Add latest changes from gitlab-org/gitlab@master

4 files changed, 211 insertions, 28 deletions

diff --git a/.gitlab/ci/qa.gitlab-ci.yml b/.gitlab/ci/qa.gitlab-ci.yml
index eae3b2f2a36..b61c7bc90c9 100644
--- a/.gitlab/ci/qa.gitlab-ci.yml
+++ b/.gitlab/ci/qa.gitlab-ci.yml
@@ -105,6 +105,12 @@ trigger-omnibus:
     branch: $TRIGGER_BRANCH
     strategy: depend
 
+# Same as trigger-omnibus but is manual and runs follow-up-e2e:package-and-test-ee automatically right after
+trigger-omnibus-and-follow-up-e2e:
+  extends:
+    - trigger-omnibus
+    - .qa:rules:manual-omnibus-and-follow-up-e2e
+
 trigger-omnibus as-if-foss:
   extends:
     - trigger-omnibus
@@ -129,6 +135,20 @@ e2e:package-and-test-ee:
     QA_RUN_TYPE: e2e-package-and-test
     PIPELINE_NAME: E2E Omnibus GitLab EE
 
+# Same as e2e:package-and-test-ee but runs automatically after trigger-omnibus-and-follow-up-e2e
+follow-up-e2e:package-and-test-ee:
+  extends:
+    - .e2e-trigger-base
+    - .qa:rules:follow-up-e2e
+  needs:
+    - build-qa-image
+    - trigger-omnibus-and-follow-up-e2e
+    - e2e-test-pipeline-generate
+  variables:
+    RELEASE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/build/omnibus-gitlab-mirror/gitlab-ee:${CI_COMMIT_SHA}"
+    QA_RUN_TYPE: e2e-package-and-test
+    PIPELINE_NAME: E2E Omnibus GitLab EE
+
 e2e:package-and-test-ce:
   extends:
     - e2e:package-and-test-ee
@@ -187,4 +207,3 @@ e2e:test-on-gdk:
     DYNAMIC_PIPELINE_YML: test-on-gdk-pipeline.yml
     SKIP_MESSAGE: Skipping test-on-gdk due to mr containing only quarantine changes!
     GDK_IMAGE: "${CI_REGISTRY_IMAGE}/gitlab-qa-gdk:${CI_COMMIT_SHA}"
-  allow_failure: true
diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index 2d9bfaf7f63..c60bc2bcb1f 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -892,6 +892,8 @@
 # - build the final stage in code-change pipelines (including MRs), and scheduled pipelines
 # This has to match ".qa:rules:e2e:test-on-gdk" otherwise there won't be an image available to run GDK in the test jobs.
 # Unfortunately, we can't just include ".qa:rules:e2e:test-on-gdk" because some of the conditions are manual
+# Since the smoke test job is not allowed to fail, the `build-gdk-image` job is also not allowed to fail.
+# It's better to fail early and avoid wasting resources running test jobs that would just fail anyway.
 .build-images:rules:build-gdk-image:
   rules:
     - if: '$QA_RUN_TESTS_ON_GDK !~ /true|yes|1/i'
@@ -902,7 +904,6 @@
     - <<: *if-default-branch-refs # Includes scheduled pipelines
       variables:
         BUILD_GDK_BASE: "true"
-      allow_failure: true
     # We want to also rebuild the base image if MRs change certain components.
     - <<: *if-merge-request
       variables:
@@ -916,37 +917,32 @@
         - GITLAB_METRICS_EXPORTER_VERSION
         - GITLAB_SHELL_VERSION
         - GITALY_SERVER_VERSION
-      allow_failure: true
     # The rest are included to be consistent with .qa:rules:e2e:test-on-gdk
     - <<: *if-merge-request-targeting-stable-branch
       changes: *setup-test-env-patterns
-      allow_failure: true
     - <<: *if-ruby3_1-branch
-      allow_failure: true
     # We include the job under the matching conditions below, but unlike in .qa:rules:e2e:test-on-gdk we don't need to
     # set OMNIBUS_GITLAB_BUILD_ON_ALL_OS when testing against GDK
     - <<: *if-merge-request
       changes: *dependency-patterns
-      allow_failure: true
     - <<: *if-merge-request-labels-run-all-e2e
-      allow_failure: true
     - <<: *if-merge-request
       changes: *feature-flag-development-config-patterns
-      allow_failure: true
     - <<: *if-merge-request
       changes: *initializers-patterns
-      allow_failure: true
     - <<: *if-merge-request
       changes: *nodejs-patterns
-      allow_failure: true
     - <<: *if-merge-request
       changes: *ci-qa-patterns
-      allow_failure: true
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
+      changes: *feature-flag-development-config-patterns
+      when: manual
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
+      changes: *code-patterns
     - <<: *if-merge-request
       changes: *code-qa-patterns
-      allow_failure: true
     - <<: *if-force-ci
-      allow_failure: true
+      when: manual
 
 .build-images:rules:build-assets-image:
   rules:
@@ -1452,6 +1448,43 @@
     - <<: *if-force-ci
       allow_failure: true
 
+# All rules copied from qa:rules:package-and-test-ee but jobs are automatic and not allowed to fail
+.qa:rules:trigger-omnibus-env:
+  rules:
+    # From .qa:rules:package-and-test-common
+    - !reference [".qa:rules:package-and-test-never-run", rules]
+    - <<: *if-merge-request-targeting-stable-branch
+      changes: *setup-test-env-patterns
+    - <<: *if-ruby3_1-branch
+      variables:
+        USE_OLD_RUBY_VERSION: 'false'
+        CACHE_EDITION: 'GITLAB_RUBY3_1'
+    - <<: *if-merge-request
+      changes: *dependency-patterns
+      variables:
+        OMNIBUS_GITLAB_BUILD_ON_ALL_OS: 'true'
+    - <<: *if-merge-request-labels-run-all-e2e
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
+      changes: *feature-flag-development-config-patterns
+    - <<: *if-merge-request
+      changes: *feature-flag-development-config-patterns
+    - <<: *if-merge-request
+      changes: *initializers-patterns
+    - <<: *if-merge-request
+      changes: *nodejs-patterns
+    - <<: *if-merge-request
+      changes: *ci-qa-patterns
+    - <<: *if-merge-request
+      changes: *qa-patterns
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
+      changes: *code-patterns
+    - <<: *if-force-ci
+    # From .qa:rules:package-and-test-schedule
+    - <<: *if-dot-com-gitlab-org-schedule
+    # From .qa:rules:code-merge-request-manual
+    - <<: *if-merge-request
+      changes: *code-patterns
+
 .qa:rules:package-and-test-never-run:
   rules:
     - <<: *if-not-canonical-namespace
@@ -1512,18 +1545,62 @@
     # manually. That rule is now in ".qa:rules:code-merge-request-manual" so it can be included when needed and we can
     # still use ".qa:rules:package-and-test-common" in jobs we don't want to be manual.
 
+# Like .qa:rules:package-and-test-common but not allowed to fail.
+# It's named `e2e` instead of `package-and-test` because it's used for e2e tests on GDK (and could be used
+# for other e2e tests)
+.qa:rules:e2e-blocking:
+  rules:
+    - !reference [".qa:rules:package-and-test-never-run", rules]
+    - <<: *if-merge-request-targeting-stable-branch
+      changes: *setup-test-env-patterns
+    - <<: *if-ruby3_1-branch
+      variables:
+        USE_OLD_RUBY_VERSION: 'false'
+        CACHE_EDITION: 'GITLAB_RUBY3_1'
+    - <<: *if-merge-request
+      changes: *dependency-patterns
+    - <<: *if-merge-request-labels-run-all-e2e
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
+      changes: *feature-flag-development-config-patterns
+      when: manual
+    - <<: *if-merge-request
+      changes: *nodejs-patterns
+    - <<: *if-merge-request
+      changes:
+        - qa/Gemfile.lock  # qa/Gemfile.lock is a part of *qa-patterns, so this rule must be placed before the one with *qa-patterns changes
+      variables:
+        UPDATE_QA_CACHE: "true"
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
+      changes: *code-patterns
+    - <<: *if-merge-request
+      changes: *code-qa-patterns # Includes all CI changes
+    - <<: *if-force-ci
+      when: manual
+
+.qa:e2e-test-schedule-variables: &qa-e2e-test-schedule-variables
+  variables:
+    CREATE_TEST_FAILURE_ISSUES: "true"
+    PROCESS_TEST_RESULTS: "true"
+    KNAPSACK_GENERATE_REPORT: "true"
+    UPDATE_QA_CACHE: "true"
+    QA_SAVE_TEST_METRICS: "true"
+    QA_EXPORT_TEST_METRICS: "false"  # on main runs, metrics are exported to separate bucket via rake task for better consistency
+
 .qa:rules:package-and-test-schedule:
   rules:
     - <<: *if-dot-com-gitlab-org-schedule
       allow_failure: true
-      variables:
-        CREATE_TEST_FAILURE_ISSUES: "true"
-        PROCESS_TEST_RESULTS: "true"
-        KNAPSACK_GENERATE_REPORT: "true"
-        UPDATE_QA_CACHE: "true"
-        QA_SAVE_TEST_METRICS: "true"
-        QA_EXPORT_TEST_METRICS: "false"  # on main runs, metrics are exported to separate bucket via rake task for better consistency
+      <<: *qa-e2e-test-schedule-variables
+
+.qa:rules:e2e-schedule-blocking:
+  rules:
+    - <<: *if-dot-com-gitlab-org-schedule
+      <<: *qa-e2e-test-schedule-variables
 
+# Note: If any changes are made to this rule, the following should also be updated:
+# 1) .qa:rules:manual-omnibus-and-follow-up-e2e
+# 2) .qa:rules:follow-up-e2e
+# 3) .qa:rules:trigger-omnibus-env
 .qa:rules:package-and-test-ee:
   rules:
     - !reference [".qa:rules:package-and-test-common", rules]
@@ -1555,12 +1632,8 @@
       when: never
     - <<: *if-default-branch-schedule-nightly # already executed in the 2-hourly schedule
       when: never
-    - !reference [".qa:rules:package-and-test-common", rules]
-    - !reference [".qa:rules:package-and-test-schedule", rules]
-    # Run automatically in all other code MRs that weren't included in ".qa:rules:package-and-test-common".
-    - <<: *if-merge-request
-      changes: *code-patterns
-      allow_failure: true
+    - !reference [".qa:rules:e2e-blocking", rules]
+    - !reference [".qa:rules:e2e-schedule-blocking", rules]
 
 .qa:rules:package-and-test-old-nav:
   rules:
@@ -1598,6 +1671,94 @@
     - !reference [".qa:rules:package-and-test-nightly", rules]
     - !reference [".qa:rules:package-and-test-ce", rules]
 
+# These are based on `.qa:rules:trigger-omnibus` but with automatic jobs changed to `when: never.`
+# If any changes are made to this rule, `.qa:rules:follow-up-e2e` should also be updated.
+.qa:rules:manual-omnibus-and-follow-up-e2e:
+  rules:
+    - !reference [".qa:rules:package-and-test-never-run", rules]
+    - !reference [".qa:rules:code-merge-request-manual", rules]
+    - <<: *if-dot-com-gitlab-org-schedule
+      when: never
+    - <<: *if-merge-request-targeting-stable-branch
+      changes: *setup-test-env-patterns
+      when: never
+    - <<: *if-ruby3_1-branch
+      when: never
+    - <<: *if-merge-request
+      changes: *dependency-patterns
+      when: never
+    - <<: *if-merge-request-labels-run-all-e2e
+      when: never
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
+      changes: *feature-flag-development-config-patterns
+      when: manual
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *feature-flag-development-config-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *initializers-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *nodejs-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-qa-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *qa-patterns
+      when: never
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
+      changes: *code-patterns
+      when: never
+    - <<: *if-force-ci
+      when: manual
+      allow_failure: true
+
+# These are based on `.qa:rules:manual-omnibus-and-follow-up-e2e` but with manual jobs changed to automatic
+.qa:rules:follow-up-e2e:
+  rules:
+    - !reference [".qa:rules:package-and-test-never-run", rules]
+    - <<: *if-merge-request
+      changes: *code-patterns
+      allow_failure: true
+    - <<: *if-dot-com-gitlab-org-schedule
+      when: never
+    - <<: *if-merge-request-targeting-stable-branch
+      changes: *setup-test-env-patterns
+      when: never
+    - <<: *if-ruby3_1-branch
+      when: never
+    - <<: *if-merge-request
+      changes: *dependency-patterns
+      when: never
+    - <<: *if-merge-request-labels-run-all-e2e
+      when: never
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
+      changes: *feature-flag-development-config-patterns
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *feature-flag-development-config-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *initializers-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *nodejs-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-qa-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *qa-patterns
+      when: never
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-and-qa-tests-specified
+      changes: *code-patterns
+      when: never
+    - <<: *if-force-ci
+      allow_failure: true
+
+
 ###############
 # Rails rules #
 ###############
diff --git a/.gitlab/ci/setup.gitlab-ci.yml b/.gitlab/ci/setup.gitlab-ci.yml
index ddd479385fc..b652ac5e30b 100644
--- a/.gitlab/ci/setup.gitlab-ci.yml
+++ b/.gitlab/ci/setup.gitlab-ci.yml
@@ -176,7 +176,7 @@ e2e-test-pipeline-generate:
 trigger-omnibus-env:
   stage: prepare
   extends:
-    - .qa:rules:package-and-test-ee
+    - .qa:rules:trigger-omnibus-env
   needs:
     # We need this job because we need its `cached-assets-hash.txt` artifact, so that we can pass the assets image tag to the downstream omnibus-gitlab pipeline.
     - compile-production-assets
diff --git a/.gitlab/ci/test-on-gdk/main.gitlab-ci.yml b/.gitlab/ci/test-on-gdk/main.gitlab-ci.yml
index 367579b1999..a3e7900114b 100644
--- a/.gitlab/ci/test-on-gdk/main.gitlab-ci.yml
+++ b/.gitlab/ci/test-on-gdk/main.gitlab-ci.yml
@@ -86,7 +86,6 @@ variables:
       dotenv: suite_status.env
     expire_in: 7 days
     when: always
-  allow_failure: true
 
 download-knapsack-report:
   extends:
@@ -143,6 +142,7 @@ gdk-qa-smoke-with-load-balancer:
     - changes:
         - ".gitlab/ci/test-on-gdk/**"
         - "lib/gitlab/database/load_balancing/**/*"
+  allow_failure: true
 
 gdk-qa-reliable:
   extends:
@@ -153,6 +153,7 @@ gdk-qa-reliable:
     QA_RUN_TYPE: gdk-qa-blocking
   rules:
     - when: always
+  allow_failure: true
 
 gdk-qa-reliable-with-load-balancer:
   extends:
@@ -171,6 +172,7 @@ gdk-qa-reliable-with-load-balancer:
     - changes:
         - ".gitlab/ci/test-on-gdk/**"
         - "lib/gitlab/database/load_balancing/**/*"
+  allow_failure: true
 
 gdk-qa-non-blocking:
   extends:
@@ -181,6 +183,7 @@ gdk-qa-non-blocking:
     QA_RUN_TYPE: gdk-qa-non-blocking
   rules:
     - when: manual
+  allow_failure: true
 
 # ==========================================
 # Post test stage