btn-danger btn-grouped'
+        = link_to 'Delete', polymorphic_path([@project.namespace.becomes(Namespace), @project, issuable], params: { destroy_confirm: true }), data: { confirm: "#{issuable.human_class_name} will be removed! Are you sure?" }, method: :delete, class: 'btn btn-danger btn-grouped'
       = link_to 'Cancel', polymorphic_path([@project.namespace.becomes(Namespace), @project, issuable]), class: 'btn btn-grouped btn-cancel'
 
   %span.append-right-10
diff --git a/changelogs/unreleased/sh-add-delete-confirmation.yml b/changelogs/unreleased/sh-add-delete-confirmation.yml
new file mode 100644
index 00000000000..21c383183e7
--- /dev/null
+++ b/changelogs/unreleased/sh-add-delete-confirmation.yml
@@ -0,0 +1,5 @@
+---
+title: Make it harder to delete issuables accidentally
+merge_request: 32376
+author:
+type: fixed
diff --git a/spec/controllers/projects/issues_controller_spec.rb b/spec/controllers/projects/issues_controller_spec.rb
index 187c7864ad7..608131dcbc8 100644
--- a/spec/controllers/projects/issues_controller_spec.rb
+++ b/spec/controllers/projects/issues_controller_spec.rb
@@ -1084,16 +1084,41 @@ describe Projects::IssuesController do
       end
 
       it "deletes the issue" do
-        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: issue.iid }
+        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: issue.iid, destroy_confirm: true }
 
         expect(response).to have_gitlab_http_status(302)
         expect(controller).to set_flash[:notice].to(/The issue was successfully deleted\./)
       end
 
+      it "deletes the issue" do
+        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: issue.iid, destroy_confirm: true }
+
+        expect(response).to have_gitlab_http_status(302)
+        expect(controller).to set_flash[:notice].to(/The issue was successfully deleted\./)
+      end
+
+      it "prevents deletion if destroy_confirm is not set" do
+        expect(Gitlab::Sentry).to receive(:track_acceptable_exception).and_call_original
+
+        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: issue.iid }
+
+        expect(response).to have_gitlab_http_status(302)
+        expect(controller).to set_flash[:notice].to('Destroy confirmation not provided for issue')
+      end
+
+      it "prevents deletion in JSON format if destroy_confirm is not set" do
+        expect(Gitlab::Sentry).to receive(:track_acceptable_exception).and_call_original
+
+        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: issue.iid, format: 'json' }
+
+        expect(response).to have_gitlab_http_status(422)
+        expect(json_response).to eq({ 'errors' => 'Destroy confirmation not provided for issue' })
+      end
+
       it 'delegates the update of the todos count cache to TodoService' do
         expect_any_instance_of(TodoService).to receive(:destroy_target).with(issue).once
 
-        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: issue.iid }
+        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: issue.iid, destroy_confirm: true }
       end
     end
   end
diff --git a/spec/controllers/projects/merge_requests_controller_spec.rb b/spec/controllers/projects/merge_requests_controller_spec.rb
index 11b1eaf11b7..80f54dd258d 100644
--- a/spec/controllers/projects/merge_requests_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests_controller_spec.rb
@@ -573,16 +573,34 @@ describe Projects::MergeRequestsController do
       end
 
       it "deletes the merge request" do
-        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: merge_request.iid }
+        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: merge_request.iid, destroy_confirm: true }
 
         expect(response).to have_gitlab_http_status(302)
         expect(controller).to set_flash[:notice].to(/The merge request was successfully deleted\./)
       end
 
+      it "prevents deletion if destroy_confirm is not set" do
+        expect(Gitlab::Sentry).to receive(:track_acceptable_exception).and_call_original
+
+        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: merge_request.iid }
+
+        expect(response).to have_gitlab_http_status(302)
+        expect(controller).to set_flash[:notice].to('Destroy confirmation not provided for merge request')
+      end
+
+      it "prevents deletion in JSON format if destroy_confirm is not set" do
+        expect(Gitlab::Sentry).to receive(:track_acceptable_exception).and_call_original
+
+        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: merge_request.iid, format: 'json' }
+
+        expect(response).to have_gitlab_http_status(422)
+        expect(json_response).to eq({ 'errors' => 'Destroy confirmation not provided for merge request' })
+      end
+
       it 'delegates the update of the todos count cache to TodoService' do
         expect_any_instance_of(TodoService).to receive(:destroy_target).with(merge_request).once
 
-        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: merge_request.iid }
+        delete :destroy, params: { namespace_id: project.namespace, project_id: project, id: merge_request.iid, destroy_confirm: true }
       end
     end
   end
diff --git a/spec/javascripts/issue_show/components/edit_actions_spec.js b/spec/javascripts/issue_show/components/edit_actions_spec.js
index d92c54ea83f..2ab74ae4e10 100644
--- a/spec/javascripts/issue_show/components/edit_actions_spec.js
+++ b/spec/javascripts/issue_show/components/edit_actions_spec.js
@@ -104,7 +104,7 @@ describe('Edit Actions components', () => {
       spyOn(window, 'confirm').and.returnValue(true);
       vm.$el.querySelector('.btn-danger').click();
 
-      expect(eventHub.$emit).toHaveBeenCalledWith('delete.issuable');
+      expect(eventHub.$emit).toHaveBeenCalledWith('delete.issuable', { destroy_confirm: true });
     });
 
     it('shows loading icon after clicking delete button', done => {
-- 
cgit v1.2.1


From 800c5837c063e289c4ca8c0cf4bff0381d938cc3 Mon Sep 17 00:00:00 2001
From: Nick Thomas <nick@gitlab.com>
Date: Thu, 29 Aug 2019 20:20:49 +0000
Subject: CE: Update the ES indexer to v1.3.0

---
 GITLAB_ELASTICSEARCH_INDEXER_VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/GITLAB_ELASTICSEARCH_INDEXER_VERSION b/GITLAB_ELASTICSEARCH_INDEXER_VERSION
index 26aaba0e866..f0bb29e7638 100644
--- a/GITLAB_ELASTICSEARCH_INDEXER_VERSION
+++ b/GITLAB_ELASTICSEARCH_INDEXER_VERSION
@@ -1 +1 @@
-1.2.0
+1.3.0
-- 
cgit v1.2.1


From 94720682a1314f769f37835d8e4e3df21650e77c Mon Sep 17 00:00:00 2001
From: Sarah Yasonik <syasonik@gitlab.com>
Date: Thu, 29 Aug 2019 20:27:38 +0000
Subject: Add a close issue slack slash command

Adds a slash command in slach for closing issues. See
https://docs.gitlab.com/ee/integration/slash_commands.html
for documentation on the wider feature set.
---
 changelogs/unreleased/ce-slack-close-command.yml   |  5 ++
 doc/integration/slash_commands.md                  |  1 +
 lib/gitlab/slash_commands/command.rb               |  1 +
 lib/gitlab/slash_commands/issue_close.rb           | 44 ++++++++++++
 lib/gitlab/slash_commands/presenters/issue_base.rb |  8 +++
 .../slash_commands/presenters/issue_close.rb       | 51 ++++++++++++++
 lib/gitlab/slash_commands/presenters/issue_new.rb  | 10 +--
 spec/lib/gitlab/slash_commands/issue_close_spec.rb | 80 ++++++++++++++++++++++
 .../slash_commands/presenters/issue_close_spec.rb  | 27 ++++++++
 9 files changed, 218 insertions(+), 9 deletions(-)
 create mode 100644 changelogs/unreleased/ce-slack-close-command.yml
 create mode 100644 lib/gitlab/slash_commands/issue_close.rb
 create mode 100644 lib/gitlab/slash_commands/presenters/issue_close.rb
 create mode 100644 spec/lib/gitlab/slash_commands/issue_close_spec.rb
 create mode 100644 spec/lib/gitlab/slash_commands/presenters/issue_close_spec.rb

diff --git a/changelogs/unreleased/ce-slack-close-command.yml b/changelogs/unreleased/ce-slack-close-command.yml
new file mode 100644
index 00000000000..c20e623b117
--- /dev/null
+++ b/changelogs/unreleased/ce-slack-close-command.yml
@@ -0,0 +1,5 @@
+---
+title: Add a close issue slack slash command
+merge_request: 32150
+author:
+type: added
diff --git a/doc/integration/slash_commands.md b/doc/integration/slash_commands.md
index 71ea2e25533..86a66dc4569 100644
--- a/doc/integration/slash_commands.md
+++ b/doc/integration/slash_commands.md
@@ -15,6 +15,7 @@ Taking the trigger term as `project-name`, the commands are:
 | `/project-name help` | Shows all available slash commands |
 | `/project-name issue new <title> <shift+return> <description>` | Creates a new issue with title `<title>` and description `<description>` |
 | `/project-name issue show <id>` | Shows the issue with id `<id>` |
+| `/project-name issue close <id>` | Closes the issue with id `<id>` |
 | `/project-name issue search <query>` | Shows up to 5 issues matching `<query>` |
 | `/project-name issue move <id> to <project>` | Moves issue ID `<id>` to `<project>` |
 | `/project-name deploy <from> to <to>` | Deploy from the `<from>` environment to the `<to>` environment |
diff --git a/lib/gitlab/slash_commands/command.rb b/lib/gitlab/slash_commands/command.rb
index 7c963fcf38a..905e0ec5cc1 100644
--- a/lib/gitlab/slash_commands/command.rb
+++ b/lib/gitlab/slash_commands/command.rb
@@ -9,6 +9,7 @@ module Gitlab
           Gitlab::SlashCommands::IssueNew,
           Gitlab::SlashCommands::IssueSearch,
           Gitlab::SlashCommands::IssueMove,
+          Gitlab::SlashCommands::IssueClose,
           Gitlab::SlashCommands::Deploy,
           Gitlab::SlashCommands::Run
         ]
diff --git a/lib/gitlab/slash_commands/issue_close.rb b/lib/gitlab/slash_commands/issue_close.rb
new file mode 100644
index 00000000000..5fcc86e91c4
--- /dev/null
+++ b/lib/gitlab/slash_commands/issue_close.rb
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module SlashCommands
+    class IssueClose < IssueCommand
+      def self.match(text)
+        /\Aissue\s+close\s+#{Issue.reference_prefix}?(?<iid>\d+)/.match(text)
+      end
+
+      def self.help_message
+        "issue close <id>"
+      end
+
+      def self.allowed?(project, user)
+        can?(user, :update_issue, project)
+      end
+
+      def execute(match)
+        issue = find_by_iid(match[:iid])
+
+        return not_found unless issue
+        return presenter(issue).already_closed if issue.closed?
+
+        close_issue(issue: issue)
+
+        presenter(issue).present
+      end
+
+      private
+
+      def close_issue(issue:)
+        Issues::CloseService.new(project, current_user).execute(issue)
+      end
+
+      def presenter(issue)
+        Gitlab::SlashCommands::Presenters::IssueClose.new(issue)
+      end
+
+      def not_found
+        Gitlab::SlashCommands::Presenters::Access.new.not_found
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/slash_commands/presenters/issue_base.rb b/lib/gitlab/slash_commands/presenters/issue_base.rb
index b6db103b82b..08cb82274fd 100644
--- a/lib/gitlab/slash_commands/presenters/issue_base.rb
+++ b/lib/gitlab/slash_commands/presenters/issue_base.rb
@@ -40,6 +40,14 @@ module Gitlab
           ]
         end
 
+        def project_link
+          "[#{project.full_name}](#{project.web_url})"
+        end
+
+        def author_profile_link
+          "[#{author.to_reference}](#{url_for(author)})"
+        end
+
         private
 
         attr_reader :resource
diff --git a/lib/gitlab/slash_commands/presenters/issue_close.rb b/lib/gitlab/slash_commands/presenters/issue_close.rb
new file mode 100644
index 00000000000..b3f24f4296a
--- /dev/null
+++ b/lib/gitlab/slash_commands/presenters/issue_close.rb
@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module SlashCommands
+    module Presenters
+      class IssueClose < Presenters::Base
+        include Presenters::IssueBase
+
+        def present
+          if @resource.confidential?
+            ephemeral_response(close_issue)
+          else
+            in_channel_response(close_issue)
+          end
+        end
+
+        def already_closed
+          ephemeral_response(text: "Issue #{@resource.to_reference} is already closed.")
+        end
+
+        private
+
+        def close_issue
+          {
+            attachments: [
+              {
+                title:        "#{@resource.title} · #{@resource.to_reference}",
+                title_link:   resource_url,
+                author_name:  author.name,
+                author_icon:  author.avatar_url,
+                fallback:     "Closed issue #{@resource.to_reference}: #{@resource.title}",
+                pretext:      pretext,
+                color:        color(@resource),
+                fields:       fields,
+                mrkdwn_in: [
+                  :title,
+                  :pretext,
+                  :fields
+                ]
+              }
+            ]
+          }
+        end
+
+        def pretext
+          "I closed an issue on #{author_profile_link}'s behalf: *#{@resource.to_reference}* in #{project_link}"
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/slash_commands/presenters/issue_new.rb b/lib/gitlab/slash_commands/presenters/issue_new.rb
index ac78745ae70..1424a4ac381 100644
--- a/lib/gitlab/slash_commands/presenters/issue_new.rb
+++ b/lib/gitlab/slash_commands/presenters/issue_new.rb
@@ -36,15 +36,7 @@ module Gitlab
         end
 
         def pretext
-          "I created an issue on #{author_profile_link}'s behalf: **#{@resource.to_reference}** in #{project_link}"
-        end
-
-        def project_link
-          "[#{project.full_name}](#{project.web_url})"
-        end
-
-        def author_profile_link
-          "[#{author.to_reference}](#{url_for(author)})"
+          "I created an issue on #{author_profile_link}'s behalf: *#{@resource.to_reference}* in #{project_link}"
         end
       end
     end
diff --git a/spec/lib/gitlab/slash_commands/issue_close_spec.rb b/spec/lib/gitlab/slash_commands/issue_close_spec.rb
new file mode 100644
index 00000000000..c0760ce0ba6
--- /dev/null
+++ b/spec/lib/gitlab/slash_commands/issue_close_spec.rb
@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::SlashCommands::IssueClose do
+  describe '#execute' do
+    let(:issue) { create(:issue, project: project) }
+    let(:project) { create(:project) }
+    let(:user) { issue.author }
+    let(:chat_name) { double(:chat_name, user: user) }
+    let(:regex_match) { described_class.match("issue close #{issue.iid}") }
+
+    subject do
+      described_class.new(project, chat_name).execute(regex_match)
+    end
+
+    context 'when the user does not have permission' do
+      let(:chat_name) { double(:chat_name, user: create(:user)) }
+
+      it 'does not allow the user to close the issue' do
+        expect(subject[:response_type]).to be(:ephemeral)
+        expect(subject[:text]).to match("not found")
+        expect(issue.reload).to be_open
+      end
+    end
+
+    context 'the issue exists' do
+      let(:title) { subject[:attachments].first[:title] }
+
+      it 'closes and returns the issue' do
+        expect(subject[:response_type]).to be(:in_channel)
+        expect(issue.reload).to be_closed
+        expect(title).to start_with(issue.title)
+      end
+
+      context 'when its reference is given' do
+        let(:regex_match) { described_class.match("issue close #{issue.to_reference}") }
+
+        it 'closes and returns the issue' do
+          expect(subject[:response_type]).to be(:in_channel)
+          expect(issue.reload).to be_closed
+          expect(title).to start_with(issue.title)
+        end
+      end
+    end
+
+    context 'the issue does not exist' do
+      let(:regex_match) { described_class.match("issue close 2343242") }
+
+      it "returns not found" do
+        expect(subject[:response_type]).to be(:ephemeral)
+        expect(subject[:text]).to match("not found")
+      end
+    end
+
+    context 'when the issue is already closed' do
+      let(:issue) { create(:issue, :closed, project: project) }
+
+      it 'shows the issue' do
+        expect(subject[:response_type]).to be(:ephemeral)
+        expect(issue.reload).to be_closed
+        expect(subject[:text]).to match("already closed")
+      end
+    end
+  end
+
+  describe '.match' do
+    it 'matches the iid' do
+      match = described_class.match("issue close 123")
+
+      expect(match[:iid]).to eq("123")
+    end
+
+    it 'accepts a reference' do
+      match = described_class.match("issue close #{Issue.reference_prefix}123")
+
+      expect(match[:iid]).to eq("123")
+    end
+  end
+end
diff --git a/spec/lib/gitlab/slash_commands/presenters/issue_close_spec.rb b/spec/lib/gitlab/slash_commands/presenters/issue_close_spec.rb
new file mode 100644
index 00000000000..adc13b4ee56
--- /dev/null
+++ b/spec/lib/gitlab/slash_commands/presenters/issue_close_spec.rb
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::SlashCommands::Presenters::IssueClose do
+  let(:project) { create(:project) }
+  let(:issue) { create(:issue, project: project) }
+  let(:attachment) { subject[:attachments].first }
+
+  subject { described_class.new(issue).present }
+
+  it { is_expected.to be_a(Hash) }
+
+  it 'shows the issue' do
+    expect(subject[:response_type]).to be(:in_channel)
+    expect(subject).to have_key(:attachments)
+    expect(attachment[:title]).to start_with(issue.title)
+  end
+
+  context 'confidential issue' do
+    let(:issue) { create(:issue, :confidential, project: project) }
+
+    it 'shows an ephemeral response' do
+      expect(subject[:response_type]).to be(:ephemeral)
+    end
+  end
+end
-- 
cgit v1.2.1


From fa6f19d1f83b68f2bb729be889ab7d66adbbedb8 Mon Sep 17 00:00:00 2001
From: dineshpanda <dineshpanda92@gmail.com>
Date: Fri, 30 Aug 2019 02:09:13 +0530
Subject: Remove dependency on IgnorableColumn concern

---
 app/models/application_setting.rb             | 15 ++++-----
 app/models/ci/build.rb                        | 15 ++++-----
 app/models/ci/runner.rb                       |  3 +-
 app/models/concerns/ignorable_column.rb       | 30 ------------------
 app/models/deploy_key.rb                      |  3 +-
 app/models/event.rb                           |  1 -
 app/models/merge_request_diff.rb              |  1 -
 app/models/note.rb                            |  3 +-
 app/models/notification_setting.rb            |  3 +-
 app/models/user.rb                            |  9 +++---
 doc/development/what_requires_downtime.md     | 12 +++-----
 spec/models/concerns/ignorable_column_spec.rb | 44 ---------------------------
 12 files changed, 29 insertions(+), 110 deletions(-)
 delete mode 100644 app/models/concerns/ignorable_column.rb
 delete mode 100644 spec/models/concerns/ignorable_column_spec.rb

diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb
index 2a99c6e5c59..8ff4cba2adb 100644
--- a/app/models/application_setting.rb
+++ b/app/models/application_setting.rb
@@ -4,7 +4,6 @@ class ApplicationSetting < ApplicationRecord
   include CacheableAttributes
   include CacheMarkdownField
   include TokenAuthenticatable
-  include IgnorableColumn
   include ChronicDurationAttribute
 
   add_authentication_token_field :runners_registration_token, encrypted: -> { Feature.enabled?(:application_settings_tokens_optional_encryption, default_enabled: true) ? :optional : :required }
@@ -25,12 +24,14 @@ class ApplicationSetting < ApplicationRecord
   serialize :domain_blacklist, Array # rubocop:disable Cop/ActiveRecordSerialize
   serialize :repository_storages # rubocop:disable Cop/ActiveRecordSerialize
 
-  ignore_column :koding_url
-  ignore_column :koding_enabled
-  ignore_column :sentry_enabled
-  ignore_column :sentry_dsn
-  ignore_column :clientside_sentry_enabled
-  ignore_column :clientside_sentry_dsn
+  self.ignored_columns = %i[
+                         clientside_sentry_dsn
+                         clientside_sentry_enabled
+                         koding_enabled
+                         koding_url
+                         sentry_dsn
+                         sentry_enabled
+                         ]
 
   cache_markdown_field :sign_in_text
   cache_markdown_field :help_page_text
diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index 7930bef5cf2..6ff89666e53 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -11,19 +11,20 @@ module Ci
     include ObjectStorage::BackgroundMove
     include Presentable
     include Importable
-    include IgnorableColumn
     include Gitlab::Utils::StrongMemoize
     include Deployable
     include HasRef
 
     BuildArchivedError = Class.new(StandardError)
 
-    ignore_column :commands
-    ignore_column :artifacts_file
-    ignore_column :artifacts_metadata
-    ignore_column :artifacts_file_store
-    ignore_column :artifacts_metadata_store
-    ignore_column :artifacts_size
+    self.ignored_columns = %i[
+                           artifacts_file
+                           artifacts_file_store
+                           artifacts_metadata
+                           artifacts_metadata_store
+                           artifacts_size
+                           commands
+                           ]
 
     belongs_to :project, inverse_of: :builds
     belongs_to :runner
diff --git a/app/models/ci/runner.rb b/app/models/ci/runner.rb
index 1c1c7a5ae7a..e0e905ebfa8 100644
--- a/app/models/ci/runner.rb
+++ b/app/models/ci/runner.rb
@@ -4,7 +4,6 @@ module Ci
   class Runner < ApplicationRecord
     extend Gitlab::Ci::Model
     include Gitlab::SQL::Pattern
-    include IgnorableColumn
     include RedisCacheable
     include ChronicDurationAttribute
     include FromUnion
@@ -36,7 +35,7 @@ module Ci
 
     FORM_EDITABLE = %i[description tag_list active run_untagged locked access_level maximum_timeout_human_readable].freeze
 
-    ignore_column :is_shared
+    self.ignored_columns = %i[is_shared]
 
     has_many :builds
     has_many :runner_projects, inverse_of: :runner, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
diff --git a/app/models/concerns/ignorable_column.rb b/app/models/concerns/ignorable_column.rb
deleted file mode 100644
index 3bec44dc79b..00000000000
--- a/app/models/concerns/ignorable_column.rb
+++ /dev/null
@@ -1,30 +0,0 @@
-# frozen_string_literal: true
-
-# Module that can be included into a model to make it easier to ignore database
-# columns.
-#
-# Example:
-#
-#     class User < ApplicationRecord
-#       include IgnorableColumn
-#
-#       ignore_column :updated_at
-#     end
-#
-module IgnorableColumn
-  extend ActiveSupport::Concern
-
-  class_methods do
-    def columns
-      super.reject { |column| ignored_columns.include?(column.name) }
-    end
-
-    def ignored_columns
-      @ignored_columns ||= Set.new
-    end
-
-    def ignore_column(*names)
-      ignored_columns.merge(names.map(&:to_s))
-    end
-  end
-end
diff --git a/app/models/deploy_key.rb b/app/models/deploy_key.rb
index 0bd90bd28e3..06f8f31b8cc 100644
--- a/app/models/deploy_key.rb
+++ b/app/models/deploy_key.rb
@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 class DeployKey < Key
-  include IgnorableColumn
   include FromUnion
 
   has_many :deploy_keys_projects, inverse_of: :deploy_key, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
@@ -11,7 +10,7 @@ class DeployKey < Key
   scope :are_public,  -> { where(public: true) }
   scope :with_projects, -> { includes(deploy_keys_projects: { project: [:route, :namespace] }) }
 
-  ignore_column :can_push
+  self.ignored_columns = %i[can_push]
 
   accepts_nested_attributes_for :deploy_keys_projects
 
diff --git a/app/models/event.rb b/app/models/event.rb
index 738080eb584..392d7368033 100644
--- a/app/models/event.rb
+++ b/app/models/event.rb
@@ -2,7 +2,6 @@
 
 class Event < ApplicationRecord
   include Sortable
-  include IgnorableColumn
   include FromUnion
   default_scope { reorder(nil) }
 
diff --git a/app/models/merge_request_diff.rb b/app/models/merge_request_diff.rb
index 2c9dbf2585c..2402fa8e38f 100644
--- a/app/models/merge_request_diff.rb
+++ b/app/models/merge_request_diff.rb
@@ -4,7 +4,6 @@ class MergeRequestDiff < ApplicationRecord
   include Sortable
   include Importable
   include ManualInverseAssociation
-  include IgnorableColumn
   include EachBatch
   include Gitlab::Utils::StrongMemoize
   include ObjectStorage::BackgroundMove
diff --git a/app/models/note.rb b/app/models/note.rb
index a12d1eb7243..c6ef91a27ad 100644
--- a/app/models/note.rb
+++ b/app/models/note.rb
@@ -14,7 +14,6 @@ class Note < ApplicationRecord
   include CacheMarkdownField
   include AfterCommitQueue
   include ResolvableNote
-  include IgnorableColumn
   include Editable
   include Gitlab::SQL::Pattern
   include ThrottledTouch
@@ -34,7 +33,7 @@ class Note < ApplicationRecord
     end
   end
 
-  ignore_column :original_discussion_id
+  self.ignored_columns = %i[original_discussion_id]
 
   cache_markdown_field :note, pipeline: :note, issuable_state_filter_enabled: true
 
diff --git a/app/models/notification_setting.rb b/app/models/notification_setting.rb
index 8306b11a7b6..9882f1dc8b3 100644
--- a/app/models/notification_setting.rb
+++ b/app/models/notification_setting.rb
@@ -1,9 +1,8 @@
 # frozen_string_literal: true
 
 class NotificationSetting < ApplicationRecord
-  include IgnorableColumn
 
-  ignore_column :events
+  self.ignored_columns = %i[events]
 
   enum level: { global: 3, watch: 2, participating: 1, mention: 4, disabled: 0, custom: 5 }
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 6107aaa7fca..79c89461806 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -13,7 +13,6 @@ class User < ApplicationRecord
   include Sortable
   include CaseSensitivity
   include TokenAuthenticatable
-  include IgnorableColumn
   include FeatureGate
   include CreatedAtFilterable
   include BulkMemberAccessLoad
@@ -24,9 +23,11 @@ class User < ApplicationRecord
 
   DEFAULT_NOTIFICATION_LEVEL = :participating
 
-  ignore_column :external_email
-  ignore_column :email_provider
-  ignore_column :authentication_token
+  self.ignored_columns = %i[
+                         authentication_token
+                         email_provider
+                         external_email
+                         ]
 
   add_authentication_token_field :incoming_email_token, token_generator: -> { SecureRandom.hex.to_i(16).to_s(36) }
   add_authentication_token_field :feed_token
diff --git a/doc/development/what_requires_downtime.md b/doc/development/what_requires_downtime.md
index 944bf5900c5..b9d1b95a4d7 100644
--- a/doc/development/what_requires_downtime.md
+++ b/doc/development/what_requires_downtime.md
@@ -45,15 +45,12 @@ rule.
 
 The first step is to ignore the column in the application code. This is
 necessary because Rails caches the columns and re-uses this cache in various
-places. This can be done by including the `IgnorableColumn` module into the
-model, followed by defining the columns to ignore. For example, to ignore
+places. This can be done by defining the columns to ignore. For example, to ignore
 `updated_at` in the User model you'd use the following:
 
 ```ruby
-class User < ActiveRecord::Base
-  include IgnorableColumn
-
-  ignore_column :updated_at
+class User < ApplicationRecord
+  self.ignored_columns = %i[updated_at]
 end
 ```
 
@@ -64,8 +61,7 @@ column. Both these changes should be submitted in the same merge request.
 
 Once the changes from step 1 have been released & deployed you can set up a
 separate merge request that removes the ignore rule. This merge request can
-simply remove the `ignore_column` line, and the `include IgnorableColumn` line
-if no other `ignore_column` calls remain.
+simply remove the `self.ignored_columns` line.
 
 ## Renaming Columns
 
diff --git a/spec/models/concerns/ignorable_column_spec.rb b/spec/models/concerns/ignorable_column_spec.rb
deleted file mode 100644
index 6b82825d2cc..00000000000
--- a/spec/models/concerns/ignorable_column_spec.rb
+++ /dev/null
@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-describe IgnorableColumn do
-  let :base_class do
-    Class.new do
-      def self.columns
-        # This method does not have access to "double"
-        [
-          Struct.new(:name).new('id'),
-          Struct.new(:name).new('title'),
-          Struct.new(:name).new('date')
-        ]
-      end
-    end
-  end
-
-  let :model do
-    Class.new(base_class) do
-      include IgnorableColumn
-    end
-  end
-
-  describe '.columns' do
-    it 'returns the columns, excluding the ignored ones' do
-      model.ignore_column(:title, :date)
-
-      expect(model.columns.map(&:name)).to eq(%w(id))
-    end
-  end
-
-  describe '.ignored_columns' do
-    it 'returns a Set' do
-      expect(model.ignored_columns).to be_an_instance_of(Set)
-    end
-
-    it 'returns the names of the ignored columns' do
-      model.ignore_column(:title, :date)
-
-      expect(model.ignored_columns).to eq(Set.new(%w(title date)))
-    end
-  end
-end
-- 
cgit v1.2.1


From 0a5f9a1a3925e83e76e0dc6e7f7cc89c610d56bd Mon Sep 17 00:00:00 2001
From: Lukas Eipert <leipert@gitlab.com>
Date: Thu, 29 Aug 2019 21:23:19 +0000
Subject: Update GitLab Packages

---
 package.json |  4 ++--
 yarn.lock    | 16 ++++++++--------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/package.json b/package.json
index 482f5cc7349..3d9e0838893 100644
--- a/package.json
+++ b/package.json
@@ -37,8 +37,8 @@
     "@babel/plugin-syntax-import-meta": "^7.2.0",
     "@babel/preset-env": "^7.5.5",
     "@gitlab/svgs": "^1.71.0",
-    "@gitlab/ui": "5.20.1",
-    "@gitlab/visual-review-tools": "1.0.0",
+    "@gitlab/ui": "5.20.2",
+    "@gitlab/visual-review-tools": "1.0.1",
     "apollo-cache-inmemory": "^1.5.1",
     "apollo-client": "^2.5.1",
     "apollo-link": "^1.2.11",
diff --git a/yarn.lock b/yarn.lock
index 78f9b461c36..6ab2aa24685 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -996,10 +996,10 @@
   resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.71.0.tgz#c8e6e8f500ea91e5cbba4ac08df533fb2e622a00"
   integrity sha512-kkeNic/FFwaqKnzwio4NE7whBOZ/toRJ8cS0587DBotajAzSYhph5ij4TCY2GTjPa33zIJ5OUr/k90C0Kr71hQ==
 
-"@gitlab/ui@5.20.1":
-  version "5.20.1"
-  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-5.20.1.tgz#a7d479f2a19988eacd90a4864183f0c49ddd310f"
-  integrity sha512-fbqs5ncnqItgmXLlK4/ZoXwW+6DGBf+/nub2agoIT4EocwYGtrmAB8V+ybEcRrJVG8YpkCGt6R4lD24VrATWTw==
+"@gitlab/ui@5.20.2":
+  version "5.20.2"
+  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-5.20.2.tgz#a51270d5a521e71059c5fd05f86cfc835f5e28ae"
+  integrity sha512-TSaD5Cz0YXBTsRtQwsa7LbS2O5h0CL3YkdYmBKrMZkphL76xQaN08ZImkQ5Xl8cD1ZiWN2CsTvoUbF19UP2V1w==
   dependencies:
     "@babel/standalone" "^7.0.0"
     "@gitlab/vue-toasted" "^1.2.1"
@@ -1014,10 +1014,10 @@
     vue "^2.6.10"
     vue-loader "^15.4.2"
 
-"@gitlab/visual-review-tools@1.0.0":
-  version "1.0.0"
-  resolved "https://registry.yarnpkg.com/@gitlab/visual-review-tools/-/visual-review-tools-1.0.0.tgz#6012e0a19797c1f5dad34ccf4dacdaf38e400a73"
-  integrity sha512-xMvz9IwrXisQ1MH+Tj6lfbQcQSiQy88nTPuQV6OTLBGuV+vIQeVwXeIkQeTKuSpd0GqZvigPdRqxyQCa3blpIg==
+"@gitlab/visual-review-tools@1.0.1":
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/@gitlab/visual-review-tools/-/visual-review-tools-1.0.1.tgz#7e588328ed018d91560633d56865d65b72c3a11b"
+  integrity sha512-vNqpui0khtPi3crrrFtfuT+nw0SdD/nMyb+aurbJzc3RXuVJGCdgYwosvTLPcJkdMOVfTijizV5+ys75s8INBw==
 
 "@gitlab/vue-toasted@^1.2.1":
   version "1.2.1"
-- 
cgit v1.2.1


From 225fba83cae544fcf1af4bd250bf7f125229ef6c Mon Sep 17 00:00:00 2001
From: Shan <s.gohar@gmail.com>
Date: Thu, 29 Aug 2019 21:34:41 +0000
Subject: Fixed spelling

---
 doc/development/documentation/index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/development/documentation/index.md b/doc/development/documentation/index.md
index c9ae00d148a..edd83f67d3b 100644
--- a/doc/development/documentation/index.md
+++ b/doc/development/documentation/index.md
@@ -88,7 +88,7 @@ in an EE MR. To pass the test, simply remove the docs changes from the EE MR, an
 ## Changing document location
 
 Changing a document's location requires specific steps to be followed to ensure that
-users can seamlessly access the new doc page, whether they are accesing content
+users can seamlessly access the new doc page, whether they are accessing content
 on a GitLab instance domain at `/help` or at docs.gitlab.com. Be sure to ping a
 GitLab technical writer if you have any questions during the process (such as
 whether the move is necessary), and ensure that a technical writer reviews this
-- 
cgit v1.2.1


From 9341406805488ed162b72039362e30f478d404ca Mon Sep 17 00:00:00 2001
From: Shan <s.gohar@gmail.com>
Date: Thu, 29 Aug 2019 21:41:42 +0000
Subject: Fixed spelling

---
 doc/development/documentation/structure.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/development/documentation/structure.md b/doc/development/documentation/structure.md
index 025a946da0e..158e69df2a6 100644
--- a/doc/development/documentation/structure.md
+++ b/doc/development/documentation/structure.md
@@ -13,7 +13,7 @@ and the section on Content in the [Style Guide](styleguide.md).
 
