Add latest changes from gitlab-org/gitlab@master

Author: GitLab Bot

.rubocop_manual_todo.yml

@@ -1884,7 +1884,6 @@ Gitlab/NamespacedClass:
     - 'app/models/issue_email_participant.rb'
     - 'app/models/issue_link.rb'
     - 'app/models/issue_user_mention.rb'
-    - 'app/models/iteration.rb'
     - 'app/models/jira_connect_installation.rb'
     - 'app/models/jira_connect_subscription.rb'
     - 'app/models/jira_import_state.rb'
@@ -2696,6 +2695,7 @@ Gitlab/NamespacedClass:
     - 'ee/app/models/issuable_metric_image.rb'
     - 'ee/app/models/issuable_sla.rb'
     - 'ee/app/models/issuables_analytics.rb'
+    - 'ee/app/models/iteration.rb'
     - 'ee/app/models/iteration_note.rb'
     - 'ee/app/models/ldap_group_link.rb'
     - 'ee/app/models/ldap_key.rb'

GITLAB_KAS_VERSION

@@ -1 +1 @@
-13.10.1
+13.11.0

app/models/iteration.rb

@@ -5,4 +5,4 @@ rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/299366
 milestone: '13.8'
 type: development
 group: group::project management
-default_enabled: false
+default_enabled: true

config/feature_flags/development/board_new_list.yml

@@ -164,7 +164,7 @@ stages:
   - build
   - dast
 
-include: 
+include:
   - template: DAST.gitlab-ci.yml
 
 # Deploys the container to the GitLab container registry
@@ -469,16 +469,14 @@ variables:
 
 #### Import API specification from a file
 
-If your API specification is in your repository, you can provide the specification's
-filename directly as the target. The specification file is expected to be in the
-`/zap/wrk` directory.
+If your API specification file is in your repository, you can provide its filename as the target.
+The API specification file must be in the `/zap/wrk` directory.
 
 ```yaml
 dast:
-  script:
+  before_script:
     - mkdir -p /zap/wrk
     - cp api-specification.yml /zap/wrk/api-specification.yml
-    - /analyze -t $DAST_WEBSITE
   variables:
     GIT_STRATEGY: fetch
     DAST_API_SPECIFICATION: api-specification.yml
@@ -496,6 +494,12 @@ host referenced may be different than the host of the API's review instance.
 This can cause incorrect URLs to be imported, or a scan on an incorrect host.
 Use the `DAST_API_HOST_OVERRIDE` CI/CD variable to override these values.
 
+WARNING:
+When using the API host override feature, you cannot use the `$DAST_WEBSITE` variable to override the hostname.
+A host override is _only_ supported when importing the API specification from a URL. Attempts to override the
+host throw an error when the API specification is imported from a file. This is due to a limitation in the
+ZAP OpenAPI extension.
+
 For example, with a OpenAPI V3 specification containing:
 
