Add latest changes from gitlab-org/gitlab@14-2-stable-eev14.2.0-rc42

11 files changed, 246 insertions, 101 deletions

diff --git a/.gitlab/ci/build-images.gitlab-ci.yml b/.gitlab/ci/build-images.gitlab-ci.yml
index 853f92ed98d..0169f017063 100644
--- a/.gitlab/ci/build-images.gitlab-ci.yml
+++ b/.gitlab/ci/build-images.gitlab-ci.yml
@@ -25,10 +25,9 @@ build-qa-image:
     - .build-images:rules:build-qa-image
   stage: build-images
   needs: []
-  variables:
-    QA_IMAGE: "${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab-ee-qa:${CI_COMMIT_REF_SLUG}"
   script:
     - !reference [.base-image-build, script]
+    - echo $QA_IMAGE
     - /kaniko/executor --context=${CI_PROJECT_DIR} --dockerfile=${CI_PROJECT_DIR}/qa/Dockerfile --destination=${QA_IMAGE} --cache=true
 
 # This image is used by:
diff --git a/.gitlab/ci/cng.gitlab-ci.yml b/.gitlab/ci/cng.gitlab-ci.yml
index f75497c1a3f..bf439288be2 100644
--- a/.gitlab/ci/cng.gitlab-ci.yml
+++ b/.gitlab/ci/cng.gitlab-ci.yml
@@ -7,4 +7,4 @@ cloud-native-image:
     GIT_DEPTH: "1"
   script:
     - install_gitlab_gem
-    - CNG_PROJECT_PATH="gitlab-org/build/CNG" ./scripts/trigger-build cng
+    - ./scripts/trigger-build cng
diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index 60025c244f1..ea3e3ac450b 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -44,7 +44,7 @@ docs-lint markdown:
     - .default-retry
     - .docs:rules:docs-lint
   # When updating the image version here, update it in /scripts/lint-doc.sh too.
-  image: registry.gitlab.com/gitlab-org/gitlab-docs/lint-markdown:alpine-3.13-vale-2.10.2-markdownlint-0.26.0
+  image: registry.gitlab.com/gitlab-org/gitlab-docs/lint-markdown:alpine-3.14-vale-2.10.4-markdownlint-0.28.1
   stage: test
   needs: []
   script:
diff --git a/.gitlab/ci/frontend.gitlab-ci.yml b/.gitlab/ci/frontend.gitlab-ci.yml
index 318ac20435e..bfc38e73bb5 100644
--- a/.gitlab/ci/frontend.gitlab-ci.yml
+++ b/.gitlab/ci/frontend.gitlab-ci.yml
@@ -143,7 +143,7 @@ rspec-ee frontend_fixture:
   extends:
     - .frontend-fixtures-base
     - .frontend:rules:default-frontend-jobs-ee
-  parallel: 2
+  parallel: 3
 
 graphql-schema-dump:
   variables:
@@ -242,7 +242,7 @@ jest:
       - tmp/tests/frontend/
     reports:
       junit: junit_jest.xml
-  parallel: 4
+  parallel: 5
 
