Add latest changes from gitlab-org/gitlab@16-0-stable-eev16.0.0-rc42

1 files changed, 492 insertions, 238 deletions

diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index 2762b4e5137..8fcea840cfe 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -41,16 +41,11 @@
 # Once https://gitlab.com/gitlab-org/gitlab/-/issues/373904 is implemented, we should be able to change this back to
 # if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_APPROVALS_COUNT > 0'
 # or any similar condition to check that the MR has *any* approval (not just required approval).
-#
-# Temprorarily adding || $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-full-rspec/ for backward compatibility,
-# remove once https://gitlab.com/gitlab-org/quality/quality-engineering/team-tasks/-/issues/1557 is fully rolled out
 .if-merge-request-approved: &if-merge-request-approved
-  if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:mr-approved/ || $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-full-rspec/'
+  if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:mr-approved/'
 
-# Temprorarily adding && $CI_MERGE_REQUEST_LABELS !~ /pipeline:run-full-rspec/ for backward compatibility,
-# remove once https://gitlab.com/gitlab-org/quality/quality-engineering/team-tasks/-/issues/1557 is fully rolled out
 .if-merge-request-not-approved: &if-merge-request-not-approved
-  if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS !~ /pipeline:mr-approved/ && $CI_MERGE_REQUEST_LABELS !~ /pipeline:run-full-rspec/'
+  if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS !~ /pipeline:mr-approved/'
 
 .if-automated-merge-request: &if-automated-merge-request
   if: '$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == "release-tools/update-gitaly" || $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /stable-ee$/'
@@ -85,8 +80,8 @@
 .if-merge-request-labels-run-review-app: &if-merge-request-labels-run-review-app
   if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-review-app/'
 
-.if-merge-request-labels-run-on-pg11: &if-merge-request-labels-run-on-pg11
-  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-on-pg11/'
+.if-merge-request-labels-run-on-pg12: &if-merge-request-labels-run-on-pg12
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-on-pg12/'
 
 .if-merge-request-labels-skip-undercoverage: &if-merge-request-labels-skip-undercoverage
   if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:skip-undercoverage/'
@@ -98,7 +93,7 @@
   if: '$CI_MERGE_REQUEST_LABELS =~ /group::global search/'
 
 .if-merge-request-labels-pipeline-expedite: &if-merge-request-labels-pipeline-expedite
-  if: '($CI_MERGE_REQUEST_LABELS =~ /master:(foss-)?broken/ || $CI_MERGE_REQUEST_TITLE =~ /^[Rr]evert/) && $CI_MERGE_REQUEST_LABELS =~ /pipeline:expedite/'
+  if: '($CI_MERGE_REQUEST_LABELS =~ /master:(foss-)?broken/ || $CI_MERGE_REQUEST_LABELS =~ /quarantine/) && $CI_MERGE_REQUEST_LABELS =~ /pipeline:expedite/'
 
 .if-merge-request-labels-frontend-and-feature-flag: &if-merge-request-labels-frontend-and-feature-flag
   if: '$CI_MERGE_REQUEST_LABELS =~ /frontend/ && $CI_MERGE_REQUEST_LABELS =~ /feature flag/'
@@ -127,6 +122,9 @@
 .if-foss-schedule: &if-foss-schedule
   if: '$CI_PROJECT_PATH == "gitlab-org/gitlab-foss" && $CI_PIPELINE_SOURCE == "schedule"'
 
+.if-foss-default-branch: &if-foss-default-branch
+  if: '$CI_PROJECT_PATH == "gitlab-org/gitlab-foss" && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH'
+
 .if-dot-com-gitlab-org-schedule: &if-dot-com-gitlab-org-schedule
   if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org" && $CI_PIPELINE_SOURCE == "schedule"'
 
@@ -154,12 +152,6 @@
 .if-ruby2-branch: &if-ruby2-branch
   if: '$CI_COMMIT_BRANCH == "ruby2"'
 
-# For Security merge requests, the gitlab-release-tools-bot triggers a new
-# pipeline for the "Pipelines for merged results" feature. If the pipeline
-# fails, we notify release managers.
-.if-security-pipeline-merge-result: &if-security-pipeline-merge-result
-  if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH && $CI_PROJECT_NAMESPACE == "gitlab-org/security" && $GITLAB_USER_LOGIN == "gitlab-release-tools-bot"'
-
 ####################
 # Changes patterns #
 ####################
@@ -280,6 +272,7 @@
 # This list should match the list in Tasks::Gitlab::Assets.assets_impacting_compilation
 .assets-compilation-patterns: &assets-compilation-patterns
   - "{package.json,yarn.lock}"
+  - "{Gemfile,Gemfile.lock}"
   - ".browserslistrc"
   - "babel.config.js"
   - "config/webpack.config.js"
@@ -310,6 +303,9 @@
 .models-patterns: &models-patterns
   - "{,ee/,jh/}{app/models}/**/*"
 
+.decomposed-db-models-patterns: &decomposed-db-models-patterns
+  - "{,ee/,jh/}app/models/{ci,geo}/**/*"
+
 .lib-gitlab-patterns: &lib-gitlab-patterns
   - "{,ee/,jh/}lib/{,ee/,jh/}gitlab/**/*"
 
