Add latest changes from gitlab-org/gitlab@14-6-stable-eev14.6.0-rc42

15 files changed, 337 insertions, 216 deletions

diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index 6aa3d533315..ae36c0cea70 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -53,7 +53,7 @@ docs-lint markdown:
 docs-lint links:
   extends:
     - .docs:rules:docs-lint
-  image: registry.gitlab.com/gitlab-org/gitlab-docs/lint-html:alpine-3.14-ruby-2.7.4-0fae0f62
+  image: registry.gitlab.com/gitlab-org/gitlab-docs/lint-html:alpine-3.14-ruby-2.7.5-08847baa
   stage: lint
   needs: []
   script:
diff --git a/.gitlab/ci/frontend.gitlab-ci.yml b/.gitlab/ci/frontend.gitlab-ci.yml
index d3844d01213..ea4ae3b0492 100644
--- a/.gitlab/ci/frontend.gitlab-ci.yml
+++ b/.gitlab/ci/frontend.gitlab-ci.yml
@@ -11,7 +11,7 @@
     - .default-retry
     - .default-before_script
     - .assets-compile-cache
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7-git-2.33-lfs-2.9-node-14.15-yarn-1.22-graphicsmagick-1.3.36
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:ruby-2.7-git-2.33-lfs-2.9-node-14.15-yarn-1.22-graphicsmagick-1.3.36
   variables:
     SETUP_DB: "false"
     WEBPACK_VENDOR_DLL: "true"
@@ -331,7 +331,7 @@ bundle-size-review:
   extends:
     - .default-retry
     - .frontend:rules:bundle-size-review
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:danger
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:danger
   stage: test
   needs: ["compile-production-assets"]
   script:
diff --git a/.gitlab/ci/global.gitlab-ci.yml b/.gitlab/ci/global.gitlab-ci.yml
index 22bd3b1e2e9..04883e5680a 100644
--- a/.gitlab/ci/global.gitlab-ci.yml
+++ b/.gitlab/ci/global.gitlab-ci.yml
@@ -213,7 +213,7 @@
     - *storybook-node-modules-cache-push
 
 .use-pg11:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-11-graphicsmagick-1.3.36"
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-11-graphicsmagick-1.3.36
   services:
     - name: postgres:11.6
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -222,7 +222,7 @@
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg12:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-12-graphicsmagick-1.3.36"
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-12-graphicsmagick-1.3.36
   services:
     - name: postgres:12
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -231,7 +231,7 @@
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg13:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-13-graphicsmagick-1.3.36"
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-13-graphicsmagick-1.3.36
   services:
     - name: postgres:13
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -240,7 +240,7 @@
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg11-ee:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-11-graphicsmagick-1.3.36"
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-11-graphicsmagick-1.3.36
   services:
     - name: postgres:11.6
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -251,7 +251,7 @@
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg12-ee:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-12-graphicsmagick-1.3.36"
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-12-graphicsmagick-1.3.36
   services:
     - name: postgres:12
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -262,7 +262,7 @@
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg13-ee:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-13-graphicsmagick-1.3.36"
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.33-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-13-graphicsmagick-1.3.36
   services:
     - name: postgres:13
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -274,7 +274,7 @@
 
 .use-kaniko:
   image:
-    name: registry.gitlab.com/gitlab-org/gitlab-build-images:kaniko
+    name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:kaniko
     entrypoint: [""]
   before_script:
     - source scripts/utils.sh
diff --git a/.gitlab/ci/qa-report.gitlab-ci.yml b/.gitlab/ci/qa-report.gitlab-ci.yml
deleted file mode 100644
index 61cbcfd58da..00000000000
--- a/.gitlab/ci/qa-report.gitlab-ci.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-test-reliability-report:
-  extends:
-    - .qa:rules:reliable-reports:schedule
-  image:
-    name: ${CI_REGISTRY_IMAGE}/gitlab-ee-qa:${CI_DEFAULT_BRANCH}
-    entrypoint: [""]
-  before_script:
-    - cd /home/gitlab/qa
-  script:
-    - echo "Generate report for 'staging-full' runs"
-    - bundle exec rake "reliable_spec_report[staging-full,30,true]"
-    - bundle exec rake "unreliable_spec_report[staging-full,30,true]"
-    - echo "Generate report for 'package-and-qa' runs"
-    - bundle exec rake "reliable_spec_report[package-and-qa,30,true]"
-    - bundle exec rake "unreliable_spec_report[package-and-qa,30,true]"
diff --git a/.gitlab/ci/qa.gitlab-ci.yml b/.gitlab/ci/qa.gitlab-ci.yml
index 74fc5f2cdc0..4fec223e66d 100644
--- a/.gitlab/ci/qa.gitlab-ci.yml
+++ b/.gitlab/ci/qa.gitlab-ci.yml
@@ -57,8 +57,12 @@ update-qa-cache:
     - install_gitlab_gem
     - tooling/bin/find_change_diffs ${CHANGES_DIFFS_DIR}
   script:
+    - tooling/bin/qa/check_if_qa_only_spec_changes ${CHANGES_FILE} ${ONLY_QA_CHANGES_FILE}
+    - '[ -f $ONLY_QA_CHANGES_FILE ] && export QA_TESTS="`cat $ONLY_QA_CHANGES_FILE`"'
+    - 'echo "QA_TESTS: $QA_TESTS"'
+    - exit_code=0 && tooling/bin/qa/package_and_qa_check ${CHANGES_DIFFS_DIR} || exit_code=$?
+    - echo $exit_code
     - |
-      tooling/bin/qa/package_and_qa_check ${CHANGES_DIFFS_DIR} && exit_code=$?
       if [ $exit_code -eq 0 ]; then
         ./scripts/trigger-build omnibus
       elif [ $exit_code -eq 1 ]; then
@@ -80,16 +84,25 @@ update-qa-cache:
     expire_in: 7d
     paths:
       - ${CHANGES_FILE}
+      - ${ONLY_QA_CHANGES_FILE}
       - ${CHANGES_DIFFS_DIR}/*
   variables:
     CHANGES_FILE: tmp/changed_files.txt
+    ONLY_QA_CHANGES_FILE: tmp/qa_only_changed_files.txt
     CHANGES_DIFFS_DIR: tmp/diffs
+    ALLURE_JOB_NAME: $CI_JOB_NAME
 
