Add latest changes from gitlab-org/gitlab@master

.gitlab-ci.yml

@@ -265,13 +265,13 @@ include:
   - local: .gitlab/ci/includes/as-if-jh.gitlab-ci.yml
     rules:
       # Only run as-if-jh triggerred pipelines for gitlab.com/gitlab-org/gitlab MRs that don't target stable branches
-      # and that don't have the quarantine or pipeline:expedite labels.
+      # and that don't have the quarantine or pipeline::expedited labels.
       - if: '$CI_PROJECT_URL != "https://gitlab.com/gitlab-org/gitlab"'
         when: never
       - if: '$CI_MERGE_REQUEST_ID == null'
         when: never
       - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee|-jh)?$/'
         when: never
-      - if: '$CI_MERGE_REQUEST_LABELS =~ /quarantine/ || $CI_MERGE_REQUEST_LABELS =~ /pipeline:expedite/'
+      - if: '$CI_MERGE_REQUEST_LABELS =~ /quarantine/ || $CI_MERGE_REQUEST_LABELS =~ /pipeline::expedited/ || $CI_MERGE_REQUEST_LABELS =~ /pipeline:expedite/'
         when: never
       - when: always

.gitlab/ci/docs.gitlab-ci.yml

@@ -39,26 +39,9 @@ review-docs-cleanup:
   script:
     - ./scripts/trigger-build.rb docs cleanup
 
-docs-lint links:
-  extends:
-    - .docs:rules:docs-lint
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-html:alpine-3.19-ruby-3.2.3-acbeb4ef
-  stage: lint
-  needs: []
-  script:
-    # Prepare docs for build
-    # The path must be 'ee/' because we have hardcoded links relying on it
-    # https://gitlab.com/gitlab-org/gitlab-docs/-/blob/887850752fc0e72856da6632db132f005ba77f16/content/index.erb#L44-63
-    - mv doc/ /tmp/gitlab-docs/content/ee
-    - cd /tmp/gitlab-docs
-    # Build HTML from Markdown
-    - make compile
-    # Check the internal links and anchors (in parallel)
-    - "parallel time bundle exec nanoc check ::: internal_links internal_anchors"
-
 .docs-markdown-lint-image:
   # When updating the image version here, update it in /scripts/lint-doc.sh too.
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.19-vale-3.0.7-markdownlint-0.39.0-markdownlint2-0.12.1
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.20-vale-3.4.2-markdownlint2-0.13.0-lychee-0.15.1
 
 docs-lint markdown:
   extends:
@@ -103,6 +86,15 @@ docs code_quality:
     expire_in: 2 weeks
     when: always
 
+docs-lint links:
+  extends:
+    - .docs:rules:docs-lint
+    - .docs-markdown-lint-image
+  stage: lint
+  needs: []
+  script:
+    - lychee --offline --include-fragments doc/**/*.md
+
 ui-docs-links lint:
   extends:
     - .docs:rules:docs-lint

.gitlab/ci/rules.gitlab-ci.yml

@@ -105,7 +105,7 @@
   if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /group::global search/'
 
 .if-merge-request-labels-pipeline-expedite: &if-merge-request-labels-pipeline-expedite
-  if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:expedite/'
+  if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && ($CI_MERGE_REQUEST_LABELS =~ /pipeline::expedited/ || $CI_MERGE_REQUEST_LABELS =~ /pipeline:expedite/)'
 
 .if-merge-request-labels-frontend-and-feature-flag: &if-merge-request-labels-frontend-and-feature-flag
   if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /frontend/ && $CI_MERGE_REQUEST_LABELS =~ /feature flag/'

.gitlab/merge_request_templates/Revert To Resolve Incident.md

@@ -23,7 +23,7 @@
 ### Related issues and merge requests
 
 
-/label ~"pipeline:expedite" ~"master:broken" ~"Pick into auto-deploy" ~"severity::1" ~"priority::1"
+/label ~"pipeline::expedited" ~"master:broken" ~"Pick into auto-deploy" ~"severity::1" ~"priority::1"
 
 <!--
    Regression label: if applicable, specify the milestone-specific regression label