@@ -349,11 +345,13 @@
   - "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/background_migration/**/*"
   - "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/database{,_spec}.rb"
   - "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/database/**/*"
+  - "{,ee/,jh/}spec/support/db_cleaner.rb"
   - "{,ee/,jh/}spec/support/helpers/database/**/*"
   - "{,ee/,jh/}spec/support/helpers/migrations_helpers/**/*"
   - "lib/api/admin/batched_background_migrations.rb"
   - "lib/gitlab/markdown_cache/active_record/**/*"
   - "spec/requests/api/admin/batched_background_migrations_spec.rb"
+  - "spec/support/database_cleaner.rb"
   - "config/prometheus/common_metrics.yml"  # Used by Gitlab::DatabaseImporters::CommonMetrics::Importer
   - "{,ee/,jh/}app/models/project_statistics.rb"  # Used to calculate sizes in migration specs
   # Gitaly has interactions with background migrations: https://gitlab.com/gitlab-org/gitlab/-/issues/336538
@@ -419,7 +417,7 @@
   - ".stylelintrc"
   - "Dockerfile.assets"
   - "vendor/assets/**/*"
-  - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
+  - ".{eslintrc.yml,eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
   - "*_VERSION"
   - "{,jh/}Gemfile{,.lock}"
   - "Rakefile"
@@ -590,7 +588,6 @@
 ##################
 # Conditions set #
 ##################
-
 .strict-ee-only-rules:
   rules:
     - <<: *if-not-ee
@@ -607,17 +604,9 @@
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
 
-.rails:rules:predictive-default-rules:
-  rules:
-    - <<: *if-merge-request-approved
-      when: never
-    - <<: *if-automated-merge-request
-      when: never
-    - <<: *if-security-merge-request
-      when: never
-
 .rails:rules:run-search-tests:
   rules:
+    - !reference [".rails:rules:default-branch-schedule-nightly--code-backstage-ee-only", rules]
     - <<: *if-merge-request-labels-group-global-search
       changes: *search-backend-patterns
     - <<: *if-merge-request-labels-group-global-search
@@ -625,6 +614,8 @@
 
 .rails:rules:ee-and-foss-default-rules:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-merge-request
       changes: *core-backend-patterns
@@ -635,6 +626,44 @@
     - <<: *if-merge-request-not-approved
       when: never
 
+.rails:rules:system-default-rules:
+  rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-merge-request-labels-run-all-rspec
+    - <<: *if-merge-request
+      changes: *core-backend-patterns
+    - <<: *if-merge-request
+      changes: *workhorse-patterns
+    - <<: *if-automated-merge-request
+      changes: *code-backstage-patterns
+    - <<: *if-security-merge-request
+      changes: *code-backstage-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+
+.rails:rules:previous-failed-tests-default-rules:
+  rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-security-merge-request
+      when: never
+    - <<: *if-merge-request-labels-run-all-rspec
+    - <<: *if-merge-request
+      changes: *code-backstage-patterns
+
+###########################
+# Conditions set for JiHu #
+###########################
+.rails:rules:predictive-default-rules:
+  rules:
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
+      when: never
+    - <<: *if-security-merge-request
+      when: never
+
 .rails:rules:as-if-foss-migration-unit-integration:predictive-default-rules:
   rules:
     - <<: *if-merge-request
@@ -650,43 +679,115 @@
       when: never
     - !reference [".rails:rules:as-if-foss-migration-unit-integration:predictive-default-rules", rules]
 
-.rails:rules:system-default-rules:
+.rails:rules:system:predictive-default-rules:
   rules:
     - <<: *if-merge-request-labels-run-all-rspec
+      when: never
     - <<: *if-merge-request
       changes: *core-backend-patterns
+      when: never
     - <<: *if-merge-request
       changes: *workhorse-patterns
-    - <<: *if-automated-merge-request
-      changes: *code-backstage-patterns
-    - <<: *if-security-merge-request
-      changes: *code-backstage-patterns
-    - <<: *if-merge-request-not-approved
       when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *code-backstage-patterns
 
-.rails:rules:system:predictive-default-rules:
+.rails:rules:ee-and-foss-migration:predictive:
   rules:
-    - <<: *if-merge-request-labels-run-all-rspec
+    - <<: *if-fork-merge-request
+      changes: *db-patterns
+    - !reference [".rails:rules:predictive-default-rules", rules]
+    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
+    # When DB schema changes, many migrations spec may be affected. However, the test mapping from Crystalball does not map db change to a specific migration spec well.
+    # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68840.
+    - <<: *if-merge-request
+      changes: *db-patterns
       when: never
+
+.rails:rules:ee-and-foss-background-migration:predictive:
+  rules:
+    - !reference [".rails:rules:ee-and-foss-migration:predictive", rules]
     - <<: *if-merge-request
-      changes: *core-backend-patterns
+      changes: *backend-patterns
+
+.rails:rules:ee-and-foss-unit:predictive:
+  rules:
+    - <<: *if-fork-merge-request
+      changes: *backend-patterns
+    - !reference [".rails:rules:predictive-default-rules", rules]
+    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
+    - <<: *if-merge-request
+      changes: *backend-patterns
+    - <<: *if-merge-request
+      changes: *backstage-patterns
+
+.rails:rules:ee-and-foss-integration:predictive:
+  rules:
+    - <<: *if-fork-merge-request
+      changes: *backend-patterns
+    - !reference [".rails:rules:predictive-default-rules", rules]
+    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
+    - <<: *if-merge-request
+      changes: *backend-patterns
+
+.rails:rules:ee-and-foss-system:predictive:
+  rules:
+    - <<: *if-fork-merge-request
+      changes: *code-backstage-patterns
+    - !reference [".rails:rules:predictive-default-rules", rules]
+    - !reference [".rails:rules:system:predictive-default-rules", rules]
+
+.rails:rules:ee-only-migration:predictive:
+  rules:
+    - <<: *if-not-ee
       when: never
+    - !reference [".rails:rules:predictive-default-rules", rules]
+    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
+    # When DB schema changes, many migrations spec may be affected. However, the test mapping from Crystalball does not map db change to a specific migration spec well.
+    # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68840.
     - <<: *if-merge-request
-      changes: *workhorse-patterns
+      changes: *db-patterns
       when: never
+
+.rails:rules:ee-only-background-migration:predictive:
+  rules:
+    - !reference [".rails:rules:ee-only-migration:predictive", rules]
     - <<: *if-merge-request
-      changes: *ci-patterns
+      changes: *backend-patterns
+
+.rails:rules:ee-only-unit:predictive:
+  rules:
+    - <<: *if-not-ee
       when: never
+    - <<: *if-fork-merge-request
+      changes: *backend-patterns
+    - !reference [".rails:rules:predictive-default-rules", rules]
+    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
     - <<: *if-merge-request
-      changes: *code-backstage-patterns
+      changes: *backend-patterns
 