 ## Components of a documentation page
 
-Most pages will be dedicated to a specifig GitLab feature or to a use case that involves
+Most pages will be dedicated to a specific GitLab feature or to a use case that involves
 one or more features, potentially in conjunction with third-party tools.
 
 Every feature or use case document should include the following content in the following sequence,
-- 
cgit v1.2.1


From be685251b0786e1577d9bfc591c36ef0f13c2425 Mon Sep 17 00:00:00 2001
From: Shan <s.gohar@gmail.com>
Date: Thu, 29 Aug 2019 21:48:55 +0000
Subject: Fixed spelling

---
 doc/development/git_object_deduplication.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/development/git_object_deduplication.md b/doc/development/git_object_deduplication.md
index 4dd1edf9b5a..e8af6346524 100644
--- a/doc/development/git_object_deduplication.md
+++ b/doc/development/git_object_deduplication.md
@@ -186,7 +186,7 @@ When a pool repository record is created in SQL on a Geo primary, this
 will eventually trigger an event on the Geo secondary. The Geo secondary
 will then create the pool repository in Gitaly. This leads to an
 "eventually consistent" situation because as each pool participant gets
-synchronized, Geo will eventuall trigger garbage collection in Gitaly on
+synchronized, Geo will eventually trigger garbage collection in Gitaly on
 the secondary, at which stage Git objects will get deduplicated.
 
 > TODO How do we handle the edge case where at the time the Geo
-- 
cgit v1.2.1


From 6f47a6d1f978bbbf735752f9710a5717fbf8b5cc Mon Sep 17 00:00:00 2001
From: Hordur Freyr Yngvason <hfyngvason@gitlab.com>
Date: Fri, 30 Aug 2019 01:10:37 +0000
Subject: Document the AUTO_DEVOPS_BUILD_IMAGE_EXTRA_ARGS project variable

---
 doc/topics/autodevops/index.md | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/doc/topics/autodevops/index.md b/doc/topics/autodevops/index.md
index 87dae0e7e1f..1432147ca5b 100644
--- a/doc/topics/autodevops/index.md
+++ b/doc/topics/autodevops/index.md
@@ -706,6 +706,34 @@ will build a Docker image based on the Dockerfile rather than using buildpacks.
 This can be much faster and result in smaller images, especially if your
 Dockerfile is based on [Alpine](https://hub.docker.com/_/alpine/).
 
+### Passing arguments to `docker build`
+
+Arguments can be passed to the `docker build` command using the
+`AUTO_DEVOPS_BUILD_IMAGE_EXTRA_ARGS` project variable.
+
+For example, to build a Docker image based on based on the `ruby:alpine`
+instead of the default `ruby:latest`:
+
+1. Set `AUTO_DEVOPS_BUILD_IMAGE_EXTRA_ARGS` to `--build-arg=RUBY_VERSION=alpine`.
+1. Add the following to a custom `Dockerfile`:
+
+    ```docker
+    ARG RUBY_VERSION=latest
+    FROM ruby:$RUBY_VERSION
+
+    # ... put your stuff here
+    ```
+
+NOTE: **Note:**
+Passing in complex values (newlines and spaces, for example) will likely
+cause escaping issues due to the way this argument is used in Auto DevOps. 
+Consider using Base64 encoding of such values to avoid this problem.
+
+CAUTION: **Warning:**
+Avoid passing secrets as Docker build arguments if possible, as they may be
+persisted in your image. See
+[this discussion](https://github.com/moby/moby/issues/13490) for details.
+
 ### Custom Helm Chart
 
 Auto DevOps uses [Helm](https://helm.sh/) to deploy your application to Kubernetes.
@@ -794,6 +822,7 @@ applications.
 |-----------------------------------------|------------------------------------|
 | `ADDITIONAL_HOSTS`                      | Fully qualified domain names specified as a comma-separated list that are added to the ingress hosts. |
 | `<ENVIRONMENT>_ADDITIONAL_HOSTS`        | For a specific environment, the fully qualified domain names specified as a comma-separated list that are added to the ingress hosts. This takes precedence over `ADDITIONAL_HOSTS`. |
+| `AUTO_DEVOPS_BUILD_IMAGE_EXTRA_ARGS`    | Extra arguments to be passed to the `docker build` command. Note that using quotes will not prevent word splitting. [More details](#passing-arguments-to-docker-build). |
 | `AUTO_DEVOPS_CHART`                     | Helm Chart used to deploy your apps. Defaults to the one [provided by GitLab](https://gitlab.com/gitlab-org/charts/auto-deploy-app). |
 | `AUTO_DEVOPS_CHART_REPOSITORY`          | Helm Chart repository used to search for charts. Defaults to `https://charts.gitlab.io`. |
 | `AUTO_DEVOPS_CHART_REPOSITORY_NAME`     | From Gitlab 11.11, used to set the name of the helm repository. Defaults to `gitlab`. |
-- 
cgit v1.2.1


From e92b8219d70b46c806b39e89b48adbfc42066202 Mon Sep 17 00:00:00 2001
From: Thomas Randolph <trandolph@gitlab.com>
Date: Thu, 29 Aug 2019 17:22:51 -0600
Subject: Remove spaces from lines failing lint

---
 doc/api/notes.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/api/notes.md b/doc/api/notes.md
index d7183df1387..1f5baf7d0e1 100644
--- a/doc/api/notes.md
+++ b/doc/api/notes.md
@@ -113,7 +113,7 @@ Parameters:
 
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `issue_iid` (required) - The IID of an issue
-- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
+- `body` (required) - The content of a note. Limited to 1 000 000 characters.
 - `created_at` (optional) - Date time string, ISO 8601 formatted, e.g. 2016-03-11T03:45:40Z (requires admin or project/group owner rights)
 
 ```bash
@@ -133,7 +133,7 @@ Parameters:
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `issue_iid` (required) - The IID of an issue
 - `note_id` (required) - The ID of a note
-- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
+- `body` (required) - The content of a note. Limited to 1 000 000 characters.
 
 ```bash
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/projects/5/issues/11/notes?body=note
@@ -231,7 +231,7 @@ Parameters:
 
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `snippet_id` (required) - The ID of a snippet
-- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
+- `body` (required) - The content of a note. Limited to 1 000 000 characters.
 - `created_at` (optional) - Date time string, ISO 8601 formatted, e.g. 2016-03-11T03:45:40Z
 
 ```bash
@@ -251,7 +251,7 @@ Parameters:
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `snippet_id` (required) - The ID of a snippet
 - `note_id` (required) - The ID of a note
-- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
+- `body` (required) - The content of a note. Limited to 1 000 000 characters.
 
 ```bash
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/projects/5/snippets/11/notes?body=note
@@ -354,7 +354,7 @@ Parameters:
 
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `merge_request_iid` (required) - The IID of a merge request
-- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
+- `body` (required) - The content of a note. Limited to 1 000 000 characters.
 - `created_at` (optional) - Date time string, ISO 8601 formatted, e.g. 2016-03-11T03:45:40Z
 
 ### Modify existing merge request note
@@ -370,7 +370,7 @@ Parameters:
 - `id` (required) - The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding)
 - `merge_request_iid` (required) - The IID of a merge request
 - `note_id` (required) - The ID of a note
-- `body` (required) - The content of a note. Limited to 1 000 000 characters. 
+- `body` (required) - The content of a note. Limited to 1 000 000 characters.
 
 ```bash
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/projects/5/merge_requests/11/notes?body=note
-- 
cgit v1.2.1


From 513d3f58117cfaa9c24e1a354a72e1a5346e1109 Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Fri, 30 Aug 2019 02:25:44 +0000
Subject: Fix markdown in various docs

Clean up issues that may cause the docs-lint
test to fail, such as trailing whitespace, no
EOF newline, blockquotes, etc
---
 doc/install/azure/index.md                                  |  3 ++-
 doc/university/process/README.md                            |  4 ----
 doc/university/training/gitlab_flow.md                      |  4 ----
 doc/university/training/topics/git_intro.md                 |  2 +-
 doc/university/training/user_training.md                    |  2 +-
 doc/user/admin_area/license.md                              |  2 +-
 doc/user/admin_area/settings/continuous_integration.md      |  2 +-
 .../admin_area/settings/rate_limits_on_raw_endpoints.md     |  2 +-
 doc/user/application_security/container_scanning/index.md   |  4 ++--
 doc/user/application_security/index.md                      |  2 +-
 doc/user/discussions/index.md                               |  2 +-
 doc/user/group/index.md                                     |  4 ++--
 doc/user/project/code_owners.md                             |  2 +-
 doc/user/project/integrations/bamboo.md                     |  4 ++--
 doc/user/project/integrations/mock_ci.md                    |  2 +-
 doc/user/project/integrations/webhooks.md                   | 13 ++++++++-----
 doc/user/project/issues/issue_data_and_actions.md           |  2 +-
 doc/user/project/issues/sorting_issue_lists.md              |  4 ++--
 doc/user/project/merge_requests/allow_collaboration.md      |  3 +--
 doc/user/project/merge_requests/merge_request_approvals.md  |  2 +-
 doc/user/project/packages/maven_repository.md               |  3 +--
 doc/user/project/packages/npm_registry.md                   |  3 +--
 .../custom_domains_ssl_tls_certification/dns_concepts.md    |  2 +-
 doc/user/project/pages/getting_started_part_one.md          |  2 +-
 doc/user/project/pipelines/settings.md                      |  6 +++---
 doc/user/project/settings/index.md                          |  2 +-
 doc/user/search/advanced_search_syntax.md                   |  1 +
 27 files changed, 39 insertions(+), 45 deletions(-)

diff --git a/doc/install/azure/index.md b/doc/install/azure/index.md
index c5939dc6856..dfb1dbcf1ed 100644
--- a/doc/install/azure/index.md
+++ b/doc/install/azure/index.md
@@ -179,7 +179,7 @@ to make sure your VM is configured to use a _static_ public IP address (i.e. not
 or you will have to reconfigure the DNS `A` record each time Azure reassigns your VM a new public IP
 address. Read [IP address types and allocation methods in Azure][Azure-IP-Address-Types] to learn more.
 
-## Let's open some ports!
+## Let's open some ports
 
 At this stage you should have a running and fully operational VM. However, none of the services on
 your VM (e.g. GitLab) will be publicly accessible via the internet until you have opened up the
@@ -333,6 +333,7 @@ If you're running Windows, you'll need to connect using [PuTTY] or an equivalent
 If you're running Linux or macOS, then you already have an SSH client installed.
 
 > **Note:**
+>
 > - Remember that you will need to login with the username and password you specified
 >   [when you created](#basics) your Azure VM
 > - If you need to reset your VM password, read
diff --git a/doc/university/process/README.md b/doc/university/process/README.md
index b278e02ccd5..1a555f065ed 100644
--- a/doc/university/process/README.md
+++ b/doc/university/process/README.md
@@ -2,10 +2,6 @@
 comments: false
 ---
 
----
-title: University | Process
----
-
 # Suggesting improvements
 
 If you would like to teach a class or participate or help in any way please
diff --git a/doc/university/training/gitlab_flow.md b/doc/university/training/gitlab_flow.md
index 0ce92be4994..66e645a0af8 100644
--- a/doc/university/training/gitlab_flow.md
+++ b/doc/university/training/gitlab_flow.md
@@ -23,8 +23,6 @@ type: reference
   as opposed to individual stable branches
 - Consider creating a tag for each version that gets deployed
 
-## Production branch
-
 ![inline](gitlab_flow/production_branch.png)
 
 ## Release branch
@@ -36,8 +34,6 @@ type: reference
 - Cherry-pick critical bug fixes to stable branch for patch release
 - Never commit bug fixes directly to stable branch
 
-## Release branch
-
 ![inline](gitlab_flow/release_branches.png)
 
 ## More details
diff --git a/doc/university/training/topics/git_intro.md b/doc/university/training/topics/git_intro.md
index 845bb7f0a81..c9a1cbb7839 100644
--- a/doc/university/training/topics/git_intro.md
+++ b/doc/university/training/topics/git_intro.md
@@ -15,7 +15,7 @@ comments: false
 - Adapts to nearly any workflow
 - Fast, reliable and stable file format
 
-## Help!
+## Help
 
 Use the tools at your disposal when you get stuck.
 
diff --git a/doc/university/training/user_training.md b/doc/university/training/user_training.md
index e440652edfc..37107e13584 100644
--- a/doc/university/training/user_training.md
+++ b/doc/university/training/user_training.md
@@ -23,7 +23,7 @@ type: reference
 - Adapts to nearly any workflow.
 - Fast, reliable and stable file format.
 
-## Help!
+## Help
 
 Use the tools at your disposal when you get stuck.
 
diff --git a/doc/user/admin_area/license.md b/doc/user/admin_area/license.md
index f5864e1f828..dbcf250bc57 100644
--- a/doc/user/admin_area/license.md
+++ b/doc/user/admin_area/license.md
@@ -117,4 +117,4 @@ questions that you know someone might ask.
 
 Each scenario can be a third-level heading, e.g. `### Getting error message X`.
 If you have none to add when creating a doc, leave this section in place
-but commented out to help encourage others to add to it in the future. -->
\ No newline at end of file
+but commented out to help encourage others to add to it in the future. -->
diff --git a/doc/user/admin_area/settings/continuous_integration.md b/doc/user/admin_area/settings/continuous_integration.md
index bd76b052422..fa14ecdf7cb 100644
--- a/doc/user/admin_area/settings/continuous_integration.md
+++ b/doc/user/admin_area/settings/continuous_integration.md
@@ -127,7 +127,7 @@ but commented out to help encourage others to add to it in the future. -->
 GitLab administrators can force a pipeline configuration to run on every
 pipeline.
 
-The configuration applies to all pipelines for a GitLab instance and is 
+The configuration applies to all pipelines for a GitLab instance and is
 sourced from:
 
 - The [instance template repository](instance_template_repository.md).
diff --git a/doc/user/admin_area/settings/rate_limits_on_raw_endpoints.md b/doc/user/admin_area/settings/rate_limits_on_raw_endpoints.md
index 8e53a6995fb..6d2f74af660 100644
--- a/doc/user/admin_area/settings/rate_limits_on_raw_endpoints.md
+++ b/doc/user/admin_area/settings/rate_limits_on_raw_endpoints.md
@@ -6,7 +6,7 @@ type: reference
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/30829) in GitLab 12.2.
 
-This setting allows you to rate limit the requests to raw endpoints, defaults to `300` requests per minute. 
+This setting allows you to rate limit the requests to raw endpoints, defaults to `300` requests per minute.
 It can be modified in **Admin Area > Network > Performance Optimization**.
 
 For example, requests over `300` per minute to `https://gitlab.com/gitlab-org/gitlab-ce/raw/master/app/controllers/application_controller.rb` will be blocked. Access to the raw file will be released after 1 minute.
diff --git a/doc/user/application_security/container_scanning/index.md b/doc/user/application_security/container_scanning/index.md
index 7b631a5a1cd..a030f8d96ef 100644
--- a/doc/user/application_security/container_scanning/index.md
+++ b/doc/user/application_security/container_scanning/index.md
@@ -96,7 +96,7 @@ them in a YAML file named `clair-whitelist.yml`. Read more in the
 
 ## Example
 
-The following is a sample `.gitlab-ci.yml` that will build your Docker Image, push it to the container registry and run Container Scanning. 
+The following is a sample `.gitlab-ci.yml` that will build your Docker Image, push it to the container registry and run Container Scanning.
 
 ```yaml
 variables:
@@ -155,4 +155,4 @@ docker: Error response from daemon: failed to copy xattrs: failed to set xattr "
 This is a result of a bug in Docker which is now [fixed](https://github.com/containerd/continuity/pull/138 "fs: add WithAllowXAttrErrors CopyOpt").
 To prevent the error, ensure the Docker version that the Runner is using is
 `18.09.03` or higher. For more information, see
-[issue #10241](https://gitlab.com/gitlab-org/gitlab-ee/issues/10241 "Investigate why Container Scanning is not working with NFS mounts").
\ No newline at end of file
+[issue #10241](https://gitlab.com/gitlab-org/gitlab-ee/issues/10241 "Investigate why Container Scanning is not working with NFS mounts").
diff --git a/doc/user/application_security/index.md b/doc/user/application_security/index.md
index fcd683ca2db..5a1cc0561fc 100644
--- a/doc/user/application_security/index.md
+++ b/doc/user/application_security/index.md
@@ -153,7 +153,7 @@ Clicking on this button will create a merge request to apply the solution onto t
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/9928) in [GitLab Ultimate](https://about.gitlab.com/pricing) 12.2.
 
-Merge Request Approvals can be configured to require approval from a member 
+Merge Request Approvals can be configured to require approval from a member
 of your security team when a vulnerability would be introduced by a merge request.
 
 This threshold is defined as `high`, `critical`, or `unknown`
diff --git a/doc/user/discussions/index.md b/doc/user/discussions/index.md
index 6891682141c..6b748981106 100644
--- a/doc/user/discussions/index.md
+++ b/doc/user/discussions/index.md
@@ -452,7 +452,7 @@ Replying to a non-thread comment will convert the non-thread comment to a
 thread once the reply is submitted. This conversion is considered an edit
 to the original comment, so a note about when it was last edited will appear underneath it.
 
-This feature only exists for Issues, Merge requests, and Epics. Commits, Snippets and Merge request diff threads are 
+This feature only exists for Issues, Merge requests, and Epics. Commits, Snippets and Merge request diff threads are
 not supported yet.
 
 [ce-5022]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5022
diff --git a/doc/user/group/index.md b/doc/user/group/index.md
index 864f1a397d5..403071f2513 100644
--- a/doc/user/group/index.md
+++ b/doc/user/group/index.md
@@ -358,7 +358,7 @@ the group regardless of the IP restriction.
 You can restrict access to groups and their underlying projects by
 allowing only users with email addresses in particular domains to be added to the group.
 
-Add email domains you want to whitelist and users with emails from different 
+Add email domains you want to whitelist and users with emails from different
 domains won't be allowed to be added to this group.
 
 Some domains cannot be restricted. These are the most popular public email domains, such as:
@@ -417,7 +417,7 @@ You can disable all email notifications related to the group, which also include
 it's subgroups and projects.
 
 To enable this feature:
- 
+
 1. Navigate to the group's **Settings > General** page.
 1. Expand the **Permissions, LFS, 2FA** section, and select **Disable email notifications**.
 1. Click **Save changes**.
diff --git a/doc/user/project/code_owners.md b/doc/user/project/code_owners.md
index 96c4f16fe04..79f0bb4db72 100644
--- a/doc/user/project/code_owners.md
+++ b/doc/user/project/code_owners.md
@@ -58,7 +58,7 @@ Example `CODEOWNERS` file:
 \#file_with_pound.rb @owner-file-with-pound
 
 # Multiple codeowners can be specified, separated by spaces or tabs
-CODEOWNERS @multiple @code @owners 
+CODEOWNERS @multiple @code @owners
 
 # Both usernames or email addresses can be used to match
 # users. Everything else will be ignored. For example this will
diff --git a/doc/user/project/integrations/bamboo.md b/doc/user/project/integrations/bamboo.md
index 3206a39dc08..94e0c9fd886 100644
--- a/doc/user/project/integrations/bamboo.md
+++ b/doc/user/project/integrations/bamboo.md
@@ -57,5 +57,5 @@ service in GitLab.
 If builds are not triggered, ensure you entered the right GitLab IP address in
 Bamboo under 'Trigger IP addresses'.
 
-> **Note:**
-> - Starting with GitLab 8.14.0, builds are triggered on push events.
+NOTE: **Note:**
+Starting with GitLab 8.14.0, builds are triggered on push events.
diff --git a/doc/user/project/integrations/mock_ci.md b/doc/user/project/integrations/mock_ci.md
index 886094a6531..b06ccda8287 100644
--- a/doc/user/project/integrations/mock_ci.md
+++ b/doc/user/project/integrations/mock_ci.md
@@ -6,7 +6,7 @@ To set up the mock CI service server, respond to the following endpoints
 
 - `commit_status`: `#{project.namespace.path}/#{project.path}/status/#{sha}.json`
   - Have your service return `200 { status: ['failed'|'canceled'|'running'|'pending'|'success'|'success-with-warnings'|'skipped'|'not_found'] }`
-   - If the service returns a 404, it is interpreted as `pending`
+  - If the service returns a 404, it is interpreted as `pending`
 - `build_page`: `#{project.namespace.path}/#{project.path}/status/#{sha}`
   - Just where the build is linked to, doesn't matter if implemented
 
diff --git a/doc/user/project/integrations/webhooks.md b/doc/user/project/integrations/webhooks.md
index ed0458ebc0f..f5bc6cbd988 100644
--- a/doc/user/project/integrations/webhooks.md
+++ b/doc/user/project/integrations/webhooks.md
@@ -2,6 +2,7 @@
 
 > **Note:**
 > Starting from GitLab 8.5:
+>
 > - the `repository` key is deprecated in favor of the `project` key
 > - the `project.ssh_url` key is deprecated in favor of the `project.git_ssh_url` key
 > - the `project.http_url` key is deprecated in favor of the `project.git_http_url` key
@@ -12,6 +13,7 @@
 >
 > **Note:**
 > Starting from GitLab 11.2:
+>
 > - The `description` field for issues, merge requests, comments, and wiki pages
 >   is rewritten so that simple Markdown image references (like
 >   `![](/uploads/...)`) have their target URL changed to an absolute URL. See
@@ -98,11 +100,12 @@ Below are described the supported events.
 
 Triggered when you push to the repository except when pushing tags.
 
-> **Note:** When more than 20 commits are pushed at once, the `commits` webhook
-  attribute will only contain the first 20 for performance reasons. Loading
-  detailed commit data is expensive. Note that despite only 20 commits being
-  present in the `commits` attribute, the `total_commits_count` attribute will
-  contain the actual total.
+NOTE: **Note:**
+When more than 20 commits are pushed at once, the `commits` webhook
+attribute will only contain the first 20 for performance reasons. Loading
+detailed commit data is expensive. Note that despite only 20 commits being
+present in the `commits` attribute, the `total_commits_count` attribute will
+contain the actual total.
 
 **Request header**:
 
diff --git a/doc/user/project/issues/issue_data_and_actions.md b/doc/user/project/issues/issue_data_and_actions.md
index d7d168710ef..41a7ed09281 100644
--- a/doc/user/project/issues/issue_data_and_actions.md
+++ b/doc/user/project/issues/issue_data_and_actions.md
@@ -192,7 +192,7 @@ You can also click the `+` to add more related issues.
 
 #### 19. Related Merge Requests
 
-Merge requests that were mentioned in that issue's description or in the issue thread 
+Merge requests that were mentioned in that issue's description or in the issue thread
 are listed as [related merge requests](crosslinking_issues.md#from-merge-requests) here.
 Also, if the current issue was mentioned as related in another merge request, that
 merge request will be listed here.
diff --git a/doc/user/project/issues/sorting_issue_lists.md b/doc/user/project/issues/sorting_issue_lists.md
index 0fe86e6f410..6e31acf80bc 100644
--- a/doc/user/project/issues/sorting_issue_lists.md
+++ b/doc/user/project/issues/sorting_issue_lists.md
@@ -15,14 +15,14 @@ When you select **Manual** sorting, you can change
 the order by dragging and dropping the issues. The changed order will persist. Everyone who visits the same list will see the reordered list, with some exceptions.
 
 Each issue is assigned a relative order value, representing its relative
-order with respect to the other issues in the list. When you drag-and-drop reorder 
+order with respect to the other issues in the list. When you drag-and-drop reorder
 an issue, its relative order value changes accordingly.
 
 In addition, any time that issue appears in a manually sorted list,
 the updated relative order value will be used for the ordering.  This means that
 if issue `A` is drag-and-drop reordered to be above issue `B` by any user in
 a given list inside your GitLab instance, any time those two issues are subsequently
-loaded in any list in the same instance (could be a different project issue list or a 
+loaded in any list in the same instance (could be a different project issue list or a
 different group issue list, for example), that ordering will be maintained.
 
 This ordering also affects [issue boards](../issue_board.md#issue-ordering-in-a-list).
diff --git a/doc/user/project/merge_requests/allow_collaboration.md b/doc/user/project/merge_requests/allow_collaboration.md
index e94125e658d..a88fb4fc6f8 100644
--- a/doc/user/project/merge_requests/allow_collaboration.md
+++ b/doc/user/project/merge_requests/allow_collaboration.md
@@ -4,8 +4,7 @@ type: reference, howto
 
 # Allow collaboration on merge requests across forks
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/17395)
-  in GitLab 10.6.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/17395) in GitLab 10.6.
 
 When a user opens a merge request from a fork, they are given the option to allow
 upstream members to collaborate with them on the source branch. This allows
diff --git a/doc/user/project/merge_requests/merge_request_approvals.md b/doc/user/project/merge_requests/merge_request_approvals.md
index a0432414bcf..ca9ddd91e0d 100644
--- a/doc/user/project/merge_requests/merge_request_approvals.md
+++ b/doc/user/project/merge_requests/merge_request_approvals.md
@@ -330,7 +330,7 @@ the dropdown) `approver` and select the user.
 Merge Request Approvals can be configured to require approval from a member
 of your security team when a vulnerability would be introduced by a merge request.
 
-For more information, see 
+For more information, see
 [Security approvals in merge requests](../../application_security/index.md#security-approvals-in-merge-requests-ultimate).
 
 <!-- ## Troubleshooting
diff --git a/doc/user/project/packages/maven_repository.md b/doc/user/project/packages/maven_repository.md
index c61402afb2c..491ebc0c068 100644
--- a/doc/user/project/packages/maven_repository.md
+++ b/doc/user/project/packages/maven_repository.md
@@ -1,7 +1,6 @@
 # GitLab Maven Repository **(PREMIUM)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5811) in
-  [GitLab Premium](https://about.gitlab.com/pricing/) 11.3.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5811) in [GitLab Premium](https://about.gitlab.com/pricing/) 11.3.
 
 With the GitLab [Maven](https://maven.apache.org) Repository, every
 project can have its own space to store its Maven artifacts.
diff --git a/doc/user/project/packages/npm_registry.md b/doc/user/project/packages/npm_registry.md
index e01bac6b26f..48186688da9 100644
--- a/doc/user/project/packages/npm_registry.md
+++ b/doc/user/project/packages/npm_registry.md
@@ -1,7 +1,6 @@
 # GitLab NPM Registry **(PREMIUM)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5934)
-  in [GitLab Premium](https://about.gitlab.com/pricing/) 11.7.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/5934) in [GitLab Premium](https://about.gitlab.com/pricing/) 11.7.
 
 With the GitLab NPM Registry, every
 project can have its own space to store NPM packages.
diff --git a/doc/user/project/pages/custom_domains_ssl_tls_certification/dns_concepts.md b/doc/user/project/pages/custom_domains_ssl_tls_certification/dns_concepts.md
index 3b80370d4a9..dc75eb450a3 100644
--- a/doc/user/project/pages/custom_domains_ssl_tls_certification/dns_concepts.md
+++ b/doc/user/project/pages/custom_domains_ssl_tls_certification/dns_concepts.md
@@ -92,4 +92,4 @@ You can have one DNS record or more than one combined:
 - `example.com` => `A` => `192.192.192.192`
 - `www` => `CNAME` => `example.com`
 - `MX` => `mail.example.com`
-- `example.com`=> TXT => `"google-site-verification=6P08Ow5E-8Q0m6vQ7FMAqAYIDprkVV8fUf_7hZ4Qvc8"`
\ No newline at end of file
+- `example.com`=> TXT => `"google-site-verification=6P08Ow5E-8Q0m6vQ7FMAqAYIDprkVV8fUf_7hZ4Qvc8"`
diff --git a/doc/user/project/pages/getting_started_part_one.md b/doc/user/project/pages/getting_started_part_one.md
index 6d538ca2455..45fdab1ca3a 100644
--- a/doc/user/project/pages/getting_started_part_one.md
+++ b/doc/user/project/pages/getting_started_part_one.md
@@ -100,4 +100,4 @@ _Read on about [Projects for GitLab Pages and URL structure](getting_started_par
 - Read through this technical overview on [Static versus Dynamic Websites](https://about.gitlab.com/2016/06/03/ssg-overview-gitlab-pages-part-1-dynamic-x-static/)
 - Understand [how modern Static Site Generators work](https://about.gitlab.com/2016/06/10/ssg-overview-gitlab-pages-part-2/) and what you can add to your static site
 - You can use [any SSG with GitLab Pages](https://about.gitlab.com/2016/06/17/ssg-overview-gitlab-pages-part-3-examples-ci/)
-- Fork an [example project](https://gitlab.com/pages) to build your website based upon
\ No newline at end of file
+- Fork an [example project](https://gitlab.com/pages) to build your website based upon
diff --git a/doc/user/project/pipelines/settings.md b/doc/user/project/pipelines/settings.md
index 456209c2180..78b6d202b32 100644
--- a/doc/user/project/pipelines/settings.md
+++ b/doc/user/project/pipelines/settings.md
@@ -107,11 +107,11 @@ in the pipelines settings page.
 ### Removing color codes
 
 Some test coverage tools output with ANSI color codes that won't be
-parsed correctly by the regular expression and will cause coverage 
-parsing to fail. 
+parsed correctly by the regular expression and will cause coverage
+parsing to fail.
 