 .package-and-qa-ff-base:
   script:
-    - export GITLAB_QA_OPTIONS="--set-feature-flags $(scripts/changed-feature-flags --files $(cat $CHANGES_FILE | tr ' ' ',') --state $QA_FF_STATE)"
-    - echo $GITLAB_QA_OPTIONS
-    - ./scripts/trigger-build omnibus
+    - |
+      feature_flags=$(scripts/changed-feature-flags --files $(cat $CHANGES_FILE | tr ' ' ',') --state $QA_FF_STATE)
+      if [[ $feature_flags ]]; then
+        export GITLAB_QA_OPTIONS="--set-feature-flags $feature_flags"
+        echo $GITLAB_QA_OPTIONS
+        ./scripts/trigger-build omnibus
+      else
+        echo "No changed feature flag found to test. The tests are skipped if the flag was removed."
+      fi
 
 package-and-qa:
   extends:
diff --git a/.gitlab/ci/rails.gitlab-ci.yml b/.gitlab/ci/rails.gitlab-ci.yml
index 1fb1c887e56..d676dc2f331 100644
--- a/.gitlab/ci/rails.gitlab-ci.yml
+++ b/.gitlab/ci/rails.gitlab-ci.yml
@@ -18,9 +18,13 @@
   variables:
     RSPEC_TESTS_MAPPING_ENABLED: "true"
 
-.decomposed-database-rspec:
+.decomposed-database:
   variables:
     DECOMPOSED_DB: "true"
+
+.decomposed-database-rspec:
+  extends: .decomposed-database
+  variables:
     GITLAB_LOAD_BALANCING_REUSE_PRIMARY_ci: "main"
     GITLAB_USE_MODEL_LOAD_BALANCING: "true"
 
@@ -31,6 +35,7 @@
     RUBY_GC_MALLOC_LIMIT: 67108864
     RUBY_GC_MALLOC_LIMIT_MAX: 134217728
     RECORD_DEPRECATIONS: "true"
+    GEO_SECONDARY_PROXY: 0
   needs: ["setup-test-env", "retrieve-tests-metadata", "compile-test-assets", "detect-tests"]
   script:
     - !reference [.base-script, script]
@@ -151,16 +156,16 @@
   parallel: 3
 
 .rspec-unit-parallel:
-  parallel: 20
+  parallel: 22
 
 .rspec-ee-unit-parallel:
-  parallel: 12
+  parallel: 14
 
 .rspec-ee-unit-geo-parallel:
   parallel: 2
 
 .rspec-integration-parallel:
-  parallel: 8
+  parallel: 10
 
 .rspec-ee-integration-parallel:
   parallel: 4
@@ -341,8 +346,14 @@ rspec fast_spec_helper minimal:
 db:rollback:
   extends: .db-job-base
   script:
-    - bundle exec rake db:migrate VERSION=20181228175414
-    - bundle exec rake db:migrate SKIP_SCHEMA_VERSION_CHECK=true
+    - scripts/db_tasks db:migrate VERSION=20181228175414
+    - scripts/db_tasks db:migrate SKIP_SCHEMA_VERSION_CHECK=true
+
+db:rollback decomposed:
+  extends:
+    - db:rollback
+    - .decomposed-database
+    - .rails:rules:decomposed-databases
 
 db:migrate:reset:
   extends: .db-job-base
@@ -367,19 +378,34 @@ db:migrate-from-previous-major-version:
     - git checkout -f $CI_COMMIT_SHA
     - SETUP_DB=false USE_BUNDLE_INSTALL=true bash scripts/prepare_build.sh
   script:
-    - run_timed_command "bundle exec rake db:migrate"
+    - run_timed_command "scripts/db_tasks db:migrate"
 
-db:check-schema:
+db:migrate-from-previous-major-version-decomposed:
   extends:
     - db:migrate-from-previous-major-version
+    - .decomposed-database
+    - .rails:rules:decomposed-databases
+
+.db:check-schema-base:
+  extends:
     - .rails:rules:ee-mr-and-default-branch-only
   variables:
     TAG_TO_CHECKOUT: "v14.4.0"
   script:
-    - run_timed_command "bundle exec rake db:migrate"
+    - run_timed_command "scripts/db_tasks db:migrate"
     - scripts/schema_changed.sh
     - scripts/validate_migration_timestamps
 
+db:check-schema:
+  extends:
+    - db:migrate-from-previous-major-version
+    - .db:check-schema-base
+
+db:check-schema-decomposed:
+  extends:
+    - db:migrate-from-previous-major-version-decomposed
+    - .db:check-schema-base
+
 db:check-migrations:
   extends:
     - .db-job-base
@@ -389,6 +415,12 @@ db:check-migrations:
     - scripts/validate_migration_schema
   allow_failure: true
 