-.rails:rules:previous-failed-tests-default-rules:
+.rails:rules:ee-only-integration:predictive:
   rules:
-    - <<: *if-security-merge-request
+    - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-labels-run-all-rspec
+    - <<: *if-fork-merge-request
+      changes: *backend-patterns
+    - !reference [".rails:rules:predictive-default-rules", rules]
+    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
     - <<: *if-merge-request
+      changes: *backend-patterns
+
+.rails:rules:ee-only-system:predictive:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-fork-merge-request
       changes: *code-backstage-patterns
+    - !reference [".rails:rules:predictive-default-rules", rules]
+    - !reference [".rails:rules:system:predictive-default-rules", rules]
 
 ################
 # Shared rules #
@@ -711,12 +812,27 @@
   rules:
     - <<: *if-not-canonical-namespace
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-targeting-stable-branch
     - <<: *if-merge-request-labels-run-review-app
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request
+    - <<: *if-merge-request
       changes: *ci-build-images-patterns
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request
+    - <<: *if-merge-request
       changes: *code-qa-patterns
+    # Rules to support .qa:rules:package-and-test-ee
+    - <<: *if-merge-request
+      changes: *dependency-patterns
+    - <<: *if-merge-request-labels-run-all-e2e
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
+      changes: *feature-flag-development-config-patterns
+    - <<: *if-merge-request
+      changes: *feature-flag-development-config-patterns
+    - <<: *if-merge-request
+      changes: *nodejs-patterns
+    - <<: *if-merge-request
+      changes: *ci-qa-patterns
+    - <<: *if-force-ci
 
 .build-images:rules:build-qa-image:
   rules:
@@ -735,7 +851,6 @@
     - <<: *if-dot-com-gitlab-org-schedule
       variables:
         ARCH: amd64,arm64
-    - <<: *if-force-ci
     - <<: *if-ruby2-branch
 
 .build-images:rules:build-qa-image-as-if-foss:
@@ -759,14 +874,37 @@
   rules:
     - <<: *if-not-canonical-namespace
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-targeting-stable-branch
+    - <<: *if-ruby2-branch
     - <<: *if-merge-request-labels-run-review-app
     - <<: *if-auto-deploy-branches
-    - <<: *if-ruby2-branch
     - <<: *if-default-refs
       changes: *ci-build-images-patterns
     - <<: *if-default-refs
       changes: *code-qa-patterns
+    # Rules to support .qa:rules:package-and-test-ee
+    - <<: *if-merge-request
+      changes: *dependency-patterns
+    - <<: *if-merge-request-labels-run-all-e2e
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
+      changes: *feature-flag-development-config-patterns
+    - <<: *if-merge-request
+      changes: *feature-flag-development-config-patterns
+    - <<: *if-merge-request
+      changes: *nodejs-patterns
+    - <<: *if-merge-request
+      changes: *ci-qa-patterns
+    - <<: *if-force-ci
+
+.build-images:rules:build-assets-image-as-if-foss:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - !reference [".build-images:rules:build-assets-image", "rules"]
 
 #################
 # Caching rules #
@@ -827,19 +965,13 @@
     - changes:
         - scripts/lint_templates_bash.rb
 
-##################
-# Delivery rules #
-##################
-.delivery:rules:security-pipeline-merge-result-failure:
-  rules:
-    - <<: *if-security-pipeline-merge-result
-      when: on_failure
-
 ######################
 # Dev fixtures rules #
 ######################
 .dev-fixtures:rules:ee-and-foss:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-default-refs
       changes: *code-backstage-patterns
 
@@ -847,6 +979,8 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-default-refs
       changes: *code-backstage-patterns
 
@@ -892,6 +1026,8 @@
   rules:
     # The `glfm-verify` job has dependencies on EE, so only run it for EE
     - !reference [".strict-ee-only-rules", rules]
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     # If any of the files that are DIRECTLY related to generating or managing the GLFM specification change,
     # run `glfm-verify` to get quick feedback on any needed updates, even if the MR is not yet approved
     - changes: *glfm-patterns
@@ -918,7 +1054,6 @@
 ##################
 # Frontend rules #
 ##################
-
 .frontend:rules:predictive-default-rules:
   rules:
     - <<: *if-merge-request-approved
@@ -927,13 +1062,18 @@
       when: never
     - <<: *if-security-merge-request
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
 
 .frontend:rules:compile-production-assets:
   rules:
     - <<: *if-not-canonical-namespace
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-targeting-stable-branch
     - <<: *if-merge-request-labels-run-review-app
+    - <<: *if-merge-request-labels-run-all-e2e
     - <<: *if-auto-deploy-branches
     - <<: *if-ruby2-branch
     - <<: *if-default-refs
@@ -943,6 +1083,14 @@
     - <<: *if-default-refs
       changes: *workhorse-patterns
 