 jest-integration:
   extends:
diff --git a/.gitlab/ci/pages.gitlab-ci.yml b/.gitlab/ci/pages.gitlab-ci.yml
index e75b0db9071..2f43e974cf6 100644
--- a/.gitlab/ci/pages.gitlab-ci.yml
+++ b/.gitlab/ci/pages.gitlab-ci.yml
@@ -7,22 +7,32 @@ pages:
     - .default-retry
     - .pages:rules
   stage: pages
+  environment: pages
+  resource_group: pages
   needs:
-    - rspec:coverage
-    - coverage-frontend
-    - karma
-    - compile-production-assets
-    - compile-storybook
+    - job: "rspec:coverage"
+    - job: "coverage-frontend"
+    - job: "karma"
+    - job: "compile-production-assets"
+    - job: "compile-storybook"
+    # `update-tests-metadata` only runs on GitLab.com's EE schedules pipelines
+    # while `pages` runs for all the 2-hourly schedules.
+    - job: "update-tests-metadata"
+      optional: true
   before_script:
     - apt-get update && apt-get -y install brotli gzip
   script:
     - mv public/ .public/
     - mkdir public/
+    - mkdir -p public/$(dirname "$KNAPSACK_RSPEC_SUITE_REPORT_PATH") public/$(dirname "$FLAKY_RSPEC_SUITE_REPORT_PATH") public/$(dirname "$RSPEC_PACKED_TESTS_MAPPING_PATH")
     - mv coverage/ public/coverage-ruby/ || true
     - mv coverage-frontend/ public/coverage-frontend/ || true
     - mv coverage-javascript/ public/coverage-javascript/ || true
     - mv storybook/public public/storybook || true
     - cp .public/assets/application-*.css public/application.css || true
+    - mv $KNAPSACK_RSPEC_SUITE_REPORT_PATH public/$KNAPSACK_RSPEC_SUITE_REPORT_PATH || true
+    - mv $FLAKY_RSPEC_SUITE_REPORT_PATH public/$FLAKY_RSPEC_SUITE_REPORT_PATH || true
+    - mv $RSPEC_PACKED_TESTS_MAPPING_PATH.gz public/$RSPEC_PACKED_TESTS_MAPPING_PATH.gz || true
     - *compress-public
   artifacts:
     paths:
diff --git a/.gitlab/ci/qa.gitlab-ci.yml b/.gitlab/ci/qa.gitlab-ci.yml
index 8bbd7dbf075..c3e6de76894 100644
--- a/.gitlab/ci/qa.gitlab-ci.yml
+++ b/.gitlab/ci/qa.gitlab-ci.yml
@@ -51,9 +51,10 @@ update-qa-cache:
   image: ${GITLAB_DEPENDENCY_PROXY}ruby:2.7-alpine
   stage: qa
   retry: 0
-  script:
+  before_script:
     - source scripts/utils.sh
     - install_gitlab_gem
+  script:
     - ./scripts/trigger-build omnibus
 
 package-and-qa:
diff --git a/.gitlab/ci/rails.gitlab-ci.yml b/.gitlab/ci/rails.gitlab-ci.yml
index 179c00b479c..f4b001ed1ba 100644
--- a/.gitlab/ci/rails.gitlab-ci.yml
+++ b/.gitlab/ci/rails.gitlab-ci.yml
@@ -29,7 +29,6 @@
   variables:
     RUBY_GC_MALLOC_LIMIT: 67108864
     RUBY_GC_MALLOC_LIMIT_MAX: 134217728
-    CRYSTALBALL: "true"
     RECORD_DEPRECATIONS: "true"
   needs: ["setup-test-env", "retrieve-tests-metadata", "compile-test-assets", "detect-tests"]
   script:
@@ -394,8 +393,7 @@ db:migrate-from-previous-major-version:
     - sed -i -e "s/gem 'google-protobuf', '~> 3.8.0'/gem 'google-protobuf', '~> 3.12'/" Gemfile
     - sed -i -e "s/gem 'nokogiri', '~> 1.10.5'/gem 'nokogiri', '~> 1.11.0'/" Gemfile
     - sed -i -e "s/gem 'mimemagic', '~> 0.3.2'/gem 'ruby-magic', '~> 0.4.0'/" Gemfile
-    - run_timed_command "gem install bundler:1.17.3"
-    - run_timed_command "bundle update google-protobuf nokogiri grpc mimemagic bootsnap"
+    - run_timed_command "bundle update --bundler google-protobuf nokogiri grpc mimemagic bootsnap"
     - SETUP_DB=false USE_BUNDLE_INSTALL=true bash scripts/prepare_build.sh
     - run_timed_command "bundle exec rake db:drop db:create db:structure:load db:migrate db:seed_fu"
     - git checkout -f $CI_COMMIT_SHA
@@ -449,7 +447,9 @@ db:backup_and_restore:
     - date
     - bundle exec rake gitlab:backup:restore
   rules:
-    - changes: ["lib/backup/**/*"]
+    - changes:
+        - "lib/backup/**/*"
+        - "lib/tasks/gitlab/backup.rake"
 
 rspec:deprecations:
   extends:
@@ -645,36 +645,33 @@ rspec-ee unit pg12 geo:
     - .rails:rules:ee-only-unit
     - .rspec-ee-unit-geo-parallel
 
