Add latest changes from gitlab-org/gitlab@master

22 files changed, 189 insertions, 40 deletions

diff --git a/app/assets/javascripts/ci/ci_variable_list/components/ci_group_variables.vue b/app/assets/javascripts/ci/ci_variable_list/components/ci_group_variables.vue
index 9c79adffdae..2045b127a82 100644
--- a/app/assets/javascripts/ci/ci_variable_list/components/ci_group_variables.vue
+++ b/app/assets/javascripts/ci/ci_variable_list/components/ci_group_variables.vue
@@ -3,6 +3,7 @@ import { TYPENAME_GROUP } from '~/graphql_shared/constants';
 import { convertToGraphQLId } from '~/graphql_shared/utils';
 import glFeatureFlagsMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import { ADD_MUTATION_ACTION, DELETE_MUTATION_ACTION, UPDATE_MUTATION_ACTION } from '../constants';
+import getGroupEnvironments from '../graphql/queries/group_environments.query.graphql';
 import getGroupVariables from '../graphql/queries/group_variables.query.graphql';
 import addGroupVariable from '../graphql/mutations/group_add_variable.mutation.graphql';
 import deleteGroupVariable from '../graphql/mutations/group_delete_variable.mutation.graphql';
@@ -22,6 +23,15 @@ export default {
     graphqlId() {
       return convertToGraphQLId(TYPENAME_GROUP, this.groupId);
     },
+    queriesAvailable() {
+      if (this.glFeatures.ciGroupEnvScopeGraphql) {
+        return this.$options.queryData;
+      }
+
+      return {
+        ciVariables: this.$options.queryData.ciVariables,
+      };
+    },
   },
   mutationData: {
     [ADD_MUTATION_ACTION]: addGroupVariable,
@@ -33,6 +43,10 @@ export default {
       lookup: (data) => data?.group?.ciVariables,
       query: getGroupVariables,
     },
+    environments: {
+      lookup: (data) => data?.group?.environmentScopes,
+      query: getGroupEnvironments,
+    },
   },
 };
 </script>
@@ -45,6 +59,6 @@ export default {
     entity="group"
     :full-path="groupPath"
     :mutation-data="$options.mutationData"
-    :query-data="$options.queryData"
+    :query-data="queriesAvailable"
   />
 </template>
diff --git a/app/assets/javascripts/ci/ci_variable_list/graphql/queries/group_environments.query.graphql b/app/assets/javascripts/ci/ci_variable_list/graphql/queries/group_environments.query.graphql
new file mode 100644
index 00000000000..5768d370474
--- /dev/null
+++ b/app/assets/javascripts/ci/ci_variable_list/graphql/queries/group_environments.query.graphql
@@ -0,0 +1,10 @@
+query getGroupEnvironments($fullPath: ID!, $first: Int, $search: String) {
+  group(fullPath: $fullPath) {
+    id
+    environmentScopes(first: $first, search: $search) {
+      nodes {
+        name
+      }
+    }
+  }
+}
diff --git a/app/controllers/groups/settings/ci_cd_controller.rb b/app/controllers/groups/settings/ci_cd_controller.rb
index 4bbaf92b126..169caabf9d8 100644
--- a/app/controllers/groups/settings/ci_cd_controller.rb
+++ b/app/controllers/groups/settings/ci_cd_controller.rb
@@ -14,6 +14,7 @@ module Groups
       feature_category :continuous_integration
 
       before_action do
+        push_frontend_feature_flag(:ci_group_env_scope_graphql, group)
         push_frontend_feature_flag(:ci_variables_pages, current_user)
       end
 
diff --git a/app/models/concerns/enums/vulnerability.rb b/app/models/concerns/enums/vulnerability.rb
index 4b325de61bc..dbf05dbc428 100644
--- a/app/models/concerns/enums/vulnerability.rb
+++ b/app/models/concerns/enums/vulnerability.rb
@@ -50,6 +50,10 @@ module Enums
       CONFIDENCE_LEVELS
     end
 
+    def self.parse_confidence_level(input)
+      input&.downcase.then { |value| confidence_levels.key?(value) ? value : 'unknown' }
+    end
+
     def self.report_types
       REPORT_TYPES
     end
@@ -58,6 +62,10 @@ module Enums
       SEVERITY_LEVELS
     end
 
+    def self.parse_severity_level(input)
+      input&.downcase.then { |value| severity_levels.key?(value) ? value : 'unknown' }
+    end
+
     def self.detection_methods
       DETECTION_METHODS
     end