 If your coverage tool doesn't provide an option to disable color
-codes in the output, you can pipe the output of the coverage tool through a 
+codes in the output, you can pipe the output of the coverage tool through a
 small one line script that will strip the color codes off.
 
 For example:
diff --git a/doc/user/project/settings/index.md b/doc/user/project/settings/index.md
index 4e3db95b6d6..58ccd8bf2ae 100644
--- a/doc/user/project/settings/index.md
+++ b/doc/user/project/settings/index.md
@@ -34,7 +34,7 @@ Issues or Merge Requests, both of which use Labels and Milestones, then you shou
 
 #### Disabling email notifications
 
-You can disable all email notifications related to the project by selecting the 
+You can disable all email notifications related to the project by selecting the
 **Disable email notifications** checkbox.  Only the project owner is allowed to change
 this setting.
 
diff --git a/doc/user/search/advanced_search_syntax.md b/doc/user/search/advanced_search_syntax.md
index c3d22e4fd29..d65dd32fe11 100644
--- a/doc/user/search/advanced_search_syntax.md
+++ b/doc/user/search/advanced_search_syntax.md
@@ -1,6 +1,7 @@
 # Advanced Syntax Search **(STARTER ONLY)**
 
 > **Notes:**
+>
 > - Introduced in [GitLab Enterprise Starter][ee] 9.2
 > - This is the user documentation. To install and configure Elasticsearch,
 >   visit the [administrator documentation](../../integration/elasticsearch.md).
-- 
cgit v1.2.1


From 615b73c739e7d9e98241ca7c8d10f465f581d27f Mon Sep 17 00:00:00 2001
From: Patrick Bajao <ebajao@gitlab.com>
Date: Thu, 22 Aug 2019 20:42:15 +0800
Subject: Doc: Add documentation about public MR-level API

---
 doc/api/merge_request_approvals.md | 258 +++++++++++++++++++++++++++++++++++++
 1 file changed, 258 insertions(+)

diff --git a/doc/api/merge_request_approvals.md b/doc/api/merge_request_approvals.md
index bf83bfd7e6a..e1aca97f3a7 100644
--- a/doc/api/merge_request_approvals.md
+++ b/doc/api/merge_request_approvals.md
@@ -605,3 +605,261 @@ POST /projects/:id/merge_requests/:merge_request_iid/unapprove
 |---------------------|---------|----------|---------------------|
 | `id`                | integer | yes      | The ID of a project |
 | `merge_request_iid` | integer | yes      | The IID of MR       |
+
+### Get merge request level rules
+
+>**Note:** This API endpoint is only available on 12.3 Starter and above.
+
+You can request information about a merge request's approval rules using the following endpoint:
+
+```
+GET /projects/:id/merge_requests/:merge_request_iid/approval_rules
+```
+
+**Parameters:**
+
+| Attribute           | Type    | Required | Description         |
+|---------------------|---------|----------|---------------------|
+| `id`                | integer | yes      | The ID of a project |
+| `merge_request_iid` | integer | yes      | The IID of MR       |
+
+```json
+[
+  {
+    "id": 1,
+    "name": "security",
+    "rule_type": "regular",
+    "eligible_approvers": [
+      {
+        "id": 5,
+        "name": "John Doe",
+        "username": "jdoe",
+        "state": "active",
+        "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+        "web_url": "http://localhost/jdoe"
+      },
+      {
+        "id": 50,
+        "name": "Group Member 1",
+        "username": "group_member_1",
+        "state": "active",
+        "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+        "web_url": "http://localhost/group_member_1"
+      }
+    ],
+    "approvals_required": 3,
+    "source_rule": null,
+    "users": [
+      {
+        "id": 5,
+        "name": "John Doe",
+        "username": "jdoe",
+        "state": "active",
+        "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+        "web_url": "http://localhost/jdoe"
+      }
+    ],
+    "groups": [
+      {
+        "id": 5,
+        "name": "group1",
+        "path": "group1",
+        "description": "",
+        "visibility": "public",
+        "lfs_enabled": false,
+        "avatar_url": null,
+        "web_url": "http://localhost/groups/group1",
+        "request_access_enabled": false,
+        "full_name": "group1",
+        "full_path": "group1",
+        "parent_id": null,
+        "ldap_cn": null,
+        "ldap_access": null
+      }
+    ],
+    "contains_hidden_groups": false
+  }
+]
+```
+
+### Create merge request level rule
+
+>**Note:** This API endpoint is only available on 12.3 Starter and above.
+
+You can create merge request approval rules using the following endpoint:
+
+```
+POST /projects/:id/merge_requests/:merge_request_iid/approval_rules
+```
+
+**Parameters:**
+
+| Attribute                  | Type    | Required | Description                                    |
+|----------------------------|---------|----------|------------------------------------------------|
+| `id`                       | integer | yes      | The ID of a project                            |
+| `merge_request_iid`        | integer | yes      | The IID of MR                                  |
+| `name`                     | string  | yes      | The name of the approval rule                  |
+| `approvals_required`       | integer | yes      | The number of required approvals for this rule |
+| `approval_project_rule_id` | integer | no       | The ID of a project-level approval rule        |
+| `users`                    | integer | no       | The ids of users as approvers                  |
+| `groups`                   | integer | no       | The ids of groups as approvers                 |
+
+**Important:** WHen `approval_project_rule_id` is set, the `name`, `users` and
+`groups` of project-level rule will be copied. The `approvals_required` specified
+will be used.
+
+```json
+{
+  "id": 1,
+  "name": "security",
+  "rule_type": "regular",
+  "eligible_approvers": [
+    {
+      "id": 2,
+      "name": "John Doe",
+      "username": "jdoe",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/jdoe"
+    },
+    {
+      "id": 50,
+      "name": "Group Member 1",
+      "username": "group_member_1",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/group_member_1"
+    }
+  ],
+  "approvals_required": 1,
+  "source_rule": null,
+  "users": [
+    {
+      "id": 2,
+      "name": "John Doe",
+      "username": "jdoe",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/jdoe"
+    }
+  ],
+  "groups": [
+    {
+      "id": 5,
+      "name": "group1",
+      "path": "group1",
+      "description": "",
+      "visibility": "public",
+      "lfs_enabled": false,
+      "avatar_url": null,
+      "web_url": "http://localhost/groups/group1",
+      "request_access_enabled": false,
+      "full_name": "group1",
+      "full_path": "group1",
+      "parent_id": null,
+      "ldap_cn": null,
+      "ldap_access": null
+    }
+  ],
+  "contains_hidden_groups": false
+}
+```
+
+### Update merge request level rule
+
+>**Note:** This API endpoint is only available on 12.3 Starter and above.
+
+You can update merge request approval rules using the following endpoint:
+
+```
+PUT /projects/:id/merge_request/:merge_request_iid/approval_rules/:approval_rule_id
+```
+
+**Important:** Approvers and groups not in the `users`/`groups` param will be **removed**
+
+**Parameters:**
+
+| Attribute            | Type    | Required | Description                                    |
+|----------------------|---------|----------|------------------------------------------------|
+| `id`                 | integer | yes      | The ID of a project                            |
+| `merge_request_iid`  | integer | yes      | The ID of MR                                   |
+| `approval_rule_id`   | integer | yes      | The ID of a approval rule                      |
+| `name`               | string  | yes      | The name of the approval rule                  |
+| `approvals_required` | integer | yes      | The number of required approvals for this rule |
+| `users`              | integer | no       | The ids of users as approvers                  |
+| `groups`             | integer | no       | The ids of groups as approvers                 |
+
+```json
+{
+  "id": 1,
+  "name": "security",
+  "rule_type": "regular",
+  "eligible_approvers": [
+    {
+      "id": 2,
+      "name": "John Doe",
+      "username": "jdoe",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/jdoe"
+    },
+    {
+      "id": 50,
+      "name": "Group Member 1",
+      "username": "group_member_1",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/group_member_1"
+    }
+  ],
+  "approvals_required": 1,
+  "source_rule": null,
+  "users": [
+    {
+      "id": 2,
+      "name": "John Doe",
+      "username": "jdoe",
+      "state": "active",
+      "avatar_url": "https://www.gravatar.com/avatar/0?s=80&d=identicon",
+      "web_url": "http://localhost/jdoe"
+    }
+  ],
+  "groups": [
+    {
+      "id": 5,
+      "name": "group1",
+      "path": "group1",
+      "description": "",
+      "visibility": "public",
+      "lfs_enabled": false,
+      "avatar_url": null,
+      "web_url": "http://localhost/groups/group1",
+      "request_access_enabled": false,
+      "full_name": "group1",
+      "full_path": "group1",
+      "parent_id": null,
+      "ldap_cn": null,
+      "ldap_access": null
+    }
+  ],
+  "contains_hidden_groups": false
+}
+```
+
+### Delete merge request level rule
+
+>**Note:** This API endpoint is only available on 12.3 Starter and above.
+
+You can delete merge request approval rules using the following endpoint:
+
+```
+DELETE /projects/:id/merge_requests/:merge_request_iid/approval_rules/:approval_rule_id
+```
+
+**Parameters:**
+
+| Attribute           | Type    | Required | Description               |
+|---------------------|---------|----------|---------------------------|
+| `id`                | integer | yes      | The ID of a project       |
+| `merge_request_iid` | integer | yes      | The ID of MR              |
+| `approval_rule_id`  | integer | yes      | The ID of a approval rule |
-- 
cgit v1.2.1


From efbc7a39da14634105596a964e530530f7178058 Mon Sep 17 00:00:00 2001
From: Patrick Bajao <ebajao@gitlab.com>
Date: Fri, 23 Aug 2019 15:50:41 +0800
Subject: Doc: Add info about update/delete restriction

---
 doc/api/merge_request_approvals.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/doc/api/merge_request_approvals.md b/doc/api/merge_request_approvals.md
index e1aca97f3a7..e60560d5625 100644
--- a/doc/api/merge_request_approvals.md
+++ b/doc/api/merge_request_approvals.md
@@ -704,7 +704,7 @@ POST /projects/:id/merge_requests/:merge_request_iid/approval_rules
 | `users`                    | integer | no       | The ids of users as approvers                  |
 | `groups`                   | integer | no       | The ids of groups as approvers                 |
 
-**Important:** WHen `approval_project_rule_id` is set, the `name`, `users` and
+**Important:** When `approval_project_rule_id` is set, the `name`, `users` and
 `groups` of project-level rule will be copied. The `approvals_required` specified
 will be used.
 
@@ -777,6 +777,9 @@ PUT /projects/:id/merge_request/:merge_request_iid/approval_rules/:approval_rule
 
 **Important:** Approvers and groups not in the `users`/`groups` param will be **removed**
 
+**Important:** Updating a `report_approver` or `code_owner` rule is not allowed.
+These are system generated rules.
+
 **Parameters:**
 
 | Attribute            | Type    | Required | Description                                    |
@@ -856,6 +859,9 @@ You can delete merge request approval rules using the following endpoint:
 DELETE /projects/:id/merge_requests/:merge_request_iid/approval_rules/:approval_rule_id
 ```
 
+**Important:** Deleting a `report_approver` or `code_owner` rule is not allowed.
+These are system generated rules.
+
 **Parameters:**
 
 | Attribute           | Type    | Required | Description               |
-- 
cgit v1.2.1


From 32ec0b7ac9975244a7cfe0872cc76a9f7ae780ce Mon Sep 17 00:00:00 2001
From: Patrick Bajao <ebajao@gitlab.com>
Date: Wed, 28 Aug 2019 09:53:50 +0800
Subject: Doc: Fix type of users and groups params

---
 doc/api/merge_request_approvals.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/doc/api/merge_request_approvals.md b/doc/api/merge_request_approvals.md
index e60560d5625..84b623f1254 100644
--- a/doc/api/merge_request_approvals.md
+++ b/doc/api/merge_request_approvals.md
@@ -152,8 +152,8 @@ POST /projects/:id/approval_rules
 | `id`                 | integer | yes      | The ID of a project                                       |
 | `name`               | string  | yes      | The name of the approval rule                             |
 | `approvals_required` | integer | yes      | The number of required approvals for this rule            |
-| `users`              | integer | no       | The ids of users as approvers                             |
-| `groups`             | integer | no       | The ids of groups as approvers                            |
+| `users`              | Array   | no       | The ids of users as approvers                             |
+| `groups`             | Array   | no       | The ids of groups as approvers                            |
 
 ```json
 {
@@ -231,8 +231,8 @@ PUT /projects/:id/approval_rules/:approval_rule_id
 | `approval_rule_id`   | integer | yes      | The ID of a approval rule                                 |
 | `name`               | string  | yes      | The name of the approval rule                             |
 | `approvals_required` | integer | yes      | The number of required approvals for this rule            |
-| `users`              | integer | no       | The ids of users as approvers                             |
-| `groups`             | integer | no       | The ids of groups as approvers                            |
+| `users`              | Array   | no       | The ids of users as approvers                             |
+| `groups`             | Array   | no       | The ids of groups as approvers                            |
 
 ```json
 {
@@ -701,8 +701,8 @@ POST /projects/:id/merge_requests/:merge_request_iid/approval_rules
 | `name`                     | string  | yes      | The name of the approval rule                  |
 | `approvals_required`       | integer | yes      | The number of required approvals for this rule |
 | `approval_project_rule_id` | integer | no       | The ID of a project-level approval rule        |
-| `users`                    | integer | no       | The ids of users as approvers                  |
-| `groups`                   | integer | no       | The ids of groups as approvers                 |
+| `users`                    | Array   | no       | The ids of users as approvers                  |
+| `groups`                   | Array   | no       | The ids of groups as approvers                 |
 
 **Important:** When `approval_project_rule_id` is set, the `name`, `users` and
 `groups` of project-level rule will be copied. The `approvals_required` specified
@@ -789,8 +789,8 @@ These are system generated rules.
 | `approval_rule_id`   | integer | yes      | The ID of a approval rule                      |
 | `name`               | string  | yes      | The name of the approval rule                  |
 | `approvals_required` | integer | yes      | The number of required approvals for this rule |
-| `users`              | integer | no       | The ids of users as approvers                  |
-| `groups`             | integer | no       | The ids of groups as approvers                 |
+| `users`              | Array   | no       | The ids of users as approvers                  |
+| `groups`             | Array   | no       | The ids of groups as approvers                 |
 
 ```json
 {
-- 
cgit v1.2.1


From 32900bbfc440b9948f8ac26c04f254b9619769d4 Mon Sep 17 00:00:00 2001
From: Patrick Bajao <ebajao@gitlab.com>
Date: Thu, 29 Aug 2019 10:30:49 +0800
Subject: Doc: Update POST/PUT endpoints to use *_ids params

---
 doc/api/merge_request_approvals.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/doc/api/merge_request_approvals.md b/doc/api/merge_request_approvals.md
index 84b623f1254..7dae1b25658 100644
--- a/doc/api/merge_request_approvals.md
+++ b/doc/api/merge_request_approvals.md
@@ -152,8 +152,8 @@ POST /projects/:id/approval_rules
 | `id`                 | integer | yes      | The ID of a project                                       |
 | `name`               | string  | yes      | The name of the approval rule                             |
 | `approvals_required` | integer | yes      | The number of required approvals for this rule            |
-| `users`              | Array   | no       | The ids of users as approvers                             |
-| `groups`             | Array   | no       | The ids of groups as approvers                            |
+| `user_ids`           | Array   | no       | The ids of users as approvers                             |
+| `group_ids`          | Array   | no       | The ids of groups as approvers                            |
 
 ```json
 {
@@ -231,8 +231,8 @@ PUT /projects/:id/approval_rules/:approval_rule_id
 | `approval_rule_id`   | integer | yes      | The ID of a approval rule                                 |
 | `name`               | string  | yes      | The name of the approval rule                             |
 | `approvals_required` | integer | yes      | The number of required approvals for this rule            |
-| `users`              | Array   | no       | The ids of users as approvers                             |
-| `groups`             | Array   | no       | The ids of groups as approvers                            |
+| `user_ids`           | Array   | no       | The ids of users as approvers                             |
+| `group_ids`          | Array   | no       | The ids of groups as approvers                            |
 
 ```json
 {
@@ -701,8 +701,8 @@ POST /projects/:id/merge_requests/:merge_request_iid/approval_rules
 | `name`                     | string  | yes      | The name of the approval rule                  |
 | `approvals_required`       | integer | yes      | The number of required approvals for this rule |
 | `approval_project_rule_id` | integer | no       | The ID of a project-level approval rule        |
-| `users`                    | Array   | no       | The ids of users as approvers                  |
-| `groups`                   | Array   | no       | The ids of groups as approvers                 |
+| `user_ids`                 | Array   | no       | The ids of users as approvers                  |
+| `group_ids`                | Array   | no       | The ids of groups as approvers                 |
 
 **Important:** When `approval_project_rule_id` is set, the `name`, `users` and
 `groups` of project-level rule will be copied. The `approvals_required` specified
@@ -789,8 +789,8 @@ These are system generated rules.
 | `approval_rule_id`   | integer | yes      | The ID of a approval rule                      |
 | `name`               | string  | yes      | The name of the approval rule                  |
 | `approvals_required` | integer | yes      | The number of required approvals for this rule |
-| `users`              | Array   | no       | The ids of users as approvers                  |
-| `groups`             | Array   | no       | The ids of groups as approvers                 |
+| `user_ids`           | Array   | no       | The ids of users as approvers                  |
+| `group_ids`          | Array   | no       | The ids of groups as approvers                 |
 
 ```json
 {
-- 
cgit v1.2.1


From 03b152c5b9b24077f3c0b261052c93949127160f Mon Sep 17 00:00:00 2001
From: Marcel Amirault <mamirault@gitlab.com>
Date: Fri, 30 Aug 2019 03:29:45 +0000
Subject: Fix broken markdown in various docs

---
 doc/ci/caching/index.md                                   | 2 +-
 doc/ci/yaml/README.md                                     | 1 +
 doc/development/contributing/issue_workflow.md            | 4 ++--
 doc/topics/autodevops/index.md                            | 2 +-
 doc/user/application_security/security_dashboard/index.md | 2 +-
 5 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/doc/ci/caching/index.md b/doc/ci/caching/index.md
index a59a0477b80..ab9fa517e23 100644
--- a/doc/ci/caching/index.md
+++ b/doc/ci/caching/index.md
@@ -175,7 +175,7 @@ job:
 ### Inherit global config, but override specific settings per job
 
 You can override cache settings without overwriting the global cache by using
-[anchors](../yaml/README.md#anchors). For example, if you want to override the 
+[anchors](../yaml/README.md#anchors). For example, if you want to override the
 `policy` for one job:
 
 ```yaml
diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md
index 7a60dedc206..38276de6791 100644
--- a/doc/ci/yaml/README.md
+++ b/doc/ci/yaml/README.md
@@ -1989,6 +1989,7 @@ Marking a job to be run in parallel requires only a simple addition to your conf
    script: rspec
 +  parallel: 5
 ```
+
 TIP: **Tip:**
 Parallelize tests suites across parallel jobs.
 Different languages have different tools to facilitate this.
diff --git a/doc/development/contributing/issue_workflow.md b/doc/development/contributing/issue_workflow.md
index f00a810ec42..8b5d380ad9e 100644
--- a/doc/development/contributing/issue_workflow.md
+++ b/doc/development/contributing/issue_workflow.md
@@ -106,7 +106,7 @@ Stage labels specify which [stage](https://about.gitlab.com/handbook/product/cat
 Stage labels respects the `devops::<stage_key>` naming convention.
 `<stage_key>` is the stage key as it is in the single source of truth for stages at
 <https://gitlab.com/gitlab-com/www-gitlab-com/blob/master/data/stages.yml>
-with `_` replaced with ` `.
+with `_` replaced with a space.
 
 For instance, the "Manage" stage is represented by the ~"devops::manage" label in
 the `gitlab-org` group since its key under `stages` is `manage`.
@@ -132,7 +132,7 @@ Group labels respects the `group::<group_key>` naming convention and
 their color is `#A8D695`.
 `<group_key>` is the group key as it is in the single source of truth for groups at
 <https://gitlab.com/gitlab-com/www-gitlab-com/blob/master/data/stages.yml>,
-with `_` replaced with ` `.
+with `_` replaced with a space.
 
 For instance, the "Continuous Integration" group is represented by the
 ~"group::continuous integration"  label in the `gitlab-org` group since its key
diff --git a/doc/topics/autodevops/index.md b/doc/topics/autodevops/index.md
index 1432147ca5b..15fdb52ac00 100644
--- a/doc/topics/autodevops/index.md
+++ b/doc/topics/autodevops/index.md
@@ -726,7 +726,7 @@ instead of the default `ruby:latest`:
 
 NOTE: **Note:**
 Passing in complex values (newlines and spaces, for example) will likely
-cause escaping issues due to the way this argument is used in Auto DevOps. 
+cause escaping issues due to the way this argument is used in Auto DevOps.
 Consider using Base64 encoding of such values to avoid this problem.
 
 CAUTION: **Warning:**
diff --git a/doc/user/application_security/security_dashboard/index.md b/doc/user/application_security/security_dashboard/index.md
index 314f7c1766f..3d7f264c295 100644
--- a/doc/user/application_security/security_dashboard/index.md
+++ b/doc/user/application_security/security_dashboard/index.md
@@ -63,7 +63,7 @@ Once you're on the dashboard, at the top you should see a series of filters for:
 - Project
 
 NOTE: **Note:**
-The dashboard only shows projects with [security reports](#supported-reports) enabled in a group. 
+The dashboard only shows projects with [security reports](#supported-reports) enabled in a group.
 
 ![dashboard with action buttons and metrics](img/group_security_dashboard.png)
 
-- 
cgit v1.2.1


From bc0e1fe679219e1b7e033f7de958e52aeeaa756a Mon Sep 17 00:00:00 2001
From: Cynthia Ng <cng@gitlab.com>
Date: Fri, 30 Aug 2019 03:42:44 +0000
Subject: Docs: Add raw endpoints limit for GL.com settings

---
 doc/user/gitlab_com/index.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/doc/user/gitlab_com/index.md b/doc/user/gitlab_com/index.md
index 548e029f81f..ca9450f94b9 100644
--- a/doc/user/gitlab_com/index.md
+++ b/doc/user/gitlab_com/index.md
@@ -331,7 +331,11 @@ No response headers are provided.
 
 ### Admin Area settings
 
-GitLab.com does not currently use these settings.
+GitLab.com:
+
+- Has [rate limits on raw endpoints](../../user/admin_area/settings/rate_limits_on_raw_endpoints.md)
+  set to the default. 
+- Does not have the user and IP rate limits settings enabled.
 
 ## GitLab.com at scale
 
-- 
cgit v1.2.1


From 69bfe12a7a5e3cecf15c1cd632f4434aa0fbe8eb Mon Sep 17 00:00:00 2001
From: Tiger <twatson@gitlab.com>
Date: Fri, 23 Aug 2019 16:05:55 +1000
Subject: Default clusters namespace_per_environment to true

---
 ...ult-clusters-namespace_per_environment-column-to-true.yml |  5 +++++
 ...5948_change_clusters_namespace_per_environment_default.rb | 12 ++++++++++++
 db/schema.rb                                                 |  2 +-
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/65251-default-clusters-namespace_per_environment-column-to-true.yml
 create mode 100644 db/migrate/20190823055948_change_clusters_namespace_per_environment_default.rb

diff --git a/changelogs/unreleased/65251-default-clusters-namespace_per_environment-column-to-true.yml b/changelogs/unreleased/65251-default-clusters-namespace_per_environment-column-to-true.yml
new file mode 100644
index 00000000000..c0bc20b2485
--- /dev/null
+++ b/changelogs/unreleased/65251-default-clusters-namespace_per_environment-column-to-true.yml
@@ -0,0 +1,5 @@
+---
+title: Default clusters namespace_per_environment column to true
+merge_request: 32139
+author:
+type: other
diff --git a/db/migrate/20190823055948_change_clusters_namespace_per_environment_default.rb b/db/migrate/20190823055948_change_clusters_namespace_per_environment_default.rb
new file mode 100644
index 00000000000..919ce807869
--- /dev/null
+++ b/db/migrate/20190823055948_change_clusters_namespace_per_environment_default.rb
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class ChangeClustersNamespacePerEnvironmentDefault < ActiveRecord::Migration[5.2]
+  DOWNTIME = false
+
+  def change
+    change_column_default :clusters, :namespace_per_environment, from: false, to: true
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 13572022235..f1dbe5c322c 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -935,7 +935,7 @@ ActiveRecord::Schema.define(version: 2019_08_28_083843) do
     t.integer "cluster_type", limit: 2, default: 3, null: false
     t.string "domain"
     t.boolean "managed", default: true, null: false
-    t.boolean "namespace_per_environment", default: false, null: false
+    t.boolean "namespace_per_environment", default: true, null: false
     t.index ["enabled"], name: "index_clusters_on_enabled"
     t.index ["user_id"], name: "index_clusters_on_user_id"
   end
-- 
cgit v1.2.1


From 364b9f7bbbb6eb4d2ebd4e0d81be7c89e4063aa6 Mon Sep 17 00:00:00 2001
From: Ronald van Zon <rvzon84@gmail.com>
Date: Fri, 30 Aug 2019 04:32:54 +0000
Subject: Apply suggestion to
 doc/user/project/pages/custom_domains_ssl_tls_certification/lets_encrypt_integration.md

---
 .../custom_domains_ssl_tls_certification/lets_encrypt_integration.md   | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/user/project/pages/custom_domains_ssl_tls_certification/lets_encrypt_integration.md b/doc/user/project/pages/custom_domains_ssl_tls_certification/lets_encrypt_integration.md
index 255d535645d..ffd9bc04c3e 100644
--- a/doc/user/project/pages/custom_domains_ssl_tls_certification/lets_encrypt_integration.md
+++ b/doc/user/project/pages/custom_domains_ssl_tls_certification/lets_encrypt_integration.md
@@ -21,6 +21,9 @@ such as [#64870](https://gitlab.com/gitlab-org/gitlab-ce/issues/64870).
 See all the related issues linked from this [issue's description](https://gitlab.com/gitlab-org/gitlab-ce/issues/28996)
 for more information.
 
+Note: **Note:**
+Using this feature requires **2 IP addresses** to be configured to the machine.
+
 ## Requirements
 
 Before you can enable automatic provisioning of a SSL certificate for your domain, make sure you have:
-- 
cgit v1.2.1


From e3a91089b75cdadaa66288d0ff68f137893a3a45 Mon Sep 17 00:00:00 2001
From: Alex Kalderimis <akalderimis@gitlab.com>
Date: Fri, 30 Aug 2019 04:43:16 +0000
Subject: Allow be_url to specify the type

This allows the be_url matcher to be more specific. By default, it only
matches HTTP and HTTPS URIs.
---
 app/services/chat_names/authorize_user_service.rb  | 10 +++++-----
 .../chat_names/authorize_user_service_spec.rb      | 21 +++++++++++++++++----
 spec/support/matchers/be_url.rb                    | 22 ++++++++++++++++++++--
 3 files changed, 42 insertions(+), 11 deletions(-)

diff --git a/app/services/chat_names/authorize_user_service.rb b/app/services/chat_names/authorize_user_service.rb
index 78b53cb3637..f7780488923 100644
--- a/app/services/chat_names/authorize_user_service.rb
+++ b/app/services/chat_names/authorize_user_service.rb
@@ -24,16 +24,16 @@ module ChatNames
     end
 
     def chat_name_token
-      Gitlab::ChatNameToken.new
+      @chat_name_token ||= Gitlab::ChatNameToken.new
     end
 
     def chat_name_params
       {
-        service_id: @service.id,
-        team_id: @params[:team_id],
+        service_id:  @service.id,
+        team_id:     @params[:team_id],
         team_domain: @params[:team_domain],
-        chat_id: @params[:user_id],
-        chat_name: @params[:user_name]
+        chat_id:     @params[:user_id],
+        chat_name:   @params[:user_name]
       }
     end
   end
diff --git a/spec/services/chat_names/authorize_user_service_spec.rb b/spec/services/chat_names/authorize_user_service_spec.rb
index 41cbac4e8e9..7f32948daad 100644
--- a/spec/services/chat_names/authorize_user_service_spec.rb
+++ b/spec/services/chat_names/authorize_user_service_spec.rb
@@ -4,23 +4,36 @@ require 'spec_helper'
 
 describe ChatNames::AuthorizeUserService do
   describe '#execute' do
-    let(:service) { create(:service) }
+    subject { described_class.new(service, params) }
 
-    subject { described_class.new(service, params).execute }
+    let(:result) { subject.execute }
+    let(:service) { create(:service) }
 
     context 'when all parameters are valid' do
       let(:params) { { team_id: 'T0001', team_domain: 'myteam', user_id: 'U0001', user_name: 'user' } }
 
+      it 'produces a valid HTTP URL' do
+        expect(result).to be_http_url
+      end
+
       it 'requests a new token' do
-        is_expected.to be_url
+        expect(subject).to receive(:request_token).once.and_call_original
+
+        subject.execute
       end
     end
 
     context 'when there are missing parameters' do
       let(:params) { {} }
 
+      it 'does not produce a URL' do
+        expect(result).to be_nil
+      end
+
       it 'does not request a new token' do
-        is_expected.to be_nil
+        expect(subject).not_to receive(:request_token)
+
+        subject.execute
       end
     end
   end
diff --git a/spec/support/matchers/be_url.rb b/spec/support/matchers/be_url.rb
index 69171f53891..388c1b384c7 100644
--- a/spec/support/matchers/be_url.rb
+++ b/spec/support/matchers/be_url.rb
@@ -1,11 +1,29 @@
 # frozen_string_literal: true
 
-RSpec::Matchers.define :be_url do |_|
+# Assert that this value is a valid URL of at least one type.
+#
+# By default, this checks that the URL is either a HTTP or HTTPS URI,
+# but you can check other URI schemes by passing the type, eg:
+#
+# ```
+# expect(value).to be_url(URI::FTP)
+# ```
+#
+# Pass an empty array of types if you want to match any URI scheme (be
+# aware that this might not do what you think it does! `foo` is a valid
+# URI, for instance).
+RSpec::Matchers.define :be_url do |types = [URI::HTTP, URI::HTTPS]|
   match do |actual|
-    URI.parse(actual) rescue false
+    next false unless actual.present?
+
+    uri = URI.parse(actual)
+    Array.wrap(types).any? { |t| uri.is_a?(t) }
+  rescue URI::InvalidURIError
+    false
   end
 end
 
 # looks better when used like:
 #   expect(thing).to receive(:method).with(a_valid_url)
 RSpec::Matchers.alias_matcher :a_valid_url, :be_url
+RSpec::Matchers.alias_matcher :be_http_url, :be_url
-- 
cgit v1.2.1


From aa5329115dff3e7050423f03b25312ceaa45235e Mon Sep 17 00:00:00 2001
From: Jan Beckmann <king-jan1999@hotmail.de>
Date: Fri, 30 Aug 2019 05:34:00 +0000
Subject: URL-encode file links in find file

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/62055
---
 app/assets/javascripts/project_find_file.js        |  2 +-
 .../unreleased/62055-find-file-links-encoding.yml  |  5 ++
 spec/frontend/project_find_file_spec.js            | 77 ++++++++++++++++++++++
 3 files changed, 83 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/62055-find-file-links-encoding.yml
 create mode 100644 spec/frontend/project_find_file_spec.js

diff --git a/app/assets/javascripts/project_find_file.js b/app/assets/javascripts/project_find_file.js
index 60d3d83a4b2..765cb868f80 100644
--- a/app/assets/javascripts/project_find_file.js
+++ b/app/assets/javascripts/project_find_file.js
@@ -113,7 +113,7 @@ export default class ProjectFindFile {
       if (searchText) {
         matches = fuzzaldrinPlus.match(filePath, searchText);
       }
-      blobItemUrl = this.options.blobUrlTemplate + '/' + filePath;
+      blobItemUrl = this.options.blobUrlTemplate + '/' + encodeURIComponent(filePath);
       html = ProjectFindFile.makeHtml(filePath, matches, blobItemUrl);
       results.push(this.element.find('.tree-table > tbody').append(html));
     }
diff --git a/changelogs/unreleased/62055-find-file-links-encoding.yml b/changelogs/unreleased/62055-find-file-links-encoding.yml
new file mode 100644
index 00000000000..20a359a9d64
--- /dev/null
+++ b/changelogs/unreleased/62055-find-file-links-encoding.yml
@@ -0,0 +1,5 @@
+---
+title: Fix encoding of special characters in "Find File"
+merge_request: 31311
+author: Jan Beckmann
+type: fixed
diff --git a/spec/frontend/project_find_file_spec.js b/spec/frontend/project_find_file_spec.js
new file mode 100644
index 00000000000..8102033139f
--- /dev/null
+++ b/spec/frontend/project_find_file_spec.js
@@ -0,0 +1,77 @@
+import MockAdapter from 'axios-mock-adapter';
+import $ from 'jquery';
+import ProjectFindFile from '~/project_find_file';
+import axios from '~/lib/utils/axios_utils';
+import { TEST_HOST } from 'helpers/test_constants';
+
+const BLOB_URL_TEMPLATE = `${TEST_HOST}/namespace/project/blob/master`;
+const FILE_FIND_URL = `${TEST_HOST}/namespace/project/files/master?format=json`;
+const FIND_TREE_URL = `${TEST_HOST}/namespace/project/tree/master`;
+const TEMPLATE = `<div class="file-finder-holder tree-holder js-file-finder" data-blob-url-template="${BLOB_URL_TEMPLATE}" data-file-find-url="${FILE_FIND_URL}"  data-find-tree-url="${FIND_TREE_URL}">
+  <input class="file-finder-input" id="file_find" />
+  <div class="tree-content-holder">
+    <div class="table-holder">
+      <table class="files-slider tree-table">
+        <tbody />
+      </table>
+    </div>
+  </div>
+</div>`;
+
+describe('ProjectFindFile', () => {
+  let element;
+  let mock;
+
+  const getProjectFindFileInstance = () =>
+    new ProjectFindFile(element, {
+      url: FILE_FIND_URL,
+      treeUrl: FIND_TREE_URL,
+      blobUrlTemplate: BLOB_URL_TEMPLATE,
+    });
+
+  const findFiles = () =>
+    element
+      .find('.tree-table tr')
+      .toArray()
+      .map(el => ({
+        text: el.textContent,
+        href: el.querySelector('a').href,
+      }));
+
+  beforeEach(() => {
+    // Create a mock adapter for stubbing axios API requests
+    mock = new MockAdapter(axios);
+
+    element = $(TEMPLATE);
+  });
+
+  afterEach(() => {
+    // Reset the mock adapter
+    mock.restore();
+  });
+
+  it('loads and renders elements from remote server', done => {
+    const files = [
+      'fileA.txt',
+      'fileB.txt',
+      'fi#leC.txt',
+      'folderA/fileD.txt',
+      'folder#B/fileE.txt',
+      'folde?rC/fil#F.txt',
+    ];
+    mock.onGet(FILE_FIND_URL).replyOnce(200, files);
+
+    getProjectFindFileInstance(); // This triggers a load / axios call + subsequent render in the constructor
+
+    setImmediate(() => {
+      expect(findFiles()).toEqual(
+        files.map(text => ({
+          text,
+          href: `${BLOB_URL_TEMPLATE}/${encodeURIComponent(text)}`,
+        })),
+      );
+
+      done();
+    });
+  });
+});
-- 
cgit v1.2.1


From e292e8e220756925e934f9080f1d4de95ce13ddf Mon Sep 17 00:00:00 2001
From: Shan <s.gohar@gmail.com>
Date: Fri, 30 Aug 2019 05:56:51 +0000
Subject: Fixed grammar and inconsistencies with capitalization

---
 doc/development/python_guide/index.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/development/python_guide/index.md b/doc/development/python_guide/index.md
index a80bee27d4a..47d9d96766c 100644
--- a/doc/development/python_guide/index.md
+++ b/doc/development/python_guide/index.md
@@ -7,9 +7,9 @@ As of GitLab 11.10, we require Python 3.
 
 ## Installation
 
-There are several ways of installing python on your system. To be able to use the same version we use in production,
-we suggest you use [pyenv](https://github.com/pyenv/pyenv). It works and behave similar to its counterpart in the
-ruby world: [rbenv](https://github.com/rbenv/rbenv).
+There are several ways of installing Python on your system. To be able to use the same version we use in production,
+we suggest you use [pyenv](https://github.com/pyenv/pyenv). It works and behaves similarly to its counterpart in the
+Ruby world: [rbenv](https://github.com/rbenv/rbenv).
 
 ### macOS
 
@@ -67,7 +67,7 @@ Running this command will install both the required Python version as well as re
 
 ## Use instructions
 
-To run any python code under the Pipenv environment, you need to first start a `virtualenv` based on the dependencies
+To run any Python code under the Pipenv environment, you need to first start a `virtualenv` based on the dependencies
 of the application. With Pipenv, this is a simple as running:
 
