Add latest changes from gitlab-org/gitlab@master

29 files changed, 836 insertions, 364 deletions

diff --git a/app/assets/javascripts/monitoring/components/dashboard.vue b/app/assets/javascripts/monitoring/components/dashboard.vue
index 5f410c487e9..391cd6dd15e 100644
--- a/app/assets/javascripts/monitoring/components/dashboard.vue
+++ b/app/assets/javascripts/monitoring/components/dashboard.vue
@@ -235,9 +235,6 @@ export default {
         this.externalDashboardUrl.length
       );
     },
-    shouldRenderSearchableEnvironmentsDropdown() {
-      return this.glFeatures.searchableEnvironmentsDropdown;
-    },
     shouldShowEnvironmentsDropdownNoMatchedMsg() {
       return !this.environmentsLoading && this.filteredEnvironments.length === 0;
     },
@@ -405,7 +402,6 @@ export default {
               }}</gl-dropdown-header>
               <gl-dropdown-divider />
               <gl-search-box-by-type
-                v-if="shouldRenderSearchableEnvironmentsDropdown"
                 ref="monitorEnvironmentsDropdownSearch"
                 class="m-2"
                 @input="debouncedEnvironmentsSearch"
@@ -426,7 +422,6 @@ export default {
                 >
               </div>
               <div
-                v-if="shouldRenderSearchableEnvironmentsDropdown"
                 v-show="shouldShowEnvironmentsDropdownNoMatchedMsg"
                 ref="monitorEnvironmentsDropdownMsg"
                 class="text-secondary no-matches-message"
diff --git a/app/assets/javascripts/monitoring/stores/getters.js b/app/assets/javascripts/monitoring/stores/getters.js
index ed1e3e3ffec..3801149e49d 100644
--- a/app/assets/javascripts/monitoring/stores/getters.js
+++ b/app/assets/javascripts/monitoring/stores/getters.js
@@ -62,8 +62,6 @@ export const metricsWithData = state => groupKey => {
  * Filter environments by names.
  *
  * This is used in the environments dropdown with searchable input.
- * Also, this searchable dropdown is behind `searchable_environments_dropdown`
- * feature flag
  *
  * @param {Object} state
  * @returns {Array} List of environments
diff --git a/app/controllers/projects/environments_controller.rb b/app/controllers/projects/environments_controller.rb
index b4b2bf01831..70c4b536854 100644
--- a/app/controllers/projects/environments_controller.rb
+++ b/app/controllers/projects/environments_controller.rb
@@ -14,7 +14,6 @@ class Projects::EnvironmentsController < Projects::ApplicationController
   before_action :expire_etag_cache, only: [:index], unless: -> { request.format.json? }
   before_action only: [:metrics, :additional_metrics, :metrics_dashboard] do
     push_frontend_feature_flag(:prometheus_computed_alerts)
-    push_frontend_feature_flag(:searchable_environments_dropdown)
   end
   before_action do
     push_frontend_feature_flag(:auto_stop_environments)
diff --git a/app/graphql/mutations/todos/restore_many.rb b/app/graphql/mutations/todos/restore_many.rb
new file mode 100644
index 00000000000..8a6265207cd
--- /dev/null
+++ b/app/graphql/mutations/todos/restore_many.rb
@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Mutations
+  module Todos
+    class RestoreMany < ::Mutations::Todos::Base
+      graphql_name 'TodoRestoreMany'
+
+      MAX_UPDATE_AMOUNT = 50
+
+      argument :ids,
+               [GraphQL::ID_TYPE],
+               required: true,
+               description: 'The global ids of the todos to restore (a maximum of 50 is supported at once)'
+
+      field :updated_ids, [GraphQL::ID_TYPE],
+            null: false,
+            description: 'The ids of the updated todo items'
+
+      def resolve(ids:)
+        check_update_amount_limit!(ids)
+
+        todos = authorized_find_all_pending_by_current_user(model_ids_of(ids))
+        updated_ids = restore(todos)
+
+        {
+            updated_ids: gids_of(updated_ids),
+            errors: errors_on_objects(todos)
+        }
+      end
+
+      private
+
+      def gids_of(ids)
+        ids.map { |id| ::URI::GID.build(app: GlobalID.app, model_name: Todo.name, model_id: id, params: nil).to_s }
+      end
+
+      def model_ids_of(ids)
+        ids.map do |gid|
+          parsed_gid = ::URI::GID.parse(gid)
+          parsed_gid.model_id.to_i if accessible_todo?(parsed_gid)
+        end.compact
+      end
+
+      def accessible_todo?(gid)
+        gid.app == GlobalID.app && todo?(gid)
+      end
+
+      def todo?(gid)
+        GlobalID.parse(gid)&.model_class&.ancestors&.include?(Todo)
+      end
+
+      def raise_too_many_todos_requested_error
+        raise Gitlab::Graphql::Errors::ArgumentError, 'Too many todos requested.'
+      end
+
+      def check_update_amount_limit!(ids)
+        raise_too_many_todos_requested_error if ids.size > MAX_UPDATE_AMOUNT
+      end
+
+      def errors_on_objects(todos)
+        todos.flat_map { |todo| errors_on_object(todo) }
+      end
+
+      def authorized_find_all_pending_by_current_user(ids)
+        return Todo.none if ids.blank? || current_user.nil?
+
+        Todo.for_ids(ids).for_user(current_user).done
+      end
+
+      def restore(todos)
+        TodoService.new.mark_todos_as_pending(todos, current_user)
+      end
+    end
+  end
+end
diff --git a/app/graphql/types/mutation_type.rb b/app/graphql/types/mutation_type.rb
index 0a9c0143945..fc0a2a099df 100644
--- a/app/graphql/types/mutation_type.rb
+++ b/app/graphql/types/mutation_type.rb
@@ -25,6 +25,7 @@ module Types
     mount_mutation Mutations::Todos::MarkDone
     mount_mutation Mutations::Todos::Restore
     mount_mutation Mutations::Todos::MarkAllDone
+    mount_mutation Mutations::Todos::RestoreMany
     mount_mutation Mutations::Snippets::Destroy
     mount_mutation Mutations::Snippets::Update
     mount_mutation Mutations::Snippets::Create
diff --git a/app/models/todo.rb b/app/models/todo.rb
index f217c942e8e..d337ef33051 100644
--- a/app/models/todo.rb
+++ b/app/models/todo.rb
@@ -51,10 +51,12 @@ class Todo < ApplicationRecord
   validates :project, presence: true, unless: :group_id
   validates :group, presence: true, unless: :project_id
 