-# FIXME: Temporarily disable geo minimal rspec jobs https://gitlab.com/gitlab-org/gitlab/-/issues/294212
-#rspec-ee unit pg12 geo minimal:
-#  extends:
-#    - rspec-ee unit pg12 geo
-#    - .minimal-rspec-tests
-#    - .rails:rules:ee-only-unit:minimal
+rspec-ee unit pg12 geo minimal:
+  extends:
+    - rspec-ee unit pg12 geo
+    - .minimal-rspec-tests
+    - .rails:rules:ee-only-unit:minimal
 
 rspec-ee integration pg12 geo:
   extends:
     - .rspec-ee-base-geo-pg12
     - .rails:rules:ee-only-integration
 
-# FIXME: Temporarily disable geo minimal rspec jobs https://gitlab.com/gitlab-org/gitlab/-/issues/294212
-#rspec-ee integration pg12 geo minimal:
-#  extends:
-#    - rspec-ee integration pg12 geo
-#    - .minimal-rspec-tests
-#    - .rails:rules:ee-only-integration:minimal
+rspec-ee integration pg12 geo minimal:
+  extends:
+    - rspec-ee integration pg12 geo
+    - .minimal-rspec-tests
+    - .rails:rules:ee-only-integration:minimal
 
 rspec-ee system pg12 geo:
   extends:
     - .rspec-ee-base-geo-pg12
     - .rails:rules:ee-only-system
 
-# FIXME: Temporarily disable geo minimal rspec jobs https://gitlab.com/gitlab-org/gitlab/-/issues/294212
-#rspec-ee system pg12 geo minimal:
-#  extends:
-#    - rspec-ee system pg12 geo
-#    - .minimal-rspec-tests
-#    - .rails:rules:ee-only-system:minimal
+rspec-ee system pg12 geo minimal:
+  extends:
+    - rspec-ee system pg12 geo
+    - .minimal-rspec-tests
+    - .rails:rules:ee-only-system:minimal
 
 db:rollback geo:
   extends:
diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index 690a971927c..7fb4e54c4d6 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -41,6 +41,22 @@ nodejs-scan-sast:
 semgrep-sast:
   rules: !reference [".reports:rules:sast", rules]
 
+gosec-sast:
+  variables:
+    GOPATH: "$CI_PROJECT_DIR/vendor/go"
+    COMPILE: "false"
+    GOSEC_GO_PKG_PATH: "$CI_PROJECT_DIR"
+    SECURE_LOG_LEVEL: "debug"
+  before_script:
+    - mkdir -p $GOPATH
+    - cd workhorse
+    - go get -d ./...
+    - cd ..
+  cache:
+    paths:
+      - vendor/go
+  rules: !reference [".reports:rules:sast", rules]
+
 .secret-analyzer:
   extends: .default-retry
   needs: []
diff --git a/.gitlab/ci/review.gitlab-ci.yml b/.gitlab/ci/review.gitlab-ci.yml
index 38d59af5aed..c22b468d674 100644
--- a/.gitlab/ci/review.gitlab-ci.yml
+++ b/.gitlab/ci/review.gitlab-ci.yml
@@ -2,7 +2,7 @@ review-cleanup:
   extends:
     - .default-retry
     - .review:rules:review-cleanup
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-helm3.5-kubectl1.17
+  image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-helm3-kubectl1.14
   stage: prepare
   environment:
     name: review/auto-cleanup
@@ -27,12 +27,15 @@ review-build-cng:
     - .review:rules:review-build-cng
   image: ${GITLAB_DEPENDENCY_PROXY}ruby:2.7-alpine3.13
   stage: review-prepare
-  before_script:
-    - source ./scripts/utils.sh
-    - install_gitlab_gem
   needs:
     - job: compile-production-assets
       artifacts: false
+  variables:
+    CNG_PROJECT_ACCESS_TOKEN: "${CNG_MIRROR_PROJECT_ACCESS_TOKEN}"  # "Multi-pipeline (from 'gitlab-org/gitlab' 'review-build-cng' job)" at https://gitlab.com/gitlab-org/build/CNG-mirror/-/settings/access_tokens
+    CNG_PROJECT_PATH: "gitlab-org/build/CNG-mirror"
+  before_script:
+    - source ./scripts/utils.sh
+    - install_gitlab_gem
   script:
     - ./scripts/trigger-build cng
 