 ```bash
-- 
cgit v1.2.1


From 739d6a5ad3ac3756d89d6d07fec5fb876aa333d6 Mon Sep 17 00:00:00 2001
From: Andreas Brandl <abrandl@gitlab.com>
Date: Tue, 27 Aug 2019 15:29:53 +0200
Subject: Perform two-step Routable lookup by path

In order to lookup a Project or Namespace by path, we prefer an exact
match (case-sensitive) but in absence of that, we'd also take a
case-insensitive match.

The case-insensitive matching with preference for the exact match is a
bit more involved in SQL as the exact lookup. Yet, the majority of cases
will be an exact match. The thinking here is that we can optimize the
lookup by performing an exact match first and only if there is no
result, we perform the case-insensitive lookup.

Data for GitLab.com:
* We have about 15M records in routes table
* About 2,500 routes exist where there's more than one record
  with the same `lower(path)`

It is possible for a user to craft requests that would always trigger
the 2-step search (e.g. we have a route for `/foo/bar`, the request is
always for `/FOO/bar`). In this case, the change at hand is not
beneficial as it would run an additional query.

However, based on the data, it is highly likely that the vast majority
of requests can be satisfied with an exact match only.

The context for this change is
https://gitlab.com/gitlab-org/gitlab-ce/issues/64590#note_208156463.
---
 app/models/concerns/routable.rb       | 11 +++++++++--
 spec/models/concerns/routable_spec.rb | 20 +++++++++++++++++++-
 2 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/app/models/concerns/routable.rb b/app/models/concerns/routable.rb
index 116e8967651..115c3ce2f91 100644
--- a/app/models/concerns/routable.rb
+++ b/app/models/concerns/routable.rb
@@ -33,8 +33,15 @@ module Routable
     #
     # Returns a single object, or nil.
     def find_by_full_path(path, follow_redirects: false)
-      order_sql = Arel.sql("(CASE WHEN routes.path = #{connection.quote(path)} THEN 0 ELSE 1 END)")
-      found = where_full_path_in([path]).reorder(order_sql).take
+      if Feature.enabled?(:routable_two_step_lookup)
+        # Case sensitive match first (it's cheaper and the usual case)
+        # If we didn't have an exact match, we perform a case insensitive search
+        found = joins(:route).find_by(routes: { path: path }) || where_full_path_in([path]).take
+      else
+        order_sql = Arel.sql("(CASE WHEN routes.path = #{connection.quote(path)} THEN 0 ELSE 1 END)")
+        found = where_full_path_in([path]).reorder(order_sql).take
+      end
+
       return found if found
 
       if follow_redirects
diff --git a/spec/models/concerns/routable_spec.rb b/spec/models/concerns/routable_spec.rb
index 31163a5bb5c..cff86afe768 100644
--- a/spec/models/concerns/routable_spec.rb
+++ b/spec/models/concerns/routable_spec.rb
@@ -58,7 +58,7 @@ describe Group, 'Routable' do
     end
   end
 
-  describe '.find_by_full_path' do
+  shared_examples_for '.find_by_full_path' do
     let!(:nested_group) { create(:group, parent: group) }
 
     context 'without any redirect routes' do
@@ -110,6 +110,24 @@ describe Group, 'Routable' do
     end
   end
 
+  describe '.find_by_full_path' do
+    context 'with routable_two_step_lookup feature' do
+      before do
+        stub_feature_flags(routable_two_step_lookup: true)
+      end
+
+      it_behaves_like '.find_by_full_path'
+    end
+
+    context 'without routable_two_step_lookup feature' do
+      before do
+        stub_feature_flags(routable_two_step_lookup: false)
+      end
+
+      it_behaves_like '.find_by_full_path'
+    end
+  end
+
   describe '.where_full_path_in' do
     context 'without any paths' do
       it 'returns an empty relation' do
-- 
cgit v1.2.1


From 1003cd92cbaf9df12bf01b85c16c8dabdb1a8b72 Mon Sep 17 00:00:00 2001
From: Andreas Brandl <abrandl@gitlab.com>
Date: Thu, 29 Aug 2019 13:51:00 +0200
Subject: Add method call count instrumentation

---
 app/models/concerns/routable.rb | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/app/models/concerns/routable.rb b/app/models/concerns/routable.rb
index 115c3ce2f91..01b853d413c 100644
--- a/app/models/concerns/routable.rb
+++ b/app/models/concerns/routable.rb
@@ -59,12 +59,23 @@ module Routable
     def where_full_path_in(paths)
       return none if paths.empty?
 
+      increment_full_path_in_counter
+
       wheres = paths.map do |path|
         "(LOWER(routes.path) = LOWER(#{connection.quote(path)}))"
       end
 
       joins(:route).where(wheres.join(' OR '))
     end
+
+    # Temporary instrumentation of method calls for .where_full_path_in
+    def increment_full_path_in_counter
+      @counter ||= Gitlab::Metrics.counter(:routable_caseinsensitive_lookup_calls, 'Number of calls to Routable.where_full_path_in')
+
+      @counter.increment
+    rescue
+      # ignore the error
+    end
   end
 
   def full_name
-- 
cgit v1.2.1


From 8501e13bbc5f423b90c0ebbf20da90801a6fa410 Mon Sep 17 00:00:00 2001
From: Juliette de Rancourt <derancourt.juliette@gmail.com>
Date: Fri, 30 Aug 2019 06:16:01 +0000
Subject: Resolve "Use "moved" instead of "closed" in issue references"

---
 app/models/issue.rb                                   | 2 +-
 changelogs/unreleased/66264-moved-issue-reference.yml | 5 +++++
 lib/banzai/filter/issuable_state_filter.rb            | 7 ++++++-
 locale/gitlab.pot                                     | 3 +++
 spec/lib/banzai/filter/issuable_state_filter_spec.rb  | 8 ++++++++
 5 files changed, 23 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/66264-moved-issue-reference.yml

diff --git a/app/models/issue.rb b/app/models/issue.rb
index caea8eadd18..75d4fc8c1c5 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -178,7 +178,7 @@ class Issue < ApplicationRecord
   end
 
   def moved?
-    !moved_to.nil?
+    !moved_to_id.nil?
   end
 
   def can_move?(user, to_project = nil)
diff --git a/changelogs/unreleased/66264-moved-issue-reference.yml b/changelogs/unreleased/66264-moved-issue-reference.yml
new file mode 100644
index 00000000000..5876e9bbf79
--- /dev/null
+++ b/changelogs/unreleased/66264-moved-issue-reference.yml
@@ -0,0 +1,5 @@
+---
+title: Use moved instead of closed in issue references
+merge_request: 32277
+author: juliette-derancourt
+type: changed
diff --git a/lib/banzai/filter/issuable_state_filter.rb b/lib/banzai/filter/issuable_state_filter.rb
index 8e2358694d4..9dfd77b1759 100644
--- a/lib/banzai/filter/issuable_state_filter.rb
+++ b/lib/banzai/filter/issuable_state_filter.rb
@@ -21,7 +21,8 @@ module Banzai
           next if !can_read_cross_project? && cross_reference?(issuable)
 
           if VISIBLE_STATES.include?(issuable.state) && issuable_reference?(node.inner_html, issuable)
-            node.content += " (#{issuable.state})"
+            state = moved_issue?(issuable) ? s_("IssuableStatus|moved") : issuable.state
+            node.content += " (#{state})"
           end
         end
 
@@ -30,6 +31,10 @@ module Banzai
 
       private
 
+      def moved_issue?(issuable)
+        issuable.instance_of?(Issue) && issuable.moved?
+      end
+
       def issuable_reference?(text, issuable)
         CGI.unescapeHTML(text) == issuable.reference_link_text(project || group)
       end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 705c2921298..49de7787151 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -6191,6 +6191,9 @@ msgstr ""
 msgid "IssuableStatus|Closed (%{moved_link_start}moved%{moved_link_end})"
 msgstr ""
 
+msgid "IssuableStatus|moved"
+msgstr ""
+
 msgid "Issue"
 msgstr ""
 
diff --git a/spec/lib/banzai/filter/issuable_state_filter_spec.rb b/spec/lib/banzai/filter/issuable_state_filter_spec.rb
index 9f6dcded56f..cb431df7551 100644
--- a/spec/lib/banzai/filter/issuable_state_filter_spec.rb
+++ b/spec/lib/banzai/filter/issuable_state_filter_spec.rb
@@ -131,6 +131,14 @@ describe Banzai::Filter::IssuableStateFilter do
 
       expect(doc.css('a').last.text).to eq("#{closed_issue.to_reference} (closed)")
     end
+
+    it 'appends state to moved issue references' do
+      moved_issue = create(:issue, :closed, project: project, moved_to: create_issue(:opened))
+      link = create_link(moved_issue.to_reference, issue: moved_issue.id, reference_type: 'issue')
+      doc = filter(link, context)
+
+      expect(doc.css('a').last.text).to eq("#{moved_issue.to_reference} (moved)")
+    end
   end
 
   context 'for merge request references' do
-- 
cgit v1.2.1


From 4b13decdd10c48e877ae0313748b33f1005d4a4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexis=20S=C3=A1nchez?= <aasanchez@gmail.com>
Date: Fri, 30 Aug 2019 06:19:01 +0000
Subject: Update doc/api/deploy_keys.md

---
 doc/api/deploy_keys.md | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/doc/api/deploy_keys.md b/doc/api/deploy_keys.md
index df8cf06fc4a..2e2e1bb5e1e 100644
--- a/doc/api/deploy_keys.md
+++ b/doc/api/deploy_keys.md
@@ -212,22 +212,25 @@ group, this can be achieved quite easily with the API.
 First, find the ID of the projects you're interested in, by either listing all
 projects:
 
-```
+```bash
 curl --header 'PRIVATE-TOKEN: <your_access_token>' https://gitlab.example.com/api/v4/projects
 ```
 
-Or finding the ID of a group and then listing all projects in that group:
+Or finding the ID of a group:
 
-```
+```bash
 curl --header 'PRIVATE-TOKEN: <your_access_token>' https://gitlab.example.com/api/v4/groups
+```
 
-# For group 1234:
+Then listing all projects in that group (for example, group 1234):
+
+```bash
 curl --header 'PRIVATE-TOKEN: <your_access_token>' https://gitlab.example.com/api/v4/groups/1234
 ```
 
 With those IDs, add the same deploy key to all:
 
-```
+```bash
 for project_id in 321 456 987; do
     curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" --header "Content-Type: application/json" \
     --data '{"title": "my key", "key": "ssh-rsa AAAA..."}' https://gitlab.example.com/api/v4/projects/${project_id}/deploy_keys
-- 
cgit v1.2.1


From 70be63f936b01f4ae2f5e7deaadbc51ac082d90c Mon Sep 17 00:00:00 2001
From: Patrick Bajao <ebajao@gitlab.com>
Date: Fri, 30 Aug 2019 14:35:13 +0800
Subject: Doc: Fix order of sections

---
 doc/api/merge_request_approvals.md | 162 ++++++++++++++++++-------------------
 1 file changed, 81 insertions(+), 81 deletions(-)