+db:check-migrations-decomposed:
+  extends:
+    - db:check-migrations
+    - .decomposed-database
+    - .rails:rules:decomposed-databases
+
 db:gitlabcom-database-testing:
   extends: .rails:rules:db:gitlabcom-database-testing
   stage: test
@@ -487,6 +519,11 @@ rspec:coverage:
     - rspec unit pg12 minimal
     - rspec integration pg12 minimal
     - rspec system pg12 minimal
+    # FOSS/EE decomposed jobs
+    - rspec migration pg12 decomposed
+    - rspec unit pg12 decomposed
+    - rspec integration pg12 decomposed
+    - rspec system pg12 decomposed
     # EE jobs
     - rspec-ee migration pg12
     - rspec-ee unit pg12
@@ -497,6 +534,11 @@ rspec:coverage:
     - rspec-ee unit pg12 minimal
     - rspec-ee integration pg12 minimal
     - rspec-ee system pg12 minimal
+    # EE decomposed jobs
+    - rspec-ee migration pg12 decomposed
+    - rspec-ee unit pg12 decomposed
+    - rspec-ee integration pg12 decomposed
+    - rspec-ee system pg12 decomposed
     # Geo jobs
     - rspec-ee unit pg12 geo
     - rspec-ee integration pg12 geo
@@ -508,6 +550,19 @@ rspec:coverage:
     # Memory jobs
     - memory-static
     - memory-on-boot
+    # As-if-FOSS jobs
+    - rspec migration pg12-as-if-foss
+    - rspec migration pg12-as-if-foss minimal
+    - rspec migration pg12-as-if-foss decomposed
+    - rspec unit pg12-as-if-foss
+    - rspec unit pg12-as-if-foss minimal
+    - rspec unit pg12-as-if-foss decomposed
+    - rspec integration pg12-as-if-foss
+    - rspec integration pg12-as-if-foss minimal
+    - rspec integration pg12-as-if-foss decomposed
+    - rspec system pg12-as-if-foss
+    - rspec system pg12-as-if-foss minimal
+    - rspec system pg12-as-if-foss decomposed
   script:
     - run_timed_command "bundle exec scripts/merge-simplecov"
     - run_timed_command "bundle exec scripts/gather-test-memory-data"
@@ -518,10 +573,29 @@ rspec:coverage:
     paths:
       - coverage/index.html
       - coverage/assets/
+      - coverage/lcov/
       - tmp/memory_test/
     reports:
       cobertura: coverage/coverage.xml
 
+rspec:undercoverage:
+  extends:
+    - .coverage-base
+    - .rails:rules:rspec-undercoverage
+  stage: post-test
+  needs: ["rspec:coverage"]
+  script:
+    - if [ -n "$CI_MERGE_REQUEST_SOURCE_BRANCH_SHA" ]; then
+        echo "Checking out \$CI_MERGE_REQUEST_SOURCE_BRANCH_SHA ($CI_MERGE_REQUEST_SOURCE_BRANCH_SHA) instead of \$CI_COMMIT_SHA (merge result commit $CI_COMMIT_SHA) so we can use $CI_MERGE_REQUEST_DIFF_BASE_SHA for undercoverage in this merged result pipeline";
+        git checkout -f ${CI_MERGE_REQUEST_SOURCE_BRANCH_SHA};
+        bundle_install_script;
+      else
+        echo "Using \$CI_COMMIT_SHA ($CI_COMMIT_SHA) for this non-merge result pipeline.";
+      fi;
+    - if [ -f scripts/undercoverage ]; then
+        run_timed_command "scripts/undercoverage";
+      fi;
+
 rspec:feature-flags:
   extends:
     - .coverage-base
@@ -880,8 +954,8 @@ db:rollback geo:
     - db:rollback
     - .rails:rules:ee-only-migration
   script:
-    - bundle exec rake geo:db:migrate VERSION=20170627195211
-    - bundle exec rake geo:db:migrate
+    - bundle exec rake db:migrate:geo VERSION=20170627195211
+    - bundle exec rake db:migrate:geo
 # EE: default refs (MRs, default branch, schedules) jobs #
 ##################################################
 
diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index 33efc3c4788..6d58bbf9682 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -98,7 +98,7 @@ gemnasium-python-dependency_scanning:
 
 yarn-audit-dependency_scanning:
   extends: .ds-analyzer
-  image: "registry.gitlab.com/gitlab-org/security-products/analyzers/npm-audit:1.4.0"
+  image: "registry.gitlab.com/gitlab-org/security-products/analyzers/npm-audit:1.4.1"
   variables:
     TOOL: yarn
   rules: !reference [".reports:rules:yarn-audit-dependency_scanning", rules]
diff --git a/.gitlab/ci/review-apps/main.gitlab-ci.yml b/.gitlab/ci/review-apps/main.gitlab-ci.yml
index 670175a6f11..16ef3c82cda 100644
--- a/.gitlab/ci/review-apps/main.gitlab-ci.yml
+++ b/.gitlab/ci/review-apps/main.gitlab-ci.yml
@@ -34,12 +34,12 @@ review-build-cng:
 .review-workflow-base:
   extends:
     - .default-retry
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-helm3.5-kubectl1.17
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:gitlab-helm3.5-kubectl1.17
   resource_group: "review/${CI_COMMIT_REF_NAME}"
   variables:
     HOST_SUFFIX: "${CI_ENVIRONMENT_SLUG}"
     DOMAIN: "-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}"
-    GITLAB_HELM_CHART_REF: "v5.4.1"
+    GITLAB_HELM_CHART_REF: "v5.5.0"
   environment:
     name: review/${CI_COMMIT_REF_SLUG}${FREQUENCY}
     url: https://gitlab-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}
@@ -65,6 +65,7 @@ review-deploy:
     - deploy || (display_deployment_debug && exit 1)
     - verify_deploy || exit 1
     - disable_sign_ups || (delete_release && exit 1)
+    - create_sample_projects
   after_script:
     # Run seed-dast-test-data.sh only when DAST_RUN is set to true. This is to pupulate review app with data for DAST scan.
     # Set DAST_RUN to true when jobs are manually scheduled.
@@ -104,4 +105,4 @@ review-stop:
   stage: deploy
   needs: []
   script:
-    - delete_k8s_release_namespace
+    - delete_namespace
diff --git a/.gitlab/ci/review-apps/qa.gitlab-ci.yml b/.gitlab/ci/review-apps/qa.gitlab-ci.yml
index 07f8bd4e5fd..af4674b802b 100644
--- a/.gitlab/ci/review-apps/qa.gitlab-ci.yml
+++ b/.gitlab/ci/review-apps/qa.gitlab-ci.yml
@@ -16,16 +16,19 @@
     GITLAB_ADMIN_PASSWORD: "${REVIEW_APPS_ROOT_PASSWORD}"
     GITLAB_QA_ADMIN_ACCESS_TOKEN: "${REVIEW_APPS_ROOT_TOKEN}"
     GITHUB_ACCESS_TOKEN: "${REVIEW_APPS_QA_GITHUB_ACCESS_TOKEN}"
-    EE_LICENSE: "${REVIEW_APPS_EE_LICENSE}"
     SIGNUP_DISABLED: "true"
   before_script:
     # Use $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA so that GitLab image built in omnibus-gitlab-mirror and QA image are in sync.
+    - export EE_LICENSE="$(cat $REVIEW_APPS_EE_LICENSE_FILE)"
     - if [ -n "$CI_MERGE_REQUEST_SOURCE_BRANCH_SHA" ]; then
         git checkout -f ${CI_MERGE_REQUEST_SOURCE_BRANCH_SHA};
       fi
     - export CI_ENVIRONMENT_URL="$(cat environment_url.txt)"
     - echo "${CI_ENVIRONMENT_URL}"
     - cd qa
+    - if [ -n "$KNAPSACK_REPORT_PATH" ]; then
+        bundle exec rake knapsack:download;
+      fi
   artifacts:
     paths:
       - qa/tmp
@@ -34,21 +37,28 @@
 