+.frontend:rules:compile-production-assets-as-if-foss:
+  rules:
+    - <<: *if-not-canonical-namespace
+      when: never
+    - <<: *if-not-ee
+      when: never
+    - !reference [.frontend:rules:compile-production-assets, rules]
+
 .frontend:rules:compile-test-assets:
   rules:
     - <<: *if-merge-request-labels-run-all-rspec
@@ -967,13 +1115,18 @@
 
 .frontend:rules:default-frontend-jobs:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
+    - <<: *if-merge-request-labels-frontend-and-feature-flag
     - <<: *if-default-refs
       changes: *code-backstage-patterns
 
 .frontend:rules:default-frontend-jobs-as-if-foss:
   rules:
     - !reference [".strict-ee-only-rules", rules]
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-security-merge-request
       changes: *code-backstage-patterns
     - <<: *if-merge-request-labels-as-if-foss
@@ -992,8 +1145,28 @@
     - <<: *if-merge-request
       changes: *frontend-patterns-for-as-if-foss
 
+.frontend:rules:upload-frontend-fixtures:
+  rules:
+    # The new strategy to upload fixtures as generic packages is experimental and can be disabled by removing the `REUSE_FRONTEND_FIXTURES_ENABLED` variable
+    - if: '$REUSE_FRONTEND_FIXTURES_ENABLED != "true"'
+      when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-dot-com-gitlab-org-default-branch
+      changes: *code-backstage-patterns
+    - <<: *if-foss-default-branch
+      changes: *code-backstage-patterns
+    - <<: *if-dot-com-gitlab-org-merge-request
+      changes:
+        - ".gitlab/ci/frontend.gitlab-ci.yml"
+        - "scripts/gitlab_component_helpers.sh"
+      when: manual
+      allow_failure: true
+
 .frontend:rules:jest:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-fork-merge-request
       when: never
     - <<: *if-merge-request-labels-run-all-jest
@@ -1033,6 +1206,8 @@
   rules:
     - !reference [".strict-ee-only-rules", rules]
     - <<: *if-merge-request-labels-as-if-foss
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-labels-run-all-jest
     - <<: *if-merge-request
       changes: *frontend-dependency-patterns
@@ -1063,6 +1238,8 @@
   rules:
     - !reference [".strict-ee-only-rules", rules]
     - <<: *if-merge-request-labels-as-if-foss
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request
       changes: *frontend-patterns-for-as-if-foss
 
@@ -1081,6 +1258,8 @@
   rules:
     - <<: *if-not-canonical-namespace
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-default-branch-refs
       changes: *frontend-build-patterns
       allow_failure: true
@@ -1093,21 +1272,32 @@
 ################
 .memory:rules:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-default-refs
       changes: *code-patterns
 
 ##########
 # Notify #
 ##########
-.notify:rules:notify-pipeline-failure:
+.notify:rules:create-issues-for-failing-tests:
   rules:
+    - <<: *if-not-canonical-namespace
+      when: never
     # Don't report child pipeline failures
     - if: '$CI_PIPELINE_SOURCE == "parent_pipeline"'
       when: never
-    - if: '$CI_SLACK_WEBHOOK_URL && $NOTIFY_PIPELINE_FAILURE_CHANNEL'
+    - if: '$CREATE_ISSUES_FOR_FAILING_TESTS == "true"'
       when: on_failure
       allow_failure: true
 
+.notify:rules:notify-package-and-test-failure:
+  rules:
+    - <<: *if-not-canonical-namespace
+      when: never
+    - <<: *if-merge-request-targeting-stable-branch
+      when: always
+
 ###############
 # Pages rules #
 ###############
@@ -1146,18 +1336,38 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-targeting-stable-branch
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request
+    - <<: *if-merge-request
       changes: *code-backstage-qa-patterns
       allow_failure: true
     - <<: *if-dot-com-gitlab-org-schedule
       allow_failure: true
+    - <<: *if-ruby2-branch
+    # Rules to support .qa:rules:package-and-test-ee
+    - <<: *if-merge-request
+      changes: *dependency-patterns
+      allow_failure: true
+    - <<: *if-merge-request-labels-run-all-e2e
+      allow_failure: true
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
+      changes: *feature-flag-development-config-patterns
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *feature-flag-development-config-patterns
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *nodejs-patterns
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *ci-qa-patterns
+      allow_failure: true
     - <<: *if-force-ci
       allow_failure: true
-    - <<: *if-ruby2-branch
 
-.qa:rules:package-and-test-mrs:
+.qa:rules:package-and-test-common:
   rules:
     - <<: *if-not-canonical-namespace
       when: never
@@ -1169,55 +1379,116 @@
       allow_failure: true
     - <<: *if-ruby2-branch
       allow_failure: true
+    - <<: *if-merge-request
+      changes: *dependency-patterns
+      variables:
+        OMNIBUS_GITLAB_BUILD_ON_ALL_OS: 'true'
     - <<: *if-merge-request-labels-run-all-e2e
       allow_failure: true
     - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
       changes: *feature-flag-development-config-patterns
       when: manual
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request
+    - <<: *if-merge-request
       changes: *feature-flag-development-config-patterns
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request
+    - <<: *if-merge-request
       changes: *initializers-patterns
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request
+    - <<: *if-merge-request
       changes: *nodejs-patterns
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request
+    - <<: *if-merge-request
       changes: *ci-qa-patterns
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request
+    - <<: *if-merge-request
+      changes:
+        - qa/Gemfile.lock  # qa/Gemfile.lock is a part of *qa-patterns, so this rule must be placed before the one with *qa-patterns changes
+      variables:
+        UPDATE_QA_CACHE: "true"
+    - <<: *if-merge-request
       changes: *qa-patterns
       allow_failure: true
     - <<: *if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
       changes: *code-patterns
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-and-security-merge-request
-      changes: *code-patterns
+    - <<: *if-force-ci
       when: manual
       allow_failure: true
-    - <<: *if-force-ci
+    - <<: *if-merge-request
+      changes: *code-patterns
       when: manual
       allow_failure: true
 