+  scope :for_ids, -> (ids) { where(id: ids) }
   scope :pending, -> { with_state(:pending) }
   scope :done, -> { with_state(:done) }
   scope :for_action, -> (action) { where(action: action) }
   scope :for_author, -> (author) { where(author: author) }
+  scope :for_user, -> (user) { where(user: user) }
   scope :for_project, -> (projects) { where(project: projects) }
   scope :for_undeleted_projects, -> { joins(:project).merge(Project.without_deleted) }
   scope :for_group, -> (group) { where(group: group) }
diff --git a/changelogs/unreleased/31914-graphql-todo-bulk-restore-pd.yml b/changelogs/unreleased/31914-graphql-todo-bulk-restore-pd.yml
new file mode 100644
index 00000000000..8e5245a7bca
--- /dev/null
+++ b/changelogs/unreleased/31914-graphql-todo-bulk-restore-pd.yml
@@ -0,0 +1,5 @@
+---
+title: Add GraphQL mutation to restore multiple todos
+merge_request: 23950
+author:
+type: added
diff --git a/changelogs/unreleased/34021-environments-dropdown-remove-feature-flag.yml b/changelogs/unreleased/34021-environments-dropdown-remove-feature-flag.yml
new file mode 100644
index 00000000000..a451ef94537
--- /dev/null
+++ b/changelogs/unreleased/34021-environments-dropdown-remove-feature-flag.yml
@@ -0,0 +1,5 @@
+---
+title: Enable search and filter in environments dropdown in monitoring dashboard
+merge_request: 23942
+author:
+type: added
diff --git a/config/initializers/backtrace_silencers.rb b/config/initializers/backtrace_silencers.rb
index 58941aae1b0..f25bb7d25fa 100644
--- a/config/initializers/backtrace_silencers.rb
+++ b/config/initializers/backtrace_silencers.rb
@@ -1,2 +1,8 @@
 Rails.backtrace_cleaner.remove_silencers!
+
+# This allows us to see the proper caller of SQL calls in {development,test}.log
+if (Rails.env.development? || Rails.env.test?) && Gitlab.ee?
+  Rails.backtrace_cleaner.add_silencer { |line| line =~ %r(^ee/lib/gitlab/database/load_balancing) }
+end
+
 Rails.backtrace_cleaner.add_silencer { |line| line !~ Gitlab::APP_DIRS_PATTERN }
diff --git a/doc/api/graphql/reference/gitlab_schema.graphql b/doc/api/graphql/reference/gitlab_schema.graphql
index f0ad0b8184d..eb728233379 100644
--- a/doc/api/graphql/reference/gitlab_schema.graphql
+++ b/doc/api/graphql/reference/gitlab_schema.graphql
@@ -4540,6 +4540,7 @@ type Mutation {
   removeAwardEmoji(input: RemoveAwardEmojiInput!): RemoveAwardEmojiPayload
   todoMarkDone(input: TodoMarkDoneInput!): TodoMarkDonePayload
   todoRestore(input: TodoRestoreInput!): TodoRestorePayload
+  todoRestoreMany(input: TodoRestoreManyInput!): TodoRestoreManyPayload
   todosMarkAllDone(input: TodosMarkAllDoneInput!): TodosMarkAllDonePayload
   toggleAwardEmoji(input: ToggleAwardEmojiInput!): ToggleAwardEmojiPayload
   updateEpic(input: UpdateEpicInput!): UpdateEpicPayload
@@ -7078,6 +7079,41 @@ input TodoRestoreInput {
 }
 
 """
+Autogenerated input type of TodoRestoreMany
+"""
+input TodoRestoreManyInput {
+  """
+  A unique identifier for the client performing the mutation.
+  """
+  clientMutationId: String
+
+  """
+  The global ids of the todos to restore (a maximum of 50 is supported at once)
+  """
+  ids: [ID!]!
+}
+
+"""
+Autogenerated return type of TodoRestoreMany
+"""
+type TodoRestoreManyPayload {
+  """
+  A unique identifier for the client performing the mutation.
+  """
+  clientMutationId: String
+
+  """
+  Reasons why the mutation failed.
+  """
+  errors: [String!]!
+
+  """
+  The ids of the updated todo items
+  """
+  updatedIds: [ID!]!
+}
+
+"""
 Autogenerated return type of TodoRestore
 """
 type TodoRestorePayload {
diff --git a/doc/api/graphql/reference/gitlab_schema.json b/doc/api/graphql/reference/gitlab_schema.json
index 33958dde42c..d346c8a886f 100644
--- a/doc/api/graphql/reference/gitlab_schema.json
+++ b/doc/api/graphql/reference/gitlab_schema.json
@@ -19023,6 +19023,33 @@
               "deprecationReason": null
             },
             {
+              "name": "todoRestoreMany",
+              "description": null,
+              "args": [
+                {
+                  "name": "input",
+                  "description": null,
+                  "type": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "INPUT_OBJECT",
+                      "name": "TodoRestoreManyInput",
+                      "ofType": null
+                    }
+                  },
+                  "defaultValue": null
+                }
+              ],
+              "type": {
+                "kind": "OBJECT",
+                "name": "TodoRestoreManyPayload",
+                "ofType": null
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
               "name": "todosMarkAllDone",
               "description": null,
               "args": [
@@ -21908,6 +21935,128 @@
         },
         {
           "kind": "OBJECT",
+          "name": "TodoRestoreManyPayload",
+          "description": "Autogenerated return type of TodoRestoreMany",
+          "fields": [
+            {
+              "name": "clientMutationId",
+              "description": "A unique identifier for the client performing the mutation.",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "SCALAR",
+                "name": "String",
+                "ofType": null
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "errors",
+              "description": "Reasons why the mutation failed.",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "LIST",
+                  "name": null,
+                  "ofType": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "SCALAR",
+                      "name": "String",
+                      "ofType": null
+                    }
+                  }
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "updatedIds",
+              "description": "The ids of the updated todo items",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "LIST",
+                  "name": null,
+                  "ofType": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "SCALAR",
+                      "name": "ID",
+                      "ofType": null
+                    }
+                  }
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            }
+          ],
+          "inputFields": null,
+          "interfaces": [
+
+          ],
+          "enumValues": null,
+          "possibleTypes": null
+        },
+        {
+          "kind": "INPUT_OBJECT",
+          "name": "TodoRestoreManyInput",
+          "description": "Autogenerated input type of TodoRestoreMany",
+          "fields": null,
+          "inputFields": [
+            {
+              "name": "ids",
+              "description": "The global ids of the todos to restore (a maximum of 50 is supported at once)",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "LIST",
+                  "name": null,
+                  "ofType": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "SCALAR",
+                      "name": "ID",
+                      "ofType": null
+                    }
+                  }
+                }
+              },
+              "defaultValue": null
+            },
+            {
+              "name": "clientMutationId",
+              "description": "A unique identifier for the client performing the mutation.",
+              "type": {
+                "kind": "SCALAR",
+                "name": "String",
+                "ofType": null
+              },
+              "defaultValue": null
+            }
+          ],
+          "interfaces": null,
+          "enumValues": null,
+          "possibleTypes": null
+        },
+        {
+          "kind": "OBJECT",
           "name": "DestroySnippetPayload",
           "description": "Autogenerated return type of DestroySnippet",
           "fields": [
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 11e48d69165..7360ce0978a 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -1152,6 +1152,16 @@ Autogenerated return type of TodoMarkDone
 | `errors` | String! => Array | Reasons why the mutation failed. |
 | `todo` | Todo! | The requested todo |
 
+## TodoRestoreManyPayload
+
+Autogenerated return type of TodoRestoreMany
+
+| Name  | Type  | Description |
+| ---   |  ---- | ----------  |
+| `clientMutationId` | String | A unique identifier for the client performing the mutation. |
+| `errors` | String! => Array | Reasons why the mutation failed. |
+| `updatedIds` | ID! => Array | The ids of the updated todo items |
+
 ## TodoRestorePayload
 
 Autogenerated return type of TodoRestore
diff --git a/doc/ci/docker/using_docker_build.md b/doc/ci/docker/using_docker_build.md
index 2750e61ff96..1635a3ffa36 100644
--- a/doc/ci/docker/using_docker_build.md
+++ b/doc/ci/docker/using_docker_build.md
@@ -108,7 +108,7 @@ By enabling `--docker-privileged`, you are effectively disabling all of
 the security mechanisms of containers and exposing your host to privilege
 escalation which can lead to container breakout. For more information, check
 out the official Docker documentation on
-[Runtime privilege and Linux capabilities][docker-cap].
+[Runtime privilege and Linux capabilities](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities).
 
