From b1d04cf9d58ac461f70a2cbf4df617cc14c3de1c Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Wed, 5 Sep 2018 21:41:59 -0700
Subject: Block loopback addresses in UrlBlocker

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/51128
---
 lib/gitlab/url_blocker.rb | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'lib')

diff --git a/lib/gitlab/url_blocker.rb b/lib/gitlab/url_blocker.rb
index 3b483f27e70..a2cce9151c3 100644
--- a/lib/gitlab/url_blocker.rb
+++ b/lib/gitlab/url_blocker.rb
@@ -30,6 +30,7 @@ module Gitlab
         end
 
         validate_localhost!(addrs_info) unless allow_localhost
+        validate_loopback!(addrs_info) unless allow_localhost
         validate_local_network!(addrs_info) unless allow_local_network
         validate_link_local!(addrs_info) unless allow_local_network
 
@@ -84,6 +85,12 @@ module Gitlab
         raise BlockedUrlError, "Requests to localhost are not allowed"
       end
 
+      def validate_loopback!(addrs_info)
+        return unless addrs_info.any? { |addr| addr.ipv4_loopback? || addr.ipv6_loopback? }
+
+        raise BlockedUrlError, "Requests to loopback addresses are not allowed"
+      end
+
       def validate_local_network!(addrs_info)
         return unless addrs_info.any? { |addr| addr.ipv4_private? || addr.ipv6_sitelocal? }
 
-- 
cgit v1.2.1


From 6bf8032735bddb5fead74ec3f4782aff008256ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matija=20=C4=8Cupi=C4=87?= <matteeyah@gmail.com>
Date: Wed, 3 Oct 2018 15:22:34 +0200
Subject: Remove full exception stack trace from error

---
 lib/gitlab/ci/parsers/test/junit.rb | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/ci/parsers/test/junit.rb b/lib/gitlab/ci/parsers/test/junit.rb
index 5d7d9a751d8..ed5a79d9b9b 100644
--- a/lib/gitlab/ci/parsers/test/junit.rb
+++ b/lib/gitlab/ci/parsers/test/junit.rb
@@ -14,10 +14,10 @@ module Gitlab
               test_case = create_test_case(test_case)
               test_suite.add_test_case(test_case)
             end
-          rescue REXML::ParseException => e
-            raise JunitParserError, "XML parsing failed: #{e.message}"
-          rescue => e
-            raise JunitParserError, "JUnit parsing failed: #{e.message}"
+          rescue REXML::ParseException
+            raise JunitParserError, "XML parsing failed"
+          rescue
+            raise JunitParserError, "JUnit parsing failed"
           end
 
           private
-- 
cgit v1.2.1


From c1c1496405620d99d5943b1c4b5277b4b7d6ad63 Mon Sep 17 00:00:00 2001
From: Jan Provaznik <jprovaznik@gitlab.com>
Date: Thu, 20 Sep 2018 16:14:46 +0200
Subject: Redact unsubscribe links in issuable texts

It's possible that user pastes accidentally also unsubscribe link
which is included in footer of notification emails. This unsubscribe
link contains personal token which attacker then use to act as the
original user (e.g. for sending comments under his/her identity).
---
 lib/gitlab/background_migration/redact_links.rb | 62 +++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 lib/gitlab/background_migration/redact_links.rb

(limited to 'lib')

diff --git a/lib/gitlab/background_migration/redact_links.rb b/lib/gitlab/background_migration/redact_links.rb
new file mode 100644
index 00000000000..f5d3bcdd517
--- /dev/null
+++ b/lib/gitlab/background_migration/redact_links.rb
@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+# rubocop:disable Style/Documentation
+
+module Gitlab
+  module BackgroundMigration
+    class RedactLinks
+      module Redactable
+        extend ActiveSupport::Concern
+
+        def redact_field!(field)
+          self[field].gsub!(%r{/sent_notifications/\h{32}/unsubscribe}, '/sent_notifications/REDACTED/unsubscribe')
+
+          if self.changed?
+            self.update_columns(field => self[field],
+                                "#{field}_html" => nil)
+          end
+        end
+      end
+
+      class Note < ActiveRecord::Base
+        include EachBatch
+        include Redactable
+
+        self.table_name = 'notes'
+        self.inheritance_column = :_type_disabled
+      end
+
+      class Issue < ActiveRecord::Base
+        include EachBatch
+        include Redactable
+
+        self.table_name = 'issues'
+        self.inheritance_column = :_type_disabled
+      end
+
+      class MergeRequest < ActiveRecord::Base
+        include EachBatch
+        include Redactable
+
+        self.table_name = 'merge_requests'
+        self.inheritance_column = :_type_disabled
+      end
+
+      class Snippet < ActiveRecord::Base
+        include EachBatch
+        include Redactable
+
+        self.table_name = 'snippets'
+        self.inheritance_column = :_type_disabled
+      end
+
+      def perform(model_name, field, start_id, stop_id)
+        link_pattern = "%/sent_notifications/" + ("_" * 32) + "/unsubscribe%"
+        model = "Gitlab::BackgroundMigration::RedactLinks::#{model_name}".constantize
+
+        model.where("#{field} like ?", link_pattern).where(id: start_id..stop_id).each do |resource|
+          resource.redact_field!(field)
+        end
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From a12d25d8a5e95ef868370e7c09e777237047366b Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Tue, 23 Oct 2018 14:59:00 -0700
Subject: Validate Wiki attachments are valid temporary files

A malicious attacker could craft a request to read arbitrary files on
the system. This change adds a Grape validation to ensure that the
tempfile parameter delivered by the Rack multipart uploader is a
Tempfile type to prevent users from being able to specify arbitrary
filenames.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/53072
---
 lib/api/validations/types/safe_file.rb | 15 +++++++++++++++
 lib/api/wikis.rb                       |  4 ++--
 2 files changed, 17 insertions(+), 2 deletions(-)
 create mode 100644 lib/api/validations/types/safe_file.rb

(limited to 'lib')

diff --git a/lib/api/validations/types/safe_file.rb b/lib/api/validations/types/safe_file.rb
new file mode 100644
index 00000000000..53b5790bfa2
--- /dev/null
+++ b/lib/api/validations/types/safe_file.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# This module overrides the Grape type validator defined in
+# https://github.com/ruby-grape/grape/blob/master/lib/grape/validations/types/file.rb
+module API
+  module Validations
+    module Types
+      class SafeFile < ::Grape::Validations::Types::File
+        def value_coerced?(value)
+          super && value[:tempfile].is_a?(Tempfile)
+        end
+      end
+    end
+  end
+end
diff --git a/lib/api/wikis.rb b/lib/api/wikis.rb
index 6e1d4eb335f..24746f4efc6 100644
--- a/lib/api/wikis.rb
+++ b/lib/api/wikis.rb
@@ -6,7 +6,7 @@ module API
       def commit_params(attrs)
         {
           file_name: attrs[:file][:filename],
-          file_content: File.read(attrs[:file][:tempfile]),
+          file_content: attrs[:file][:tempfile].read,
           branch_name: attrs[:branch]
         }
       end
@@ -100,7 +100,7 @@ module API
         success Entities::WikiAttachment
       end
       params do
-        requires :file, type: File, desc: 'The attachment file to be uploaded'
+        requires :file, type: ::API::Validations::Types::SafeFile, desc: 'The attachment file to be uploaded'
         optional :branch, type: String, desc: 'The name of the branch'
       end
       post ":id/wikis/attachments", requirements: API::PROJECT_ENDPOINT_REQUIREMENTS do
-- 
cgit v1.2.1


From 084a8b6101c25e5d3d4f97f078abd9a649a2fb64 Mon Sep 17 00:00:00 2001
From: Tiago Botelho <tiagonbotelho@hotmail.com>
Date: Mon, 22 Oct 2018 15:49:20 +0100
Subject: Adds tracing messages for slow git pushes

Whenever a git push takes more than 50 seconds the user
will receive a trace from each check performed along with
their timings
---
 lib/api/internal.rb                      |   2 +
 lib/gitlab/checks/change_access.rb       | 108 ++++++++++++++++++++-----------
 lib/gitlab/checks/lfs_integrity.rb       |   5 +-
 lib/gitlab/checks/timed_logger.rb        |  69 ++++++++++++++++++++
 lib/gitlab/git/lfs_changes.rb            |   4 +-
 lib/gitlab/git_access.rb                 |  22 +++++--
 lib/gitlab/gitaly_client/blob_service.rb |  17 ++++-
 7 files changed, 181 insertions(+), 46 deletions(-)
 create mode 100644 lib/gitlab/checks/timed_logger.rb

(limited to 'lib')

diff --git a/lib/api/internal.rb b/lib/api/internal.rb
index 4dd6b19e353..ae40b5f7557 100644
--- a/lib/api/internal.rb
+++ b/lib/api/internal.rb
@@ -65,6 +65,8 @@ module API
                          result
                        rescue Gitlab::GitAccess::UnauthorizedError => e
                          break response_with_status(code: 401, success: false, message: e.message)
+                       rescue Gitlab::GitAccess::TimeoutError => e
+                         break response_with_status(code: 503, success: false, message: e.message)
                        rescue Gitlab::GitAccess::NotFoundError => e
                          break response_with_status(code: 404, success: false, message: e.message)
                        end
diff --git a/lib/gitlab/checks/change_access.rb b/lib/gitlab/checks/change_access.rb
index 49e7f7e1fd7..52a72de3b15 100644
--- a/lib/gitlab/checks/change_access.rb
+++ b/lib/gitlab/checks/change_access.rb
@@ -18,11 +18,24 @@ module Gitlab
         lfs_objects_missing: 'LFS objects are missing. Ensure LFS is properly set up or try a manual "git lfs push --all".'
       }.freeze
 
-      attr_reader :user_access, :project, :skip_authorization, :skip_lfs_integrity_check, :protocol, :oldrev, :newrev, :ref, :branch_name, :tag_name
+      LOG_MESSAGES = {
+        push_checks: "Checking if you are allowed to push...",
+        delete_default_branch_check: "Checking if default branch is being deleted...",
+        protected_branch_checks: "Checking if you are force pushing to a protected branch...",
+        protected_branch_push_checks: "Checking if you are allowed to push to the protected branch...",
+        protected_branch_deletion_checks: "Checking if you are allowed to delete the protected branch...",
+        tag_checks: "Checking if you are allowed to change existing tags...",
+        protected_tag_checks: "Checking if you are creating, updating or deleting a protected tag...",
+        lfs_objects_exist_check: "Scanning repository for blobs stored in LFS and verifying their files have been uploaded to GitLab...",
+        commits_check_file_paths_validation: "Validating commits' file paths...",
+        commits_check: "Validating commits..." # different message in EE
+      }.freeze
+
+      attr_reader :user_access, :project, :skip_authorization, :skip_lfs_integrity_check, :protocol, :oldrev, :newrev, :ref, :branch_name, :tag_name, :logger
 
       def initialize(
         change, user_access:, project:, skip_authorization: false,
-        skip_lfs_integrity_check: false, protocol:
+        skip_lfs_integrity_check: false, protocol:, logger:
       )
         @oldrev, @newrev, @ref = change.values_at(:oldrev, :newrev, :ref)
         @branch_name = Gitlab::Git.branch_name(@ref)
@@ -32,6 +45,9 @@ module Gitlab
         @skip_authorization = skip_authorization
         @skip_lfs_integrity_check = skip_lfs_integrity_check
         @protocol = protocol
+
+        @logger = logger
+        @logger.log << "Running checks for ref: #{@branch_name || @tag_name}"
       end
 
       def exec(skip_commits_check: false)
@@ -49,26 +65,32 @@ module Gitlab
       protected
 
       def push_checks
-        unless can_push?
-          raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:push_code]
+        logger.log_timed(LOG_MESSAGES[__method__]) do
+          unless can_push?
+            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:push_code]
+          end
         end
       end
 
       def branch_checks
         return unless branch_name
 
-        if deletion? && branch_name == project.default_branch
-          raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:delete_default_branch]
+        logger.log_timed(LOG_MESSAGES[:delete_default_branch_check]) do
+          if deletion? && branch_name == project.default_branch
+            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:delete_default_branch]
+          end
         end
 
         protected_branch_checks
       end
 
       def protected_branch_checks
-        return unless ProtectedBranch.protected?(project, branch_name)
+        logger.log_timed(LOG_MESSAGES[__method__]) do
+          return unless ProtectedBranch.protected?(project, branch_name) # rubocop:disable Cop/AvoidReturnFromBlocks
 
-        if forced_push?
-          raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:force_push_protected_branch]
+          if forced_push?
+            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:force_push_protected_branch]
+          end
         end
 
         if deletion?
@@ -79,23 +101,27 @@ module Gitlab
       end
 
       def protected_branch_deletion_checks
-        unless user_access.can_delete_branch?(branch_name)
-          raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:non_master_delete_protected_branch]
-        end
+        logger.log_timed(LOG_MESSAGES[__method__]) do
+          unless user_access.can_delete_branch?(branch_name)
+            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:non_master_delete_protected_branch]
+          end
 
-        unless updated_from_web?
-          raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:non_web_delete_protected_branch]
+          unless updated_from_web?
+            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:non_web_delete_protected_branch]
+          end
         end
       end
 
       def protected_branch_push_checks
-        if matching_merge_request?
-          unless user_access.can_merge_to_branch?(branch_name) || user_access.can_push_to_branch?(branch_name)
-            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:merge_protected_branch]
-          end
-        else
-          unless user_access.can_push_to_branch?(branch_name)
-            raise GitAccess::UnauthorizedError, push_to_protected_branch_rejected_message
+        logger.log_timed(LOG_MESSAGES[__method__]) do
+          if matching_merge_request?
+            unless user_access.can_merge_to_branch?(branch_name) || user_access.can_push_to_branch?(branch_name)
+              raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:merge_protected_branch]
+            end
+          else
+            unless user_access.can_push_to_branch?(branch_name)
+              raise GitAccess::UnauthorizedError, push_to_protected_branch_rejected_message
+            end
           end
         end
       end
@@ -103,21 +129,25 @@ module Gitlab
       def tag_checks
         return unless tag_name
 
-        if tag_exists? && user_access.cannot_do_action?(:admin_project)
-          raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:change_existing_tags]
+        logger.log_timed(LOG_MESSAGES[__method__]) do
+          if tag_exists? && user_access.cannot_do_action?(:admin_project)
+            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:change_existing_tags]
+          end
         end
 
         protected_tag_checks
       end
 
       def protected_tag_checks
-        return unless ProtectedTag.protected?(project, tag_name)
+        logger.log_timed(LOG_MESSAGES[__method__]) do
+          return unless ProtectedTag.protected?(project, tag_name) # rubocop:disable Cop/AvoidReturnFromBlocks
 
-        raise(GitAccess::UnauthorizedError, ERROR_MESSAGES[:update_protected_tag]) if update?
-        raise(GitAccess::UnauthorizedError, ERROR_MESSAGES[:delete_protected_tag]) if deletion?
+          raise(GitAccess::UnauthorizedError, ERROR_MESSAGES[:update_protected_tag]) if update?
+          raise(GitAccess::UnauthorizedError, ERROR_MESSAGES[:delete_protected_tag]) if deletion?
 
-        unless user_access.can_create_tag?(tag_name)
-          raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:create_protected_tag]
+          unless user_access.can_create_tag?(tag_name)
+            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:create_protected_tag]
+          end
         end
       end
 
@@ -125,14 +155,18 @@ module Gitlab
         return if deletion? || newrev.nil?
         return unless should_run_commit_validations?
 
-        # n+1: https://gitlab.com/gitlab-org/gitlab-ee/issues/3593
-        ::Gitlab::GitalyClient.allow_n_plus_1_calls do
-          commits.each do |commit|
-            commit_check.validate(commit, validations_for_commit(commit))
+        logger.log_timed(LOG_MESSAGES[__method__]) do
+          # n+1: https://gitlab.com/gitlab-org/gitlab-ee/issues/3593
+          ::Gitlab::GitalyClient.allow_n_plus_1_calls do
+            commits.each do |commit|
+              commit_check.validate(commit, validations_for_commit(commit))
+            end
           end
         end
 
-        commit_check.validate_file_paths
+        logger.log_timed(LOG_MESSAGES[:commits_check_file_paths_validation]) do
+          commit_check.validate_file_paths
+        end
       end
 
       # Method overwritten in EE to inject custom validations
@@ -194,10 +228,12 @@ module Gitlab
       end
 
       def lfs_objects_exist_check
-        lfs_check = Checks::LfsIntegrity.new(project, newrev)
+        logger.log_timed(LOG_MESSAGES[__method__]) do
+          lfs_check = Checks::LfsIntegrity.new(project, newrev, logger.time_left)
 
-        if lfs_check.objects_missing?
-          raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:lfs_objects_missing]
+          if lfs_check.objects_missing?
+            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:lfs_objects_missing]
+          end
         end
       end
 
diff --git a/lib/gitlab/checks/lfs_integrity.rb b/lib/gitlab/checks/lfs_integrity.rb
index fa3dc1808df..1652d5a30a4 100644
--- a/lib/gitlab/checks/lfs_integrity.rb
+++ b/lib/gitlab/checks/lfs_integrity.rb
@@ -3,9 +3,10 @@
 module Gitlab
   module Checks
     class LfsIntegrity
-      def initialize(project, newrev)
+      def initialize(project, newrev, time_left)
         @project = project
         @newrev = newrev
+        @time_left = time_left
       end
 
       # rubocop: disable CodeReuse/ActiveRecord
@@ -13,7 +14,7 @@ module Gitlab
         return false unless @newrev && @project.lfs_enabled?
 
         new_lfs_pointers = Gitlab::Git::LfsChanges.new(@project.repository, @newrev)
-                                                  .new_pointers(object_limit: ::Gitlab::Git::Repository::REV_LIST_COMMIT_LIMIT)
+                                                  .new_pointers(object_limit: ::Gitlab::Git::Repository::REV_LIST_COMMIT_LIMIT, dynamic_timeout: @time_left)
 
         return false unless new_lfs_pointers.present?
 
diff --git a/lib/gitlab/checks/timed_logger.rb b/lib/gitlab/checks/timed_logger.rb
new file mode 100644
index 00000000000..cbb079a5383
--- /dev/null
+++ b/lib/gitlab/checks/timed_logger.rb
@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Checks
+    class TimedLogger
+      TimeoutError = Class.new(StandardError)
+
+      attr_reader :start_time
+      attr_accessor :log, :timeout
+
+      def initialize(start_time: Time.now, log: [], timeout:)
+        @start_time = start_time
+        @timeout = timeout
+        @log = log
+      end
+
+      def log_timed(log_message, start = Time.now)
+        check_timeout_reached
+
+        timed = true
+
+        yield
+
+        log << log_message + time_suffix_message(start: start)
+      rescue GRPC::DeadlineExceeded, TimeoutError
+        args = { cancelled: true }
+        args[:start] = start if timed
+
+        log << log_message + time_suffix_message(args)
+
+        raise TimeoutError
+      end
+
+      def check_timeout_reached
+        return unless time_expired?
+
+        raise TimeoutError
+      end
+
+      def time_left
+        (start_time + timeout.seconds) - Time.now
+      end
+
+      private
+
+      def time_expired?
+        time_left <= 0
+      end
+
+      def time_suffix_message(cancelled: false, start: nil)
+        return " (#{elapsed_time(start)}ms)" unless cancelled
+
+        if start
+          " (cancelled after #{elapsed_time(start)}ms)"
+        else
+          " (cancelled)"
+        end
+      end
+
+      def elapsed_time(start)
+        to_ms(Time.now - start)
+      end
+
+      def to_ms(elapsed)
+        (elapsed.to_f * 1000).round(2)
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/git/lfs_changes.rb b/lib/gitlab/git/lfs_changes.rb
index f0fab1e76a3..d7148165408 100644
--- a/lib/gitlab/git/lfs_changes.rb
+++ b/lib/gitlab/git/lfs_changes.rb
@@ -6,8 +6,8 @@ module Gitlab
         @newrev = newrev
       end
 