-.qa:rules:package-and-test:
+.qa:rules:package-and-test-schedule:
   rules:
-    - !reference [".qa:rules:package-and-test-mrs", rules]
     - <<: *if-dot-com-gitlab-org-schedule
       allow_failure: true
       variables:
         SKIP_REPORT_IN_ISSUES: "false"
         PROCESS_TEST_RESULTS: "true"
         KNAPSACK_GENERATE_REPORT: "true"
+        UPDATE_QA_CACHE: "true"
         QA_SAVE_TEST_METRICS: "true"
-        QA_EXPORT_TEST_METRICS: "false" # on main runs, metrics are exported to separate bucket via rake task for better consistency
+        QA_EXPORT_TEST_METRICS: "false"  # on main runs, metrics are exported to separate bucket via rake task for better consistency
+
+.qa:rules:package-and-test-ee:
+  rules:
+    - !reference [".qa:rules:package-and-test-common", rules]
+    - !reference [".qa:rules:package-and-test-schedule", rules]
+
+.qa:rules:package-and-test-ce:
+  rules:
+    - <<: *if-not-canonical-namespace
+      when: never
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request
+      changes: *ci-build-images-patterns
+      when: manual
+      allow_failure: true
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request
+      changes: *code-qa-patterns
+      when: manual
+      allow_failure: true
 
 .qa:rules:e2e:test-on-gdk:
   rules:
     - if: '$QA_RUN_TESTS_ON_GDK !~ /true|yes|1/i'
       when: never
-    - !reference [".qa:rules:package-and-test", rules]
+    - !reference [".qa:rules:package-and-test-common", rules]
+    - !reference [".qa:rules:package-and-test-schedule", rules]
+
+.qa:rules:package-and-test-sidebar:
+  rules:
+    - <<: *if-not-canonical-namespace
+      when: never
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-merge-request
+      changes: *code-patterns
+      when: manual
+      allow_failure: true
+    - <<: *if-default-branch-schedule-nightly
+      allow_failure: true
+      variables:
+        SKIP_REPORT_IN_ISSUES: "false"
+        PROCESS_TEST_RESULTS: "true"
+        QA_SAVE_TEST_METRICS: "true"
+        QA_EXPORT_TEST_METRICS: "false"
+
+.qa:rules:package-and-test-nightly:
+  rules:
+    - <<: *if-default-branch-schedule-nightly
+      variables:
+        KNAPSACK_GENERATE_REPORT: "true"
+        SKIP_REPORT_IN_ISSUES: "false"
+        QA_SAVE_TEST_METRICS: "true"
+        QA_EXPORT_TEST_METRICS: "false"
 
 ###############
 # Rails rules #
@@ -1231,18 +1502,49 @@
 .rails:rules:single-db:
   rules:
     - <<: *if-merge-request-labels-run-single-db
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request
       changes: *db-patterns
+    - <<: *if-merge-request
+      changes: *decomposed-db-models-patterns
     - <<: *if-default-branch-schedule-nightly
 
 .rails:rules:db:check-migrations-single-db:
   rules:
     - <<: *if-merge-request-labels-run-single-db
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request
       changes: *db-patterns
+    - <<: *if-merge-request
+      changes: *decomposed-db-models-patterns
+
+.rails:rules:single-db-ci-connection:
+  rules:
+    - <<: *if-merge-request-labels-run-single-db
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-merge-request
+      changes: *db-patterns
+    - <<: *if-merge-request
+      changes: *decomposed-db-models-patterns
+    - <<: *if-default-branch-schedule-nightly
+
+.rails:rules:db:check-migrations-single-db-ci-connection:
+  rules:
+    - <<: *if-merge-request-labels-run-single-db
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-merge-request
+      changes: *db-patterns
+    - <<: *if-merge-request
+      changes: *decomposed-db-models-patterns
 
 .rails:rules:db-backup:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-default-refs
       changes: *db-backup-patterns
@@ -1269,6 +1571,8 @@
   rules:
     - <<: *if-fork-merge-request
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-merge-request
       changes: *core-backend-patterns
@@ -1281,17 +1585,22 @@
     - <<: *if-default-refs
       changes: *db-patterns
 
-.rails:rules:ee-and-foss-migration:predictive:
+.rails:rules:rspec-predictive:
   rules:
     - <<: *if-fork-merge-request
-      changes: *db-patterns
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
-    # When DB schema changes, many migrations spec may be affected. However, the test mapping from Crystalball does not map db change to a specific migration spec well.
-    # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68840.
-    - <<: *if-merge-request
-      changes: *db-patterns
+      changes: *code-backstage-patterns
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
+      when: never
+    - <<: *if-security-merge-request
+      when: never
+    - <<: *if-merge-request-labels-run-all-rspec
       when: never
+    - <<: *if-merge-request
+      changes: *code-backstage-patterns
 
 .rails:rules:ee-and-foss-background-migration:
   rules:
@@ -1299,14 +1608,10 @@
     - <<: *if-default-refs
       changes: *backend-patterns
 