 .parallel-qa-base:
   parallel: 5
+  variables:
+    KNAPSACK_TEST_FILE_PATTERN: "qa/specs/features/**/*_spec.rb"
   script:
-    - export KNAPSACK_REPORT_PATH=knapsack/master_report.json
-    - export KNAPSACK_TEST_FILE_PATTERN=qa/specs/features/**/*_spec.rb
     - |
       bin/test "${QA_SCENARIO}" "${CI_ENVIRONMENT_URL}" \
         -- \
         --color --format documentation \
         --format RspecJunitFormatter --out tmp/rspec.xml
+  after_script:
+    - if [ -n "$KNAPSACK_GENERATE_REPORT" ]; then
+        mv qa/${KNAPSACK_REPORT_PATH} qa/knapsack/gcs/regenerated-${CI_NODE_INDEX}.json;
+      fi
   artifacts:
+    paths:
+      - qa/tmp # we can't merge list so need to include explicitly once more
+      - qa/knapsack/gcs/regenerated-*.json
     reports:
       junit: qa/tmp/rspec.xml
 
 .allure-report-base:
   image:
-    name: ${GITLAB_DEPENDENCY_PROXY}andrcuns/allure-report-publisher:0.4.1
+    name: ${GITLAB_DEPENDENCY_PROXY}andrcuns/allure-report-publisher:0.4.2
     entrypoint: [""]
   stage: post-qa
   variables:
@@ -69,6 +79,16 @@
         --ignore-missing-results \
         --color
 
+.knapsack-upload-base:
+  image:
+    name: ${QA_IMAGE}
+    entrypoint: [""]
+  stage: post-qa
+  before_script:
+    - cd qa
+  script:
+    - bundle exec rake 'knapsack:upload[knapsack/gcs/regenerated-*.json]'
+
 review-qa-smoke:
   extends:
     - .review-qa-base
@@ -84,9 +104,11 @@ review-qa-reliable:
     - .review-qa-base
     - .review:rules:review-qa-reliable
     - .parallel-qa-base
+  retry: 1
   variables:
     QA_RUN_TYPE: review-qa-reliable
     QA_SCENARIO: Test::Instance::Reliable
+    KNAPSACK_REPORT_PATH: knapsack/gcs/review-qa-reliable.json
 
 review-qa-all:
   extends:
@@ -96,6 +118,7 @@ review-qa-all:
   variables:
     QA_RUN_TYPE: review-qa-all
     QA_SCENARIO: Test::Instance::All
+    KNAPSACK_REPORT_PATH: knapsack/gcs/review-qa-all.json
 
 review-performance:
   extends:
@@ -140,3 +163,19 @@ allure-report-qa-all:
   variables:
     ALLURE_REPORT_PATH_PREFIX: gitlab-review-all
     ALLURE_JOB_NAME: review-qa-all
+
+knapsack-report-qa-all:
+  extends:
+    - .knapsack-upload-base
+    - .review:rules:knapsack-report-qa-all
+  needs: ["review-qa-all"]
+  variables:
+    KNAPSACK_REPORT_PATH: knapsack/gcs/review-qa-all.json
+
+knapsack-report-qa-reliable:
+  extends:
+    - .knapsack-upload-base
+    - .review:rules:knapsack-report-qa-reliable
+  needs: ["review-qa-reliable"]
+  variables:
+    KNAPSACK_REPORT_PATH: knapsack/gcs/review-qa-reliable.json
diff --git a/.gitlab/ci/review.gitlab-ci.yml b/.gitlab/ci/review.gitlab-ci.yml
index b2b8c456ae2..b90af076a56 100644
--- a/.gitlab/ci/review.gitlab-ci.yml
+++ b/.gitlab/ci/review.gitlab-ci.yml
@@ -2,23 +2,26 @@ review-cleanup:
   extends:
     - .default-retry
     - .review:rules:review-cleanup
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-helm3-kubectl1.14
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:gitlab-helm3-kubectl1.14
   stage: prepare
   environment:
-    name: review/auto-cleanup
+    name: review/${CI_COMMIT_REF_SLUG}${FREQUENCY}
     action: stop
   before_script:
     - source scripts/utils.sh
+    - source scripts/review_apps/review-apps.sh
     - source scripts/review_apps/gcp_cleanup.sh
     - install_gitlab_gem
     - setup_gcp_dependencies
   script:
+    - delete_release
+    - delete_namespace
     - ruby -rrubygems scripts/review_apps/automated_cleanup.rb
     - gcp_cleanup
 
 start-review-app-pipeline:
   extends:
-    - .review:rules:review-app-pipeline
+    - .review:rules:start-review-app-pipeline
   stage: review
   needs:
     - job: build-assets-image
diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index 50b1650e1d5..e62de4bc6dc 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -11,7 +11,7 @@
   if: '$CI_PROJECT_NAME != "gitlab-foss" && $CI_PROJECT_NAME != "gitlab-ce" && $CI_PROJECT_NAME != "gitlabhq"'
 
 .if-jh: &if-jh
-  if: '$CI_PROJECT_PATH == "gitlab-jh/gitlab"'
+  if: '$CI_PROJECT_PATH =~ /^gitlab-(jh|cn)\/.*/'
 