-      def new_pointers(object_limit: nil, not_in: nil)
-        @repository.gitaly_blob_client.get_new_lfs_pointers(@newrev, object_limit, not_in)
+      def new_pointers(object_limit: nil, not_in: nil, dynamic_timeout: nil)
+        @repository.gitaly_blob_client.get_new_lfs_pointers(@newrev, object_limit, not_in, dynamic_timeout)
       end
 
       def all_pointers
diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index 827c04ae035..713a98bb556 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -9,6 +9,7 @@ module Gitlab
     UnauthorizedError = Class.new(StandardError)
     NotFoundError = Class.new(StandardError)
     ProjectCreationError = Class.new(StandardError)
+    TimeoutError = Class.new(StandardError)
     ProjectMovedError = Class.new(NotFoundError)
 
     ERROR_MESSAGES = {
@@ -26,11 +27,12 @@ module Gitlab
       cannot_push_to_read_only: "You can't push code to a read-only GitLab instance."
     }.freeze
 
+    INTERNAL_TIMEOUT = 50.seconds.freeze
     DOWNLOAD_COMMANDS = %w{git-upload-pack git-upload-archive}.freeze
     PUSH_COMMANDS = %w{git-receive-pack}.freeze
     ALL_COMMANDS = DOWNLOAD_COMMANDS + PUSH_COMMANDS
 
-    attr_reader :actor, :project, :protocol, :authentication_abilities, :namespace_path, :project_path, :redirected_path, :auth_result_type, :changes
+    attr_reader :actor, :project, :protocol, :authentication_abilities, :namespace_path, :project_path, :redirected_path, :auth_result_type, :changes, :logger
 
     def initialize(actor, project, protocol, authentication_abilities:, namespace_path: nil, project_path: nil, redirected_path: nil, auth_result_type: nil)
       @actor    = actor
@@ -44,6 +46,7 @@ module Gitlab
     end
 
     def check(cmd, changes)
+      @logger = Checks::TimedLogger.new(timeout: INTERNAL_TIMEOUT)
       @changes = changes
 
       check_protocol!
@@ -269,14 +272,25 @@ module Gitlab
     end
 
     def check_single_change_access(change, skip_lfs_integrity_check: false)
-      Checks::ChangeAccess.new(
+      change_access = Checks::ChangeAccess.new(
         change,
         user_access: user_access,
         project: project,
         skip_authorization: deploy_key?,
         skip_lfs_integrity_check: skip_lfs_integrity_check,
-        protocol: protocol
-      ).exec
+        protocol: protocol,
+        logger: logger
+      )
+
+      change_access.exec
+    rescue Checks::TimedLogger::TimeoutError
+      header = <<~MESSAGE
+      Push operation timed out
+
+      Timing information for debugging purposes:
+      MESSAGE
+
+      raise TimeoutError, header + logger.log.join("\n")
     end
 
     def deploy_key
diff --git a/lib/gitlab/gitaly_client/blob_service.rb b/lib/gitlab/gitaly_client/blob_service.rb
index 1840bf45154..086ce31e678 100644
--- a/lib/gitlab/gitaly_client/blob_service.rb
+++ b/lib/gitlab/gitaly_client/blob_service.rb
@@ -72,7 +72,7 @@ module Gitlab
         GitalyClient::BlobsStitcher.new(response)
       end
 
-      def get_new_lfs_pointers(revision, limit, not_in)
+      def get_new_lfs_pointers(revision, limit, not_in, dynamic_timeout = nil)
         request = Gitaly::GetNewLFSPointersRequest.new(
           repository: @gitaly_repo,
           revision: encode_binary(revision),
@@ -85,7 +85,20 @@ module Gitlab
           request.not_in_refs += not_in
         end
 
-        response = GitalyClient.call(@gitaly_repo.storage_name, :blob_service, :get_new_lfs_pointers, request, timeout: GitalyClient.medium_timeout)
+        timeout =
+          if dynamic_timeout
+            [dynamic_timeout, GitalyClient.medium_timeout].min
+          else
+            GitalyClient.medium_timeout
+          end
+
+        response = GitalyClient.call(
+          @gitaly_repo.storage_name,
+          :blob_service,
+          :get_new_lfs_pointers,
+          request,
+          timeout: timeout
+        )
 
         map_lfs_pointers(response)
       end
-- 
cgit v1.2.1


From cb5f4d0cad520629aecaa838ddf1e84d7265ff49 Mon Sep 17 00:00:00 2001
From: Tiago Botelho <tiagonbotelho@hotmail.com>
Date: Thu, 25 Oct 2018 09:49:59 +0100
Subject: Refactors TimedLogger to be more OOP compliant

Adds a #full_message method so that external classes
do not have access to the state of the logger.

Adds a #append_message to always append to the array in-place
---
 lib/gitlab/checks/change_access.rb |  2 +-
 lib/gitlab/checks/timed_logger.rb  | 22 +++++++++++++++++-----
 lib/gitlab/git_access.rb           | 16 ++++++++--------
 3 files changed, 26 insertions(+), 14 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/checks/change_access.rb b/lib/gitlab/checks/change_access.rb
index 52a72de3b15..7036ae9191d 100644
--- a/lib/gitlab/checks/change_access.rb
+++ b/lib/gitlab/checks/change_access.rb
@@ -47,7 +47,7 @@ module Gitlab
         @protocol = protocol
 
         @logger = logger
-        @logger.log << "Running checks for ref: #{@branch_name || @tag_name}"
+        @logger.append_message("Running checks for ref: #{@branch_name || @tag_name}")
       end
 
       def exec(skip_commits_check: false)
diff --git a/lib/gitlab/checks/timed_logger.rb b/lib/gitlab/checks/timed_logger.rb
index cbb079a5383..11c08429d3d 100644
--- a/lib/gitlab/checks/timed_logger.rb
+++ b/lib/gitlab/checks/timed_logger.rb
@@ -5,15 +5,18 @@ module Gitlab
     class TimedLogger
       TimeoutError = Class.new(StandardError)
 
-      attr_reader :start_time
-      attr_accessor :log, :timeout
+      attr_reader :start_time, :header, :log, :timeout
 
-      def initialize(start_time: Time.now, log: [], timeout:)
+      def initialize(start_time: Time.now, log: [], timeout:, header: "")
         @start_time = start_time
         @timeout = timeout
+        @header = header
         @log = log
       end
 
+      # Adds trace of method being tracked with
+      # the correspondent time it took to run it
+      #
       def log_timed(log_message, start = Time.now)
         check_timeout_reached
 
@@ -21,12 +24,12 @@ module Gitlab
 
         yield
 
-        log << log_message + time_suffix_message(start: start)
+        append_message(log_message + time_suffix_message(start: start))
       rescue GRPC::DeadlineExceeded, TimeoutError
         args = { cancelled: true }
         args[:start] = start if timed
 
-        log << log_message + time_suffix_message(args)
+        append_message(log_message + time_suffix_message(args))
 
         raise TimeoutError
       end
@@ -41,6 +44,15 @@ module Gitlab
         (start_time + timeout.seconds) - Time.now
       end
 
+      def full_message
+        header + log.join("\n")
+      end
+
+      # We always want to append in-place on the log
+      def append_message(message)
+        log << message
+      end
+
       private
 
       def time_expired?
diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index 713a98bb556..1da466cbfd6 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -27,6 +27,12 @@ module Gitlab
       cannot_push_to_read_only: "You can't push code to a read-only GitLab instance."
     }.freeze
 
+    LOG_HEADER = <<~MESSAGE
+      Push operation timed out
+
+      Timing information for debugging purposes:
+    MESSAGE
+
     INTERNAL_TIMEOUT = 50.seconds.freeze
     DOWNLOAD_COMMANDS = %w{git-upload-pack git-upload-archive}.freeze
     PUSH_COMMANDS = %w{git-receive-pack}.freeze
@@ -46,7 +52,7 @@ module Gitlab
     end
 
     def check(cmd, changes)
-      @logger = Checks::TimedLogger.new(timeout: INTERNAL_TIMEOUT)
+      @logger = Checks::TimedLogger.new(timeout: INTERNAL_TIMEOUT, header: LOG_HEADER)
       @changes = changes
 
       check_protocol!
@@ -284,13 +290,7 @@ module Gitlab
 
       change_access.exec
     rescue Checks::TimedLogger::TimeoutError
-      header = <<~MESSAGE
-      Push operation timed out
-
-      Timing information for debugging purposes:
-      MESSAGE
-
-      raise TimeoutError, header + logger.log.join("\n")
+      raise TimeoutError, logger.full_message
     end
 
     def deploy_key
-- 
cgit v1.2.1


From e0225aea1beb741601b888d4f505abd97f0f67a6 Mon Sep 17 00:00:00 2001
From: Tiago Botelho <tiagonbotelho@hotmail.com>
Date: Thu, 25 Oct 2018 10:36:40 +0100
Subject: Iterating through commit list times out

Validating each commit on ChangeAccess times out if
it already took too long to complete.

Improves the TimedLogger specs to not make use of a stubbed
class anymore
---
 lib/gitlab/checks/change_access.rb | 2 ++
 lib/gitlab/checks/timed_logger.rb  | 6 ++++--
 lib/gitlab/git_access.rb           | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/checks/change_access.rb b/lib/gitlab/checks/change_access.rb
index 7036ae9191d..28ec6beb7e0 100644
--- a/lib/gitlab/checks/change_access.rb
+++ b/lib/gitlab/checks/change_access.rb
@@ -159,6 +159,8 @@ module Gitlab
           # n+1: https://gitlab.com/gitlab-org/gitlab-ee/issues/3593
           ::Gitlab::GitalyClient.allow_n_plus_1_calls do
             commits.each do |commit|
+              logger.check_timeout_reached
+
               commit_check.validate(commit, validations_for_commit(commit))
             end
           end
diff --git a/lib/gitlab/checks/timed_logger.rb b/lib/gitlab/checks/timed_logger.rb
index 11c08429d3d..f365e0a43f6 100644
--- a/lib/gitlab/checks/timed_logger.rb
+++ b/lib/gitlab/checks/timed_logger.rb
@@ -7,7 +7,7 @@ module Gitlab
 
       attr_reader :start_time, :header, :log, :timeout
 
-      def initialize(start_time: Time.now, log: [], timeout:, header: "")
+      def initialize(start_time: Time.now, log: [], header: "", timeout:)
         @start_time = start_time
         @timeout = timeout
         @header = header
@@ -15,7 +15,9 @@ module Gitlab
       end
 
       # Adds trace of method being tracked with
-      # the correspondent time it took to run it
+      # the correspondent time it took to run it.
+      # We make use of the start default argument
+      # on unit tests related to this method
       #
       def log_timed(log_message, start = Time.now)
         check_timeout_reached
diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index 1da466cbfd6..802fa65dd63 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -27,13 +27,13 @@ module Gitlab
       cannot_push_to_read_only: "You can't push code to a read-only GitLab instance."
     }.freeze
 
+    INTERNAL_TIMEOUT = 50.seconds.freeze
     LOG_HEADER = <<~MESSAGE
       Push operation timed out
 
       Timing information for debugging purposes:
     MESSAGE
 
-    INTERNAL_TIMEOUT = 50.seconds.freeze
     DOWNLOAD_COMMANDS = %w{git-upload-pack git-upload-archive}.freeze
     PUSH_COMMANDS = %w{git-receive-pack}.freeze
     ALL_COMMANDS = DOWNLOAD_COMMANDS + PUSH_COMMANDS
-- 
cgit v1.2.1


From f8ee07d9ee6d01b255902ad976a07beef59a95fb Mon Sep 17 00:00:00 2001
From: Tiago Botelho <tiagonbotelho@hotmail.com>
Date: Mon, 22 Oct 2018 14:18:45 +0100
Subject: User not defined in PostReceive#process_project_changes

When Gitlab::GitPostReceive#changes_refs is empty
user would not get defined and nil would be passed
to PostReceive#after_project_changes_hooks which would
then throw an error.
---
 lib/gitlab/git_post_receive.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/git_post_receive.rb b/lib/gitlab/git_post_receive.rb
index e731e654f3c..f5470ffa2da 100644
--- a/lib/gitlab/git_post_receive.rb
+++ b/lib/gitlab/git_post_receive.rb
@@ -11,7 +11,7 @@ module Gitlab
       @changes = deserialize_changes(changes)
     end
 
-    def identify(revision)
+    def identify(revision = nil)
       super(identifier, project, revision)
     end
 
-- 
cgit v1.2.1


From 679d9b21b7aac55796ef59d5694b7d2e0fb40b35 Mon Sep 17 00:00:00 2001
From: Tiago Botelho <tiagonbotelho@hotmail.com>
Date: Thu, 25 Oct 2018 11:09:53 +0100
Subject: Removes idenfitication by commit from Gitlab::Identifier

Before we would need to identify a user when pushing
through the GitLab UI. Since this is no longer the case
we can remove the identification by commit and instead,
use the identify_using_user
---
 lib/gitlab/git_post_receive.rb |  4 ++--
 lib/gitlab/identifier.rb       | 21 +++------------------
 2 files changed, 5 insertions(+), 20 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/git_post_receive.rb b/lib/gitlab/git_post_receive.rb
index f5470ffa2da..cf2329e489d 100644
--- a/lib/gitlab/git_post_receive.rb
+++ b/lib/gitlab/git_post_receive.rb
@@ -11,8 +11,8 @@ module Gitlab
       @changes = deserialize_changes(changes)
     end
 
-    def identify(revision = nil)
-      super(identifier, project, revision)
+    def identify
+      super(identifier)
     end
 
     def changes_refs
diff --git a/lib/gitlab/identifier.rb b/lib/gitlab/identifier.rb
index 28a9fe29465..d5f94ad04f1 100644
--- a/lib/gitlab/identifier.rb
+++ b/lib/gitlab/identifier.rb
@@ -1,13 +1,11 @@
 # frozen_string_literal: true
 
 # Detect user based on identifier like
-# key-13 or user-36 or last commit
+# key-13 or user-36
 module Gitlab
   module Identifier
-    def identify(identifier, project = nil, newrev = nil)
-      if identifier.blank?
-        identify_using_commit(project, newrev)
-      elsif identifier =~ /\Auser-\d+\Z/
+    def identify(identifier)
+      if identifier =~ /\Auser-\d+\Z/
         # git push over http
         identify_using_user(identifier)
       elsif identifier =~ /\Akey-\d+\Z/
@@ -16,19 +14,6 @@ module Gitlab
       end
     end
 
-    # Tries to identify a user based on a commit SHA.
-    def identify_using_commit(project, ref)
-      return if project.nil? && ref.nil?
-
-      commit = project.commit(ref)
-
-      return if !commit || !commit.author_email
-
-      identify_with_cache(:email, commit.author_email) do
-        commit.author
-      end
-    end
-
     # Tries to identify a user based on a user identifier (e.g. "user-123").
     # rubocop: disable CodeReuse/ActiveRecord
     def identify_using_user(identifier)
-- 
cgit v1.2.1


From dd2e91cc7832db66615a466956e6c8aa0cd0fba0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matija=20=C4=8Cupi=C4=87?= <matteeyah@gmail.com>
Date: Thu, 25 Oct 2018 19:55:19 +0200
Subject: Cache pipeline status only for specific sha

---
 lib/gitlab/cache/ci/project_pipeline_status.rb | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/cache/ci/project_pipeline_status.rb b/lib/gitlab/cache/ci/project_pipeline_status.rb
index b369b9e7600..99fe7d3a252 100644
--- a/lib/gitlab/cache/ci/project_pipeline_status.rb
+++ b/lib/gitlab/cache/ci/project_pipeline_status.rb
@@ -41,8 +41,8 @@ module Gitlab
           end
         end
 
-        def self.cache_key_for_project(project)
-          "#{Gitlab::Redis::Cache::CACHE_NAMESPACE}:projects/#{project.id}/pipeline_status"
+        def self.cache_key_for_project(project, cache_sha = project.commit&.sha)
+          "#{Gitlab::Redis::Cache::CACHE_NAMESPACE}:projects/#{project.id}/pipeline_status/#{cache_sha}"
         end
 
         def self.update_for_pipeline(pipeline)
@@ -84,9 +84,7 @@ module Gitlab
         def load_from_project
           return unless commit
 
-          self.sha = commit.sha
-          self.status = commit.status
-          self.ref = project.default_branch
+          self.sha, self.status, self.ref = commit.sha, commit.status, project.default_branch
         end
 
         # We only cache the status for the HEAD commit of a project
@@ -104,6 +102,8 @@ module Gitlab
         def load_from_cache
           Gitlab::Redis::Cache.with do |redis|
             self.sha, self.status, self.ref = redis.hmget(cache_key, :sha, :status, :ref)
+
+            self.status = nil if self.status.empty?
           end
         end
 
-- 
cgit v1.2.1


From 41fe3fdfc39092e63a3fe1ae9b323e5204c2bdce Mon Sep 17 00:00:00 2001
From: Tiago Botelho <tiagonbotelho@hotmail.com>
Date: Fri, 26 Oct 2018 09:50:44 +0100
Subject: Reverts commits_check message

---
 lib/gitlab/checks/change_access.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/checks/change_access.rb b/lib/gitlab/checks/change_access.rb
index 28ec6beb7e0..074afe9c412 100644
--- a/lib/gitlab/checks/change_access.rb
+++ b/lib/gitlab/checks/change_access.rb
@@ -28,7 +28,7 @@ module Gitlab
         protected_tag_checks: "Checking if you are creating, updating or deleting a protected tag...",
         lfs_objects_exist_check: "Scanning repository for blobs stored in LFS and verifying their files have been uploaded to GitLab...",
         commits_check_file_paths_validation: "Validating commits' file paths...",
-        commits_check: "Validating commits..." # different message in EE
+        commits_check: "Validating commit contents..."
       }.freeze
 
       attr_reader :user_access, :project, :skip_authorization, :skip_lfs_integrity_check, :protocol, :oldrev, :newrev, :ref, :branch_name, :tag_name, :logger
-- 
cgit v1.2.1


From 0079fa19ce493da761a07f3dca2a3caf0a2476d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matija=20=C4=8Cupi=C4=87?= <matteeyah@gmail.com>
Date: Fri, 26 Oct 2018 14:53:04 +0200
Subject: Remove cache_sha parameter

---
 lib/gitlab/cache/ci/project_pipeline_status.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/cache/ci/project_pipeline_status.rb b/lib/gitlab/cache/ci/project_pipeline_status.rb
index 99fe7d3a252..dfbb83f7bb9 100644
--- a/lib/gitlab/cache/ci/project_pipeline_status.rb
+++ b/lib/gitlab/cache/ci/project_pipeline_status.rb
@@ -41,8 +41,8 @@ module Gitlab
           end
         end
 
-        def self.cache_key_for_project(project, cache_sha = project.commit&.sha)
-          "#{Gitlab::Redis::Cache::CACHE_NAMESPACE}:projects/#{project.id}/pipeline_status/#{cache_sha}"
+        def self.cache_key_for_project(project)
+          "#{Gitlab::Redis::Cache::CACHE_NAMESPACE}:projects/#{project.id}/pipeline_status/#{project.commit&.sha}"
         end
 
         def self.update_for_pipeline(pipeline)
-- 
cgit v1.2.1


From db80db793f43f9b4367730fc9b95c1925807f999 Mon Sep 17 00:00:00 2001
From: Jasper Maes <jaspermaes.jm@gmail.com>
Date: Fri, 26 Oct 2018 18:19:28 +0200
Subject: Replace deprecated uniq on a Relation with distinct

---
 lib/gitlab/contributions_calendar.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/contributions_calendar.rb b/lib/gitlab/contributions_calendar.rb
index c819bffdfd6..5ed6427072a 100644
--- a/lib/gitlab/contributions_calendar.rb
+++ b/lib/gitlab/contributions_calendar.rb
@@ -73,7 +73,7 @@ module Gitlab
       # re-running the contributed projects query in each union is expensive, so
       # use IN(project_ids...) instead. It's the intersection of two users so
       # the list will be (relatively) short
-      @contributed_project_ids ||= projects.uniq.pluck(:id)
+      @contributed_project_ids ||= projects.distinct.pluck(:id)
       authed_projects = Project.where(id: @contributed_project_ids)
         .with_feature_available_for_user(feature, current_user)
         .reorder(nil)
-- 
cgit v1.2.1


From 06892e88f56eff13747f58e269c7190fc662a9ae Mon Sep 17 00:00:00 2001
From: gfyoung <gfyoung17@gmail.com>
Date: Thu, 25 Oct 2018 21:12:43 -0700
Subject: Enable frozen string for lib/gitlab/ci

Enables frozen string for the following:

* lib/gitlab/ci/*.rb
* lib/gitlab/ci/build/**/*.rb
* lib/gitlab/ci/config/**/*.rb
* lib/gitlab/ci/pipeline/**/*.rb
* lib/gitlab/ci/reports/**/*.rb

Partially addresses #47424.
---
 lib/gitlab/ci/ansi2html.rb                              | 4 +++-
 lib/gitlab/ci/build/artifacts/adapters/gzip_stream.rb   | 2 ++
 lib/gitlab/ci/build/artifacts/adapters/raw_stream.rb    | 2 ++
 lib/gitlab/ci/build/artifacts/metadata.rb               | 2 ++
 lib/gitlab/ci/build/artifacts/metadata/entry.rb         | 2 ++
 lib/gitlab/ci/build/artifacts/path.rb                   | 2 ++
 lib/gitlab/ci/build/credentials/base.rb                 | 2 ++
 lib/gitlab/ci/build/credentials/factory.rb              | 2 ++
 lib/gitlab/ci/build/credentials/registry.rb             | 2 ++
 lib/gitlab/ci/build/image.rb                            | 2 ++
 lib/gitlab/ci/build/policy.rb                           | 2 ++
 lib/gitlab/ci/build/policy/kubernetes.rb                | 2 ++
 lib/gitlab/ci/build/policy/refs.rb                      | 2 ++
 lib/gitlab/ci/build/policy/specification.rb             | 2 ++
 lib/gitlab/ci/build/policy/variables.rb                 | 2 ++
 lib/gitlab/ci/build/step.rb                             | 2 ++
 lib/gitlab/ci/charts.rb                                 | 2 ++
 lib/gitlab/ci/config.rb                                 | 2 ++
 lib/gitlab/ci/config/entry/artifacts.rb                 | 2 ++
 lib/gitlab/ci/config/entry/attributable.rb              | 2 ++
 lib/gitlab/ci/config/entry/boolean.rb                   | 2 ++
 lib/gitlab/ci/config/entry/cache.rb                     | 2 ++
 lib/gitlab/ci/config/entry/commands.rb                  | 2 ++
 lib/gitlab/ci/config/entry/configurable.rb              | 2 ++
 lib/gitlab/ci/config/entry/coverage.rb                  | 2 ++
 lib/gitlab/ci/config/entry/environment.rb               | 2 ++
 lib/gitlab/ci/config/entry/factory.rb                   | 2 ++
 lib/gitlab/ci/config/entry/global.rb                    | 2 ++
 lib/gitlab/ci/config/entry/hidden.rb                    | 2 ++
 lib/gitlab/ci/config/entry/image.rb                     | 2 ++
 lib/gitlab/ci/config/entry/job.rb                       | 2 ++
 lib/gitlab/ci/config/entry/jobs.rb                      | 2 ++
 lib/gitlab/ci/config/entry/key.rb                       | 2 ++
 lib/gitlab/ci/config/entry/legacy_validation_helpers.rb | 2 ++
 lib/gitlab/ci/config/entry/node.rb                      | 2 ++
 lib/gitlab/ci/config/entry/paths.rb                     | 2 ++
 lib/gitlab/ci/config/entry/policy.rb                    | 2 ++
 lib/gitlab/ci/config/entry/script.rb                    | 2 ++
 lib/gitlab/ci/config/entry/service.rb                   | 2 ++
 lib/gitlab/ci/config/entry/services.rb                  | 2 ++
 lib/gitlab/ci/config/entry/simplifiable.rb              | 2 ++
 lib/gitlab/ci/config/entry/stage.rb                     | 2 ++
 lib/gitlab/ci/config/entry/stages.rb                    | 2 ++
 lib/gitlab/ci/config/entry/undefined.rb                 | 2 ++
 lib/gitlab/ci/config/entry/unspecified.rb               | 2 ++
 lib/gitlab/ci/config/entry/validatable.rb               | 2 ++
 lib/gitlab/ci/config/entry/validator.rb                 | 2 ++
 lib/gitlab/ci/config/entry/validators.rb                | 2 ++
 lib/gitlab/ci/config/entry/variables.rb                 | 2 ++
 lib/gitlab/ci/config/loader.rb                          | 2 ++
 lib/gitlab/ci/cron_parser.rb                            | 2 ++
 lib/gitlab/ci/mask_secret.rb                            | 4 ++++
 lib/gitlab/ci/model.rb                                  | 2 ++
 lib/gitlab/ci/pipeline/chain/base.rb                    | 2 ++
 lib/gitlab/ci/pipeline/chain/build.rb                   | 2 ++
 lib/gitlab/ci/pipeline/chain/command.rb                 | 5 ++++-
 lib/gitlab/ci/pipeline/chain/create.rb                  | 2 ++
 lib/gitlab/ci/pipeline/chain/helpers.rb                 | 2 ++
 lib/gitlab/ci/pipeline/chain/populate.rb                | 2 ++
 lib/gitlab/ci/pipeline/chain/sequence.rb                | 2 ++
 lib/gitlab/ci/pipeline/chain/skip.rb                    | 2 ++
 lib/gitlab/ci/pipeline/chain/validate/abilities.rb      | 2 ++
 lib/gitlab/ci/pipeline/chain/validate/config.rb         | 2 ++
 lib/gitlab/ci/pipeline/chain/validate/repository.rb     | 2 ++
 lib/gitlab/ci/pipeline/duration.rb                      | 2 ++
 lib/gitlab/ci/pipeline/expression.rb                    | 2 ++
 lib/gitlab/ci/pipeline/expression/lexeme/base.rb        | 2 ++
 lib/gitlab/ci/pipeline/expression/lexeme/equals.rb      | 2 ++
 lib/gitlab/ci/pipeline/expression/lexeme/matches.rb     | 2 ++
 lib/gitlab/ci/pipeline/expression/lexeme/null.rb        | 2 ++
 lib/gitlab/ci/pipeline/expression/lexeme/operator.rb    | 2 ++
 lib/gitlab/ci/pipeline/expression/lexeme/pattern.rb     | 2 ++
 lib/gitlab/ci/pipeline/expression/lexeme/string.rb      | 2 ++
 lib/gitlab/ci/pipeline/expression/lexeme/value.rb       | 2 ++
 lib/gitlab/ci/pipeline/expression/lexeme/variable.rb    | 2 ++
 lib/gitlab/ci/pipeline/expression/lexer.rb              | 2 ++
 lib/gitlab/ci/pipeline/expression/parser.rb             | 2 ++
 lib/gitlab/ci/pipeline/expression/statement.rb          | 2 ++
 lib/gitlab/ci/pipeline/expression/token.rb              | 2 ++
 lib/gitlab/ci/pipeline/seed/base.rb                     | 2 ++
 lib/gitlab/ci/pipeline/seed/build.rb                    | 2 ++
 lib/gitlab/ci/pipeline/seed/stage.rb                    | 2 ++
 lib/gitlab/ci/reports/test_case.rb                      | 2 ++
 lib/gitlab/ci/reports/test_reports.rb                   | 2 ++
 lib/gitlab/ci/reports/test_reports_comparer.rb          | 2 ++
 lib/gitlab/ci/reports/test_suite.rb                     | 2 ++
 lib/gitlab/ci/reports/test_suite_comparer.rb            | 2 ++
 lib/gitlab/ci/trace.rb                                  | 2 ++
 lib/gitlab/ci/yaml_processor.rb                         | 2 ++
 89 files changed, 183 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/ci/ansi2html.rb b/lib/gitlab/ci/ansi2html.rb
index e780f8c646b..974b5ad6877 100644
--- a/lib/gitlab/ci/ansi2html.rb
+++ b/lib/gitlab/ci/ansi2html.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # ANSI color library
 #
 # Implementation per http://en.wikipedia.org/wiki/ANSI_escape_code
@@ -265,7 +267,7 @@ module Gitlab
         def reset_state
           @offset = 0
           @n_open_tags = 0
-          @out = ''
+          @out = +''
           reset
         end
 
diff --git a/lib/gitlab/ci/build/artifacts/adapters/gzip_stream.rb b/lib/gitlab/ci/build/artifacts/adapters/gzip_stream.rb
index ee3647f24fd..25a82086676 100644
--- a/lib/gitlab/ci/build/artifacts/adapters/gzip_stream.rb
+++ b/lib/gitlab/ci/build/artifacts/adapters/gzip_stream.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/artifacts/adapters/raw_stream.rb b/lib/gitlab/ci/build/artifacts/adapters/raw_stream.rb
index fa6842cf36a..cf37d700991 100644
--- a/lib/gitlab/ci/build/artifacts/adapters/raw_stream.rb
+++ b/lib/gitlab/ci/build/artifacts/adapters/raw_stream.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/artifacts/metadata.rb b/lib/gitlab/ci/build/artifacts/metadata.rb
index 551d4f4473e..08dac756cc1 100644
--- a/lib/gitlab/ci/build/artifacts/metadata.rb
+++ b/lib/gitlab/ci/build/artifacts/metadata.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'zlib'
 require 'json'
 
diff --git a/lib/gitlab/ci/build/artifacts/metadata/entry.rb b/lib/gitlab/ci/build/artifacts/metadata/entry.rb
index 85072a072d6..d0a80518ae8 100644
--- a/lib/gitlab/ci/build/artifacts/metadata/entry.rb
+++ b/lib/gitlab/ci/build/artifacts/metadata/entry.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/artifacts/path.rb b/lib/gitlab/ci/build/artifacts/path.rb
index 9cd9b36c5f8..65cd935afaa 100644
--- a/lib/gitlab/ci/build/artifacts/path.rb
+++ b/lib/gitlab/ci/build/artifacts/path.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/credentials/base.rb b/lib/gitlab/ci/build/credentials/base.rb
index 29a7a27c963..58adf6e506d 100644
--- a/lib/gitlab/ci/build/credentials/base.rb
+++ b/lib/gitlab/ci/build/credentials/base.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/credentials/factory.rb b/lib/gitlab/ci/build/credentials/factory.rb
index 2423aa8857d..fa805abb8bb 100644
--- a/lib/gitlab/ci/build/credentials/factory.rb
+++ b/lib/gitlab/ci/build/credentials/factory.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/credentials/registry.rb b/lib/gitlab/ci/build/credentials/registry.rb
index 55eafcaed10..1c8588d9913 100644
--- a/lib/gitlab/ci/build/credentials/registry.rb
+++ b/lib/gitlab/ci/build/credentials/registry.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/image.rb b/lib/gitlab/ci/build/image.rb
index c811f88f483..4dd932f61d4 100644
--- a/lib/gitlab/ci/build/image.rb
+++ b/lib/gitlab/ci/build/image.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/policy.rb b/lib/gitlab/ci/build/policy.rb
index d10cc7802d4..43c46ad74af 100644
--- a/lib/gitlab/ci/build/policy.rb
+++ b/lib/gitlab/ci/build/policy.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/policy/kubernetes.rb b/lib/gitlab/ci/build/policy/kubernetes.rb
index 782f6c4c0af..4c7dc947cd0 100644
--- a/lib/gitlab/ci/build/policy/kubernetes.rb
+++ b/lib/gitlab/ci/build/policy/kubernetes.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/policy/refs.rb b/lib/gitlab/ci/build/policy/refs.rb
index 4aa5dc89f47..10934536536 100644
--- a/lib/gitlab/ci/build/policy/refs.rb
+++ b/lib/gitlab/ci/build/policy/refs.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/policy/specification.rb b/lib/gitlab/ci/build/policy/specification.rb
index f09ba42c074..ceb5210cfb5 100644
--- a/lib/gitlab/ci/build/policy/specification.rb
+++ b/lib/gitlab/ci/build/policy/specification.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/policy/variables.rb b/lib/gitlab/ci/build/policy/variables.rb
index 9d2a362b7d4..0698136166a 100644
--- a/lib/gitlab/ci/build/policy/variables.rb
+++ b/lib/gitlab/ci/build/policy/variables.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/build/step.rb b/lib/gitlab/ci/build/step.rb
index 0b1ebe4e048..d587c896712 100644
--- a/lib/gitlab/ci/build/step.rb
+++ b/lib/gitlab/ci/build/step.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Build
diff --git a/lib/gitlab/ci/charts.rb b/lib/gitlab/ci/charts.rb
index 7b7354bce16..a4f01468e8e 100644
--- a/lib/gitlab/ci/charts.rb
+++ b/lib/gitlab/ci/charts.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Charts
diff --git a/lib/gitlab/ci/config.rb b/lib/gitlab/ci/config.rb
index fedaf18ef30..2fb3c4582e7 100644
--- a/lib/gitlab/ci/config.rb
+++ b/lib/gitlab/ci/config.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     #
diff --git a/lib/gitlab/ci/config/entry/artifacts.rb b/lib/gitlab/ci/config/entry/artifacts.rb
index e80f9d2e452..ef5f25b42c0 100644
--- a/lib/gitlab/ci/config/entry/artifacts.rb
+++ b/lib/gitlab/ci/config/entry/artifacts.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/attributable.rb b/lib/gitlab/ci/config/entry/attributable.rb
index 3e87a09704e..3c2e1df9b83 100644
--- a/lib/gitlab/ci/config/entry/attributable.rb
+++ b/lib/gitlab/ci/config/entry/attributable.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/boolean.rb b/lib/gitlab/ci/config/entry/boolean.rb
index f3357f85b99..b9639c83075 100644
--- a/lib/gitlab/ci/config/entry/boolean.rb
+++ b/lib/gitlab/ci/config/entry/boolean.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/cache.rb b/lib/gitlab/ci/config/entry/cache.rb
index d7e09acbbf3..0a25057f482 100644
--- a/lib/gitlab/ci/config/entry/cache.rb
+++ b/lib/gitlab/ci/config/entry/cache.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/commands.rb b/lib/gitlab/ci/config/entry/commands.rb
index 9f66f11be9b..d9658291ebe 100644
--- a/lib/gitlab/ci/config/entry/commands.rb
+++ b/lib/gitlab/ci/config/entry/commands.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/configurable.rb b/lib/gitlab/ci/config/entry/configurable.rb
index 697f622c45e..4aabf0cfa31 100644
--- a/lib/gitlab/ci/config/entry/configurable.rb
+++ b/lib/gitlab/ci/config/entry/configurable.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/coverage.rb b/lib/gitlab/ci/config/entry/coverage.rb
index 12a063059cb..690409ccf77 100644
--- a/lib/gitlab/ci/config/entry/coverage.rb
+++ b/lib/gitlab/ci/config/entry/coverage.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/environment.rb b/lib/gitlab/ci/config/entry/environment.rb
index 0c1f9eb7cbf..07e9e1d3f67 100644
--- a/lib/gitlab/ci/config/entry/environment.rb
+++ b/lib/gitlab/ci/config/entry/environment.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/factory.rb b/lib/gitlab/ci/config/entry/factory.rb
index 6be8288748f..85c9c3511a4 100644
--- a/lib/gitlab/ci/config/entry/factory.rb
+++ b/lib/gitlab/ci/config/entry/factory.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/global.rb b/lib/gitlab/ci/config/entry/global.rb
index 04077fa7a61..eba203d9d06 100644
--- a/lib/gitlab/ci/config/entry/global.rb
+++ b/lib/gitlab/ci/config/entry/global.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/hidden.rb b/lib/gitlab/ci/config/entry/hidden.rb
index 6fc3aa385bc..dc0ede2a25f 100644
--- a/lib/gitlab/ci/config/entry/hidden.rb
+++ b/lib/gitlab/ci/config/entry/hidden.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/image.rb b/lib/gitlab/ci/config/entry/image.rb
index 2844be80a84..fc453b72fa5 100644
--- a/lib/gitlab/ci/config/entry/image.rb
+++ b/lib/gitlab/ci/config/entry/image.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/job.rb b/lib/gitlab/ci/config/entry/job.rb
index f290ff3a565..e4610faa327 100644
--- a/lib/gitlab/ci/config/entry/job.rb
+++ b/lib/gitlab/ci/config/entry/job.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/jobs.rb b/lib/gitlab/ci/config/entry/jobs.rb
index 96b6f2e5d6c..1535b108000 100644
--- a/lib/gitlab/ci/config/entry/jobs.rb
+++ b/lib/gitlab/ci/config/entry/jobs.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/key.rb b/lib/gitlab/ci/config/entry/key.rb
index f27ad0a7759..963b200c7bb 100644
--- a/lib/gitlab/ci/config/entry/key.rb
+++ b/lib/gitlab/ci/config/entry/key.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/legacy_validation_helpers.rb b/lib/gitlab/ci/config/entry/legacy_validation_helpers.rb
index a3d4432be82..4043629dea9 100644
--- a/lib/gitlab/ci/config/entry/legacy_validation_helpers.rb
+++ b/lib/gitlab/ci/config/entry/legacy_validation_helpers.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/node.rb b/lib/gitlab/ci/config/entry/node.rb
index 26505c91be3..347089722e4 100644
--- a/lib/gitlab/ci/config/entry/node.rb
+++ b/lib/gitlab/ci/config/entry/node.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/paths.rb b/lib/gitlab/ci/config/entry/paths.rb
index 68dad161149..9580b5e2e7f 100644
--- a/lib/gitlab/ci/config/entry/paths.rb
+++ b/lib/gitlab/ci/config/entry/paths.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/policy.rb b/lib/gitlab/ci/config/entry/policy.rb
index c92562f8c85..0535d7c1a1a 100644
--- a/lib/gitlab/ci/config/entry/policy.rb
+++ b/lib/gitlab/ci/config/entry/policy.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/script.rb b/lib/gitlab/ci/config/entry/script.rb
index 29ecd9995ca..f7d39e5cf55 100644
--- a/lib/gitlab/ci/config/entry/script.rb
+++ b/lib/gitlab/ci/config/entry/script.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/service.rb b/lib/gitlab/ci/config/entry/service.rb
index 3e2ebcff31a..47bf9205147 100644
--- a/lib/gitlab/ci/config/entry/service.rb
+++ b/lib/gitlab/ci/config/entry/service.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/services.rb b/lib/gitlab/ci/config/entry/services.rb
index 0066894e069..bdf7f80f382 100644
--- a/lib/gitlab/ci/config/entry/services.rb
+++ b/lib/gitlab/ci/config/entry/services.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/simplifiable.rb b/lib/gitlab/ci/config/entry/simplifiable.rb
index 12764629686..9961bbfaa40 100644
--- a/lib/gitlab/ci/config/entry/simplifiable.rb
+++ b/lib/gitlab/ci/config/entry/simplifiable.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/stage.rb b/lib/gitlab/ci/config/entry/stage.rb
index b7afaba1de8..65ab5953131 100644
--- a/lib/gitlab/ci/config/entry/stage.rb
+++ b/lib/gitlab/ci/config/entry/stage.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/stages.rb b/lib/gitlab/ci/config/entry/stages.rb
index ec187bd3732..ab184246d29 100644
--- a/lib/gitlab/ci/config/entry/stages.rb
+++ b/lib/gitlab/ci/config/entry/stages.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/undefined.rb b/lib/gitlab/ci/config/entry/undefined.rb
index 1171ac10f22..77dcfa88170 100644
--- a/lib/gitlab/ci/config/entry/undefined.rb
+++ b/lib/gitlab/ci/config/entry/undefined.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/unspecified.rb b/lib/gitlab/ci/config/entry/unspecified.rb
index fbb2551e870..bab32489d2f 100644
--- a/lib/gitlab/ci/config/entry/unspecified.rb
+++ b/lib/gitlab/ci/config/entry/unspecified.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/validatable.rb b/lib/gitlab/ci/config/entry/validatable.rb
index e45787773a8..08a6593c980 100644
--- a/lib/gitlab/ci/config/entry/validatable.rb
+++ b/lib/gitlab/ci/config/entry/validatable.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/validator.rb b/lib/gitlab/ci/config/entry/validator.rb
index 2df23a3edcd..33ffdd3a95d 100644
--- a/lib/gitlab/ci/config/entry/validator.rb
+++ b/lib/gitlab/ci/config/entry/validator.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/validators.rb b/lib/gitlab/ci/config/entry/validators.rb
index f6b4ba7843e..805d26ca8d8 100644
--- a/lib/gitlab/ci/config/entry/validators.rb
+++ b/lib/gitlab/ci/config/entry/validators.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/entry/variables.rb b/lib/gitlab/ci/config/entry/variables.rb
index 8acab605c91..6fd3cec2f5f 100644
--- a/lib/gitlab/ci/config/entry/variables.rb
+++ b/lib/gitlab/ci/config/entry/variables.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/config/loader.rb b/lib/gitlab/ci/config/loader.rb
index 141d2714cb6..b4c491e84a6 100644
--- a/lib/gitlab/ci/config/loader.rb
+++ b/lib/gitlab/ci/config/loader.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Config
diff --git a/lib/gitlab/ci/cron_parser.rb b/lib/gitlab/ci/cron_parser.rb
index 73f36735e35..b1db9084662 100644
--- a/lib/gitlab/ci/cron_parser.rb
+++ b/lib/gitlab/ci/cron_parser.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class CronParser
diff --git a/lib/gitlab/ci/mask_secret.rb b/lib/gitlab/ci/mask_secret.rb
index 0daddaa638c..58d55b1bd6f 100644
--- a/lib/gitlab/ci/mask_secret.rb
+++ b/lib/gitlab/ci/mask_secret.rb
@@ -1,9 +1,13 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci::MaskSecret
     class << self
       def mask!(value, token)
         return value unless value.present? && token.present?
 
+        # We assume 'value' must be mutable, given
+        # that frozen string is enabled.
         value.gsub!(token, 'x' * token.length)
         value
       end
diff --git a/lib/gitlab/ci/model.rb b/lib/gitlab/ci/model.rb
index 3994a50772b..fbdb84c0522 100644
--- a/lib/gitlab/ci/model.rb
+++ b/lib/gitlab/ci/model.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Model
diff --git a/lib/gitlab/ci/pipeline/chain/base.rb b/lib/gitlab/ci/pipeline/chain/base.rb
index efed19da21c..bab1c73e2f1 100644
--- a/lib/gitlab/ci/pipeline/chain/base.rb
+++ b/lib/gitlab/ci/pipeline/chain/base.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/chain/build.rb b/lib/gitlab/ci/pipeline/chain/build.rb
index b5eb0cfa2f0..b445a872b3d 100644
--- a/lib/gitlab/ci/pipeline/chain/build.rb
+++ b/lib/gitlab/ci/pipeline/chain/build.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/chain/command.rb b/lib/gitlab/ci/pipeline/chain/command.rb
index a53c80d34f7..05978804d92 100644
--- a/lib/gitlab/ci/pipeline/chain/command.rb
+++ b/lib/gitlab/ci/pipeline/chain/command.rb
@@ -1,4 +1,7 @@
-module Gitlab # rubocop:disable Naming/FileName
+# rubocop:disable Naming/FileName
+# frozen_string_literal: true
+
+module Gitlab
   module Ci
     module Pipeline
       module Chain
diff --git a/lib/gitlab/ci/pipeline/chain/create.rb b/lib/gitlab/ci/pipeline/chain/create.rb
index 02493c7fe02..c882241ef6a 100644
--- a/lib/gitlab/ci/pipeline/chain/create.rb
+++ b/lib/gitlab/ci/pipeline/chain/create.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/chain/helpers.rb b/lib/gitlab/ci/pipeline/chain/helpers.rb
index bf1380a1da9..6bb3a75291b 100644
--- a/lib/gitlab/ci/pipeline/chain/helpers.rb
+++ b/lib/gitlab/ci/pipeline/chain/helpers.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/chain/populate.rb b/lib/gitlab/ci/pipeline/chain/populate.rb
index f34c11ca3c2..633d3cd4f6b 100644
--- a/lib/gitlab/ci/pipeline/chain/populate.rb
+++ b/lib/gitlab/ci/pipeline/chain/populate.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/chain/sequence.rb b/lib/gitlab/ci/pipeline/chain/sequence.rb
index e24630656d3..99780409085 100644
--- a/lib/gitlab/ci/pipeline/chain/sequence.rb
+++ b/lib/gitlab/ci/pipeline/chain/sequence.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/chain/skip.rb b/lib/gitlab/ci/pipeline/chain/skip.rb
index 32cbb7ca6af..b9707d2f8f5 100644
--- a/lib/gitlab/ci/pipeline/chain/skip.rb
+++ b/lib/gitlab/ci/pipeline/chain/skip.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/chain/validate/abilities.rb b/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
index 13c6fedd831..ebd7e6e8289 100644
--- a/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
+++ b/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/chain/validate/config.rb b/lib/gitlab/ci/pipeline/chain/validate/config.rb
index a3bd2a5a23a..28c38cc3d18 100644
--- a/lib/gitlab/ci/pipeline/chain/validate/config.rb
+++ b/lib/gitlab/ci/pipeline/chain/validate/config.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/chain/validate/repository.rb b/lib/gitlab/ci/pipeline/chain/validate/repository.rb
index 9699c24e5b6..d88851d8245 100644
--- a/lib/gitlab/ci/pipeline/chain/validate/repository.rb
+++ b/lib/gitlab/ci/pipeline/chain/validate/repository.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/duration.rb b/lib/gitlab/ci/pipeline/duration.rb
index 30701e1de1b..de24bbf688b 100644
--- a/lib/gitlab/ci/pipeline/duration.rb
+++ b/lib/gitlab/ci/pipeline/duration.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression.rb b/lib/gitlab/ci/pipeline/expression.rb
index f57df7c5637..61d392121d8 100644
--- a/lib/gitlab/ci/pipeline/expression.rb
+++ b/lib/gitlab/ci/pipeline/expression.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/base.rb b/lib/gitlab/ci/pipeline/expression/lexeme/base.rb
index 047ab66e9b3..70c774416f6 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/base.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/base.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/equals.rb b/lib/gitlab/ci/pipeline/expression/lexeme/equals.rb
index 3a2f0c6924e..668e85f5b9e 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/equals.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/equals.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb b/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
index 10957598f76..cd17bc4d78b 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/null.rb b/lib/gitlab/ci/pipeline/expression/lexeme/null.rb
index a2778716924..be7258c201a 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/null.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/null.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/operator.rb b/lib/gitlab/ci/pipeline/expression/lexeme/operator.rb
index f640d0b5855..3ebceb92eb7 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/operator.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/operator.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/pattern.rb b/lib/gitlab/ci/pipeline/expression/lexeme/pattern.rb
index 9b239c29ea4..d7e6dacf068 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/pattern.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/pattern.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/string.rb b/lib/gitlab/ci/pipeline/expression/lexeme/string.rb
index 346c92dc51e..2db2bf011f1 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/string.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/string.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/value.rb b/lib/gitlab/ci/pipeline/expression/lexeme/value.rb
index f2611d65faf..ef9ddb6cae9 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/value.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/value.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/variable.rb b/lib/gitlab/ci/pipeline/expression/lexeme/variable.rb
index 37643c8ef53..85c0899e4f6 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/variable.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/variable.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/lexer.rb b/lib/gitlab/ci/pipeline/expression/lexer.rb
index 4cacb1e62c9..f26542361a2 100644
--- a/lib/gitlab/ci/pipeline/expression/lexer.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexer.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/parser.rb b/lib/gitlab/ci/pipeline/expression/parser.rb
index 90f94d0b763..ed184309ab4 100644
--- a/lib/gitlab/ci/pipeline/expression/parser.rb
+++ b/lib/gitlab/ci/pipeline/expression/parser.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/statement.rb b/lib/gitlab/ci/pipeline/expression/statement.rb
index b36f1e0f865..b03611f756e 100644
--- a/lib/gitlab/ci/pipeline/expression/statement.rb
+++ b/lib/gitlab/ci/pipeline/expression/statement.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/expression/token.rb b/lib/gitlab/ci/pipeline/expression/token.rb
index 58211800b88..513d43f6fca 100644
--- a/lib/gitlab/ci/pipeline/expression/token.rb
+++ b/lib/gitlab/ci/pipeline/expression/token.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/seed/base.rb b/lib/gitlab/ci/pipeline/seed/base.rb
index db9706924bb..1fd3a61017f 100644
--- a/lib/gitlab/ci/pipeline/seed/base.rb
+++ b/lib/gitlab/ci/pipeline/seed/base.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/seed/build.rb b/lib/gitlab/ci/pipeline/seed/build.rb
index 6980b0b7aff..ef738a93bfe 100644
--- a/lib/gitlab/ci/pipeline/seed/build.rb
+++ b/lib/gitlab/ci/pipeline/seed/build.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/pipeline/seed/stage.rb b/lib/gitlab/ci/pipeline/seed/stage.rb
index 2b58d9863a0..4775ff15581 100644
--- a/lib/gitlab/ci/pipeline/seed/stage.rb
+++ b/lib/gitlab/ci/pipeline/seed/stage.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Pipeline
diff --git a/lib/gitlab/ci/reports/test_case.rb b/lib/gitlab/ci/reports/test_case.rb
index b4d08ed257f..292e273a03a 100644
--- a/lib/gitlab/ci/reports/test_case.rb
+++ b/lib/gitlab/ci/reports/test_case.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Reports
diff --git a/lib/gitlab/ci/reports/test_reports.rb b/lib/gitlab/ci/reports/test_reports.rb
index c87bdb4a8a2..7397ff35d46 100644
--- a/lib/gitlab/ci/reports/test_reports.rb
+++ b/lib/gitlab/ci/reports/test_reports.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Reports
diff --git a/lib/gitlab/ci/reports/test_reports_comparer.rb b/lib/gitlab/ci/reports/test_reports_comparer.rb
index 726c6a11a81..11810bdc0a8 100644
--- a/lib/gitlab/ci/reports/test_reports_comparer.rb
+++ b/lib/gitlab/ci/reports/test_reports_comparer.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Reports
diff --git a/lib/gitlab/ci/reports/test_suite.rb b/lib/gitlab/ci/reports/test_suite.rb
index b5f15397c0f..b0391160c15 100644
--- a/lib/gitlab/ci/reports/test_suite.rb
+++ b/lib/gitlab/ci/reports/test_suite.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Reports
diff --git a/lib/gitlab/ci/reports/test_suite_comparer.rb b/lib/gitlab/ci/reports/test_suite_comparer.rb
index 642aa593092..9cb7db5934c 100644
--- a/lib/gitlab/ci/reports/test_suite_comparer.rb
+++ b/lib/gitlab/ci/reports/test_suite_comparer.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Reports
diff --git a/lib/gitlab/ci/trace.rb b/lib/gitlab/ci/trace.rb
index 93e219a21f9..8eccd262db9 100644
--- a/lib/gitlab/ci/trace.rb
+++ b/lib/gitlab/ci/trace.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Trace
diff --git a/lib/gitlab/ci/yaml_processor.rb b/lib/gitlab/ci/yaml_processor.rb
index a427aa30683..39a1b52e531 100644
--- a/lib/gitlab/ci/yaml_processor.rb
+++ b/lib/gitlab/ci/yaml_processor.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class YamlProcessor
-- 
cgit v1.2.1


From 4611a59968c65d1eda83af6c33bb844d9610fa12 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Sun, 28 Oct 2018 18:31:08 +0000
Subject: Add failure reason for execution timeout

---
 lib/gitlab/ci/status/build/failed.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/ci/status/build/failed.rb b/lib/gitlab/ci/status/build/failed.rb
index 50b0d044265..4babc23a495 100644
--- a/lib/gitlab/ci/status/build/failed.rb
+++ b/lib/gitlab/ci/status/build/failed.rb
@@ -11,7 +11,8 @@ module Gitlab
             runner_system_failure: 'runner system failure',
             missing_dependency_failure: 'missing dependency failure',
             runner_unsupported: 'unsupported runner',
-            stale_schedule: 'stale schedule'
+            stale_schedule: 'stale schedule',
+            job_execution_timeout: 'job execution timeout'
           }.freeze
 
           private_constant :REASONS
-- 
cgit v1.2.1


From 9a25cfc80b21b8f0d43309c0c3f3fe674a6c1e7f Mon Sep 17 00:00:00 2001
From: Andrew Newdigate <andrew@gitlab.com>
Date: Mon, 29 Oct 2018 13:44:09 +0000
Subject: Fix open-ended params for api_json.log

---
 lib/gitlab/grape_logging/formatters/lograge_with_timestamp.rb | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/grape_logging/formatters/lograge_with_timestamp.rb b/lib/gitlab/grape_logging/formatters/lograge_with_timestamp.rb
index 0014ce2689b..41004408dec 100644
--- a/lib/gitlab/grape_logging/formatters/lograge_with_timestamp.rb
+++ b/lib/gitlab/grape_logging/formatters/lograge_with_timestamp.rb
@@ -6,7 +6,7 @@ module Gitlab
 
         def call(severity, datetime, _, data)
           time = data.delete :time
-          data[:params] = utf8_encode_values(data[:params]) if data.has_key?(:params)
+          data[:params] = process_params(data)
 
           attributes = {
             time: datetime.utc.iso8601(3),
@@ -20,6 +20,14 @@ module Gitlab
 
         private
 
+        def process_params(data)
+          return [] unless data.has_key?(:params)
+
+          data[:params]
+            .each_pair
+            .map { |k, v| { key: k, value: utf8_encode_values(v) } }
+        end
+
         def utf8_encode_values(data)
           case data
           when Hash
-- 
cgit v1.2.1


From 0acdd3d3dd7b8207e8dcdee269e9cc9894d6f199 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kamil=20Trzci=C5=84ski?= <ayufan@ayufan.eu>
Date: Tue, 23 Oct 2018 10:38:10 +0000
Subject: Rename 'sast_container' licensed feature

---
 lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml b/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
index 6fa59e41d20..db48b187e5e 100644
--- a/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
@@ -210,7 +210,7 @@ container_scanning:
     refs:
       - branches
     variables:
-      - $GITLAB_FEATURES =~ /\bsast_container\b/
+      - $GITLAB_FEATURES =~ /\bcontainer_scanning\b/
   except:
     variables:
       - $CONTAINER_SCANNING_DISABLED
-- 
cgit v1.2.1


From b9652d8e4dc8544766c9371057be72cc26fe3a4b Mon Sep 17 00:00:00 2001
From: Imre Farkas <ifarkas@gitlab.com>
Date: Mon, 29 Oct 2018 16:06:45 +0000
Subject: [master] Persist only SHA digest of PersonalAccessToken#token

---
 lib/gitlab/auth/user_auth_finders.rb             |  4 +---
 lib/gitlab/background_migration/digest_column.rb | 25 ++++++++++++++++++++
 lib/gitlab/crypto_helper.rb                      | 30 ++++++++++++++++++++++++
 lib/tasks/tokens.rake                            | 14 ++++-------
 4 files changed, 61 insertions(+), 12 deletions(-)
 create mode 100644 lib/gitlab/background_migration/digest_column.rb
 create mode 100644 lib/gitlab/crypto_helper.rb

(limited to 'lib')

diff --git a/lib/gitlab/auth/user_auth_finders.rb b/lib/gitlab/auth/user_auth_finders.rb
index 5df6db6f366..c304adc64db 100644
--- a/lib/gitlab/auth/user_auth_finders.rb
+++ b/lib/gitlab/auth/user_auth_finders.rb
@@ -73,7 +73,6 @@ module Gitlab
         end
       end
 
-      # rubocop: disable CodeReuse/ActiveRecord
       def find_personal_access_token
         token =
           current_request.params[PRIVATE_TOKEN_PARAM].presence ||
@@ -82,9 +81,8 @@ module Gitlab
         return unless token
 
         # Expiration, revocation and scopes are verified in `validate_access_token!`
-        PersonalAccessToken.find_by(token: token) || raise(UnauthorizedError)
+        PersonalAccessToken.find_by_token(token) || raise(UnauthorizedError)
       end
-      # rubocop: enable CodeReuse/ActiveRecord
 
       def find_oauth_access_token
         token = Doorkeeper::OAuth::Token.from_request(current_request, *Doorkeeper.configuration.access_token_methods)
diff --git a/lib/gitlab/background_migration/digest_column.rb b/lib/gitlab/background_migration/digest_column.rb
new file mode 100644
index 00000000000..22a3bb8f8f3
--- /dev/null
+++ b/lib/gitlab/background_migration/digest_column.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# rubocop:disable Style/Documentation
+module Gitlab
+  module BackgroundMigration
+    class DigestColumn
+      class PersonalAccessToken < ActiveRecord::Base
+        self.table_name = 'personal_access_tokens'
+      end
+
+      def perform(model, attribute_from, attribute_to, start_id, stop_id)
+        model = model.constantize if model.is_a?(String)
+
+        model.transaction do
+          relation = model.where(id: start_id..stop_id).where.not(attribute_from => nil).lock
+
+          relation.each do |instance|
+            instance.update_columns(attribute_to => Gitlab::CryptoHelper.sha256(instance.read_attribute(attribute_from)),
+                                    attribute_from => nil)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/crypto_helper.rb b/lib/gitlab/crypto_helper.rb
new file mode 100644
index 00000000000..68d0b5d8f8a
--- /dev/null
+++ b/lib/gitlab/crypto_helper.rb
@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module CryptoHelper
+    extend self
+
+    AES256_GCM_OPTIONS = {
+      algorithm: 'aes-256-gcm',
+      key: Settings.attr_encrypted_db_key_base_truncated,
+      iv: Settings.attr_encrypted_db_key_base_truncated[0..11]
+    }.freeze
+
+    def sha256(value)
+      salt = Settings.attr_encrypted_db_key_base_truncated
+      ::Digest::SHA256.base64digest("#{value}#{salt}")
+    end
+
+    def aes256_gcm_encrypt(value)
+      encrypted_token = Encryptor.encrypt(AES256_GCM_OPTIONS.merge(value: value))
+      Base64.encode64(encrypted_token)
+    end
+
+    def aes256_gcm_decrypt(value)
+      return unless value
+
+      encrypted_token = Base64.decode64(value)
+      Encryptor.decrypt(AES256_GCM_OPTIONS.merge(value: encrypted_token))
+    end
+  end
+end
diff --git a/lib/tasks/tokens.rake b/lib/tasks/tokens.rake
index 81829668de8..eec024f9bbb 100644
--- a/lib/tasks/tokens.rake
+++ b/lib/tasks/tokens.rake
@@ -1,4 +1,7 @@
 require_relative '../../app/models/concerns/token_authenticatable.rb'
+require_relative '../../app/models/concerns/token_authenticatable_strategies/base.rb'
+require_relative '../../app/models/concerns/token_authenticatable_strategies/insecure.rb'
+require_relative '../../app/models/concerns/token_authenticatable_strategies/digest.rb'
 
 namespace :tokens do
   desc "Reset all GitLab incoming email tokens"
@@ -26,13 +29,6 @@ class TmpUser < ActiveRecord::Base
 
   self.table_name = 'users'
 
-  def reset_incoming_email_token!
-    write_new_token(:incoming_email_token)
-    save!(validate: false)
-  end
-
-  def reset_feed_token!
-    write_new_token(:feed_token)
-    save!(validate: false)
-  end
+  add_authentication_token_field :incoming_email_token, token_generator: -> { SecureRandom.hex.to_i(16).to_s(36) }
+  add_authentication_token_field :feed_token
 end
-- 
cgit v1.2.1


From c847f172d25efc211045c363f4e55402ad250c09 Mon Sep 17 00:00:00 2001
From: Robert Speicher <robert@gitlab.com>
Date: Fri, 26 Oct 2018 18:42:57 +0000
Subject: Merge branch 'fix_pat_auth-11-4' into 'security-11-4'

[11.4] Fix Token lookup for Git over HTTP and registry authentication

See merge request gitlab/gitlabhq!2577
---
 lib/gitlab/auth.rb | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/auth.rb b/lib/gitlab/auth.rb
index d2029a141e7..6eb5f9e2300 100644
--- a/lib/gitlab/auth.rb
+++ b/lib/gitlab/auth.rb
@@ -151,17 +151,15 @@ module Gitlab
       end
       # rubocop: enable CodeReuse/ActiveRecord
 
-      # rubocop: disable CodeReuse/ActiveRecord
       def personal_access_token_check(password)
         return unless password.present?
 
-        token = PersonalAccessTokensFinder.new(state: 'active').find_by(token: password)
+        token = PersonalAccessTokensFinder.new(state: 'active').find_by_token(password)
 
         if token && valid_scoped_token?(token, available_scopes)
           Gitlab::Auth::Result.new(token.user, nil, :personal_access_token, abilities_for_scopes(token.scopes))
         end
       end
-      # rubocop: enable CodeReuse/ActiveRecord
 
       def valid_oauth_token?(token)
         token && token.accessible? && valid_scoped_token?(token, [:api])
-- 
cgit v1.2.1


From 6580de78bb52323fcafaaf4d2e770590e4f1c586 Mon Sep 17 00:00:00 2001
From: Mark Chao <mchao@gitlab.com>
Date: Thu, 6 Sep 2018 10:59:52 +0800
Subject: Add access to Blob's language from gitattributes

Ported from Highlight class since it as a concept is more related to
blob, and this allows more flexibility.
---
 lib/gitlab/search_results.rb | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'lib')

diff --git a/lib/gitlab/search_results.rb b/lib/gitlab/search_results.rb
index 5ce3eda2ccb..f2795c739f5 100644
--- a/lib/gitlab/search_results.rb
+++ b/lib/gitlab/search_results.rb
@@ -25,6 +25,12 @@ module Gitlab
       def no_highlighting?
         false
       end
+
+      # Since search results often contain many items,
+      # not triggering lookup can avoid n+1 queries.
+      def language_from_gitattributes
+        nil
+      end
     end
 
     attr_reader :current_user, :query, :per_page
-- 
cgit v1.2.1


From 32f9cf8ce3dd337bf3b1683c5872171c253f0d27 Mon Sep 17 00:00:00 2001
From: Mark Chao <mchao@gitlab.com>
Date: Thu, 6 Sep 2018 17:48:57 +0800
Subject: Add BlobPresenter for highlighting

Force FoundBlob to use BlobPresenter
---
 lib/gitlab/search_results.rb | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'lib')

diff --git a/lib/gitlab/search_results.rb b/lib/gitlab/search_results.rb
index f2795c739f5..3dbb0608a4f 100644
--- a/lib/gitlab/search_results.rb
+++ b/lib/gitlab/search_results.rb
@@ -4,6 +4,7 @@ module Gitlab
   class SearchResults
     class FoundBlob
       include EncodingHelper
+      include Presentable
 
       attr_reader :id, :filename, :basename, :ref, :startline, :data, :project_id
 
@@ -31,6 +32,10 @@ module Gitlab
       def language_from_gitattributes
         nil
       end
+
+      def present
+        super(presenter_class: BlobPresenter)
+      end
     end
 
     attr_reader :current_user, :query, :per_page
-- 
cgit v1.2.1


From 39ae9a59a59615092fbef189466f37c34f4a7fb1 Mon Sep 17 00:00:00 2001
From: Mark Chao <mchao@gitlab.com>
Date: Thu, 6 Sep 2018 12:34:25 +0800
Subject: Make Highlight accept language param

This replaces the repository param.
This allows more flexiblity as sometimes we have highlight content
not related to repository. Sometimes we know ahead of time the language
of the content. Lastly language determination seems better fit as a
logic in the Blob class.
`repository` param is only used to determine the language, which seems
to be the responsiblity of Blob.
---
 lib/gitlab/blame.rb          |  3 +--
 lib/gitlab/conflict/file.rb  | 36 +++++++++++++++++++++++++++++++-----
 lib/gitlab/diff/highlight.rb |  2 +-
 lib/gitlab/highlight.rb      | 14 ++++++--------
 4 files changed, 39 insertions(+), 16 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/blame.rb b/lib/gitlab/blame.rb
index 0d79594363e..f1a653a9d95 100644
--- a/lib/gitlab/blame.rb
+++ b/lib/gitlab/blame.rb
@@ -43,8 +43,7 @@ module Gitlab
 
     def highlighted_lines
       @blob.load_all_data!
-      @highlighted_lines ||=
-        Gitlab::Highlight.highlight(@blob.path, @blob.data, repository: repository).lines
+      @highlighted_lines ||= @blob.present.highlight.lines
     end
 
     def project
diff --git a/lib/gitlab/conflict/file.rb b/lib/gitlab/conflict/file.rb
index 30911b49b18..501c2111530 100644
--- a/lib/gitlab/conflict/file.rb
+++ b/lib/gitlab/conflict/file.rb
@@ -3,6 +3,7 @@ module Gitlab
     class File
       include Gitlab::Routing
       include IconsHelper
+      include Gitlab::Utils::StrongMemoize
 
       CONTEXT_LINES = 3
 
@@ -30,11 +31,8 @@ module Gitlab
       end
 
       def highlight_lines!
-        their_file = lines.reject { |line| line.type == 'new' }.map(&:text).join("\n")
-        our_file = lines.reject { |line| line.type == 'old' }.map(&:text).join("\n")
-
-        their_highlight = Gitlab::Highlight.highlight(their_path, their_file, repository: repository).lines
-        our_highlight = Gitlab::Highlight.highlight(our_path, our_file, repository: repository).lines
+        their_highlight = Gitlab::Highlight.highlight(their_path, their_lines, language: their_language).lines
+        our_highlight = Gitlab::Highlight.highlight(our_path, our_lines, language: our_language).lines
 
         lines.each do |line|
           line.rich_text =
@@ -182,6 +180,34 @@ module Gitlab
             raw_line[:line_new], parent_file: self)
         end
       end
+
+      def their_language
+        strong_memoize(:their_language) do
+          repository.gitattribute(their_path, 'gitlab-language')
+        end
+      end
+
+      def our_language
+        strong_memoize(:our_language) do
+          if our_path == their_path
+            their_language
+          else
+            repository.gitattribute(our_path, 'gitlab-language')
+          end
+        end
+      end
+
+      def their_lines
+        strong_memoize(:their_lines) do
+          lines.reject { |line| line.type == 'new' }.map(&:text).join("\n")
+        end
+      end
+
+      def our_lines
+        strong_memoize(:our_lines) do
+          lines.reject { |line| line.type == 'old' }.map(&:text).join("\n")
+        end
+      end
     end
   end
 end
diff --git a/lib/gitlab/diff/highlight.rb b/lib/gitlab/diff/highlight.rb
index a605ddb5c33..1d833183ec3 100644
--- a/lib/gitlab/diff/highlight.rb
+++ b/lib/gitlab/diff/highlight.rb
@@ -79,7 +79,7 @@ module Gitlab
         return [] unless blob
 
         blob.load_all_data!
-        Gitlab::Highlight.highlight(blob.path, blob.data, repository: repository).lines
+        blob.present.highlight.lines
       end
     end
   end
diff --git a/lib/gitlab/highlight.rb b/lib/gitlab/highlight.rb
index 83095acc528..d28223194cc 100644
--- a/lib/gitlab/highlight.rb
+++ b/lib/gitlab/highlight.rb
@@ -5,16 +5,16 @@ module Gitlab
     TIMEOUT_BACKGROUND = 30.seconds
     TIMEOUT_FOREGROUND = 3.seconds
 
-    def self.highlight(blob_name, blob_content, repository: nil, plain: false)
-      new(blob_name, blob_content, repository: repository)
+    def self.highlight(blob_name, blob_content, language: nil, plain: false)
+      new(blob_name, blob_content, language: language)
         .highlight(blob_content, continue: false, plain: plain)
     end
 
     attr_reader :blob_name
 
-    def initialize(blob_name, blob_content, repository: nil)
+    def initialize(blob_name, blob_content, language: nil)
       @formatter = Rouge::Formatters::HTMLGitlab
-      @repository = repository
+      @language = language
       @blob_name = blob_name
       @blob_content = blob_content
     end
@@ -36,11 +36,9 @@ module Gitlab
     private
 
     def custom_language
-      language_name = @repository && @repository.gitattribute(@blob_name, 'gitlab-language')
+      return nil unless @language
 
-      return nil unless language_name
-
-      Rouge::Lexer.find_fancy(language_name)
+      Rouge::Lexer.find_fancy(@language)
     end
 
     def highlight_text(text, continue: true, plain: false)
-- 
cgit v1.2.1


From bc14e4ed1024efa1e0a411bd59e1339fb1af20c0 Mon Sep 17 00:00:00 2001
From: Mark Chao <mchao@gitlab.com>
Date: Tue, 11 Sep 2018 12:37:44 +0800
Subject: Move :plain option to Highlight class

This is to DRY the repeated file size check.

Move spec and constants to Highlight
---
 lib/gitlab/highlight.rb      | 3 +++
 lib/gitlab/search_results.rb | 4 ----
 2 files changed, 3 insertions(+), 4 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/highlight.rb b/lib/gitlab/highlight.rb
index d28223194cc..a4e60bbd828 100644
--- a/lib/gitlab/highlight.rb
+++ b/lib/gitlab/highlight.rb
@@ -4,6 +4,7 @@ module Gitlab
   class Highlight
     TIMEOUT_BACKGROUND = 30.seconds
     TIMEOUT_FOREGROUND = 3.seconds
+    MAXIMUM_TEXT_HIGHLIGHT_SIZE = 1.megabyte
 
     def self.highlight(blob_name, blob_content, language: nil, plain: false)
       new(blob_name, blob_content, language: language)
@@ -20,6 +21,8 @@ module Gitlab
     end
 
     def highlight(text, continue: true, plain: false)
+      plain ||= text.length > MAXIMUM_TEXT_HIGHLIGHT_SIZE
+
       highlighted_text = highlight_text(text, continue: continue, plain: plain)
       highlighted_text = link_dependencies(text, highlighted_text) if blob_name
       highlighted_text
diff --git a/lib/gitlab/search_results.rb b/lib/gitlab/search_results.rb
index 3dbb0608a4f..6c86ad11385 100644
--- a/lib/gitlab/search_results.rb
+++ b/lib/gitlab/search_results.rb
@@ -23,10 +23,6 @@ module Gitlab
         filename
       end
 
-      def no_highlighting?
-        false
-      end
-
       # Since search results often contain many items,
       # not triggering lookup can avoid n+1 queries.
       def language_from_gitattributes
-- 
cgit v1.2.1


From a4ba973e24ef6767d635c0291c9b6ce8085aef28 Mon Sep 17 00:00:00 2001
From: Mark Chao <mchao@gitlab.com>
Date: Thu, 4 Oct 2018 17:16:51 +0800
Subject: Allow FoundBlob to access language from gitattributes

Extract language_from_git_attributes as a concern so it can
ben included in two blob classes.
---
 lib/gitlab/project_search_results.rb |  2 +-
 lib/gitlab/search_results.rb         | 11 +++++------
 2 files changed, 6 insertions(+), 7 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/project_search_results.rb b/lib/gitlab/project_search_results.rb
index 3a202d915e3..04df881bf03 100644
--- a/lib/gitlab/project_search_results.rb
+++ b/lib/gitlab/project_search_results.rb
@@ -82,7 +82,7 @@ module Gitlab
         ref: ref,
         startline: startline,
         data: data.join,
-        project_id: project ? project.id : nil
+        project: project
       )
     end
 
diff --git a/lib/gitlab/search_results.rb b/lib/gitlab/search_results.rb
index 6c86ad11385..b46c18c4364 100644
--- a/lib/gitlab/search_results.rb
+++ b/lib/gitlab/search_results.rb
@@ -5,8 +5,9 @@ module Gitlab
     class FoundBlob
       include EncodingHelper
       include Presentable
+      include BlobLanguageFromGitAttributes
 
-      attr_reader :id, :filename, :basename, :ref, :startline, :data, :project_id
+      attr_reader :id, :filename, :basename, :ref, :startline, :data, :project
 
       def initialize(opts = {})
         @id = opts.fetch(:id, nil)
@@ -16,17 +17,15 @@ module Gitlab
         @startline = opts.fetch(:startline, nil)
         @data = encode_utf8(opts.fetch(:data, nil))
         @per_page = opts.fetch(:per_page, 20)
-        @project_id = opts.fetch(:project_id, nil)
+        @project = opts.fetch(:project, nil)
       end
 
       def path
         filename
       end
 
-      # Since search results often contain many items,
-      # not triggering lookup can avoid n+1 queries.
-      def language_from_gitattributes
-        nil
+      def project_id
+        @project&.id
       end
 
       def present
-- 
cgit v1.2.1


From 0fa5260f1d1e99bcd0429cba09140c039a3d9d5a Mon Sep 17 00:00:00 2001
From: Mark Chao <mchao@gitlab.com>
Date: Tue, 16 Oct 2018 13:56:13 +0800
Subject: Allow search results to accept project_id

This gives flexiblity to avoid duplicated query of Project.
---
 lib/gitlab/search_results.rb | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/search_results.rb b/lib/gitlab/search_results.rb
index b46c18c4364..458737f31eb 100644
--- a/lib/gitlab/search_results.rb
+++ b/lib/gitlab/search_results.rb
@@ -18,6 +18,11 @@ module Gitlab
         @data = encode_utf8(opts.fetch(:data, nil))
         @per_page = opts.fetch(:per_page, 20)
         @project = opts.fetch(:project, nil)
+        # Some caller does not have project object (e.g. elastic search),
+        # yet they can trigger many calls in one go,
+        # causing duplicated queries.
+        # Allow those to just pass project_id instead.
+        @project_id = opts.fetch(:project_id, nil)
       end
 
       def path
@@ -25,7 +30,7 @@ module Gitlab
       end
 
       def project_id
-        @project&.id
+        @project_id || @project&.id
       end
 
       def present
-- 
cgit v1.2.1


From d01d1cc8ee61914f9f520611be36eee054ba5583 Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <hleeyu@gmail.com>
Date: Tue, 30 Oct 2018 20:24:34 +0800
Subject: Extract EE params in issues API to separate module

---
 lib/api/issues.rb | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

(limited to 'lib')

diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index 405fc30a2ed..e37083165f5 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -8,6 +8,15 @@ module API
 
     helpers ::Gitlab::IssuableMetadata
 
+    # EE::API::Issues would override the following helpers
+    helpers do
+      params :issues_params_ee do
+      end
+
+      params :issue_params_ee do
+      end
+    end
+
     helpers do
       # rubocop: disable CodeReuse/ActiveRecord
       def find_issues(args = {})
@@ -46,9 +55,11 @@ module API
                          desc: 'Return issues for the given scope: `created_by_me`, `assigned_to_me` or `all`'
         optional :my_reaction_emoji, type: String, desc: 'Return issues reacted by the authenticated user by the given emoji'
         use :pagination
+
+        use :issues_params_ee
       end
 
-      params :issue_params_ce do
+      params :issue_params do
         optional :description, type: String, desc: 'The description of an issue'
         optional :assignee_ids, type: Array[Integer], desc: 'The array of user IDs to assign issue'
         optional :assignee_id,  type: Integer, desc: '[Deprecated] The ID of a user to assign issue'
@@ -57,10 +68,8 @@ module API
         optional :due_date, type: String, desc: 'Date string in the format YEAR-MONTH-DAY'
         optional :confidential, type: Boolean, desc: 'Boolean parameter if the issue should be confidential'
         optional :discussion_locked, type: Boolean, desc: " Boolean parameter indicating if the issue's discussion is locked"
-      end
 
-      params :issue_params do
-        use :issue_params_ce
+        use :issue_params_ee
       end
     end
 
-- 
cgit v1.2.1


From 81f5955eb6677849c15d35b60223312f6a9d77a3 Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Tue, 30 Oct 2018 14:37:40 +0100
Subject: Move Repository#wrapped_gitaly_errors into concern

Having this in a concern allows us to reuse it for different single
purpose classes that call out to git without going through the
repository every time.
---
 lib/gitlab/git/blob.rb                |  3 ++-
 lib/gitlab/git/commit.rb              |  9 +++++----
 lib/gitlab/git/commit_stats.rb        |  4 +++-
 lib/gitlab/git/conflict/resolver.rb   |  6 ++++--
 lib/gitlab/git/remote_mirror.rb       |  4 +++-
 lib/gitlab/git/repository.rb          | 21 ++++-----------------
 lib/gitlab/git/tree.rb                |  3 ++-
 lib/gitlab/git/wiki.rb                | 18 ++++++++++--------
 lib/gitlab/git/wraps_gitaly_errors.rb | 15 +++++++++++++++
 9 files changed, 48 insertions(+), 35 deletions(-)
 create mode 100644 lib/gitlab/git/wraps_gitaly_errors.rb

(limited to 'lib')

diff --git a/lib/gitlab/git/blob.rb b/lib/gitlab/git/blob.rb
index 13b0bb930f4..0bd1d3420a2 100644
--- a/lib/gitlab/git/blob.rb
+++ b/lib/gitlab/git/blob.rb
@@ -5,6 +5,7 @@ module Gitlab
     class Blob
       include Gitlab::BlobHelper
       include Gitlab::EncodingHelper
+      extend Gitlab::Git::WrapsGitalyErrors
 
       # This number is the maximum amount of data that we want to display to
       # the user. We load as much as we can for encoding detection and LFS
@@ -75,7 +76,7 @@ module Gitlab
         # Returns array of Gitlab::Git::Blob
         # Does not guarantee blob data will be set
         def batch_lfs_pointers(repository, blob_ids)
-          repository.wrapped_gitaly_errors do
+          wrapped_gitaly_errors do
             repository.gitaly_blob_client.batch_lfs_pointers(blob_ids.to_a)
           end
         end
diff --git a/lib/gitlab/git/commit.rb b/lib/gitlab/git/commit.rb
index 74cdabfed9d..2820491b65d 100644
--- a/lib/gitlab/git/commit.rb
+++ b/lib/gitlab/git/commit.rb
@@ -3,6 +3,7 @@ module Gitlab
   module Git
     class Commit
       include Gitlab::EncodingHelper
+      extend Gitlab::Git::WrapsGitalyErrors
 
       attr_accessor :raw_commit, :head
 
@@ -59,7 +60,7 @@ module Gitlab
           # This saves us an RPC round trip.
           return nil if commit_id.include?(':')
 
-          commit = repo.wrapped_gitaly_errors do
+          commit = wrapped_gitaly_errors do
             repo.gitaly_commit_client.find_commit(commit_id)
           end
 
@@ -100,7 +101,7 @@ module Gitlab
         #   Commit.between(repo, '29eda46b', 'master')
         #
         def between(repo, base, head)
-          repo.wrapped_gitaly_errors do
+          wrapped_gitaly_errors do
             repo.gitaly_commit_client.between(base, head)
           end
         end
@@ -125,7 +126,7 @@ module Gitlab
         #        are documented here:
         #        http://www.rubydoc.info/github/libgit2/rugged/Rugged#SORT_NONE-constant)
         def find_all(repo, options = {})
-          repo.wrapped_gitaly_errors do
+          wrapped_gitaly_errors do
             Gitlab::GitalyClient::CommitService.new(repo).find_all_commits(options)
           end
         end
@@ -142,7 +143,7 @@ module Gitlab
         # relation to each other. The last 10 commits for a branch for example,
         # should go through .where
         def batch_by_oid(repo, oids)
-          repo.wrapped_gitaly_errors do
+          wrapped_gitaly_errors do
             repo.gitaly_commit_client.list_commits_by_oid(oids)
           end
         end
diff --git a/lib/gitlab/git/commit_stats.rb b/lib/gitlab/git/commit_stats.rb
index ae6f554bc06..83a9fd5f81a 100644
--- a/lib/gitlab/git/commit_stats.rb
+++ b/lib/gitlab/git/commit_stats.rb
@@ -3,6 +3,8 @@
 module Gitlab
   module Git
     class CommitStats
+      include Gitlab::Git::WrapsGitalyErrors
+
       attr_reader :id, :additions, :deletions, :total
 
       # Instantiate a CommitStats object
@@ -14,7 +16,7 @@ module Gitlab
         @deletions = 0
         @total = 0
 
-        repo.wrapped_gitaly_errors do
+        wrapped_gitaly_errors do
           gitaly_stats(repo, commit)
         end
       end
diff --git a/lib/gitlab/git/conflict/resolver.rb b/lib/gitlab/git/conflict/resolver.rb
index 6dc792c16b8..307f1b8cb66 100644
--- a/lib/gitlab/git/conflict/resolver.rb
+++ b/lib/gitlab/git/conflict/resolver.rb
@@ -2,6 +2,8 @@ module Gitlab
   module Git
     module Conflict
       class Resolver
+        include Gitlab::Git::WrapsGitalyErrors
+
         ConflictSideMissing = Class.new(StandardError)
         ResolutionError = Class.new(StandardError)
 
@@ -12,7 +14,7 @@ module Gitlab
         end
 
         def conflicts
-          @conflicts ||= @target_repository.wrapped_gitaly_errors do
+          @conflicts ||= wrapped_gitaly_errors do
             gitaly_conflicts_client(@target_repository).list_conflict_files.to_a
           end
         rescue GRPC::FailedPrecondition => e
@@ -22,7 +24,7 @@ module Gitlab
         end
 
         def resolve_conflicts(source_repository, resolution, source_branch:, target_branch:)
-          source_repository.wrapped_gitaly_errors do
+          wrapped_gitaly_errors do
             gitaly_conflicts_client(source_repository).resolve_conflicts(@target_repository, resolution, source_branch, target_branch)
           end
         end
diff --git a/lib/gitlab/git/remote_mirror.rb b/lib/gitlab/git/remote_mirror.rb
index e4743b4db0a..7f9520de5ce 100644
--- a/lib/gitlab/git/remote_mirror.rb
+++ b/lib/gitlab/git/remote_mirror.rb
@@ -1,13 +1,15 @@
 module Gitlab
   module Git
     class RemoteMirror
+      include Gitlab::Git::WrapsGitalyErrors
+
       def initialize(repository, ref_name)
         @repository = repository
         @ref_name = ref_name
       end
 
       def update(only_branches_matching: [])
-        @repository.wrapped_gitaly_errors do
+        wrapped_gitaly_errors do
           @repository.gitaly_remote_client.update_remote_mirror(@ref_name, only_branches_matching)
         end
       end
diff --git a/lib/gitlab/git/repository.rb b/lib/gitlab/git/repository.rb
index 9df04372cc2..fcc92341c40 100644
--- a/lib/gitlab/git/repository.rb
+++ b/lib/gitlab/git/repository.rb
@@ -6,6 +6,7 @@ module Gitlab
   module Git
     class Repository
       include Gitlab::Git::RepositoryMirroring
+      include Gitlab::Git::WrapsGitalyErrors
       include Gitlab::EncodingHelper
       include Gitlab::Utils::StrongMemoize
 
@@ -845,23 +846,9 @@ module Gitlab
       end
 
       def gitaly_migrate(method, status: Gitlab::GitalyClient::MigrationStatus::OPT_IN, &block)
-        Gitlab::GitalyClient.migrate(method, status: status, &block)
-      rescue GRPC::NotFound => e
-        raise NoRepository.new(e)
-      rescue GRPC::InvalidArgument => e
-        raise ArgumentError.new(e)
-      rescue GRPC::BadStatus => e
-        raise CommandError.new(e)
-      end
-
-      def wrapped_gitaly_errors(&block)
-        yield block
-      rescue GRPC::NotFound => e
-        raise NoRepository.new(e)
-      rescue GRPC::InvalidArgument => e
-        raise ArgumentError.new(e)
-      rescue GRPC::BadStatus => e
-        raise CommandError.new(e)
+        wrapped_gitaly_errors do
+          Gitlab::GitalyClient.migrate(method, status: status, &block)
+        end
       end
 
       def clean_stale_repository_files
diff --git a/lib/gitlab/git/tree.rb b/lib/gitlab/git/tree.rb
index e0867aeb5a7..b5b701699f0 100644
--- a/lib/gitlab/git/tree.rb
+++ b/lib/gitlab/git/tree.rb
@@ -2,6 +2,7 @@ module Gitlab
   module Git
     class Tree
       include Gitlab::EncodingHelper
+      extend Gitlab::Git::WrapsGitalyErrors
 
       attr_accessor :id, :root_id, :name, :path, :flat_path, :type,
         :mode, :commit_id, :submodule_url
@@ -15,7 +16,7 @@ module Gitlab
         def where(repository, sha, path = nil, recursive = false)
           path = nil if path == '' || path == '/'
 
-          repository.wrapped_gitaly_errors do
+          wrapped_gitaly_errors do
             repository.gitaly_commit_client.tree_entries(repository, sha, path, recursive)
           end
         end
diff --git a/lib/gitlab/git/wiki.rb b/lib/gitlab/git/wiki.rb
index 7fe56979d5c..02c643d0da0 100644
--- a/lib/gitlab/git/wiki.rb
+++ b/lib/gitlab/git/wiki.rb
@@ -1,6 +1,8 @@
 module Gitlab
   module Git
     class Wiki
+      include Gitlab::Git::WrapsGitalyErrors
+
       DuplicatePageError = Class.new(StandardError)
       OperationError = Class.new(StandardError)
 
@@ -65,37 +67,37 @@ module Gitlab
       end
 
       def write_page(name, format, content, commit_details)
-        @repository.wrapped_gitaly_errors do
+        wrapped_gitaly_errors do
           gitaly_write_page(name, format, content, commit_details)
         end
       end
 
       def delete_page(page_path, commit_details)
-        @repository.wrapped_gitaly_errors do
+        wrapped_gitaly_errors do
           gitaly_delete_page(page_path, commit_details)
         end
       end
 
       def update_page(page_path, title, format, content, commit_details)
-        @repository.wrapped_gitaly_errors do
+        wrapped_gitaly_errors do
           gitaly_update_page(page_path, title, format, content, commit_details)
         end
       end
 
       def pages(limit: 0)
-        @repository.wrapped_gitaly_errors do
+        wrapped_gitaly_errors do
           gitaly_get_all_pages(limit: limit)
         end
       end
 
       def page(title:, version: nil, dir: nil)
-        @repository.wrapped_gitaly_errors do
+        wrapped_gitaly_errors do
           gitaly_find_page(title: title, version: version, dir: dir)
         end
       end
 
       def file(name, version)
-        @repository.wrapped_gitaly_errors do
+        wrapped_gitaly_errors do
           gitaly_find_file(name, version)
         end
       end
@@ -105,7 +107,7 @@ module Gitlab
       #  :per_page - The number of items per page.
       #  :limit    - Total number of items to return.
       def page_versions(page_path, options = {})
-        versions = @repository.wrapped_gitaly_errors do
+        versions = wrapped_gitaly_errors do
           gitaly_wiki_client.page_versions(page_path, options)
         end
 
@@ -127,7 +129,7 @@ module Gitlab
       def page_formatted_data(title:, dir: nil, version: nil)
         version = version&.id
 
-        @repository.wrapped_gitaly_errors do
+        wrapped_gitaly_errors do
           gitaly_wiki_client.get_formatted_data(title: title, dir: dir, version: version)
         end
       end
diff --git a/lib/gitlab/git/wraps_gitaly_errors.rb b/lib/gitlab/git/wraps_gitaly_errors.rb
new file mode 100644
index 00000000000..4b161f7e6ce
--- /dev/null
+++ b/lib/gitlab/git/wraps_gitaly_errors.rb
@@ -0,0 +1,15 @@
+module Gitlab
+  module Git
+    module WrapsGitalyErrors
+      def wrapped_gitaly_errors(&block)
+        yield block
+      rescue GRPC::NotFound => e
+        raise Gitlab::Git::Repository::NoRepository.new(e)
+      rescue GRPC::InvalidArgument => e
+        raise ArgumentError.new(e)
+      rescue GRPC::BadStatus => e
+        raise Gitlab::Git::CommandError.new(e)
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 5186d6faa1f43f612a6181eebf099e54d90b7e1c Mon Sep 17 00:00:00 2001
From: gfyoung <gfyoung17@gmail.com>
Date: Tue, 30 Oct 2018 12:05:07 -0700
Subject: Enable frozen string for lib/gitlab/ci/**/*.rb

Enables frozen string for all remaining files
in lib/gitlab/ci.

Partially addresses #47424.
---
 lib/gitlab/ci/status/build/action.rb         |  2 ++
 lib/gitlab/ci/status/build/cancelable.rb     |  2 ++
 lib/gitlab/ci/status/build/canceled.rb       |  2 ++
 lib/gitlab/ci/status/build/common.rb         |  2 ++
 lib/gitlab/ci/status/build/created.rb        |  2 ++
 lib/gitlab/ci/status/build/erased.rb         |  2 ++
 lib/gitlab/ci/status/build/factory.rb        |  2 ++
 lib/gitlab/ci/status/build/failed.rb         |  2 ++
 lib/gitlab/ci/status/build/failed_allowed.rb |  2 ++
 lib/gitlab/ci/status/build/manual.rb         |  2 ++
 lib/gitlab/ci/status/build/pending.rb        |  2 ++
 lib/gitlab/ci/status/build/play.rb           |  2 ++
 lib/gitlab/ci/status/build/retried.rb        |  2 ++
 lib/gitlab/ci/status/build/retryable.rb      |  2 ++
 lib/gitlab/ci/status/build/scheduled.rb      |  2 ++
 lib/gitlab/ci/status/build/skipped.rb        |  2 ++
 lib/gitlab/ci/status/build/stop.rb           |  2 ++
 lib/gitlab/ci/status/build/unschedule.rb     |  2 ++
 lib/gitlab/ci/status/canceled.rb             |  2 ++
 lib/gitlab/ci/status/core.rb                 |  2 ++
 lib/gitlab/ci/status/created.rb              |  2 ++
 lib/gitlab/ci/status/extended.rb             |  2 ++
 lib/gitlab/ci/status/external/common.rb      |  2 ++
 lib/gitlab/ci/status/external/factory.rb     |  2 ++
 lib/gitlab/ci/status/factory.rb              |  2 ++
 lib/gitlab/ci/status/failed.rb               |  2 ++
 lib/gitlab/ci/status/group/common.rb         |  2 ++
 lib/gitlab/ci/status/group/factory.rb        |  2 ++
 lib/gitlab/ci/status/manual.rb               |  2 ++
 lib/gitlab/ci/status/pending.rb              |  2 ++
 lib/gitlab/ci/status/pipeline/blocked.rb     |  2 ++
 lib/gitlab/ci/status/pipeline/common.rb      |  2 ++
 lib/gitlab/ci/status/pipeline/delayed.rb     |  2 ++
 lib/gitlab/ci/status/pipeline/factory.rb     |  2 ++
 lib/gitlab/ci/status/running.rb              |  2 ++
 lib/gitlab/ci/status/scheduled.rb            |  2 ++
 lib/gitlab/ci/status/skipped.rb              |  2 ++
 lib/gitlab/ci/status/stage/common.rb         |  2 ++
 lib/gitlab/ci/status/stage/factory.rb        |  2 ++
 lib/gitlab/ci/status/success.rb              |  2 ++
 lib/gitlab/ci/status/success_warning.rb      |  2 ++
 lib/gitlab/ci/trace/chunked_io.rb            | 15 +++++++++------
 lib/gitlab/ci/trace/section_parser.rb        |  2 ++
 lib/gitlab/ci/trace/stream.rb                |  5 +++--
 lib/gitlab/ci/variables/collection.rb        |  2 ++
 lib/gitlab/ci/variables/collection/item.rb   |  2 ++
 46 files changed, 100 insertions(+), 8 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/ci/status/build/action.rb b/lib/gitlab/ci/status/build/action.rb
index 6c9125647ad..45d9ba41e92 100644
--- a/lib/gitlab/ci/status/build/action.rb
+++ b/lib/gitlab/ci/status/build/action.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/cancelable.rb b/lib/gitlab/ci/status/build/cancelable.rb
index 024047d4983..43fb5cdbbe6 100644
--- a/lib/gitlab/ci/status/build/cancelable.rb
+++ b/lib/gitlab/ci/status/build/cancelable.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/canceled.rb b/lib/gitlab/ci/status/build/canceled.rb
index c83e2734a73..0518b9e673d 100644
--- a/lib/gitlab/ci/status/build/canceled.rb
+++ b/lib/gitlab/ci/status/build/canceled.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/common.rb b/lib/gitlab/ci/status/build/common.rb
index c1fc70ac266..6a75ec5c37f 100644
--- a/lib/gitlab/ci/status/build/common.rb
+++ b/lib/gitlab/ci/status/build/common.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/created.rb b/lib/gitlab/ci/status/build/created.rb
index 5be8e9de425..780fea23123 100644
--- a/lib/gitlab/ci/status/build/created.rb
+++ b/lib/gitlab/ci/status/build/created.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/erased.rb b/lib/gitlab/ci/status/build/erased.rb
index 495227c2ffb..d74cfc1ee77 100644
--- a/lib/gitlab/ci/status/build/erased.rb
+++ b/lib/gitlab/ci/status/build/erased.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/factory.rb b/lib/gitlab/ci/status/build/factory.rb
index 4a74d6d6ed1..6e4bfe23f2b 100644
--- a/lib/gitlab/ci/status/build/factory.rb
+++ b/lib/gitlab/ci/status/build/factory.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/failed.rb b/lib/gitlab/ci/status/build/failed.rb
index 4babc23a495..7cc1cc6b8e3 100644
--- a/lib/gitlab/ci/status/build/failed.rb
+++ b/lib/gitlab/ci/status/build/failed.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/failed_allowed.rb b/lib/gitlab/ci/status/build/failed_allowed.rb
index ca0046fb1f7..d7570fdd3e2 100644
--- a/lib/gitlab/ci/status/build/failed_allowed.rb
+++ b/lib/gitlab/ci/status/build/failed_allowed.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/manual.rb b/lib/gitlab/ci/status/build/manual.rb
index 042da6392d3..d01b09f1398 100644
--- a/lib/gitlab/ci/status/build/manual.rb
+++ b/lib/gitlab/ci/status/build/manual.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/pending.rb b/lib/gitlab/ci/status/build/pending.rb
index 9dd9a27ad57..95f668295dd 100644
--- a/lib/gitlab/ci/status/build/pending.rb
+++ b/lib/gitlab/ci/status/build/pending.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/play.rb b/lib/gitlab/ci/status/build/play.rb
index a8b9ebf0803..c66b8ca5654 100644
--- a/lib/gitlab/ci/status/build/play.rb
+++ b/lib/gitlab/ci/status/build/play.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/retried.rb b/lib/gitlab/ci/status/build/retried.rb
index 6e190e4ee3c..b489dc68733 100644
--- a/lib/gitlab/ci/status/build/retried.rb
+++ b/lib/gitlab/ci/status/build/retried.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/retryable.rb b/lib/gitlab/ci/status/build/retryable.rb
index 5aeb8e51480..eb6b3f21604 100644
--- a/lib/gitlab/ci/status/build/retryable.rb
+++ b/lib/gitlab/ci/status/build/retryable.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/scheduled.rb b/lib/gitlab/ci/status/build/scheduled.rb
index 62ad9083616..f443dbee120 100644
--- a/lib/gitlab/ci/status/build/scheduled.rb
+++ b/lib/gitlab/ci/status/build/scheduled.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/skipped.rb b/lib/gitlab/ci/status/build/skipped.rb
index 3e678d0baee..4fe2f7b3114 100644
--- a/lib/gitlab/ci/status/build/skipped.rb
+++ b/lib/gitlab/ci/status/build/skipped.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/stop.rb b/lib/gitlab/ci/status/build/stop.rb
index dea838bfa39..a620e7ad126 100644
--- a/lib/gitlab/ci/status/build/stop.rb
+++ b/lib/gitlab/ci/status/build/stop.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/build/unschedule.rb b/lib/gitlab/ci/status/build/unschedule.rb
index e1b7b83428c..9110839cb55 100644
--- a/lib/gitlab/ci/status/build/unschedule.rb
+++ b/lib/gitlab/ci/status/build/unschedule.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/canceled.rb b/lib/gitlab/ci/status/canceled.rb
index e6195a60d4f..07f37732023 100644
--- a/lib/gitlab/ci/status/canceled.rb
+++ b/lib/gitlab/ci/status/canceled.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/core.rb b/lib/gitlab/ci/status/core.rb
index 9d6a2f51c11..ea773ee9944 100644
--- a/lib/gitlab/ci/status/core.rb
+++ b/lib/gitlab/ci/status/core.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/created.rb b/lib/gitlab/ci/status/created.rb
index 846f00b83dd..fface4bb97b 100644
--- a/lib/gitlab/ci/status/created.rb
+++ b/lib/gitlab/ci/status/created.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/extended.rb b/lib/gitlab/ci/status/extended.rb
index 1e8101f8949..b72a28ed0b6 100644
--- a/lib/gitlab/ci/status/extended.rb
+++ b/lib/gitlab/ci/status/extended.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/external/common.rb b/lib/gitlab/ci/status/external/common.rb
index 9307545b5b1..4169f5b3210 100644
--- a/lib/gitlab/ci/status/external/common.rb
+++ b/lib/gitlab/ci/status/external/common.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/external/factory.rb b/lib/gitlab/ci/status/external/factory.rb
index 07b15bd8d97..91fafb940a8 100644
--- a/lib/gitlab/ci/status/external/factory.rb
+++ b/lib/gitlab/ci/status/external/factory.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/factory.rb b/lib/gitlab/ci/status/factory.rb
index 15836c699c7..3446644eff8 100644
--- a/lib/gitlab/ci/status/factory.rb
+++ b/lib/gitlab/ci/status/factory.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/failed.rb b/lib/gitlab/ci/status/failed.rb
index 27ce85bd3ed..770ed7d4d5a 100644
--- a/lib/gitlab/ci/status/failed.rb
+++ b/lib/gitlab/ci/status/failed.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/group/common.rb b/lib/gitlab/ci/status/group/common.rb
index cfd4329a923..0b5ea0712ca 100644
--- a/lib/gitlab/ci/status/group/common.rb
+++ b/lib/gitlab/ci/status/group/common.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/group/factory.rb b/lib/gitlab/ci/status/group/factory.rb
index d118116cfc3..ee785856fdd 100644
--- a/lib/gitlab/ci/status/group/factory.rb
+++ b/lib/gitlab/ci/status/group/factory.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/manual.rb b/lib/gitlab/ci/status/manual.rb
index fc387e2fd25..50c92add400 100644
--- a/lib/gitlab/ci/status/manual.rb
+++ b/lib/gitlab/ci/status/manual.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/pending.rb b/lib/gitlab/ci/status/pending.rb
index 6780780db32..cea7e6ed938 100644
--- a/lib/gitlab/ci/status/pending.rb
+++ b/lib/gitlab/ci/status/pending.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/pipeline/blocked.rb b/lib/gitlab/ci/status/pipeline/blocked.rb
index bf7e484ee9b..ed13a439be0 100644
--- a/lib/gitlab/ci/status/pipeline/blocked.rb
+++ b/lib/gitlab/ci/status/pipeline/blocked.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/pipeline/common.rb b/lib/gitlab/ci/status/pipeline/common.rb
index 61bb07beb0f..7b34a2ea858 100644
--- a/lib/gitlab/ci/status/pipeline/common.rb
+++ b/lib/gitlab/ci/status/pipeline/common.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/pipeline/delayed.rb b/lib/gitlab/ci/status/pipeline/delayed.rb
index 12736861c89..e61acdcd167 100644
--- a/lib/gitlab/ci/status/pipeline/delayed.rb
+++ b/lib/gitlab/ci/status/pipeline/delayed.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/pipeline/factory.rb b/lib/gitlab/ci/status/pipeline/factory.rb
index 0adf83fa197..5d1a8bbd924 100644
--- a/lib/gitlab/ci/status/pipeline/factory.rb
+++ b/lib/gitlab/ci/status/pipeline/factory.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/running.rb b/lib/gitlab/ci/status/running.rb
index ee13905e46d..ac7dd74cdce 100644
--- a/lib/gitlab/ci/status/running.rb
+++ b/lib/gitlab/ci/status/running.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/scheduled.rb b/lib/gitlab/ci/status/scheduled.rb
index 3adcfa36af2..16ad1da89e3 100644
--- a/lib/gitlab/ci/status/scheduled.rb
+++ b/lib/gitlab/ci/status/scheduled.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/skipped.rb b/lib/gitlab/ci/status/skipped.rb
index 0dbdc4de426..aaec1e1d201 100644
--- a/lib/gitlab/ci/status/skipped.rb
+++ b/lib/gitlab/ci/status/skipped.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/stage/common.rb b/lib/gitlab/ci/status/stage/common.rb
index f60a7662075..f12daaa9676 100644
--- a/lib/gitlab/ci/status/stage/common.rb
+++ b/lib/gitlab/ci/status/stage/common.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/stage/factory.rb b/lib/gitlab/ci/status/stage/factory.rb
index 4c37f084d07..58f4642510b 100644
--- a/lib/gitlab/ci/status/stage/factory.rb
+++ b/lib/gitlab/ci/status/stage/factory.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/success.rb b/lib/gitlab/ci/status/success.rb
index 731013ec017..020f2c5b89f 100644
--- a/lib/gitlab/ci/status/success.rb
+++ b/lib/gitlab/ci/status/success.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/status/success_warning.rb b/lib/gitlab/ci/status/success_warning.rb
index 32b4cf43e48..6632cd9b143 100644
--- a/lib/gitlab/ci/status/success_warning.rb
+++ b/lib/gitlab/ci/status/success_warning.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Status
diff --git a/lib/gitlab/ci/trace/chunked_io.rb b/lib/gitlab/ci/trace/chunked_io.rb
index 2147f62a84a..e9b3199d56e 100644
--- a/lib/gitlab/ci/trace/chunked_io.rb
+++ b/lib/gitlab/ci/trace/chunked_io.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 ##
 # This class is compatible with IO class (https://ruby-doc.org/core-2.3.1/IO.html)
 # source: https://gitlab.com/snippets/1685610
@@ -66,8 +68,8 @@ module Gitlab
           end
         end
 
-        def read(length = nil, outbuf = "")
-          out = ""
+        def read(length = nil, outbuf = nil)
+          out = []
 
           length ||= size - tell
 
@@ -83,17 +85,18 @@ module Gitlab
             length -= chunk_data.bytesize
           end
 
+          out = out.join
+
           # If outbuf is passed, we put the output into the buffer. This supports IO.copy_stream functionality
           if outbuf
-            outbuf.slice!(0, outbuf.bytesize)
-            outbuf << out
+            outbuf.replace(out)
           end
 
           out
         end
 
         def readline
-          out = ""
+          out = []
 
           until eof?
             data = chunk_slice_from_offset
@@ -109,7 +112,7 @@ module Gitlab
             end
           end
 
-          out
+          out.join
         end
 
         def write(data)
diff --git a/lib/gitlab/ci/trace/section_parser.rb b/lib/gitlab/ci/trace/section_parser.rb
index c09089d6475..f33f8cc56c1 100644
--- a/lib/gitlab/ci/trace/section_parser.rb
+++ b/lib/gitlab/ci/trace/section_parser.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Trace
diff --git a/lib/gitlab/ci/trace/stream.rb b/lib/gitlab/ci/trace/stream.rb
index a71040e5e56..bd40fdf59b1 100644
--- a/lib/gitlab/ci/trace/stream.rb
+++ b/lib/gitlab/ci/trace/stream.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     class Trace
@@ -129,8 +131,7 @@ module Gitlab
           debris = ''
 
           until (buf = read_backward(BUFFER_SIZE)).empty?
-            buf += debris
-            debris, *lines = buf.each_line.to_a
+            debris, *lines = (buf + debris).each_line.to_a
             lines.reverse_each do |line|
               yield(line.force_encoding(Encoding.default_external))
             end
diff --git a/lib/gitlab/ci/variables/collection.rb b/lib/gitlab/ci/variables/collection.rb
index ad30b3f427c..a7b4e0348c2 100644
--- a/lib/gitlab/ci/variables/collection.rb
+++ b/lib/gitlab/ci/variables/collection.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Variables
diff --git a/lib/gitlab/ci/variables/collection/item.rb b/lib/gitlab/ci/variables/collection/item.rb
index 7da6d09d440..fdf852e8788 100644
--- a/lib/gitlab/ci/variables/collection/item.rb
+++ b/lib/gitlab/ci/variables/collection/item.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gitlab
   module Ci
     module Variables
-- 
cgit v1.2.1


From d4ef4ad752bf05758351bd0b8761566e40ab0e8e Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Tue, 30 Oct 2018 16:41:49 -0700
Subject: Reduce SQL queries needed to load open merge requests

The SQL queries and memory allocation in MergeRequests::RefreshService
is dominated by queries for Project and Route loads. On staging, the
absence of an inverse relationship caused Rails to make over 1100
extraneous SQL queries for the www-gitlab-com repository.

Relates to https://gitlab.com/gitlab-org/gitlab-ce/issues/49703
---
 lib/gitlab/import/merge_request_helpers.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/import/merge_request_helpers.rb b/lib/gitlab/import/merge_request_helpers.rb
index 97dc1a987c4..9215067d973 100644
--- a/lib/gitlab/import/merge_request_helpers.rb
+++ b/lib/gitlab/import/merge_request_helpers.rb
@@ -22,7 +22,7 @@ module Gitlab
           # additional work that is strictly necessary.
           merge_request_id = insert_and_return_id(attributes, project.merge_requests)
 
-          merge_request = project.merge_requests.find(merge_request_id)
+          merge_request = project.merge_requests.reload.find(merge_request_id)
 
           # We use .insert_and_return_id which effectively disables all callbacks.
           # Trigger iid logic here to make sure we track internal id values consistently.
-- 
cgit v1.2.1


From 1d7737ae8615b31b9c0896ac43ced351159a1cf9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jarka=20Ko=C5=A1anov=C3=A1?= <jarka@gitlab.com>
Date: Mon, 15 Oct 2018 10:36:07 +0200
Subject: Prepare Banzai to work with group issuables

---
 lib/banzai/filter/issuable_state_filter.rb | 11 ++++++--
 lib/banzai/issuable_extractor.rb           | 41 ++++++++++++++++++++----------
 2 files changed, 37 insertions(+), 15 deletions(-)

(limited to 'lib')

diff --git a/lib/banzai/filter/issuable_state_filter.rb b/lib/banzai/filter/issuable_state_filter.rb
index d7fe012883d..8e2358694d4 100644
--- a/lib/banzai/filter/issuable_state_filter.rb
+++ b/lib/banzai/filter/issuable_state_filter.rb
@@ -18,7 +18,7 @@ module Banzai
         issuables = extractor.extract([doc])
 
         issuables.each do |node, issuable|
-          next if !can_read_cross_project? && issuable.project != project
+          next if !can_read_cross_project? && cross_reference?(issuable)
 
           if VISIBLE_STATES.include?(issuable.state) && issuable_reference?(node.inner_html, issuable)
             node.content += " (#{issuable.state})"
@@ -31,7 +31,14 @@ module Banzai
       private
 
       def issuable_reference?(text, issuable)
-        text == issuable.reference_link_text(project || group)
+        CGI.unescapeHTML(text) == issuable.reference_link_text(project || group)
+      end
+
+      def cross_reference?(issuable)
+        return true if issuable.project != project
+        return true if issuable.respond_to?(:group) && issuable.group != group
+
+        false
       end
 
       def can_read_cross_project?
diff --git a/lib/banzai/issuable_extractor.rb b/lib/banzai/issuable_extractor.rb
index 0a05d46db4c..341dbb74fe0 100644
--- a/lib/banzai/issuable_extractor.rb
+++ b/lib/banzai/issuable_extractor.rb
@@ -9,13 +9,11 @@ module Banzai
   # so we can avoid N+1 queries problem
 
   class IssuableExtractor
-    QUERY = %q(
-      descendant-or-self::a[contains(concat(" ", @class, " "), " gfm ")]
-      [@data-reference-type="issue" or @data-reference-type="merge_request"]
-    ).freeze
-
     attr_reader :context
 
+    ISSUE_REFERENCE_TYPE = '@data-reference-type="issue"'.freeze
+    MERGE_REQUEST_REFERENCE_TYPE = '@data-reference-type="merge_request"'.freeze
+
     # context - An instance of Banzai::RenderContext.
     def initialize(context)
       @context = context
@@ -24,21 +22,38 @@ module Banzai
     # Returns Hash in the form { node => issuable_instance }
     def extract(documents)
       nodes = documents.flat_map do |document|
-        document.xpath(QUERY)
+        document.xpath(query)
       end
 
-      issue_parser = Banzai::ReferenceParser::IssueParser.new(context)
+      # The project or group for the issuable might be pending for deletion!
+      # Filter them out because we don't care about them.
+      issuables_for_nodes(nodes).select { |node, issuable| issuable.project || issuable.group }
+    end
+
+    private
 
-      merge_request_parser =
+    def issuables_for_nodes(nodes)
+      parsers.each_with_object({}) do |parser, result|
+        result.merge!(parser.records_for_nodes(nodes))
+      end
+    end
+
+    def parsers
+      [
+        Banzai::ReferenceParser::IssueParser.new(context),
         Banzai::ReferenceParser::MergeRequestParser.new(context)
+      ]
+    end
 
-      issuables_for_nodes = issue_parser.records_for_nodes(nodes).merge(
-        merge_request_parser.records_for_nodes(nodes)
+    def query
+      %Q(
+        descendant-or-self::a[contains(concat(" ", @class, " "), " gfm ")]
+        [#{reference_types.join(' or ')}]
       )
+    end
 
-      # The project for the issue/MR might be pending for deletion!
-      # Filter them out because we don't care about them.
-      issuables_for_nodes.select { |node, issuable| issuable.project }
+    def reference_types
+      [ISSUE_REFERENCE_TYPE, MERGE_REQUEST_REFERENCE_TYPE]
     end
   end
 end
-- 
cgit v1.2.1


From 01d8c1f6f0dacbb8d4779d0226e1c02eb11dfe0e Mon Sep 17 00:00:00 2001
From: Douglas Barbosa Alexandre <dbalexandre@gmail.com>
Date: Wed, 31 Oct 2018 14:39:24 -0300
Subject: Whitelist none method from ActiveRecord::Querying

---
 lib/gitlab/user_extractor.rb | 2 --
 1 file changed, 2 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/user_extractor.rb b/lib/gitlab/user_extractor.rb
index bd0d24e4369..9abd64c2250 100644
--- a/lib/gitlab/user_extractor.rb
+++ b/lib/gitlab/user_extractor.rb
@@ -14,13 +14,11 @@ module Gitlab
       @text = text
     end
 
-    # rubocop: disable CodeReuse/ActiveRecord
     def users
       return User.none unless @text.present?
 
       @users ||= User.from_union(union_relations)
     end
-    # rubocop: enable CodeReuse/ActiveRecord
 
     def usernames
       matches[:usernames]
-- 
cgit v1.2.1


From 733ae9492129e835f183902a97ee0886e2dbdc9b Mon Sep 17 00:00:00 2001
From: George Tsiolis <tsiolis.g@gmail.com>
Date: Tue, 30 Oct 2018 12:53:01 +0200
Subject: Fix typos in comments and specs

---
 lib/extracts_path.rb                                                  | 2 +-
 lib/gitlab/auth/o_auth/auth_hash.rb                                   | 2 +-
 .../background_migration/set_confidential_note_events_on_services.rb  | 4 ++--
 .../background_migration/set_confidential_note_events_on_webhooks.rb  | 4 ++--
 lib/gitlab/ci/templates/Maven.gitlab-ci.yml                           | 2 +-
 lib/gitlab/database/migration_helpers.rb                              | 2 +-
 lib/gitlab/diff/position_tracer.rb                                    | 2 +-
 lib/gitlab/gitaly_client/repository_service.rb                        | 2 +-
 lib/gitlab/import_export/project_tree_restorer.rb                     | 2 +-
 lib/gitlab/path_regex.rb                                              | 2 +-
 lib/gitlab/proxy_http_connection_adapter.rb                           | 2 +-
 lib/gitlab/slash_commands/issue_new.rb                                | 2 +-
 lib/gitlab/user_extractor.rb                                          | 2 +-
 lib/google_api/auth.rb                                                | 2 +-
 14 files changed, 16 insertions(+), 16 deletions(-)

(limited to 'lib')

diff --git a/lib/extracts_path.rb b/lib/extracts_path.rb
index a340a276640..655278da711 100644
--- a/lib/extracts_path.rb
+++ b/lib/extracts_path.rb
@@ -153,7 +153,7 @@ module ExtractsPath
 
   private
 
-  # overriden in subclasses, do not remove
+  # overridden in subclasses, do not remove
   def get_id
     id = [params[:id] || params[:ref]]
     id << "/" + params[:path] unless params[:path].blank?
diff --git a/lib/gitlab/auth/o_auth/auth_hash.rb b/lib/gitlab/auth/o_auth/auth_hash.rb
index 4a5f9d2839d..36fc8061d92 100644
--- a/lib/gitlab/auth/o_auth/auth_hash.rb
+++ b/lib/gitlab/auth/o_auth/auth_hash.rb
@@ -80,7 +80,7 @@ module Gitlab
         end
 
         # Get the first part of the email address (before @)
-        # In addtion in removes illegal characters
+        # In addition in removes illegal characters
         def generate_username(email)
           email.match(/^[^@]*/)[0].mb_chars.normalize(:kd).gsub(/[^\x00-\x7F]/, '').to_s
         end
diff --git a/lib/gitlab/background_migration/set_confidential_note_events_on_services.rb b/lib/gitlab/background_migration/set_confidential_note_events_on_services.rb
index e5e8837221e..bc434b0cb64 100644
--- a/lib/gitlab/background_migration/set_confidential_note_events_on_services.rb
+++ b/lib/gitlab/background_migration/set_confidential_note_events_on_services.rb
@@ -3,8 +3,8 @@
 
 module Gitlab
   module BackgroundMigration
-    # Ensures services which previously recieved all notes events continue
-    # to recieve confidential ones.
+    # Ensures services which previously received all notes events continue
+    # to receive confidential ones.
     class SetConfidentialNoteEventsOnServices
       class Service < ActiveRecord::Base
         self.table_name = 'services'
diff --git a/lib/gitlab/background_migration/set_confidential_note_events_on_webhooks.rb b/lib/gitlab/background_migration/set_confidential_note_events_on_webhooks.rb
index 171c8ef21b7..28d8d2c640b 100644
--- a/lib/gitlab/background_migration/set_confidential_note_events_on_webhooks.rb
+++ b/lib/gitlab/background_migration/set_confidential_note_events_on_webhooks.rb
@@ -3,8 +3,8 @@
 
 module Gitlab
   module BackgroundMigration
-    # Ensures hooks which previously recieved all notes events continue
-    # to recieve confidential ones.
+    # Ensures hooks which previously received all notes events continue
+    # to receive confidential ones.
     class SetConfidentialNoteEventsOnWebhooks
       class WebHook < ActiveRecord::Base
         self.table_name = 'web_hooks'
diff --git a/lib/gitlab/ci/templates/Maven.gitlab-ci.yml b/lib/gitlab/ci/templates/Maven.gitlab-ci.yml
index d61ff239e13..492b3d03db2 100644
--- a/lib/gitlab/ci/templates/Maven.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Maven.gitlab-ci.yml
@@ -15,7 +15,7 @@
 # * Publishes the documentation for `master` branch.
 
 variables:
-  # This will supress any download for dependencies and plugins or upload messages which would clutter the console log.
+  # This will suppress any download for dependencies and plugins or upload messages which would clutter the console log.
   # `showDateTime` will show the passed time in milliseconds. You need to specify `--batch-mode` to make this work.
   MAVEN_OPTS: "-Dhttps.protocols=TLSv1.2 -Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN -Dorg.slf4j.simpleLogger.showDateTime=true -Djava.awt.headless=true"
   # As of Maven 3.3.0 instead of this you may define these options in `.mvn/maven.config` so the same config is used
diff --git a/lib/gitlab/database/migration_helpers.rb b/lib/gitlab/database/migration_helpers.rb
index a17f27a3147..f98d6dbd46f 100644
--- a/lib/gitlab/database/migration_helpers.rb
+++ b/lib/gitlab/database/migration_helpers.rb
@@ -879,7 +879,7 @@ module Gitlab
         columns(table).find { |column| column.name == name }
       end
 
-      # This will replace the first occurance of a string in a column with
+      # This will replace the first occurrence of a string in a column with
       # the replacement
       # On postgresql we can use `regexp_replace` for that.
       # On mysql we find the location of the pattern, and overwrite it
diff --git a/lib/gitlab/diff/position_tracer.rb b/lib/gitlab/diff/position_tracer.rb
index b68a1636814..8457e0c4cb6 100644
--- a/lib/gitlab/diff/position_tracer.rb
+++ b/lib/gitlab/diff/position_tracer.rb
@@ -24,7 +24,7 @@ module Gitlab
         # head of `feature` was commit B, resulting in the original diff A->B.
         # Since creation, `master` was updated to C.
         # Now `feature` is being updated to D, and the newly generated MR diff is C->D.
-        # It is possible that C and D are direct decendants of A and B respectively,
+        # It is possible that C and D are direct descendants of A and B respectively,
         # but this isn't necessarily the case as rebases and merges come into play.
         #
         # Suppose we have a diff note on the original diff A->B. Now that the MR
diff --git a/lib/gitlab/gitaly_client/repository_service.rb b/lib/gitlab/gitaly_client/repository_service.rb
index 2956ed4b911..d7b36946b65 100644
--- a/lib/gitlab/gitaly_client/repository_service.rb
+++ b/lib/gitlab/gitaly_client/repository_service.rb
@@ -349,7 +349,7 @@ module Gitlab
             f.write(message.data)
           end
         end
-        # If the file is empty means that we recieved an empty stream, we delete the file
+        # If the file is empty means that we received an empty stream, we delete the file
         FileUtils.rm(save_path) if File.zero?(save_path)
       end
 
diff --git a/lib/gitlab/import_export/project_tree_restorer.rb b/lib/gitlab/import_export/project_tree_restorer.rb
index 3d693d23c99..99581eb0416 100644
--- a/lib/gitlab/import_export/project_tree_restorer.rb
+++ b/lib/gitlab/import_export/project_tree_restorer.rb
@@ -154,7 +154,7 @@ module Gitlab
           Project.transaction do
             process_sub_relation(relation, relation_item)
 
-            # For every subrelation that hangs from Project, save the associated records alltogether
+            # For every subrelation that hangs from Project, save the associated records altogether
             # This effectively batches all records per subrelation item, only keeping those in memory
             # We have to keep in mind that more batch granularity << Memory, but >> Slowness
             if save
diff --git a/lib/gitlab/path_regex.rb b/lib/gitlab/path_regex.rb
index 44025650de0..fa68dead80b 100644
--- a/lib/gitlab/path_regex.rb
+++ b/lib/gitlab/path_regex.rb
@@ -236,7 +236,7 @@ module Gitlab
 
     def single_line_regexp(regex)
       # Turns a multiline extended regexp into a single line one,
-      # beacuse `rake routes` breaks on multiline regexes.
+      # because `rake routes` breaks on multiline regexes.
       Regexp.new(regex.source.gsub(/\(\?#.+?\)/, '').gsub(/\s*/, ''), regex.options ^ Regexp::EXTENDED).freeze
     end
   end
diff --git a/lib/gitlab/proxy_http_connection_adapter.rb b/lib/gitlab/proxy_http_connection_adapter.rb
index 82213098672..a64cb47e77e 100644
--- a/lib/gitlab/proxy_http_connection_adapter.rb
+++ b/lib/gitlab/proxy_http_connection_adapter.rb
@@ -4,7 +4,7 @@
 # of the global setting allow_local_requests_from_hooks_and_services this adapter
 # will allow/block connection to internal IPs and/or urls.
 #
-# This functionality can be overriden by providing the setting the option
+# This functionality can be overridden by providing the setting the option
 # allow_local_requests = true in the request. For example:
 # Gitlab::HTTP.get('http://www.gitlab.com', allow_local_requests: true)
 #
diff --git a/lib/gitlab/slash_commands/issue_new.rb b/lib/gitlab/slash_commands/issue_new.rb
index 25f965e843d..6396b828dc7 100644
--- a/lib/gitlab/slash_commands/issue_new.rb
+++ b/lib/gitlab/slash_commands/issue_new.rb
@@ -3,7 +3,7 @@ module Gitlab
     class IssueNew < IssueCommand
       def self.match(text)
         # we can not match \n with the dot by passing the m modifier as than
-        # the title and description are not seperated
+        # the title and description are not separated
         /\Aissue\s+(new|create)\s+(?<title>[^\n]*)\n*(?<description>(.|\n)*)/.match(text)
       end
 
diff --git a/lib/gitlab/user_extractor.rb b/lib/gitlab/user_extractor.rb
index bd0d24e4369..657e647b609 100644
--- a/lib/gitlab/user_extractor.rb
+++ b/lib/gitlab/user_extractor.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 # This class extracts all users found in a piece of text by the username or the
-# email adress
+# email address
 
 module Gitlab
   class UserExtractor
diff --git a/lib/google_api/auth.rb b/lib/google_api/auth.rb
index e724e58e9ca..56f056fd869 100644
--- a/lib/google_api/auth.rb
+++ b/lib/google_api/auth.rb
@@ -16,7 +16,7 @@ module GoogleApi
       client.auth_code.authorize_url(
         redirect_uri: redirect_uri,
         scope: scope,
-        state: state # This is used for arbitary redirection
+        state: state # This is used for arbitrary redirection
       )
     end
 
-- 
cgit v1.2.1


From d19ba4439b4f0cda2aa5ab6e1fb7e4f4330738db Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Thu, 1 Nov 2018 00:27:38 -0700
Subject: Reserve more RAM for master process in Puma

The Puma Worker Killer checks the total RAM used by both the master
and worker processes. Bump the limits to N+1 instead of N workers
to account for this.
---
 lib/gitlab/cluster/puma_worker_killer_initializer.rb | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/cluster/puma_worker_killer_initializer.rb b/lib/gitlab/cluster/puma_worker_killer_initializer.rb
index 331c39f7d6b..4ed9a9a02ab 100644
--- a/lib/gitlab/cluster/puma_worker_killer_initializer.rb
+++ b/lib/gitlab/cluster/puma_worker_killer_initializer.rb
@@ -11,7 +11,11 @@ module Gitlab
           # Importantly RAM is for _all_workers (ie, the cluster),
           # not each worker as is the case with GITLAB_UNICORN_MEMORY_MAX
           worker_count = puma_options[:workers] || 1
-          config.ram = worker_count * puma_per_worker_max_memory_mb
+          # The Puma Worker Killer checks the total RAM used by both the master
+          # and worker processes. Bump the limits to N+1 instead of N workers
+          # to account for this:
+          # https://github.com/schneems/puma_worker_killer/blob/v0.1.0/lib/puma_worker_killer/puma_memory.rb#L57
+          config.ram = (worker_count + 1) * puma_per_worker_max_memory_mb
 
           config.frequency = 20 # seconds
 
-- 
cgit v1.2.1


From 17a7b4113290435560275e408b1764f4b308295f Mon Sep 17 00:00:00 2001
From: Helmut Januschka <helmut@januschka.com>
Date: Wed, 19 Sep 2018 10:06:03 +0200
Subject: add related merge request endpoint

---
 lib/api/issues.rb | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

(limited to 'lib')

diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index e37083165f5..7909f9c7a00 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -294,6 +294,30 @@ module API
       end
       # rubocop: enable CodeReuse/ActiveRecord
 
+      desc 'List merge requests that are related to the issue'  do
+        success Entities::MergeRequestBasic
+      end
+      params do
+        requires :issue_iid, type: Integer, desc: 'The internal ID of a project issue'
+      end
+      get ':id/issues/:issue_iid/related_merge_requests' do
+        issue = find_project_issue(params[:issue_iid])
+
+        merge_request_iids = ::Issues::ReferencedMergeRequestsService.new(user_project, current_user)
+          .execute(issue)
+          .flatten
+          .map(&:iid)
+
+        merge_requests =
+          if merge_request_iids.present?
+            MergeRequestsFinder.new(current_user, project_id: user_project.id, iids: merge_request_iids).execute
+          else
+            MergeRequest.none
+          end
+
+        present paginate(merge_requests), with: Entities::MergeRequestBasic, current_user: current_user, project: user_project
+      end
+
       desc 'List merge requests closing issue'  do
         success Entities::MergeRequestBasic
       end
-- 
cgit v1.2.1


From de1db4972cff7539b4ed490e9ebaf87f06500bbd Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Thu, 1 Nov 2018 07:50:39 -0700
Subject: Avoidp loading merge request diff files when not needed

---
 lib/gitlab/diff/file_collection/base.rb | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/diff/file_collection/base.rb b/lib/gitlab/diff/file_collection/base.rb
index b79ff771a2b..2ad6fe8449d 100644
--- a/lib/gitlab/diff/file_collection/base.rb
+++ b/lib/gitlab/diff/file_collection/base.rb
@@ -17,7 +17,6 @@ module Gitlab
 
           @diffable = diffable
           @include_stats = diff_options.delete(:include_stats)
-          @diffs = diffable.raw_diffs(diff_options)
           @project = project
           @diff_options = diff_options
           @diff_refs = diff_refs
@@ -25,8 +24,12 @@ module Gitlab
           @repository = project.repository
         end
 
+        def diffs
+          @diffs ||= diffable.raw_diffs(diff_options)
+        end
+
         def diff_files
-          @diff_files ||= @diffs.decorate! { |diff| decorate_diff!(diff) }
+          @diff_files ||= diffs.decorate! { |diff| decorate_diff!(diff) }
         end
 
         def diff_file_with_old_path(old_path)
-- 
cgit v1.2.1


From 2d75626aadc906223ae8d88d6ac157cff8569d3e Mon Sep 17 00:00:00 2001
From: Sergej <kinolaev@gmail.com>
Date: Thu, 25 Oct 2018 07:38:36 +0000
Subject: Change HELM_HOST in Auto-DevOps to work behind proxy

---
 lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml b/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
index 6fa59e41d20..0b9a7434937 100644
--- a/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
@@ -823,7 +823,7 @@ rollout 100%:
   function initialize_tiller() {
     echo "Checking Tiller..."
 
-    export HELM_HOST=":44134"
+    export HELM_HOST="localhost:44134"
     tiller -listen ${HELM_HOST} -alsologtostderr > /dev/null 2>&1 &
     echo "Tiller is listening on ${HELM_HOST}"
 
-- 
cgit v1.2.1


From 5ede567d718bcf69a204dee83155399a401cb465 Mon Sep 17 00:00:00 2001
From: Thong Kuah <tkuah@gitlab.com>
Date: Fri, 2 Nov 2018 15:46:15 +0000
Subject: Incorporates Kubernetes Namespace into Cluster's flow

---
 lib/gitlab/kubernetes/role_binding.rb | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/kubernetes/role_binding.rb b/lib/gitlab/kubernetes/role_binding.rb
index 4f3ee040bf2..cb0cb42d007 100644
--- a/lib/gitlab/kubernetes/role_binding.rb
+++ b/lib/gitlab/kubernetes/role_binding.rb
@@ -3,9 +3,8 @@
 module Gitlab
   module Kubernetes
     class RoleBinding
-      attr_reader :role_name, :namespace, :service_account_name
-
-      def initialize(role_name:, namespace:, service_account_name:)
+      def initialize(name:, role_name:, namespace:, service_account_name:)
+        @name = name
         @role_name = role_name
         @namespace = namespace
         @service_account_name = service_account_name
@@ -21,14 +20,16 @@ module Gitlab
 
       private
 
+      attr_reader :name, :role_name, :namespace, :service_account_name
+
       def metadata
-        { name: "gitlab-#{namespace}", namespace: namespace }
+        { name: name, namespace: namespace }
       end
 
       def role_ref
         {
           apiGroup: 'rbac.authorization.k8s.io',
-          kind: 'Role',
+          kind: 'ClusterRole',
           name: role_name
         }
       end
-- 
cgit v1.2.1


From d86f76320cab9297e0d278a29dd71af991cd2d23 Mon Sep 17 00:00:00 2001
From: Dylan Griffith <dyl.griffith@gmail.com>
Date: Fri, 2 Nov 2018 16:09:25 +0000
Subject: Use our own docker image for helm install pods

This will reduce dependencies and failure points during installation. It
will also reduce security risks from untrusted dependencies being able
to effect all our users
---
 lib/gitlab/kubernetes/helm.rb              | 1 +
 lib/gitlab/kubernetes/helm/base_command.rb | 6 ------
 lib/gitlab/kubernetes/helm/pod.rb          | 2 +-
 3 files changed, 2 insertions(+), 7 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/kubernetes/helm.rb b/lib/gitlab/kubernetes/helm.rb
index 4a1bdf34c3e..1cd4f9e17b7 100644
--- a/lib/gitlab/kubernetes/helm.rb
+++ b/lib/gitlab/kubernetes/helm.rb
@@ -2,6 +2,7 @@ module Gitlab
   module Kubernetes
     module Helm
       HELM_VERSION = '2.7.2'.freeze
+      KUBECTL_VERSION = '1.11.0'.freeze
       NAMESPACE = 'gitlab-managed-apps'.freeze
       SERVICE_ACCOUNT = 'tiller'.freeze
       CLUSTER_ROLE_BINDING = 'tiller-admin'.freeze
diff --git a/lib/gitlab/kubernetes/helm/base_command.rb b/lib/gitlab/kubernetes/helm/base_command.rb
index 6752f2cff43..008cba9d33c 100644
--- a/lib/gitlab/kubernetes/helm/base_command.rb
+++ b/lib/gitlab/kubernetes/helm/base_command.rb
@@ -11,12 +11,6 @@ module Gitlab
         def generate_script
           <<~HEREDOC
             set -eo pipefail
-            ALPINE_VERSION=$(cat /etc/alpine-release | cut -d '.' -f 1,2)
-            echo http://mirror.clarkson.edu/alpine/v$ALPINE_VERSION/main >> /etc/apk/repositories
-            echo http://mirror1.hs-esslingen.de/pub/Mirrors/alpine/v$ALPINE_VERSION/main >> /etc/apk/repositories
-            apk add -U wget ca-certificates openssl >/dev/null
-            wget -q -O - https://kubernetes-helm.storage.googleapis.com/helm-v#{Gitlab::Kubernetes::Helm::HELM_VERSION}-linux-amd64.tar.gz | tar zxC /tmp >/dev/null
-            mv /tmp/linux-amd64/helm /usr/bin/
           HEREDOC
         end
 
diff --git a/lib/gitlab/kubernetes/helm/pod.rb b/lib/gitlab/kubernetes/helm/pod.rb
index 95192b11c0d..e9c621d96f0 100644
--- a/lib/gitlab/kubernetes/helm/pod.rb
+++ b/lib/gitlab/kubernetes/helm/pod.rb
@@ -25,7 +25,7 @@ module Gitlab
         def container_specification
           {
             name: 'helm',
-            image: 'alpine:3.6',
+            image: "registry.gitlab.com/gitlab-org/cluster-integration/helm-install-image/releases/#{Gitlab::Kubernetes::Helm::HELM_VERSION}-kube-#{Gitlab::Kubernetes::Helm::KUBECTL_VERSION}",
             env: generate_pod_env(command),
             command: %w(/bin/sh),
             args: %w(-c $(COMMAND_SCRIPT))
-- 
cgit v1.2.1


From ccb1ff9aca69ad6b01bcb9881aa8836741b070b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Lafoucri=C3=A8re?= <plafoucriere@gitlab.com>
Date: Sun, 4 Nov 2018 22:48:05 +0000
Subject: Update license_management job

---
 lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml b/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
index 734af5eba59..5a8cd92b75f 100644
--- a/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
@@ -116,12 +116,9 @@ code_quality:
 
 license_management:
   stage: test
-  image: docker:stable
+  image: "registry.gitlab.com/gitlab-org/security-products/license-management:$CI_SERVER_VERSION_MAJOR-$CI_SERVER_VERSION_MINOR-stable"
   allow_failure: true
-  services:
-    - docker:stable-dind
   script:
-    - setup_docker
     - license_management
   artifacts:
     paths: [gl-license-management-report.json]
@@ -525,11 +522,7 @@ rollout 100%:
   }
 
   function license_management() {
-    # Extract "MAJOR.MINOR" from CI_SERVER_VERSION and generate "MAJOR-MINOR-stable"
-    LICENSE_MANAGEMENT_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')
-
-    docker run --volume "$PWD:/code" \
-                                    "registry.gitlab.com/gitlab-org/security-products/license-management:$LICENSE_MANAGEMENT_VERSION" analyze /code
+    /run.sh analyze .
   }
 
   function sast() {
-- 
cgit v1.2.1