diff --git a/doc/api/merge_request_approvals.md b/doc/api/merge_request_approvals.md
index 7dae1b25658..b73fe38f53e 100644
--- a/doc/api/merge_request_approvals.md
+++ b/doc/api/merge_request_approvals.md
@@ -525,87 +525,6 @@ PUT /projects/:id/merge_requests/:merge_request_iid/approvers
 }
 ```
 
-## Approve Merge Request
-
->**Note:** This API endpoint is only available on 8.9 Starter and above.
-
-If you are allowed to, you can approve a merge request using the following
-endpoint:
-
-```
-POST /projects/:id/merge_requests/:merge_request_iid/approve
-```
-
-**Parameters:**
-
-| Attribute           | Type    | Required | Description             |
-|---------------------|---------|----------|-------------------------|
-| `id`                | integer | yes      | The ID of a project     |
-| `merge_request_iid` | integer | yes      | The IID of MR           |
-| `sha`               | string  | no       | The HEAD of the MR      |
-| `approval_password` **(STARTER)** | string  | no      | Current user's password. Required if [**Require user password to approve**](../user/project/merge_requests/merge_request_approvals.md#require-authentication-when-approving-a-merge-request-starter) is enabled in the project settings. |
-
-The `sha` parameter works in the same way as
-when [accepting a merge request](merge_requests.md#accept-mr): if it is passed, then it must
-match the current HEAD of the merge request for the approval to be added. If it
-does not match, the response code will be `409`.
-
-```json
-{
-  "id": 5,
-  "iid": 5,
-  "project_id": 1,
-  "title": "Approvals API",
-  "description": "Test",
-  "state": "opened",
-  "created_at": "2016-06-08T00:19:52.638Z",
-  "updated_at": "2016-06-09T21:32:14.105Z",
-  "merge_status": "can_be_merged",
-  "approvals_required": 2,
-  "approvals_left": 0,
-  "approved_by": [
-    {
-      "user": {
-        "name": "Administrator",
-        "username": "root",
-        "id": 1,
-        "state": "active",
-        "avatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon",
-        "web_url": "http://localhost:3000/root"
-      }
-    },
-    {
-      "user": {
-        "name": "Nico Cartwright",
-        "username": "ryley",
-        "id": 2,
-        "state": "active",
-        "avatar_url": "http://www.gravatar.com/avatar/cf7ad14b34162a76d593e3affca2adca?s=80\u0026d=identicon",
-        "web_url": "http://localhost:3000/ryley"
-      }
-    }
-  ],
-}
-```
-
-## Unapprove Merge Request
-
->**Note:** This API endpoint is only available on 9.0 Starter and above.
-
-If you did approve a merge request, you can unapprove it using the following
-endpoint:
-
-```
-POST /projects/:id/merge_requests/:merge_request_iid/unapprove
-```
-
-**Parameters:**
-
-| Attribute           | Type    | Required | Description         |
-|---------------------|---------|----------|---------------------|
-| `id`                | integer | yes      | The ID of a project |
-| `merge_request_iid` | integer | yes      | The IID of MR       |
-
 ### Get merge request level rules
 
 >**Note:** This API endpoint is only available on 12.3 Starter and above.
@@ -869,3 +788,84 @@ These are system generated rules.
 | `id`                | integer | yes      | The ID of a project       |
 | `merge_request_iid` | integer | yes      | The ID of MR              |
 | `approval_rule_id`  | integer | yes      | The ID of a approval rule |
+
+## Approve Merge Request
+
+>**Note:** This API endpoint is only available on 8.9 Starter and above.
+
+If you are allowed to, you can approve a merge request using the following
+endpoint:
+
+```
+POST /projects/:id/merge_requests/:merge_request_iid/approve
+```
+
+**Parameters:**
+
+| Attribute           | Type    | Required | Description             |
+|---------------------|---------|----------|-------------------------|
+| `id`                | integer | yes      | The ID of a project     |
+| `merge_request_iid` | integer | yes      | The IID of MR           |
+| `sha`               | string  | no       | The HEAD of the MR      |
+| `approval_password` **(STARTER)** | string  | no      | Current user's password. Required if [**Require user password to approve**](../user/project/merge_requests/merge_request_approvals.md#require-authentication-when-approving-a-merge-request-starter) is enabled in the project settings. |
+
+The `sha` parameter works in the same way as
+when [accepting a merge request](merge_requests.md#accept-mr): if it is passed, then it must
+match the current HEAD of the merge request for the approval to be added. If it
+does not match, the response code will be `409`.
+
+```json
+{
+  "id": 5,
+  "iid": 5,
+  "project_id": 1,
+  "title": "Approvals API",
+  "description": "Test",
+  "state": "opened",
+  "created_at": "2016-06-08T00:19:52.638Z",
+  "updated_at": "2016-06-09T21:32:14.105Z",
+  "merge_status": "can_be_merged",
+  "approvals_required": 2,
+  "approvals_left": 0,
+  "approved_by": [
+    {
+      "user": {
+        "name": "Administrator",
+        "username": "root",
+        "id": 1,
+        "state": "active",
+        "avatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon",
+        "web_url": "http://localhost:3000/root"
+      }
+    },
+    {
+      "user": {
+        "name": "Nico Cartwright",
+        "username": "ryley",
+        "id": 2,
+        "state": "active",
+        "avatar_url": "http://www.gravatar.com/avatar/cf7ad14b34162a76d593e3affca2adca?s=80\u0026d=identicon",
+        "web_url": "http://localhost:3000/ryley"
+      }
+    }
+  ],
+}
+```
+
+## Unapprove Merge Request
+
+>**Note:** This API endpoint is only available on 9.0 Starter and above.
+
+If you did approve a merge request, you can unapprove it using the following
+endpoint:
+
+```
+POST /projects/:id/merge_requests/:merge_request_iid/unapprove
+```
+
+**Parameters:**
+
+| Attribute           | Type    | Required | Description         |
+|---------------------|---------|----------|---------------------|
+| `id`                | integer | yes      | The ID of a project |
+| `merge_request_iid` | integer | yes      | The IID of MR       |
-- 
cgit v1.2.1


From e3f9cc432c970127cb23915d18a7daeac0531ebd Mon Sep 17 00:00:00 2001
From: Takuya Noguchi <takninnovationresearch@gmail.com>
Date: Fri, 30 Aug 2019 08:35:39 +0900
Subject: Update jira-ruby to 1.7.1

Signed-off-by: Takuya Noguchi <takninnovationresearch@gmail.com>
---
 Gemfile                         | 2 +-
 Gemfile.lock                    | 7 +++++--
 config/dependency_decisions.yml | 7 +++++++
 vendor/licenses.csv             | 1 +
 4 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/Gemfile b/Gemfile
index 6c7ef7264c3..7eabce9929f 100644
--- a/Gemfile
+++ b/Gemfile
@@ -215,7 +215,7 @@ gem 'discordrb-webhooks-blackst0ne', '~> 3.3', require: false
 gem 'hipchat', '~> 1.5.0'
 
 # Jira integration
-gem 'jira-ruby', '~> 1.4'
+gem 'jira-ruby', '~> 1.7'
 
 # Flowdock integration
 gem 'flowdock', '~> 0.7'
diff --git a/Gemfile.lock b/Gemfile.lock
index dac68eac5b0..ea2c44a2992 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -74,6 +74,8 @@ GEM
     asciidoctor-plantuml (0.0.9)
       asciidoctor (>= 1.5.6, < 3.0.0)
     ast (2.4.0)
+    atlassian-jwt (0.2.0)
+      jwt (~> 2.1.0)
     attr_encrypted (3.1.0)
       encryptor (~> 3.0.0)
     attr_required (1.0.1)
@@ -444,8 +446,9 @@ GEM
       opentracing (~> 0.3)
       thrift
     jaro_winkler (1.5.3)
-    jira-ruby (1.4.1)
+    jira-ruby (1.7.1)
       activesupport
+      atlassian-jwt
       multipart-post
       oauth (~> 0.5, >= 0.5.0)
     js_regex (3.1.1)
@@ -1124,7 +1127,7 @@ DEPENDENCIES
   icalendar
   influxdb (~> 0.2)
   invisible_captcha (~> 0.12.1)
-  jira-ruby (~> 1.4)
+  jira-ruby (~> 1.7)
   js_regex (~> 3.1)
   json-schema (~> 2.8.0)
   jwt (~> 2.1.0)
diff --git a/config/dependency_decisions.yml b/config/dependency_decisions.yml
index 40a80429afa..33c90989548 100644
--- a/config/dependency_decisions.yml
+++ b/config/dependency_decisions.yml
@@ -606,3 +606,10 @@
     :why: https://github.com/egonSchiele/contracts.ruby/blob/master/LICENSE
     :versions: []
     :when: 2019-04-01 11:29:39.361015000 Z
+- - :license
+  - atlassian-jwt
+  - Apache 2.0
+  - :who: Takuya Noguchi
+    :why: https://bitbucket.org/atlassian/atlassian-jwt-ruby/src/master/LICENSE.txt
+    :versions: []
+    :when: 2019-08-30 05:45:35.317663000 Z
diff --git a/vendor/licenses.csv b/vendor/licenses.csv
index 20aacff75fd..41dd9eb5256 100644
--- a/vendor/licenses.csv
+++ b/vendor/licenses.csv
@@ -152,6 +152,7 @@ assert,1.4.1,MIT
 assign-symbols,1.0.0,MIT
 async-each,1.0.1,MIT
 async-limiter,1.0.0,MIT
+atlassian-jwt,0.2.0,Apache 2.0
 atob,2.1.2,(MIT OR Apache-2.0)
 atomic,1.1.99,Apache 2.0
 attr_encrypted,3.1.0,MIT
-- 
cgit v1.2.1


From ceb6742e0121915b7ccba8cc1f1d72ec91441ed5 Mon Sep 17 00:00:00 2001
From: Lee Tickett <lee@tickett.net>
Date: Fri, 30 Aug 2019 08:25:51 +0000
Subject: Revert "DB change, migratoin and changelog"

This reverts commit af5242ecb682189c5d8276e1ab1ffe5ce844f2e5.
---
 app/assets/javascripts/boards/components/sidebar/remove_issue.vue | 8 ++++----
 changelogs/unreleased/remove-vue-resource-from-remove-issue.yml   | 5 +++++
 2 files changed, 9 insertions(+), 4 deletions(-)
 create mode 100644 changelogs/unreleased/remove-vue-resource-from-remove-issue.yml

diff --git a/app/assets/javascripts/boards/components/sidebar/remove_issue.vue b/app/assets/javascripts/boards/components/sidebar/remove_issue.vue
index b84722244d1..71e5d8058da 100644
--- a/app/assets/javascripts/boards/components/sidebar/remove_issue.vue
+++ b/app/assets/javascripts/boards/components/sidebar/remove_issue.vue
@@ -1,10 +1,10 @@
 <script>
-import Vue from 'vue';
+import axios from '~/lib/utils/axios_utils';
 import Flash from '../../../flash';
 import { __ } from '../../../locale';
 import boardsStore from '../../stores/boards_store';
 
-export default Vue.extend({
+export default {
   props: {
     issue: {
       type: Object,
@@ -35,7 +35,7 @@ export default Vue.extend({
       }
 
       // Post the remove data
-      Vue.http.patch(this.updateUrl, data).catch(() => {
+      axios.patch(this.updateUrl, data).catch(() => {
         Flash(__('Failed to remove issue from board, please try again.'));
 
         lists.forEach(list => {
@@ -71,7 +71,7 @@ export default Vue.extend({
       return req;
     },
   },
-});
+};
 </script>
 <template>
   <div class="block list">
diff --git a/changelogs/unreleased/remove-vue-resource-from-remove-issue.yml b/changelogs/unreleased/remove-vue-resource-from-remove-issue.yml
new file mode 100644
index 00000000000..5be1c832ac7
--- /dev/null
+++ b/changelogs/unreleased/remove-vue-resource-from-remove-issue.yml
@@ -0,0 +1,5 @@
+---
+title: Remove vue resource from remove issue
+merge_request: 32425
+author: Lee Tickett
+type: other
-- 
cgit v1.2.1


From 224080f89cfd46c7ad3d3a5d331e6e1ebe55ec57 Mon Sep 17 00:00:00 2001
From: Maneschi Romain <rmaneschi@gmail.com>
Date: Fri, 30 Aug 2019 08:40:33 +0000
Subject: Delete animation width on global search input

---
 app/assets/stylesheets/pages/search.scss                | 3 +--
 changelogs/unreleased/66715-delete-search-animation.yml | 5 +++++
 2 files changed, 6 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/66715-delete-search-animation.yml

diff --git a/app/assets/stylesheets/pages/search.scss b/app/assets/stylesheets/pages/search.scss
index 74380ec995a..2d2f0c531c7 100644
--- a/app/assets/stylesheets/pages/search.scss
+++ b/app/assets/stylesheets/pages/search.scss
@@ -45,8 +45,7 @@ input[type='checkbox']:hover {
     border: 0;
     border-radius: $border-radius-default;
     transition: border-color ease-in-out $default-transition-duration,
-      background-color ease-in-out $default-transition-duration,
-      width ease-in-out $default-transition-duration;
+      background-color ease-in-out $default-transition-duration;
 
     @include media-breakpoint-up(xl) {
       width: $search-input-xl-width;
diff --git a/changelogs/unreleased/66715-delete-search-animation.yml b/changelogs/unreleased/66715-delete-search-animation.yml
new file mode 100644
index 00000000000..9cb796e4164
--- /dev/null
+++ b/changelogs/unreleased/66715-delete-search-animation.yml
@@ -0,0 +1,5 @@
+---
+title: delete animation width on global search input
+merge_request: 32399
+author: Romain Maneschi
+type: other
-- 
cgit v1.2.1


From 1bccd36f04f1e1c4efe9155ea9037910c42a3749 Mon Sep 17 00:00:00 2001
From: Markus Koller <mkoller@gitlab.com>
Date: Fri, 30 Aug 2019 09:49:14 +0000
Subject: Improve search result labels

- Use "results" instead of "blobs", "wiki blobs", "snippet blobs"
- Use "comments" instead of "notes"
- Use correct pluralization
- Don't add "1 - 10 of" if there's only one page
---
 app/helpers/search_helper.rb                       | 41 +++++++++-
 app/views/layouts/_search.html.haml                |  5 +-
 .../36383-improve-search-result-labels.yml         |  5 ++
 locale/gitlab.pot                                  | 48 +++++++++++
 spec/features/global_search_spec.rb                |  8 +-
 .../projects/files/user_searches_for_files_spec.rb |  6 +-
 .../features/search/user_searches_for_code_spec.rb | 57 ++++++--------
 .../search/user_searches_for_comments_spec.rb      | 24 +++---
 .../search/user_searches_for_commits_spec.rb       | 14 ++--
 .../search/user_searches_for_issues_spec.rb        | 24 +++---
 .../user_searches_for_merge_requests_spec.rb       | 16 ++--
 .../search/user_searches_for_milestones_spec.rb    | 16 ++--
 .../search/user_searches_for_projects_spec.rb      |  6 +-
 .../search/user_searches_for_users_spec.rb         | 92 +++++++++++-----------
 .../search/user_searches_for_wiki_pages_spec.rb    |  7 +-
 .../search/user_uses_header_search_field_spec.rb   |  6 +-
 spec/features/snippets/search_snippets_spec.rb     | 14 +---
 spec/helpers/search_helper_spec.rb                 | 43 +++++++++-
 spec/support/helpers/capybara_helpers.rb           |  4 +
 spec/support/helpers/search_helpers.rb             | 19 ++++-
 spec/support/helpers/wait_for_requests.rb          |  4 -
 spec/views/search/_results.html.haml_spec.rb       | 33 ++++++++
 22 files changed, 308 insertions(+), 184 deletions(-)
 create mode 100644 changelogs/unreleased/36383-improve-search-result-labels.yml
 create mode 100644 spec/views/search/_results.html.haml_spec.rb

diff --git a/app/helpers/search_helper.rb b/app/helpers/search_helper.rb
index 91c83380b62..2e2d324ab62 100644
--- a/app/helpers/search_helper.rb
+++ b/app/helpers/search_helper.rb
@@ -30,7 +30,46 @@ module SearchHelper
     to = collection.offset_value + collection.to_a.size
     count = collection.total_count
 
-    s_("SearchResults|Showing %{from} - %{to} of %{count} %{scope} for \"%{term}\"") % { from: from, to: to, count: count, scope: scope.humanize(capitalize: false), term: term }
+    search_entries_info_template(collection) % {
+      from: from,
+      to: to,
+      count: count,
+      scope: search_entries_info_label(scope, count),
+      term: term
+    }
+  end
+
+  def search_entries_info_label(scope, count)
+    case scope
+    when 'blobs', 'snippet_blobs', 'wiki_blobs'
+      ns_('SearchResults|result', 'SearchResults|results', count)
+    when 'commits'
+      ns_('SearchResults|commit', 'SearchResults|commits', count)
+    when 'issues'
+      ns_('SearchResults|issue', 'SearchResults|issues', count)
+    when 'merge_requests'
+      ns_('SearchResults|merge request', 'SearchResults|merge requests', count)
+    when 'milestones'
+      ns_('SearchResults|milestone', 'SearchResults|milestones', count)
+    when 'notes'
+      ns_('SearchResults|comment', 'SearchResults|comments', count)
+    when 'projects'
+      ns_('SearchResults|project', 'SearchResults|projects', count)
+    when 'snippet_titles'
+      ns_('SearchResults|snippet', 'SearchResults|snippets', count)
+    when 'users'
+      ns_('SearchResults|user', 'SearchResults|users', count)
+    else
+      raise "Unrecognized search scope '#{scope}'"
+    end
+  end
+
+  def search_entries_info_template(collection)
+    if collection.total_pages > 1
+      s_("SearchResults|Showing %{from} - %{to} of %{count} %{scope} for \"%{term}\"")
+    else
+      s_("SearchResults|Showing %{count} %{scope} for \"%{term}\"")
+    end
   end
 
   def find_project_for_result_blob(projects, result)
diff --git a/app/views/layouts/_search.html.haml b/app/views/layouts/_search.html.haml
index e6a235e39da..ba5cd0fdd41 100644
--- a/app/views/layouts/_search.html.haml
+++ b/app/views/layouts/_search.html.haml
@@ -47,6 +47,7 @@
       = hidden_field_tag :snippets, true
     = hidden_field_tag :repository_ref, @ref
     = hidden_field_tag :nav_source, 'navbar'
-    -# workaround for non-JS feature specs, for JS you need to use find('#search').send_keys(:enter)
-    = button_tag 'Go' if ENV['RAILS_ENV'] == 'test'
+    -# workaround for non-JS feature specs, see spec/support/helpers/search_helpers.rb
+    - if ENV['RAILS_ENV'] == 'test'
+      %noscript= button_tag 'Search'
     .search-autocomplete-opts.hide{ :'data-autocomplete-path' => search_autocomplete_path, :'data-autocomplete-project-id' => @project.try(:id), :'data-autocomplete-project-ref' => @ref }
diff --git a/changelogs/unreleased/36383-improve-search-result-labels.yml b/changelogs/unreleased/36383-improve-search-result-labels.yml
new file mode 100644
index 00000000000..b17c173af7a
--- /dev/null
+++ b/changelogs/unreleased/36383-improve-search-result-labels.yml
@@ -0,0 +1,5 @@
+---
+title: Improve search result labels
+merge_request: 32101
+author:
+type: changed
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 49de7787151..401b46b78f1 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -10097,9 +10097,57 @@ msgstr ""
 msgid "SearchCodeResults|of %{link_to_project}"
 msgstr ""
 
+msgid "SearchResults|Showing %{count} %{scope} for \"%{term}\""
+msgstr ""
+
 msgid "SearchResults|Showing %{from} - %{to} of %{count} %{scope} for \"%{term}\""
 msgstr ""
 
+msgid "SearchResults|comment"
+msgid_plural "SearchResults|comments"
+msgstr[0] ""
+msgstr[1] ""
+
+msgid "SearchResults|commit"
+msgid_plural "SearchResults|commits"
+msgstr[0] ""
+msgstr[1] ""
+
+msgid "SearchResults|issue"
+msgid_plural "SearchResults|issues"
+msgstr[0] ""
+msgstr[1] ""
+
+msgid "SearchResults|merge request"
+msgid_plural "SearchResults|merge requests"
+msgstr[0] ""
+msgstr[1] ""
+
+msgid "SearchResults|milestone"
+msgid_plural "SearchResults|milestones"
+msgstr[0] ""
+msgstr[1] ""
+
+msgid "SearchResults|project"
+msgid_plural "SearchResults|projects"
+msgstr[0] ""
+msgstr[1] ""
+
+msgid "SearchResults|result"
+msgid_plural "SearchResults|results"
+msgstr[0] ""
+msgstr[1] ""
+
+msgid "SearchResults|snippet"
+msgid_plural "SearchResults|snippets"
+msgstr[0] ""
+msgstr[1] ""
+
+msgid "SearchResults|user"
+msgid_plural "SearchResults|users"
+msgstr[0] ""
+msgstr[1] ""
+
 msgid "Secret"
 msgstr ""
 
diff --git a/spec/features/global_search_spec.rb b/spec/features/global_search_spec.rb
index a7ccc6f7d7b..00fa85930b1 100644
--- a/spec/features/global_search_spec.rb
+++ b/spec/features/global_search_spec.rb
@@ -16,8 +16,7 @@ describe 'Global search' do
   it 'increases usage ping searches counter' do
     expect(Gitlab::UsageDataCounters::SearchCounter).to receive(:increment_navbar_searches_count)
 
-    fill_in "search", with: "foobar"
-    click_button "Go"
+    submit_search('foobar')
   end
 
   describe 'I search through the issues and I see pagination' do
@@ -27,10 +26,9 @@ describe 'Global search' do
     end
 
     it "has a pagination" do
-      fill_in "search", with: "initial"
-      click_button "Go"
+      submit_search('initial')
+      select_search_scope('Issues')
 
-      select_filter("Issues")
       expect(page).to have_selector('.gl-pagination .next')
     end
   end
diff --git a/spec/features/projects/files/user_searches_for_files_spec.rb b/spec/features/projects/files/user_searches_for_files_spec.rb
index e82f54fbe50..ff7547bce83 100644
--- a/spec/features/projects/files/user_searches_for_files_spec.rb
+++ b/spec/features/projects/files/user_searches_for_files_spec.rb
@@ -18,8 +18,7 @@ describe 'Projects > Files > User searches for files' do
       end
 
       it 'does not show any result' do
-        fill_in('search', with: 'coffee')
-        click_button('Go')
+        submit_search('coffee')
 
         expect(page).to have_content("We couldn't find any")
       end
@@ -50,8 +49,7 @@ describe 'Projects > Files > User searches for files' do
     it 'shows found files' do
       expect(page).to have_selector('.tree-controls .shortcuts-find-file')
 
-      fill_in('search', with: 'coffee')
-      click_button('Go')
+      submit_search('coffee')
 
       expect(page).to have_content('coffee')
       expect(page).to have_content('CONTRIBUTING.md')
diff --git a/spec/features/search/user_searches_for_code_spec.rb b/spec/features/search/user_searches_for_code_spec.rb
index 4ca79ccaea8..9451ee6eb15 100644
--- a/spec/features/search/user_searches_for_code_spec.rb
+++ b/spec/features/search/user_searches_for_code_spec.rb
@@ -6,21 +6,6 @@ describe 'User searches for code' do
   let(:user) { create(:user) }
   let(:project) { create(:project, :repository, namespace: user.namespace) }
 
-  def submit_search(search, with_send_keys: false)
-    page.within('.search') do
-      field = find_field('search')
-      field.fill_in(with: search)
-
-      if with_send_keys
-        field.send_keys(:enter)
-      else
-        click_button("Go")
-      end
-    end
-
-    click_link('Code')
-  end
-
   context 'when signed in' do
     before do
       project.add_maintainer(user)
@@ -31,7 +16,9 @@ describe 'User searches for code' do
       visit(project_path(project))
 
       submit_search('application.js')
+      select_search_scope('Code')
 
+      expect(page).to have_selector('.results', text: 'application.js')
       expect(page).to have_selector('.file-content .code')
       expect(page).to have_selector("span.line[lang='javascript']")
     end
@@ -52,9 +39,7 @@ describe 'User searches for code' do
         fill_in('dashboard_search', with: 'rspec')
         find('.btn-search').click
 
-        page.within('.results') do
-          expect(find(:css, '.search-results')).to have_content('Update capybara, rspec-rails, poltergeist to recent versions')
-        end
+        expect(page).to have_selector('.results', text: 'Update capybara, rspec-rails, poltergeist to recent versions')
       end
 
       it 'search mutiple words with refs switching' do
@@ -64,16 +49,12 @@ describe 'User searches for code' do
         fill_in('dashboard_search', with: search)
         find('.btn-search').click
 
-        page.within('.results') do
-          expect(find('.search-results')).to have_content(expected_result)
-        end
+        expect(page).to have_selector('.results', text: expected_result)
 
         find('.js-project-refs-dropdown').click
         find('.dropdown-page-one .dropdown-content').click_link('v1.0.0')
 
-        page.within('.results') do
-          expect(find(:css, '.search-results')).to have_content(expected_result)
-        end
+        expect(page).to have_selector('.results', text: expected_result)
 
         expect(find_field('dashboard_search').value).to eq(search)
       end
@@ -84,7 +65,9 @@ describe 'User searches for code' do
 
       before do
         visit(project_tree_path(project, ref_name))
-        submit_search('gitlab-grack', with_send_keys: true)
+
+        submit_search('gitlab-grack')
+        select_search_scope('Code')
       end
 
       it 'shows ref switcher in code result summary' do
@@ -104,22 +87,27 @@ describe 'User searches for code' do
       end
 
       it 'search result changes when refs switched' do
-        expect(find('.search-results')).not_to have_content('path = gitlab-grack')
+        expect(find('.results')).not_to have_content('path = gitlab-grack')
+
         find('.js-project-refs-dropdown').click
         find('.dropdown-page-one .dropdown-content').click_link('master')
-        expect(find('.search-results')).to have_content('path = gitlab-grack')
+
+        expect(page).to have_selector('.results', text: 'path = gitlab-grack')
       end
     end
 
     it 'no ref switcher shown in issue result summary', :js do
       issue = create(:issue, title: 'test', project: project)
       visit(project_tree_path(project))
-      submit_search('test', with_send_keys: true)
+
+      submit_search('test')
+      select_search_scope('Code')
+
       expect(page).to have_selector('.js-project-refs-dropdown')
-      page.within('.search-filter') do
-        click_link('Issues')
-      end
-      expect(find(:css, '.search-results')).to have_link(issue.title)
+
+      select_search_scope('Issues')
+
+      expect(find(:css, '.results')).to have_link(issue.title)
       expect(page).not_to have_selector('.js-project-refs-dropdown')
     end
   end
@@ -133,10 +121,9 @@ describe 'User searches for code' do
 
     it 'finds code' do
       submit_search('rspec')
+      select_search_scope('Code')
 
-      page.within('.results') do
-        expect(find(:css, '.search-results')).to have_content('Update capybara, rspec-rails, poltergeist to recent versions')
-      end
+      expect(page).to have_selector('.results', text: 'Update capybara, rspec-rails, poltergeist to recent versions')
     end
   end
 end
diff --git a/spec/features/search/user_searches_for_comments_spec.rb b/spec/features/search/user_searches_for_comments_spec.rb
index 2ce3fa4735f..0a203a5bf2d 100644
--- a/spec/features/search/user_searches_for_comments_spec.rb
+++ b/spec/features/search/user_searches_for_comments_spec.rb
@@ -18,15 +18,13 @@ describe 'User searches for comments' do
       let(:comment) { create(:note_on_commit, author: user, project: project, commit_id: 12345678, note: 'Bug here') }
 
       it 'finds a commit' do
-        page.within('.search') do
-          fill_in('search', with: comment.note)
-          click_button('Go')
-        end
-
-        click_link('Comments')
+        submit_search(comment.note)
+        select_search_scope('Comments')
 
-        expect(page).to have_text('Commit deleted')
-        expect(page).to have_text('12345678')
+        page.within('.results') do
+          expect(page).to have_content('Commit deleted')
+          expect(page).to have_content('12345678')
+        end
       end
     end
   end
@@ -36,14 +34,10 @@ describe 'User searches for comments' do
     let(:comment) { create(:note, noteable: snippet, author: user, note: 'Supercalifragilisticexpialidocious', project: project) }
 
     it 'finds a snippet' do
-      page.within('.search') do
-        fill_in('search', with: comment.note)
-        click_button('Go')
-      end
-
-      click_link('Comments')
+      submit_search(comment.note)
+      select_search_scope('Comments')
 
-      expect(page).to have_link(snippet.title)
+      expect(page).to have_selector('.results', text: snippet.title)
     end
   end
 end
diff --git a/spec/features/search/user_searches_for_commits_spec.rb b/spec/features/search/user_searches_for_commits_spec.rb
index 81c299752ea..958f12d3b84 100644
--- a/spec/features/search/user_searches_for_commits_spec.rb
+++ b/spec/features/search/user_searches_for_commits_spec.rb
@@ -16,15 +16,13 @@ describe 'User searches for commits' do
 
   context 'when searching by SHA' do
     it 'finds a commit and redirects to its page' do
-      fill_in('search', with: sha)
-      click_button('Search')
+      submit_search(sha)
 
       expect(page).to have_current_path(project_commit_path(project, sha))
     end
 
     it 'finds a commit in uppercase and redirects to its page' do
-      fill_in('search', with: sha.upcase)
-      click_button('Search')
+      submit_search(sha.upcase)
 
       expect(page).to have_current_path(project_commit_path(project, sha))
     end
@@ -34,16 +32,14 @@ describe 'User searches for commits' do
     it 'finds a commit and holds on /search page' do
       create_commit('Message referencing another sha: "deadbeef"', project, user, 'master')
 
-      fill_in('search', with: 'deadbeef')
-      click_button('Search')
+      submit_search('deadbeef')
 
       expect(page).to have_current_path('/search', ignore_query: true)
     end
 
     it 'finds multiple commits' do
-      fill_in('search', with: 'See merge request')
-      click_button('Search')
-      click_link('Commits')
+      submit_search('See merge request')
+      select_search_scope('Commits')
 
       expect(page).to have_selector('.commit-row-description', count: 9)
     end
diff --git a/spec/features/search/user_searches_for_issues_spec.rb b/spec/features/search/user_searches_for_issues_spec.rb
index f0fcf6df70c..ae718cec7af 100644
--- a/spec/features/search/user_searches_for_issues_spec.rb
+++ b/spec/features/search/user_searches_for_issues_spec.rb
@@ -21,13 +21,11 @@ describe 'User searches for issues', :js do
     it 'finds an issue' do
       fill_in('dashboard_search', with: issue1.title)
       find('.btn-search').click
-
-      page.within('.search-filter') do
-        click_link('Issues')
-      end
+      select_search_scope('Issues')
 
       page.within('.results') do
-        expect(find(:css, '.search-results')).to have_link(issue1.title).and have_no_link(issue2.title)
+        expect(page).to have_link(issue1.title)
+        expect(page).not_to have_link(issue2.title)
       end
     end
 
@@ -41,13 +39,11 @@ describe 'User searches for issues', :js do
 
         fill_in('dashboard_search', with: issue1.title)
         find('.btn-search').click
-
-        page.within('.search-filter') do
-          click_link('Issues')
-        end
+        select_search_scope('Issues')
 
         page.within('.results') do
-          expect(find(:css, '.search-results')).to have_link(issue1.title).and have_no_link(issue2.title)
+          expect(page).to have_link(issue1.title)
+          expect(page).not_to have_link(issue2.title)
         end
       end
     end
@@ -65,13 +61,11 @@ describe 'User searches for issues', :js do
     it 'finds an issue' do
       fill_in('dashboard_search', with: issue1.title)
       find('.btn-search').click
-
-      page.within('.search-filter') do
-        click_link('Issues')
-      end
+      select_search_scope('Issues')
 
       page.within('.results') do
-        expect(find(:css, '.search-results')).to have_link(issue1.title).and have_no_link(issue2.title)
+        expect(page).to have_link(issue1.title)
+        expect(page).not_to have_link(issue2.title)
       end
     end
   end
diff --git a/spec/features/search/user_searches_for_merge_requests_spec.rb b/spec/features/search/user_searches_for_merge_requests_spec.rb
index d005b87cdfe..0139ac26816 100644
--- a/spec/features/search/user_searches_for_merge_requests_spec.rb
+++ b/spec/features/search/user_searches_for_merge_requests_spec.rb
@@ -20,13 +20,11 @@ describe 'User searches for merge requests', :js do
   it 'finds a merge request' do
     fill_in('dashboard_search', with: merge_request1.title)
     find('.btn-search').click
-
-    page.within('.search-filter') do
-      click_link('Merge requests')
-    end
+    select_search_scope('Merge requests')
 
     page.within('.results') do
-      expect(find(:css, '.search-results')).to have_link(merge_request1.title).and have_no_link(merge_request2.title)
+      expect(page).to have_link(merge_request1.title)
+      expect(page).not_to have_link(merge_request2.title)
     end
   end
 
@@ -40,13 +38,11 @@ describe 'User searches for merge requests', :js do
 
       fill_in('dashboard_search', with: merge_request1.title)
       find('.btn-search').click
-
-      page.within('.search-filter') do
-        click_link('Merge requests')
-      end
+      select_search_scope('Merge requests')
 
       page.within('.results') do
-        expect(find(:css, '.search-results')).to have_link(merge_request1.title).and have_no_link(merge_request2.title)
+        expect(page).to have_link(merge_request1.title)
+        expect(page).not_to have_link(merge_request2.title)
       end
     end
   end
diff --git a/spec/features/search/user_searches_for_milestones_spec.rb b/spec/features/search/user_searches_for_milestones_spec.rb
index 00964ab4f1d..0714cfcc309 100644
--- a/spec/features/search/user_searches_for_milestones_spec.rb
+++ b/spec/features/search/user_searches_for_milestones_spec.rb
@@ -20,13 +20,11 @@ describe 'User searches for milestones', :js do
   it 'finds a milestone' do
     fill_in('dashboard_search', with: milestone1.title)
     find('.btn-search').click
-
-    page.within('.search-filter') do
-      click_link('Milestones')
-    end
+    select_search_scope('Milestones')
 
     page.within('.results') do
-      expect(find(:css, '.search-results')).to have_link(milestone1.title).and have_no_link(milestone2.title)
+      expect(page).to have_link(milestone1.title)
+      expect(page).not_to have_link(milestone2.title)
     end
   end
 
@@ -40,13 +38,11 @@ describe 'User searches for milestones', :js do
 
       fill_in('dashboard_search', with: milestone1.title)
       find('.btn-search').click
-
-      page.within('.search-filter') do
-        click_link('Milestones')
-      end
+      select_search_scope('Milestones')
 
       page.within('.results') do
-        expect(find(:css, '.search-results')).to have_link(milestone1.title).and have_no_link(milestone2.title)
+        expect(page).to have_link(milestone1.title)
+        expect(page).not_to have_link(milestone2.title)
       end
     end
   end
diff --git a/spec/features/search/user_searches_for_projects_spec.rb b/spec/features/search/user_searches_for_projects_spec.rb
index 082c1ae8e4a..b194ac32ff6 100644
--- a/spec/features/search/user_searches_for_projects_spec.rb
+++ b/spec/features/search/user_searches_for_projects_spec.rb
@@ -20,8 +20,7 @@ describe 'User searches for projects' do
     it 'preserves the group being searched in' do
       visit(search_path(group_id: project.namespace.id))
 
-      fill_in('search', with: 'foo')
-      click_button('Search')
+      submit_search('foo')
 
       expect(find('#group_id', visible: false).value).to eq(project.namespace.id.to_s)
     end
@@ -29,8 +28,7 @@ describe 'User searches for projects' do
     it 'preserves the project being searched in' do
       visit(search_path(project_id: project.id))
 
-      fill_in('search', with: 'foo')
-      click_button('Search')
+      submit_search('foo')
 
       expect(find('#project_id', visible: false).value).to eq(project.id.to_s)
     end
diff --git a/spec/features/search/user_searches_for_users_spec.rb b/spec/features/search/user_searches_for_users_spec.rb
index e10c1afc0b8..6f2c5d48018 100644
--- a/spec/features/search/user_searches_for_users_spec.rb
+++ b/spec/features/search/user_searches_for_users_spec.rb
@@ -3,83 +3,81 @@
 require 'spec_helper'
 
 describe 'User searches for users' do
-  context 'when on the dashboard' do
-    it 'finds the user', :js do
-      create(:user, username: 'gob_bluth', name: 'Gob Bluth')
+  let(:user1) { create(:user, username: 'gob_bluth', name: 'Gob Bluth') }
+  let(:user2) { create(:user, username: 'michael_bluth', name: 'Michael Bluth') }
+  let(:user3) { create(:user, username: 'gob_2018', name: 'George Oscar Bluth') }
 
-      sign_in(create(:user))
+  before do
+    sign_in(user1)
+  end
 
+  context 'when on the dashboard' do
+    it 'finds the user', :js do
       visit dashboard_projects_path
 
-      fill_in 'search', with: 'gob'
-      find('#search').send_keys(:enter)
+      submit_search('gob')
+      select_search_scope('Users')
 
-      expect(page).to have_content('Users 1')
-
-      click_on('Users 1')
-
-      expect(page).to have_content('Gob Bluth')
-      expect(page).to have_content('@gob_bluth')
+      page.within('.results') do
+        expect(page).to have_content('Gob Bluth')
+        expect(page).to have_content('@gob_bluth')
+      end
     end
   end
 
   context 'when on the project page' do
-    it 'finds the user belonging to the project' do
-      project = create(:project)
+    let(:project) { create(:project) }
 
-      user1 = create(:user, username: 'gob_bluth', name: 'Gob Bluth')
+    before do
       create(:project_member, :developer, user: user1, project: project)
-
-      user2 = create(:user, username: 'michael_bluth', name: 'Michael Bluth')
       create(:project_member, :developer, user: user2, project: project)
+      user3
+    end
 
-      create(:user, username: 'gob_2018', name: 'George Oscar Bluth')
-
-      sign_in(user1)
-
-      visit projects_path(project)
+    it 'finds the user belonging to the project' do
+      visit project_path(project)
 
-      fill_in 'search', with: 'gob'
-      click_button 'Go'
+      submit_search('gob')
+      select_search_scope('Users')
 
-      expect(page).to have_content('Gob Bluth')
-      expect(page).to have_content('@gob_bluth')
+      page.within('.results') do
+        expect(page).to have_content('Gob Bluth')
+        expect(page).to have_content('@gob_bluth')
 
-      expect(page).not_to have_content('Michael Bluth')
-      expect(page).not_to have_content('@michael_bluth')
+        expect(page).not_to have_content('Michael Bluth')
+        expect(page).not_to have_content('@michael_bluth')
 
-      expect(page).not_to have_content('George Oscar Bluth')
-      expect(page).not_to have_content('@gob_2018')
+        expect(page).not_to have_content('George Oscar Bluth')
+        expect(page).not_to have_content('@gob_2018')
+      end
     end
   end
 
   context 'when on the group page' do
-    it 'finds the user belonging to the group' do
-      group = create(:group)
+    let(:group) { create(:group) }
 
-      user1 = create(:user, username: 'gob_bluth', name: 'Gob Bluth')
+    before do
       create(:group_member, :developer, user: user1, group: group)
-
-      user2 = create(:user, username: 'michael_bluth', name: 'Michael Bluth')
       create(:group_member, :developer, user: user2, group: group)
+      user3
+    end
 
-      create(:user, username: 'gob_2018', name: 'George Oscar Bluth')
-
-      sign_in(user1)
-
+    it 'finds the user belonging to the group' do
       visit group_path(group)
 
-      fill_in 'search', with: 'gob'
-      click_button 'Go'
+      submit_search('gob')
+      select_search_scope('Users')
 
-      expect(page).to have_content('Gob Bluth')
-      expect(page).to have_content('@gob_bluth')
+      page.within('.results') do
+        expect(page).to have_content('Gob Bluth')
+        expect(page).to have_content('@gob_bluth')
 
-      expect(page).not_to have_content('Michael Bluth')
-      expect(page).not_to have_content('@michael_bluth')
+        expect(page).not_to have_content('Michael Bluth')
+        expect(page).not_to have_content('@michael_bluth')
 
-      expect(page).not_to have_content('George Oscar Bluth')
-      expect(page).not_to have_content('@gob_2018')
+        expect(page).not_to have_content('George Oscar Bluth')
+        expect(page).not_to have_content('@gob_2018')
+      end
     end
   end
 end
diff --git a/spec/features/search/user_searches_for_wiki_pages_spec.rb b/spec/features/search/user_searches_for_wiki_pages_spec.rb
index 0a5abfbf46a..1ae37447bdc 100644
--- a/spec/features/search/user_searches_for_wiki_pages_spec.rb
+++ b/spec/features/search/user_searches_for_wiki_pages_spec.rb
@@ -26,13 +26,10 @@ describe 'User searches for wiki pages', :js do
 
       fill_in('dashboard_search', with: search_term)
       find('.btn-search').click
-
-      page.within('.search-filter') do
-        click_link('Wiki')
-      end
+      select_search_scope('Wiki')
 
       page.within('.results') do
-        expect(find(:css, '.search-results')).to have_link(wiki_page.title, href: project_wiki_path(project, wiki_page.slug))
+        expect(page).to have_link(wiki_page.title, href: project_wiki_path(project, wiki_page.slug))
       end
     end
   end
diff --git a/spec/features/search/user_uses_header_search_field_spec.rb b/spec/features/search/user_uses_header_search_field_spec.rb
index 5006631cc14..7e7c09e4a13 100644
--- a/spec/features/search/user_uses_header_search_field_spec.rb
+++ b/spec/features/search/user_uses_header_search_field_spec.rb
@@ -19,8 +19,7 @@ describe 'User uses header search field', :js do
     end
 
     it 'starts searching by pressing the enter key' do
-      fill_in('search', with: 'gitlab')
-      find('#search').native.send_keys(:enter)
+      submit_search('gitlab')
 
       page.within('.page-title') do
         expect(page).to have_content('Search')
@@ -101,8 +100,7 @@ describe 'User uses header search field', :js do
       before do
         create(:issue, project: project, title: 'project issue')
 
-        fill_in('search', with: 'project')
-        find('#search').send_keys(:enter)
+        submit_search('project')
       end
 
       it 'displays result counts for all categories' do
diff --git a/spec/features/snippets/search_snippets_spec.rb b/spec/features/snippets/search_snippets_spec.rb
index 4a8c5f9b1fe..bbdf544bd0c 100644
--- a/spec/features/snippets/search_snippets_spec.rb
+++ b/spec/features/snippets/search_snippets_spec.rb
@@ -10,12 +10,8 @@ describe 'Search Snippets' do
     sign_in private_snippet.author
     visit dashboard_snippets_path
 
-    page.within '.search' do
-      fill_in 'search', with: 'Middle'
-      click_button 'Go'
-    end
-
-    click_link 'Titles and Filenames'
+    submit_search('Middle')
+    select_search_scope('Titles and Filenames')
 
     expect(page).to have_link(public_snippet.title)
     expect(page).to have_link(private_snippet.title)
@@ -45,11 +41,7 @@ describe 'Search Snippets' do
 
     sign_in create(:user)
     visit dashboard_snippets_path
-
-    page.within '.search' do
-      fill_in 'search', with: 'line seven'
-      click_button 'Go'
-    end
+    submit_search('line seven')
 
     expect(page).to have_content('line seven')
 
diff --git a/spec/helpers/search_helper_spec.rb b/spec/helpers/search_helper_spec.rb
index 2ab72679ee7..e1dc589236b 100644
--- a/spec/helpers/search_helper_spec.rb
+++ b/spec/helpers/search_helper_spec.rb
@@ -6,7 +6,7 @@ describe SearchHelper do
     str
   end
 
-  describe 'search_autocomplete_source' do
+  describe 'search_autocomplete_opts' do
     context "with no current user" do
       before do
         allow(self).to receive(:current_user).and_return(nil)
@@ -99,6 +99,47 @@ describe SearchHelper do
     end
   end
 
+  describe 'search_entries_info' do
+    using RSpec::Parameterized::TableSyntax
+
+    where(:scope, :label) do
+      'commits'        | 'commit'
+      'issues'         | 'issue'
+      'merge_requests' | 'merge request'
+      'milestones'     | 'milestone'
+      'projects'       | 'project'
+      'snippet_titles' | 'snippet'
+      'users'          | 'user'
+
+      'blobs'          | 'result'
+      'snippet_blobs'  | 'result'
+      'wiki_blobs'     | 'result'
+
+      'notes'          | 'comment'
+    end
+
+    with_them do
+      it 'uses the correct singular label' do
+        collection = Kaminari.paginate_array([:foo]).page(1).per(10)
+
+        expect(search_entries_info(collection, scope, 'foo')).to eq("Showing 1 #{label} for \"foo\"")
+      end
+
+      it 'uses the correct plural label' do
+        collection = Kaminari.paginate_array([:foo] * 23).page(1).per(10)
+
+        expect(search_entries_info(collection, scope, 'foo')).to eq("Showing 1 - 10 of 23 #{label.pluralize} for \"foo\"")
+      end
+    end
+
+    it 'raises an error for unrecognized scopes' do
+      expect do
+        collection = Kaminari.paginate_array([:foo]).page(1).per(10)
+        search_entries_info(collection, 'unknown', 'foo')
+      end.to raise_error(RuntimeError)
+    end
+  end
+
   describe 'search_filter_input_options' do
     context 'project' do
       before do
diff --git a/spec/support/helpers/capybara_helpers.rb b/spec/support/helpers/capybara_helpers.rb
index 5abbc1e2951..a7baa7042c9 100644
--- a/spec/support/helpers/capybara_helpers.rb
+++ b/spec/support/helpers/capybara_helpers.rb
@@ -42,4 +42,8 @@ module CapybaraHelpers
   def clear_browser_session
     page.driver.browser.manage.delete_cookie('_gitlab_session')
   end
+
+  def javascript_test?
+    Capybara.current_driver == Capybara.javascript_driver
+  end
 end
diff --git a/spec/support/helpers/search_helpers.rb b/spec/support/helpers/search_helpers.rb
index 815337f8615..2cf3f4b83c4 100644
--- a/spec/support/helpers/search_helpers.rb
+++ b/spec/support/helpers/search_helpers.rb
@@ -1,7 +1,22 @@
 # frozen_string_literal: true
 
 module SearchHelpers
-  def select_filter(name)
-    find(:xpath, "//ul[contains(@class, 'search-filter')]//a[contains(.,'#{name}')]").click
+  def submit_search(query, scope: nil)
+    page.within('.search-form, .search-page-form') do
+      field = find_field('search')
+      field.fill_in(with: query)
+
+      if javascript_test?
+        field.send_keys(:enter)
+      else
+        click_button('Search')
+      end
+    end
+  end
+
+  def select_search_scope(scope)
+    page.within '.search-filter' do
+      click_link scope
+    end
   end
 end
diff --git a/spec/support/helpers/wait_for_requests.rb b/spec/support/helpers/wait_for_requests.rb
index 3bb2f7c5b51..30dff1063b5 100644
--- a/spec/support/helpers/wait_for_requests.rb
+++ b/spec/support/helpers/wait_for_requests.rb
@@ -61,8 +61,4 @@ module WaitForRequests
 
     Capybara.page.evaluate_script('jQuery.active').zero?
   end
-
-  def javascript_test?
-    Capybara.current_driver == Capybara.javascript_driver
-  end
 end
diff --git a/spec/views/search/_results.html.haml_spec.rb b/spec/views/search/_results.html.haml_spec.rb
new file mode 100644
index 00000000000..177ade3b700
--- /dev/null
+++ b/spec/views/search/_results.html.haml_spec.rb
@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'search/_results' do
+  before do
+    controller.params[:action] = 'show'
+
+    3.times { create(:issue) }
+
+    @search_objects = Issue.page(1).per(2)
+    @scope = 'issues'
+    @search_term = 'foo'
+  end
+
+  it 'displays the page size' do
+    render
+
+    expect(rendered).to have_content('Showing 1 - 2 of 3 issues for "foo"')
+  end
+
+  context 'when search results do not have a count' do
+    before do
+      @search_objects = @search_objects.without_count
+    end
+
+    it 'does not display the page size' do
+      render
+
+      expect(rendered).not_to have_content(/Showing .* of .*/)
+    end
+  end
+end
-- 
cgit v1.2.1


From edde1b708a6a605185a6dde73550b9f45e673371 Mon Sep 17 00:00:00 2001
From: Andreas Brandl <abrandl@gitlab.com>
Date: Fri, 30 Aug 2019 11:50:26 +0200
Subject: Add another counter to calculate method call ratio

We should see the ratio drop down when enabling the Feature.

Recommendation by @andrewn
---
 app/models/concerns/routable.rb | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/app/models/concerns/routable.rb b/app/models/concerns/routable.rb
index 01b853d413c..3a486632800 100644
--- a/app/models/concerns/routable.rb
+++ b/app/models/concerns/routable.rb
@@ -33,6 +33,8 @@ module Routable
     #
     # Returns a single object, or nil.
     def find_by_full_path(path, follow_redirects: false)
+      increment_counter(:routable_find_by_full_path, 'Number of calls to Routable.find_by_full_path')
+
       if Feature.enabled?(:routable_two_step_lookup)
         # Case sensitive match first (it's cheaper and the usual case)
         # If we didn't have an exact match, we perform a case insensitive search
@@ -59,7 +61,7 @@ module Routable
     def where_full_path_in(paths)
       return none if paths.empty?
 
-      increment_full_path_in_counter
+      increment_counter(:routable_where_full_path_in, 'Number of calls to Routable.where_full_path_in')
 
       wheres = paths.map do |path|
         "(LOWER(routes.path) = LOWER(#{connection.quote(path)}))"
@@ -68,11 +70,11 @@ module Routable
       joins(:route).where(wheres.join(' OR '))
     end
 
-    # Temporary instrumentation of method calls for .where_full_path_in
-    def increment_full_path_in_counter
-      @counter ||= Gitlab::Metrics.counter(:routable_caseinsensitive_lookup_calls, 'Number of calls to Routable.where_full_path_in')
+    # Temporary instrumentation of method calls
+    def increment_counter(counter, description)
+      @counters[counter] ||= Gitlab::Metrics.counter(counter, description)
 
-      @counter.increment
+      @counters[counter].increment
     rescue
       # ignore the error
     end
-- 
cgit v1.2.1


From 8170159a6ea820778acbf80cafb3afd8a5b02dfb Mon Sep 17 00:00:00 2001
From: Evan Read <eread@gitlab.com>
Date: Fri, 30 Aug 2019 11:15:00 +0000
Subject: Add note about GitHub OAuth

---
 .../ci_cd_for_external_repos/github_integration.md |  51 ++++++---------------
 .../img/github_repo_list.png                       | Bin 14282 -> 0 bytes
 2 files changed, 13 insertions(+), 38 deletions(-)
 delete mode 100644 doc/ci/ci_cd_for_external_repos/img/github_repo_list.png

diff --git a/doc/ci/ci_cd_for_external_repos/github_integration.md b/doc/ci/ci_cd_for_external_repos/github_integration.md
index f639e3dadee..fa56503072d 100644
--- a/doc/ci/ci_cd_for_external_repos/github_integration.md
+++ b/doc/ci/ci_cd_for_external_repos/github_integration.md
@@ -11,35 +11,10 @@ GitLab.
 <i class="fa fa-youtube-play youtube" aria-hidden="true"></i>
 Watch a video on [Using GitLab CI/CD pipelines with GitHub repositories](https://www.youtube.com/watch?v=qgl3F2j-1cI).
 
-## Connect with GitHub integration
-
-If the [GitHub integration](../../integration/github.md) has been enabled by your GitLab
-administrator:
-
-1. In GitLab create a **CI/CD for external repo** project and select
-   **GitHub**.
-
-   ![Create project](img/github_omniauth.png)
-
-1. Once authenticated, you will be redirected to a list of your repositories to
-   connect. Click **Connect** to select the repository.
-
-   ![Create project](img/github_repo_list.png)
-
-1. In GitHub, add a `.gitlab-ci.yml` to [configure GitLab CI/CD](../quick_start/README.md).
-
-GitLab will:
-
-1. Import the project.
-1. Enable [Pull Mirroring](../../workflow/repository_mirroring.md#pulling-from-a-remote-repository-starter).
-1. Enable [GitHub project integration](../../user/project/integrations/github.md).
-1. Create a web hook on GitHub to notify GitLab of new commits.
-
-CAUTION: **Caution:**
-Due to a 10-token limitation on the [GitHub OAuth Implementation](https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/#creating-multiple-tokens-for-oauth-apps),
-if you import more than 10 times, your oldest imported project's token will be
-revoked. See issue [#9147](https://gitlab.com/gitlab-org/gitlab-ee/issues/9147)
-for more information.
+NOTE: **Note:**
+Because of [GitHub limitations](https://gitlab.com/gitlab-org/gitlab-ee/issues/9147),
+[GitHub OAuth](../../integration/github.html#enabling-github-oauth)
+cannot be used to authenticate with GitHub as an external CI/CD repository.
 
 ## Connect with Personal Access Token
 
@@ -47,8 +22,7 @@ NOTE: **Note:**
 Personal access tokens can only be used to connect GitHub.com
 repositories to GitLab.
 
-If you are not using the [GitHub integration](../../integration/github.md), you can
-still perform a one-off authorization with GitHub to grant GitLab access your
+To perform a one-off authorization with GitHub to grant GitLab access your
 repositories:
 
 1. Open <https://github.com/settings/tokens/new> to create a **Personal Access
@@ -69,18 +43,19 @@ repositories:
 
 1. In GitHub, add a `.gitlab-ci.yml` to [configure GitLab CI/CD](../quick_start/README.md).
 
-GitLab will import the project, enable [Pull Mirroring](../../workflow/repository_mirroring.md#pulling-from-a-remote-repository-starter), enable
-[GitHub project integration](../../user/project/integrations/github.md), and create a web hook
-on GitHub to notify GitLab of new commits.
+GitLab will:
+
+1. Import the project.
+1. Enable [Pull Mirroring](../../workflow/repository_mirroring.md#pulling-from-a-remote-repository-starter)
+1. Enable [GitHub project integration](../../user/project/integrations/github.md)
+1. Create a web hook on GitHub to notify GitLab of new commits.
 
 ## Connect manually
 
 NOTE: **Note:**
-To use **GitHub Enterprise** with **GitLab.com** use this method.
+To use **GitHub Enterprise** with **GitLab.com**, use this method.
 
-If the [GitHub integration](../../integration/github.md) is not enabled, or is enabled
-for a different GitHub instance, you GitLab CI/CD can be manually enabled for
-your repository:
+To manually enable GitLab CI/CD for your repository:
 
 1. In GitHub open <https://github.com/settings/tokens/new> create a **Personal
    Access Token.** GitLab will use this token to access your repository and
diff --git a/doc/ci/ci_cd_for_external_repos/img/github_repo_list.png b/doc/ci/ci_cd_for_external_repos/img/github_repo_list.png
deleted file mode 100644
index 73579dd3cf1..00000000000
Binary files a/doc/ci/ci_cd_for_external_repos/img/github_repo_list.png and /dev/null differ
-- 
cgit v1.2.1


From 807c3307d5092121baaa32a53098ce761afc982e Mon Sep 17 00:00:00 2001
From: Dave Pisek <dpisek@gitlab.com>
Date: Mon, 26 Aug 2019 16:49:15 +1000
Subject: Update documentation for security dashboard

This commit updates a screenshot and the description
of the documentation of the group security dashboard to it is in
sync with the latest version of the dashboard.
---
 .../security_dashboard/img/group_security_dashboard.png | Bin 68332 -> 0 bytes
 .../img/group_security_dashboard_v12_3.png              | Bin 0 -> 60530 bytes
 .../application_security/security_dashboard/index.md    |  14 +++++++-------
 3 files changed, 7 insertions(+), 7 deletions(-)
 delete mode 100644 doc/user/application_security/security_dashboard/img/group_security_dashboard.png
 create mode 100644 doc/user/application_security/security_dashboard/img/group_security_dashboard_v12_3.png

diff --git a/doc/user/application_security/security_dashboard/img/group_security_dashboard.png b/doc/user/application_security/security_dashboard/img/group_security_dashboard.png
deleted file mode 100644
index 85ab124f74c..00000000000
Binary files a/doc/user/application_security/security_dashboard/img/group_security_dashboard.png and /dev/null differ
diff --git a/doc/user/application_security/security_dashboard/img/group_security_dashboard_v12_3.png b/doc/user/application_security/security_dashboard/img/group_security_dashboard_v12_3.png
new file mode 100644
index 00000000000..61f683c1335
Binary files /dev/null and b/doc/user/application_security/security_dashboard/img/group_security_dashboard_v12_3.png differ
diff --git a/doc/user/application_security/security_dashboard/index.md b/doc/user/application_security/security_dashboard/index.md
index 3d7f264c295..e7cda35eb98 100644
--- a/doc/user/application_security/security_dashboard/index.md
+++ b/doc/user/application_security/security_dashboard/index.md
@@ -65,16 +65,11 @@ Once you're on the dashboard, at the top you should see a series of filters for:
 NOTE: **Note:**
 The dashboard only shows projects with [security reports](#supported-reports) enabled in a group.
 
-![dashboard with action buttons and metrics](img/group_security_dashboard.png)
+![dashboard with action buttons and metrics](img/group_security_dashboard_v12_3.png)
 
 Selecting one or more filters will filter the results in this page.
-The first section is an overview of all the vulnerabilities, grouped by severity.
-Underneath this overview is a timeline chart that shows how many open
-vulnerabilities your projects had at various points in time. You can filter among 30, 60, and
-90 days, with the default being 90. Hover over the chart to get more details about
-the open vulnerabilities at a specific time.
 
-Finally, there is a list of all the vulnerabilities in the group, sorted by severity.
+The main section is a list of all the vulnerabilities in the group, sorted by severity.
 In that list, you can see the severity of the vulnerability, its name, its
 confidence (likelihood of the vulnerability to be a positive one), and the project
 it's from.
@@ -85,6 +80,11 @@ If you hover over a row, there will appear some actions you can take:
 - "Create issue"
 - "Dismiss vulnerability"
 
+Next to the list is a timeline chart that shows how many open
+vulnerabilities your projects had at various points in time. You can filter among 30, 60, and
+90 days, with the default being 90. Hover over the chart to get more details about
+the open vulnerabilities at a specific time.
+
 Read more on how to [interact with the vulnerabilities](../index.md#interacting-with-the-vulnerabilities).
 
 ## Keeping the dashboards up to date
-- 
cgit v1.2.1


From 0f59d73ef2f65aba791b6738a5e705fe1a8da789 Mon Sep 17 00:00:00 2001
From: Felipe Artur <fcardozo@gitlab.com>
Date: Fri, 30 Aug 2019 11:28:20 +0000
Subject: Rename epic column state to state_id

Rename epic column state to state_id to be consistent with
issues and merge requests
---
 changelogs/unreleased/issue_10770.yml                   |  5 +++++
 .../20190822175441_rename_epics_state_to_state_id.rb    | 17 +++++++++++++++++
 .../20190822185441_cleanup_epics_state_id_rename.rb     | 17 +++++++++++++++++
 db/schema.rb                                            |  2 +-
 spec/db/schema_spec.rb                                  |  2 +-
 5 files changed, 41 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/issue_10770.yml
 create mode 100644 db/migrate/20190822175441_rename_epics_state_to_state_id.rb
 create mode 100644 db/post_migrate/20190822185441_cleanup_epics_state_id_rename.rb

diff --git a/changelogs/unreleased/issue_10770.yml b/changelogs/unreleased/issue_10770.yml
new file mode 100644
index 00000000000..728160b24ad
--- /dev/null
+++ b/changelogs/unreleased/issue_10770.yml
@@ -0,0 +1,5 @@
+---
+title: Rename epic column state to state_id
+merge_request: 32270
+author:
+type: changed
diff --git a/db/migrate/20190822175441_rename_epics_state_to_state_id.rb b/db/migrate/20190822175441_rename_epics_state_to_state_id.rb
new file mode 100644
index 00000000000..7f40d164a8e
--- /dev/null
+++ b/db/migrate/20190822175441_rename_epics_state_to_state_id.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class RenameEpicsStateToStateId < ActiveRecord::Migration[5.2]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    rename_column_concurrently :epics, :state, :state_id
+  end
+
+  def down
+    cleanup_concurrent_column_rename :epics, :state_id, :state
+  end
+end
diff --git a/db/post_migrate/20190822185441_cleanup_epics_state_id_rename.rb b/db/post_migrate/20190822185441_cleanup_epics_state_id_rename.rb
new file mode 100644
index 00000000000..471b2ab9ca2
--- /dev/null
+++ b/db/post_migrate/20190822185441_cleanup_epics_state_id_rename.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class CleanupEpicsStateIdRename < ActiveRecord::Migration[5.2]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    cleanup_concurrent_column_rename :epics, :state, :state_id
+  end
+
+  def down
+    rename_column_concurrently :epics, :state_id, :state
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index f1dbe5c322c..5999a859e77 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1286,11 +1286,11 @@ ActiveRecord::Schema.define(version: 2019_08_28_083843) do
     t.date "due_date_fixed"
     t.boolean "start_date_is_fixed"
     t.boolean "due_date_is_fixed"
-    t.integer "state", limit: 2, default: 1, null: false
     t.integer "closed_by_id"
     t.datetime "closed_at"
     t.integer "parent_id"
     t.integer "relative_position"
+    t.integer "state_id", limit: 2, default: 1, null: false
     t.index ["assignee_id"], name: "index_epics_on_assignee_id"
     t.index ["author_id"], name: "index_epics_on_author_id"
     t.index ["closed_by_id"], name: "index_epics_on_closed_by_id"
diff --git a/spec/db/schema_spec.rb b/spec/db/schema_spec.rb
index 232890b1bba..52af470efac 100644
--- a/spec/db/schema_spec.rb
+++ b/spec/db/schema_spec.rb
@@ -30,7 +30,7 @@ describe 'Database schema' do
     draft_notes: %w[discussion_id commit_id],
     emails: %w[user_id],
     events: %w[target_id],
-    epics: %w[updated_by_id last_edited_by_id start_date_sourcing_milestone_id due_date_sourcing_milestone_id],
+    epics: %w[updated_by_id last_edited_by_id start_date_sourcing_milestone_id due_date_sourcing_milestone_id state_id],
     forked_project_links: %w[forked_from_project_id],
     geo_event_log: %w[hashed_storage_attachments_event_id],
     geo_job_artifact_deleted_events: %w[job_artifact_id],
-- 
cgit v1.2.1


From f246db4446466de58ba8618fb77bea63ca976551 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Tue, 27 Aug 2019 10:51:28 +0700
Subject: Fix deployable nil exception on job controller

When deployable is nil, we gracefully take care of the case.
---
 app/serializers/deployment_entity.rb                             | 2 +-
 .../fix-nil-deployable-exception-on-job-controller-show.yml      | 5 +++++
 spec/features/projects/jobs_spec.rb                              | 8 ++++++++
 spec/serializers/deployment_entity_spec.rb                       | 9 +++++++++
 4 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/fix-nil-deployable-exception-on-job-controller-show.yml

diff --git a/app/serializers/deployment_entity.rb b/app/serializers/deployment_entity.rb
index 8b967459173..94a827658f0 100644
--- a/app/serializers/deployment_entity.rb
+++ b/app/serializers/deployment_entity.rb
@@ -23,7 +23,7 @@ class DeploymentEntity < Grape::Entity
   expose :last?
   expose :deployed_by, as: :user, using: UserEntity
 
-  expose :deployable do |deployment, opts|
+  expose :deployable, if: -> (deployment) { deployment.deployable.present? } do |deployment, opts|
     deployment.deployable.yield_self do |deployable|
       if include_details?
         JobEntity.represent(deployable, opts)
diff --git a/changelogs/unreleased/fix-nil-deployable-exception-on-job-controller-show.yml b/changelogs/unreleased/fix-nil-deployable-exception-on-job-controller-show.yml
new file mode 100644
index 00000000000..b79317e3ab7
--- /dev/null
+++ b/changelogs/unreleased/fix-nil-deployable-exception-on-job-controller-show.yml
@@ -0,0 +1,5 @@
+---
+title: Fix users cannot access job detail page when deployable does not exist
+merge_request: 32247
+author:
+type: fixed
diff --git a/spec/features/projects/jobs_spec.rb b/spec/features/projects/jobs_spec.rb
index 8ed420300af..eb52df2ff79 100644
--- a/spec/features/projects/jobs_spec.rb
+++ b/spec/features/projects/jobs_spec.rb
@@ -609,6 +609,14 @@ describe 'Jobs', :clean_gitlab_redis_shared_state do
           expect(find('.js-environment-link')['href']).to match("environments/#{environment.id}")
           expect(find('.js-job-deployment-link')['href']).to include(second_deployment.deployable.project.path, second_deployment.deployable_id.to_s)
         end
+
+        context 'when deployment does not have a deployable' do
+          let!(:second_deployment) { create(:deployment, :success, environment: environment, deployable: nil) }
+
+          it 'has an empty href' do
+            expect(find('.js-job-deployment-link')['href']).to be_empty
+          end
+        end
       end
 
       context 'job failed to deploy' do
diff --git a/spec/serializers/deployment_entity_spec.rb b/spec/serializers/deployment_entity_spec.rb
index 1b19eac9a97..79f89dc1a9c 100644
--- a/spec/serializers/deployment_entity_spec.rb
+++ b/spec/serializers/deployment_entity_spec.rb
@@ -36,6 +36,15 @@ describe DeploymentEntity do
     expect(subject).to include(:deployed_at)
   end
 
+  context 'when deployable is nil' do
+    let(:entity) { described_class.new(deployment, request: request, deployment_details: false) }
+    let(:deployment) { create(:deployment, deployable: nil, project: project) }
+
+    it 'does not expose deployable entry' do
+      expect(subject).not_to include(:deployable)
+    end
+  end
+
   context 'when the pipeline has another manual action' do
     let(:other_build) { create(:ci_build, :manual, name: 'another deploy', pipeline: pipeline) }
     let!(:other_deployment) { create(:deployment, deployable: other_build) }
-- 
cgit v1.2.1


From 5142bd738e7de37991ab8c43a3096ef232363110 Mon Sep 17 00:00:00 2001
From: James Fargher <proglottis@gmail.com>
Date: Fri, 30 Aug 2019 11:47:13 +0000
Subject: Install cert-manager v0.9.1

This does not support upgrading from earlier versions
---
 app/models/clusters/applications/cert_manager.rb   | 33 +++++++++++++++++++---
 changelogs/unreleased/cert_manager_v0_9.yml        |  5 ++++
 .../clusters/applications/cert_manager_spec.rb     | 27 +++++++++++++-----
 3 files changed, 54 insertions(+), 11 deletions(-)
 create mode 100644 changelogs/unreleased/cert_manager_v0_9.yml

diff --git a/app/models/clusters/applications/cert_manager.rb b/app/models/clusters/applications/cert_manager.rb
index 6bd7473c8ff..27d4180e5b9 100644
--- a/app/models/clusters/applications/cert_manager.rb
+++ b/app/models/clusters/applications/cert_manager.rb
@@ -3,7 +3,8 @@
 module Clusters
   module Applications
     class CertManager < ApplicationRecord
-      VERSION = 'v0.5.2'.freeze
+      VERSION = 'v0.9.1'
+      CRD_VERSION = '0.9'
 
       self.table_name = 'clusters_applications_cert_managers'
 
@@ -21,16 +22,22 @@ module Clusters
       validates :email, presence: true
 
       def chart
-        'stable/cert-manager'
+        'certmanager/cert-manager'
+      end
+
+      def repository
+        'https://charts.jetstack.io'
       end
 
       def install_command
         Gitlab::Kubernetes::Helm::InstallCommand.new(
           name: 'certmanager',
+          repository: repository,
           version: VERSION,
           rbac: cluster.platform_kubernetes_rbac?,
           chart: chart,
           files: files.merge(cluster_issuer_file),
+          preinstall: pre_install_script,
           postinstall: post_install_script
         )
       end
@@ -46,16 +53,30 @@ module Clusters
 
       private
 
+      def pre_install_script
+        [
+          apply_file("https://raw.githubusercontent.com/jetstack/cert-manager/release-#{CRD_VERSION}/deploy/manifests/00-crds.yaml"),
+          "kubectl label --overwrite namespace #{Gitlab::Kubernetes::Helm::NAMESPACE} certmanager.k8s.io/disable-validation=true"
+        ]
+      end
+
       def post_install_script
-        ["kubectl create -f /data/helm/certmanager/config/cluster_issuer.yaml"]
+        [retry_command(apply_file('/data/helm/certmanager/config/cluster_issuer.yaml'))]
+      end
+
+      def retry_command(command)
+        "for i in $(seq 1 30); do #{command} && break; sleep 1s; echo \"Retrying ($i)...\"; done"
       end
 
       def post_delete_script
         [
           delete_private_key,
           delete_crd('certificates.certmanager.k8s.io'),
+          delete_crd('certificaterequests.certmanager.k8s.io'),
+          delete_crd('challenges.certmanager.k8s.io'),
           delete_crd('clusterissuers.certmanager.k8s.io'),
-          delete_crd('issuers.certmanager.k8s.io')
+          delete_crd('issuers.certmanager.k8s.io'),
+          delete_crd('orders.certmanager.k8s.io')
         ].compact
       end
 
@@ -75,6 +96,10 @@ module Clusters
         Gitlab::Kubernetes::KubectlCmd.delete("crd", definition, "--ignore-not-found")
       end
 
+      def apply_file(filename)
+        Gitlab::Kubernetes::KubectlCmd.apply_file(filename)
+      end
+
       def cluster_issuer_file
         {
           'cluster_issuer.yaml': cluster_issuer_yaml_content
diff --git a/changelogs/unreleased/cert_manager_v0_9.yml b/changelogs/unreleased/cert_manager_v0_9.yml
new file mode 100644
index 00000000000..bda5bbffab5
--- /dev/null
+++ b/changelogs/unreleased/cert_manager_v0_9.yml
@@ -0,0 +1,5 @@
+---
+title: Install cert-manager v0.9.1
+merge_request: 32243
+author:
+type: changed
diff --git a/spec/models/clusters/applications/cert_manager_spec.rb b/spec/models/clusters/applications/cert_manager_spec.rb
index 93050e80b07..f6d5d05e4a0 100644
--- a/spec/models/clusters/applications/cert_manager_spec.rb
+++ b/spec/models/clusters/applications/cert_manager_spec.rb
@@ -44,11 +44,18 @@ describe Clusters::Applications::CertManager do
 
     it 'is initialized with cert_manager arguments' do
       expect(subject.name).to eq('certmanager')
-      expect(subject.chart).to eq('stable/cert-manager')
-      expect(subject.version).to eq('v0.5.2')
+      expect(subject.chart).to eq('certmanager/cert-manager')
+      expect(subject.repository).to eq('https://charts.jetstack.io')
+      expect(subject.version).to eq('v0.9.1')
       expect(subject).to be_rbac
       expect(subject.files).to eq(cert_manager.files.merge(cluster_issuer_file))
-      expect(subject.postinstall).to eq(['kubectl create -f /data/helm/certmanager/config/cluster_issuer.yaml'])
+      expect(subject.preinstall).to eq([
+        'kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml',
+        'kubectl label --overwrite namespace gitlab-managed-apps certmanager.k8s.io/disable-validation=true'
+      ])
+      expect(subject.postinstall).to eq([
+        'for i in $(seq 1 30); do kubectl apply -f /data/helm/certmanager/config/cluster_issuer.yaml && break; sleep 1s; echo "Retrying ($i)..."; done'
+      ])
     end
 
     context 'for a specific user' do
@@ -75,7 +82,7 @@ describe Clusters::Applications::CertManager do
       let(:cert_manager) { create(:clusters_applications_cert_manager, :errored, version: '0.0.1') }
 
       it 'is initialized with the locked version' do
-        expect(subject.version).to eq('v0.5.2')
+        expect(subject.version).to eq('v0.9.1')
       end
     end
   end
@@ -93,10 +100,13 @@ describe Clusters::Applications::CertManager do
 
     it 'specifies a post delete command to remove custom resource definitions' do
       expect(subject.postdelete).to eq([
-        "kubectl delete secret -n gitlab-managed-apps letsencrypt-prod --ignore-not-found",
+        'kubectl delete secret -n gitlab-managed-apps letsencrypt-prod --ignore-not-found',
         'kubectl delete crd certificates.certmanager.k8s.io --ignore-not-found',
+        'kubectl delete crd certificaterequests.certmanager.k8s.io --ignore-not-found',
+        'kubectl delete crd challenges.certmanager.k8s.io --ignore-not-found',
         'kubectl delete crd clusterissuers.certmanager.k8s.io --ignore-not-found',
-        'kubectl delete crd issuers.certmanager.k8s.io --ignore-not-found'
+        'kubectl delete crd issuers.certmanager.k8s.io --ignore-not-found',
+        'kubectl delete crd orders.certmanager.k8s.io --ignore-not-found'
       ])
     end
 
@@ -111,8 +121,11 @@ describe Clusters::Applications::CertManager do
       it 'does not try and delete the secret' do
         expect(subject.postdelete).to eq([
           'kubectl delete crd certificates.certmanager.k8s.io --ignore-not-found',
+          'kubectl delete crd certificaterequests.certmanager.k8s.io --ignore-not-found',
+          'kubectl delete crd challenges.certmanager.k8s.io --ignore-not-found',
           'kubectl delete crd clusterissuers.certmanager.k8s.io --ignore-not-found',
-          'kubectl delete crd issuers.certmanager.k8s.io --ignore-not-found'
+          'kubectl delete crd issuers.certmanager.k8s.io --ignore-not-found',
+          'kubectl delete crd orders.certmanager.k8s.io --ignore-not-found'
         ])
       end
     end
-- 
cgit v1.2.1


From cc518f4f938503811682fbb82fc95cd0980d8d78 Mon Sep 17 00:00:00 2001
From: Tristan Read <tread@gitlab.com>
Date: Fri, 30 Aug 2019 11:52:00 +0000
Subject: Remove changelog file again

https://gitlab.com/gitlab-org/gitlab-ce/issues/66684
---
 .../integrations/img/grafana_live_embed.png        | Bin 0 -> 44603 bytes
 doc/user/project/integrations/prometheus.md        |  21 +++++++++++++++++++++
 2 files changed, 21 insertions(+)
 create mode 100644 doc/user/project/integrations/img/grafana_live_embed.png

diff --git a/doc/user/project/integrations/img/grafana_live_embed.png b/doc/user/project/integrations/img/grafana_live_embed.png
new file mode 100644
index 00000000000..91970cd379a
Binary files /dev/null and b/doc/user/project/integrations/img/grafana_live_embed.png differ
diff --git a/doc/user/project/integrations/prometheus.md b/doc/user/project/integrations/prometheus.md
index d13592559b9..3583c0554ee 100644
--- a/doc/user/project/integrations/prometheus.md
+++ b/doc/user/project/integrations/prometheus.md
@@ -393,6 +393,27 @@ The following requirements must be met for the metric to unfurl:
 
 ![Embedded Metrics](img/embed_metrics.png)
 
+### Embedding live Grafana charts
+
+It is also possible to embed live [Grafana](https://docs.gitlab.com/omnibus/settings/grafana.html) charts within issues, as a [Direct Linked Rendered Image](https://grafana.com/docs/reference/sharing/#direct-link-rendered-image).
+
+The sharing dialog within Grafana provides the link, as highlighted below.
+
+![Grafana Direct Linked Rendered Image](img/grafana_live_embed.png)
+
+NOTE: **Note:**
+For this embed to display correctly the Grafana instance must be available to the target user, either as a public dashboard or on the same network.
+
+Copy the link and add an image tag as [inline HTML](../../markdown.md#inline-html) in your markdown. You may tweak the query parameters as required. For instance, removing the `&from=` and `&to=` parameters will give you a live chart. Here is example markup for a live chart from GitLab's public dashboard:
+
+```html
+<img src="https://dashboards.gitlab.com/render/d-solo/RZmbBr7mk/gitlab-triage?orgId=1&refresh=30s&var-env=gprd&var-environment=gprd&var-prometheus=prometheus-01-inf-gprd&var-prometheus_app=prometheus-app-01-inf-gprd&var-backend=All&var-type=All&var-stage=main&panelId=1247&width=1000&height=300"/>
+```
+
+This will render like so:
+
+<img src="https://dashboards.gitlab.com/render/d-solo/RZmbBr7mk/gitlab-triage?orgId=1&refresh=30s&var-env=gprd&var-environment=gprd&var-prometheus=prometheus-01-inf-gprd&var-prometheus_app=prometheus-app-01-inf-gprd&var-backend=All&var-type=All&var-stage=main&panelId=1247&width=1000&height=300"/>
+
 ## Troubleshooting
 
 If the "No data found" screen continues to appear, it could be due to:
-- 
cgit v1.2.1


From 9d5b7b8d8b7cdafb2d8746c8876625e6833874a3 Mon Sep 17 00:00:00 2001
From: Markus Koller <mkoller@gitlab.com>
Date: Fri, 30 Aug 2019 11:58:03 +0000
Subject: Document ES web indexing

---
 doc/integration/elasticsearch.md | 299 +++++++++++++++++++++++----------------
 1 file changed, 176 insertions(+), 123 deletions(-)

diff --git a/doc/integration/elasticsearch.md b/doc/integration/elasticsearch.md
index de49508b47a..dc4aa9a5373 100644
--- a/doc/integration/elasticsearch.md
+++ b/doc/integration/elasticsearch.md
@@ -128,8 +128,10 @@ total are being tracked in [epic &153](https://gitlab.com/groups/gitlab-org/-/ep
 
 ## Enabling Elasticsearch
 
-In order to enable Elasticsearch, you need to have admin access. Go to
-**Admin > Settings > Integrations** and find the "Elasticsearch" section.
+In order to enable Elasticsearch, you need to have admin access. Navigate to
+**Admin Area** (wrench icon), then **Settings > Integrations** and expand the **Elasticsearch** section.
+
+Click **Save changes** for the changes to take effect.
 
 The following Elasticsearch settings are available:
 
@@ -171,171 +173,222 @@ from the Elasticsearch index as expected.
 
 To disable the Elasticsearch integration:
 
-1. Navigate to the **Admin > Settings > Integrations**
-1. Find the 'Elasticsearch' section and uncheck 'Search with Elasticsearch enabled'
-   and 'Elasticsearch indexing'
-1. Click **Save** for the changes to take effect
-1. (Optional) Delete the existing index by running the command `sudo gitlab-rake gitlab:elastic:delete_index`
+1. Navigate to the **Admin Area** (wrench icon), then **Settings > Integrations**.
+1. Expand the **Elasticsearch** section and uncheck **Elasticsearch indexing**
+   and **Search with Elasticsearch enabled**.
+1. Click **Save changes** for the changes to take effect.
+1. (Optional) Delete the existing index by running one of these commands:
+
+   ```sh
+   # Omnibus installations
+   sudo gitlab-rake gitlab:elastic:delete_index
+
+   # Installations from source
+   bundle exec rake gitlab:elastic:delete_index RAILS_ENV=production
+   ```
 
 ## Adding GitLab's data to the Elasticsearch index
 
-### Indexing small instances (database size less than 500 MiB, size of repos less than 5 GiB)
+While Elasticsearch indexing is enabled, new changes in your GitLab instance will be automatically indexed as they happen.
+To backfill existing data, you can use one of the methods below to index it in background jobs.
 
-Configure Elasticsearch's host and port in **Admin > Settings**. Then index the data using one of the following commands:
+### Indexing through the administration UI
 
-```sh
-# Omnibus installations
-sudo gitlab-rake gitlab:elastic:index
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/15390) in [GitLab Starter](https://about.gitlab.com/pricing/) 12.3.
 
-# Installations from source
-bundle exec rake gitlab:elastic:index RAILS_ENV=production
-```
+To index via the admin area:
+
+1. Navigate to the **Admin Area** (wrench icon), then **Settings > Integrations** and expand the **Elasticsearch** section.
+1. [Enable **Elasticsearch indexing** and configure your host and port](#enabling-elasticsearch).
+1. Create empty indexes using one of the following commands:
+
+   ```sh
+   # Omnibus installations
+   sudo gitlab-rake gitlab:elastic:create_empty_index
+
+   # Installations from source
+   bundle exec rake gitlab:elastic:create_empty_index RAILS_ENV=production
+   ```
+
+1. Click **Index all projects**.
+1. Click **Check progress** in the confirmation message to see the status of the background jobs.
+1. Personal snippets need to be indexed manually by running one of these commands:
+
+   ```sh
+   # Omnibus installations
+   sudo gitlab-rake gitlab:elastic:index_snippets
+
+   # Installations from source
+   bundle exec rake gitlab:elastic:index_snippets RAILS_ENV=production
+   ```
+
+1. After the indexing has completed, enable [**Search with Elasticsearch**](#enabling-elasticsearch).
+
+### Indexing through Rake tasks
+
+#### Indexing small instances
+
+CAUTION: **Warning**:
+This will delete your existing indexes.
+
+If the database size is less than 500 MiB, and the size of all hosted repos is less than 5 GiB:
+
+1. [Enable **Elasticsearch indexing** and configure your host and port](#enabling-elasticsearch).
+1. Index your data using one of the following commands:
+
+   ```sh
+   # Omnibus installations
+   sudo gitlab-rake gitlab:elastic:index
+
+   # Installations from source
+   bundle exec rake gitlab:elastic:index RAILS_ENV=production
+   ```
 
-After it completes the indexing process, [enable Elasticsearch searching](elasticsearch.md#enabling-elasticsearch).
+1. After the indexing has completed, enable [**Search with Elasticsearch**](#enabling-elasticsearch).
 
-### Indexing large instances
+#### Indexing large instances
 
-WARNING: **Warning**:
-Performing asynchronous indexing, as this will describe, will generate a lot of sidekiq jobs.
+CAUTION: **Warning**:
+Performing asynchronous indexing will generate a lot of Sidekiq jobs.
 Make sure to prepare for this task by either [Horizontally Scaling](../administration/high_availability/README.md#basic-scaling)
-or creating [extra sidekiq processes](../administration/operations/extra_sidekiq_processes.md)
+or creating [extra Sidekiq processes](../administration/operations/extra_sidekiq_processes.md)
 
-Configure Elasticsearch's host and port in **Admin > Settings > Integrations**. Then create empty indexes using one of the following commands:
+1. [Enable **Elasticsearch indexing** and configure your host and port](#enabling-elasticsearch).
+1. Create empty indexes using one of the following commands:
 
-```sh
-# Omnibus installations
-sudo gitlab-rake gitlab:elastic:create_empty_index
+   ```sh
+   # Omnibus installations
+   sudo gitlab-rake gitlab:elastic:create_empty_index
 