.rubocop_todo/gitlab/strong_memoize_attr.yml

@@ -505,10 +505,8 @@ Gitlab/StrongMemoizeAttr:
     - 'lib/gitlab/ci/pipeline/chain/command.rb'
     - 'lib/gitlab/ci/pipeline/chain/config/content.rb'
     - 'lib/gitlab/ci/pipeline/chain/create.rb'
-    - 'lib/gitlab/ci/pipeline/chain/evaluate_workflow_rules.rb'
     - 'lib/gitlab/ci/pipeline/chain/limit/active_jobs.rb'
     - 'lib/gitlab/ci/pipeline/chain/limit/rate_limit.rb'
-    - 'lib/gitlab/ci/pipeline/chain/seed.rb'
     - 'lib/gitlab/ci/pipeline/chain/skip.rb'
     - 'lib/gitlab/ci/pipeline/expression/lexer.rb'
     - 'lib/gitlab/ci/pipeline/quota/deployments.rb'

.rubocop_todo/rspec/context_wording.yml

@@ -1597,7 +1597,6 @@ RSpec/ContextWording:
     - 'spec/lib/gitlab/ci/parsers/test/junit_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/command_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/create_spec.rb'
-    - 'spec/lib/gitlab/ci/pipeline/chain/helpers_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/seed_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/validate/abilities_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/duration_spec.rb'

.rubocop_todo/rspec/feature_category.yml

@@ -2880,7 +2880,6 @@ RSpec/FeatureCategory:
     - 'spec/lib/gitlab/ci/pipeline/chain/ensure_environments_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/ensure_resource_groups_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/evaluate_workflow_rules_spec.rb'
-    - 'spec/lib/gitlab/ci/pipeline/chain/helpers_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/limit/active_jobs_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/limit/deployments_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/limit/rate_limit_spec.rb'

.rubocop_todo/rspec/named_subject.yml

@@ -1876,7 +1876,6 @@ RSpec/NamedSubject:
     - 'spec/lib/gitlab/ci/pipeline/chain/config/content_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/ensure_environments_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/ensure_resource_groups_spec.rb'
-    - 'spec/lib/gitlab/ci/pipeline/chain/helpers_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/limit/active_jobs_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/remove_unwanted_chat_jobs_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/sequence_spec.rb'

.rubocop_todo/rspec/scattered_let.yml

@@ -126,7 +126,6 @@ RSpec/ScatteredLet:
     - 'spec/lib/gitlab/checks/matching_merge_request_spec.rb'
     - 'spec/lib/gitlab/ci/config/external/file/artifact_spec.rb'
     - 'spec/lib/gitlab/ci/config_spec.rb'
-    - 'spec/lib/gitlab/ci/pipeline/chain/helpers_spec.rb'
     - 'spec/lib/gitlab/ci/status/stage/factory_spec.rb'
     - 'spec/lib/gitlab/ci/yaml_processor_spec.rb'
     - 'spec/lib/gitlab/cycle_analytics/stage_summary_spec.rb'

.rubocop_todo/rspec/verified_doubles.yml

@@ -373,7 +373,6 @@ RSpec/VerifiedDoubles:
     - 'spec/lib/gitlab/ci/config/external/rules_spec.rb'
     - 'spec/lib/gitlab/ci/parsers/test/junit_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/evaluate_workflow_rules_spec.rb'
-    - 'spec/lib/gitlab/ci/pipeline/chain/helpers_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/limit/deployments_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/remove_unwanted_chat_jobs_spec.rb'
     - 'spec/lib/gitlab/ci/pipeline/chain/sequence_spec.rb'

.rubocop_todo/style/if_unless_modifier.yml

@@ -620,8 +620,6 @@ Style/IfUnlessModifier:
     - 'lib/gitlab/ci/config/normalizer.rb'
     - 'lib/gitlab/ci/parsers/coverage/sax_document.rb'
     - 'lib/gitlab/ci/parsers/security/common.rb'
-    - 'lib/gitlab/ci/pipeline/chain/populate.rb'
-    - 'lib/gitlab/ci/pipeline/chain/seed.rb'
     - 'lib/gitlab/ci/pipeline/chain/validate/abilities.rb'
     - 'lib/gitlab/ci/pipeline/chain/validate/repository.rb'
     - 'lib/gitlab/ci/pipeline/expression/lexeme/base.rb'