diff --git a/app/models/user.rb b/app/models/user.rb
index 7fd5d25d7e0..7d810c025b0 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -31,6 +31,7 @@ class User < ApplicationRecord
   include RestrictedSignup
   include StripAttribute
   include EachBatch
+  include SafelyChangeColumnDefault
 
   DEFAULT_NOTIFICATION_LEVEL = :participating
 
@@ -59,6 +60,8 @@ class User < ApplicationRecord
   INCOMING_MAIL_TOKEN_PREFIX = 'glimt-'
   FEED_TOKEN_PREFIX = 'glft-'
 
+  columns_changing_default :project_view
+
   # lib/tasks/tokens.rake needs to be updated when changing mail and feed tokens
   add_authentication_token_field :incoming_email_token, token_generator: -> { self.generate_incoming_mail_token }
   add_authentication_token_field :feed_token, format_with_prefix: :prefix_for_feed_token
diff --git a/config/feature_flags/development/ci_group_env_scope_graphql.yml b/config/feature_flags/development/ci_group_env_scope_graphql.yml
new file mode 100644
index 00000000000..04b080c67d4
--- /dev/null
+++ b/config/feature_flags/development/ci_group_env_scope_graphql.yml
@@ -0,0 +1,8 @@
+---
+name: ci_group_env_scope_graphql
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/124134
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/416385
+milestone: '16.2'
+type: development
+group: group::pipeline security
+default_enabled: false
diff --git a/db/post_migrate/20230707114012_change_project_view_default.rb b/db/post_migrate/20230707114012_change_project_view_default.rb
new file mode 100644
index 00000000000..6437a650261
--- /dev/null
+++ b/db/post_migrate/20230707114012_change_project_view_default.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class ChangeProjectViewDefault < Gitlab::Database::Migration[2.1]
+  enable_lock_retries!
+
+  def change
+    change_column_default(:users, :project_view, from: 0, to: 2)
+  end
+end
diff --git a/db/schema_migrations/20230707114012 b/db/schema_migrations/20230707114012
new file mode 100644
index 00000000000..b9525ad8a67
--- /dev/null
+++ b/db/schema_migrations/20230707114012
@@ -0,0 +1 @@
+dc0b3017e7dc807b18382cc0a19725be652eea6210c4b5b716093557deace62d
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 1dd2d9dd2a3..f54bd4fc210 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -23921,7 +23921,7 @@ CREATE TABLE users (
     otp_backup_codes text,
     public_email character varying,
     dashboard integer DEFAULT 0,
-    project_view integer DEFAULT 0,
+    project_view integer DEFAULT 2,
     consumed_timestep integer,
     layout integer DEFAULT 0,
     hide_project_limit boolean DEFAULT false,
diff --git a/doc/api/merge_request_approvals.md b/doc/api/merge_request_approvals.md
index 19179bddb00..9123fe0dc1e 100644
--- a/doc/api/merge_request_approvals.md
+++ b/doc/api/merge_request_approvals.md
@@ -37,7 +37,7 @@ Supported attributes:
 {
   "approvers": [], // Deprecated in GitLab 12.3, always returns empty
   "approver_groups": [], // Deprecated in GitLab 12.3, always returns empty
-  "approvals_before_merge": 2,
+  "approvals_before_merge": 2, // Deprecated in GitLab 12.3, use Approval Rules instead
   "reset_approvals_on_push": true,
   "selective_code_owner_removals": false,
   "disable_overriding_approvers_per_merge_request": false,
@@ -63,7 +63,7 @@ Supported attributes:
 | Attribute                                        | Type              | Required               | Description                                                                                                                                             |
 |--------------------------------------------------|-------------------|------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `id`                                             | integer or string | **{check-circle}** Yes | The ID or [URL-encoded path of a project](rest/index.md#namespaced-path-encoding).                                                                           |
-| `approvals_before_merge` (deprecated)            | integer           | **{dotted-circle}** No | How many approvals are required before a merge request can be merged. [Deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/11132) in GitLab 12.3. |
+| `approvals_before_merge` (deprecated)            | integer           | **{dotted-circle}** No | How many approvals are required before a merge request can be merged. [Deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/11132) in GitLab 12.3. Use [Approval Rules](#create-project-level-rule) instead. |
 | `disable_overriding_approvers_per_merge_request` | boolean           | **{dotted-circle}** No | Allow or prevent overriding approvers per merge request.                                                                                                |
 | `merge_requests_author_approval`                 | boolean           | **{dotted-circle}** No | Allow or prevent authors from self approving merge requests; `true` means authors can self approve.                                                     |
 | `merge_requests_disable_committers_approval`     | boolean           | **{dotted-circle}** No | Allow or prevent committers from self approving merge requests.                                                                                         |
@@ -73,7 +73,7 @@ Supported attributes:
 
 ```json
 {
-  "approvals_before_merge": 2,
+  "approvals_before_merge": 2, // Deprecated in GitLab 12.3, use Approval Rules instead
   "reset_approvals_on_push": true,
   "selective_code_owner_removals": false,
   "disable_overriding_approvers_per_merge_request": false,
diff --git a/doc/topics/cron/index.md b/doc/topics/cron/index.md
index b437541e0ea..ca1bc7f40f2 100644
--- a/doc/topics/cron/index.md
+++ b/doc/topics/cron/index.md
@@ -42,6 +42,7 @@ are valid:
 - Run once a month on the 2nd Monday: `0 0 * * 1#2`
 - Run once a year at midnight of 1 January: `0 0 1 1 *`
 - Run every other Sunday at 0900 hours: `0 9 * * sun%2`
+  - This syntax is from the [fugit modulo extension](https://github.com/floraison/fugit#the-modulo-extension)
 
 For complete cron documentation, refer to the
 [crontab(5) — Linux manual page](https://man7.org/linux/man-pages/man5/crontab.5.html).
diff --git a/doc/user/application_security/policies/scan-execution-policies.md b/doc/user/application_security/policies/scan-execution-policies.md
index 0e51cb93da3..3fc626c01c7 100644
--- a/doc/user/application_security/policies/scan-execution-policies.md
+++ b/doc/user/application_security/policies/scan-execution-policies.md
@@ -73,26 +73,42 @@ the following sections and tables provide an alternative.
 
 ## `pipeline` rule type
 
+> The `branch_type` field was [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/404774) in GitLab 16.1 [with a flag](../../../administration/feature_flags.md) named `security_policies_branch_type`. Disabled by default.
+
+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to [enable the feature flag](../../../administration/feature_flags.md) named `security_policies_branch_type`.
+On GitLab.com, this feature is not available.
+
 This rule enforces the defined actions whenever the pipeline runs for a selected branch.
 
 | Field | Type | Possible values | Description |
 |-------|------|-----------------|-------------|
 | `type` | `string` | `pipeline` | The rule's type. |
-| `branches` | `array` of `string` | `*` or the branch's name | The branch the given policy applies to (supports wildcard). Cannot be used with the `branch_type` field. |
-| `branch_type` | `string` | `default`, `protected` or `all` | The types of branches the given policy applies to. Cannot be used with the `branches` field. |
+| `branches` <sup>1</sup> | `array` of `string` | `*` or the branch's name | The branch the given policy applies to (supports wildcard). |
+| `branch_type` <sup>1</sup> | `string` | `default`, `protected` or `all` | The types of branches the given policy applies to. |
+
+1. You must specify only one of `branches` or `branch_type`.
 
 ## `schedule` rule type
 
+> The `branch_type` field was [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/404774) in GitLab 16.1 [with a flag](../../../administration/feature_flags.md) named `security_policies_branch_type`. Disabled by default.
+
+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to [enable the feature flag](../../../administration/feature_flags.md) named `security_policies_branch_type`.
+On GitLab.com, this feature is not available.
+
 This rule enforces the defined actions and schedules a scan on the provided date/time.
 
 | Field      | Type | Possible values | Description |
 |------------|------|-----------------|-------------|
 | `type`     | `string` | `schedule` | The rule's type. |
-| `branches` | `array` of `string` | `*` or the branch's name | The branch the given policy applies to (supports wildcard). This field is required if the `agents` field is not set. Cannot be used with the `branch_type` field. |
-| `branch_type` | `string` | `default`, `protected` or `all` | The types of branches the given policy applies to. Cannot be used with the `branches` field. |
+| `branches` <sup>1</sup> | `array` of `string` | `*` or the branch's name | The branch the given policy applies to (supports wildcard). |
+| `branch_type` <sup>1</sup> | `string` | `default`, `protected` or `all` | The types of branches the given policy applies to. |
 | `cadence`  | `string` | CRON expression (for example, `0 0 * * *`) | A whitespace-separated string containing five fields that represents the scheduled time. Minimum of 15 minute intervals when used together with the `branches` field. |
 | `timezone` | `string` | Time zone identifier (for example, `America/New_York`) | Time zone to apply to the cadence. Value must be an IANA Time Zone Database identifier. |
-| `agents`   | `object` | | The name of the [GitLab agents](../../clusters/agent/index.md) where [Operational Container Scanning](../../clusters/agent/vulnerabilities.md) runs. The object key is the name of the Kubernetes agent configured for your project in GitLab. This field is required if the `branches` field is not set. |
+| `agents` <sup>1</sup>   | `object` | | The name of the [GitLab agents](../../clusters/agent/index.md) where [Operational Container Scanning](../../clusters/agent/vulnerabilities.md) runs. The object key is the name of the Kubernetes agent configured for your project in GitLab. |
+
+1. You must specify only one of `branches`, `branch_type`, or `agents`.
 
 GitLab supports the following types of CRON syntax for the `cadence` field:
 
diff --git a/doc/user/clusters/agent/gitops.md b/doc/user/clusters/agent/gitops.md
index f07d37dee57..8c04bc6aa0b 100644
--- a/doc/user/clusters/agent/gitops.md
+++ b/doc/user/clusters/agent/gitops.md
@@ -77,7 +77,12 @@ For additional repository structure recommendations, see the [Flux documentation
 
 ## Immediate Git repository reconciliation
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/392852) in GitLab 16.1.
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/392852) in GitLab 16.1 with a [flag](../../../administration/feature_flags.md) named `notify_kas_on_git_push`. Disabled by default.
+
+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available,
+ask an administrator to [enable the feature flag](../../../administration/feature_flags.md) named `notify_kas_on_git_push`.
+On GitLab.com, this feature is not available.
 
 Usually, the Flux source controller reconciles Git repositories at configured intervals.
 This can cause delays between a `git push` and the reconciliation of the cluster state, and results in
diff --git a/doc/user/clusters/agent/gitops/flux_tutorial.md b/doc/user/clusters/agent/gitops/flux_tutorial.md
index d0780f85201..b9bb4a410d6 100644
--- a/doc/user/clusters/agent/gitops/flux_tutorial.md
+++ b/doc/user/clusters/agent/gitops/flux_tutorial.md
@@ -100,7 +100,7 @@ To install `agentk`:
    apiVersion: v1
    kind: Namespace
    metadata:
-   name: gitlab
+     name: gitlab
    ```
 
 1. Apply the agent registration token as a secret in the cluster:
@@ -143,7 +143,7 @@ To install `agentk`:
          sourceRef:
            kind: HelmRepository
            name: gitlab-agent
-           namespace: gitlab-agent
+           namespace: gitlab
      interval: 1h0m0s
      values:
        config:
diff --git a/doc/user/project/integrations/webhook_events.md b/doc/user/project/integrations/webhook_events.md
index 140f71e8d89..a7c8f1b2d8c 100644
--- a/doc/user/project/integrations/webhook_events.md
+++ b/doc/user/project/integrations/webhook_events.md
@@ -1471,7 +1471,7 @@ Payload example:
 ### Number of retries
 
 > - `retries_count` [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/382046) in GitLab 15.6 [with a flag](../../../administration/feature_flags.md) named `job_webhook_retries_count`. Disabled by default.
-> - `retries_count` [enabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/382046) in GitLab 16.1.
+> - `retries_count` [enabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/382046) in GitLab 16.2.
 
 `retries_count` is an integer that indicates if the job is a retry. `0` means that the job
 has not been retried. `1` means that it's the first retry.
diff --git a/lib/gitlab/ci/parsers/security/common.rb b/lib/gitlab/ci/parsers/security/common.rb
index 21408beb8cb..ee1da82f285 100644
--- a/lib/gitlab/ci/parsers/security/common.rb
+++ b/lib/gitlab/ci/parsers/security/common.rb
@@ -126,8 +126,8 @@ module Gitlab
                 compare_key: data['cve'] || '',
                 location: location,
                 evidence: evidence,
-                severity: parse_severity_level(data['severity']),
-                confidence: parse_confidence_level(data['confidence']),
+                severity: ::Enums::Vulnerability.parse_severity_level(data['severity']),
+                confidence: ::Enums::Vulnerability.parse_confidence_level(data['confidence']),
                 scanner: create_scanner(top_level_scanner_data || data['scanner']),
                 scan: report&.scan,
                 identifiers: identifiers,
@@ -260,14 +260,6 @@ module Gitlab
             ::Gitlab::Ci::Reports::Security::Link.new(name: link['name'], url: link['url'])
           end
 
-          def parse_severity_level(input)
-            input&.downcase.then { |value| ::Enums::Vulnerability.severity_levels.key?(value) ? value : 'unknown' }
-          end
-
-          def parse_confidence_level(input)
-            input&.downcase.then { |value| ::Enums::Vulnerability.confidence_levels.key?(value) ? value : 'unknown' }
-          end
-
           def create_location(location_data)
             raise NotImplementedError
           end
diff --git a/lib/gitlab/ci/pipeline/chain/validate/abilities.rb b/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
index 035167f1a74..b8b70a6b6b6 100644
--- a/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
+++ b/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
@@ -22,7 +22,7 @@ module Gitlab
                 return error('Insufficient permissions to create a new pipeline')
               end
 
-              unless allowed_to_write_ref?
+              unless allowed_to_run_pipeline?
                 error("You do not have sufficient permission to run a pipeline on '#{command.ref}'. Please select a different branch or contact your administrator for assistance.")
               end
             end
@@ -37,6 +37,10 @@ module Gitlab
               can?(current_user, :create_pipeline, project)
             end
 
+            def allowed_to_run_pipeline?
+              allowed_to_write_ref?
+            end
+
             def allowed_to_write_ref?
               access = Gitlab::UserAccess.new(current_user, container: project)
 
diff --git a/lib/gitlab/ci/reports/sbom/source.rb b/lib/gitlab/ci/reports/sbom/source.rb
index fbb8644c1b0..b7af6ea17c3 100644
--- a/lib/gitlab/ci/reports/sbom/source.rb
+++ b/lib/gitlab/ci/reports/sbom/source.rb
@@ -11,6 +11,22 @@ module Gitlab
             @source_type = type
             @data = data
           end
+
+          def source_file_path
+            data.dig('source_file', 'path')
+          end
+
+          def input_file_path
+            data.dig('input_file', 'path')
+          end
+
+          def packager
+            data.dig('package_manager', 'name')
+          end
+
+          def language
+            data.dig('language', 'name')
+          end
         end
       end
     end
diff --git a/lib/gitlab/ci/reports/security/link.rb b/lib/gitlab/ci/reports/security/link.rb
index 1c4c05cd9ac..6804d2b2a29 100644
--- a/lib/gitlab/ci/reports/security/link.rb
+++ b/lib/gitlab/ci/reports/security/link.rb
@@ -18,6 +18,10 @@ module Gitlab
               url: url
             }.compact
           end
+
+          def ==(other)
+            name == other.name && url == other.url
+          end
         end
       end
     end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 7dd526b6588..d102db78a9f 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -4575,9 +4575,6 @@ msgstr ""
 msgid "All changes are committed"
 msgstr ""
 
-msgid "All default branches"
-msgstr ""
-
 msgid "All eligible users"
 msgstr ""
 
@@ -40576,7 +40573,7 @@ msgstr ""
 msgid "ScanResultPolicy|When %{scanType} %{scanners} runs against the %{branches} and find(s) %{vulnerabilitiesNumber} %{boldDescription} of the following criteria:"
 msgstr ""
 
-msgid "ScanResultPolicy|When %{scanType} in an open merge request targeting the %{branches} and the licenses match all of the following criteria:"
+msgid "ScanResultPolicy|When %{scanType} in an open merge request targeting %{branches} and the licenses match all of the following criteria:"
 msgstr ""
 
 msgid "ScanResultPolicy|When %{scanners} find scanner specified conditions in an open merge request targeting the %{branches} and match %{boldDescription} of the following criteria"
@@ -43991,9 +43988,6 @@ msgstr ""
 msgid "Specific branches"
 msgstr ""
 
-msgid "Specific protected branches"
-msgstr ""
-
 msgid "Specified URL cannot be used: \"%{reason}\""
 msgstr ""
 
@@ -53531,6 +53525,15 @@ msgstr ""
 msgid "all"
 msgstr ""
 
+msgid "all branches"
+msgstr ""
+
+msgid "all default branches"
+msgstr ""
+
+msgid "all protected branches"
+msgstr ""
+
 msgid "allowed to fail"
 msgstr ""
 
@@ -55410,6 +55413,9 @@ msgstr ""
 msgid "source diff"
 msgstr ""
 
+msgid "specific protected branches"
+msgstr ""
+
 msgid "specified top is not part of the tree"
 msgstr ""
 
diff --git a/spec/frontend/ci/ci_variable_list/components/ci_group_variables_spec.js b/spec/frontend/ci/ci_variable_list/components/ci_group_variables_spec.js
index 7436210fe70..b364f098a3a 100644
--- a/spec/frontend/ci/ci_variable_list/components/ci_group_variables_spec.js
+++ b/spec/frontend/ci/ci_variable_list/components/ci_group_variables_spec.js
@@ -9,15 +9,13 @@ import {
   DELETE_MUTATION_ACTION,
   UPDATE_MUTATION_ACTION,
 } from '~/ci/ci_variable_list/constants';
+import getGroupEnvironments from '~/ci/ci_variable_list/graphql/queries/group_environments.query.graphql';
 import getGroupVariables from '~/ci/ci_variable_list/graphql/queries/group_variables.query.graphql';
 import addGroupVariable from '~/ci/ci_variable_list/graphql/mutations/group_add_variable.mutation.graphql';
 import deleteGroupVariable from '~/ci/ci_variable_list/graphql/mutations/group_delete_variable.mutation.graphql';
 import updateGroupVariable from '~/ci/ci_variable_list/graphql/mutations/group_update_variable.mutation.graphql';
 
 const mockProvide = {
-  glFeatures: {
-    groupScopedCiVariables: false,
-  },
   groupPath: '/group',
   groupId: 12,
 };
@@ -27,9 +25,16 @@ describe('Ci Group Variable wrapper', () => {
 
   const findCiShared = () => wrapper.findComponent(ciVariableShared);
 
-  const createComponent = ({ provide = {} } = {}) => {
+  const createComponent = ({ featureFlags } = {}) => {
     wrapper = shallowMount(ciGroupVariables, {
-      provide: { ...mockProvide, ...provide },
+      provide: {
+        ...mockProvide,
+        glFeatures: {
+          ciGroupEnvScopeGraphql: false,
+          groupScopedCiVariables: false,
+          ...featureFlags,
+        },
+      },
     });
   };
 
@@ -62,10 +67,10 @@ describe('Ci Group Variable wrapper', () => {
     });
   });
 
-  describe('feature flag', () => {
+  describe('groupScopedCiVariables feature flag', () => {
     describe('When enabled', () => {
       beforeEach(() => {
-        createComponent({ provide: { glFeatures: { groupScopedCiVariables: true } } });
+        createComponent({ featureFlags: { groupScopedCiVariables: true } });
       });
 
       it('Passes down `true` to variable shared component', () => {
@@ -75,7 +80,7 @@ describe('Ci Group Variable wrapper', () => {
 
     describe('When disabled', () => {
       beforeEach(() => {
-        createComponent({ provide: { glFeatures: { groupScopedCiVariables: false } } });
+        createComponent();
       });
 
       it('Passes down `false` to variable shared component', () => {
@@ -83,4 +88,26 @@ describe('Ci Group Variable wrapper', () => {
       });
     });
   });
+
+  describe('ciGroupEnvScopeGraphql feature flag', () => {
+    describe('When enabled', () => {
+      beforeEach(() => {
+        createComponent({ featureFlags: { ciGroupEnvScopeGraphql: true } });
+      });
+
+      it('Passes down environments query to variable shared component', () => {
+        expect(findCiShared().props('queryData').environments.query).toBe(getGroupEnvironments);
+      });
+    });
+
+    describe('When disabled', () => {
+      beforeEach(() => {
+        createComponent();
+      });
+
+      it('Does not pass down environments query to variable shared component', () => {
+        expect(findCiShared().props('queryData').environments).toBe(undefined);
+      });
+    });
+  });
 });
diff --git a/spec/lib/gitlab/ci/reports/sbom/source_spec.rb b/spec/lib/gitlab/ci/reports/sbom/source_spec.rb
index 63b8e5fdf01..c1eaea511b7 100644
--- a/spec/lib/gitlab/ci/reports/sbom/source_spec.rb
+++ b/spec/lib/gitlab/ci/reports/sbom/source_spec.rb
@@ -24,4 +24,28 @@ RSpec.describe Gitlab::Ci::Reports::Sbom::Source, feature_category: :dependency_
       data: attributes[:data]
     )
   end
+
+  describe '#source_file_path' do
+    it 'returns the correct source_file_path' do
+      expect(subject.source_file_path).to eq('package.json')
+    end
+  end
+
+  describe '#input_file_path' do
+    it 'returns the correct input_file_path' do
+      expect(subject.input_file_path).to eq("package-lock.json")
+    end
+  end
+
+  describe '#packager' do
+    it 'returns the correct package manager name' do
+      expect(subject.packager).to eq("npm")
+    end
+  end
+
+  describe '#language' do
+    it 'returns the correct langauge' do
+      expect(subject.language).to eq("JavaScript")
+    end
+  end
 end