-.rails:rules:ee-and-foss-background-migration:predictive:
-  rules:
-    - !reference [".rails:rules:ee-and-foss-migration:predictive", rules]
-    - <<: *if-merge-request
-      changes: *backend-patterns
-
 .rails:rules:ee-and-foss-mr-with-migration:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request
       changes: *db-patterns
     - <<: *if-merge-request-labels-run-all-rspec
@@ -1326,15 +1631,8 @@
     - !reference [".rails:rules:ee-and-foss-default-rules", rules]
     - <<: *if-default-refs
       changes: *backend-patterns
-
-.rails:rules:ee-and-foss-unit:predictive:
-  rules:
-    - <<: *if-fork-merge-request
-      changes: *backend-patterns
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
-    - <<: *if-merge-request
-      changes: *backend-patterns
+    - <<: *if-default-refs
+      changes: *backstage-patterns
 
 .rails:rules:ee-and-foss-integration:
   rules:
@@ -1344,15 +1642,6 @@
     - <<: *if-default-refs
       changes: *backend-patterns
 
-.rails:rules:ee-and-foss-integration:predictive:
-  rules:
-    - <<: *if-fork-merge-request
-      changes: *backend-patterns
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
-    - <<: *if-merge-request
-      changes: *backend-patterns
-
 .rails:rules:ee-and-foss-system:
   rules:
     - <<: *if-fork-merge-request
@@ -1361,13 +1650,6 @@
     - <<: *if-default-refs
       changes: *code-backstage-patterns
 
-.rails:rules:ee-and-foss-system:predictive:
-  rules:
-    - <<: *if-fork-merge-request
-      changes: *code-backstage-patterns
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - !reference [".rails:rules:system:predictive-default-rules", rules]
-
 .rails:rules:ee-and-foss-fast_spec_helper:
   rules:
     - <<: *if-merge-request-labels-run-all-rspec
@@ -1386,6 +1668,10 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-fork-merge-request
+      when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-merge-request
       changes: *core-backend-patterns
@@ -1402,30 +1688,12 @@
     - <<: *if-default-refs
       changes: *db-patterns
 
-.rails:rules:ee-only-migration:predictive:
-  rules:
-    - <<: *if-not-ee
-      when: never
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
-    # When DB schema changes, many migrations spec may be affected. However, the test mapping from Crystalball does not map db change to a specific migration spec well.
-    # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68840.
-    - <<: *if-merge-request
-      changes: *db-patterns
-      when: never
-
 .rails:rules:ee-only-background-migration:
   rules:
     - !reference [".rails:rules:ee-only-migration", rules]
     - <<: *if-default-refs
       changes: *backend-patterns
 
-.rails:rules:ee-only-background-migration:predictive:
-  rules:
-    - !reference [".rails:rules:ee-only-migration:predictive", rules]
-    - <<: *if-merge-request
-      changes: *backend-patterns
-
 .rails:rules:ee-only-unit:
   rules:
     - <<: *if-not-ee
@@ -1436,17 +1704,6 @@
     - <<: *if-default-refs
       changes: *backend-patterns
 
-.rails:rules:ee-only-unit:predictive:
-  rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-fork-merge-request
-      changes: *backend-patterns
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
-    - <<: *if-merge-request
-      changes: *backend-patterns
-
 .rails:rules:ee-only-integration:
   rules:
     - <<: *if-not-ee
@@ -1457,17 +1714,6 @@
     - <<: *if-default-refs
       changes: *backend-patterns
 
-.rails:rules:ee-only-integration:predictive:
-  rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-fork-merge-request
-      changes: *backend-patterns
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
-    - <<: *if-merge-request
-      changes: *backend-patterns
-
 .rails:rules:ee-only-system:
   rules:
     - <<: *if-not-ee
@@ -1478,19 +1724,12 @@
     - <<: *if-default-refs
       changes: *code-backstage-patterns
 
-.rails:rules:ee-only-system:predictive:
-  rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-fork-merge-request
-      changes: *code-backstage-patterns
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - !reference [".rails:rules:system:predictive-default-rules", rules]
-
 .rails:rules:as-if-foss-migration:
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-merge-request
       changes: *core-backend-patterns
@@ -1505,48 +1744,21 @@
     - <<: *if-merge-request-not-approved
       when: never
 
-.rails:rules:as-if-foss-migration:predictive:
-  rules:
-    - <<: *if-not-ee
-      when: never
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - !reference [".rails:rules:as-if-foss-migration-unit-integration:predictive-default-rules", rules]
-    # When DB schema changes, many migrations spec may be affected. However, the test mapping from Crystalball does not map db change to a specific migration spec well.
-    # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68840.
-    - <<: *if-merge-request-labels-as-if-foss
-      changes: *db-patterns
-      when: never
-
 .rails:rules:as-if-foss-background-migration:
   rules:
     - !reference [".rails:rules:as-if-foss-migration", rules]
     - <<: *if-merge-request-labels-as-if-foss
       changes: *backend-patterns
 
-.rails:rules:as-if-foss-background-migration:predictive:
-  rules:
-    - !reference [".rails:rules:as-if-foss-migration:predictive", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-      changes: *backend-patterns
-
 .rails:rules:as-if-foss-unit:
   rules:
     - <<: *if-not-ee
       when: never
     - <<: *if-fork-merge-request
       when: never
-    - !reference [".rails:rules:ee-and-foss-default-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-      changes: *backend-patterns
-
-.rails:rules:as-if-foss-unit:predictive:
-  rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-fork-merge-request
+    - <<: *if-merge-request-labels-pipeline-expedite
       when: never
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - !reference [".rails:rules:as-if-foss-migration-unit-integration:predictive-default-rules", rules]
+    - !reference [".rails:rules:ee-and-foss-default-rules", rules]
     - <<: *if-merge-request-labels-as-if-foss
       changes: *backend-patterns
 