 .if-default-refs: &if-default-refs
   if: '$CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH || $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable(-ee)?$/ || $CI_COMMIT_REF_NAME =~ /^\d+-\d+-auto-deploy-\d+$/ || $CI_COMMIT_REF_NAME =~ /^security\// || $CI_MERGE_REQUEST_IID || $CI_COMMIT_TAG || $FORCE_GITLAB_CI'
@@ -67,6 +67,9 @@
 .if-merge-request-labels-run-review-app: &if-merge-request-labels-run-review-app
   if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-review-app/'
 
+.if-merge-request-labels-skip-undercoverage: &if-merge-request-labels-skip-undercoverage
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:skip-undercoverage/'
+
 .if-security-merge-request: &if-security-merge-request
   if: '$CI_PROJECT_NAMESPACE == "gitlab-org/security" && $CI_MERGE_REQUEST_IID'
 
@@ -82,9 +85,6 @@
 .if-dot-com-gitlab-org-schedule: &if-dot-com-gitlab-org-schedule
   if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org" && $CI_PIPELINE_SOURCE == "schedule"'
 
-.if-dot-com-gitlab-org-schedule-child-pipeline: &if-dot-com-gitlab-org-schedule-child-pipeline
-  if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org" && $CI_PIPELINE_SOURCE == "parent_pipeline" && $FREQUENCY'
-
 .if-dot-com-ee-schedule: &if-dot-com-ee-schedule
   if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_PIPELINE_SOURCE == "schedule"'
 
@@ -172,7 +172,7 @@
   - "scripts/lint-doc.sh"
 
 .docs-deprecations-patterns: &docs-deprecations-patterns
-  - "doc/deprecations/index.md"
+  - "doc/update/deprecations.md"
   - "data/deprecations/*.yml"
   - "data/deprecations/templates/_deprecation_template.md.erb"
   - "lib/tasks/gitlab/docs/compile_deprecations.rake"
@@ -271,6 +271,7 @@
   - "danger/**/*"
   - "{,ee/,jh/}fixtures/**/*"
   - "{,ee/,jh/}rubocop/**/*"
+  - ".rubocop_todo/**/*.yml"
   - "{,ee/,jh/}spec/**/*"
   - "{,spec/}tooling/**/*"
 
@@ -288,7 +289,8 @@
   - "Dockerfile.assets"
   - "vendor/assets/**/*"
   - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
-  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,rubocop_manual_todo}.yml"
+  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo}.yml"
+  - ".rubocop_todo/**/*.yml"
   - "*_VERSION"
   - "{,jh/}Gemfile{,.lock}"
   - "Rakefile"
@@ -311,7 +313,8 @@
   - "Dockerfile.assets"
   - "vendor/assets/**/*"
   - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
-  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,rubocop_manual_todo}.yml"
+  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo}.yml"
+  - ".rubocop_todo/**/*.yml"
   - "*_VERSION"
   - "{,jh/}Gemfile{,.lock}"
   - "Rakefile"
@@ -341,7 +344,8 @@
   - "Dockerfile.assets"
   - "vendor/assets/**/*"
   - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
-  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,rubocop_manual_todo}.yml"
+  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo}.yml"
+  - ".rubocop_todo/**/*.yml"
   - "*_VERSION"
   - "{,jh/}Gemfile{,.lock}"
   - "Rakefile"
@@ -367,7 +371,8 @@
   - "Dockerfile.assets"
   - "vendor/assets/**/*"
   - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
-  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,rubocop_manual_todo}.yml"
+  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo}.yml"
+  - ".rubocop_todo/**/*.yml"
   - "*_VERSION"
   - "{,jh/}Gemfile{,.lock}"
   - "Rakefile"
@@ -400,7 +405,8 @@
   - "Dockerfile.assets"
   - "vendor/assets/**/*"
   - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
-  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,rubocop_manual_todo}.yml"
+  - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo}.yml"
+  - ".rubocop_todo/**/*.yml"
   - "*_VERSION"
   - "{,jh/}Gemfile{,.lock}"
   - "Rakefile"
@@ -642,8 +648,8 @@
       changes: *ci-patterns
     - <<: *if-automated-merge-request
       changes: *code-backstage-patterns
-    - <<: *if-default-refs
-      changes: *backend-patterns
+    - <<: *if-security-merge-request
+      changes: *code-backstage-patterns
     - <<: *if-merge-request-not-approved
       when: never
     - <<: *if-default-refs
@@ -655,14 +661,13 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request-labels-run-all-jest
       when: never
     - <<: *if-default-refs
       changes: *core-frontend-patterns
       when: never
-    - <<: *if-default-refs
-      changes: *backend-patterns
-      when: never
     - <<: *if-merge-request
       changes: *ci-patterns
       when: never
@@ -785,11 +790,6 @@
       changes: *feature-flag-development-config-patterns
       allow_failure: true
 