 Docker-in-Docker works well, and is the recommended configuration, but it is
 not without its own challenges:
@@ -409,7 +409,7 @@ any image that's used with the `--cache-from` argument must first be pulled
 
 ### Using Docker caching
 
-Here's a simple `.gitlab-ci.yml` file showing how Docker caching can be utilized:
+Here's a `.gitlab-ci.yml` file showing how Docker caching can be used:
 
 ```yaml
 image: docker:19.03.1
@@ -503,229 +503,8 @@ If you're running multiple Runners you will have to modify all configuration fil
 
 ## Using the GitLab Container Registry
 
-> **Notes:**
->
-> - This feature requires GitLab 8.8 and GitLab Runner 1.2.
-> - Starting from GitLab 8.12, if you have [2FA] enabled in your account, you need
->   to pass a [personal access token][pat] instead of your password in order to
->   login to GitLab's Container Registry.
-
 Once you've built a Docker image, you can push it up to the built-in
-[GitLab Container Registry](../../user/packages/container_registry/index.md).
-Some things you should be aware of:
-
-- You must [log in to the container registry](#authenticating-to-the-container-registry)
-  before running commands. You can do this in the `before_script` if multiple
-  jobs depend on it.
-- Using `docker build --pull` fetches any changes to base
-  images before building just in case your cache is stale. It takes slightly
-  longer, but means you don’t get stuck without security patches to base images.
-- Doing an explicit `docker pull` before each `docker run` fetches
-  the latest image that was just built. This is especially important if you are
-  using multiple runners that cache images locally. Using the Git SHA in your
-  image tag makes this less necessary since each job will be unique and you
-  shouldn't ever have a stale image. However, it's still possible to have a
-  stale image if you re-build a given commit after a dependency has changed.
-- You don't want to build directly to `latest` tag in case there are multiple jobs
-  happening simultaneously.
-
-### Authenticating to the Container Registry
-
-There are three ways to authenticate to the Container Registry via GitLab CI/CD
-and depend on the visibility of your project.
-
-For all projects, mostly suitable for public ones:
-
-- **Using the special `$CI_REGISTRY_USER` variable**: The user specified by this variable is created for you in order to
-  push to the Registry connected to your project. Its password is automatically
-  set with the `$CI_REGISTRY_PASSWORD` variable. This allows you to automate building and deploying
-  your Docker images and has read/write access to the Registry. This is ephemeral,
-  so it's only valid for one job. You can use the following example as-is:
-
-  ```shell
-  docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
-  ```
-
-For private and internal projects:
-
-- **Using a personal access token**: You can create and use a
-  [personal access token](../../user/profile/personal_access_tokens.md)
-  in case your project is private:
-
-  - For read (pull) access, the scope should be `read_registry`.
-  - For read/write (pull/push) access, use `api`.
-
-  Replace the `<username>` and `<access_token>` in the following example:
-
-  ```shell
-  docker login -u <username> -p <access_token> $CI_REGISTRY
-  ```
-
-- **Using the GitLab Deploy Token**: You can create and use a
-  [special deploy token](../../user/project/deploy_tokens/index.md#gitlab-deploy-token)
-  with your private projects. It provides read-only (pull) access to the Registry.
-  Once created, you can use the special environment variables, and GitLab CI/CD
-  will fill them in for you. You can use the following example as-is:
-
-  ```shell
-  docker login -u $CI_DEPLOY_USER -p $CI_DEPLOY_PASSWORD $CI_REGISTRY
-  ```
-
-### Using docker-in-docker image from Container Registry
-
-If you want to use your own Docker images for docker-in-docker there are a few things you need to do in addition to the steps in the [docker-in-docker](#use-docker-in-docker-workflow-with-docker-executor) section:
-
-1. Update the `image` and `service` to point to your registry.
-1. Add a service [alias](../yaml/README.md#servicesalias).
-
-Below is an example of what your `.gitlab-ci.yml` should look like,
-assuming you have it configured with [TLS enabled](#tls-enabled):
-
-```yaml
- build:
-   image: $CI_REGISTRY/group/project/docker:19.03.1
-   services:
-     - name: $CI_REGISTRY/group/project/docker:19.03.1-dind
-       alias: docker
-   variables:
-     # Specify to Docker where to create the certificates, Docker will
-     # create them automatically on boot, and will create
-     # `/certs/client` that will be shared between the service and
-     # build container.
-     DOCKER_TLS_CERTDIR: "/certs"
-   stage: build
-   script:
-     - docker build -t my-docker-image .
-     - docker run my-docker-image /script/to/run/tests
-```
-
-If you forget to set the service alias, the `docker:19.03.1` image won't find the
-`dind` service, and an error like the following is thrown:
-
-```shell
-$ docker info
-error during connect: Get http://docker:2376/v1.39/info: dial tcp: lookup docker on 192.168.0.1:53: no such host
-```
-
-### Container Registry examples
-
-If you're using docker-in-docker on your Runners, this is how your `.gitlab-ci.yml`
-could look like:
-
-```yaml
-build:
-  image: docker:19.03.1
-  stage: build
-  services:
-    - docker:19.03.1-dind
-  variables:
-    # Use TLS https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#tls-enabled
-    DOCKER_HOST: tcp://docker:2376
-    DOCKER_TLS_CERTDIR: "/certs"
-  script:
-    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
-    - docker build -t $CI_REGISTRY/group/project/image:latest .
-    - docker push $CI_REGISTRY/group/project/image:latest
-```
-
-You can also make use of [other variables](../variables/README.md) to avoid hardcoding:
-
-```yaml
-build:
-  image: docker:19.03.1
-  stage: build
-  services:
-    - docker:19.03.1-dind
-  variables:
-    # Use TLS https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#tls-enabled
-    DOCKER_HOST: tcp://docker:2376
-    DOCKER_TLS_CERTDIR: "/certs"
-    IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
-  script:
-    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
-    - docker build -t $IMAGE_TAG .
-    - docker push $IMAGE_TAG
-```
-
-Here, `$CI_REGISTRY_IMAGE` would be resolved to the address of the registry tied
-to this project. Since `$CI_COMMIT_REF_NAME` resolves to the branch or tag name,
-and your branch-name can contain forward slashes (e.g., feature/my-feature), it is
-safer to use `$CI_COMMIT_REF_SLUG` as the image tag. This is due to that image tags
-cannot contain forward slashes. We also declare our own variable, `$IMAGE_TAG`,
-combining the two to save us some typing in the `script` section.
-
-Here's a more elaborate example that splits up the tasks into 4 pipeline stages,
-including two tests that run in parallel. The `build` is stored in the container
-registry and used by subsequent stages, downloading the image
-when needed. Changes to `master` also get tagged as `latest` and deployed using
-an application-specific deploy script:
-
-```yaml
-image: docker:19.03.1
-services:
-  - docker:19.03.1-dind
-
-stages:
-  - build
-  - test
-  - release
-  - deploy
-
-variables:
-  # Use TLS https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#tls-enabled
-  DOCKER_HOST: tcp://docker:2376
-  DOCKER_TLS_CERTDIR: "/certs"
-  CONTAINER_TEST_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
-  CONTAINER_RELEASE_IMAGE: $CI_REGISTRY_IMAGE:latest
