Add latest changes from gitlab-org/gitlab@master

Author: GitLab Bot

.graphqlrc

@@ -4,4 +4,5 @@ schema:
 documents:
   - ./app/assets/javascripts/**/*.graphql
   - ./ee/app/assets/javascripts/**/*.graphql
+  - ./jh/app/assets/javascripts/**/*.graphql
   - ./app/graphql/queries/**/*.graphql

app/assets/javascripts/work_items/components/work_item_attributes_wrapper.vue

@@ -12,8 +12,10 @@ import {
   WIDGET_TYPE_PROGRESS,
   WIDGET_TYPE_START_AND_DUE_DATE,
   WIDGET_TYPE_TIME_TRACKING,
+  WIDGET_TYPE_ROLLEDUP_DATES,
   WIDGET_TYPE_WEIGHT,
   WIDGET_TYPE_COLOR,
+  WORK_ITEM_TYPE_VALUE_EPIC,
 } from '../constants';
 import WorkItemAssigneesInline from './work_item_assignees_inline.vue';
 import WorkItemAssigneesWithEdit from './work_item_assignees_with_edit.vue';
@@ -61,6 +63,8 @@ export default {
       import('ee_component/work_items/components/work_item_color_inline.vue'),
     WorkItemColorWithEdit: () =>
       import('ee_component/work_items/components/work_item_color_with_edit.vue'),
+    WorkItemRolledupDates: () =>
+      import('ee_component/work_items/components/work_item_rolledup_dates.vue'),
   },
   mixins: [glFeatureFlagMixin()],
   props: {
@@ -92,6 +96,9 @@ export default {
     workItemDueDate() {
       return this.isWidgetPresent(WIDGET_TYPE_START_AND_DUE_DATE);
     },
+    workItemRolledupDates() {
+      return this.isWidgetPresent(WIDGET_TYPE_ROLLEDUP_DATES);
+    },
     workItemWeight() {
       return this.isWidgetPresent(WIDGET_TYPE_WEIGHT);
     },
@@ -113,6 +120,11 @@ export default {
     workItemMilestone() {
       return this.isWidgetPresent(WIDGET_TYPE_MILESTONE);
     },
+    showRolledupDates() {
+      return (
+        this.glFeatures.workItemsRolledupDates && this.workItemType === WORK_ITEM_TYPE_VALUE_EPIC
+      );
+    },
     workItemParent() {
       return this.isWidgetPresent(WIDGET_TYPE_HIERARCHY)?.parent;
     },
@@ -211,6 +223,20 @@ export default {
         @error="$emit('error', $event)"
       />
     </template>
+    <template v-if="workItemRolledupDates && showRolledupDates">
+      <work-item-rolledup-dates
+        :can-update="canUpdate"
+        :due-date-is-fixed="workItemRolledupDates.dueDateIsFixed"
+        :due-date-fixed="workItemRolledupDates.dueDateFixed"
+        :due-date-inherited="workItemRolledupDates.dueDate"
+        :start-date-is-fixed="workItemRolledupDates.startDateIsFixed"
+        :start-date-fixed="workItemRolledupDates.startDateFixed"
+        :start-date-inherited="workItemRolledupDates.startDate"
+        :work-item-type="workItemType"
+        :work-item="workItem"
+        @error="$emit('error', $event)"
+      />
+    </template>
     <template v-if="workItemMilestone">
       <work-item-milestone-with-edit
         v-if="workItemsBetaFeaturesEnabled"
@@ -257,7 +283,7 @@ export default {
         @error="$emit('error', $event)"
       />
     </template>
-    <template v-if="workItemDueDate">
+    <template v-if="workItemDueDate && !showRolledupDates">
       <work-item-due-date-with-edit
         v-if="workItemsBetaFeaturesEnabled"
         :can-update="canUpdate"

app/assets/javascripts/work_items/constants.js

@@ -17,6 +17,7 @@ export const WIDGET_TYPE_CURRENT_USER_TODOS = 'CURRENT_USER_TODOS';
 export const WIDGET_TYPE_LABELS = 'LABELS';
 export const WIDGET_TYPE_START_AND_DUE_DATE = 'START_AND_DUE_DATE';
 export const WIDGET_TYPE_TIME_TRACKING = 'TIME_TRACKING';
+export const WIDGET_TYPE_ROLLEDUP_DATES = 'ROLLEDUP_DATES';
 export const WIDGET_TYPE_WEIGHT = 'WEIGHT';
 export const WIDGET_TYPE_PARTICIPANTS = 'PARTICIPANTS';
 export const WIDGET_TYPE_PROGRESS = 'PROGRESS';

app/models/group.rb

@@ -918,6 +918,10 @@ def linked_work_items_feature_flag_enabled?
     feature_flag_enabled_for_self_or_ancestor?(:linked_work_items)
   end
 
+  def work_items_rolledup_dates_feature_flag_enabled?
+    feature_flag_enabled_for_self_or_ancestor?(:work_items_rolledup_dates)
+  end
+
   def supports_lock_on_merge?
     feature_flag_enabled_for_self_or_ancestor?(:enforce_locked_labels_on_merge, type: :ops)
   end

app/services/git/process_ref_changes_service.rb

@@ -9,6 +9,7 @@ def execute
 
       process_changes_by_action(:branch, changes.branch_changes)
       process_changes_by_action(:tag, changes.tag_changes)
+      warn_if_over_process_limit(changes.branch_changes + changes.tag_changes)
 
       perform_housekeeping
     end
@@ -63,7 +64,46 @@ def process_changes(ref_type, action, changes, execute_project_hooks:)
     end
 
     def under_process_limit?(change)
-      change[:index] < PIPELINE_PROCESS_LIMIT || Feature.enabled?(:git_push_create_all_pipelines, project)
+      change[:index] < process_limit || Feature.enabled?(:git_push_create_all_pipelines, project)
+    end
+
+    def process_limit
+      PIPELINE_PROCESS_LIMIT
+    end
+
+    def warn_if_over_process_limit(changes)
+      return unless process_limit > 0
+      return if changes.length <= process_limit
+
+      # We don't know for sure whether the project has CI enabled or CI rules
+      # that might excluded pipelines from being created.
+      omitted_refs = possible_omitted_pipeline_refs(changes)
+
+      return unless omitted_refs.present?
+
+      # This notification only lets the admin know that we might have skipped some refs.
+      Gitlab::AppJsonLogger.info(
+        message: "Some pipelines may not have been created because ref count exceeded limit",
+        ref_limit: process_limit,
+        total_ref_count: changes.length,
+        possible_omitted_refs: omitted_refs,
+        possible_omitted_ref_count: omitted_refs.length,
+        **Gitlab::ApplicationContext.current
+      )
+    end
+
+    def possible_omitted_pipeline_refs(changes)
+      # Pipelines can only be created on pushed for branch creation or updates
+      omitted_changes = changes.select do |change|
+        change[:index] >= process_limit &&
+          change_action(change) != :removed
+      end
+
+      # rubocop:disable CodeReuse/ActiveRecord -- not an ActiveRecord model
+      # rubocop:disable Database/AvoidUsingPluckWithoutLimit -- not an ActiveRecord model
+      omitted_changes.pluck(:ref).sort
+      # rubocop:enable CodeReuse/ActiveRecord
+      # rubocop:enable Database/AvoidUsingPluckWithoutLimit
     end
 
     def create_bulk_push_event(ref_type, action, changes)

app/services/resource_access_tokens/create_service.rb

@@ -84,7 +84,8 @@ def default_user_params
         email: username_and_email_generator.email,
         username: username_and_email_generator.username,
         user_type: :project_bot,
-        skip_confirmation: true # Bot users should always have their emails confirmed.
+        skip_confirmation: true, # Bot users should always have their emails confirmed.
+        organization_id: resource.organization_id
       }
     end
 

app/workers/members_destroyer/unassign_issuables_worker.rb

@@ -15,9 +15,7 @@ class UnassignIssuablesWorker
 
     idempotent!
 
-    # Remove the default value `nil` for `requesting_user_id` after 16.10.
-    # TODO: https://gitlab.com/gitlab-org/gitlab/-/issues/442878
-    def perform(user_id, entity_id, entity_type, requesting_user_id = nil)
+    def perform(user_id, entity_id, entity_type, requesting_user_id)
       unless ENTITY_TYPES.include?(entity_type)
         logger.error(
           message: "#{entity_type} is not a supported entity.",
@@ -42,9 +40,7 @@ def perform(user_id, entity_id, entity_type, requesting_user_id = nil)
         return
       end
 
-      # Remove the condition requesting_user_id after 16.10.
-      # TODO: https://gitlab.com/gitlab-org/gitlab/-/issues/442878
-      requesting_user = requesting_user_id && User.find(requesting_user_id)
+      requesting_user = User.find(requesting_user_id)
       user = User.find(user_id)
       entity = entity_type.constantize.find(entity_id)
 

config/webpack.config.js

@@ -42,9 +42,8 @@ const {
   WEBPACK_OUTPUT_PATH,
   WEBPACK_PUBLIC_PATH,
   SOURCEGRAPH_PUBLIC_PATH,
-  SOURCEGRAPH_OUTPUT_PATH,
-  GITLAB_WEB_IDE_OUTPUT_PATH,
   GITLAB_WEB_IDE_PUBLIC_PATH,
+  copyFilesPatterns,
 } = require('./webpack.constants');
 
 const createIncrementalWebpackCompiler = require('./helpers/incremental_webpack_compiler');
@@ -89,9 +88,6 @@ if (WEBPACK_REPORT) {
   NO_HASHED_CHUNKS = true;
 }
 