-.qa:rules:reliable-reports:schedule:
-  rules:
-    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $QA_RELIABLE_REPORT == "true"'
-      allow_failure: true
-
 ###############
 # Rails rules #
 ###############
@@ -814,6 +814,8 @@
       changes: *db-patterns
     - <<: *if-automated-merge-request
       changes: *db-patterns
+    - <<: *if-security-merge-request
+      changes: *db-patterns
     - <<: *if-merge-request-not-approved
       when: never
     - changes: *db-patterns
@@ -824,6 +826,8 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
       when: never
     - <<: *if-merge-request
@@ -859,6 +863,8 @@
       changes: *ci-patterns
     - <<: *if-automated-merge-request
       changes: *backend-patterns
+    - <<: *if-security-merge-request
+      changes: *backend-patterns
     - <<: *if-merge-request-not-approved
       when: never
     - changes: *backend-patterns
@@ -869,6 +875,8 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
       when: never
     - <<: *if-merge-request
@@ -889,6 +897,8 @@
       changes: *ci-patterns
     - <<: *if-automated-merge-request
       changes: *backend-patterns
+    - <<: *if-security-merge-request
+      changes: *backend-patterns
     - <<: *if-merge-request-not-approved
       when: never
     - changes: *backend-patterns
@@ -899,6 +909,8 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
       when: never
     - <<: *if-merge-request
@@ -919,6 +931,8 @@
       changes: *ci-patterns
     - <<: *if-automated-merge-request
       changes: *code-backstage-patterns
+    - <<: *if-security-merge-request
+      changes: *code-backstage-patterns
     - <<: *if-merge-request-not-approved
       when: never
     - changes: *code-backstage-patterns
@@ -929,6 +943,8 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
       when: never
     - <<: *if-merge-request
@@ -949,6 +965,8 @@
       changes: *ci-patterns
     - <<: *if-automated-merge-request
       changes: ["config/**/*"]
+    - <<: *if-security-merge-request
+      changes: ["config/**/*"]
     - <<: *if-merge-request-not-approved
       when: never
     - changes: ["config/**/*"]
@@ -959,6 +977,8 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
       when: never
     - <<: *if-merge-request
@@ -988,6 +1008,8 @@
       changes: *db-patterns
     - <<: *if-automated-merge-request
       changes: *db-patterns
+    - <<: *if-security-merge-request
+      changes: *db-patterns
     - <<: *if-merge-request-not-approved
       when: never
     - changes: *db-patterns
@@ -1000,6 +1022,8 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
       when: never
     - <<: *if-merge-request
@@ -1023,6 +1047,8 @@
       changes: *ci-patterns
     - <<: *if-automated-merge-request
       changes: *backend-patterns
+    - <<: *if-security-merge-request
+      changes: *backend-patterns
     - <<: *if-merge-request-not-approved
       when: never
     - changes: *backend-patterns
@@ -1035,6 +1061,8 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
       when: never
     - <<: *if-merge-request
@@ -1057,6 +1085,8 @@
       changes: *ci-patterns
     - <<: *if-automated-merge-request
       changes: *backend-patterns
+    - <<: *if-security-merge-request
+      changes: *backend-patterns
     - <<: *if-merge-request-not-approved
       when: never
     - changes: *backend-patterns
@@ -1069,6 +1099,8 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
       when: never
     - <<: *if-merge-request
@@ -1091,6 +1123,8 @@
       changes: *ci-patterns
     - <<: *if-automated-merge-request
       changes: *code-backstage-patterns
+    - <<: *if-security-merge-request
+      changes: *code-backstage-patterns
     - <<: *if-merge-request-not-approved
       when: never
     - changes: *code-backstage-patterns
@@ -1103,6 +1137,8 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request-labels-run-all-rspec
       when: never
     - <<: *if-merge-request
@@ -1129,6 +1165,8 @@
       changes: *db-patterns
     - <<: *if-automated-merge-request
       changes: *db-patterns
+    - <<: *if-security-merge-request
+      changes: *db-patterns
     - <<: *if-merge-request-not-approved
       when: never
 
@@ -1140,15 +1178,14 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request
       changes: *core-backend-patterns
       when: never
     - <<: *if-merge-request
       changes: *ci-patterns
       when: never
-    - <<: *if-security-merge-request
-      changes: *db-patterns
-      when: never
     - <<: *if-merge-request-labels-as-if-foss
       changes: *db-patterns
       when: never
@@ -1164,10 +1201,10 @@
       changes: *ci-patterns
     - <<: *if-automated-merge-request
       changes: *backend-patterns
-    - <<: *if-merge-request-not-approved
-      when: never
     - <<: *if-security-merge-request
       changes: *backend-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-merge-request-labels-as-if-foss
       changes: *backend-patterns
 
@@ -1179,14 +1216,14 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request
       changes: *core-backend-patterns
       when: never
     - <<: *if-merge-request
       changes: *ci-patterns
       when: never
-    - <<: *if-security-merge-request
-      changes: *backend-patterns
     - <<: *if-merge-request-labels-as-if-foss
       changes: *backend-patterns
 
@@ -1201,10 +1238,10 @@
       changes: *ci-patterns
     - <<: *if-automated-merge-request
       changes: *backend-patterns
-    - <<: *if-merge-request-not-approved
-      when: never
     - <<: *if-security-merge-request
       changes: *backend-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-merge-request-labels-as-if-foss
       changes: *backend-patterns
 
@@ -1216,14 +1253,14 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request
       changes: *core-backend-patterns
       when: never
     - <<: *if-merge-request
       changes: *ci-patterns
       when: never
-    - <<: *if-security-merge-request
-      changes: *backend-patterns
     - <<: *if-merge-request-labels-as-if-foss
       changes: *backend-patterns
 
@@ -1238,10 +1275,10 @@
       changes: *ci-patterns
     - <<: *if-automated-merge-request
       changes: *code-backstage-patterns
-    - <<: *if-merge-request-not-approved
-      when: never
     - <<: *if-security-merge-request
       changes: *code-backstage-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
     - <<: *if-merge-request-labels-as-if-foss
       changes: *code-backstage-patterns
 
@@ -1253,14 +1290,14 @@
       when: never
     - <<: *if-automated-merge-request
       when: never
+    - <<: *if-security-merge-request
+      when: never
     - <<: *if-merge-request
       changes: *core-backend-patterns
       when: never
     - <<: *if-merge-request
       changes: *ci-patterns
       when: never
-    - <<: *if-security-merge-request
-      changes: *code-backstage-patterns
     - <<: *if-merge-request-labels-as-if-foss
       changes: *code-backstage-patterns
 
@@ -1367,6 +1404,16 @@
     - <<: *if-merge-request-labels-run-all-rspec
       when: always
 
+.rails:rules:rspec-undercoverage:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-labels-skip-undercoverage
+      when: never
+    - <<: *if-merge-request-labels-run-all-rspec
+    - <<: *if-merge-request
+      changes: *backend-patterns
+
 .rails:rules:default-branch-schedule-nightly--code-backstage:
   rules:
     - <<: *if-default-branch-schedule-nightly
@@ -1556,7 +1603,7 @@
 ################
 # Review rules #
 ################
-.review:rules:review-app-pipeline:
+.review:rules:start-review-app-pipeline:
   rules:
     - <<: *if-not-ee
       when: never
@@ -1572,82 +1619,34 @@
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *qa-patterns
     - <<: *if-dot-com-gitlab-org-schedule
+      variables:
+        KNAPSACK_GENERATE_REPORT: "true"
 
 .review:rules:review-build-cng:
   rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-merge-request-labels-run-review-app
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *ci-review-patterns
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *frontend-patterns
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *code-patterns
-      allow_failure: true
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *qa-patterns
-    - <<: *if-dot-com-gitlab-org-schedule-child-pipeline
+    - when: always
 
 .review:rules:review-deploy:
   rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-merge-request-labels-run-review-app
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *ci-review-patterns
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *frontend-patterns
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *code-patterns
-      allow_failure: true
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *qa-patterns
-    - <<: *if-dot-com-gitlab-org-schedule-child-pipeline
-      allow_failure: true
+    - when: on_success
 
 .review:rules:review-performance:
   rules:
     - if: '$DAST_RUN == "true"'  # Skip this job when DAST is run
       when: never
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-merge-request-labels-run-review-app
-    - <<: *if-dot-com-gitlab-org-merge-request
+    - <<: *if-merge-request-labels-run-review-app  # we explicitely don't allow the job to fail in that case
+    - <<: *if-dot-com-gitlab-org-merge-request  # we explicitely don't allow the job to fail in that case
       changes: *ci-review-patterns
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *frontend-patterns
-      allow_failure: true
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *code-qa-patterns
-      allow_failure: true
-    - <<: *if-dot-com-gitlab-org-schedule-child-pipeline
+    - when: on_success
       allow_failure: true
 
 .review:rules:review-delete-deployment:
   rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-merge-request-labels-run-review-app
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *code-qa-patterns
+    - when: on_success
 
 .review:rules:review-qa-smoke:
   rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-merge-request-labels-run-review-app
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *ci-review-patterns
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *frontend-patterns
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *qa-patterns
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *code-patterns
-      allow_failure: true
-    - <<: *if-dot-com-ee-schedule-child-pipeline
-      allow_failure: true
+    - when: on_success
 
 # The rule needs to be duplicated between `on_success` and `on_failure`
 # because the jobs `needs` the previous job to complete.
@@ -1656,34 +1655,8 @@
 # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63844#note_599012559
 .review:rules:review-qa-smoke-report:
   rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-merge-request-labels-run-review-app
-      when: on_success
-    - <<: *if-merge-request-labels-run-review-app
-      when: on_failure
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *ci-review-patterns
-      when: on_success
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *ci-review-patterns
-      when: on_failure
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *frontend-patterns
-      when: on_success
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *frontend-patterns
-      when: on_failure
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *code-qa-patterns
-      when: on_success
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *code-qa-patterns
-      when: on_failure
-    - <<: *if-dot-com-ee-schedule-child-pipeline
-      when: on_success
-    - <<: *if-dot-com-ee-schedule-child-pipeline
-      when: on_failure
+    - when: on_success
+    - when: on_failure
 
 .review:rules:review-qa-reliable:
   rules:
@@ -1692,17 +1665,12 @@
 
 .review:rules:review-qa-all:
   rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-merge-request-labels-run-review-app
+    - <<: *if-merge-request-labels-run-review-app  # we explicitely don't allow the job to fail in that case
     - <<: *if-dot-com-gitlab-org-merge-request
       changes: *code-patterns
       when: manual
-      allow_failure: true
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *qa-patterns
-      allow_failure: true
-    - <<: *if-dot-com-ee-nightly-schedule-child-pipeline
+      allow_failure: true # manual jobs needs to be allowd to fail, otherwise they block the pipeline
+    - when: on_success
       allow_failure: true
 
 # The rule needs to be duplicated between `on_success` and `on_failure`
@@ -1712,29 +1680,23 @@
 # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63844#note_599012559
 .review:rules:review-qa-all-report:
   rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-merge-request-labels-run-review-app
-      when: on_success
-    - <<: *if-merge-request-labels-run-review-app
-      when: on_failure
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *code-patterns
-      when: manual
-      allow_failure: true
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *qa-patterns
-      when: on_success
+    - when: on_success
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *qa-patterns
-      when: on_failure
+    - when: on_failure
       allow_failure: true
-    - <<: *if-dot-com-ee-nightly-schedule-child-pipeline
+
+# Generate knapsack report on successful runs only
+# Reliable suite will pass most of the time so this should yield best distribution
+.review:rules:knapsack-report-qa-reliable:
+  rules:
+    - if: '$KNAPSACK_GENERATE_REPORT == "true"'
       when: on_success
       allow_failure: true
-    - <<: *if-dot-com-ee-nightly-schedule-child-pipeline
-      when: on_failure
+
+.review:rules:knapsack-report-qa-all:
+  rules:
+    - if: '$KNAPSACK_GENERATE_REPORT == "true"'
+      when: always
       allow_failure: true
 
 .review:rules:review-cleanup:
@@ -1750,23 +1712,16 @@
 
 .review:rules:review-stop:
   rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-merge-request-labels-run-review-app
-      when: manual
-      allow_failure: true
-    - <<: *if-dot-com-gitlab-org-merge-request
-      changes: *code-qa-patterns
-      when: manual
+    - when: manual
       allow_failure: true
 
 .review:rules:danger:
   rules:
-    - if: '$CI_MERGE_REQUEST_IID'
+    - <<: *if-merge-request
 
 .review:rules:danger-local:
   rules:
-    - if: '$CI_MERGE_REQUEST_IID'
+    - <<: *if-merge-request
       changes: *danger-patterns
 
 ###############
@@ -1819,6 +1774,16 @@
       changes: *code-backstage-patterns
       when: on_success
 
+.setup:rules:generate-frontend-fixtures-mapping:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-dot-com-ee-2-hourly-schedule
+    - changes:
+        - ".gitlab/ci/setup.gitlab-ci.yml"
+        - ".gitlab/ci/test-metadata.gitlab-ci.yml"
+        - "scripts/rspec_helpers.sh"
+
 .setup:rules:add-jh-folder:
   rules:
     - <<: *if-not-ee
diff --git a/.gitlab/ci/setup.gitlab-ci.yml b/.gitlab/ci/setup.gitlab-ci.yml
index 4c674f38939..1eb3bd2ea41 100644
--- a/.gitlab/ci/setup.gitlab-ci.yml
+++ b/.gitlab/ci/setup.gitlab-ci.yml
@@ -68,6 +68,24 @@ verify-tests-yml:
     - install_tff_gem
     - scripts/verify-tff-mapping
 
+generate-frontend-fixtures-mapping:
+  extends:
+    - .setup:rules:generate-frontend-fixtures-mapping
+    - .use-pg12
+    - .rails-cache
+  needs: ["setup-test-env"]
+  stage: prepare
+  before_script:
+    - !reference [.default-before_script, before_script]
+    - source ./scripts/rspec_helpers.sh
+    - run_timed_command "scripts/gitaly-test-spawn"
+  script:
+    - generate_frontend_fixtures_mapping
+  artifacts:
+    expire_in: 7d
+    paths:
+      - ${FRONTEND_FIXTURES_MAPPING_PATH}
+
 .detect-test-base:
   image: ${GITLAB_DEPENDENCY_PROXY}ruby:2.7
   needs: []
@@ -78,17 +96,21 @@ verify-tests-yml:
     - install_gitlab_gem
     - install_tff_gem
     - retrieve_tests_mapping
+    - retrieve_frontend_fixtures_mapping
     - |
       if [ -n "$CI_MERGE_REQUEST_IID" ]; then
         tooling/bin/find_changes ${CHANGES_FILE};
         tooling/bin/find_tests ${CHANGES_FILE} ${MATCHED_TESTS_FILE};
-        echo "related rspec tests: $(cat $MATCHED_TESTS_FILE)";
+        tooling/bin/find_changes ${CHANGES_FILE} ${MATCHED_TESTS_FILE} ${FRONTEND_FIXTURES_MAPPING_PATH};
+        echo "Changed files: $(cat $CHANGES_FILE)";
+        echo "Related rspec tests: $(cat $MATCHED_TESTS_FILE)";
       fi
   artifacts:
     expire_in: 7d
     paths:
       - ${CHANGES_FILE}
       - ${MATCHED_TESTS_FILE}
+      - ${FRONTEND_FIXTURES_MAPPING_PATH}
 
 detect-tests:
   extends:
diff --git a/.gitlab/ci/static-analysis.gitlab-ci.yml b/.gitlab/ci/static-analysis.gitlab-ci.yml
index ebd223c4171..a5cc02303f3 100644
--- a/.gitlab/ci/static-analysis.gitlab-ci.yml
+++ b/.gitlab/ci/static-analysis.gitlab-ci.yml
@@ -10,6 +10,7 @@
     # Disable warnings in browserslist which can break on backports
     # https://github.com/browserslist/browserslist/blob/a287ec6/node.js#L367-L384
     BROWSERSLIST_IGNORE_OLD_DATA: "true"
+    GRAPHQL_SCHEMA_APOLLO_FILE: "tmp/tests/graphql/gitlab_schema_apollo.graphql"
 
 update-static-analysis-cache:
   extends:
@@ -47,17 +48,34 @@ static-verification-with-database:
   variables:
     SETUP_DB: "true"
 
+generate-apollo-graphl-schema:
+  extends:
+    - .static-analysis-base
+    - .frontend:rules:default-frontend-jobs
+  image:
+    name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:apollo
+    entrypoint: [""]
+  needs: ['graphql-schema-dump']
+  variables:
+    USE_BUNDLE_INSTALL: "false"
+  script:
+    - apollo client:download-schema --config=config/apollo.config.js ${GRAPHQL_SCHEMA_APOLLO_FILE}
+  artifacts:
+    name: graphql-schema-apollo
+    paths:
+      - "${GRAPHQL_SCHEMA_APOLLO_FILE}"
+
 eslint:
   extends:
     - .static-analysis-base
     - .yarn-cache
-    - .static-analysis:rules:ee
-  needs: []
+    - .frontend:rules:default-frontend-jobs
+  needs: ['generate-apollo-graphl-schema']
   variables:
     USE_BUNDLE_INSTALL: "false"
   script:
     - run_timed_command "retry yarn install --frozen-lockfile"
-    - run_timed_command "yarn run lint:eslint:all"
+    - run_timed_command "yarn run lint:eslint:all --parser-options=schema:${GRAPHQL_SCHEMA_APOLLO_FILE}"
 
 eslint as-if-foss:
   extends:
diff --git a/.gitlab/ci/test-metadata.gitlab-ci.yml b/.gitlab/ci/test-metadata.gitlab-ci.yml
index 2d96fb6d4b0..d0d45cb9294 100644
--- a/.gitlab/ci/test-metadata.gitlab-ci.yml
+++ b/.gitlab/ci/test-metadata.gitlab-ci.yml
@@ -8,7 +8,7 @@
       - knapsack/
       - rspec_flaky/
       - rspec_profiling/
-      - crystalball/packed-mapping.json.gz
+      - crystalball/
 
 retrieve-tests-metadata:
   extends:
@@ -27,6 +27,7 @@ update-tests-metadata:
   stage: post-test
   dependencies:
     - retrieve-tests-metadata
+    - generate-frontend-fixtures-mapping
     - setup-test-env
     - rspec migration pg12
     - rspec-all frontend_fixture
diff --git a/.gitlab/ci/workhorse.gitlab-ci.yml b/.gitlab/ci/workhorse.gitlab-ci.yml
index 47b5d29ab8e..cd53adc6d4b 100644
--- a/.gitlab/ci/workhorse.gitlab-ci.yml
+++ b/.gitlab/ci/workhorse.gitlab-ci.yml
@@ -22,8 +22,8 @@ workhorse:verify:
 
 workhorse:test using go 1.16:
   extends: .workhorse:test
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7-golang-1.16-git-2.31
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:ruby-2.7-golang-1.16-git-2.31
 
 workhorse:test using go 1.17:
   extends: .workhorse:test
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7-golang-1.17-git-2.31
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:ruby-2.7-golang-1.17-git-2.31