-# Installations from source
-bundle exec rake gitlab:elastic:create_empty_index RAILS_ENV=production
-```
+   # Installations from source
+   bundle exec rake gitlab:elastic:create_empty_index RAILS_ENV=production
+   ```
 
-Indexing large Git repositories can take a while. To speed up the process, you
-can temporarily disable auto-refreshing and replicating. In our experience, you can expect a 20%
-decrease in indexing time. We'll enable them when indexing is done. This step is optional!
+1. Indexing large Git repositories can take a while. To speed up the process, you
+   can temporarily disable auto-refreshing and replicating. In our experience, you can expect a 20%
+   decrease in indexing time. We'll enable them when indexing is done. This step is optional!
 
-```bash
-curl --request PUT localhost:9200/gitlab-production/_settings --data '{
-    "index" : {
-        "refresh_interval" : "-1",
-        "number_of_replicas" : 0
-    } }'
-```
+   ```bash
+   curl --request PUT localhost:9200/gitlab-production/_settings --data '{
+       "index" : {
+           "refresh_interval" : "-1",
+           "number_of_replicas" : 0
+       } }'
+   ```
 
-Then enable Elasticsearch indexing and run project indexing tasks:
+1. Index projects and their associated data:
 
-```sh
-# Omnibus installations
-sudo gitlab-rake gitlab:elastic:index_projects
+   ```sh
+   # Omnibus installations
+   sudo gitlab-rake gitlab:elastic:index_projects
 
-# Installations from source
-bundle exec rake gitlab:elastic:index_projects RAILS_ENV=production
-```
+   # Installations from source
+   bundle exec rake gitlab:elastic:index_projects RAILS_ENV=production
+   ```
 
-This enqueues a Sidekiq job for each project that needs to be indexed.
-You can view the jobs in the admin panel (they are placed in the `elastic_indexer`
-queue), or you can query indexing status using a rake task:
+   This enqueues a Sidekiq job for each project that needs to be indexed.
+   You can view the jobs in **Admin Area > Monitoring > Background Jobs > Queues Tab**
+   and click `elastic_indexer`, or you can query indexing status using a rake task:
 
-```sh
-# Omnibus installations
-sudo gitlab-rake gitlab:elastic:index_projects_status
+   ```sh
+   # Omnibus installations
+   sudo gitlab-rake gitlab:elastic:index_projects_status
 
-# Installations from source
-bundle exec rake gitlab:elastic:index_projects_status RAILS_ENV=production
+   # Installations from source
+   bundle exec rake gitlab:elastic:index_projects_status RAILS_ENV=production
 
-Indexing is 65.55% complete (6555/10000 projects)
-```
+   Indexing is 65.55% complete (6555/10000 projects)
+   ```
 
-If you want to limit the index to a range of projects you can provide the
-`ID_FROM` and `ID_TO` parameters:
+   If you want to limit the index to a range of projects you can provide the
+   `ID_FROM` and `ID_TO` parameters:
 
-```sh
-# Omnibus installations
-sudo gitlab-rake gitlab:elastic:index_projects ID_FROM=1001 ID_TO=2000
+   ```sh
+   # Omnibus installations
+   sudo gitlab-rake gitlab:elastic:index_projects ID_FROM=1001 ID_TO=2000
 
-# Installations from source
-bundle exec rake gitlab:elastic:index_projects ID_FROM=1001 ID_TO=2000 RAILS_ENV=production
-```
+   # Installations from source
+   bundle exec rake gitlab:elastic:index_projects ID_FROM=1001 ID_TO=2000 RAILS_ENV=production
+   ```
 
-Where `ID_FROM` and `ID_TO` are project IDs. Both parameters are optional.
-The above examples will index all projects starting with ID `1001` up to (and including) ID `2000`.
+   Where `ID_FROM` and `ID_TO` are project IDs. Both parameters are optional.
+   The above example will index all projects from ID `1001` up to (and including) ID `2000`.
 
-TIP: **Troubleshooting:**
-Sometimes the project indexing jobs queued by `gitlab:elastic:index_projects`
-can get interrupted. This may happen for many reasons, but it's always safe
-to run the indexing task again - it will skip those repositories that have
-already been indexed.
+   TIP: **Troubleshooting:**
+   Sometimes the project indexing jobs queued by `gitlab:elastic:index_projects`
+   can get interrupted. This may happen for many reasons, but it's always safe
+   to run the indexing task again. It will skip repositories that have
+   already been indexed.
 
-As the indexer stores the last commit SHA of every indexed repository in the
-database, you can run the indexer with the special parameter `UPDATE_INDEX` and
-it will check every project repository again to make sure that every commit in
-that repository is indexed, it can be useful in case if your index is outdated:
+   As the indexer stores the last commit SHA of every indexed repository in the
+   database, you can run the indexer with the special parameter `UPDATE_INDEX` and
+   it will check every project repository again to make sure that every commit in
+   a repository is indexed, which can be useful in case if your index is outdated:
 
-```sh
-# Omnibus installations
-sudo gitlab-rake gitlab:elastic:index_projects UPDATE_INDEX=true ID_TO=1000
+   ```sh
+   # Omnibus installations
+   sudo gitlab-rake gitlab:elastic:index_projects UPDATE_INDEX=true ID_TO=1000
 
-# Installations from source
-bundle exec rake gitlab:elastic:index_projects UPDATE_INDEX=true ID_TO=1000 RAILS_ENV=production
-```
+   # Installations from source
+   bundle exec rake gitlab:elastic:index_projects UPDATE_INDEX=true ID_TO=1000 RAILS_ENV=production
+   ```
 
-You can also use the `gitlab:elastic:clear_index_status` Rake task to force the
-indexer to "forget" all progress, so retrying the indexing process from the
-start.
+   You can also use the `gitlab:elastic:clear_index_status` Rake task to force the
+   indexer to "forget" all progress, so it will retry the indexing process from the
+   start.
 
-The `index_projects` command enqueues jobs to index all project and wiki
-repositories, and most database content. However, snippets still need to be
-indexed separately. To do so, run one of these commands:
+1. Personal snippets are not associated with a project and need to be indexed separately
+   by running one of these commands:
 
-```sh
-# Omnibus installations
-sudo gitlab-rake gitlab:elastic:index_snippets
+   ```sh
+   # Omnibus installations
+   sudo gitlab-rake gitlab:elastic:index_snippets
 
-# Installations from source
-bundle exec rake gitlab:elastic:index_snippets RAILS_ENV=production
-```
+   # Installations from source
+   bundle exec rake gitlab:elastic:index_snippets RAILS_ENV=production
+   ```
 
-Enable replication and refreshing again after indexing (only if you previously disabled it):
+1. Enable replication and refreshing again after indexing (only if you previously disabled it):
 
-```bash
-curl --request PUT localhost:9200/gitlab-production/_settings --data '{
-    "index" : {
-        "number_of_replicas" : 1,
-        "refresh_interval" : "1s"
-    } }'
-```
+   ```bash
+   curl --request PUT localhost:9200/gitlab-production/_settings --data '{
+       "index" : {
+           "number_of_replicas" : 1,
+           "refresh_interval" : "1s"
+       } }'
+   ```
 
-A force merge should be called after enabling the refreshing above.
+   A force merge should be called after enabling the refreshing above.
 
-For Elasticsearch 6.x, before proceeding with the force merge, the index should be in read-only mode:
+   For Elasticsearch 6.x, the index should be in read-only mode before proceeding with the force merge:
 
-```bash
-curl --request PUT localhost:9200/gitlab-production/_settings --data '{
-  "settings": {
-    "index.blocks.write": true
-  } }'
-```
+   ```bash
+   curl --request PUT localhost:9200/gitlab-production/_settings --data '{
+     "settings": {
+       "index.blocks.write": true
+     } }'
+   ```
 
-Then, initiate the force merge:
+   Then, initiate the force merge:
 
-```bash
-curl --request POST 'http://localhost:9200/gitlab-production/_forcemerge?max_num_segments=5'
-```
+   ```bash
+   curl --request POST 'http://localhost:9200/gitlab-production/_forcemerge?max_num_segments=5'
+   ```
 
-After this, if your index is in read-only, switch back to read-write:
+   After this, if your index is in read-only mode, switch back to read-write:
 
-```bash
-curl --request PUT localhost:9200/gitlab-production/_settings --data '{
-  "settings": {
-    "index.blocks.write": false
-  } }'
-```
+   ```bash
+   curl --request PUT localhost:9200/gitlab-production/_settings --data '{
+     "settings": {
+       "index.blocks.write": false
+     } }'
+   ```
 
-Enable Elasticsearch search in **Admin > Settings > Integrations**. That's it. Enjoy it!
+1. After the indexing has completed, enable [**Search with Elasticsearch**](#enabling-elasticsearch).
 
-### Index limit
+### Indexing limitations
 
-Currently for repository and snippet files, GitLab would only index up to 1 MB of content, in order to avoid indexing timeout.
+For repository and snippet files, GitLab will only index up to 1 MiB of content, in order to avoid indexing timeouts.
 
 ## GitLab Elasticsearch Rake Tasks
 
@@ -352,7 +405,7 @@ There are several rake tasks available to you via the command line:
 - [`sudo gitlab-rake gitlab:elastic:index_projects_status`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
   - This determines the overall status of the indexing. It is done by counting the total number of indexed projects, dividing by a count of the total number of projects, then multiplying by 100.
 - [`sudo gitlab-rake gitlab:elastic:create_empty_index`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
-  - This generates an empty index on the Elasticsearch side.
+  - This generates an empty index on the Elasticsearch side, deleting the existing one if present.
 - [`sudo gitlab-rake gitlab:elastic:clear_index_status`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
   - This deletes all instances of IndexStatus for all projects.
 - [`sudo gitlab-rake gitlab:elastic:delete_index`](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/lib/tasks/gitlab/elastic.rake)
@@ -468,7 +521,7 @@ Here are some common pitfalls and how to overcome them:
   pp s.search_objects.to_a
   ```
 
-  See [Elasticsearch Index Scopes](elasticsearch.md#elasticsearch-index-scopes) for more information on searching for specific types of data.
+  See [Elasticsearch Index Scopes](#elasticsearch-index-scopes) for more information on searching for specific types of data.
 
 - **I indexed all the repositories but then switched Elasticsearch servers and now I can't find anything**
 
-- 
cgit v1.2.1


From 18e5362e87ebcbc163a9f9ad1aff2fdadba89906 Mon Sep 17 00:00:00 2001
From: Andrew Newdigate <andrew@gitlab.com>
Date: Fri, 30 Aug 2019 14:04:45 +0000
Subject: Fix for histogram corruption in Sidekiq

This fixes a bug in which sidekiq histograms contain invalid labels.

See https://gitlab.com/gitlab-com/gl-infra/infrastructure/issues/7729
for more details.
---
 lib/gitlab/sidekiq_middleware/metrics.rb           | 2 +-
 spec/lib/gitlab/sidekiq_middleware/metrics_spec.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/gitlab/sidekiq_middleware/metrics.rb b/lib/gitlab/sidekiq_middleware/metrics.rb
index 3dc9521ee8b..368f37a5d8c 100644
--- a/lib/gitlab/sidekiq_middleware/metrics.rb
+++ b/lib/gitlab/sidekiq_middleware/metrics.rb
@@ -35,7 +35,7 @@ module Gitlab
 
       def init_metrics
         {
-          sidekiq_jobs_completion_seconds: ::Gitlab::Metrics.histogram(:sidekiq_jobs_completion_seconds, 'Seconds to complete sidekiq job', buckets: SIDEKIQ_LATENCY_BUCKETS),
+          sidekiq_jobs_completion_seconds: ::Gitlab::Metrics.histogram(:sidekiq_jobs_completion_seconds, 'Seconds to complete sidekiq job', {}, SIDEKIQ_LATENCY_BUCKETS),
           sidekiq_jobs_failed_total:       ::Gitlab::Metrics.counter(:sidekiq_jobs_failed_total, 'Sidekiq jobs failed'),
           sidekiq_jobs_retried_total:      ::Gitlab::Metrics.counter(:sidekiq_jobs_retried_total, 'Sidekiq jobs retried'),
           sidekiq_running_jobs:            ::Gitlab::Metrics.gauge(:sidekiq_running_jobs, 'Number of Sidekiq jobs running', {}, :livesum)
diff --git a/spec/lib/gitlab/sidekiq_middleware/metrics_spec.rb b/spec/lib/gitlab/sidekiq_middleware/metrics_spec.rb
index e430599bd94..ac97a5ebd15 100644
--- a/spec/lib/gitlab/sidekiq_middleware/metrics_spec.rb
+++ b/spec/lib/gitlab/sidekiq_middleware/metrics_spec.rb
@@ -13,7 +13,7 @@ describe Gitlab::SidekiqMiddleware::Metrics do
     let(:running_jobs_metric) { double('running jobs metric') }
 
     before do
-      allow(Gitlab::Metrics).to receive(:histogram).with(:sidekiq_jobs_completion_seconds, anything, anything).and_return(completion_seconds_metric)
+      allow(Gitlab::Metrics).to receive(:histogram).with(:sidekiq_jobs_completion_seconds, anything, anything, anything).and_return(completion_seconds_metric)
       allow(Gitlab::Metrics).to receive(:counter).with(:sidekiq_jobs_failed_total, anything).and_return(failed_total_metric)
       allow(Gitlab::Metrics).to receive(:counter).with(:sidekiq_jobs_retried_total, anything).and_return(retried_total_metric)
       allow(Gitlab::Metrics).to receive(:gauge).with(:sidekiq_running_jobs, anything, {}, :livesum).and_return(running_jobs_metric)
-- 
cgit v1.2.1


From 6c0d1534c1e0aab79342e9109647eb820e6d35c5 Mon Sep 17 00:00:00 2001
From: Walmyr Lima <walmyr@gitlab.com>
Date: Fri, 30 Aug 2019 16:47:58 +0200
Subject: Increase window size during e2e tests

---
 qa/qa/runtime/browser.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qa/qa/runtime/browser.rb b/qa/qa/runtime/browser.rb
index 2987bb1a213..197008ed8bf 100644
--- a/qa/qa/runtime/browser.rb
+++ b/qa/qa/runtime/browser.rb
@@ -68,7 +68,7 @@ module QA
           options = Selenium::WebDriver.const_get(QA::Runtime::Env.browser.capitalize)::Options.new
 
           if QA::Runtime::Env.browser == :chrome
-            options.add_argument("window-size=1240,1680")
+            options.add_argument("window-size=1480,2200")
 
             # Chrome won't work properly in a Docker container in sandbox mode
             options.add_argument("no-sandbox")
-- 
cgit v1.2.1


From 231b68a8818c4ed938ae471fd67eee0a6a196602 Mon Sep 17 00:00:00 2001
From: Gosia Ksionek <mksionek@gitlab.com>
Date: Fri, 30 Aug 2019 15:09:10 +0000
Subject: Update docs file

Add changelod

Remove changelog

Apply suggestion to doc/user/group/index.md
---
 doc/user/group/index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/user/group/index.md b/doc/user/group/index.md
index 403071f2513..43721c531e4 100644
--- a/doc/user/group/index.md
+++ b/doc/user/group/index.md
@@ -346,7 +346,7 @@ Add one or more whitelisted IP subnets using CIDR notation in comma separated fo
 coming from a different IP address won't be able to access the restricted
 content.
 
-Restriction currently applies to UI, API access is not restricted.
+Restriction currently applies to UI and API access, Git actions via ssh are not restricted.
 To avoid accidental lock-out, admins and group owners are are able to access
 the group regardless of the IP restriction.
 
-- 
cgit v1.2.1


From c7669395528bb01ed7d263e806ff74e5dec2fd97 Mon Sep 17 00:00:00 2001
From: Reuben Pereira <rpereira@gitlab.com>
Date: Fri, 30 Aug 2019 16:17:50 +0000
Subject: Add production fixture to create project

Since migrations are not run by new instances, add a production
fixture that should ensure that the self-monitoring project is created
for new instances as well.
---
 db/fixtures/development/98_gitlab_instance_administration_project.rb | 3 +++
 db/fixtures/production/998_gitlab_instance_administration_project.rb | 3 +++
 2 files changed, 6 insertions(+)
 create mode 100644 db/fixtures/development/98_gitlab_instance_administration_project.rb
 create mode 100644 db/fixtures/production/998_gitlab_instance_administration_project.rb

diff --git a/db/fixtures/development/98_gitlab_instance_administration_project.rb b/db/fixtures/development/98_gitlab_instance_administration_project.rb
new file mode 100644
index 00000000000..6cf3ae95cee
--- /dev/null
+++ b/db/fixtures/development/98_gitlab_instance_administration_project.rb
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+::Gitlab::DatabaseImporters::SelfMonitoring::Project::CreateService.new.execute!
diff --git a/db/fixtures/production/998_gitlab_instance_administration_project.rb b/db/fixtures/production/998_gitlab_instance_administration_project.rb
new file mode 100644
index 00000000000..6cf3ae95cee
--- /dev/null
+++ b/db/fixtures/production/998_gitlab_instance_administration_project.rb
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+::Gitlab::DatabaseImporters::SelfMonitoring::Project::CreateService.new.execute!
-- 
cgit v1.2.1


From 05a37f69e13250abe291b39f5a5f8926a717b5e6 Mon Sep 17 00:00:00 2001
From: Jesse Hall <jessehall3@gmail.com>
Date: Fri, 30 Aug 2019 17:26:10 +0000
Subject: Fix for #56295, https://gitlab.com/gitlab-org/gitlab-ce/issues/56295.
 All avatars now visible in commit trailers.

---
 app/helpers/avatars_helper.rb                      |  9 ++---
 ...some-avatars-not-visible-in-commit-trailers.yml |  5 +++
 lib/banzai/filter/commit_trailers_filter.rb        |  3 +-
 spec/helpers/avatars_helper_spec.rb                | 42 ++++++++++++++++++++++
 .../banzai/filter/commit_trailers_filter_spec.rb   | 21 +++++++++++
 5 files changed, 75 insertions(+), 5 deletions(-)
 create mode 100644 changelogs/unreleased/56295-some-avatars-not-visible-in-commit-trailers.yml

diff --git a/app/helpers/avatars_helper.rb b/app/helpers/avatars_helper.rb
index 81ff359556d..b7f7e617825 100644
--- a/app/helpers/avatars_helper.rb
+++ b/app/helpers/avatars_helper.rb
@@ -56,13 +56,13 @@ module AvatarsHelper
     }))
   end
 
-  def user_avatar_url_for(options = {})
+  def user_avatar_url_for(only_path: true, **options)
     if options[:url]
       options[:url]
     elsif options[:user]
-      avatar_icon_for_user(options[:user], options[:size])
+      avatar_icon_for_user(options[:user], options[:size], only_path: only_path)
     else
-      avatar_icon_for_email(options[:user_email], options[:size])
+      avatar_icon_for_email(options[:user_email], options[:size], only_path: only_path)
     end
   end
 
@@ -75,6 +75,7 @@ module AvatarsHelper
     has_tooltip = options[:has_tooltip].nil? ? true : options[:has_tooltip]
     data_attributes = options[:data] || {}
     css_class = %W[avatar s#{avatar_size}].push(*options[:css_class])
+    alt_text = user_name ? "#{user_name}'s avatar" : "default avatar"
 
     if has_tooltip
       css_class.push('has-tooltip')
@@ -88,7 +89,7 @@ module AvatarsHelper
     end
 
     image_options = {
-      alt:   "#{user_name}'s avatar",
+      alt:   alt_text,
       src:   avatar_url,
       data:  data_attributes,
       class: css_class,
diff --git a/changelogs/unreleased/56295-some-avatars-not-visible-in-commit-trailers.yml b/changelogs/unreleased/56295-some-avatars-not-visible-in-commit-trailers.yml
new file mode 100644
index 00000000000..23450c0fdc3
--- /dev/null
+++ b/changelogs/unreleased/56295-some-avatars-not-visible-in-commit-trailers.yml
@@ -0,0 +1,5 @@
+---
+title: Fix for missing avatar images dislpayed in commit trailers.
+merge_request: 32374
+author: Jesse Hall @jessehall3
+type: fixed
diff --git a/lib/banzai/filter/commit_trailers_filter.rb b/lib/banzai/filter/commit_trailers_filter.rb
index f49c4b403db..02a47556151 100644
--- a/lib/banzai/filter/commit_trailers_filter.rb
+++ b/lib/banzai/filter/commit_trailers_filter.rb
@@ -88,7 +88,8 @@ module Banzai
           user: user,
           user_email: email,
           css_class: 'avatar-inline',
-          has_tooltip: false
+          has_tooltip: false,
+          only_path: false
         )
 
         link_href = user.nil? ? "mailto:#{email}" : urls.user_url(user)
diff --git a/spec/helpers/avatars_helper_spec.rb b/spec/helpers/avatars_helper_spec.rb
index 94998d302f9..6fbb6147d84 100644
--- a/spec/helpers/avatars_helper_spec.rb
+++ b/spec/helpers/avatars_helper_spec.rb
@@ -324,5 +324,47 @@ describe AvatarsHelper do
         )
       end
     end
+
+    context 'with only_path parameter set to false' do
+      let(:user_with_avatar) { create(:user, :with_avatar, username: 'foobar') }
+
+      context 'with user parameter' do
+        let(:options) { { user: user_with_avatar, only_path: false } }
+
+        it 'will return avatar with a full path' do
+          is_expected.to eq tag(
+            :img,
+            alt: "#{user_with_avatar.name}'s avatar",
+            src: avatar_icon_for_user(user_with_avatar, 16, only_path: false),
+            data: { container: 'body' },
+            class: "avatar s16 has-tooltip",
+            title: user_with_avatar.name
+          )
+        end
+      end
+
+      context 'with user_name and user_email' do
+        let(:options) { { user_email: user_with_avatar.email, user_name: user_with_avatar.username, only_path: false } }
+
+        it 'will return avatar with a full path' do
+          is_expected.to eq tag(
+            :img,
+            alt: "#{user_with_avatar.username}'s avatar",
+            src: avatar_icon_for_email(user_with_avatar.email, 16, only_path: false),
+            data: { container: 'body' },
+            class: "avatar s16 has-tooltip",
+            title: user_with_avatar.username
+          )
+        end
+      end
+    end
+
+    context 'with unregistered email address' do
+      let(:options) { { user_email: "unregistered_email@example.com" } }
+
+      it 'will return default alt text for avatar' do
+        expect(subject).to include("default avatar")
+      end
+    end
   end
 end
diff --git a/spec/lib/banzai/filter/commit_trailers_filter_spec.rb b/spec/lib/banzai/filter/commit_trailers_filter_spec.rb
index bcb74be1034..192d00805e0 100644
--- a/spec/lib/banzai/filter/commit_trailers_filter_spec.rb
+++ b/spec/lib/banzai/filter/commit_trailers_filter_spec.rb
@@ -189,5 +189,26 @@ describe Banzai::Filter::CommitTrailersFilter do
       expect_to_have_user_link_with_avatar(doc, user: user, trailer: trailer)
       expect(doc.text).to include(commit_body)
     end
+
+    context 'with Gitlab-hosted avatars in commit trailers' do
+      # Because commit trailers are contained within markdown,
+      # any path-only link will automatically be prefixed
+      # with the path of its repository.
+      # See: "build_relative_path" in "lib/banzai/filter/relative_link_filter.rb"
+      let(:user_with_avatar) { create(:user, :with_avatar, username: 'foobar') }
+
+      it 'returns a full path for avatar urls' do
+        _, message_html = build_commit_message(
+          trailer: trailer,
+          name: user_with_avatar.name,
+          email: user_with_avatar.email
+        )
+
+        doc = filter(message_html)
+        expected = "#{Gitlab.config.gitlab.url}#{user_with_avatar.avatar_url}"
+
+        expect(doc.css('img')[0].attr('src')).to start_with expected
+      end
+    end
   end
 end
-- 
cgit v1.2.1


From 209a47b982b1bfe57608fb62a0dd32fdea08293f Mon Sep 17 00:00:00 2001
From: Matt Penna <mpenna@gitlab.com>
Date: Fri, 30 Aug 2019 17:52:46 +0000
Subject: Added expected site deployment wait time

---
 doc/user/project/pages/index.md | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/doc/user/project/pages/index.md b/doc/user/project/pages/index.md
index a0bc10b0ed7..a9fd6544e64 100644
--- a/doc/user/project/pages/index.md
+++ b/doc/user/project/pages/index.md
@@ -106,12 +106,14 @@ To get started with GitLab Pages, you can either:
 1. From the left sidebar, navigate to your project's **CI/CD > Pipelines**
    and click **Run pipeline** to trigger GitLab CI/CD to build and deploy your
    site to the server.
-1. Once the pipeline has finished successfully, find the link to visit your
-   website from your project's **Settings > Pages**.
+1. After the pipeline has finished successfully, wait approximately 30 minutes
+   for your website to be visible. After waiting 30 minutes, find the link to
+   visit your website from your project's **Settings > Pages**. If the link
+   leads to a 404 page, wait a few minutes and try again.
 