-
-before_script:
-  - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
-
-build:
-  stage: build
-  script:
-    - docker build --pull -t $CONTAINER_TEST_IMAGE .
-    - docker push $CONTAINER_TEST_IMAGE
-
-test1:
-  stage: test
-  script:
-    - docker pull $CONTAINER_TEST_IMAGE
-    - docker run $CONTAINER_TEST_IMAGE /script/to/run/tests
-
-test2:
-  stage: test
-  script:
-    - docker pull $CONTAINER_TEST_IMAGE
-    - docker run $CONTAINER_TEST_IMAGE /script/to/run/another/test
-
-release-image:
-  stage: release
-  script:
-    - docker pull $CONTAINER_TEST_IMAGE
-    - docker tag $CONTAINER_TEST_IMAGE $CONTAINER_RELEASE_IMAGE
-    - docker push $CONTAINER_RELEASE_IMAGE
-  only:
-    - master
-
-deploy:
-  stage: deploy
-  script:
-    - ./deploy.sh
-  only:
-    - master
-```
-
-NOTE: **Note:**
-This example explicitly calls `docker pull`. If you prefer to implicitly pull the
-built image using `image:`, and use either the [Docker](https://docs.gitlab.com/runner/executors/docker.html)
-or [Kubernetes](https://docs.gitlab.com/runner/executors/kubernetes.html) executor,
-make sure that [`pull_policy`](https://docs.gitlab.com/runner/executors/docker.html#how-pull-policies-work)
-is set to `always`.
-
-[docker-cap]: https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities
-[2fa]: ../../user/profile/account/two_factor_authentication.md
-[pat]: ../../user/profile/personal_access_tokens.md
+[GitLab Container Registry](../../user/packages/container_registry/index.md#build-and-push-images-using-gitlab-cicd).
 
 ## Troubleshooting
 
diff --git a/doc/development/architecture.md b/doc/development/architecture.md
index cd41eb28e4d..0cf311a645e 100644
--- a/doc/development/architecture.md
+++ b/doc/development/architecture.md
@@ -131,7 +131,7 @@ Component statuses are linked to configuration documentation for each component.
 | [GitLab Workhorse](#gitlab-workhorse) | Smart reverse proxy, handles large HTTP requests | [✅][workhorse-omnibus] | [✅][workhorse-charts] | [✅][workhorse-charts] | [✅](https://about.gitlab.com/handbook/engineering/infrastructure/production-architecture/#service-architecture) | [⚙][workhorse-source] | ✅ | CE & EE |
 | [GitLab Shell](#gitlab-shell) | Handles `git` over SSH sessions | [✅][shell-omnibus] | [✅][shell-charts] | [✅][shell-charts] | [✅](https://about.gitlab.com/handbook/engineering/infrastructure/production-architecture/#service-architecture) | [⚙][shell-source] | [✅][gitlab-yml] | CE & EE |
 | [GitLab Pages](#gitlab-pages) | Hosts static websites | [⚙][pages-omnibus] | [❌][pages-charts] | [❌][pages-charts] | [✅](../user/gitlab_com/index.md#gitlab-pages) | [⚙][pages-source] | [⚙][pages-gdk] | CE & EE  |
-| [Registry](#registry) | Container registry, allows pushing and pulling of images | [⚙][registry-omnibus] | [✅][registry-charts] | [✅][registry-charts] | [✅](../user/packages/container_registry/index.md#build-and-push-images) | [⤓][registry-source] | [⚙][registry-gdk] | CE & EE  |
+| [Registry](#registry) | Container registry, allows pushing and pulling of images | [⚙][registry-omnibus] | [✅][registry-charts] | [✅][registry-charts] | [✅](../user/packages/container_registry/index.md#build-and-push-images-using-gitlab-cicd) | [⤓][registry-source] | [⚙][registry-gdk] | CE & EE  |
 | [Redis](#redis) | Caching service | [✅][redis-omnibus] | [✅][redis-omnibus] | [✅][redis-charts] | [✅](https://about.gitlab.com/handbook/engineering/infrastructure/production-architecture/#service-architecture) | [⤓][redis-source] | ✅ | CE & EE |
 | [PostgreSQL](#postgresql) | Database | [✅][postgres-omnibus] | [✅][postgres-charts] | [✅][postgres-charts] | [✅](../user/gitlab_com/index.md#postgresql) | [⤓][postgres-source] | ✅ | CE & EE |
 | [PgBouncer](#pgbouncer) | Database connection pooling, failover | [⚙][pgbouncer-omnibus] | [❌][pgbouncer-charts] | [❌][pgbouncer-charts] | [✅](https://about.gitlab.com/handbook/engineering/infrastructure/production-architecture/#database-architecture) | ❌ | ❌ | EE Only |
diff --git a/doc/user/application_security/container_scanning/index.md b/doc/user/application_security/container_scanning/index.md
index de8854bda0a..25a6c21ac39 100644
--- a/doc/user/application_security/container_scanning/index.md
+++ b/doc/user/application_security/container_scanning/index.md
@@ -46,17 +46,31 @@ To enable Container Scanning in your pipeline, you need:
 - Docker `18.09.03` or higher installed on the machine where the Runners are
   running. If you're using the shared Runners on GitLab.com, this is already
   the case.
-- To [build and push](../../../ci/docker/using_docker_build.md#container-registry-examples)
-  your Docker image to your project's [Container Registry](../../packages/container_registry/index.md).
-  The name of the Docker image should match the following scheme:
+- To [build and push](../../packages/container_registry/index.md#container-registry-examples-with-gitlab-cicd)
+  your Docker image to your project's Container Registry.
+  The name of the Docker image should use the following
+  [predefined environment variables](../../../ci/variables/predefined_variables.md)
+  as defined below:
 
   ```text
   $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA
   ```
 
-  The variables above can be found in the
-  [predefined environment variables](../../../ci/variables/predefined_variables.md)
-  document.
+  These can be used directly in your `.gitlab-ci.yml` file:
+
+  ```yaml
+  build:
+    image: docker:19.03.1
+    stage: build
+    services:
+      - docker:19.03.1-dind
+    variables:
+      IMAGE_TAG: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_REF_SHA
+    script:
+      - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+      - docker build -t $IMAGE_TAG .
+      - docker push $IMAGE_TAG
+  ```
 
 ## Configuration
 
diff --git a/doc/user/packages/container_registry/index.md b/doc/user/packages/container_registry/index.md
index c9e60d1497f..0238121f977 100644
--- a/doc/user/packages/container_registry/index.md
+++ b/doc/user/packages/container_registry/index.md
@@ -43,15 +43,27 @@ project:
 1. Press **Save changes** for the changes to take effect. You should now be able
    to see the **Packages > Container Registry**  link in the sidebar.
 
-## Build and push images
+## Control Container Registry from within GitLab
+
+GitLab offers a simple Container Registry management panel. Go to your project
+and click **Packages > Container Registry** in the project menu.
+
+This view will show you all Docker images in your project and will easily allow you to
+delete them.
+
+## Use images from GitLab Container Registry
+
+To download and run a container from images hosted in GitLab Container Registry,
+use `docker run`:
+
+```shell
+docker run [options] registry.example.com/group/project/image [arguments]
+```
+
+For more information on running Docker containers, visit the
+[Docker documentation](https://docs.docker.com/engine/userguide/intro/).
 
-> **Notes:**
->
-> - Moving or renaming existing container registry repositories is not supported
->   once you have pushed images because the images are signed, and the
->   signature includes the repository name.
-> - To move or rename a repository with a container registry you will have to
->   delete all existing images.
+## Authenticating to the GitLab Container Registry
 
 If you visit the **Packages > Container Registry** link under your project's
 menu, you can see the explicit instructions to login to the Container Registry
@@ -64,6 +76,28 @@ able to login with:
 docker login registry.example.com
 ```
 
+NOTE: **Note:**
+If you have [2 Factor Authentication](../../profile/account/two_factor_authentication.md)
+enabled in your account, you need to pass a
+[personal access token](../../profile/personal_access_tokens.md) instead
+of your password in order to login to GitLab's Container Registry.
+
+If a project is private, credentials will need to be provided for authorization.
+There are two ways to do this:
+
+- By using a [personal access token](../../profile/personal_access_tokens.md).
+- By using a [deploy token](../../project/deploy_tokens/index.md).
+
+The minimum scope needed for both of them is `read_registry`.
+
+Example of using a token:
+
+```sh
+docker login registry.example.com -u <username> -p <token>
+```
+
+## Build and push images from your local machine
+
 Building and publishing images should be a straightforward process. Just make
 sure that you are using the Registry URL with the namespace and project name
 that is hosted on GitLab:
@@ -80,8 +114,7 @@ Your image will be named after the following scheme:
 ```
 
 GitLab supports up to three levels of image repository names.
-
-Following examples of image tags are valid:
+The following examples of image tags are valid:
 
 ```text
 registry.example.com/group/project:some-tag
@@ -89,53 +122,211 @@ registry.example.com/group/project/image:latest
 registry.example.com/group/project/my/image:rc1
 ```
 
-## Use images from GitLab Container Registry
-
-To download and run a container from images hosted in GitLab Container Registry,
-use `docker run`:
-
-```shell
-docker run [options] registry.example.com/group/project/image [arguments]
-```
-
-For more information on running Docker containers, visit the
-[Docker documentation](https://docs.docker.com/engine/userguide/intro/).
+## Build and push images using GitLab CI/CD
+
+While you can build and push your images from your local machine, the true
+power of the Container Registry comes when you combine it with GitLab CI/CD.
+You can then create workflows and automate any processes that involve testing,
+building, and eventually deploying your project from the Docker image you
+created.
+
+Before diving into the details, some things you should be aware of:
+
+- You must [authenticate to the container registry](#authenticating-to-the-container-registry-with-gitlab-cicd)
+  before running any commands. You can do this in the `before_script` if multiple
+  jobs depend on it.
+- Using `docker build --pull` fetches any changes to base
+  images before building in case your cache is stale. It takes slightly
+  longer, but it means you don’t get stuck without security patches for base images.
+- Doing an explicit `docker pull` before each `docker run` fetches
+  the latest image that was just built. This is especially important if you are
+  using multiple Runners that cache images locally. Using the Git SHA in your
+  image tag makes this less necessary since each job will be unique and you
+  shouldn't ever have a stale image. However, it's still possible to have a
+  stale image if you re-build a given commit after a dependency has changed.
+- You don't want to build directly to `latest` tag in case there are multiple jobs
+  happening simultaneously.
+
+### Authenticating to the Container Registry with GitLab CI/CD
+
+There are three ways to authenticate to the Container Registry via
+[GitLab CI/CD](../../../ci/yaml/README.md) which depend on the visibility of
+your project.
+
+Available for all projects, though more suitable for public ones:
+
+- **Using the special `CI_REGISTRY_USER` variable**: The user specified by this variable is created for you in order to
+  push to the Registry connected to your project. Its password is automatically
+  set with the `CI_REGISTRY_PASSWORD` variable. This allows you to automate building and deploying
+  your Docker images and has read/write access to the Registry. This is ephemeral,
+  so it's only valid for one job. You can use the following example as-is:
+
+  ```sh
+  docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+  ```
 
-## Control Container Registry from within GitLab
+For private and internal projects:
 
-GitLab offers a simple Container Registry management panel. Go to your project
-and click **Packages > Container Registry** in the project menu.
+- **Using a personal access token**: You can create and use a
+  [personal access token](../../profile/personal_access_tokens.md)
+  in case your project is private:
 
-This view will show you all tags in your project and will easily allow you to
-delete them.
+  - For read (pull) access, the scope should be `read_registry`.
+  - For read/write (pull/push) access, use `api`.
 
-## Build and push images using GitLab CI
+  Replace the `<username>` and `<access_token>` in the following example:
 
-NOTE: **Note:**
-This feature requires GitLab 8.8 and GitLab Runner 1.2.
+  ```sh
+  docker login -u <username> -p <access_token> $CI_REGISTRY
+  ```
 
-Make sure that your GitLab Runner is configured to allow building Docker images by
-following the [Using Docker Build](../../../ci/docker/using_docker_build.md)
-and [Using the GitLab Container Registry documentation](../../../ci/docker/using_docker_build.md#using-the-gitlab-container-registry).
-Alternatively, you can [build images with Kaniko](../../../ci/docker/using_kaniko.md) if the Docker builds are not an option for you.
+- **Using the GitLab Deploy Token**: You can create and use a
+  [special deploy token](../../project/deploy_tokens/index.md#gitlab-deploy-token)
+  with your private projects. It provides read-only (pull) access to the Registry.
+  Once created, you can use the special environment variables, and GitLab CI/CD
+  will fill them in for you. You can use the following example as-is:
 
-## Using with private projects
+  ```sh
+  docker login -u $CI_DEPLOY_USER -p $CI_DEPLOY_PASSWORD $CI_REGISTRY
+  ```
 
-> Personal Access tokens were [introduced](https://gitlab.com/gitlab-org/gitlab-foss/merge_requests/11845) in GitLab 9.3.
-> Project Deploy Tokens were [introduced](https://gitlab.com/gitlab-org/gitlab-foss/merge_requests/17894) in GitLab 10.7
+### Container Registry examples with GitLab CI/CD
+
+If you're using docker-in-docker on your Runners, this is how your `.gitlab-ci.yml`
+should look similar to this:
+
+```yaml
+build:
+  image: docker:19.03.1
+  stage: build
+  services:
+    - docker:19.03.1-dind
+  script:
+    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+    - docker build -t $CI_REGISTRY/group/project/image:latest .
+    - docker push $CI_REGISTRY/group/project/image:latest
+```
 
-If a project is private, credentials will need to be provided for authorization.
-There are two ways to do this:
+You can also make use of [other variables](../../../ci/variables/README.md) to avoid hardcoding:
+
+```yaml
+build:
+  image: docker:19.03.1
+  stage: build
+  services:
+    - docker:19.03.1-dind
+  variables:
+    IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
+  script:
+    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+    - docker build -t $IMAGE_TAG .
+    - docker push $IMAGE_TAG
+```
 
-- By using a [personal access token](../../profile/personal_access_tokens.md).
-- By using a [deploy token](../../project/deploy_tokens/index.md).
+Here, `$CI_REGISTRY_IMAGE` would be resolved to the address of the registry tied
+to this project. Since `$CI_COMMIT_REF_NAME` resolves to the branch or tag name,
+and your branch-name can contain forward slashes (e.g., feature/my-feature), it is
+safer to use `$CI_COMMIT_REF_SLUG` as the image tag. This is due to that image tags
+cannot contain forward slashes. We also declare our own variable, `$IMAGE_TAG`,
+combining the two to save us some typing in the `script` section.
+
+Here's a more elaborate example that splits up the tasks into 4 pipeline stages,
+including two tests that run in parallel. The `build` is stored in the container
+registry and used by subsequent stages, downloading the image
+when needed. Changes to `master` also get tagged as `latest` and deployed using
+an application-specific deploy script:
+
+```yaml
+image: docker:19.03.1
+services:
+  - docker:19.03.1-dind
+
+stages:
+  - build
+  - test
+  - release
+  - deploy
+
+variables:
+  # Use TLS https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#tls-enabled
+  DOCKER_HOST: tcp://docker:2376
+  DOCKER_TLS_CERTDIR: "/certs"
+  CONTAINER_TEST_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
+  CONTAINER_RELEASE_IMAGE: $CI_REGISTRY_IMAGE:latest
+
+before_script:
+  - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+
+build:
+  stage: build
+  script:
+    - docker build --pull -t $CONTAINER_TEST_IMAGE .
+    - docker push $CONTAINER_TEST_IMAGE
+
+test1:
+  stage: test
+  script:
+    - docker pull $CONTAINER_TEST_IMAGE
+    - docker run $CONTAINER_TEST_IMAGE /script/to/run/tests
+
+test2:
+  stage: test
+  script:
+    - docker pull $CONTAINER_TEST_IMAGE
+    - docker run $CONTAINER_TEST_IMAGE /script/to/run/another/test
+
+release-image:
+  stage: release
+  script:
+    - docker pull $CONTAINER_TEST_IMAGE
+    - docker tag $CONTAINER_TEST_IMAGE $CONTAINER_RELEASE_IMAGE
+    - docker push $CONTAINER_RELEASE_IMAGE
+  only:
+    - master
+
+deploy:
+  stage: deploy
+  script:
+    - ./deploy.sh
+  only:
+    - master
+```
 
-The minimal scope needed for both of them is `read_registry`.
+NOTE: **Note:**
+This example explicitly calls `docker pull`. If you prefer to implicitly pull the
+built image using `image:`, and use either the [Docker](https://docs.gitlab.com/runner/executors/docker.html)
+or [Kubernetes](https://docs.gitlab.com/runner/executors/kubernetes.html) executor,
+make sure that [`pull_policy`](https://docs.gitlab.com/runner/executors/docker.html#how-pull-policies-work)
+is set to `always`.
+
+### Using a docker-in-docker image from your Container Registry
+
+If you want to use your own Docker images for docker-in-docker, there are a few
+things you need to do in addition to the steps in the
+[docker-in-docker](../../../ci/docker/using_docker_build.md#use-docker-in-docker-workflow-with-docker-executor) section:
+
+1. Update the `image` and `service` to point to your registry.
+1. Add a service [alias](../../../ci/yaml/README.md#servicesalias).
+
+Below is an example of what your `.gitlab-ci.yml` should look like:
+
+```yaml
+ build:
+   image: $CI_REGISTRY/group/project/docker:19.03.1
+   services:
+     - name: $CI_REGISTRY/group/project/docker:19.03.1-dind
+       alias: docker
+   stage: build
+   script:
+     - docker build -t my-docker-image .
+     - docker run my-docker-image /script/to/run/tests
+```
 
-Example of using a token:
+If you forget to set the service alias, the `docker:19.03.1` image won't find the
+`dind` service, and an error like the following will be thrown:
 
-```shell
-docker login registry.example.com -u <username> -p <token>
+```plaintext
+error during connect: Get http://docker:2376/v1.39/info: dial tcp: lookup docker on 192.168.0.1:53: no such host
 ```
 
 ## Expiration policy
@@ -179,6 +370,13 @@ The UI allows you to configure the following:
 - **Expiration latest:** how many tags to _always_ keep for each image.
 - **Docker tags with names matching this regex pattern will expire:** the regex used to determine what tags should be expired. To qualify all tags for expiration, use the default value of `.*`.
 
+## Limitations
+
+Moving or renaming existing Container Registry repositories is not supported
+once you have pushed images, because the images are signed, and the
+signature includes the repository name. To move or rename a repository with a
+Container Registry, you will have to delete all existing images.
+
 ## Troubleshooting the GitLab Container Registry
 
 ### Docker connection error
diff --git a/lib/gitlab/diff/highlight_cache.rb b/lib/gitlab/diff/highlight_cache.rb
index a3d88664bac..0a8fbb9a673 100644
--- a/lib/gitlab/diff/highlight_cache.rb
+++ b/lib/gitlab/diff/highlight_cache.rb
@@ -3,6 +3,7 @@
 module Gitlab
   module Diff
     class HighlightCache
+      include Gitlab::Metrics::Methods
       include Gitlab::Utils::StrongMemoize
 
       EXPIRATION = 1.week
@@ -11,6 +12,11 @@ module Gitlab
       delegate :diffable,     to: :@diff_collection
       delegate :diff_options, to: :@diff_collection
 
+      define_histogram :gitlab_redis_diff_caching_memory_usage_bytes do
+        docstring 'Redis diff caching memory usage by key'
+        buckets [100, 1000, 10000, 100000, 1000000, 10000000]
+      end
+
       def initialize(diff_collection)
         @diff_collection = diff_collection
       end
diff --git a/lib/gitlab/graphql/connections/keyset/conditions/base_condition.rb b/lib/gitlab/graphql/connections/keyset/conditions/base_condition.rb
index 22728cc0b65..8c0d71aff6d 100644
--- a/lib/gitlab/graphql/connections/keyset/conditions/base_condition.rb
+++ b/lib/gitlab/graphql/connections/keyset/conditions/base_condition.rb
@@ -6,8 +6,10 @@ module Gitlab
       module Keyset
         module Conditions
           class BaseCondition
-            def initialize(arel_table, names, values, operator, before_or_after)
-              @arel_table, @names, @values, @operator, @before_or_after = arel_table, names, values, operator, before_or_after
+            def initialize(arel_table, order_list, values, operators, before_or_after)
+              @arel_table, @order_list, @values, @operators, @before_or_after = arel_table, order_list, values, operators, before_or_after
+
+              @before_or_after = :after unless [:after, :before].include?(@before_or_after)
             end
 
             def build
@@ -16,7 +18,7 @@ module Gitlab
 
             private
 
-            attr_reader :arel_table, :names, :values, :operator, :before_or_after
+            attr_reader :arel_table, :order_list, :values, :operators, :before_or_after
 
             def table_condition(attribute, value, operator)
               case operator
diff --git a/lib/gitlab/graphql/connections/keyset/conditions/not_null_condition.rb b/lib/gitlab/graphql/connections/keyset/conditions/not_null_condition.rb
index 3b56ddb996d..3239d27c0cd 100644
--- a/lib/gitlab/graphql/connections/keyset/conditions/not_null_condition.rb
+++ b/lib/gitlab/graphql/connections/keyset/conditions/not_null_condition.rb
@@ -12,7 +12,7 @@ module Gitlab
               # If there is only one order field, we can assume it
               # does not contain NULLs, and don't need additional
               # conditions
-              unless names.count == 1
+              unless order_list.count == 1
                 conditions << [second_attribute_condition, final_condition]
               end
 
@@ -24,7 +24,7 @@ module Gitlab
             # ex: "(relative_position > 23)"
             def first_attribute_condition
               <<~SQL
-                (#{table_condition(names.first, values.first, operator.first).to_sql})
+                (#{table_condition(order_list.first, values.first, operators.first).to_sql})
               SQL
             end
 
@@ -32,9 +32,9 @@ module Gitlab
             def second_attribute_condition
               condition = <<~SQL
                 OR (
-                  #{table_condition(names.first, values.first, '=').to_sql}
+                  #{table_condition(order_list.first, values.first, '=').to_sql}
                   AND
-                  #{table_condition(names[1], values[1], operator[1]).to_sql}
+                  #{table_condition(order_list[1], values[1], operators[1]).to_sql}
                 )
               SQL
 
@@ -45,7 +45,7 @@ module Gitlab
             def final_condition
               if before_or_after == :after
                 <<~SQL
-                  OR (#{table_condition(names.first, nil, 'is_null').to_sql})
+                  OR (#{table_condition(order_list.first, nil, 'is_null').to_sql})
                 SQL
               end
             end
diff --git a/lib/gitlab/graphql/connections/keyset/conditions/null_condition.rb b/lib/gitlab/graphql/connections/keyset/conditions/null_condition.rb
index 71a74936d5d..18ea0692e2c 100644
--- a/lib/gitlab/graphql/connections/keyset/conditions/null_condition.rb
+++ b/lib/gitlab/graphql/connections/keyset/conditions/null_condition.rb
@@ -16,9 +16,9 @@ module Gitlab
             def first_attribute_condition
               condition = <<~SQL
                 (
-                  #{table_condition(names.first, nil, 'is_null').to_sql}
+                  #{table_condition(order_list.first, nil, 'is_null').to_sql}
                   AND
-                  #{table_condition(names[1], values[1], operator[1]).to_sql}
+                  #{table_condition(order_list[1], values[1], operators[1]).to_sql}
                 )
               SQL
 
@@ -29,7 +29,7 @@ module Gitlab
             def final_condition
               if before_or_after == :before
                 <<~SQL
-                  OR (#{table_condition(names.first, nil, 'is_not_null').to_sql})
+                  OR (#{table_condition(order_list.first, nil, 'is_not_null').to_sql})
                 SQL
               end
             end
diff --git a/lib/gitlab/graphql/connections/keyset/order_info.rb b/lib/gitlab/graphql/connections/keyset/order_info.rb
index 4d85e8f79b7..e112154cfbc 100644
--- a/lib/gitlab/graphql/connections/keyset/order_info.rb
+++ b/lib/gitlab/graphql/connections/keyset/order_info.rb
@@ -8,12 +8,12 @@ module Gitlab
           attr_reader :attribute_name, :sort_direction
 
           def initialize(order_value)
-            if order_value.is_a?(String)
-              @attribute_name, @sort_direction = extract_nulls_last_order(order_value)
-            else
-              @attribute_name = order_value.expr.name
-              @sort_direction = order_value.direction
-            end
+            @attribute_name, @sort_direction =
+              if order_value.is_a?(String)
+                extract_nulls_last_order(order_value)
+              else
+                extract_attribute_values(order_value)
+              end
           end
 
           def operator_for(before_or_after)
@@ -71,6 +71,10 @@ module Gitlab
 
             [tokens.first, (tokens[1] == 'asc' ? :asc : :desc)]
           end
+
+          def extract_attribute_values(order_value)
+            [order_value.expr.name, order_value.direction]
+          end
         end
       end
     end
diff --git a/spec/frontend/monitoring/components/__snapshots__/dashboard_template_spec.js.snap b/spec/frontend/monitoring/components/__snapshots__/dashboard_template_spec.js.snap
index 2b2ff074f83..c705270343b 100644
--- a/spec/frontend/monitoring/components/__snapshots__/dashboard_template_spec.js.snap
+++ b/spec/frontend/monitoring/components/__snapshots__/dashboard_template_spec.js.snap
@@ -51,13 +51,22 @@ exports[`Dashboard template matches the default snapshot 1`] = `
              
             <gl-dropdown-divider-stub />
              
-            <!---->
+            <gl-search-box-by-type-stub
+              class="m-2"
+              value=""
+            />
              
             <div
               class="flex-fill overflow-auto"
             />
              
-            <!---->
+            <div
+              class="text-secondary no-matches-message"
+            >
+              
+              No matching results
+            
+            </div>
           </div>
         </gl-dropdown-stub>
       </gl-form-group-stub>
diff --git a/spec/frontend/monitoring/components/dashboard_spec.js b/spec/frontend/monitoring/components/dashboard_spec.js
index 29338ee204e..31266b4f6d4 100644
--- a/spec/frontend/monitoring/components/dashboard_spec.js
+++ b/spec/frontend/monitoring/components/dashboard_spec.js
@@ -255,9 +255,6 @@ describe('Dashboard', () => {
         {
           attachToDocument: true,
           stubs: ['graph-group', 'panel-type'],
-          provide: {
-            glFeatures: { searchableEnvironmentsDropdown: true },
-          },
         },
       );
 
diff --git a/spec/graphql/mutations/todos/restore_many_spec.rb b/spec/graphql/mutations/todos/restore_many_spec.rb
new file mode 100644
index 00000000000..7821ce35a08
--- /dev/null
+++ b/spec/graphql/mutations/todos/restore_many_spec.rb
@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Mutations::Todos::RestoreMany do
+  let_it_be(:current_user) { create(:user) }
+  let_it_be(:author) { create(:user) }
+  let_it_be(:other_user) { create(:user) }
+
+  let_it_be(:todo1) { create(:todo, user: current_user, author: author, state: :done) }
+  let_it_be(:todo2) { create(:todo, user: current_user, author: author, state: :pending) }
+
+  let_it_be(:other_user_todo) { create(:todo, user: other_user, author: author, state: :done) }
+
+  let(:mutation) { described_class.new(object: nil, context: { current_user: current_user }) }
+
+  describe '#resolve' do
+    it 'restores a single todo' do
+      result = restore_mutation([todo1])
+
+      expect(todo1.reload.state).to eq('pending')
+      expect(todo2.reload.state).to eq('pending')
+      expect(other_user_todo.reload.state).to eq('done')
+
+      todo_ids = result[:updated_ids]
+      expect(todo_ids.size).to eq(1)
+      expect(todo_ids.first).to eq(todo1.to_global_id.to_s)
+    end
+
+    it 'handles a todo which is already pending as expected' do
+      result = restore_mutation([todo2])
+
+      expect_states_were_not_changed
+
+      expect(result[:updated_ids]).to eq([])
+    end
+
+    it 'ignores requests for todos which do not belong to the current user' do
+      restore_mutation([other_user_todo])
+
+      expect_states_were_not_changed
+    end
+
+    it 'ignores invalid GIDs' do
+      expect { mutation.resolve(ids: ['invalid_gid']) }.to raise_error(URI::BadURIError)
+
+      expect_states_were_not_changed
+    end
+
+    it 'restores multiple todos' do
+      todo4 = create(:todo, user: current_user, author: author, state: :done)
+
+      result = restore_mutation([todo1, todo4, todo2])
+
+      expect(result[:updated_ids].size).to eq(2)
+
+      returned_todo_ids = result[:updated_ids]
+      expect(returned_todo_ids).to contain_exactly(todo1.to_global_id.to_s, todo4.to_global_id.to_s)
+
+      expect(todo1.reload.state).to eq('pending')
+      expect(todo2.reload.state).to eq('pending')
+      expect(todo4.reload.state).to eq('pending')
+      expect(other_user_todo.reload.state).to eq('done')
+    end
+
+    it 'fails if one todo does not belong to the current user' do
+      restore_mutation([todo1, todo2, other_user_todo])
+
+      expect(todo1.reload.state).to eq('pending')
+      expect(todo2.reload.state).to eq('pending')
+      expect(other_user_todo.reload.state).to eq('done')
+    end
+
+    it 'fails if too many todos are requested for update' do
+      expect { restore_mutation([todo1] * 51) }.to raise_error(Gitlab::Graphql::Errors::ArgumentError)
+    end
+
+    it 'does not update todos from another app' do
+      todo4 = create(:todo)
+      todo4_gid = ::URI::GID.parse("gid://otherapp/Todo/#{todo4.id}")
+
+      result = mutation.resolve(ids: [todo4_gid.to_s])
+
+      expect(result[:updated_ids]).to be_empty
+
+      expect_states_were_not_changed
+    end
+
+    it 'does not update todos from another model' do
+      todo4 = create(:todo)
+      todo4_gid = ::URI::GID.parse("gid://#{GlobalID.app}/Project/#{todo4.id}")
+
+      result = mutation.resolve(ids: [todo4_gid.to_s])
+
+      expect(result[:updated_ids]).to be_empty
+
+      expect_states_were_not_changed
+    end
+  end
+
+  def restore_mutation(todos)
+    mutation.resolve(ids: todos.map { |todo| global_id_of(todo) } )
+  end
+
+  def global_id_of(todo)
+    todo.to_global_id.to_s
+  end
+
+  def expect_states_were_not_changed
+    expect(todo1.reload.state).to eq('done')
+    expect(todo2.reload.state).to eq('pending')
+    expect(other_user_todo.reload.state).to eq('done')
+  end
+end
diff --git a/spec/lib/gitlab/diff/highlight_cache_spec.rb b/spec/lib/gitlab/diff/highlight_cache_spec.rb
index bff51709c40..218c393c409 100644
--- a/spec/lib/gitlab/diff/highlight_cache_spec.rb
+++ b/spec/lib/gitlab/diff/highlight_cache_spec.rb
@@ -144,4 +144,10 @@ describe Gitlab::Diff::HighlightCache, :clean_gitlab_redis_cache do
       cache.clear
     end
   end
+
+  describe 'metrics' do
+    it 'defines :gitlab_redis_diff_caching_memory_usage_bytes histogram' do
+      expect(described_class).to respond_to(:gitlab_redis_diff_caching_memory_usage_bytes)
+    end
+  end
 end
diff --git a/spec/lib/gitlab/graphql/connections/keyset/conditions/not_null_condition_spec.rb b/spec/lib/gitlab/graphql/connections/keyset/conditions/not_null_condition_spec.rb
index d943540fe1f..5e215be4dfb 100644
--- a/spec/lib/gitlab/graphql/connections/keyset/conditions/not_null_condition_spec.rb
+++ b/spec/lib/gitlab/graphql/connections/keyset/conditions/not_null_condition_spec.rb
@@ -4,10 +4,15 @@ require 'spec_helper'
 
 describe Gitlab::Graphql::Connections::Keyset::Conditions::NotNullCondition do
   describe '#build' do
-    let(:condition) { described_class.new(Issue.arel_table, %w(relative_position id), [1500, 500], ['>', '>'], before_or_after) }
+    let(:operators) { ['>', '>'] }
+    let(:before_or_after) { :after }
+    let(:condition) { described_class.new(arel_table, order_list, values, operators, before_or_after) }
 
     context 'when there is only one ordering field' do
-      let(:condition) { described_class.new(Issue.arel_table, ['id'], [500], ['>'], :after) }
+      let(:arel_table) { Issue.arel_table }
+      let(:order_list) { ['id'] }
+      let(:values)     { [500] }
+      let(:operators)  { ['>'] }
 
       it 'generates a single condition sql' do
         expected_sql = <<~SQL
@@ -18,38 +23,52 @@ describe Gitlab::Graphql::Connections::Keyset::Conditions::NotNullCondition do
       end
     end
 
-    context 'when :after' do
-      let(:before_or_after) { :after }
+    context 'when ordering by a column attribute' do
+      let(:arel_table) { Issue.arel_table }
+      let(:order_list) { %w(relative_position id) }
+      let(:values)     { [1500, 500] }
 
-      it 'generates :after sql' do
-        expected_sql = <<~SQL
-          ("issues"."relative_position" > 1500)
-          OR (
-            "issues"."relative_position" = 1500
-            AND
-            "issues"."id" > 500
-          )
-          OR ("issues"."relative_position" IS NULL)
-        SQL
+      shared_examples ':after condition' do
+        it 'generates :after sql' do
+          expected_sql = <<~SQL
+            ("issues"."relative_position" > 1500)
+            OR (
+              "issues"."relative_position" = 1500
+              AND
+              "issues"."id" > 500
+            )
+            OR ("issues"."relative_position" IS NULL)
+          SQL
 
-        expect(condition.build.squish).to eq expected_sql.squish
+          expect(condition.build.squish).to eq expected_sql.squish
+        end
       end
-    end
 
-    context 'when :before' do
-      let(:before_or_after) { :before }
+      context 'when :after' do
+        it_behaves_like ':after condition'
+      end
 
-      it 'generates :before sql' do
-        expected_sql = <<~SQL
-          ("issues"."relative_position" > 1500)
-          OR (
-            "issues"."relative_position" = 1500
-            AND
-            "issues"."id" > 500
-          )
-        SQL
+      context 'when :before' do
+        let(:before_or_after) { :before }
 
-        expect(condition.build.squish).to eq expected_sql.squish
+        it 'generates :before sql' do
+          expected_sql = <<~SQL
+            ("issues"."relative_position" > 1500)
+            OR (
+              "issues"."relative_position" = 1500
+              AND
+              "issues"."id" > 500
+            )
+          SQL
+
+          expect(condition.build.squish).to eq expected_sql.squish
+        end
+      end
+
+      context 'when :foo' do
+        let(:before_or_after) { :foo }
+
+        it_behaves_like ':after condition'
       end
     end
   end
diff --git a/spec/lib/gitlab/graphql/connections/keyset/conditions/null_condition_spec.rb b/spec/lib/gitlab/graphql/connections/keyset/conditions/null_condition_spec.rb
index 7fce94adb81..1049890a079 100644
--- a/spec/lib/gitlab/graphql/connections/keyset/conditions/null_condition_spec.rb
+++ b/spec/lib/gitlab/graphql/connections/keyset/conditions/null_condition_spec.rb
@@ -4,38 +4,54 @@ require 'spec_helper'
 
 describe Gitlab::Graphql::Connections::Keyset::Conditions::NullCondition do
   describe '#build' do
-    let(:condition) { described_class.new(Issue.arel_table, %w(relative_position id), [nil, 500], [nil, '>'], before_or_after) }
-
-    context 'when :after' do
-      let(:before_or_after) { :after }
-
-      it 'generates sql' do
-        expected_sql = <<~SQL
-        (
-          "issues"."relative_position" IS NULL
-          AND
-          "issues"."id" > 500
-        )
-        SQL
+    let(:values) { [nil, 500] }
+    let(:operators) { [nil, '>'] }
+    let(:before_or_after) { :after }
+    let(:condition) { described_class.new(arel_table, order_list, values, operators, before_or_after) }
+
+    context 'when ordering by a column attribute' do
+      let(:arel_table) { Issue.arel_table }
+      let(:order_list) { %w(relative_position id) }
+
+      shared_examples ':after condition' do
+        it 'generates sql' do
+          expected_sql = <<~SQL
+            (
+              "issues"."relative_position" IS NULL
+              AND
+              "issues"."id" > 500
+            )
+          SQL
+
+          expect(condition.build.squish).to eq expected_sql.squish
+        end
+      end
 
-        expect(condition.build.squish).to eq expected_sql.squish
+      context 'when :after' do
+        it_behaves_like ':after condition'
       end
-    end
 
-    context 'when :before' do
-      let(:before_or_after) { :before }
+      context 'when :before' do
+        let(:before_or_after) { :before }
+
+        it 'generates :before sql' do
+          expected_sql = <<~SQL
+            (
+              "issues"."relative_position" IS NULL
+              AND
+              "issues"."id" > 500
+            )
+            OR ("issues"."relative_position" IS NOT NULL)
+          SQL
+
+          expect(condition.build.squish).to eq expected_sql.squish
+        end
+      end
 
-      it 'generates :before sql' do
-        expected_sql = <<~SQL
-          (
-            "issues"."relative_position" IS NULL
-            AND
-            "issues"."id" > 500
-          )
-          OR ("issues"."relative_position" IS NOT NULL)
-        SQL
+      context 'when :foo' do
+        let(:before_or_after) { :foo }
 
-        expect(condition.build.squish).to eq expected_sql.squish
+        it_behaves_like ':after condition'
       end
     end
   end
diff --git a/spec/lib/gitlab/graphql/connections/keyset/query_builder_spec.rb b/spec/lib/gitlab/graphql/connections/keyset/query_builder_spec.rb
index 59e153d9e07..7ebf5da264d 100644
--- a/spec/lib/gitlab/graphql/connections/keyset/query_builder_spec.rb
+++ b/spec/lib/gitlab/graphql/connections/keyset/query_builder_spec.rb
@@ -13,6 +13,7 @@ describe Gitlab::Graphql::Connections::Keyset::QueryBuilder do
   describe '#conditions' do
     let(:relation) { Issue.order(relative_position: :desc).order(:id) }
     let(:order_list) { Gitlab::Graphql::Connections::Keyset::OrderInfo.build_order_list(relation) }
+    let(:arel_table) { Issue.arel_table }
     let(:builder) { described_class.new(arel_table, order_list, decoded_cursor, before_or_after) }
     let(:before_or_after) { :after }
 
@@ -101,8 +102,4 @@ describe Gitlab::Graphql::Connections::Keyset::QueryBuilder do
       end
     end
   end
-
-  def arel_table
-    Issue.arel_table
-  end
 end
diff --git a/spec/models/todo_spec.rb b/spec/models/todo_spec.rb
index ea09c6caed3..3f0c95b2513 100644
--- a/spec/models/todo_spec.rb
+++ b/spec/models/todo_spec.rb
@@ -313,6 +313,36 @@ describe Todo do
     end
   end
 
+  describe '.for_ids' do
+    it 'returns the expected todos' do
+      todo1 = create(:todo)
+      todo2 = create(:todo)
+      todo3 = create(:todo)
+      create(:todo)
+
+      expect(described_class.for_ids([todo2.id, todo1.id, todo3.id])).to contain_exactly(todo1, todo2, todo3)
+    end
+
+    it 'returns an empty collection when no ids are given' do
+      create(:todo)
+
+      expect(described_class.for_ids([])).to be_empty
+    end
+  end
+
+  describe '.for_user' do
+    it 'returns the expected todos' do
+      user1 = create(:user)
+      user2 = create(:user)
+
+      todo1 = create(:todo, user: user1)
+      todo2 = create(:todo, user: user1)
+      create(:todo, user: user2)
+
+      expect(described_class.for_user(user1)).to contain_exactly(todo1, todo2)
+    end
+  end
+
   describe '.any_for_target?' do
     it 'returns true if there are todos for a given target' do
       todo = create(:todo)