GITLAB_PAGES_VERSION

@@ -1 +1 @@
-9fef3b59e0562e140085c950a87e0f6a2566dfc5
+a8ff22f80ef2fff0e29bea366cc601f278c8f7db

Gemfile

@@ -273,7 +273,7 @@ gem 're2', '2.7.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Misc
 
-gem 'semver_dialects', '~> 2.0', '>= 2.0.2', feature_category: :software_composition_analysis
+gem 'semver_dialects', '~> 3.0', feature_category: :software_composition_analysis
 gem 'version_sorter', '~> 2.3' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'csv_builder', path: 'gems/csv_builder' # rubocop:todo Gemfile/MissingFeatureCategory
 

Gemfile.checksum

@@ -618,7 +618,7 @@
 {"name":"sd_notify","version":"0.1.1","platform":"ruby","checksum":"cbc7ac6caa7cedd26b30a72b5eeb6f36050dc0752df263452ea24fb5a4ad3131"},
 {"name":"seed-fu","version":"2.3.7","platform":"ruby","checksum":"f19673443e9af799b730e3d4eca6a89b39e5a36825015dffd00d02ea3365cf74"},
 {"name":"selenium-webdriver","version":"4.21.1","platform":"ruby","checksum":"c30b64014532fc5156c60797985f839f36adbe60ff4653e7112b008dc1c83263"},
-{"name":"semver_dialects","version":"2.0.2","platform":"ruby","checksum":"60059c9f416f931b5212d862fad2879d6b9affb8e0b9afb0d91b793639c116fe"},
+{"name":"semver_dialects","version":"3.0.0","platform":"ruby","checksum":"daab2476c2a5d779e1c97ae9b92e59803757e679453692402dfbe364c3cf7b3e"},
 {"name":"sentry-rails","version":"5.17.3","platform":"ruby","checksum":"017771c42d739c0ad2213a581ca9d005cf543227bc13662cd1ca9909f2429459"},
 {"name":"sentry-ruby","version":"5.17.3","platform":"ruby","checksum":"61791a4b0bb0f95cd87aceeaa1efa6d4ab34d64236c9d5df820478adfe2fbbfc"},
 {"name":"sentry-sidekiq","version":"5.17.3","platform":"ruby","checksum":"d0714a218999e41e38127d0c174e0ee62a32b069f92e85b544e0c2125eca2c58"},

Gemfile.lock

@@ -1649,7 +1649,7 @@ GEM
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
-    semver_dialects (2.0.2)
+    semver_dialects (3.0.0)
       deb_version (~> 1.0.1)
       pastel (~> 0.8.0)
       thor (~> 1.3)
@@ -2205,7 +2205,7 @@ DEPENDENCIES
   sd_notify (~> 0.1.0)
   seed-fu (~> 2.3.7)
   selenium-webdriver (~> 4.21, >= 4.21.1)
-  semver_dialects (~> 2.0, >= 2.0.2)
+  semver_dialects (~> 3.0)
   sentry-rails (~> 5.17.3)
   sentry-ruby (~> 5.17.3)
   sentry-sidekiq (~> 5.17.3)

app/assets/javascripts/error_tracking_settings/components/app.vue

@@ -198,7 +198,7 @@ export default {
     </gl-form-group>
     <gl-form-group
       v-if="showGitlabDsnSetting"
-      :label="__('Paste this DSN into your Sentry SDK')"
+      :label="__('Paste this Data Source Name (DSN) into your Sentry SDK.')"
       data-testid="gitlab-dsn-setting-form"
     >
       <gl-form-input-group readonly :value="gitlabDsn">