@@ -1556,18 +1768,9 @@
       when: never
     - <<: *if-fork-merge-request
       when: never
-    - !reference [".rails:rules:ee-and-foss-default-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-      changes: *backend-patterns
-
-.rails:rules:as-if-foss-integration:predictive:
-  rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-fork-merge-request
+    - <<: *if-merge-request-labels-pipeline-expedite
       when: never
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - !reference [".rails:rules:as-if-foss-migration-unit-integration:predictive-default-rules", rules]
+    - !reference [".rails:rules:ee-and-foss-default-rules", rules]
     - <<: *if-merge-request-labels-as-if-foss
       changes: *backend-patterns
 
@@ -1577,40 +1780,27 @@
       when: never
     - <<: *if-fork-merge-request
       when: never
-    - !reference [".rails:rules:system-default-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-      changes: *code-backstage-patterns
-
-.rails:rules:as-if-foss-system:predictive:
-  rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-fork-merge-request
-      when: never
-    - !reference [".rails:rules:predictive-default-rules", rules]
-    - <<: *if-merge-request
-      changes: *core-backend-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *workhorse-patterns
-      when: never
-    - <<: *if-merge-request
-      changes: *ci-patterns
+    - <<: *if-merge-request-labels-pipeline-expedite
       when: never
+    - !reference [".rails:rules:system-default-rules", rules]
     - <<: *if-merge-request-labels-as-if-foss
       changes: *code-backstage-patterns
 
 .rails:rules:ee-and-foss-db-library-code:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-default-refs
       changes: *db-library-patterns
     - <<: *if-merge-request-labels-run-all-rspec
-    - <<: *if-merge-request-labels-run-on-pg11
+    - <<: *if-merge-request-labels-run-on-pg12
 
 .rails:rules:ee-mr-and-default-branch-only:
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-merge-request
       changes: *code-backstage-patterns
@@ -1639,6 +1829,8 @@
       when: never
     - <<: *if-merge-request-labels-as-if-foss
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-security-merge-request
       changes: *code-backstage-patterns
     - <<: *if-dot-com-gitlab-org-merge-request
@@ -1668,6 +1860,8 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-default-branch-schedule-nightly
     - <<: *if-ruby2-branch-schedule-nightly
     - <<: *if-merge-request-labels-run-all-rspec
@@ -1691,17 +1885,23 @@
       when: never
     - <<: *if-merge-request-labels-skip-undercoverage
       when: never
+    # We cannot get the coverage data from child pipeline so we only run undercoverage on full pipelines for now
+    # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/113410#note_1335422806
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-merge-request
       changes: *backend-patterns
 
-.rails:rules:rspec-on-pg11:
+.rails:rules:rspec-on-pg12:
   rules:
-    - <<: *if-merge-request-labels-run-on-pg11
+    - <<: *if-merge-request-labels-run-on-pg12
     - !reference [".rails:rules:default-branch-schedule-nightly--code-backstage-default-rules", rules]
 
 .rails:rules:default-branch-schedule-nightly--code-backstage-default-rules:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-default-branch-schedule-nightly
     - <<: *if-merge-request
       changes: [".gitlab/ci/rails.gitlab-ci.yml"]
@@ -1720,6 +1920,8 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-default-refs
       changes: *code-backstage-patterns
 
@@ -1729,7 +1931,12 @@
       when: never
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
-    - if: '$SKIP_FLAKY_TESTS_AUTOMATICALLY == "true" || $RETRY_FAILED_TESTS_IN_NEW_PROCESS == "true"'
+    - if: '$FAST_QUARANTINE == "false" && $RETRY_FAILED_TESTS_IN_NEW_PROCESS != "true"'
+      when: never
+    - <<: *if-merge-request
+      changes: *code-backstage-patterns
+      when: always
+    - <<: *if-default-branch-refs
       changes: *code-backstage-patterns
       when: always
 
@@ -1850,12 +2057,6 @@
       changes: ["vendor/gems/omniauth-azure-oauth2/**/*"]
     - <<: *if-merge-request-labels-run-all-rspec
 
-.vendor:rules:omniauth-cas3:
-  rules:
-    - <<: *if-merge-request
-      changes: ["vendor/gems/omniauth-cas3/**/*"]
-    - <<: *if-merge-request-labels-run-all-rspec
-
 .vendor:rules:omniauth_crowd:
   rules:
     - <<: *if-merge-request
@@ -1892,6 +2093,18 @@
       changes: ["vendor/gems/bundler-checksum/**/*"]
     - <<: *if-merge-request-labels-run-all-rspec
 
+.vendor:rules:cloud_profiler_agent:
+  rules:
+    - <<: *if-merge-request
+      changes: ["vendor/gems/cloud_profiler_agent/**/*"]
+    - <<: *if-merge-request-labels-run-all-rspec
+
+.vendor:rules:sidekiq-reliable-fetch:
+  rules:
+    - <<: *if-merge-request
+      changes: ["vendor/gems/sidekiq-reliable-fetch/**/*"]
+    - <<: *if-merge-request-labels-run-all-rspec
+
 ##################
 # Releases rules #
 ##################
@@ -1919,6 +2132,8 @@
 #################
 .reports:rules:code_quality:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - if: '$CODE_QUALITY_DISABLED'
       when: never
     # Run code_quality on master until https://gitlab.com/gitlab-org/gitlab/-/issues/363747 is resolved
@@ -1930,6 +2145,8 @@
 