 ```yaml
@@ -515,10 +519,6 @@ variables:
   DAST_API_HOST_OVERRIDE: api-test.host.com
 ```
 
-Note that using a host override is ONLY supported when importing the API specification from a URL.
-It doesn't work and is ignored when importing the specification from a file. This is due to a
-limitation in the ZAP OpenAPI extension.
-
 #### Authentication using headers
 
 Tokens in request headers are often used as a way to authenticate API requests.
@@ -963,7 +963,7 @@ follows:
 - _Header validation_ requires the header `Gitlab-On-Demand-DAST` be added to the target site,
   with a value unique to the project. The validation process checks that the header is present, and
   checks its value.
-  
+
 Both methods are equivalent in functionality. Use whichever is feasible.
 
 #### Create a site profile

doc/user/application_security/dast/index.md

@@ -342,14 +342,16 @@ As in other list types, click the trash icon to remove a list.
 
 ### Iteration lists **(PREMIUM)**
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/250479) in GitLab 13.10.
-> - It's [deployed behind the `board_new_lists` and `iteration_board_lists` feature flags](../feature_flags.md), disabled by default.
-> - It's disabled on GitLab.com.
-> - It's recommended for production use.
-> - To use it in GitLab self-managed instances, ask a GitLab administrator to enable the feature flags: [`board_new_lists`](#enable-or-disable-new-add-list-form) and [`iteration_board_lists`](#enable-or-disable-iteration-lists-in-boards).
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/250479) in GitLab 13.11.
+> - [Deployed behind the `board_new_lists` and `iteration_board_lists` feature flags](../feature_flags.md), disabled by default.
+> - [Enabled by default](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/57439) in GitLab 13.11.
+> - Enabled on GitLab.com.
+> - Recommended for production use.
+> - For GitLab self-managed instances, GitLab administrators can opt to disable the feature flags: [`board_new_lists`](#enable-or-disable-new-add-list-form) and [`iteration_board_lists`](#enable-or-disable-iteration-lists-in-boards). **(PREMIUM SELF)**
 
-WARNING:
-This feature might not be available to you. Check the **version history** note above for details.
+There can be
+[risks when disabling released features](../feature_flags.md#risks-when-disabling-released-features).
+Refer to this feature's version history for more details.
 
 You're also able to create lists of an iteration.
 These are lists that filter issues by the assigned
@@ -646,10 +648,10 @@ Feature.disable(:graphql_board_lists)
 
 ### Enable or disable new add list form **(FREE SELF)**
 
-The new form for adding lists is under development and not ready for production use. It is
-deployed behind a feature flag that is **disabled by default**.
+The new form for adding lists is under development but ready for production use. It is
+deployed behind a feature flag that is **enabled by default**.
 [GitLab administrators with access to the GitLab Rails console](../../administration/feature_flags.md)
-can enable it.
+can disable it.
 
 To enable it:
 
@@ -666,12 +668,12 @@ Feature.disable(:board_new_list)
 ### Enable or disable iteration lists in boards **(PREMIUM SELF)**
 
 NOTE:
-To enable iteration lists in boards, you also need to enable the [new add list form](#enable-or-disable-new-add-list-form).
+When disabling iteration lists in boards, you also need to disable the [new add list form](#enable-or-disable-new-add-list-form).
 
-The iteration list is under development and not ready for production use. It is
-deployed behind a feature flag that is **disabled by default**.
+The iteration list is under development but ready for production use. It is
+deployed behind a feature flag that is **enabled by default**.
 [GitLab administrators with access to the GitLab Rails console](../../administration/feature_flags.md)
-can enable it.
+can disable it.
 
 To enable it:
 

doc/user/project/issue_board.md

@@ -29,7 +29,7 @@ module QA
                 content: <<~EOF
                   test:
                     tags: ["runner-for-#{project.name}"]
-                    script: sleep 5
+                    script: sleep 10
                     only:
                       - merge_requests
                 EOF
@@ -47,36 +47,50 @@ module QA
       end
 
       it 'merges when pipeline succeeds', testcase: 'https://gitlab.com/gitlab-org/quality/testcases/-/issues/1684' do
-        branch_name = "merge-request-test-#{SecureRandom.hex(8)}"
+        verify_merge_when_pipeline_succeeds
+      end
 
-        # Create a branch that will be merged into the default branch
-        Resource::Repository::ProjectPush.fabricate! do |project_push|
-          project_push.project = project
-          project_push.new_branch = true
-          project_push.branch_name = branch_name
-          project_push.file_name = "file-#{SecureRandom.hex(8)}.txt"
+      it 'reliably merges when pipeline succeeds', :transient, testcase: 'https://gitlab.com/gitlab-org/quality/testcases/-/issues/1684' do
+        verify_merge_when_pipeline_succeeds(repeat: Runtime::Env.transient_trials) do |i|
+          QA::Runtime::Logger.info("Transient bug test - Trial #{i}")
         end
+      end
 
-        # Create a merge request to merge the branch we just created
-        merge_request = Resource::MergeRequest.fabricate_via_api! do |merge_request|
-          merge_request.project = project
-          merge_request.source_branch = branch_name
-          merge_request.no_preparation = true
-        end
+      def verify_merge_when_pipeline_succeeds(repeat: 1)
+        repeat.times do |i|
+          yield i if block_given?
 
-        merge_request.visit!
+          branch_name = "merge-request-test-#{SecureRandom.hex(8)}"
 
-        Page::MergeRequest::Show.perform do |mr|
-          mr.merge_when_pipeline_succeeds!
+          # Create a branch that will be merged into the default branch
+          Resource::Repository::ProjectPush.fabricate! do |project_push|
+            project_push.project = project
+            project_push.new_branch = true
+            project_push.branch_name = branch_name
+            project_push.file_name = "file-#{SecureRandom.hex(8)}.txt"
+          end
 
-          Support::Waiter.wait_until(sleep_interval: 5) do
-            merge_request = merge_request.reload!
-            merge_request.state == 'merged'
+          # Create a merge request to merge the branch we just created
+          merge_request = Resource::MergeRequest.fabricate_via_api! do |merge_request|
+            merge_request.project = project
+            merge_request.source_branch = branch_name
+            merge_request.no_preparation = true
           end
 
-          aggregate_failures do
-            expect(merge_request.merge_when_pipeline_succeeds).to be_truthy
-            expect(mr.merged?).to be_truthy, "Expected content 'The changes were merged' but it did not appear."
+          merge_request.visit!
+
+          Page::MergeRequest::Show.perform do |mr|
+            mr.merge_when_pipeline_succeeds!
+
+            Support::Waiter.wait_until(sleep_interval: 5) do
+              merge_request = merge_request.reload!
+              merge_request.state == 'merged'
+            end
+
+            aggregate_failures do
+              expect(merge_request.merge_when_pipeline_succeeds).to be_truthy
+              expect(mr.merged?).to be_truthy, "Expected content 'The changes were merged' but it did not appear."
+            end
           end
         end
       end

qa/qa/specs/features/browser_ui/3_create/merge_request/merge_when_pipeline_succeeds_spec.rb

@@ -1,18 +1,38 @@
 import { waitFor } from '@testing-library/dom';
 import MockAdapter from 'axios-mock-adapter';
 import { cloneDeep } from 'lodash';
-import { getFixture, getJSONFixture } from 'helpers/fixtures';
+import { getJSONFixture } from 'helpers/fixtures';
 import axios from '~/lib/utils/axios_utils';
 import UsersSelect from '~/users_select';
 
-const getUserSearchHTML = () => {
-  const html = getFixture('merge_requests/merge_request_of_current_user.html');
-  const parser = new DOMParser();
-
-  const el = parser.parseFromString(html, 'text/html').querySelector('.assignee');
-
-  return el.outerHTML;
-};
+// TODO: generate this from a fixture that guarantees the same output in CE and EE [(see issue)][1].
+// Hardcoding this HTML temproarily fixes a FOSS ~"master::broken" [(see issue)][2].
+// [1]: https://gitlab.com/gitlab-org/gitlab/-/issues/327809
+// [2]: https://gitlab.com/gitlab-org/gitlab/-/issues/327805
+const getUserSearchHTML = () => `
+<div class="js-sidebar-assignee-data selectbox hide-collapsed">
+<input type="hidden" name="merge_request[assignee_ids][]" value="0">
+<div class="dropdown js-sidebar-assignee-dropdown">
+<button class="dropdown-menu-toggle js-user-search js-author-search js-multiselect js-save-user-data js-invite-members-track" type="button" data-first-user="frontend-fixtures" data-current-user="true" data-iid="1" data-issuable-type="merge_request" data-project-id="1" data-author-id="1" data-field-name="merge_request[assignee_ids][]" data-issue-update="http://test.host/frontend-fixtures/merge-requests-project/-/merge_requests/1.json" data-ability-name="merge_request" data-null-user="true" data-display="static" data-multi-select="true" data-dropdown-title="Select assignee(s)" data-dropdown-header="Assignee(s)" data-track-event="show_invite_members" data-toggle="dropdown"><span class="dropdown-toggle-text ">Select assignee(s)</span><svg class="s16 dropdown-menu-toggle-icon gl-top-3" data-testid="chevron-down-icon"><use xlink:href="http://test.host/assets/icons-16c30bec0d8a57f0a33e6f6215c6aff7a6ec5e4a7e6b7de733a6b648541a336a.svg#chevron-down"></use></svg></button><div class="dropdown-menu dropdown-select dropdown-menu-user dropdown-menu-selectable dropdown-menu-author dropdown-extended-height">
+<div class="dropdown-title gl-display-flex">
+<span class="gl-ml-auto">Assign to</span><button class="dropdown-title-button dropdown-menu-close gl-ml-auto" aria-label="Close" type="button"><svg class="s16 dropdown-menu-close-icon" data-testid="close-icon"><use xlink:href="http://test.host/assets/icons-16c30bec0d8a57f0a33e6f6215c6aff7a6ec5e4a7e6b7de733a6b648541a336a.svg#close"></use></svg></button>
+</div>
+<div class="dropdown-input">
+<input type="search" id="" data-qa-selector="dropdown_input_field" class="dropdown-input-field" placeholder="Search users" autocomplete="off"><svg class="s16 dropdown-input-search" data-testid="search-icon"><use xlink:href="http://test.host/assets/icons-16c30bec0d8a57f0a33e6f6215c6aff7a6ec5e4a7e6b7de733a6b648541a336a.svg#search"></use></svg><svg class="s16 dropdown-input-clear js-dropdown-input-clear" data-testid="close-icon"><use xlink:href="http://test.host/assets/icons-16c30bec0d8a57f0a33e6f6215c6aff7a6ec5e4a7e6b7de733a6b648541a336a.svg#close"></use></svg>
+</div>
+<div data-qa-selector="dropdown_list_content" class="dropdown-content "></div>
+<div class="dropdown-footer">
+<ul class="dropdown-footer-list">
+<li>
+<div class="js-invite-members-trigger" data-display-text="Invite Members" data-event="click_invite_members" data-label="edit_assignee" data-trigger-element="anchor"></div>
+</li>
+</ul>
+</div>
+<div class="dropdown-loading"><div class="gl-spinner-container"><span class="gl-spinner gl-spinner-orange gl-spinner-md gl-mt-7" aria-label="Loading"></span></div></div>
+</div>
+</div>
+</div>
+`;
 
 const USER_SEARCH_HTML = getUserSearchHTML();
 const AUTOCOMPLETE_USERS = getJSONFixture('autocomplete/users.json');