app/assets/javascripts/issues/list/constants.js

@@ -12,6 +12,7 @@ import {
   OPERATOR_AFTER,
   OPERATOR_BEFORE,
   TOKEN_TYPE_ASSIGNEE,
+  TOKEN_TYPE_MR_ASSIGNEE,
   TOKEN_TYPE_AUTHOR,
   TOKEN_TYPE_CONFIDENTIAL,
   TOKEN_TYPE_CONTACT,
@@ -214,6 +215,26 @@ export const filtersMap = {
       },
     },
   },
+  [TOKEN_TYPE_MR_ASSIGNEE]: {
+    [API_PARAM]: {
+      [NORMAL_FILTER]: 'assigneeUsername',
+      [SPECIAL_FILTER]: 'assigneeWildcardId',
+      [ALTERNATIVE_FILTER]: 'assigneeId',
+    },
+    [URL_PARAM]: {
+      [OPERATOR_IS]: {
+        [NORMAL_FILTER]: 'mr_assignee_username',
+        [SPECIAL_FILTER]: 'mr_assignee_id',
+        [ALTERNATIVE_FILTER]: 'mr_assignee_username',
+      },
+      [OPERATOR_NOT]: {
+        [NORMAL_FILTER]: 'not[mr_assignee_username]',
+      },
+      [OPERATOR_OR]: {
+        [NORMAL_FILTER]: 'or[mr_assignee_username]',
+      },
+    },
+  },
   [TOKEN_TYPE_ASSIGNEE]: {
     [API_PARAM]: {
       [NORMAL_FILTER]: 'assigneeUsernames',

app/assets/javascripts/merge_requests/components/reviewers/reviewer_dropdown.vue

@@ -167,7 +167,7 @@ export default {
               />
             </div>
             <span class="gl-display-flex gl-flex-direction-column">
-              <span class="gl-font-weight-bold gl-white-space-nowrap">{{ item.text }}</span>
+              <span class="gl-font-bold gl-white-space-nowrap">{{ item.text }}</span>
               <span class="gl-text-gray-400"> {{ item.secondaryText }}</span>
             </span>
           </span>

app/assets/javascripts/merge_requests/list/components/merge_requests_list_app.vue

@@ -23,6 +23,8 @@ import {
   TOKEN_TYPE_TARGET_BRANCH,
   TOKEN_TITLE_SOURCE_BRANCH,
   TOKEN_TYPE_SOURCE_BRANCH,
+  TOKEN_TITLE_ASSIGNEE,
+  TOKEN_TYPE_MR_ASSIGNEE,
 } from '~/vue_shared/components/filtered_search_bar/constants';
 import {
   convertToApiParams,
@@ -171,6 +173,20 @@ export default {
       }
 
       return [
+        {
+          type: TOKEN_TYPE_MR_ASSIGNEE,
+          title: TOKEN_TITLE_ASSIGNEE,
+          icon: 'user',
+          token: UserToken,
+          dataType: 'user',
+          operators: OPERATORS_IS,
+          fullPath: this.fullPath,
+          isProject: true,
+          recentSuggestionsStorageKey: `${this.fullPath}-merge-requests-recent-tokens-assignee`,
+          preloadedUsers,
+          multiSelect: false,
+          unique: true,
+        },
         {
           type: TOKEN_TYPE_AUTHOR,
           title: TOKEN_TITLE_AUTHOR,

app/assets/javascripts/merge_requests/list/queries/get_merge_requests.query.graphql

@@ -7,6 +7,7 @@ query getMergeRequests(
   $fullPath: ID!
   $sort: MergeRequestSort
   $state: MergeRequestState
+  $assigneeUsername: String
   $authorUsername: String
   $draft: Boolean
   $sourceBranches: [String!]
@@ -21,6 +22,7 @@ query getMergeRequests(
     mergeRequests(
       sort: $sort
       state: $state
+      assigneeUsername: $assigneeUsername
       authorUsername: $authorUsername
       draft: $draft
       sourceBranches: $sourceBranches

app/assets/javascripts/vue_shared/components/filtered_search_bar/constants.js

@@ -90,6 +90,7 @@ export const TOKEN_TITLE_CLOSED = __('Closed date');
 export const TOKEN_TYPE_APPROVED_BY = 'approved-by';
 export const TOKEN_TYPE_MERGE_USER = 'merge-user';
 export const TOKEN_TYPE_ASSIGNEE = 'assignee';
+export const TOKEN_TYPE_MR_ASSIGNEE = 'mr-assignee';
 export const TOKEN_TYPE_AUTHOR = 'author';
 export const TOKEN_TYPE_CONFIDENTIAL = 'confidential';
 export const TOKEN_TYPE_CONTACT = 'contact';