 .reports:rules:brakeman-sast:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - if: $SAST_DISABLED
       when: never
     - if: $SAST_EXCLUDED_ANALYZERS =~ /brakeman/
@@ -1941,6 +2158,8 @@
 
 .reports:rules:semgrep-sast:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - if: $SAST_DISABLED
       when: never
     - if: $SAST_EXCLUDED_ANALYZERS =~ /semgrep/
@@ -1958,6 +2177,8 @@
 
 .reports:rules:secret_detection:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - if: '$SECRET_DETECTION_DISABLED'
       when: never
     # Scan each commit on master to feed the Vulnerability Reports with detected secrets
@@ -1967,6 +2188,8 @@
 
 .reports:rules:gemnasium-dependency_scanning:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - if: '$DEPENDENCY_SCANNING_DISABLED || $GITLAB_FEATURES !~ /\bdependency_scanning\b/ || $DS_EXCLUDED_ANALYZERS =~ /gemnasium([^-]|$)/'
       when: never
     # Run Dependency Scanning on master until https://gitlab.com/gitlab-org/gitlab/-/issues/361657 is resolved
@@ -1976,6 +2199,8 @@
 
 .reports:rules:gemnasium-python-dependency_scanning:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - if: '$DEPENDENCY_SCANNING_DISABLED || $GITLAB_FEATURES !~ /\bdependency_scanning\b/ || $DS_EXCLUDED_ANALYZERS =~ /gemnasium-python/'
       when: never
     # Run Dependency Scanning on master until https://gitlab.com/gitlab-org/gitlab/-/issues/361657 is resolved
@@ -1985,6 +2210,8 @@
 
 .reports:rules:yarn-audit-dependency_scanning:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - if: '$DEPENDENCY_SCANNING_DISABLED || $GITLAB_FEATURES !~ /\bdependency_scanning\b/'
       when: never
     # Run Dependency Scanning on master until https://gitlab.com/gitlab-org/gitlab/-/issues/361657 is resolved
@@ -1994,6 +2221,8 @@
 
 .reports:rules:test-dast:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - if: '$DAST_DISABLED || $GITLAB_FEATURES !~ /\bdast\b/'
       when: never
     - <<: *if-merge-request
@@ -2014,13 +2243,6 @@
     - <<: *if-merge-request
       changes: ["Gemfile.lock"]
 
-.reports:rules:license_scanning:
-  rules:
-    - if: '$LICENSE_MANAGEMENT_DISABLED || $GITLAB_FEATURES !~ /\blicense_scanning\b/'
-      when: never
-    - <<: *if-default-refs
-      changes: *dependency-patterns
-
 ################
 # Review rules #
 ################
@@ -2072,7 +2294,7 @@
       variables:
         KNAPSACK_GENERATE_REPORT: "true"
         QA_SAVE_TEST_METRICS: "true"
-        QA_EXPORT_TEST_METRICS: "false" # on main runs, metrics are exported to separate bucket via rake task for better consistency
+        QA_EXPORT_TEST_METRICS: "false"  # on main runs, metrics are exported to separate bucket via rake task for better consistency
 
 # The following rules needs to be the same as the one for .review:rules:start-review-app-pipeline
 # except that:
@@ -2182,10 +2404,12 @@
 
 .setup:rules:gitlab_git_test:
   rules:
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-default-refs
       changes: *code-backstage-patterns
 
-.setup:rules:rails-production-environment:
+.setup:rules:rails-production-server-boot:
   rules:
     - <<: *if-default-refs
       changes: *code-patterns
@@ -2212,6 +2436,8 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
     - <<: *if-default-refs
       changes: *code-backstage-patterns
 
@@ -2242,6 +2468,7 @@
     - <<: *if-default-refs
       changes: *workhorse-patterns
     - <<: *if-merge-request-labels-run-all-rspec
+    - <<: *if-merge-request-labels-frontend-and-feature-flag
 
 .test-metadata:rules:update-tests-metadata:
   rules:
@@ -2292,6 +2519,33 @@
       changes: *feature-flag-development-config-patterns
 
 # This rule should share the same logic with .as-if-jh:rules:prepare-as-if-jh
+# in additionally that there are changes in dependency-patterns
+# Unfortunately, we can't say it has changes in
+#     feature-flag-development-config-patterns
+# And in
+#     dependency-patterns
+# At the same time. Note that this can't be using OR so using a union pattern
+# doesn't work either. Given that we cannot specify this, there's a gap can
+# happen when:
+#     * The merge request does not have ~"pipeline:run-as-if-jh"
+#     * The merge request changes a feature flag
+#     * The merge request also changes dependencies
+# In this case, we expect that we do run `sync-as-if-jh-branch` but it won't,
+# meaning that dependencies in the JH validation pipeline will be outdated.
+# To work around this issue, apply ~"pipeline:run-as-if-jh" to the merge
+# request so we can force it to run `sync-as-if-jh-branch` when there are
+# dependencies changes.
+.as-if-jh:rules:sync-as-if-jh:
+  rules:
+    - !reference [".strict-ee-only-rules", rules]
+    - !reference [".as-if-jh-default-exclusion-rules", rules]
+    - <<: *if-merge-request-labels-as-if-jh
+      changes: *dependency-patterns
+      # Ideally, we should be able to do this:
+      # - <<: *if-dot-com-gitlab-org-merge-request
+      #   changes: *feature-flag-development-config-patterns && *dependency-patterns
+
+# This rule should share the same logic with .as-if-jh:rules:prepare-as-if-jh
 # Because the jobs using this need jobs using the preparation rules
 .as-if-jh:rules:start-as-if-jh:
   rules: