Add latest changes from gitlab-org/gitlab@12-3-auto-deploy-20190916stable-branch-foss-test

13 files changed, 334 insertions, 474 deletions

diff --git a/.gitlab/ci/cng.gitlab-ci.yml b/.gitlab/ci/cng.gitlab-ci.yml
index 35859a1ab33..3ba3b221df0 100644
--- a/.gitlab/ci/cng.gitlab-ci.yml
+++ b/.gitlab/ci/cng.gitlab-ci.yml
@@ -11,6 +11,5 @@ cloud-native-image:
     - CNG_PROJECT_PATH="gitlab-org/build/CNG" BUILD_TRIGGER_TOKEN=$CI_JOB_TOKEN ./scripts/trigger-build cng
   only:
     refs:
-      - tags
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+      - tags@gitlab-org/gitlab-foss
+      - tags@gitlab-org/gitlab
diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index 87023da3c24..22e752ae0b0 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -2,12 +2,6 @@
   extends:
     - .default-tags
     - .default-retry
-    - .only-docs-changes
-  only:
-    refs:
-      - merge_requests
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
   image: ruby:2.6-alpine
   stage: review
   dependencies: []
@@ -25,32 +19,55 @@
     - apk add --update openssl
     - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/trigger-build-docs
     - chmod 755 trigger-build-docs
+
+# Trigger a manual docs build in gitlab-docs only on non docs-only branches.
+# Useful to preview the docs changes live.
+review-docs-deploy-manual:
+  extends:
+    - .review-docs
+    - .except-docs-qa
+  script:
     - gem install gitlab --no-document
+    - ./trigger-build-docs deploy
+  when: manual
+  only:
+    - branches@gitlab-org/gitlab-foss
+    - branches@gitlab-org/gitlab
 
 # Always trigger a docs build in gitlab-docs only on docs-only branches.
 # Useful to preview the docs changes live.
 review-docs-deploy:
-  extends: .review-docs
+  extends:
+    - .review-docs
+    - .except-qa
   script:
+    - gem install gitlab --no-document
     - ./trigger-build-docs deploy
-  when: manual
+  only:
+    - /(^docs[\/-].+|.+-docs$)/@gitlab-org/gitlab-foss
+    - /(^docs[\/-].+|.+-docs$)/@gitlab-org/gitlab
 
 # Cleanup remote environment of gitlab-docs
 review-docs-cleanup:
-  extends: .review-docs
+  extends:
+    - .review-docs
+    - .except-qa
   environment:
     name: review-docs/$CI_COMMIT_REF_SLUG
     action: stop
   script:
+    - gem install gitlab --no-document
     - ./trigger-build-docs cleanup
   when: manual
+  only:
+    - branches@gitlab-org/gitlab-foss
+    - branches@gitlab-org/gitlab
 
 docs lint:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-    - .only-docs-changes
+    - .except-qa
   image: "registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-docs-lint"
   stage: test
   dependencies: []
diff --git a/.gitlab/ci/frontend.gitlab-ci.yml b/.gitlab/ci/frontend.gitlab-ci.yml
index f72396e4edf..a61601597c3 100644
--- a/.gitlab/ci/frontend.gitlab-ci.yml
+++ b/.gitlab/ci/frontend.gitlab-ci.yml
@@ -9,10 +9,9 @@
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-    - .default-before_script
     - .assets-compile-cache
-    - .only-code-qa-changes
+    - .default-before_script
+    - .except-docs
   image: dev.gitlab.org:5005/gitlab/gitlab-build-images:ruby-2.6.3-git-2.22-chrome-73.0-node-12.x-yarn-1.16-graphicsmagick-1.3.33-docker-18.06.1
   stage: test
   dependencies: ["setup-test-env"]
@@ -46,9 +45,10 @@
     - scripts/clean-old-cached-assets
     - rm -f /etc/apt/sources.list.d/google*.list  # We don't need to update Chrome here
   only:
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
-      - $CI_SERVER_HOST == "dev.gitlab.org"
+    - /.+/@gitlab-org/gitlab-foss
+    - /.+/@gitlab-org/gitlab
+    - /.+/@gitlab/gitlabhq
+    - /.+/@gitlab/gitlab-ee
   tags:
     - gitlab-org
     - docker
@@ -57,7 +57,8 @@ gitlab:assets:compile:
   extends: .gitlab:assets:compile-metadata
   only:
     refs:
-      - master
+      - master@gitlab-org/gitlab-foss
+      - master@gitlab-org/gitlab
   cache:
     policy: pull-push
 
@@ -65,7 +66,9 @@ gitlab:assets:compile pull-cache:
   extends: .gitlab:assets:compile-metadata
   except:
     refs:
-      - master
+      - master@gitlab-org/gitlab-foss
+      - master@gitlab-org/gitlab
+      - /(^docs[\/-].+|.+-docs$)/
   cache:
     policy: pull
 
@@ -73,10 +76,8 @@ gitlab:assets:compile pull-cache:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-    - .default-before_script
     - .assets-compile-cache
-    - .only-code-qa-changes
+    - .default-before_script
     - .use-pg
   stage: prepare
   script:
@@ -97,10 +98,12 @@ gitlab:assets:compile pull-cache:
       - public/assets
 
 compile-assets:
-  extends: .compile-assets-metadata
+  extends:
+    - .compile-assets-metadata
   only:
     refs:
-      - master
+      - master@gitlab-org/gitlab-foss
+      - master@gitlab-org/gitlab
   cache:
     policy: pull-push
 
@@ -108,23 +111,21 @@ compile-assets pull-cache:
   extends: .compile-assets-metadata
   except:
     refs:
-      - master
+      - master@gitlab-org/gitlab-foss
+      - master@gitlab-org/gitlab
+      - /(^docs[\/-].+|.+-docs$)/
   cache:
     policy: pull
 
-.only-code-frontend-job-base:
+karma:
   extends:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
     - .default-before_script
-    - .only-code-changes
     - .use-pg
+    - .except-docs
   dependencies: ["compile-assets", "compile-assets pull-cache", "setup-test-env"]
-
-karma:
-  extends: .only-code-frontend-job-base
   variables:
     # we override the max_old_space_size to prevent OOM errors
     NODE_OPTIONS: --max_old_space_size=3584
@@ -147,7 +148,14 @@ karma:
       junit: junit_karma.xml
 
 jest:
-  extends: .only-code-frontend-job-base
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  dependencies: ["compile-assets", "compile-assets pull-cache", "setup-test-env"]
   script:
     - scripts/gitaly-test-spawn
     - date
@@ -170,26 +178,27 @@ jest:
       - tmp/jest/jest/
     policy: pull-push
 
-.qa-job-base:
+.qa:
   extends:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
-    - .only-code-qa-changes
+    - .except-docs
   dependencies: []
   stage: test
+  variables:
+    SETUP_DB: "false"
   before_script:
     - cd qa/
     - bundle install
 
 qa:internal:
-  extends: .qa-job-base
+  extends: .qa
   script:
     - bundle exec rspec
 
 qa:selectors:
-  extends: .qa-job-base
+  extends: .qa
   script:
     - bundle exec bin/qa Test::Sanity::Selectors
 
@@ -198,8 +207,7 @@ qa:selectors:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
-    - .only-code-changes
+    - .except-docs
   dependencies: []
   cache:
     key: "$CI_JOB_NAME"
@@ -230,9 +238,10 @@ webpack-dev-server:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .only-code-changes
-  dependencies: ["setup-test-env", "compile-assets", "compile-assets pull-cache"]
+    - .except-docs-qa
+  dependencies: ["compile-assets", "compile-assets pull-cache", "setup-test-env"]
   variables:
+    SETUP_DB: "false"
     WEBPACK_MEMORY_TEST: "true"
   script:
     - node --version
diff --git a/.gitlab/ci/global.gitlab-ci.yml b/.gitlab/ci/global.gitlab-ci.yml
index 94d7d2cdaa4..8287390c80e 100644
--- a/.gitlab/ci/global.gitlab-ci.yml
+++ b/.gitlab/ci/global.gitlab-ci.yml
@@ -27,83 +27,40 @@
       - vendor/gitaly-ruby
     policy: pull
 
-.default-only:
-  only:
+.except-docs:
+  except:
     refs:
-      - master
-      - /^[\d-]+-stable(-ee)?$/
-      - /^\d+-\d+-auto-deploy-\d+$/
-      - merge_requests
-      - tags
-
-.only-code-changes:
-  only:
-    changes:
-      - ".gitlab/ci/**/*"
-      - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
-      - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
-      - ".csscomb.json"
-      - "Dangerfile"
-      - "Dockerfile.assets"
-      - "*_VERSION"
-      - "Gemfile{,.lock}"
-      - "Rakefile"
-      - "{babel.config,jest.config}.js"
-      - "config.ru"
-      - "{package.json,yarn.lock}"
-      - "{app,bin,config,danger,db,ee,fixtures,haml_lint,lib,public,rubocop,scripts,spec,symbol,vendor}/**/*"
-      - "doc/README.md"  # Some RSpec test rely on this file
+      - /(^docs[\/-].+|.+-docs$)/
 
-.only-qa-changes:
-  only:
-    changes:
-      - ".dockerignore"
-      - "qa/**/*"
+.except-qa:
+  except:
+    refs:
+      - /(^qa[\/-].*|.*-qa$)/
 
-.only-docs-changes:
-  only:
-    changes:
-      - ".gitlab/route-map.yml"
-      - "doc/**/*"
-      - ".markdownlint.json"
+.except-docs-qa:
+  except:
+    refs:
+      - /(^docs[\/-].+|.+-docs$)/
+      - /(^qa[\/-].*|.*-qa$)/
 
-.only-code-qa-changes:
-  only:
-    changes:
-      - ".gitlab/ci/**/*"
-      - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
-      - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,scss-lint}.yml"
-      - ".csscomb.json"
-      - "Dangerfile"
-      - "Dockerfile.assets"
-      - "*_VERSION"
-      - "Gemfile{,.lock}"
-      - "Rakefile"
-      - "{babel.config,jest.config}.js"
-      - "config.ru"
-      - "{package.json,yarn.lock}"
-      - "{app,bin,config,danger,db,ee,fixtures,haml_lint,lib,public,rubocop,scripts,spec,symbol,vendor}/**/*"
-      - "doc/README.md"  # Some RSpec test rely on this file
-      - ".dockerignore"
-      - "qa/**/*"
+.except-docs-qa-geo:
+  except:
+    refs:
+      - /(^docs[\/-].+|.+-docs$)/
+      - /(^qa[\/-].*|.*-qa$)/
+      - /(^geo[\/-].*|.*-geo$)/
 
-.only-review:
+.review-only:
   only:
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+    refs:
+      - branches@gitlab-org/gitlab-foss
+      - branches@gitlab-org/gitlab
     kubernetes: active
   except:
     refs:
       - master
       - /^\d+-\d+-auto-deploy-\d+$/
-
-.only-review-schedules:
-  only:
-    refs:
-      - schedules
-    variables:
-      - $REVIEW_APP_CLEANUP && $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
-    kubernetes: active
+      - /(^docs[\/-].+|.+-docs$)/
 
 .use-pg:
   services:
@@ -117,9 +74,3 @@
     - name: postgres:10.9
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
     - name: redis:alpine
-
-.only-ee:
-  only:
-    variables:
-      - $CI_PROJECT_NAME == "gitlab-ee"
-      - $CI_PROJECT_NAME == "gitlab"  # New name of gitlab-ee after the single codebase migration
diff --git a/.gitlab/ci/memory.gitlab-ci.yml b/.gitlab/ci/memory.gitlab-ci.yml
index d990c7eefa2..1936933cca4 100644
--- a/.gitlab/ci/memory.gitlab-ci.yml
+++ b/.gitlab/ci/memory.gitlab-ci.yml
@@ -1,14 +1,10 @@
-.only-code-memory-job-base:
+memory-static:
   extends:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
     - .default-before_script
-    - .only-code-changes
-
-memory-static:
-  extends: .only-code-memory-job-base
+    - .except-docs
   variables:
     SETUP_DB: "false"
   script:
@@ -35,8 +31,12 @@ memory-static:
 # All tests are run without a webserver (directly using Rack::Mock by default).
 memory-on-boot:
   extends:
-    - .only-code-memory-job-base
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
     - .use-pg-10
+    - .except-docs-qa
   variables:
     NODE_ENV: "production"
     RAILS_ENV: "production"
diff --git a/.gitlab/ci/pages.gitlab-ci.yml b/.gitlab/ci/pages.gitlab-ci.yml
index 47f4117e34a..cf77ec24090 100644
--- a/.gitlab/ci/pages.gitlab-ci.yml
+++ b/.gitlab/ci/pages.gitlab-ci.yml
@@ -3,12 +3,11 @@ pages:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
+    - .except-docs
   only:
     refs:
-      - master
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+      - master@gitlab-org/gitlab-foss
+      - master@gitlab-org/gitlab
   stage: pages
   dependencies: ["coverage", "karma", "gitlab:assets:compile"]
   script:
diff --git a/.gitlab/ci/qa.gitlab-ci.yml b/.gitlab/ci/qa.gitlab-ci.yml
index e7362f913a9..a868316c353 100644
--- a/.gitlab/ci/qa.gitlab-ci.yml
+++ b/.gitlab/ci/qa.gitlab-ci.yml
@@ -1,5 +1,4 @@
 .package-and-qa-base:
-  extends: .default-only
   image: ruby:2.6-alpine
   stage: qa
   dependencies: []
@@ -11,16 +10,17 @@
     - install_gitlab_gem
     - ./scripts/trigger-build omnibus
   only:
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
+    refs:
+      - branches@gitlab-org/gitlab-foss
+      - branches@gitlab-org/gitlab
 
 package-and-qa-manual:
-  extends:
-    - .package-and-qa-base
-    - .only-code-changes
+  extends: .package-and-qa-base
   except:
     refs:
       - master
+      - /(^docs[\/-].+|.+-docs$)/
+      - /(^qa[\/-].*|.*-qa$)/
   when: manual
   needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
 
@@ -34,11 +34,10 @@ package-and-qa-manual:master:
   needs: ["build-qa-image", "gitlab:assets:compile"]
 
 package-and-qa:
-  extends:
-    - .package-and-qa-base
-    - .only-qa-changes
-  except:
+  extends: .package-and-qa-base
+  only:
     refs:
-      - master
+      - /(^qa[\/-].*|.*-qa$)/@gitlab-org/gitlab-foss
+      - /(^qa[\/-].*|.*-qa$)/@gitlab-org/gitlab
   needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
   allow_failure: true
diff --git a/.gitlab/ci/rails.gitlab-ci.yml b/.gitlab/ci/rails.gitlab-ci.yml
index e9222c4b719..2363c0e5f8a 100644
--- a/.gitlab/ci/rails.gitlab-ci.yml
+++ b/.gitlab/ci/rails.gitlab-ci.yml
@@ -1,40 +1,36 @@
-.only-master:
+.only-schedules-master:
   only:
     refs:
-      - master
+      - schedules@gitlab-org/gitlab-foss
+      - schedules@gitlab-org/gitlab
+      - master@gitlab-org/gitlab-foss
+      - master@gitlab-org/gitlab
+      - master@gitlab/gitlabhq
+      - master@gitlab/gitlab-ee
+
+.only-gitlab-ee:
+  only:
+    - branches@gitlab-org/gitlab
+    - tags@gitlab-org/gitlab
 
 .rake-exec:
   extends:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
     - .default-before_script
   variables:
     SETUP_DB: "false"
   script:
     - bundle exec rake $CI_JOB_NAME
 
-.only-code-rails-job-base:
-  extends:
-    - .default-tags
-    - .default-retry
-    - .default-cache
-    - .default-only
-    - .default-before_script
-    - .only-code-changes
-
-.only-code-qa-rails-job-base:
+.rspec-base:
   extends:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
     - .default-before_script
-    - .only-code-qa-changes
-
-.rspec-base:
-  extends: .only-code-rails-job-base
+    - .except-docs-qa
   stage: test
   script:
     - JOB_NAME=( $CI_JOB_NAME )
@@ -83,8 +79,12 @@
 
 setup-test-env:
   extends:
-    - .only-code-qa-rails-job-base
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
     - .use-pg
+    - .except-docs
   stage: prepare
   script:
     - bundle exec ruby -Ispec -e 'require "spec_helper" ; TestEnv.init'
@@ -111,19 +111,19 @@ rspec system pg:
 rspec unit pg-10:
   extends:
     - .rspec-base-pg-10
-    - .only-master
+    - .only-schedules-master
   parallel: 20
 
 rspec integration pg-10:
   extends:
     - .rspec-base-pg-10
-    - .only-master
+    - .only-schedules-master
   parallel: 6
 
 rspec system pg-10:
   extends:
     - .rspec-base-pg-10
-    - .only-master
+    - .only-schedules-master
   parallel: 24
 
 rspec-fast-spec-helper:
@@ -133,8 +133,9 @@ rspec-fast-spec-helper:
 
 rspec quarantine pg:
   extends:
+    - .default-before_script
     - .rspec-base-pg
-    - .only-master
+    - .only-schedules-master
   script:
     - export NO_KNAPSACK=1 CACHE_CLASSES=true
     - scripts/gitaly-test-spawn
@@ -142,7 +143,12 @@ rspec quarantine pg:
   allow_failure: true
 
 static-analysis:
-  extends: .only-code-qa-rails-job-base
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .except-docs
   dependencies: ["setup-test-env", "compile-assets", "compile-assets pull-cache"]
   variables:
     SETUP_DB: "false"
@@ -156,48 +162,81 @@ static-analysis:
     policy: pull-push
 
 downtime_check:
-  extends:
-    - .rake-exec
-    - .only-code-changes
+  extends: .rake-exec
   except:
     refs:
       - master
       - tags
-    variables:
-      - $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable(-ee)?$/
+      - /^[\d-]+-stable(-ee)?$/
+      - /(^docs[\/-].+|.+-docs$)/
+      - /(^qa[\/-].*|.*-qa$)/
   stage: test
   dependencies: ["setup-test-env"]
   needs: ["setup-test-env"]
 
-.db-job-base:
+ee_compat_check:
+  extends: .rake-exec
+  dependencies: []
+  except:
+    refs:
+      - master
+      - tags
+      - branches@gitlab-org/gitlab
+      - branches@gitlab/gitlab-ee
+      - /^[\d-]+-stable(-ee)?$/
+      - /(^docs[\/-].+|.+-docs$)/
+      - /^security-/
+  artifacts:
+    name: "${CI_JOB_NAME}_${CI_COMIT_REF_NAME}_${CI_COMMIT_SHA}"
+    when: always
+    expire_in: 10d
+    paths:
+      - ee_compat_check/patches/*.patch
+
+# DB migration, rollback, and seed jobs
+db:migrate:reset:
   extends:
-    - .only-code-rails-job-base
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
     - .use-pg
+    - .except-docs-qa
   stage: test
   dependencies: ["setup-test-env"]
   needs: ["setup-test-env"]
-
-# DB migration, rollback, and seed jobs
-db:migrate:reset:
-  extends: .db-job-base
   script:
     - bundle exec rake db:migrate:reset
 
 db:check-schema:
-  extends: .db-job-base
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  stage: test
+  dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   script:
     - source scripts/schema_changed.sh
 
 db:migrate-from-v11.11.0:
-  extends: .db-job-base
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  stage: test
+  dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   variables:
     SETUP_DB: "false"
   script:
-    - export PROJECT_TO_CHECKOUT="gitlab-foss"
-    - export TAG_TO_CHECKOUT="v11.11.0"
-    - '[[ ! -d "ee/" ]] || export PROJECT_TO_CHECKOUT="gitlab"'
-    - '[[ ! -d "ee/" ]] || export TAG_TO_CHECKOUT="v11.11.0-ee"'
-    - git fetch https://gitlab.com/gitlab-org/$PROJECT_TO_CHECKOUT.git $TAG_TO_CHECKOUT
+    - git fetch https://gitlab.com/gitlab-org/gitlab.git v11.11.0-ee
     - git checkout -f FETCH_HEAD
     - sed -i "s/gem 'oj', '~> 2.17.4'//" Gemfile
     - sed -i "s/gem 'bootsnap', '~> 1.0.0'/gem 'bootsnap'/" Gemfile
@@ -215,13 +254,31 @@ db:migrate-from-v11.11.0:
     - bundle exec rake db:migrate
 
 db:rollback:
-  extends: .db-job-base
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  stage: test
+  dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   script:
     - bundle exec rake db:migrate VERSION=20180101160629
     - bundle exec rake db:migrate SKIP_SCHEMA_VERSION_CHECK=true
 
 gitlab:setup:
-  extends: .db-job-base
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  stage: test
+  dependencies: ["setup-test-env"]
+  needs: ["setup-test-env"]
   variables:
     SETUP_DB: "false"
   script:
@@ -238,7 +295,14 @@ gitlab:setup:
       - log/development.log
 
 coverage:
-  extends: .only-code-rails-job-base
+  # Don't include dedicated-no-docs-no-db-pull-cache-job here since we need to
+  # download artifacts from all the rspec jobs instead of from setup-test-env only
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .except-docs-qa
   cache:
     policy: pull
   variables:
@@ -260,7 +324,7 @@ coverage:
 .rspec-base-ee:
   extends:
     - .rspec-base
-    - .only-ee
+    - .only-gitlab-ee
   script:
     - JOB_NAME=( $CI_JOB_NAME )
     - TEST_TOOL=${JOB_NAME[0]}
@@ -298,9 +362,10 @@ rspec system pg ee:
   extends: .rspec-base-pg-ee
   parallel: 5
 
-.rspec-base-geo:
-  extends: .rspec-base-ee
-  parallel: 3
+.rspec-base-pg-geo:
+  extends:
+    - .rspec-base
+    - .only-gitlab-ee
   script:
     - JOB_NAME=( $CI_JOB_NAME )
     - TEST_TOOL=${JOB_NAME[0]}
@@ -317,37 +382,33 @@ rspec system pg ee:
 
 rspec geo pg ee:
   extends:
-    - .rspec-base-geo
+    - .rspec-base-pg-geo
     - .use-pg
-  except:
-    variables:
-      - $CI_COMMIT_REF_NAME =~ /(^geo[\/-].*|.*-geo$)/
+    - .except-docs-qa-geo
+  parallel: 3
 
 rspec geo pg-10 ee:
   extends:
-    - .rspec-base-geo
+    - .rspec-base-pg-geo
     - .use-pg-10
-  except:
-    variables:
-      - $CI_COMMIT_REF_NAME =~ /(^geo[\/-].*|.*-geo$)/
+    - .except-docs-qa-geo
+  parallel: 3
 
 quick-rspec geo pg ee:
   extends:
-    - .rspec-base-geo
+    - .rspec-base-pg-geo
     - .use-pg
   stage: quick-test
   only:
-    variables:
-      - $CI_COMMIT_REF_NAME =~ /(^geo[\/-].*|.*-geo$)/
+    - /(^geo[\/-].*|.*-geo$)/
 
 quick-rspec geo pg-10 ee:
   extends:
-    - .rspec-base-geo
+    - .rspec-base-pg-geo
     - .use-pg-10
   stage: quick-test
   only:
-    variables:
-      - $CI_COMMIT_REF_NAME =~ /(^geo[\/-].*|.*-geo$)/
+    - /(^geo[\/-].*|.*-geo$)/
 
 rspec quarantine pg ee:
   extends: rspec quarantine pg
@@ -356,10 +417,35 @@ rspec quarantine pg ee:
     - scripts/gitaly-test-spawn
     - bin/rspec --color --format documentation --format RspecJunitFormatter --out junit_rspec.xml --tag quarantine -- ee/spec/
 