-Your website is then visible on your domain, and you can modify yourfiles
+Your website is then visible on your domain and you can modify your files
 as you wish. For every modification pushed to your repository, GitLab CI/CD
-will run a new pipeline to publish your changes to the server.
+will run a new pipeline to immediately publish your changes to the server.
 
 _Advanced options:_
 
-- 
cgit v1.2.1


From d93b985df07ccf07541efef709edb8467e0f2955 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Thu, 29 Aug 2019 16:10:49 -0700
Subject: Use self.ignored_columns += instead of =

This is to accomodate prepended modules.
---
 app/models/application_setting.rb         | 16 ++++++++--------
 app/models/ci/build.rb                    | 16 ++++++++--------
 app/models/deploy_key.rb                  |  2 +-
 app/models/note.rb                        |  2 +-
 app/models/notification_setting.rb        |  3 +--
 app/models/user.rb                        | 10 +++++-----
 doc/development/what_requires_downtime.md |  2 +-
 7 files changed, 25 insertions(+), 26 deletions(-)

diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb
index 8ff4cba2adb..46259abf1b6 100644
--- a/app/models/application_setting.rb
+++ b/app/models/application_setting.rb
@@ -24,14 +24,14 @@ class ApplicationSetting < ApplicationRecord
   serialize :domain_blacklist, Array # rubocop:disable Cop/ActiveRecordSerialize
   serialize :repository_storages # rubocop:disable Cop/ActiveRecordSerialize
 
-  self.ignored_columns = %i[
-                         clientside_sentry_dsn
-                         clientside_sentry_enabled
-                         koding_enabled
-                         koding_url
-                         sentry_dsn
-                         sentry_enabled
-                         ]
+  self.ignored_columns += %i[
+    clientside_sentry_dsn
+    clientside_sentry_enabled
+    koding_enabled
+    koding_url
+    sentry_dsn
+    sentry_enabled
+  ]
 
   cache_markdown_field :sign_in_text
   cache_markdown_field :help_page_text
diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index 6ff89666e53..79a2d5e6e9d 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -17,14 +17,14 @@ module Ci
 
     BuildArchivedError = Class.new(StandardError)
 
-    self.ignored_columns = %i[
-                           artifacts_file
-                           artifacts_file_store
-                           artifacts_metadata
-                           artifacts_metadata_store
-                           artifacts_size
-                           commands
-                           ]
+    self.ignored_columns += %i[
+      artifacts_file
+      artifacts_file_store
+      artifacts_metadata
+      artifacts_metadata_store
+      artifacts_size
+      commands
+    ]
 
     belongs_to :project, inverse_of: :builds
     belongs_to :runner
diff --git a/app/models/deploy_key.rb b/app/models/deploy_key.rb
index 06f8f31b8cc..22ab326a0ab 100644
--- a/app/models/deploy_key.rb
+++ b/app/models/deploy_key.rb
@@ -10,7 +10,7 @@ class DeployKey < Key
   scope :are_public,  -> { where(public: true) }
   scope :with_projects, -> { includes(deploy_keys_projects: { project: [:route, :namespace] }) }
 
-  self.ignored_columns = %i[can_push]
+  self.ignored_columns += %i[can_push]
 
   accepts_nested_attributes_for :deploy_keys_projects
 
diff --git a/app/models/note.rb b/app/models/note.rb
index c6ef91a27ad..2a0063c76b0 100644
--- a/app/models/note.rb
+++ b/app/models/note.rb
@@ -33,7 +33,7 @@ class Note < ApplicationRecord
     end
   end
 
-  self.ignored_columns = %i[original_discussion_id]
+  self.ignored_columns += %i[original_discussion_id]
 
   cache_markdown_field :note, pipeline: :note, issuable_state_filter_enabled: true
 
diff --git a/app/models/notification_setting.rb b/app/models/notification_setting.rb
index 9882f1dc8b3..637c017a342 100644
--- a/app/models/notification_setting.rb
+++ b/app/models/notification_setting.rb
@@ -1,8 +1,7 @@
 # frozen_string_literal: true
 
 class NotificationSetting < ApplicationRecord
-
-  self.ignored_columns = %i[events]
+  self.ignored_columns += %i[events]
 
   enum level: { global: 3, watch: 2, participating: 1, mention: 4, disabled: 0, custom: 5 }
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 79c89461806..cb222b87d88 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -23,11 +23,11 @@ class User < ApplicationRecord
 
   DEFAULT_NOTIFICATION_LEVEL = :participating
 
-  self.ignored_columns = %i[
-                         authentication_token
-                         email_provider
-                         external_email
-                         ]
+  self.ignored_columns += %i[
+    authentication_token
+    email_provider
+    external_email
+  ]
 
   add_authentication_token_field :incoming_email_token, token_generator: -> { SecureRandom.hex.to_i(16).to_s(36) }
   add_authentication_token_field :feed_token
diff --git a/doc/development/what_requires_downtime.md b/doc/development/what_requires_downtime.md
index b9d1b95a4d7..f4cee410066 100644
--- a/doc/development/what_requires_downtime.md
+++ b/doc/development/what_requires_downtime.md
@@ -50,7 +50,7 @@ places. This can be done by defining the columns to ignore. For example, to igno
 
 ```ruby
 class User < ApplicationRecord
-  self.ignored_columns = %i[updated_at]
+  self.ignored_columns += %i[updated_at]
 end
 ```
 
-- 
cgit v1.2.1


From b943baa42a5365bd6377022223f66db9af58da33 Mon Sep 17 00:00:00 2001
From: Manoj MJ <mmj@gitlab.com>
Date: Fri, 30 Aug 2019 21:30:51 +0000
Subject: Limit access request email to 10 most recently active
 owners/maintainers

This change limits the number of emails
for new access requests notifications to
10 most recently active owners/maintainers
---
 app/models/group.rb                                |   6 +
 app/models/project.rb                              |   6 +
 app/services/notification_service.rb               |  15 +-
 ...3-access-request-emails-limit-to-ten-owners.yml |   5 +
 doc/user/group/index.md                            |   7 +-
 doc/user/project/members/index.md                  |  11 +-
 spec/factories/group_members.rb                    |   4 +
 spec/factories/project_members.rb                  |   4 +
 spec/factories/users.rb                            |   8 ++
 spec/models/group_spec.rb                          |  19 +++
 spec/models/project_spec.rb                        |  20 +++
 spec/services/notification_service_spec.rb         | 152 ++++++++++++++++-----
 .../notification_service_shared_examples.rb        |  44 ++++++
 13 files changed, 258 insertions(+), 43 deletions(-)
 create mode 100644 changelogs/unreleased/28643-access-request-emails-limit-to-ten-owners.yml

diff --git a/app/models/group.rb b/app/models/group.rb
index 61a4802a6ee..abe93cf3c84 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -15,6 +15,8 @@ class Group < Namespace
   include WithUploads
   include Gitlab::Utils::StrongMemoize
 
+  ACCESS_REQUEST_APPROVERS_TO_BE_NOTIFIED_LIMIT = 10
+
   has_many :group_members, -> { where(requested_at: nil) }, dependent: :destroy, as: :source # rubocop:disable Cop/ActiveRecordDependent
   alias_method :members, :group_members
   has_many :users, through: :group_members
@@ -429,6 +431,10 @@ class Group < Namespace
     super || ::Gitlab::Access::OWNER_SUBGROUP_ACCESS
   end
 
+  def access_request_approvers_to_be_notified
+    members.owners.order_recent_sign_in.limit(ACCESS_REQUEST_APPROVERS_TO_BE_NOTIFIED_LIMIT)
+  end
+
   private
 
   def update_two_factor_requirement
diff --git a/app/models/project.rb b/app/models/project.rb
index 8f568a5b840..a6d203f1e72 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -55,6 +55,8 @@ class Project < ApplicationRecord
   VALID_MIRROR_PORTS = [22, 80, 443].freeze
   VALID_MIRROR_PROTOCOLS = %w(http https ssh git).freeze
 
+  ACCESS_REQUEST_APPROVERS_TO_BE_NOTIFIED_LIMIT = 10
+
   SORTING_PREFERENCE_FIELD = :projects_sort
 
   cache_markdown_field :description, pipeline: :description
@@ -2193,6 +2195,10 @@ class Project < ApplicationRecord
     pool_repository.present?
   end
 
+  def access_request_approvers_to_be_notified
+    members.maintainers.order_recent_sign_in.limit(ACCESS_REQUEST_APPROVERS_TO_BE_NOTIFIED_LIMIT)
+  end
+
   private
 
   def merge_requests_allowing_collaboration(source_branch = nil)
diff --git a/app/services/notification_service.rb b/app/services/notification_service.rb
index 83710ffce2f..5b8c1288854 100644
--- a/app/services/notification_service.rb
+++ b/app/services/notification_service.rb
@@ -293,11 +293,16 @@ class NotificationService
   def new_access_request(member)
     return true unless member.notifiable?(:subscription)
 
-    recipients = member.source.members.active_without_invites_and_requests.owners_and_maintainers
-    if fallback_to_group_owners_maintainers?(recipients, member)
-      recipients = member.source.group.members.active_without_invites_and_requests.owners_and_maintainers
+    source = member.source
+
+    recipients = source.access_request_approvers_to_be_notified
+
+    if fallback_to_group_access_request_approvers?(recipients, source)
+      recipients = source.group.access_request_approvers_to_be_notified
     end
 
+    return true if recipients.empty?
+
     recipients.each { |recipient| deliver_access_request_email(recipient, member) }
   end
 
@@ -611,9 +616,9 @@ class NotificationService
     mailer.member_access_requested_email(member.real_source_type, member.id, recipient.user.id).deliver_later
   end
 
-  def fallback_to_group_owners_maintainers?(recipients, member)
+  def fallback_to_group_access_request_approvers?(recipients, source)
     return false if recipients.present?
 
-    member.source.respond_to?(:group) && member.source.group
+    source.respond_to?(:group) && source.group
   end
 end
diff --git a/changelogs/unreleased/28643-access-request-emails-limit-to-ten-owners.yml b/changelogs/unreleased/28643-access-request-emails-limit-to-ten-owners.yml
new file mode 100644
index 00000000000..25e83eaf68e
--- /dev/null
+++ b/changelogs/unreleased/28643-access-request-emails-limit-to-ten-owners.yml
@@ -0,0 +1,5 @@
+---
+title: Limit access request emails to ten most recently active owners or maintainers
+merge_request: 32141
+author:
+type: changed
diff --git a/doc/user/group/index.md b/doc/user/group/index.md
index 43721c531e4..86fb7533e70 100644
--- a/doc/user/group/index.md
+++ b/doc/user/group/index.md
@@ -150,8 +150,11 @@ side of your screen.
 
 ![Request access button](img/request_access_button.png)
 
-Group owners and maintainers will be notified of your request and will be able to approve or
-decline it on the members page.
+Once access is requested:
+
+- Up to ten group owners are notified of your request via email.
+  Email is sent to the most recently active group owners.
+- Any group owner can approve or decline your request on the members page.
 
 ![Manage access requests](img/access_requests_management.png)
 
diff --git a/doc/user/project/members/index.md b/doc/user/project/members/index.md
index e343fd45488..21016dca358 100644
--- a/doc/user/project/members/index.md
+++ b/doc/user/project/members/index.md
@@ -79,8 +79,15 @@ side of your screen.
 
 ![Request access button](img/request_access_button.png)
 
-Project owners & maintainers will be notified of your request and will be able to approve or
-decline it on the members page.
+Once access is requested:
+
+- Up to ten project maintainers are notified of your request via email.
+  Email is sent to the most recently active project maintainers.
+- Any project maintainer can approve or decline your request on the members page.
+
+NOTE: **Note:**
+If a project does not have any maintainers, the notification is sent to the
+most recently active owners of the project's group.
 
 ![Manage access requests](img/access_requests_management.png)
 
diff --git a/spec/factories/group_members.rb b/spec/factories/group_members.rb
index 4c875935d82..a93f13395a2 100644
--- a/spec/factories/group_members.rb
+++ b/spec/factories/group_members.rb
@@ -24,5 +24,9 @@ FactoryBot.define do
     trait(:ldap) do
       ldap true
     end
+
+    trait :blocked do
+      after(:build) { |group_member, _| group_member.user.block! }
+    end
   end
 end
diff --git a/spec/factories/project_members.rb b/spec/factories/project_members.rb
index 6dcac0400ca..723fa6058fe 100644
--- a/spec/factories/project_members.rb
+++ b/spec/factories/project_members.rb
@@ -17,5 +17,9 @@ FactoryBot.define do
       invite_token 'xxx'
       invite_email 'email@email.com'
     end
+
+    trait :blocked do
+      after(:build) { |project_member, _| project_member.user.block! }
+    end
   end
 end
diff --git a/spec/factories/users.rb b/spec/factories/users.rb
index b2c8bdab013..57e58513529 100644
--- a/spec/factories/users.rb
+++ b/spec/factories/users.rb
@@ -39,6 +39,14 @@ FactoryBot.define do
       avatar { fixture_file_upload('spec/fixtures/dk.png') }
     end
 
+    trait :with_sign_ins do
+      sign_in_count 3
+      current_sign_in_at { Time.now }
+      last_sign_in_at { FFaker::Time.between(10.days.ago, 1.day.ago) }
+      current_sign_in_ip '127.0.0.1'
+      last_sign_in_ip '127.0.0.1'
+    end
+
     trait :two_factor_via_otp do
       before(:create) do |user|
         user.otp_required_for_login = true
diff --git a/spec/models/group_spec.rb b/spec/models/group_spec.rb
index 1c41ceb7deb..796b6917fb2 100644
--- a/spec/models/group_spec.rb
+++ b/spec/models/group_spec.rb
@@ -1039,4 +1039,23 @@ describe Group do
         .to eq(Gitlab::Access::MAINTAINER_SUBGROUP_ACCESS)
     end
   end
+
+  describe '#access_request_approvers_to_be_notified' do
+    it 'returns a maximum of ten, active, non_requested owners of the group in recent_sign_in descending order' do
+      group = create(:group, :public)
+
+      users = create_list(:user, 12, :with_sign_ins)
+      active_owners = users.map do |user|
+        create(:group_member, :owner, group: group, user: user)
+      end
+
+      create(:group_member, :owner, :blocked, group: group)
+      create(:group_member, :maintainer, group: group)
+      create(:group_member, :access_request, :owner, group: group)
+
+      active_owners_in_recent_sign_in_desc_order = group.members_and_requesters.where(id: active_owners).order_recent_sign_in.limit(10)
+
+      expect(group.access_request_approvers_to_be_notified).to eq(active_owners_in_recent_sign_in_desc_order)
+    end
+  end
 end
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index bd352db2236..bfbcac60fea 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -4991,6 +4991,26 @@ describe Project do
     end
   end
 
+  describe '#access_request_approvers_to_be_notified' do
+    it 'returns a maximum of ten, active, non_requested maintainers of the project in recent_sign_in descending order' do
+      group = create(:group, :public)
+      project = create(:project, group: group)
+
+      users = create_list(:user, 12, :with_sign_ins)
+      active_maintainers = users.map do |user|
+        create(:project_member, :maintainer, user: user)
+      end
+
+      create(:project_member, :maintainer, :blocked, project: project)
+      create(:project_member, :developer, project: project)
+      create(:project_member, :access_request, :maintainer, project: project)
+
+      active_maintainers_in_recent_sign_in_desc_order = project.members_and_requesters.where(id: active_maintainers).order_recent_sign_in.limit(10)
+
+      expect(project.access_request_approvers_to_be_notified).to eq(active_maintainers_in_recent_sign_in_desc_order)
+    end
+  end
+
   def rugged_config
     rugged_repo(project.repository).config
   end
diff --git a/spec/services/notification_service_spec.rb b/spec/services/notification_service_spec.rb
index d925aa2b6c3..ab0e01e27d7 100644
--- a/spec/services/notification_service_spec.rb
+++ b/spec/services/notification_service_spec.rb
@@ -1932,31 +1932,39 @@ describe NotificationService, :mailer do
     let(:added_user) { create(:user) }
 
     describe '#new_access_request' do
-      let(:maintainer) { create(:user) }
-      let(:owner) { create(:user) }
-      let(:developer) { create(:user) }
-      let!(:group) do
-        create(:group, :public, :access_requestable) do |group|
-          group.add_owner(owner)
-          group.add_maintainer(maintainer)
-          group.add_developer(developer)
+      context 'recipients' do
+        let(:maintainer) { create(:user) }
+        let(:owner) { create(:user) }
+        let(:developer) { create(:user) }
+
+        let!(:group) do
+          create(:group, :public, :access_requestable) do |group|
+            group.add_owner(owner)
+            group.add_maintainer(maintainer)
+            group.add_developer(developer)
+          end
         end
-      end
 
-      before do
-        reset_delivered_emails!
-      end
+        before do
+          reset_delivered_emails!
+        end
 
-      it 'sends notification to group owners_and_maintainers' do
-        group.request_access(added_user)
+        it 'sends notification only to group owners' do
+          group.request_access(added_user)
+
+          should_email(owner)
+          should_not_email(maintainer)
+          should_not_email(developer)
+        end
 
-        should_email(owner)
-        should_email(maintainer)
-        should_not_email(developer)
+        it_behaves_like 'group emails are disabled' do
+          let(:notification_target)  { group }
+          let(:notification_trigger) { group.request_access(added_user) }
+        end
       end
 
-      it_behaves_like 'group emails are disabled' do
-        let(:notification_target)  { group }
+      it_behaves_like 'sends notification only to a maximum of ten, most recently active group owners' do
+        let(:group) { create(:group, :public, :access_requestable) }
         let(:notification_trigger) { group.request_access(added_user) }
       end
     end
@@ -2012,20 +2020,36 @@ describe NotificationService, :mailer do
 
     describe '#new_access_request' do
       context 'for a project in a user namespace' do
-        let(:project) do
-          create(:project, :public, :access_requestable) do |project|
-            project.add_maintainer(project.owner)
+        context 'recipients' do
+          let(:developer) { create(:user) }
+          let(:maintainer) { create(:user) }
+
+          let!(:project) do
+            create(:project, :public, :access_requestable) do |project|
+              project.add_developer(developer)
+              project.add_maintainer(maintainer)
+            end
           end
-        end
 
-        it 'sends notification to project owners_and_maintainers' do
-          project.request_access(added_user)
+          before do
+            reset_delivered_emails!
+          end
+
+          it 'sends notification only to project maintainers' do
+            project.request_access(added_user)
+
+            should_email(maintainer)
+            should_not_email(developer)
+          end
 
-          should_only_email(project.owner)
+          it_behaves_like 'project emails are disabled' do
+            let(:notification_target)  { project }
+            let(:notification_trigger) { project.request_access(added_user) }
+          end
         end
 
-        it_behaves_like 'project emails are disabled' do
-          let(:notification_target)  { project }
+        it_behaves_like 'sends notification only to a maximum of ten, most recently active project maintainers' do
+          let(:project) { create(:project, :public, :access_requestable) }
           let(:notification_trigger) { project.request_access(added_user) }
         end
       end
@@ -2033,16 +2057,76 @@ describe NotificationService, :mailer do
       context 'for a project in a group' do
         let(:group_owner) { create(:user) }
         let(:group) { create(:group).tap { |g| g.add_owner(group_owner) } }
-        let!(:project) { create(:project, :public, :access_requestable, namespace: group) }
 
-        before do
-          reset_delivered_emails!
+        context 'when the project has no maintainers' do
+          context 'when the group has at least one owner' do
+            let!(:project) { create(:project, :public, :access_requestable, namespace: group) }
+
+            before do
+              reset_delivered_emails!
+            end
+
+            context 'recipients' do
+              it 'sends notifications to the group owners' do
+                project.request_access(added_user)
+
+                should_only_email(group_owner)
+              end
+            end
+
+            it_behaves_like 'sends notification only to a maximum of ten, most recently active group owners' do
+              let(:group) { create(:group, :public, :access_requestable) }
+              let(:notification_trigger) { project.request_access(added_user) }
+            end
+          end
+
+          context 'when the group does not have any owners' do
+            let(:group) { create(:group) }
+            let!(:project) { create(:project, :public, :access_requestable, namespace: group) }
+
+            context 'recipients' do
+              before do
+                reset_delivered_emails!
+              end
+
+              it 'does not send any notifications' do
+                project.request_access(added_user)
+
+                should_not_email_anyone
+              end
+            end
+          end
         end
 
-        it 'sends notification to group owners_and_maintainers' do
-          project.request_access(added_user)
+        context 'when the project has maintainers' do
+          let(:maintainer) { create(:user) }
+          let(:developer) { create(:user) }
+
+          let!(:project) do
+            create(:project, :public, :access_requestable, namespace: group) do |project|
+              project.add_maintainer(maintainer)
+              project.add_developer(developer)
+            end
+          end
+
+          before do
+            reset_delivered_emails!
+          end
+
+          context 'recipients' do
+            it 'sends notifications only to project maintainers' do
+              project.request_access(added_user)
 
-          should_only_email(group_owner)
+              should_email(maintainer)
+              should_not_email(developer)
+              should_not_email(group_owner)
+            end
+          end
+
+          it_behaves_like 'sends notification only to a maximum of ten, most recently active project maintainers' do
+            let(:project) { create(:project, :public, :access_requestable, namespace: group) }
+            let(:notification_trigger) { project.request_access(added_user) }
+          end
         end
       end
     end
diff --git a/spec/support/shared_examples/services/notification_service_shared_examples.rb b/spec/support/shared_examples/services/notification_service_shared_examples.rb
index dd338ea47c7..ad580b581d6 100644
--- a/spec/support/shared_examples/services/notification_service_shared_examples.rb
+++ b/spec/support/shared_examples/services/notification_service_shared_examples.rb
@@ -52,3 +52,47 @@ shared_examples 'group emails are disabled' do
     should_email_anyone
   end
 end
+
+shared_examples 'sends notification only to a maximum of ten, most recently active group owners' do
+  let(:owners) { create_list(:user, 12, :with_sign_ins) }
+
+  before do
+    owners.each do |owner|
+      group.add_owner(owner)
+    end
+
+    reset_delivered_emails!
+  end
+
+  context 'limit notification emails' do
+    it 'sends notification only to a maximum of ten, most recently active group owners' do
+      ten_most_recently_active_group_owners = owners.sort_by(&:last_sign_in_at).last(10)
+
+      notification_trigger
+
+      should_only_email(*ten_most_recently_active_group_owners)
+    end
+  end
+end
+
+shared_examples 'sends notification only to a maximum of ten, most recently active project maintainers' do
+  let(:maintainers) { create_list(:user, 12, :with_sign_ins) }
+
+  before do
+    maintainers.each do |maintainer|
+      project.add_maintainer(maintainer)
+    end
+
+    reset_delivered_emails!
+  end
+
+  context 'limit notification emails' do
+    it 'sends notification only to a maximum of ten, most recently active project maintainers' do
+      ten_most_recently_active_project_maintainers = maintainers.sort_by(&:last_sign_in_at).last(10)
+
+      notification_trigger
+
+      should_only_email(*ten_most_recently_active_project_maintainers)
+    end
+  end
+end
-- 
cgit v1.2.1


From 288e709cb729124b81344912db0a0f8ce9735a7d Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Fri, 30 Aug 2019 21:51:30 +0000
Subject: Creates Feature Flag for job log

Updates frontend code and specs to allow for the new
feature flag
---
 app/assets/javascripts/jobs/components/job_app.vue      |  6 ++++--
 app/assets/javascripts/jobs/components/job_log_json.vue | 10 ++++++++++
 app/controllers/projects/jobs_controller.rb             | 15 +++++++++++++++
 locale/gitlab.pot                                       |  3 +++
 spec/controllers/projects/jobs_controller_spec.rb       |  1 +
 spec/features/projects/jobs/user_browses_job_spec.rb    |  2 ++
 spec/features/projects/jobs_spec.rb                     |  1 +
 spec/features/security/project/internal_access_spec.rb  |  4 ++++
 spec/features/security/project/private_access_spec.rb   |  4 ++++
 spec/features/security/project/public_access_spec.rb    |  4 ++++
 10 files changed, 48 insertions(+), 2 deletions(-)
 create mode 100644 app/assets/javascripts/jobs/components/job_log_json.vue

diff --git a/app/assets/javascripts/jobs/components/job_app.vue b/app/assets/javascripts/jobs/components/job_app.vue
index 8da87f424c4..ad1072366f3 100644
--- a/app/assets/javascripts/jobs/components/job_app.vue
+++ b/app/assets/javascripts/jobs/components/job_app.vue
@@ -12,7 +12,6 @@ import createStore from '../store';
 import EmptyState from './empty_state.vue';
 import EnvironmentsBlock from './environments_block.vue';
 import ErasedBlock from './erased_block.vue';
-import Log from './job_log.vue';
 import LogTopBar from './job_log_controllers.vue';
 import StuckBlock from './stuck_block.vue';
 import UnmetPrerequisitesBlock from './unmet_prerequisites_block.vue';
@@ -30,7 +29,10 @@ export default {
     EnvironmentsBlock,
     ErasedBlock,
     Icon,
-    Log,
+    Log: () =>
+      gon && gon.features && gon.features.jobLogJson
+        ? import('./job_log_json.vue')
+        : import('./job_log.vue'),
     LogTopBar,
     StuckBlock,
     UnmetPrerequisitesBlock,
diff --git a/app/assets/javascripts/jobs/components/job_log_json.vue b/app/assets/javascripts/jobs/components/job_log_json.vue
new file mode 100644
index 00000000000..2198b20eb8f
--- /dev/null
+++ b/app/assets/javascripts/jobs/components/job_log_json.vue
@@ -0,0 +1,10 @@
+<script>
+export default {
+  name: 'JobLogJSON',
+};
+</script>
+<template>
+  <pre>
+    {{ __('This feature is in development. Please disable the `job_log_json` feature flag') }}
+  </pre>
+</template>
diff --git a/app/controllers/projects/jobs_controller.rb b/app/controllers/projects/jobs_controller.rb
index adbc0159358..06d7579aff4 100644
--- a/app/controllers/projects/jobs_controller.rb
+++ b/app/controllers/projects/jobs_controller.rb
@@ -11,6 +11,9 @@ class Projects::JobsController < Projects::ApplicationController
   before_action :authorize_erase_build!, only: [:erase]
   before_action :authorize_use_build_terminal!, only: [:terminal, :terminal_websocket_authorize]
   before_action :verify_api_request!, only: :terminal_websocket_authorize
+  before_action only: [:trace] do
+    push_frontend_feature_flag(:job_log_json)
+  end
 
   layout 'project'
 
@@ -64,6 +67,14 @@ class Projects::JobsController < Projects::ApplicationController
   # rubocop: enable CodeReuse/ActiveRecord
 
   def trace
+    if Feature.enabled?(:job_log_json, @project)
+      json_trace
+    else
+      html_trace
+    end
+  end
+
+  def html_trace
     build.trace.read do |stream|
       respond_to do |format|
         format.json do
@@ -84,6 +95,10 @@ class Projects::JobsController < Projects::ApplicationController
     end
   end
 
+  def json_trace
+    # will be implemented with https://gitlab.com/gitlab-org/gitlab-ce/issues/66454
+  end
+
   def retry
     return respond_422 unless @build.retryable?
 
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 401b46b78f1..7807d5db6e7 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -11760,6 +11760,9 @@ msgstr ""
 msgid "This domain is not verified. You will need to verify ownership before access is enabled."
 msgstr ""
 
+msgid "This feature is in development. Please disable the `job_log_json` feature flag"
+msgstr ""
+
 msgid "This feature requires local storage to be enabled"
 msgstr ""
 
diff --git a/spec/controllers/projects/jobs_controller_spec.rb b/spec/controllers/projects/jobs_controller_spec.rb
index f076a5e769f..bd3e66efd58 100644
--- a/spec/controllers/projects/jobs_controller_spec.rb
+++ b/spec/controllers/projects/jobs_controller_spec.rb
@@ -12,6 +12,7 @@ describe Projects::JobsController, :clean_gitlab_redis_shared_state do
 
   before do
     stub_feature_flags(ci_enable_live_trace: true)
+    stub_feature_flags(job_log_json: false)
     stub_not_protect_default_branch
   end
 
diff --git a/spec/features/projects/jobs/user_browses_job_spec.rb b/spec/features/projects/jobs/user_browses_job_spec.rb
index 1b277e17b0c..4d8a4812123 100644
--- a/spec/features/projects/jobs/user_browses_job_spec.rb
+++ b/spec/features/projects/jobs/user_browses_job_spec.rb
@@ -10,6 +10,8 @@ describe 'User browses a job', :js do
   let!(:build) { create(:ci_build, :success, :trace_artifact, :coverage, pipeline: pipeline) }
 
   before do
+    stub_feature_flags(job_log_json: false)
+
     project.add_maintainer(user)
     project.enable_ci
 
diff --git a/spec/features/projects/jobs_spec.rb b/spec/features/projects/jobs_spec.rb
index eb52df2ff79..d1783de0330 100644
--- a/spec/features/projects/jobs_spec.rb
+++ b/spec/features/projects/jobs_spec.rb
@@ -20,6 +20,7 @@ describe 'Jobs', :clean_gitlab_redis_shared_state do
   before do
     project.add_role(user, user_access_level)
     sign_in(user)
+    stub_feature_flags(job_log_json: false)
   end
 
   describe "GET /:project/jobs" do
diff --git a/spec/features/security/project/internal_access_spec.rb b/spec/features/security/project/internal_access_spec.rb
index 42c747c674f..d089fa718d2 100644
--- a/spec/features/security/project/internal_access_spec.rb
+++ b/spec/features/security/project/internal_access_spec.rb
@@ -7,6 +7,10 @@ describe "Internal Project Access" do
 
   set(:project) { create(:project, :internal, :repository) }
 
+  before do
+    stub_feature_flags(job_log_json: false)
+  end
+
   describe "Project should be internal" do
     describe '#internal?' do
       subject { project.internal? }
diff --git a/spec/features/security/project/private_access_spec.rb b/spec/features/security/project/private_access_spec.rb
index a86d240b7d6..b868cd595cb 100644
--- a/spec/features/security/project/private_access_spec.rb
+++ b/spec/features/security/project/private_access_spec.rb
@@ -7,6 +7,10 @@ describe "Private Project Access" do
 
   set(:project) { create(:project, :private, :repository, public_builds: false) }
 
+  before do
+    stub_feature_flags(job_log_json: false)
+  end
+
   describe "Project should be private" do
     describe '#private?' do
       subject { project.private? }
diff --git a/spec/features/security/project/public_access_spec.rb b/spec/features/security/project/public_access_spec.rb
index 8d7f8c84358..8db2f2d69e5 100644
--- a/spec/features/security/project/public_access_spec.rb
+++ b/spec/features/security/project/public_access_spec.rb
@@ -7,6 +7,10 @@ describe "Public Project Access" do
 
   set(:project) { create(:project, :public, :repository) }
 
+  before do
+    stub_feature_flags(job_log_json: false)
+  end
+
   describe "Project should be public" do
     describe '#public?' do
       subject { project.public? }
-- 
cgit v1.2.1