app/finders/concerns/finder_with_group_hierarchy.rb

@@ -75,6 +75,11 @@ def groups_user_can_read_items(groups)
   end
 
   def preload_associations(groups)
+    ActiveRecord::Associations::Preloader.new(
+      records: groups,
+      associations: [:organization]
+    ).call
+
     Preloaders::UserMaxAccessLevelInGroupsPreloader.new(groups, current_user).execute
   end
 end

app/models/ci/pipeline.rb

@@ -833,8 +833,8 @@ def add_warning_message(content)
 
     # Like #drop!, but does not persist the pipeline nor trigger any state
     # machine callbacks.
-    def set_failed(drop_reason)
-      self.failure_reason = drop_reason.to_s
+    def set_failed(failure_reason)
+      self.failure_reason = failure_reason.to_s
       self.status = 'failed'
     end
 

app/models/concerns/enums/sbom.rb

@@ -7,10 +7,10 @@ class Sbom
     }.with_indifferent_access.freeze
 
     PURL_TYPES = {
-      composer: 1, # refered to as `packagist` in gemnasium-db
+      composer: 1, # refered to as `packagist` in gemnasium-db and semver_dialects
       conan: 2,
       gem: 3,
-      golang: 4, # refered to as `go` in gemnasium-db
+      golang: 4, # refered to as `go` in gemnasium-db and semver_dialects
       maven: 5,
       npm: 6,
       nuget: 7,

app/models/group.rb

@@ -729,7 +729,7 @@ def max_member_access_for_user(user, only_concrete_membership: false)
 
     unless only_concrete_membership
       return GroupMember::OWNER if user.can_admin_all_resources?
-      return GroupMember::OWNER if user.can_admin_organization?(organization_id)
+      return GroupMember::OWNER if user.can_admin_organization?(organization)
     end
 
     max_member_access(user)

app/models/preloaders/group_policy_preloader.rb

@@ -8,6 +8,11 @@ def initialize(groups, current_user)
     end
 
     def execute
+      ActiveRecord::Associations::Preloader.new(
+        records: groups,
+        associations: [:organization]
+      ).call
+
       Preloaders::UserMaxAccessLevelInGroupsPreloader.new(groups, current_user).execute
     end
 

app/models/user.rb

@@ -2148,7 +2148,7 @@ def owns_organization?(organization)
   end
 
   def can_admin_organization?(organization)
-    owns_organization?(organization)
+    can?(:admin_organization, organization)
   end
 
   def update_two_factor_requirement

app/policies/group_policy.rb

@@ -34,13 +34,11 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
 
   desc "User owns the group's organization"
   condition(:organization_owner) do
-    if @user.is_a?(User)
-      @user.owns_organization?(@subject.organization_id)
-    else
-      false
-    end
+    owns_group_organization?
   end
 
+  rule { admin | organization_owner }.enable :admin_organization
+
   with_options scope: :subject, score: 0
   condition(:request_access_enabled) { @subject.request_access_enabled }
 
@@ -458,6 +456,21 @@ def resource_access_token_creation_allowed?
   def valid_dependency_proxy_deploy_token
     @user.is_a?(DeployToken) && @user&.valid_for_dependency_proxy? && @user&.has_access_to_group?(@subject)
   end
+
+  # rubocop:disable Cop/UserAdmin -- specifically check the admin attribute
+  def owns_group_organization?
+    return false unless @user
+    return false unless user_is_user?
+    return false unless @subject.organization
+    # Ensure admins can't bypass admin mode.
+    return false if @user.admin? && !can?(:admin)
+
+    # Load the owners with a single query.
+    @subject.organization
+            .owner_user_ids
+            .include?(@user.id)
+  end
+  # rubocop:enable Cop/UserAdmin
 end
 
 GroupPolicy.prepend_mod_with('GroupPolicy')