@@ -43,7 +46,7 @@ review-build-cng:
   variables:
     HOST_SUFFIX: "${CI_ENVIRONMENT_SLUG}"
     DOMAIN: "-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}"
-    GITLAB_HELM_CHART_REF: "v4.12.0"
+    GITLAB_HELM_CHART_REF: "v5.1.0"
   environment:
     name: review/${CI_COMMIT_REF_SLUG}${FREQUENCY}
     url: https://gitlab-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}
@@ -114,7 +117,7 @@ review-stop:
   extends:
     - .use-docker-in-docker
   image:
-    name: ${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab-ee-qa:${CI_COMMIT_REF_SLUG}
+    name: ${QA_IMAGE}
     entrypoint: [""]
   stage: qa
   needs: ["build-qa-image", "review-deploy"]
diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index c97ef4fc868..53420dfe31a 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -19,12 +19,6 @@
 .if-default-branch-push: &if-default-branch-push
   if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
 
-.if-default-branch-schedule-2-hourly: &if-default-branch-schedule-2-hourly
-  if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $FREQUENCY == "2-hourly"'
-
-.if-default-branch-schedule-nightly: &if-default-branch-schedule-nightly
-  if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $FREQUENCY == "nightly"'
-
 .if-auto-deploy-branches: &if-auto-deploy-branches
   if: '$CI_COMMIT_BRANCH =~ /^\d+-\d+-auto-deploy-\d+$/'
 
@@ -34,24 +28,51 @@
 .if-merge-request: &if-merge-request
   if: '$CI_MERGE_REQUEST_IID'
 
+.if-merge-request-approved: &if-merge-request-approved
+  if: '$CI_MERGE_REQUEST_IID && $CI_MERGE_REQUEST_APPROVED'
+
+.if-merge-request-not-approved: &if-merge-request-not-approved
+  if: '$CI_MERGE_REQUEST_IID && $CI_MERGE_REQUEST_APPROVED != "true"'
+
+.if-automated-merge-request: &if-automated-merge-request
+  if: '$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == "release-tools/update-gitaly" || $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /stable-ee$/'
+
 .if-merge-request-title-as-if-foss: &if-merge-request-title-as-if-foss
-  if: '$CI_MERGE_REQUEST_TITLE =~ /RUN AS-IF-FOSS/'
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-as-if-foss/'
 
 .if-merge-request-title-update-caches: &if-merge-request-title-update-caches
-  if: '$CI_MERGE_REQUEST_TITLE =~ /UPDATE CACHE/'
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:update-cache/'
 
 .if-merge-request-title-run-all-rspec: &if-merge-request-title-run-all-rspec
-  if: '$CI_MERGE_REQUEST_TITLE =~ /RUN ALL RSPEC/'
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-all-rspec/'
 
 .if-security-merge-request: &if-security-merge-request
   if: '$CI_PROJECT_NAMESPACE == "gitlab-org/security" && $CI_MERGE_REQUEST_IID'
 