+migration:upgrade-pg-ce-to-ee:
+  extends:
+    - .default-tags
+    - .default-retry
+    - .default-cache
+    - .default-before_script
+    - .use-pg
+    - .except-docs-qa
+  dependencies: ["setup-test-env"]
+  variables:
+    SETUP_DB: "false"
+  script:
+    - ruby -r./scripts/ee_specific_check/ee_specific_check -e'EESpecificCheck.fetch_remote_ce_branch'
+    - git checkout -f FETCH_HEAD
+    - . scripts/utils.sh
+    - . scripts/prepare_build.sh
+    - date
+    - setup_db
+    - date
+    - git checkout -f $CI_COMMIT_SHA
+    - date
+    - . scripts/prepare_build.sh
+    - date
+    - bundle exec rake db:migrate
+
 db:rollback geo:
   extends:
     - db:rollback
-    - .only-ee
+    - .only-gitlab-ee
   script:
     - bundle exec rake geo:db:migrate VERSION=20170627195211
     - bundle exec rake geo:db:migrate
diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index 38da73034d5..5622cd232ca 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -1,236 +1,39 @@
-# include:
-#   - template: Code-Quality.gitlab-ci.yml
-#   - template: Security/SAST.gitlab-ci.yml
-#   - template: Security/Dependency-Scanning.gitlab-ci.yml
-#   - template: Security/DAST.gitlab-ci.yml
+include:
+  - template: Code-Quality.gitlab-ci.yml
+  - template: Security/SAST.gitlab-ci.yml
+  - template: Security/Dependency-Scanning.gitlab-ci.yml
+  - template: Security/DAST.gitlab-ci.yml
 
-# We need to duplicate this job's definition because it seems it's impossible to
-# override an included `only.refs`.
-# See https://gitlab.com/gitlab-org/gitlab/issues/31371.
-code_quality:
+.reports:
   extends:
     - .default-retry
-    - .default-only
-    - .only-code-changes
-  stage: test
-  image: docker:stable
-  allow_failure: true
-  services:
-    - docker:stable-dind
-  variables:
-    DOCKER_DRIVER: overlay2
-    DOCKER_TLS_CERTDIR: ""
-  script:
-    - |
-      if ! docker info &>/dev/null; then
-        if [ -z "$DOCKER_HOST" -a "$KUBERNETES_PORT" ]; then
-          export DOCKER_HOST='tcp://localhost:2375'
-        fi
-      fi
-    - docker run
-        --env SOURCE_CODE="$PWD"
-        --volume "$PWD":/code
-        --volume /var/run/docker.sock:/var/run/docker.sock
-        "registry.gitlab.com/gitlab-org/security-products/codequality:12-0-stable" /code
-  artifacts:
-    reports:
-      codequality: gl-code-quality-report.json
-    expire_in: 1 week
-  dependencies: []
-  except:
-    variables:
-      - $CODE_QUALITY_DISABLED
+    - .except-docs
+
+code_quality:
+  extends: .reports
 
-# We need to duplicate this job's definition because it seems it's impossible to
-# override an included `only.refs`.
-# See https://gitlab.com/gitlab-org/gitlab/issues/31371.
 sast:
-  extends:
-    - .default-retry
-    - .default-only
-    - .only-code-changes
-  stage: test
-  image: docker:stable
+  extends: .reports
   variables:
-    DOCKER_DRIVER: overlay2
-    DOCKER_TLS_CERTDIR: ""
     SAST_BRAKEMAN_LEVEL: 2
-    SAST_EXCLUDED_PATHS: qa,spec,doc,ee/spec
-  allow_failure: true
-  services:
-    - docker:stable-dind
-  script:
-    - export SAST_VERSION=${SP_VERSION:-$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')}
-    - |
-      if ! docker info &>/dev/null; then
-        if [ -z "$DOCKER_HOST" -a "$KUBERNETES_PORT" ]; then
-          export DOCKER_HOST='tcp://localhost:2375'
-        fi
-      fi
-    - | # this is required to avoid undesirable reset of Docker image ENV variables being set on build stage
-      function propagate_env_vars() {
-        CURRENT_ENV=$(printenv)
-
-        for VAR_NAME; do
-          echo $CURRENT_ENV | grep "${VAR_NAME}=" > /dev/null && echo "--env $VAR_NAME "
-        done
-      }
-    - |
-      docker run \
-        $(propagate_env_vars \
-          SAST_BANDIT_EXCLUDED_PATHS \
-          SAST_ANALYZER_IMAGES \
-          SAST_ANALYZER_IMAGE_PREFIX \
-          SAST_ANALYZER_IMAGE_TAG \
-          SAST_DEFAULT_ANALYZERS \
-          SAST_PULL_ANALYZER_IMAGES \
-          SAST_BRAKEMAN_LEVEL \
-          SAST_FLAWFINDER_LEVEL \
-          SAST_GITLEAKS_ENTROPY_LEVEL \
-          SAST_GOSEC_LEVEL \
-          SAST_EXCLUDED_PATHS \
-          SAST_DOCKER_CLIENT_NEGOTIATION_TIMEOUT \
-          SAST_PULL_ANALYZER_IMAGE_TIMEOUT \
-          SAST_RUN_ANALYZER_TIMEOUT \
-          SAST_JAVA_VERSION \
-          ANT_HOME \
-          ANT_PATH \
-          GRADLE_PATH \
-          JAVA_OPTS \
-          JAVA_PATH \
-          JAVA_8_VERSION \
-          JAVA_11_VERSION \
-          MAVEN_CLI_OPTS \
-          MAVEN_PATH \
-          MAVEN_REPO_PATH \
-          SBT_PATH \
-          FAIL_NEVER \
-        ) \
-        --volume "$PWD:/code" \
-        --volume /var/run/docker.sock:/var/run/docker.sock \
-        "registry.gitlab.com/gitlab-org/security-products/sast:$SAST_VERSION" /app/bin/run /code
+    SAST_EXCLUDED_PATHS: qa,spec,doc
   artifacts:
     expire_in: 7 days
     paths:
       - gl-sast-report.json
-    reports:
-      sast: gl-sast-report.json
-  dependencies: []
-  only:
-    variables:
-      - $GITLAB_FEATURES =~ /\bsast\b/
-  except:
-    variables:
-      - $SAST_DISABLED
 
-# We need to duplicate this job's definition because it seems it's impossible to
-# override an included `only.refs`.
-# See https://gitlab.com/gitlab-org/gitlab/issues/31371.
 dependency_scanning:
-  extends:
-    - .default-retry
-    - .default-only
-    - .only-code-changes
-  stage: test
-  image: docker:stable
-  variables:
-    DOCKER_DRIVER: overlay2
-    DOCKER_TLS_CERTDIR: ""
-  allow_failure: true
-  services:
-    - docker:stable-dind
-  script:
-    - export DS_VERSION=${SP_VERSION:-$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')}
-    - |
-      if ! docker info &>/dev/null; then
-        if [ -z "$DOCKER_HOST" -a "$KUBERNETES_PORT" ]; then
-          export DOCKER_HOST='tcp://localhost:2375'
-        fi
-      fi
-    - | # this is required to avoid undesirable reset of Docker image ENV variables being set on build stage
-      function propagate_env_vars() {
-        CURRENT_ENV=$(printenv)
+  extends: .reports
 
-        for VAR_NAME; do
-          echo $CURRENT_ENV | grep "${VAR_NAME}=" > /dev/null && echo "--env $VAR_NAME "
-        done
-      }
-    - |
-      docker run \
-        $(propagate_env_vars \
-          DS_ANALYZER_IMAGES \
-          DS_ANALYZER_IMAGE_PREFIX \
-          DS_ANALYZER_IMAGE_TAG \
-          DS_DEFAULT_ANALYZERS \
-          DS_EXCLUDED_PATHS \
-          DEP_SCAN_DISABLE_REMOTE_CHECKS \
-          DS_DOCKER_CLIENT_NEGOTIATION_TIMEOUT \
-          DS_PULL_ANALYZER_IMAGE_TIMEOUT \
-          DS_RUN_ANALYZER_TIMEOUT \
-          DS_PYTHON_VERSION \
-          DS_PIP_DEPENDENCY_PATH \
-          PIP_INDEX_URL \
-          PIP_EXTRA_INDEX_URL \
-        ) \
-        --volume "$PWD:/code" \
-        --volume /var/run/docker.sock:/var/run/docker.sock \
-        "registry.gitlab.com/gitlab-org/security-products/dependency-scanning:$DS_VERSION" /code
-  artifacts:
-    reports:
-      dependency_scanning: gl-dependency-scanning-report.json
-  dependencies: []
-  only:
-    variables:
-      - $GITLAB_FEATURES =~ /\bdependency_scanning\b/
-  except:
-    variables:
-      - $DEPENDENCY_SCANNING_DISABLED
-
-# We need to duplicate this job's definition because it seems it's impossible to
-# override an included `only.refs`.
-# See https://gitlab.com/gitlab-org/gitlab/issues/31371.
 dast:
   extends:
-    - .default-retry
-    - .default-only
-    - .only-code-qa-changes
-    - .only-review
+    - .reports
+    - .review-only
   stage: qa
   dependencies: ["review-deploy"]
   before_script:
     - export DAST_WEBSITE="$(cat review_app_url.txt)"
-  image:
-    name: "registry.gitlab.com/gitlab-org/security-products/dast:$CI_SERVER_VERSION_MAJOR-$CI_SERVER_VERSION_MINOR-stable"
-  variables:
-  # URL to scan:
-  # DAST_WEBSITE: https://example.com/
-  #
-  # Time limit for target availability (scan is attempted even when timeout):
-  # DAST_TARGET_AVAILABILITY_TIMEOUT: 60
-  #
-  # Set these variables to scan with an authenticated user:
-  # DAST_AUTH_URL: https://example.com/sign-in
-  # DAST_USERNAME: john.doe@example.com
-  # DAST_PASSWORD: john-doe-password
-  # DAST_USERNAME_FIELD: session[user] # the name of username field at the sign-in HTML form
-  # DAST_PASSWORD_FIELD: session[password] # the name of password field at the sign-in HTML form
-  # DAST_AUTH_EXCLUDE_URLS: http://example.com/sign-out,http://example.com/sign-out-2 # optional: URLs to skip during the authenticated scan; comma-separated, no spaces in between
-  #
-  # Perform ZAP Full Scan, which includes both passive and active scanning:
-  # DAST_FULL_SCAN_ENABLED: "true"
-  allow_failure: true
-  script:
-    - export DAST_WEBSITE=${DAST_WEBSITE:-$(cat environment_url.txt)}
-    - /analyze -t $DAST_WEBSITE
   artifacts:
     expire_in: 7 days
     paths:
       - gl-dast-report.json
-    reports:
-      dast: gl-dast-report.json
-  only:
-    variables:
-      - $GITLAB_FEATURES =~ /\bdast\b/
-  except:
-    variables:
-      - $DAST_DISABLED
diff --git a/.gitlab/ci/review.gitlab-ci.yml b/.gitlab/ci/review.gitlab-ci.yml
index c7b79dac9dd..a269e15611f 100644
--- a/.gitlab/ci/review.gitlab-ci.yml
+++ b/.gitlab/ci/review.gitlab-ci.yml
@@ -1,10 +1,21 @@
+.review-schedules-only:
+  only:
+    refs:
+      - schedules@gitlab-org/gitlab-foss
+      - schedules@gitlab-org/gitlab
+    kubernetes: active
+    variables:
+      - $REVIEW_APP_CLEANUP
+  except:
+    refs:
+      - tags
+      - /(^docs[\/-].+|.+-docs$)/
+
 .review-base:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-    - .only-review
-    - .only-code-qa-changes
+    - .review-only
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-charts-build-base
   dependencies: []
   before_script:
@@ -14,7 +25,6 @@
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-qa-alpine
   services:
     - docker:19.03.0-dind
@@ -24,27 +34,24 @@
   variables:
     DOCKER_DRIVER: overlay2
     DOCKER_HOST: tcp://docker:2375
-    GITLAB_EDITION: "ce"
+    LATEST_QA_IMAGE: "gitlab/${CI_PROJECT_NAME}-qa:nightly"
+    QA_IMAGE: "${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab/${CI_PROJECT_NAME}-qa:${CI_COMMIT_REF_SLUG}"
 
 build-qa-image:
   extends:
     - .review-docker
-    - .only-code-qa-changes
+    - .except-docs
   only:
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
-  stage: prepare
+    refs:
+      - branches@gitlab-org/gitlab-foss
+      - branches@gitlab-org/gitlab
+  stage: test
   script:
-    - '[[ ! -d "ee/" ]] || export GITLAB_EDITION="ee"'
-    - export QA_IMAGE="${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab/gitlab-${GITLAB_EDITION}-qa:${CI_COMMIT_REF_SLUG}"
-    - time docker build --cache-from gitlab/gitlab-${GITLAB_EDITION}-qa:nightly --tag ${QA_IMAGE} --file ./qa/Dockerfile ./
+    - time docker build --cache-from ${LATEST_QA_IMAGE} --tag ${QA_IMAGE} --file ./qa/Dockerfile ./
     - echo "${CI_JOB_TOKEN}" | docker login --username gitlab-ci-token --password-stdin ${CI_REGISTRY}
     - time docker push ${QA_IMAGE}
 
 .review-build-cng-base:
-  extends:
-    - .default-only
-    - .only-code-qa-changes
   image: ruby:2.6-alpine
   stage: review-prepare
   before_script:
@@ -58,13 +65,13 @@ build-qa-image:
 review-build-cng:
   extends:
     - .review-build-cng-base
-    - .only-review
+    - .review-only
   needs: ["gitlab:assets:compile pull-cache"]
 
 schedule:review-build-cng:
   extends:
     - .review-build-cng-base
-    - .only-review-schedules
+    - .review-schedules-only
   needs: ["gitlab:assets:compile"]
 
 .review-deploy-base:
@@ -75,13 +82,11 @@ schedule:review-build-cng:
     HOST_SUFFIX: "${CI_ENVIRONMENT_SLUG}"
     DOMAIN: "-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}"
     GITLAB_HELM_CHART_REF: "master"
-    GITLAB_EDITION: "ce"
   environment:
     name: review/${CI_COMMIT_REF_NAME}
     url: https://gitlab-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}
     on_stop: review-stop
   before_script:
-    - '[[ ! -d "ee/" ]] || export GITLAB_EDITION="ee"'
     - export GITLAB_SHELL_VERSION=$(<GITLAB_SHELL_VERSION)
     - export GITALY_VERSION=$(<GITALY_SERVER_VERSION)
     - export GITLAB_WORKHORSE_VERSION=$(<GITLAB_WORKHORSE_VERSION)
@@ -110,7 +115,7 @@ review-deploy:
 schedule:review-deploy:
   extends:
     - .review-deploy-base
-    - .only-review-schedules
+    - .review-schedules-only
   needs: ["schedule:review-build-cng"]
 
 review-stop:
@@ -145,8 +150,7 @@ review-cleanup-failed-deployment:
 .review-qa-base:
   extends:
     - .review-docker
-    - .only-review
-    - .only-code-qa-changes
+    - .review-only
   stage: qa
   variables:
     QA_ARTIFACTS_DIR: "${CI_PROJECT_DIR}/qa"
@@ -165,8 +169,6 @@ review-cleanup-failed-deployment:
     expire_in: 7 days
     when: always
   before_script:
-    - '[[ ! -d "ee/" ]] || export GITLAB_EDITION="ee"'
-    - export QA_IMAGE="${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab/gitlab-${GITLAB_EDITION}-qa:${CI_COMMIT_REF_SLUG}"
     - export CI_ENVIRONMENT_URL="$(cat review_app_url.txt)"
     - echo "${CI_ENVIRONMENT_URL}"
     - echo "${QA_IMAGE}"
@@ -193,9 +195,7 @@ review-qa-all:
 parallel-spec-reports:
   extends:
     - .default-tags
-    - .default-only
-    - .only-code-qa-changes
-    - .only-review
+    - .except-docs
   image: ruby:2.6-alpine
   stage: post-test
   dependencies: ["review-qa-all"]
@@ -242,14 +242,14 @@ review-performance:
 schedule:review-performance:
   extends:
     - review-performance
-    - .only-review-schedules
+    - .review-schedules-only
   dependencies: ["schedule:review-deploy"]
 
 schedule:review-cleanup:
   extends:
     - .review-base
-    - .only-review-schedules
-  stage: prepare
+    - .review-schedules-only
+  stage: build
   allow_failure: true
   environment:
     name: review/auto-cleanup
@@ -265,7 +265,6 @@ danger-review:
     - .default-tags
     - .default-retry
     - .default-cache
-    - .default-only
   image: registry.gitlab.com/gitlab-org/gitlab-build-images:danger
   stage: test
   dependencies: []
@@ -275,9 +274,10 @@ danger-review:
   except:
     refs:
       - master
-    variables:
-      - $CI_COMMIT_REF_NAME =~ /^\d+-\d+-auto-deploy-\d+$/
-      - $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable(-ee)?$/
+      - /^\d+-\d+-auto-deploy-\d+$/
+      - /^[\d-]+-stable(-ee)?$/
+      - /^ce-to-ee-.*/
+      - /.*-stable(-ee)?-prepare-.*/
   script:
     - git version
     - node --version
diff --git a/.gitlab/ci/setup.gitlab-ci.yml b/.gitlab/ci/setup.gitlab-ci.yml
index e673eb9c7f3..d29907b3683 100644
--- a/.gitlab/ci/setup.gitlab-ci.yml
+++ b/.gitlab/ci/setup.gitlab-ci.yml
@@ -6,6 +6,7 @@ cache gems:
     - .default-retry
     - .default-cache
     - .default-before_script
+    - .except-docs
   stage: test
   dependencies: ["setup-test-env"]
   needs: ["setup-test-env"]
@@ -18,17 +19,15 @@ cache gems:
       - vendor/cache
   only:
     refs:
-      - master
+      - master@gitlab-org/gitlab-foss
+      - master@gitlab-org/gitlab
       - tags
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
 
 .minimal-job:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-    - .only-code-changes
+    - .except-docs-qa
   dependencies: []
 
 gitlab_git_test:
@@ -41,6 +40,5 @@ no_ee_check:
   script:
     - scripts/no-ee-check
   only:
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAME == "gitlab-foss"
-      - $CI_SERVER_HOST == "dev.gitlab.org" && $CI_PROJECT_NAME == "gitlabhq"
+    refs:
+      - branches@gitlab-org/gitlab-foss
diff --git a/.gitlab/ci/test-metadata.gitlab-ci.yml b/.gitlab/ci/test-metadata.gitlab-ci.yml
index fe3cde2bb16..14c230deb47 100644
--- a/.gitlab/ci/test-metadata.gitlab-ci.yml
+++ b/.gitlab/ci/test-metadata.gitlab-ci.yml
@@ -1,5 +1,4 @@
 .tests-metadata-state:
-  extends: .default-only
   variables:
     TESTS_METADATA_S3_BUCKET: "gitlab-ce-cache"
   before_script:
@@ -14,7 +13,7 @@
 retrieve-tests-metadata:
   extends:
     - .tests-metadata-state
-    - .only-code-changes
+    - .except-docs-qa
   stage: prepare
   cache:
     key: tests_metadata
@@ -27,8 +26,8 @@ retrieve-tests-metadata:
     - mkdir -p rspec_profiling/
     - wget -O $FLAKY_RSPEC_SUITE_REPORT_PATH http://${TESTS_METADATA_S3_BUCKET}.s3.amazonaws.com/$FLAKY_RSPEC_SUITE_REPORT_PATH || rm $FLAKY_RSPEC_SUITE_REPORT_PATH
     - '[[ -f $FLAKY_RSPEC_SUITE_REPORT_PATH ]] || echo "{}" > ${FLAKY_RSPEC_SUITE_REPORT_PATH}'
-    - '[[ ! -d "ee/" ]] || wget -O $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH http://${TESTS_METADATA_S3_BUCKET}.s3.amazonaws.com/$EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH || rm $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH'
-    - '[[ ! -d "ee/" ]] || [[ -f $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH ]] || echo "{}" > ${EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH}'
+    - wget -O $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH http://${TESTS_METADATA_S3_BUCKET}.s3.amazonaws.com/$EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH || rm $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH
+    - '[[ -f $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH ]] || echo "{}" > ${EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH}'
 
 update-tests-metadata:
   extends: .tests-metadata-state
@@ -44,9 +43,9 @@ update-tests-metadata:
     - echo "{}" > ${KNAPSACK_RSPEC_SUITE_REPORT_PATH}
     - scripts/merge-reports ${KNAPSACK_RSPEC_SUITE_REPORT_PATH} knapsack/${CI_PROJECT_NAME}/rspec_*_pg_node_*.json
     - '[[ -z ${TESTS_METADATA_S3_BUCKET} ]] || scripts/sync-reports put $TESTS_METADATA_S3_BUCKET $KNAPSACK_RSPEC_SUITE_REPORT_PATH'
-    - '[[ ! -d "ee/" ]] || echo "{}" > ${EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH}'
-    - '[[ ! -d "ee/" ]] || scripts/merge-reports ${EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH} knapsack/${CI_PROJECT_NAME}/rspec_*_pg_ee_*node_*.json'
-    - '[[ ! -d "ee/" ]] || [[ -z ${TESTS_METADATA_S3_BUCKET} ]] || scripts/sync-reports put $TESTS_METADATA_S3_BUCKET $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH'
+    - echo "{}" > ${EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH}
+    - scripts/merge-reports ${EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH} knapsack/${CI_PROJECT_NAME}/rspec_*_pg_ee_*node_*.json
+    - '[[ -z ${TESTS_METADATA_S3_BUCKET} ]] || scripts/sync-reports put $TESTS_METADATA_S3_BUCKET $EE_KNAPSACK_RSPEC_SUITE_REPORT_PATH'
     - rm -f knapsack/${CI_PROJECT_NAME}/*_node_*.json
     - scripts/merge-reports ${FLAKY_RSPEC_SUITE_REPORT_PATH} rspec_flaky/all_*_*.json
     - FLAKY_RSPEC_GENERATE_REPORT=1 scripts/prune-old-flaky-specs ${FLAKY_RSPEC_SUITE_REPORT_PATH}
@@ -55,17 +54,15 @@ update-tests-metadata:
     - scripts/insert-rspec-profiling-data
   only:
     refs:
-      - master
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"
-      - $CI_SERVER_HOST == "dev.gitlab.org"
+      - master@gitlab-org/gitlab-foss
+      - master@gitlab-org/gitlab
+      - master@gitlab/gitlabhq
+      - master@gitlab/gitlab-ee
 
 flaky-examples-check:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-    - .only-code-changes
   image: ruby:2.6-alpine
   stage: post-test
   variables:
@@ -73,7 +70,12 @@ flaky-examples-check:
   allow_failure: true
   only:
     refs:
-      - merge_requests
+      - branches
+  except:
+    refs:
+      - master
+      - /(^docs[\/-].+|.+-docs$)/
+      - /(^qa[\/-].*|.*-qa$)/
   artifacts:
     expire_in: 30d
     paths:
diff --git a/.gitlab/ci/yaml.gitlab-ci.yml b/.gitlab/ci/yaml.gitlab-ci.yml
index 323f94b6d04..dd61cb3f035 100644
--- a/.gitlab/ci/yaml.gitlab-ci.yml
+++ b/.gitlab/ci/yaml.gitlab-ci.yml
@@ -4,10 +4,7 @@ lint-ci-gitlab:
   extends:
     - .default-tags
     - .default-retry
-    - .default-only
-  only:
-    changes:
-      - "**/*.yml"
+    - .except-docs
   image: sdesbure/yamllint:latest
   dependencies: []
   script: