Add latest changes from gitlab-org/gitlab@master

53 files changed, 460 insertions, 234 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index a5f07b312fb..007be17c303 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -42,6 +42,9 @@ default:
 workflow:
   name: '$PIPELINE_NAME'
   rules:
+    - if: '$CI_PROJECT_PATH == "gitlab/gitaly" && $CI_PIPELINE_SOURCE == "parent_pipeline" && $GITALY_TEST'
+      variables:
+        PIPELINE_NAME: 'Gitaly Rails Test Pipeline'
     # If `$FORCE_GITLAB_CI` is set, create a pipeline.
     - if: '$FORCE_GITLAB_CI'
       variables:
@@ -119,9 +122,6 @@ workflow:
       variables:
         <<: *default-ruby-variables
         PIPELINE_NAME: 'Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch pipeline'
-    - if: '$CI_PROJECT_PATH == "gitlab/gitaly" && $CI_PIPELINE_SOURCE == "parent_pipeline" && $GITALY_TEST'
-      variables:
-        PIPELINE_NAME: 'Gitaly Rails Test Pipeline'
 
 variables:
   PG_VERSION: "14"
diff --git a/.gitlab/ci/gitlab-gems.gitlab-ci.yml b/.gitlab/ci/gitlab-gems.gitlab-ci.yml
index c38df607e6b..d972139ad6e 100644
--- a/.gitlab/ci/gitlab-gems.gitlab-ci.yml
+++ b/.gitlab/ci/gitlab-gems.gitlab-ci.yml
@@ -1,23 +1,10 @@
-gems activerecord-gitlab:
-  extends:
-    - .gems:rules:activerecord-gitlab
-  needs: []
-  trigger:
-    include: gems/activerecord-gitlab/.gitlab-ci.yml
-    strategy: depend
-
-gems gitlab-rspec:
-  extends:
-    - .gems:rules:gitlab-rspec
-  needs: []
-  trigger:
-    include: gems/gitlab-rspec/.gitlab-ci.yml
-    strategy: depend
-
-gems gitlab-utils:
-  extends:
-    - .gems:rules:gitlab-utils
-  needs: []
-  trigger:
-    include: gems/gitlab-utils/.gitlab-ci.yml
-    strategy: depend
+include:
+  - local: .gitlab/ci/templates/gem.gitlab-ci.yml
+    inputs:
+      gem_name: "activerecord-gitlab"
+  - local: .gitlab/ci/templates/gem.gitlab-ci.yml
+    inputs:
+      gem_name: "gitlab-rspec"
+  - local: .gitlab/ci/templates/gem.gitlab-ci.yml
+    inputs:
+      gem_name: "gitlab-utils"
diff --git a/.gitlab/ci/templates/gem.gitlab-ci.yml b/.gitlab/ci/templates/gem.gitlab-ci.yml
new file mode 100644
index 00000000000..c5b1a1ecf45
--- /dev/null
+++ b/.gitlab/ci/templates/gem.gitlab-ci.yml
@@ -0,0 +1,19 @@
+# The template generates jobs that trigger child pipelines for gems vendored in the main GitLab project under `gems/`.
+#
+# Inputs:
+# - `gem_name`: The name of the gem, i.e. if the gem is located at `gems/gitlab-rspec`, `gem_name` should be set to `gitlab-rspec`.
+spec:
+  inputs:
+    gem_name:
+---
+.gems:rules:$[[inputs.gem_name]]:
+  rules:
+    - if: '$CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached"'
+      changes: ["gems/$[[inputs.gem_name]]/**/*"]
+
+gems $[[inputs.gem_name]]:
+  extends: .gems:rules:$[[inputs.gem_name]]
+  needs: []
+  trigger:
+    include: gems/$[[inputs.gem_name]]/.gitlab-ci.yml
+    strategy: depend
diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 7a837fbed48..ade995f2fc4 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-6a3d3ddfd7f2f1791cdfcf410c0876253e8b1def
+ed135330cadb3cdb766eea501dd15f3796cf2466
diff --git a/GITLAB_ELASTICSEARCH_INDEXER_VERSION b/GITLAB_ELASTICSEARCH_INDEXER_VERSION
index e198586e42b..43270543f77 100644
--- a/GITLAB_ELASTICSEARCH_INDEXER_VERSION
+++ b/GITLAB_ELASTICSEARCH_INDEXER_VERSION
@@ -1 +1 @@
-4.3.5
+4.3.6
diff --git a/app/assets/javascripts/vue_shared/components/user_avatar/user_avatar_link.vue b/app/assets/javascripts/vue_shared/components/user_avatar/user_avatar_link.vue
index 00720f27934..0949071d4dc 100644
--- a/app/assets/javascripts/vue_shared/components/user_avatar/user_avatar_link.vue
+++ b/app/assets/javascripts/vue_shared/components/user_avatar/user_avatar_link.vue
@@ -18,6 +18,7 @@
 */
 
 import { GlAvatarLink, GlTooltipDirective } from '@gitlab/ui';
+import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import UserAvatarImage from './user_avatar_image.vue';
 
 export default {
@@ -74,6 +75,16 @@ export default {
       required: false,
       default: 'top',
     },
+    popoverUserId: {
+      type: [String, Number],
+      required: false,
+      default: '',
+    },
+    popoverUsername: {
+      type: String,
+      required: false,
+      default: '',
+    },
     username: {
       type: String,
       required: false,
@@ -81,10 +92,17 @@ export default {
     },
   },
   computed: {
+    userId() {
+      return getIdFromGraphQLId(this.popoverUserId);
+    },
     shouldShowUsername() {
       return this.username.length > 0;
     },
     avatarTooltipText() {
+      // Prevent showing tooltip when popoverUserId is present
+      if (this.popoverUserId) {
+        return '';
+      }
       return this.shouldShowUsername ? '' : this.tooltipText;
     },
   },
@@ -92,7 +110,12 @@ export default {
 </script>
 
 <template>
-  <gl-avatar-link :href="linkHref" class="user-avatar-link">
+  <gl-avatar-link
+    :href="linkHref"
+    :data-user-id="userId"
+    :data-username="popoverUsername"
+    class="user-avatar-link js-user-link"
+  >
     <user-avatar-image
       :class="imgCssWrapperClasses"
       :img-src="imgSrc"
diff --git a/app/assets/javascripts/vue_shared/components/user_avatar/user_avatar_list.vue b/app/assets/javascripts/vue_shared/components/user_avatar/user_avatar_list.vue
index 335f9ab1df4..258e8b1a6c5 100644
--- a/app/assets/javascripts/vue_shared/components/user_avatar/user_avatar_list.vue
+++ b/app/assets/javascripts/vue_shared/components/user_avatar/user_avatar_list.vue
@@ -81,6 +81,8 @@ export default {
       :img-alt="item.name"
       :tooltip-text="item.name"
       :img-size="imgSize"
+      :popover-user-id="item.id"
+      :popover-username="item.username"
       img-css-classes="gl-mr-3"
     />
     <template v-if="hasBreakpoint">
diff --git a/app/controllers/projects/notes_controller.rb b/app/controllers/projects/notes_controller.rb
index 5373efd57d2..7fcdf220bd2 100644
--- a/app/controllers/projects/notes_controller.rb
+++ b/app/controllers/projects/notes_controller.rb
@@ -19,13 +19,23 @@ class Projects::NotesController < Projects::ApplicationController
 
   override :feature_category
   def feature_category
-    if %w[index create].include?(params[:action]) && params[:target_type] == 'merge_request'
-      return 'code_review_workflow'
+    if %w[index create].include?(params[:action])
+      category = feature_category_override_for_target_type(params[:target_type])
+      return category if category
     end
 
     super
   end
 
+  def feature_category_override_for_target_type(target_type)
+    case target_type
+    when 'merge_request'
+      'code_review_workflow'
+    when 'commit', 'project_snippet'
+      'source_code_management'
+    end
+  end
+
   def delete_attachment
     note.remove_attachment!
     note.update_attribute(:attachment, nil)
diff --git a/app/graphql/types/ci/group_variable_type.rb b/app/graphql/types/ci/group_variable_type.rb
index f9ed54f0d10..7e2afba0d53 100644
--- a/app/graphql/types/ci/group_variable_type.rb
+++ b/app/graphql/types/ci/group_variable_type.rb
@@ -21,6 +21,10 @@ module Types
       field :protected, GraphQL::Types::Boolean,
             null: true,
             description: 'Indicates whether the variable is protected.'
+
+      field :description, GraphQL::Types::String,
+            null: true,
+            description: 'Description of the variable.'
     end
   end
 end
diff --git a/app/graphql/types/ci/project_variable_type.rb b/app/graphql/types/ci/project_variable_type.rb
index 2a5375045e5..a9679000511 100644
--- a/app/graphql/types/ci/project_variable_type.rb
+++ b/app/graphql/types/ci/project_variable_type.rb
@@ -21,6 +21,10 @@ module Types
       field :masked, GraphQL::Types::Boolean,
             null: true,
             description: 'Indicates whether the variable is masked.'
+
+      field :description, GraphQL::Types::String,
+            null: true,
+            description: 'Description of the variable.'
     end
   end
 end
diff --git a/app/models/ci/group_variable.rb b/app/models/ci/group_variable.rb
index 5522a01758f..4720a48a7ca 100644
--- a/app/models/ci/group_variable.rb
+++ b/app/models/ci/group_variable.rb
@@ -14,6 +14,7 @@ module Ci
 
     alias_attribute :secret_value, :value
 
+    validates :description, length: { maximum: 255 }, allow_blank: true
     validates :key, uniqueness: {
       scope: [:group_id, :environment_scope],
       message: "(%{value}) has already been taken"
diff --git a/app/models/ci/variable.rb b/app/models/ci/variable.rb
index 23fe89c38df..6f5972ebefa 100644
--- a/app/models/ci/variable.rb
+++ b/app/models/ci/variable.rb
@@ -14,6 +14,7 @@ module Ci
 
     alias_attribute :secret_value, :value
 
+    validates :description, length: { maximum: 255 }, allow_blank: true
     validates :key, uniqueness: {
       scope: [:project_id, :environment_scope],
       message: "(%{value}) has already been taken"
diff --git a/data/deprecations/16-2-deprecation-omniauth-facebook.yml b/data/deprecations/16-2-deprecation-omniauth-facebook.yml
new file mode 100644
index 00000000000..f0ef0429a9c
--- /dev/null
+++ b/data/deprecations/16-2-deprecation-omniauth-facebook.yml
@@ -0,0 +1,11 @@
+- title: "OmniAuth Facebook is deprecated"  # (required) Clearly explain the change, or planned change. For example, "The `confidential` field for a `Note` is deprecated" or "CI/CD job names will be limited to 250 characters."
+  removal_milestone: "17.0"  # (required) The milestone when this feature is planned to be removed
+  announcement_milestone: "16.2"  # (required) The milestone when this feature was first announced as deprecated.
+  announcement_date: "2023-07-22"  # (required) The date of the milestone release when this feature was first announced as deprecated. This should almost always be the 22nd of a month (YYYY-MM-22), unless you did an out of band blog post.
+  removal_date: "2024-05-22"  # (required) The date of the milestone release when this feature is planned to be removed. This should almost always be the 22nd of a month (YYYY-MM-22), unless you did an out of band blog post.
+  breaking_change: true  # (required) Change to false if this is not a breaking change.
+  reporter: hsutor  # (required) GitLab username of the person reporting the change
+  stage: Manage  # (required) String value of the stage that the feature was created in. e.g., Growth
+  issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/416000  # (required) Link to the deprecation issue in GitLab
+  body: |  # (required) Do not modify this line, instead modify the lines below.
+    OmniAuth Facebook support will be removed in GitLab 17.0. The last gem release was in 2021 and it is currently unmaintained. The current usage is less than 0.1%. If you use OmniAuth Facebook, switch to a [supported provider](https://docs.gitlab.com/ee/integration/omniauth.html#supported-providers) in advance of support removal.
diff --git a/db/migrate/20230621072726_add_description_to_ci_variable.rb b/db/migrate/20230621072726_add_description_to_ci_variable.rb
new file mode 100644
index 00000000000..c14afca60bb
--- /dev/null
+++ b/db/migrate/20230621072726_add_description_to_ci_variable.rb
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+class AddDescriptionToCiVariable < Gitlab::Database::Migration[2.1]
+  enable_lock_retries!
+
+  # rubocop:disable Migration/AddLimitToTextColumns
+  # text limit is added in a 20230621072848_add_text_limit_to_ci_variable_description.rb migration
+  def change
+    add_column(:ci_variables, :description, :text)
+  end
+  # rubocop:enable Migration/AddLimitToTextColumns
+end
diff --git a/db/migrate/20230621083004_add_description_to_ci_group_variable.rb b/db/migrate/20230621083004_add_description_to_ci_group_variable.rb
new file mode 100644
index 00000000000..933c4079c4c
--- /dev/null
+++ b/db/migrate/20230621083004_add_description_to_ci_group_variable.rb
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+class AddDescriptionToCiGroupVariable < Gitlab::Database::Migration[2.1]
+  enable_lock_retries!
+
+  # rubocop:disable Migration/AddLimitToTextColumns
+  # text limit is added in a 20230621083052_add_text_limit_to_ci_group_variable_description.rb migration
+  def change
+    add_column(:ci_group_variables, :description, :text)
+  end
+  # rubocop:enable Migration/AddLimitToTextColumns
+end
diff --git a/db/post_migrate/20230621072848_add_text_limit_to_ci_variable_description.rb b/db/post_migrate/20230621072848_add_text_limit_to_ci_variable_description.rb
new file mode 100644
index 00000000000..485ac8bae61
--- /dev/null
+++ b/db/post_migrate/20230621072848_add_text_limit_to_ci_variable_description.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class AddTextLimitToCiVariableDescription < Gitlab::Database::Migration[2.1]
+  disable_ddl_transaction!
+
+  TABLE_NAME = :ci_variables
+  COLUMN_NAME = :description
+
+  def up
+    add_text_limit(TABLE_NAME, COLUMN_NAME, 255)
+  end
+
+  def down
+    remove_text_limit(TABLE_NAME, COLUMN_NAME)
+  end
+end
diff --git a/db/post_migrate/20230621083052_add_text_limit_to_ci_group_variable_description.rb b/db/post_migrate/20230621083052_add_text_limit_to_ci_group_variable_description.rb
new file mode 100644
index 00000000000..b0a5a3d539b
--- /dev/null
+++ b/db/post_migrate/20230621083052_add_text_limit_to_ci_group_variable_description.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class AddTextLimitToCiGroupVariableDescription < Gitlab::Database::Migration[2.1]
+  disable_ddl_transaction!
+
+  TABLE_NAME = :ci_group_variables
+  COLUMN_NAME = :description
+
+  def up
+    add_text_limit(TABLE_NAME, COLUMN_NAME, 255)
+  end
+
+  def down
+    remove_text_limit(TABLE_NAME, COLUMN_NAME)
+  end
+end
diff --git a/db/schema_migrations/20230621072726 b/db/schema_migrations/20230621072726
new file mode 100644
index 00000000000..333aeda18b3
--- /dev/null
+++ b/db/schema_migrations/20230621072726
@@ -0,0 +1 @@
+56bf488ec781f8db5ec1723c6a749c0d80140781a1eb3a07984abeddd7d6e88e
\ No newline at end of file
diff --git a/db/schema_migrations/20230621072848 b/db/schema_migrations/20230621072848
new file mode 100644
index 00000000000..0c69a850bd5
--- /dev/null
+++ b/db/schema_migrations/20230621072848
@@ -0,0 +1 @@
+4add5ff0aacac0f287e7aad63a5c0361091d9467bbabc03117750fdbd83681b5
\ No newline at end of file
diff --git a/db/schema_migrations/20230621083004 b/db/schema_migrations/20230621083004
new file mode 100644
index 00000000000..9cf899b3495
--- /dev/null
+++ b/db/schema_migrations/20230621083004
@@ -0,0 +1 @@
+e5b653b4cdee96f1160950ca6885609f393d49f9b7a4cdd3be3e1dac07fc3add
\ No newline at end of file
diff --git a/db/schema_migrations/20230621083052 b/db/schema_migrations/20230621083052
new file mode 100644
index 00000000000..edd3c6df2fe
--- /dev/null
+++ b/db/schema_migrations/20230621083052
@@ -0,0 +1 @@
+7aa6e43678d3e7421fc80c6705daab68c219fa715b8a18ef6c9fdc5df304f8c0
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 66df68e8b6c..bc3d41bfe45 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -13338,7 +13338,9 @@ CREATE TABLE ci_group_variables (
     variable_type smallint DEFAULT 1 NOT NULL,
     environment_scope text DEFAULT '*'::text NOT NULL,
     raw boolean DEFAULT false NOT NULL,
-    CONSTRAINT check_dfe009485a CHECK ((char_length(environment_scope) <= 255))
+    description text,
+    CONSTRAINT check_dfe009485a CHECK ((char_length(environment_scope) <= 255)),
+    CONSTRAINT check_e2e50ff879 CHECK ((char_length(description) <= 255))
 );
 
 CREATE SEQUENCE ci_group_variables_id_seq
@@ -14185,7 +14187,9 @@ CREATE TABLE ci_variables (
     environment_scope character varying DEFAULT '*'::character varying NOT NULL,
     masked boolean DEFAULT false NOT NULL,
     variable_type smallint DEFAULT 1 NOT NULL,
-    raw boolean DEFAULT false NOT NULL
+    raw boolean DEFAULT false NOT NULL,
+    description text,
+    CONSTRAINT check_7e46c006aa CHECK ((char_length(description) <= 255))
 );
 
 CREATE SEQUENCE ci_variables_id_seq
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index ad111312f86..989cfa3d87f 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -12749,12 +12749,11 @@ Represents the total number of issues and their weights for a particular day.
 
 ##### `CiCatalogResource.versions`
 
-Versions of the catalog resource.
+Versions of the catalog resource. This field can only be resolved for one catalog resource in any single request.
 
 WARNING:
-**Deprecated** in 16.1.
-Causes performance degradation.
-Use: `latest_version`.
+**Introduced** in 16.2.
+This feature is an Experiment. It can be changed or removed at any time.
 
 Returns [`ReleaseConnection`](#releaseconnection).
 
@@ -12908,6 +12907,7 @@ CI/CD variables for a group.
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
+| <a id="cigroupvariabledescription"></a>`description` | [`String`](#string) | Description of the variable. |
 | <a id="cigroupvariableenvironmentscope"></a>`environmentScope` | [`String`](#string) | Scope defining the environments that can use the variable. |
 | <a id="cigroupvariableid"></a>`id` | [`ID!`](#id) | ID of the variable. |
 | <a id="cigroupvariablekey"></a>`key` | [`String`](#string) | Name of the variable. |
@@ -13091,6 +13091,7 @@ CI/CD variables for a project.
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
+| <a id="ciprojectvariabledescription"></a>`description` | [`String`](#string) | Description of the variable. |
 | <a id="ciprojectvariableenvironmentscope"></a>`environmentScope` | [`String`](#string) | Scope defining the environments that can use the variable. |
 | <a id="ciprojectvariableid"></a>`id` | [`ID!`](#id) | ID of the variable. |
 | <a id="ciprojectvariablekey"></a>`key` | [`String`](#string) | Name of the variable. |
diff --git a/doc/api/group_level_variables.md b/doc/api/group_level_variables.md
index 56242e16478..08fb9e55f32 100644
--- a/doc/api/group_level_variables.md
+++ b/doc/api/group_level_variables.md
@@ -31,7 +31,8 @@ curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/a
         "protected": false,
         "masked": false,
         "raw": false,
-        "environment_scope": "*"
+        "environment_scope": "*",
+        "description": null
     },
     {
         "key": "TEST_VARIABLE_2",
@@ -40,7 +41,8 @@ curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/a
         "protected": false,
         "masked": false,
         "raw": false,
-        "environment_scope": "*"
+        "environment_scope": "*",
+        "description": null
     }
 ]
 ```
@@ -70,7 +72,8 @@ curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/a
     "protected": false,
     "masked": false,
     "raw": false,
-    "environment_scope": "*"
+    "environment_scope": "*",
+    "description": null
 }
 ```
 
@@ -92,6 +95,7 @@ POST /groups/:id/variables
 | `masked`                          | boolean        | No       | Whether the variable is masked |
 | `raw`                             | boolean        | No       | Whether the variable is treated as a raw string. Default: `false`. When `true`, variables in the value are not [expanded](../ci/variables/index.md#prevent-cicd-variable-expansion). |
 | `environment_scope` **(PREMIUM)** | string         | No       | The [environment scope](../ci/environments/index.md#limit-the-environment-scope-of-a-cicd-variable) of a variable |
+| `description`                     | string         | No       | The `description` of the variable. Default: `null` |
 
 ```shell
 curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" \
@@ -106,7 +110,8 @@ curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" \
     "protected": false,
     "masked": false,
     "raw": false,
-    "environment_scope": "*"
+    "environment_scope": "*",
+    "description": null
 }
 ```
 
@@ -128,6 +133,7 @@ PUT /groups/:id/variables/:key
 | `masked`                          | boolean        | No       | Whether the variable is masked |
 | `raw`                             | boolean        | No       | Whether the variable is treated as a raw string. Default: `false`. When `true`, variables in the value are not [expanded](../ci/variables/index.md#prevent-cicd-variable-expansion). |
 | `environment_scope` **(PREMIUM)** | string         | No       | The [environment scope](../ci/environments/index.md#limit-the-environment-scope-of-a-cicd-variable) of a variable |
+| `description`                     | string         | No       | The description of the variable. Default: `null`. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/409641) in GitLab 16.2. |
 
 ```shell
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" \
@@ -142,7 +148,8 @@ curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" \
     "protected": true,
     "masked": true,
     "raw": true,
-    "environment_scope": "*"
+    "environment_scope": "*",
+    "description": null
 }
 ```
 
diff --git a/doc/api/project_level_variables.md b/doc/api/project_level_variables.md
index f9818b683a0..46e491453f9 100644
--- a/doc/api/project_level_variables.md
+++ b/doc/api/project_level_variables.md
@@ -32,7 +32,8 @@ curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/a
         "protected": false,
         "masked": true,
         "raw": false,
-        "environment_scope": "*"
+        "environment_scope": "*",
+        "description": null
     },
     {
         "variable_type": "env_var",
@@ -41,7 +42,8 @@ curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/a
         "protected": false,
         "masked": false,
         "raw": false,
-        "environment_scope": "*"
+        "environment_scope": "*",
+        "description": null
     }
 ]
 ```
@@ -73,7 +75,8 @@ curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/a
     "protected": false,
     "masked": true,
     "raw": false,
-    "environment_scope": "*"
+    "environment_scope": "*",
+    "description": null
 }
 ```
 
@@ -97,6 +100,7 @@ POST /projects/:id/variables
 | `masked`            | boolean        | No       | Whether the variable is masked. Default: `false` |
 | `raw`               | boolean        | No       | Whether the variable is treated as a raw string. Default: `false`. When `true`, variables in the value are not [expanded](../ci/variables/index.md#prevent-cicd-variable-expansion). |
 | `environment_scope` | string         | No       | The `environment_scope` of the variable. Default: `*` |
+| `description`       | string         | No       | The description of the variable. Default: `null`. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/409641) in GitLab 16.2. |
 
 ```shell
 curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" \
@@ -111,7 +115,8 @@ curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" \
     "protected": false,
     "masked": false,
     "raw": false,
-    "environment_scope": "*"
+    "environment_scope": "*",
+    "description": null
 }
 ```
 
@@ -135,6 +140,7 @@ PUT /projects/:id/variables/:key
 | `raw`               | boolean        | No       | Whether the variable is treated as a raw string. Default: `false`. When `true`, variables in the value are not [expanded](../ci/variables/index.md#prevent-cicd-variable-expansion). |
 | `environment_scope` | string         | No       | The `environment_scope` of the variable |
 | `filter`            | hash           | No       | Available filters: `[environment_scope]`. See the [`filter` parameter details](#the-filter-parameter). |
+| `description`       | string         | No       | The description of the variable. Default: `null`. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/409641) in GitLab 16.2. |
 
 ```shell
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" \
@@ -149,7 +155,8 @@ curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" \
     "protected": true,
     "masked": false,
     "raw": false,
-    "environment_scope": "*"
+    "environment_scope": "*",
+    "description": "null"
 }
 ```
 
diff --git a/doc/development/ai_architecture.md b/doc/development/ai_architecture.md
index ac62f50baf5..f497047ccce 100644
--- a/doc/development/ai_architecture.md
+++ b/doc/development/ai_architecture.md
@@ -40,7 +40,7 @@ package "AI API" as AIF {
   node "Vertex AI"
 }
 
-package GitLab { 
+package GitLab {
   node "Web IDE"
 
   package "Web" {
@@ -106,3 +106,24 @@ The following models have been approved for use:
 The following vector stores have been approved for use:
 
 - [`pgvector`](https://github.com/pgvector/pgvector) is a Postgres extension adding support for storing vector embeddings and calculating ANN (approximate nearest neighbor).
+
+### Indexing Update
+
+We are currently using sequential scan, which provides perfect recall. We are considering adding an index if we can ensure that it still produces accurate results, as noted in the `pgvector` indexing [documentation](https://github.com/pgvector/pgvector#indexing).
+
+Given that the table contains thousands of entries, indexing with these updated settings would likely improve search speed while maintaining high accuracy. However, more testing may be needed to verify the optimal configuration for this dataset size before deploying to production.
+
+A [draft MR](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/122035) has been created to update the index.
+
+The index function has been updated to improve search quality. This was tested locally by setting the `ivfflat.probes` value to `10` with the following SQL command:
+
+```ruby
+Embedding::TanukiBotMvc.connection.execute("SET ivfflat.probes = 10")
+```
+
+Setting the `probes` value for indexing improves results, as per the neighbor [documentation](https://github.com/ankane/neighbor#indexing).
+
+For optimal `probes` and `lists` values:
+
+- Use `lists` equal to `rows / 1000` for tables with up to 1 million rows and `sqrt(rows)` for larger datasets.
+- For `probes` start with `lists / 10` for tables up to 1 million rows and `sqrt(lists)` for larger datasets.
diff --git a/doc/development/database/multiple_databases.md b/doc/development/database/multiple_databases.md
index c2e0bf0c575..778876dce33 100644
--- a/doc/development/database/multiple_databases.md
+++ b/doc/development/database/multiple_databases.md
@@ -26,8 +26,8 @@ Each table of GitLab needs to have a `gitlab_schema` assigned:
 - `gitlab_main`: describes all tables that are being stored in the `main:` database (for example, like `projects`, `users`).
 - `gitlab_ci`: describes all CI tables that are being stored in the `ci:` database (for example, `ci_pipelines`, `ci_builds`).
 - `gitlab_geo`: describes all Geo tables that are being stored in the `geo:` database (for example, like `project_registry`, `secondary_usage_data`).
-- `gitlab_shared`: describe all application tables that contain data across all decomposed databases (for example, `loose_foreign_keys_deleted_records`) for models that inherit from `Gitlab::Database::SharedModel`.
-- `gitlab_internal`: describe all internal tables of Rails and PostgreSQL (for example, `ar_internal_metadata`, `schema_migrations`, `pg_*`).
+- `gitlab_shared`: describes all application tables that contain data across all decomposed databases (for example, `loose_foreign_keys_deleted_records`) for models that inherit from `Gitlab::Database::SharedModel`.
+- `gitlab_internal`: describes all internal tables of Rails and PostgreSQL (for example, `ar_internal_metadata`, `schema_migrations`, `pg_*`).
 - `gitlab_pm`: describes all tables that store `package_metadata` (it is an alias for `gitlab_main`).
 - `...`: more schemas to be introduced with additional decomposed databases
 
diff --git a/doc/development/gems.md b/doc/development/gems.md
index 5f42fc7f43c..0a8b8407461 100644
--- a/doc/development/gems.md
+++ b/doc/development/gems.md
@@ -93,7 +93,7 @@ You can see example adding a new gem: [!121676](https://gitlab.com/gitlab-org/gi
    end
    ```
 
-1. Update `gems/gitlab-<name-of-gem>/.rubocop` with:
+1. Update `gems/<name-of-gem>/.rubocop` with:
 
    ```yaml
    inherit_from:
@@ -112,60 +112,28 @@ You can see example adding a new gem: [!121676](https://gitlab.com/gitlab-org/gi
 
 1. Configure CI for a newly added Gem:
 
-   - Add `gems/gitlab-<name-of-gem>/.gitlab-ci.yml`:
+   - Add `gems/<name-of-gem>/.gitlab-ci.yml`:
 
      ```yaml
-     workflow:
-       rules:
-         - if: $CI_MERGE_REQUEST_ID
-
-     rspec:
-       image: "ruby:${RUBY_VERSION}"
-       cache:
-         key: gitlab-<name-of-gem>-${RUBY_VERSION}
-         paths:
-           - gitlab-<name-of-gem>/vendor/ruby
-       before_script:
-         - cd gems/gitlab-<name-of-gem>
-         - ruby -v                                   # Print out ruby version for debugging
-         - gem install bundler --no-document         # Bundler is not installed with the image
-         - bundle config set --local path 'vendor'   # Install dependencies into ./vendor/ruby
-         - bundle config set with 'development'
-         - bundle config set --local frozen 'true'   # Disallow Gemfile.lock changes on CI
-         - bundle config                             # Show bundler configuration
-         - bundle install -j $(nproc)
-       script:
-         - bundle exec rspec
-       parallel:
-         matrix:
-           - RUBY_VERSION: ["2.7", "3.0", "3.1", "3.2"]
-     ```
-
-   - To `.gitlab/ci/rules.gitlab-ci.yml` add:
-
-     ```yaml
-     .gems:rules:gitlab-<name-of-gem>:
-       rules:
-         - <<: *if-merge-request
-           changes: ["gems/gitlab-<name-of-gem>/**/*"]
+     include:
+       - local: gems/gem.gitlab-ci.yml
+         inputs:
+           gem_name: "<name-of-gem>"
      ```
 
    - To `.gitlab/ci/gitlab-gems.gitlab-ci.yml` add:
 
      ```yaml
-     gems gitlab-<name-of-gem>:
-       extends:
-         - .gems:rules:gitlab-<name-of-gem>
-       needs: []
-       trigger:
-         include: gems/gitlab-<name-of-gem>/.gitlab-ci.yml
-         strategy: depend
+     include:
+       - local: .gitlab/ci/templates/gem.gitlab-ci.yml
+         inputs:
+           gem_name: "<name-of-gem>"
      ```
 
 1. Reference Gem in `Gemfile` with:
 
    ```ruby
-   gem 'gitlab-<name-of-gem>', path: 'gems/gitlab-<name-of-gem>'
+   gem '<name-of-gem>', path: 'gems/<name-of-gem>'
    ```
 
 ### Examples of Gem extractions
diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md
index 66341dd281c..fbaf8ae5e0e 100644
--- a/doc/update/deprecations.md
+++ b/doc/update/deprecations.md
@@ -342,6 +342,20 @@ settings for the group using either the GitLab UI or GraphQL API.
 
 <div class="deprecation breaking-change" data-milestone="17.0">
 
+### OmniAuth Facebook is deprecated
+
+<div class="deprecation-notes">
+- Announced in: GitLab <span class="milestone">16.2</span>
+- This is a [breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change).
+- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/issues/416000).
+</div>
+
+OmniAuth Facebook support will be removed in GitLab 17.0. The last gem release was in 2021 and it is currently unmaintained. The current usage is less than 0.1%. If you use OmniAuth Facebook, switch to a [supported provider](https://docs.gitlab.com/ee/integration/omniauth.html#supported-providers) in advance of support removal.
+
+</div>
+
+<div class="deprecation breaking-change" data-milestone="17.0">
+
 ### Package pipelines in API payload is paginated
 
 <div class="deprecation-notes">
diff --git a/gems/activerecord-gitlab/.gitlab-ci.yml b/gems/activerecord-gitlab/.gitlab-ci.yml
index f0007f003e8..eb94904ce90 100644
--- a/gems/activerecord-gitlab/.gitlab-ci.yml
+++ b/gems/activerecord-gitlab/.gitlab-ci.yml
@@ -1,24 +1,4 @@
-workflow:
-  rules:
-    - if: $CI_MERGE_REQUEST_ID
-
-rspec:
-  image: "ruby:${RUBY_VERSION}"
-  cache:
-    key: activerecord-gitlab
-    paths:
-      - activerecord-gitlab/vendor/ruby
-  before_script:
-    - cd gems/activerecord-gitlab
-    - ruby -v                                   # Print out ruby version for debugging
-    - gem install bundler --no-document         # Bundler is not installed with the image
-    - bundle config set --local path 'vendor'   # Install dependencies into ./vendor/ruby
-    - bundle config set with 'development'
-    - bundle config set --local frozen 'true'   # Disallow Gemfile.lock changes on CI
-    - bundle config                             # Show bundler configuration
-    - bundle install -j $(nproc)
-  script:
-    - bundle exec rspec
-  parallel:
-    matrix:
-      - RUBY_VERSION: ["2.7", "3.0", "3.1", "3.2"]
+include:
+  - local: gems/gem.gitlab-ci.yml
+    inputs:
+      gem_name: "activerecord-gitlab"
diff --git a/gems/gem.gitlab-ci.yml b/gems/gem.gitlab-ci.yml
new file mode 100644
index 00000000000..63be78c6edb
--- /dev/null
+++ b/gems/gem.gitlab-ci.yml
@@ -0,0 +1,41 @@
+# The template generates jobs for gems vendored in the main GitLab project under `gems/`.
+#
+# Inputs
+# - `gem_name`: The name of the gem, i.e. if the gem is located at `gems/gitlab-rspec`, `gem_name` should be set to `gitlab-rspec`.
+spec:
+  inputs:
+    gem_name:
+---
+workflow:
+  rules:
+    - if: $CI_MERGE_REQUEST_ID
+
+default:
+  image: "ruby:${RUBY_VERSION}"
+  cache:
+    key: "$[[inputs.gem_name]]-${RUBY_VERSION}"
+    paths:
+      - "gems/$[[inputs.gem_name]]/vendor/ruby"
+  before_script:
+    - cd gems/$[[inputs.gem_name]]
+    - ruby -v                                   # Print out ruby version for debugging
+    - gem install bundler --no-document         # Bundler is not installed with the image
+    - bundle config set --local path 'vendor'   # Install dependencies into ./vendor/ruby
+    - bundle config set with 'development'
+    - bundle config set --local frozen 'true'   # Disallow Gemfile.lock changes on CI
+    - bundle config                             # Show bundler configuration
+    - bundle install -j $(nproc)
+
+rubocop:
+  script:
+    - bundle exec rubocop --config .rubocop.yml
+  parallel:
+    matrix:
+      - RUBY_VERSION: ["3.0", "3.1", "3.2"]
+
+rspec:
+  script:
+    - bundle exec rspec
+  parallel:
+    matrix:
+      - RUBY_VERSION: ["3.0", "3.1", "3.2"]
diff --git a/gems/gitlab-rspec/.gitlab-ci.yml b/gems/gitlab-rspec/.gitlab-ci.yml
index 95bdc51cb7d..910b391a0e9 100644
--- a/gems/gitlab-rspec/.gitlab-ci.yml
+++ b/gems/gitlab-rspec/.gitlab-ci.yml
@@ -1,31 +1,4 @@
-# You can override the included template(s) by including variable overrides
-# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
-# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
-# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
-# Note that environment variables can be set in several places
-# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
-
-workflow:
-  rules:
-    - if: $CI_MERGE_REQUEST_ID
-
-rspec:
-  image: "ruby:${RUBY_VERSION}"
-  cache:
-    key: gitlab-rspec-${RUBY_VERSION}
-    paths:
-      - gitlab-rspec/vendor/ruby
-  before_script:
-    - cd gems/gitlab-rspec
-    - ruby -v                                   # Print out ruby version for debugging
-    - gem install bundler --no-document         # Bundler is not installed with the image
-    - bundle config set --local path 'vendor'   # Install dependencies into ./vendor/ruby
-    - bundle config set with 'development'
-    - bundle config set --local frozen 'true'   # Disallow Gemfile.lock changes on CI
-    - bundle config                             # Show bundler configuration
-    - bundle install -j $(nproc)
-  script:
-    - bundle exec rspec
-  parallel:
-    matrix:
-      - RUBY_VERSION: ["2.7", "3.0", "3.1", "3.2"]
+include:
+  - local: gems/gem.gitlab-ci.yml
+    inputs:
+      gem_name: "gitlab-rspec"
diff --git a/gems/gitlab-rspec/Gemfile b/gems/gitlab-rspec/Gemfile
index 78f8c3d0b36..be173b205f7 100644
--- a/gems/gitlab-rspec/Gemfile
+++ b/gems/gitlab-rspec/Gemfile
@@ -3,16 +3,3 @@
 source "https://rubygems.org"
 
 gemspec
-
-gem "rspec", "~> 3.0"
-gem 'nokogiri', '~> 1.15.2'
-
-group :development, :test do
-  gem 'rubocop'
-  gem 'rubocop-rspec', '~> 2.18.1'
-  gem 'factory_bot_rails', '~> 6.2.0'
-  gem 'gitlab-styles', '~> 10.0.0', require: false
-  gem 'rspec-rails', '~> 6.0.1'
-  gem 'rspec-parameterized', '~> 1.0'
-  gem 'rspec-benchmark', '~> 0.6.0'
-end
diff --git a/gems/gitlab-rspec/Gemfile.lock b/gems/gitlab-rspec/Gemfile.lock
index 819a6237a90..6ccdedfe23c 100644
--- a/gems/gitlab-rspec/Gemfile.lock
+++ b/gems/gitlab-rspec/Gemfile.lock
@@ -168,12 +168,10 @@ DEPENDENCIES
   factory_bot_rails (~> 6.2.0)
   gitlab-rspec!
   gitlab-styles (~> 10.0.0)
-  nokogiri (~> 1.15.2)
-  rspec (~> 3.0)
   rspec-benchmark (~> 0.6.0)
   rspec-parameterized (~> 1.0)
   rspec-rails (~> 6.0.1)
-  rubocop
+  rubocop (~> 1.21)
   rubocop-rspec (~> 2.18.1)
 
 BUNDLED WITH
diff --git a/gems/gitlab-rspec/gitlab-rspec.gemspec b/gems/gitlab-rspec/gitlab-rspec.gemspec
index 061647190ec..2fa17b257ce 100644
--- a/gems/gitlab-rspec/gitlab-rspec.gemspec
+++ b/gems/gitlab-rspec/gitlab-rspec.gemspec
@@ -8,15 +8,23 @@ Gem::Specification.new do |spec|
   spec.authors = ["group::tenant-scale"]
   spec.email = ["engineering@gitlab.com"]
 
-  spec.summary = "GitLab's RSpec extensions"
+  spec.summary = "GitLab RSpec extensions"
   spec.description = "A set of useful helpers to configure RSpec with various stubs and CI configs."
   spec.homepage = "https://gitlab.com/gitlab-org/gitlab/-/tree/master/gems/gitlab-rspec"
   spec.license = "MIT"
   spec.required_ruby_version = ">= 3.0"
+  spec.metadata["rubygems_mfa_required"] = "true"
 
-  spec.files = Dir['lib/**/*.rb']
-  spec.test_files = Dir['spec/**/*']
+  spec.files = Dir["lib/**/*.rb"]
   spec.require_paths = ["lib"]
 
-  spec.add_dependency "rspec", "~> 3.0"
+  spec.add_runtime_dependency "rspec", "~> 3.0"
+
+  spec.add_development_dependency "factory_bot_rails", "~> 6.2.0"
+  spec.add_development_dependency "gitlab-styles", "~> 10.0.0"
+  spec.add_development_dependency "rspec-benchmark", "~> 0.6.0"
+  spec.add_development_dependency "rspec-parameterized", "~> 1.0"
+  spec.add_development_dependency "rspec-rails", "~> 6.0.1"
+  spec.add_development_dependency "rubocop", "~> 1.21"
+  spec.add_development_dependency "rubocop-rspec", "~> 2.18.1"
 end
diff --git a/gems/gitlab-utils/.gitlab-ci.yml b/gems/gitlab-utils/.gitlab-ci.yml
index ab92953b57d..a9e984d4785 100644
--- a/gems/gitlab-utils/.gitlab-ci.yml
+++ b/gems/gitlab-utils/.gitlab-ci.yml
@@ -1,30 +1,4 @@
-# You can override the included template(s) by including variable overrides
-# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
-# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
-# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
-# Note that environment variables can be set in several places
-# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
-workflow:
-  rules:
-    - if: $CI_MERGE_REQUEST_ID
-
-rspec:
-  image: "ruby:${RUBY_VERSION}"
-  cache:
-    key: gitlab-utils-${RUBY_VERSION}
-    paths:
-      - gitlab-utils/vendor/ruby
-  before_script:
-    - cd gems/gitlab-utils
-    - ruby -v                                   # Print out ruby version for debugging
-    - gem install bundler --no-document         # Bundler is not installed with the image
-    - bundle config set --local path 'vendor'   # Install dependencies into ./vendor/ruby
-    - bundle config set with 'development'
-    - bundle config set --local frozen 'true'   # Disallow Gemfile.lock changes on CI
-    - bundle config                             # Show bundler configuration
-    - bundle install -j $(nproc)
-  script:
-    - bundle exec rspec
-  parallel:
-    matrix:
-      - RUBY_VERSION: ["2.7", "3.0", "3.1", "3.2"]
+include:
+  - local: gems/gem.gitlab-ci.yml
+    inputs:
+      gem_name: "gitlab-utils"
diff --git a/gems/gitlab-utils/gitlab-utils.gemspec b/gems/gitlab-utils/gitlab-utils.gemspec
index 15e40ecc279..ec11ed271e1 100644
--- a/gems/gitlab-utils/gitlab-utils.gemspec
+++ b/gems/gitlab-utils/gitlab-utils.gemspec
@@ -8,27 +8,27 @@ Gem::Specification.new do |spec|
   spec.authors = ["group::tenant scale"]
   spec.email = ["engineering@gitlab.com"]
 
-  spec.summary = "GitLab's common helper methods"
+  spec.summary = "GitLab common helper methods"
   spec.description = "A set of useful helpers methods to perform various conversions and checks."
-  spec.homepage = 'https://gitlab.com/gitlab-org/gitlab/-/tree/master/gems/gitlab-utils'
-  spec.license = 'MIT'
+  spec.homepage = "https://gitlab.com/gitlab-org/gitlab/-/tree/master/gems/gitlab-utils"
+  spec.license = "MIT"
   spec.required_ruby_version = ">= 3.0"
+  spec.metadata["rubygems_mfa_required"] = "true"
 
-  spec.files = Dir['lib/**/*.rb']
-  spec.test_files = Dir['spec/**/*']
+  spec.files = Dir["lib/**/*.rb"]
   spec.require_paths = ["lib"]
 
-  spec.add_runtime_dependency 'actionview', '>= 6.1.7.2'
-  spec.add_runtime_dependency 'activesupport', '>= 6.1.7.2'
-  spec.add_runtime_dependency 'addressable', '~> 2.8'
-  spec.add_runtime_dependency 'nokogiri', '~> 1.15.2'
-  spec.add_runtime_dependency 'rake', '~> 13.0'
+  spec.add_runtime_dependency "actionview", ">= 6.1.7.2"
+  spec.add_runtime_dependency "activesupport", ">= 6.1.7.2"
+  spec.add_runtime_dependency "addressable", "~> 2.8"
+  spec.add_runtime_dependency "nokogiri", "~> 1.15.2"
+  spec.add_runtime_dependency "rake", "~> 13.0"
 
-  spec.add_development_dependency 'factory_bot_rails', '~> 6.2.0'
-  spec.add_development_dependency 'gitlab-styles', '~> 10.0.0'
-  spec.add_development_dependency 'rspec-benchmark', '~> 0.6.0'
-  spec.add_development_dependency 'rspec-parameterized', '~> 1.0'
-  spec.add_development_dependency 'rspec-rails', '~> 6.0.1'
-  spec.add_development_dependency 'rubocop', '~> 1.21'
-  spec.add_development_dependency 'rubocop-rspec', '~> 2.18.1'
+  spec.add_development_dependency "factory_bot_rails", "~> 6.2.0"
+  spec.add_development_dependency "gitlab-styles", "~> 10.0.0"
+  spec.add_development_dependency "rspec-benchmark", "~> 0.6.0"
+  spec.add_development_dependency "rspec-parameterized", "~> 1.0"
+  spec.add_development_dependency "rspec-rails", "~> 6.0.1"
+  spec.add_development_dependency "rubocop", "~> 1.21"
+  spec.add_development_dependency "rubocop-rspec", "~> 2.18.1"
 end
diff --git a/lib/api/ci/variables.rb b/lib/api/ci/variables.rb
index f5331eb75da..49a6ec279fb 100644
--- a/lib/api/ci/variables.rb
+++ b/lib/api/ci/variables.rb
@@ -63,6 +63,7 @@ module API
           optional :raw, type: Boolean, desc: 'Whether the variable will be expanded'
           optional :variable_type, type: String, values: ::Ci::Variable.variable_types.keys, desc: 'The type of the variable. Default: env_var'
           optional :environment_scope, type: String, desc: 'The environment_scope of the variable'
+          optional :description, type: String, desc: 'The description of the variable'
         end
         post ':id/variables' do
           variable = ::Ci::ChangeVariableService.new(
@@ -95,6 +96,7 @@ module API
           optional :filter, type: Hash, desc: 'Available filters: [environment_scope]. Example: filter[environment_scope]=production' do
             optional :environment_scope, type: String, desc: 'The environment scope of a variable'
           end
+          optional :description, type: String, desc: 'The description of the variable'
         end
         # rubocop: disable CodeReuse/ActiveRecord
         put ':id/variables/:key' do
diff --git a/lib/api/entities/ci/variable.rb b/lib/api/entities/ci/variable.rb
index 47597cb77be..4336f82fb5e 100644
--- a/lib/api/entities/ci/variable.rb
+++ b/lib/api/entities/ci/variable.rb
@@ -14,6 +14,8 @@ module API
         expose :raw?, as: :raw, if: -> (entity, _) { entity.respond_to?(:raw?) }, documentation: { type: 'boolean' }
         expose :environment_scope, if: -> (entity, _) { entity.respond_to?(:environment_scope) },
                                    documentation: { type: 'string', example: '*' }
+        expose :description, if: -> (entity, _) { entity.respond_to?(:description) },
+                                   documentation: { type: 'string', example: 'This variable is being used for ...' }
       end
     end
   end
diff --git a/lib/api/group_variables.rb b/lib/api/group_variables.rb
index 295bee475c3..f320fa06394 100644
--- a/lib/api/group_variables.rb
+++ b/lib/api/group_variables.rb
@@ -59,6 +59,8 @@ module API
         optional :raw, type: String, desc: 'Whether the variable will be expanded'
         optional :variable_type, type: String, values: ::Ci::GroupVariable.variable_types.keys, desc: 'The type of the variable. Default: env_var'
         optional :environment_scope, type: String, desc: 'The environment scope of a variable'
+        optional :description, type: String, desc: 'The description of the variable'
+
         use :optional_group_variable_params_ee
       end
       post ':id/variables' do
@@ -94,6 +96,7 @@ module API
         optional :raw, type: String, desc: 'Whether the variable will be expanded'
         optional :variable_type, type: String, values: ::Ci::GroupVariable.variable_types.keys, desc: 'The type of the variable. Default: env_var'
         optional :environment_scope, type: String, desc: 'The environment scope of a variable'
+        optional :description, type: String, desc: 'The description of the variable'
 
         use :optional_group_variable_params_ee
       end
diff --git a/qa/qa/page/main/login.rb b/qa/qa/page/main/login.rb
index 3a836210dea..9b8ff92cc9f 100644
--- a/qa/qa/page/main/login.rb
+++ b/qa/qa/page/main/login.rb
@@ -128,8 +128,8 @@ module QA
           '/users/sign_in'
         end
 
-        def has_sign_in_tab?
-          has_element?(:sign_in_tab)
+        def has_sign_in_tab?(wait: Capybara.default_max_wait_time)
+          has_element?(:sign_in_tab, wait: wait)
         end
 
         def has_ldap_tab?
@@ -203,7 +203,6 @@ module QA
 
         def sign_out_and_sign_in_as(user:)
           Menu.perform(&:sign_out_if_signed_in)
-          has_sign_in_tab?
           sign_in_using_credentials(user: user)
         end
 
@@ -225,7 +224,7 @@ module QA
         def sign_in_using_gitlab_credentials(user:, skip_page_validation: false)
           wait_if_retry_later
 
-          switch_to_sign_in_tab if has_sign_in_tab?
+          switch_to_sign_in_tab if has_sign_in_tab?(wait: 0)
           switch_to_standard_tab if has_standard_tab?
 
           fill_in_credential(user)
diff --git a/qa/qa/specs/features/api/5_package/container_registry/saas/container_registry_spec.rb b/qa/qa/specs/features/api/5_package/container_registry/saas/container_registry_spec.rb
index d5073863dff..23d8585d07a 100644
--- a/qa/qa/specs/features/api/5_package/container_registry/saas/container_registry_spec.rb
+++ b/qa/qa/specs/features/api/5_package/container_registry/saas/container_registry_spec.rb
@@ -19,17 +19,17 @@ module QA
         end
       end
 
-      let!(:project_access_token) do
-        QA::Resource::ProjectAccessToken.fabricate_via_api! do |pat|
-          pat.project = project
+      let!(:runner) do
+        Resource::ProjectRunner.fabricate! do |runner|
+          runner.project = project
+          runner.name = "runner-for-#{project.name}"
+          runner.tags = ["runner-for-#{project.name}"]
         end
       end
 
-      let(:registry) do
-        Resource::RegistryRepository.init do |repository|
-          repository.name = project.path_with_namespace
-          repository.project = project
-          repository.tag_name = 'master'
+      let!(:project_access_token) do
+        QA::Resource::ProjectAccessToken.fabricate_via_api! do |pat|
+          pat.project = project
         end
       end
 
@@ -61,6 +61,8 @@ module QA
             - docker build -t $IMAGE_TAG .
             - docker push $IMAGE_TAG
             - docker pull $IMAGE_TAG
+          tags:
+            - "runner-for-#{project.name}"
 
         test:
           image: dwdraju/alpine-curl-jq:latest
@@ -74,9 +76,15 @@ module QA
             - if [ $status_code -ne 200 ]; then exit 1; fi;
             - 'status_code=$(curl --head --output /dev/null --write-out "%{http_code}\n" --header "PRIVATE-TOKEN: #{masked_token}" "https://${CI_SERVER_HOST}/api/v4/projects/#{project.id}/registry/repositories/$id/tags/master")'
             - if [ $status_code -ne 404 ]; then exit 1; fi;
+          tags:
+            - "runner-for-#{project.name}"
         YAML
       end
 
+      after do
+        runner.remove_via_api!
+      end
+
       it 'pushes, pulls image to the registry and deletes tag',
         testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/348001' do
         Support::Retrier.retry_on_exception(max_attempts: 3, sleep_interval: 2, message: "Commit push") do
diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb
index 52991e3ca93..940f6fed906 100644
--- a/spec/controllers/projects/notes_controller_spec.rb
+++ b/spec/controllers/projects/notes_controller_spec.rb
@@ -155,6 +155,12 @@ RSpec.describe Projects::NotesController, type: :controller, feature_category: :
           expect(note_json[:discussion_line_code]).to be_nil
         end
 
+        it 'sets the correct feature category' do
+          get :index, params: params
+
+          expect(::Gitlab::ApplicationContext.current_context_attribute(:feature_category)).to eq('source_code_management')
+        end
+
         context 'when user cannot read commit' do
           before do
             allow(Ability).to receive(:allowed?).and_call_original
@@ -170,6 +176,28 @@ RSpec.describe Projects::NotesController, type: :controller, feature_category: :
       end
     end
 
+    context 'for a snippet note' do
+      let(:project_snippet) { create(:project_snippet, project: project) }
+      let!(:note) { create(:note_on_project_snippet, project: project, noteable: project_snippet) }
+
+      let(:params) { request_params.merge(target_type: 'project_snippet', target_id: project_snippet.id, html: true) }
+
+      it 'responds with the expected attributes' do
+        get :index, params: params
+
+        expect(note_json[:id]).to eq(note.id)
+        expect(note_json[:discussion_html]).to be_nil
+        expect(note_json[:diff_discussion_html]).to be_nil
+        expect(note_json[:discussion_line_code]).to be_nil
+      end
+
+      it 'sets the correct feature category' do
+        get :index, params: params
+
+        expect(::Gitlab::ApplicationContext.current_context_attribute(:feature_category)).to eq('source_code_management')
+      end
+    end
+
     context 'for a merge request note' do
       let!(:note) { create(:note_on_merge_request, project: project) }
 
@@ -289,6 +317,44 @@ RSpec.describe Projects::NotesController, type: :controller, feature_category: :
         end
       end
 
+      context 'on a commit' do
+        let(:commit_id) { RepoHelpers.sample_commit.id }
+        let(:request_params) do
+          {
+            note: { note: note_text, commit_id: commit_id, noteable_type: 'Commit' },
+            namespace_id: project.namespace,
+            project_id: project,
+            target_type: 'commit',
+            target_id: commit_id
+          }
+        end
+
+        it 'sets the correct feature category' do
+          create!
+
+          expect(::Gitlab::ApplicationContext.current_context_attribute(:feature_category)).to eq('source_code_management')
+        end
+      end
+
+      context 'on a project snippet' do
+        let(:project_snippet) { create(:project_snippet, project: project) }
+        let(:request_params) do
+          {
+            note: { note: note_text, noteable_id: project_snippet.id, noteable_type: 'ProjectSnippet' },
+            namespace_id: project.namespace,
+            project_id: project,
+            target_type: 'project_snippet',
+            target_id: project_snippet.id
+          }
+        end
+
+        it 'sets the correct feature category' do
+          create!
+
+          expect(::Gitlab::ApplicationContext.current_context_attribute(:feature_category)).to eq('source_code_management')
+        end
+      end
+
       context 'the project is publically available' do
         context 'for HTML' do
           it "returns status 302" do
diff --git a/spec/frontend/repository/components/__snapshots__/last_commit_spec.js.snap b/spec/frontend/repository/components/__snapshots__/last_commit_spec.js.snap
index 6825d4afecf..8150f6df65c 100644
--- a/spec/frontend/repository/components/__snapshots__/last_commit_spec.js.snap
+++ b/spec/frontend/repository/components/__snapshots__/last_commit_spec.js.snap
@@ -12,6 +12,8 @@ exports[`Repository last commit component renders commit widget 1`] = `
     imgsize="32"
     imgsrc="https://test.com"
     linkhref="/test"
+    popoveruserid=""
+    popoverusername=""
     tooltipplacement="top"
     tooltiptext=""
     username=""
diff --git a/spec/frontend/vue_shared/components/user_avatar/user_avatar_link_spec.js b/spec/frontend/vue_shared/components/user_avatar/user_avatar_link_spec.js
index 90f9156af38..443d4e32580 100644
--- a/spec/frontend/vue_shared/components/user_avatar/user_avatar_link_spec.js
+++ b/spec/frontend/vue_shared/components/user_avatar/user_avatar_link_spec.js
@@ -95,4 +95,18 @@ describe('User Avatar Link Component', () => {
       expect(wrapper.html()).toContain(badge);
     });
   });
+
+  describe('when popover props provided', () => {
+    beforeEach(() => {
+      createWrapper({ popoverUserId: 1, popoverUsername: defaultProps.username });
+    });
+
+    it('should render GlAvatarLink with popover support', () => {
+      expect(wrapper.attributes()).toMatchObject({
+        href: defaultProps.linkHref,
+        'data-user-id': '1',
+        'data-username': `${defaultProps.username}`,
+      });
+    });
+  });
 });
diff --git a/spec/frontend/vue_shared/components/user_avatar/user_avatar_list_spec.js b/spec/frontend/vue_shared/components/user_avatar/user_avatar_list_spec.js
index 075cb753301..32f9df8a63c 100644
--- a/spec/frontend/vue_shared/components/user_avatar/user_avatar_list_spec.js
+++ b/spec/frontend/vue_shared/components/user_avatar/user_avatar_list_spec.js
@@ -14,6 +14,7 @@ const DEFAULT_EMPTY_MESSAGE = 'None';
 const createUser = (id) => ({
   id,
   name: 'Lorem',
+  username: 'lorem.ipsum',
   web_url: `${TEST_HOST}/${id}`,
   avatar_url: `${TEST_HOST}/${id}/avatar`,
 });
@@ -90,6 +91,8 @@ describe('UserAvatarList', () => {
             imgAlt: x.name,
             tooltipText: x.name,
             imgSize: TEST_IMAGE_SIZE,
+            popoverUserId: x.id,
+            popoverUsername: x.username,
           }),
         ),
       );
@@ -107,6 +110,8 @@ describe('UserAvatarList', () => {
             imgAlt: x.name,
             tooltipText: x.name,
             imgSize: TEST_IMAGE_SIZE,
+            popoverUserId: x.id,
+            popoverUsername: x.username,
           }),
         ),
       );
diff --git a/spec/graphql/types/ci/group_variable_type_spec.rb b/spec/graphql/types/ci/group_variable_type_spec.rb
index 106935642f2..ef6d8279523 100644
--- a/spec/graphql/types/ci/group_variable_type_spec.rb
+++ b/spec/graphql/types/ci/group_variable_type_spec.rb
@@ -5,5 +5,7 @@ require 'spec_helper'
 RSpec.describe GitlabSchema.types['CiGroupVariable'] do
   specify { expect(described_class.interfaces).to contain_exactly(Types::Ci::VariableInterface) }
 
-  specify { expect(described_class).to have_graphql_fields(:environment_scope, :masked, :protected).at_least }
+  specify do
+    expect(described_class).to have_graphql_fields(:environment_scope, :masked, :protected, :description).at_least
+  end
 end
diff --git a/spec/graphql/types/ci/project_variable_type_spec.rb b/spec/graphql/types/ci/project_variable_type_spec.rb
index e6e045b2bca..cec0753fcba 100644
--- a/spec/graphql/types/ci/project_variable_type_spec.rb
+++ b/spec/graphql/types/ci/project_variable_type_spec.rb
@@ -5,5 +5,7 @@ require 'spec_helper'
 RSpec.describe GitlabSchema.types['CiProjectVariable'] do
   specify { expect(described_class.interfaces).to contain_exactly(Types::Ci::VariableInterface) }
 
-  specify { expect(described_class).to have_graphql_fields(:environment_scope, :masked, :protected).at_least }
+  specify do
+    expect(described_class).to have_graphql_fields(:environment_scope, :masked, :protected, :description).at_least
+  end
 end
diff --git a/spec/models/ci/group_variable_spec.rb b/spec/models/ci/group_variable_spec.rb
index dfb9d72c57a..5e1e39a929b 100644
--- a/spec/models/ci/group_variable_spec.rb
+++ b/spec/models/ci/group_variable_spec.rb
@@ -13,7 +13,13 @@ RSpec.describe Ci::GroupVariable, feature_category: :secrets_management do
   it { is_expected.to include_module(Presentable) }
   it { is_expected.to include_module(Ci::Maskable) }
   it { is_expected.to include_module(HasEnvironmentScope) }
-  it { is_expected.to validate_uniqueness_of(:key).scoped_to([:group_id, :environment_scope]).with_message(/\(\w+\) has already been taken/) }
+
+  describe 'validations' do
+    it { is_expected.to validate_uniqueness_of(:key).scoped_to([:group_id, :environment_scope]).with_message(/\(\w+\) has already been taken/) }
+    it { is_expected.to allow_values('').for(:description) }
+    it { is_expected.to allow_values(nil).for(:description) }
+    it { is_expected.to validate_length_of(:description).is_at_most(255) }
+  end
 
   describe '.by_environment_scope' do
     let!(:matching_variable) { create(:ci_group_variable, environment_scope: 'production ') }
diff --git a/spec/models/ci/variable_spec.rb b/spec/models/ci/variable_spec.rb
index c5d0f6f661c..c93f355718a 100644
--- a/spec/models/ci/variable_spec.rb
+++ b/spec/models/ci/variable_spec.rb
@@ -15,6 +15,9 @@ RSpec.describe Ci::Variable, feature_category: :secrets_management do
     it { is_expected.to include_module(Ci::Maskable) }
     it { is_expected.to include_module(HasEnvironmentScope) }
     it { is_expected.to validate_uniqueness_of(:key).scoped_to(:project_id, :environment_scope).with_message(/\(\w+\) has already been taken/) }
+    it { is_expected.to allow_values('').for(:description) }
+    it { is_expected.to allow_values(nil).for(:description) }
+    it { is_expected.to validate_length_of(:description).is_at_most(255) }
   end
 
   describe '.by_environment_scope' do
diff --git a/spec/requests/api/ci/variables_spec.rb b/spec/requests/api/ci/variables_spec.rb
index e937c4c2b8f..a1446e1040e 100644
--- a/spec/requests/api/ci/variables_spec.rb
+++ b/spec/requests/api/ci/variables_spec.rb
@@ -48,6 +48,7 @@ RSpec.describe API::Ci::Variables, feature_category: :secrets_management do
         expect(json_response['masked']).to eq(variable.masked?)
         expect(json_response['raw']).to eq(variable.raw?)
         expect(json_response['variable_type']).to eq('env_var')
+        expect(json_response['description']).to be_nil
       end
 
       it 'responds with 404 Not Found if requesting non-existing variable' do
@@ -140,7 +141,7 @@ RSpec.describe API::Ci::Variables, feature_category: :secrets_management do
 
         it 'creates variable with optional attributes' do
           expect do
-            post api("/projects/#{project.id}/variables", user), params: { variable_type: 'file', key: 'TEST_VARIABLE_2', value: 'VALUE_2' }
+            post api("/projects/#{project.id}/variables", user), params: { variable_type: 'file', key: 'TEST_VARIABLE_2', value: 'VALUE_2', description: 'description' }
           end.to change { project.variables.count }.by(1)
 
           expect(response).to have_gitlab_http_status(:created)
@@ -150,6 +151,7 @@ RSpec.describe API::Ci::Variables, feature_category: :secrets_management do
           expect(json_response['masked']).to be_falsey
           expect(json_response['raw']).to be_falsey
           expect(json_response['variable_type']).to eq('file')
+          expect(json_response['description']).to eq('description')
         end
 
         it 'does not allow to duplicate variable key' do
@@ -226,7 +228,7 @@ RSpec.describe API::Ci::Variables, feature_category: :secrets_management do
         initial_variable = project.variables.reload.first
         value_before = initial_variable.value
 
-        put api("/projects/#{project.id}/variables/#{variable.key}", user), params: { variable_type: 'file', value: 'VALUE_1_UP', protected: true }
+        put api("/projects/#{project.id}/variables/#{variable.key}", user), params: { variable_type: 'file', value: 'VALUE_1_UP', protected: true, description: 'updated' }
 
         updated_variable = project.variables.reload.first
 
@@ -235,6 +237,7 @@ RSpec.describe API::Ci::Variables, feature_category: :secrets_management do
         expect(updated_variable.value).to eq('VALUE_1_UP')
         expect(updated_variable).to be_protected
         expect(updated_variable.variable_type).to eq('file')
+        expect(updated_variable.description).to eq('updated')
       end
 
       it 'masks the new value when logging' do
diff --git a/spec/requests/api/group_variables_spec.rb b/spec/requests/api/group_variables_spec.rb
index 6849b087211..d0edc181b65 100644
--- a/spec/requests/api/group_variables_spec.rb
+++ b/spec/requests/api/group_variables_spec.rb
@@ -56,6 +56,7 @@ RSpec.describe API::GroupVariables, feature_category: :secrets_management do
         expect(json_response['protected']).to eq(variable.protected?)
         expect(json_response['variable_type']).to eq(variable.variable_type)
         expect(json_response['environment_scope']).to eq(variable.environment_scope)
+        expect(json_response['description']).to be_nil
       end
 
       it 'responds with 404 Not Found if requesting non-existing variable' do
@@ -115,7 +116,7 @@ RSpec.describe API::GroupVariables, feature_category: :secrets_management do
 
         it 'creates variable with optional attributes' do
           expect do
-            post api("/groups/#{group.id}/variables", user), params: { variable_type: 'file', key: 'TEST_VARIABLE_2', value: 'VALUE_2' }
+            post api("/groups/#{group.id}/variables", user), params: { variable_type: 'file', key: 'TEST_VARIABLE_2', value: 'VALUE_2', description: 'description' }
           end.to change { group.variables.count }.by(1)
 
           expect(response).to have_gitlab_http_status(:created)
@@ -126,6 +127,7 @@ RSpec.describe API::GroupVariables, feature_category: :secrets_management do
           expect(json_response['raw']).to be_falsey
           expect(json_response['variable_type']).to eq('file')
           expect(json_response['environment_scope']).to eq('*')
+          expect(json_response['description']).to eq('description')
         end
 
         it 'does not allow to duplicate variable key' do
@@ -182,7 +184,7 @@ RSpec.describe API::GroupVariables, feature_category: :secrets_management do
         initial_variable = group.variables.reload.first
         value_before = initial_variable.value
 
-        put api("/groups/#{group.id}/variables/#{variable.key}", user), params: { variable_type: 'file', value: 'VALUE_1_UP', protected: true, masked: true, raw: true }
+        put api("/groups/#{group.id}/variables/#{variable.key}", user), params: { variable_type: 'file', value: 'VALUE_1_UP', protected: true, masked: true, raw: true, description: 'updated' }
 
         updated_variable = group.variables.reload.first
 
@@ -193,6 +195,7 @@ RSpec.describe API::GroupVariables, feature_category: :secrets_management do
         expect(json_response['variable_type']).to eq('file')
         expect(json_response['masked']).to be_truthy
         expect(json_response['raw']).to be_truthy
+        expect(json_response['description']).to eq('updated')
       end
 
       it 'masks the new value when logging' do
diff --git a/spec/scripts/trigger-build_spec.rb b/spec/scripts/trigger-build_spec.rb
index 78cc57b6c91..3ac383e8d30 100644
--- a/spec/scripts/trigger-build_spec.rb
+++ b/spec/scripts/trigger-build_spec.rb
@@ -211,6 +211,7 @@ RSpec.describe Trigger, feature_category: :tooling do
           context "when set in a file" do
             before do
               allow(File).to receive(:read).and_call_original
+              stub_env(version_file, nil)
             end
 
             it 'includes the version from the file' do