+.if-default-branch-schedule-2-hourly: &if-default-branch-schedule-2-hourly
+  if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $FREQUENCY == "2-hourly"'
+
+.if-default-branch-schedule-nightly: &if-default-branch-schedule-nightly
+  if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $FREQUENCY == "nightly"'
+
 .if-security-schedule: &if-security-schedule
   if: '$CI_PROJECT_NAMESPACE == "gitlab-org/security" && $CI_PIPELINE_SOURCE == "schedule"'
 
 .if-dot-com-gitlab-org-schedule: &if-dot-com-gitlab-org-schedule
   if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org" && $CI_PIPELINE_SOURCE == "schedule"'
 
+.if-dot-com-ee-schedule: &if-dot-com-ee-schedule
+  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_PIPELINE_SOURCE == "schedule"'
+
+.if-dot-com-ee-2-hourly-schedule: &if-dot-com-ee-2-hourly-schedule
+  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_PIPELINE_SOURCE == "schedule" && $FREQUENCY == "2-hourly"'
+
+.if-dot-com-ee-nightly-schedule: &if-dot-com-ee-nightly-schedule
+  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_PIPELINE_SOURCE == "schedule" && $FREQUENCY == "nightly"'
+
+.if-cache-credentials-schedule: &if-cache-credentials-schedule
+  if: '$CI_REPO_CACHE_CREDENTIALS && $CI_PIPELINE_SOURCE == "schedule"'
+
 .if-dot-com-gitlab-org-default-branch: &if-dot-com-gitlab-org-default-branch
   if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org" && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH'
 
@@ -64,20 +85,12 @@
 .if-dot-com-gitlab-org-and-security-tag: &if-dot-com-gitlab-org-and-security-tag
   if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE =~ /^gitlab-org($|\/security$)/ && $CI_COMMIT_TAG'
 
-.if-dot-com-ee-schedule: &if-dot-com-ee-schedule
-  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_PIPELINE_SOURCE == "schedule"'
-
-.if-cache-credentials-schedule: &if-cache-credentials-schedule
-  if: '$CI_REPO_CACHE_CREDENTIALS && $CI_PIPELINE_SOURCE == "schedule"'
-
-.if-merge-request-rspec-minimal-disabled: &if-merge-request-rspec-minimal-disabled
-  if: '$CI_MERGE_REQUEST_IID && $RSPEC_MINIMAL_ENABLED != "true"'
 
 .if-rspec-fail-fast-disabled: &if-rspec-fail-fast-disabled
   if: '$RSPEC_FAIL_FAST_ENABLED != "true"'
 
 .if-rspec-fail-fast-skipped: &if-rspec-fail-fast-skipped
-  if: '$CI_MERGE_REQUEST_TITLE =~ /SKIP RSPEC FAIL-FAST/'
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:skip-rspec-fail-fast/'
 
 # For Security merge requests, the gitlab-release-tools-bot triggers a new
 # pipeline for the "Pipelines for merged results" feature. If the pipeline
@@ -205,6 +218,7 @@
   - "{,ee/,jh/}spec/support/helpers/database/**/*"
   - "config/prometheus/common_metrics.yml"  # Used by Gitlab::DatabaseImporters::CommonMetrics::Importer
   - "{,ee/,jh/}app/models/project_statistics.rb"  # Used to calculate sizes in migration specs
+  - "GITALY_SERVER_VERSION" # Has interactions with background migrations:https://gitlab.com/gitlab-org/gitlab/-/issues/336538
   # CI changes
   - ".gitlab-ci.yml"
   - ".gitlab/ci/**/*"
@@ -551,9 +565,7 @@
 ###############
 .pages:rules:
   rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-default-branch-schedule-2-hourly
+    - <<: *if-dot-com-ee-2-hourly-schedule
 
 ############
 # QA rules #
@@ -597,12 +609,20 @@
 ###############
 .rails:rules:ee-and-foss-migration:
   rules:
-    - changes: *db-patterns
     - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *db-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    - changes: *db-patterns
 
 .rails:rules:ee-and-foss-migration:minimal:
   rules:
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request-title-run-all-rspec
       when: never
@@ -628,12 +648,20 @@
 