-const SOURCEGRAPH_PACKAGE = '@sourcegraph/code-host-integration';
-const GITLAB_WEB_IDE_PACKAGE = '@gitlab/web-ide';
-
 const devtool = IS_PRODUCTION ? 'source-map' : 'cheap-module-eval-source-map';
 
 let autoEntriesCount = 0;
@@ -711,34 +707,7 @@ module.exports = {
       }),
 
     new CopyWebpackPlugin({
-      patterns: [
-        {
-          from: path.join(ROOT_PATH, 'node_modules/pdfjs-dist/cmaps/'),
-          to: path.join(WEBPACK_OUTPUT_PATH, 'pdfjs/cmaps/'),
-        },
-        {
-          from: path.join(ROOT_PATH, 'node_modules/pdfjs-dist/legacy/build/pdf.worker.min.js'),
-          to: path.join(WEBPACK_OUTPUT_PATH, 'pdfjs/'),
-        },
-        {
-          from: path.join(ROOT_PATH, 'node_modules', SOURCEGRAPH_PACKAGE, '/'),
-          to: SOURCEGRAPH_OUTPUT_PATH,
-          globOptions: {
-            ignore: ['package.json'],
-          },
-        },
-        {
-          from: path.join(ROOT_PATH, 'node_modules', GITLAB_WEB_IDE_PACKAGE, 'dist', 'public'),
-          to: GITLAB_WEB_IDE_OUTPUT_PATH,
-        },
-        {
-          from: path.join(
-            ROOT_PATH,
-            'node_modules/@gitlab/visual-review-tools/dist/visual_review_toolbar.js',
-          ),
-          to: WEBPACK_OUTPUT_PATH,
-        },
-      ],
+      patterns: copyFilesPatterns,
     }),
 
     // compression can require a lot of compute time and is disabled in CI

config/webpack.constants.js

@@ -18,14 +18,45 @@ const GITLAB_WEB_IDE_PUBLIC_PATH = path.join(WEBPACK_PUBLIC_PATH, GITLAB_WEB_IDE
 const IS_EE = require('./helpers/is_ee_env');
 const IS_JH = require('./helpers/is_jh_env');
 
+const SOURCEGRAPH_PACKAGE = '@sourcegraph/code-host-integration';
+const GITLAB_WEB_IDE_PACKAGE = '@gitlab/web-ide';
+
+const copyFilesPatterns = [
+  {
+    from: path.join(ROOT_PATH, 'node_modules/pdfjs-dist/cmaps/'),
+    to: path.join(WEBPACK_OUTPUT_PATH, 'pdfjs/cmaps/'),
+  },
+  {
+    from: path.join(ROOT_PATH, 'node_modules/pdfjs-dist/legacy/build/pdf.worker.min.js'),
+    to: path.join(WEBPACK_OUTPUT_PATH, 'pdfjs/'),
+  },
+  {
+    from: path.join(ROOT_PATH, 'node_modules', SOURCEGRAPH_PACKAGE, '/'),
+    to: SOURCEGRAPH_OUTPUT_PATH,
+    globOptions: {
+      ignore: ['package.json'],
+    },
+  },
+  {
+    from: path.join(ROOT_PATH, 'node_modules', GITLAB_WEB_IDE_PACKAGE, 'dist', 'public'),
+    to: GITLAB_WEB_IDE_OUTPUT_PATH,
+  },
+  {
+    from: path.join(
+      ROOT_PATH,
+      'node_modules/@gitlab/visual-review-tools/dist/visual_review_toolbar.js',
+    ),
+    to: WEBPACK_OUTPUT_PATH,
+  },
+];
+
 module.exports = {
   IS_EE,
   IS_JH,
   ROOT_PATH,
   WEBPACK_OUTPUT_PATH,
   WEBPACK_PUBLIC_PATH,
-  SOURCEGRAPH_OUTPUT_PATH,
   SOURCEGRAPH_PUBLIC_PATH,
-  GITLAB_WEB_IDE_OUTPUT_PATH,
   GITLAB_WEB_IDE_PUBLIC_PATH,
+  copyFilesPatterns,
 };

db/docs/batched_background_migrations/purge_security_scans_with_empty_finding_data.yml

@@ -7,4 +7,4 @@ milestone: '16.10'
 queued_migration_version: 20240209153920
 # Replace with the approximate date you think it's best to ensure the completion of this BBM.
 finalize_after: '2024-03-15'
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: 20240320102510

db/post_migrate/20240320102510_finalize_purge_security_scans_with_empty_finding_data.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class FinalizePurgeSecurityScansWithEmptyFindingData < Gitlab::Database::Migration[2.2]
+  disable_ddl_transaction!
+
+  milestone '16.11'
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  def up
+    return if Gitlab.com? || !Gitlab.ee?
+
+    ensure_batched_background_migration_is_finished(
+      job_class_name: 'PurgeSecurityScansWithEmptyFindingData',
+      table_name: :security_scans,
+      column_name: :id,
+      job_arguments: [],
+      finalize: true
+    )
+  end
+
+  def down
+    # no-op
+  end
+end

db/schema_migrations/20240320102510

@@ -0,0 +1 @@
+9cf0040ec4eb9f9baa7bdef04e8afe07bcac0091053ae7810440993609d0f1bc

doc/administration/geo/secondary_proxy/index.md

@@ -76,31 +76,6 @@ a single URL used by all Geo sites, including the primary.
 
 In Kubernetes, you can [use the same domain under `global.hosts.domain` as for the primary site](https://docs.gitlab.com/charts/advanced/geo/index.html).
 
-## Geo proxying with Separate URLs
-
-> - Geo secondary proxying for separate URLs is [enabled by default](https://gitlab.com/gitlab-org/gitlab/-/issues/346112) in GitLab 15.1.
-
-NOTE:
-The feature flag described in this section is planned to be deprecated and removed in a future release. Support for read-only Geo secondary sites is proposed in [issue 366810](https://gitlab.com/gitlab-org/gitlab/-/issues/366810), you can upvote and share your use cases in that issue.
-
-If you run into issues, to disable this feature, disable the `geo_secondary_proxy_separate_urls` feature flag.
-
-1. SSH into one node running Rails on your primary Geo site and run:
-
-   ```shell
-   sudo gitlab-rails runner "Feature.disable(:geo_secondary_proxy_separate_urls)"
-   ```
-
-1. Restart Puma on all of the nodes running Rails on your secondary Geo site:
-
-   ```shell
-   sudo gitlab-ctl restart puma
-   ```
-
-In Kubernetes, you can run the same command in the toolbox pod. Refer to the
-[Kubernetes cheat sheet](https://docs.gitlab.com/charts/troubleshooting/kubernetes_cheat_sheet.html#gitlab-specific-kubernetes-information)
-for details.
-
 ## Limitations
 
 - When secondary proxying is used, the asynchronous Geo replication can cause unexpected issues for accelerated
@@ -204,3 +179,30 @@ gitlab:
     extraEnv:
       GEO_SECONDARY_PROXY: "0"
 ```
+
+## Geo proxying with Separate URLs
+
+> - Geo secondary proxying for separate URLs is [enabled by default](https://gitlab.com/gitlab-org/gitlab/-/issues/346112) in GitLab 15.1.
+
+NOTE:
+The feature flag described in this section is planned to be deprecated and removed in a future release. Support for read-only Geo secondary sites is proposed in [issue 366810](https://gitlab.com/gitlab-org/gitlab/-/issues/366810), you can upvote and share your use cases in that issue.
+
+Geo proxying for seperate URLs is enabled by default from GitLab 15.1. This allows secondary sites to proxy actions to the primary site even if the URLS are different.
+
+If you run into issues, disable the `geo_secondary_proxy_separate_urls` feature flag to disable the feature.
+
+1. SSH into one node running Rails on your primary Geo site and run:
+
+   ```shell
+   sudo gitlab-rails runner "Feature.disable(:geo_secondary_proxy_separate_urls)"
+   ```
+
+1. Restart Puma on all of the nodes running Rails on your secondary Geo site:
+
+   ```shell
+   sudo gitlab-ctl restart puma
+   ```
+
+In Kubernetes, you can run the same command in the toolbox pod. Refer to the
+[Kubernetes cheat sheet](https://docs.gitlab.com/charts/troubleshooting/kubernetes_cheat_sheet.html#gitlab-specific-kubernetes-information)
+for details.

doc/development/cloud_connector/index.md

@@ -104,8 +104,8 @@ To add a new feature bound to a scope:
       services:
         new_feature_scope:
           service_start_time: 2024-02-15 00:00:00 UTC
-            min_gitlab_version: '16.8'
-            bundled_with: 'duo_pro'
+          min_gitlab_version: '16.8'
+          bundled_with: 'duo_pro'
     ```
 
 1. **Optional:** If the backend service the token is used for requires additional claims to be embedded in the