 .rails:rules:ee-and-foss-unit:
   rules:
-    - changes: *backend-patterns
     - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *backend-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    - changes: *backend-patterns
 
 .rails:rules:ee-and-foss-unit:minimal:
   rules:
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request-title-run-all-rspec
       when: never
@@ -645,12 +673,20 @@
 
 .rails:rules:ee-and-foss-integration:
   rules:
-    - changes: *backend-patterns
     - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *backend-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    - changes: *backend-patterns
 
 .rails:rules:ee-and-foss-integration:minimal:
   rules:
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request-title-run-all-rspec
       when: never
@@ -662,12 +698,20 @@
 
 .rails:rules:ee-and-foss-system:
   rules:
-    - changes: *code-backstage-patterns
     - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *code-backstage-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    - changes: *code-backstage-patterns
 
 .rails:rules:ee-and-foss-system:minimal:
   rules:
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request-title-run-all-rspec
       when: never
@@ -679,12 +723,20 @@
 
 .rails:rules:ee-and-foss-fast_spec_helper:
   rules:
-    - changes: ["config/**/*"]
     - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: ["config/**/*"]
+    - <<: *if-merge-request-not-approved
+      when: never
+    - changes: ["config/**/*"]
 
 .rails:rules:ee-and-foss-fast_spec_helper:minimal:
   rules:
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request-title-run-all-rspec
       when: never
@@ -703,14 +755,22 @@
   rules:
     - <<: *if-not-ee
       when: never
-    - changes: *db-patterns
     - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *db-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    - changes: *db-patterns
 
 .rails:rules:ee-only-migration:minimal:
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request-title-run-all-rspec
       when: never
@@ -724,14 +784,22 @@
   rules:
     - <<: *if-not-ee
       when: never
-    - changes: *backend-patterns
     - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *backend-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    - changes: *backend-patterns
 
 .rails:rules:ee-only-unit:minimal:
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request-title-run-all-rspec
       when: never
@@ -745,14 +813,22 @@
   rules:
     - <<: *if-not-ee
       when: never
-    - changes: *backend-patterns
     - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *backend-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    - changes: *backend-patterns
 
 .rails:rules:ee-only-integration:minimal:
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request-title-run-all-rspec
       when: never
@@ -766,14 +842,22 @@
   rules:
     - <<: *if-not-ee
       when: never
-    - changes: *code-backstage-patterns
     - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *code-backstage-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    - changes: *code-backstage-patterns
 
 .rails:rules:ee-only-system:minimal:
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request-title-run-all-rspec
       when: never
@@ -787,19 +871,25 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *db-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-security-merge-request
       changes: *db-patterns
     - <<: *if-merge-request-title-as-if-foss
       changes: *db-patterns
-    - <<: *if-merge-request-title-run-all-rspec
-    - <<: *if-merge-request
-      changes: *ci-patterns
 
 .rails:rules:as-if-foss-migration:minimal:
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request
       changes: *ci-patterns
@@ -808,25 +898,30 @@
       changes: *db-patterns
     - <<: *if-merge-request-title-as-if-foss
       changes: *db-patterns
-    - <<: *if-merge-request-title-run-all-rspec
 
 .rails:rules:as-if-foss-unit:
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *backend-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-security-merge-request
       changes: *backend-patterns
     - <<: *if-merge-request-title-as-if-foss
       changes: *backend-patterns
-    - <<: *if-merge-request-title-run-all-rspec
-    - <<: *if-merge-request
-      changes: *ci-patterns
 
 .rails:rules:as-if-foss-unit:minimal:
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request
       changes: *ci-patterns
@@ -835,25 +930,30 @@
       changes: *backend-patterns
     - <<: *if-merge-request-title-as-if-foss
       changes: *backend-patterns
-    - <<: *if-merge-request-title-run-all-rspec
 
 .rails:rules:as-if-foss-integration:
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *backend-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-security-merge-request
       changes: *backend-patterns
     - <<: *if-merge-request-title-as-if-foss
       changes: *backend-patterns
-    - <<: *if-merge-request-title-run-all-rspec
-    - <<: *if-merge-request
-      changes: *ci-patterns
 
 .rails:rules:as-if-foss-integration:minimal:
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request
       changes: *ci-patterns
@@ -862,25 +962,30 @@
       changes: *backend-patterns
     - <<: *if-merge-request-title-as-if-foss
       changes: *backend-patterns
-    - <<: *if-merge-request-title-run-all-rspec
 
 .rails:rules:as-if-foss-system:
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-merge-request-title-run-all-rspec
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *code-backstage-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-security-merge-request
       changes: *code-backstage-patterns
     - <<: *if-merge-request-title-as-if-foss
       changes: *code-backstage-patterns
-    - <<: *if-merge-request-title-run-all-rspec
-    - <<: *if-merge-request
-      changes: *ci-patterns
 
 .rails:rules:as-if-foss-system:minimal:
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request-rspec-minimal-disabled
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
       when: never
     - <<: *if-merge-request
       changes: *ci-patterns
@@ -889,7 +994,6 @@
       changes: *code-backstage-patterns
     - <<: *if-merge-request-title-as-if-foss
       changes: *code-backstage-patterns
-    - <<: *if-merge-request-title-run-all-rspec
 
 .rails:rules:ee-and-foss-db-library-code:
   rules:
@@ -1209,6 +1313,8 @@
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *code-qa-patterns
       allow_failure: true
+    - <<: *if-dot-com-ee-schedule
+      allow_failure: true
 
 # The rule needs to be duplicated between `on_success` and `on_failure`
 # because the jobs `needs` the previous job to complete.
@@ -1235,6 +1341,10 @@
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *code-qa-patterns
       when: on_failure
+    - <<: *if-dot-com-ee-schedule
+      when: on_success
+    - <<: *if-dot-com-ee-schedule
+      when: on_failure
 
 .review:rules:review-qa-all:
   rules:
@@ -1247,6 +1357,8 @@
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *qa-patterns
       allow_failure: true
+    - <<: *if-dot-com-ee-nightly-schedule
+      allow_failure: true
 
 # The rule needs to be duplicated between `on_success` and `on_failure`
 # because the jobs `needs` the previous job to complete.
@@ -1261,12 +1373,18 @@
       allow_failure: true
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *qa-patterns
-      allow_failure: true
       when: on_success
+      allow_failure: true
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *qa-patterns
+      when: on_failure
       allow_failure: true
+    - <<: *if-dot-com-ee-nightly-schedule
+      when: on_success
+      allow_failure: true
+    - <<: *if-dot-com-ee-nightly-schedule
       when: on_failure
+      allow_failure: true
 
 .review:rules:review-cleanup:
   rules:
@@ -1354,10 +1472,10 @@
   rules:
     - <<: *if-not-ee
       when: never
+    - <<: *if-dot-com-ee-2-hourly-schedule
     - changes:
         - ".gitlab/ci/test-metadata.gitlab-ci.yml"
         - "scripts/rspec_helpers.sh"
-    - <<: *if-dot-com-ee-schedule
 
 ###################
 # workhorse rules #
diff --git a/.gitlab/ci/test-metadata.gitlab-ci.yml b/.gitlab/ci/test-metadata.gitlab-ci.yml
index 08c5a7267c2..135bf8b6a8c 100644
--- a/.gitlab/ci/test-metadata.gitlab-ci.yml
+++ b/.gitlab/ci/test-metadata.gitlab-ci.yml
@@ -43,5 +43,6 @@ update-tests-metadata:
   script:
     - run_timed_command "retry gem install fog-aws mime-types activesupport rspec_profiling postgres-copy --no-document"
     - source ./scripts/rspec_helpers.sh
+    - test -f rspec_flaky/report-suite.json || echo -e "\e[31m" 'Consider add ~"pipeline:run-all-rspec" to run full rspec jobs' "\e[0m"
     - update_tests_metadata
     - update_tests_mapping