Add latest changes from gitlab-org/gitlab@master

33 files changed, 260 insertions, 325 deletions

diff --git a/.gitlab/issue_templates/Feature Flag Roll Out.md b/.gitlab/issue_templates/Feature Flag Roll Out.md
index d9e90f616b1..0462742513c 100644
--- a/.gitlab/issue_templates/Feature Flag Roll Out.md
+++ b/.gitlab/issue_templates/Feature Flag Roll Out.md
@@ -119,10 +119,10 @@ To do so, follow these steps:
 - [ ] Create a merge request with the following changes. Ask for review and merge it.
     - [ ] Set the `default_enabled` attribute in [the feature flag definition](https://docs.gitlab.com/ee/development/feature_flags/#feature-flag-definition-and-validation) to `true`.
     - [ ] Create [a changelog entry](https://docs.gitlab.com/ee/development/feature_flags/#changelog).
-- [ ] Ensure that the default-enabling MR has been deployed to both production and canary.
-      If the merge request was deployed before [the code cutoff](https://about.gitlab.com/handbook/engineering/releases/#self-managed-releases-1),
+- [ ] Ensure that the default-enabling MR has been included in the release package.
+      If the merge request was deployed before [the monthly release was tagged](https://about.gitlab.com/handbook/engineering/releases/#self-managed-releases-1),
       the feature can be officially announced in a release blog post.
-    - [ ] `/chatops run auto_deploy status <merge-commit-of-default-enabling-mr>`
+    - [ ] `/chatops run release check <merge-request-url> <milestone>`
 - [ ] Close [the feature issue](ISSUE LINK) to indicate the feature will be released in the current milestone.
 - [ ] Set the next milestone to this rollout issue for scheduling [the flag removal](#release-the-feature).
 - [ ] (Optional) You can [create a separate issue](https://gitlab.com/gitlab-org/gitlab/-/issues/new?issuable_template=Feature%20Flag%20Cleanup) for scheduling the steps below to [Release the feature](#release-the-feature).
@@ -152,10 +152,10 @@ You can either [create a follow-up issue for Feature Flag Cleanup](https://gitla
     - [ ] Remove all references to the feature flag from the codebase.
     - [ ] Remove the YAML definitions for the feature from the repository.
     - [ ] Create [a changelog entry](https://docs.gitlab.com/ee/development/feature_flags/#changelog).
-- [ ] Ensure that the cleanup MR has been deployed to both production and canary.
-      If the merge request was deployed before [the code cutoff](https://about.gitlab.com/handbook/engineering/releases/#self-managed-releases-1),
+- [ ] Ensure that the cleanup MR has been included in the release package.
+      If the merge request was deployed before [the monthly release was tagged](https://about.gitlab.com/handbook/engineering/releases/#self-managed-releases-1),
       the feature can be officially announced in a release blog post.
-    - [ ] `/chatops run auto_deploy status <merge-commit-of-cleanup-mr>`
+    - [ ] `/chatops run release check <merge-request-url> <milestone>`
 - [ ] Close [the feature issue](ISSUE LINK) to indicate the feature will be released in the current milestone.
 - [ ] Clean up the feature flag from all environments by running these chatops command in `#production` channel:
     - [ ] `/chatops run feature delete <feature-flag-name> --dev`
diff --git a/app/assets/javascripts/diffs/components/commit_item.vue b/app/assets/javascripts/diffs/components/commit_item.vue
index 1ccbe0d0d41..42f4ea8eb58 100644
--- a/app/assets/javascripts/diffs/components/commit_item.vue
+++ b/app/assets/javascripts/diffs/components/commit_item.vue
@@ -103,7 +103,7 @@ export default {
       >
         <div
           v-if="commit.signature_html"
-          v-safe-html:[$options.safeHtmlConfig]="commit.signature_html"
+          v-html="commit.signature_html /* eslint-disable-line vue/no-v-html */"
         ></div>
         <commit-pipeline-status
           v-if="commit.pipeline_status_path"
diff --git a/app/assets/javascripts/pages/admin/broadcast_messages/broadcast_message.js b/app/assets/javascripts/pages/admin/broadcast_messages/broadcast_message.js
index 2a7e6a45cdd..18ba89f8856 100644
--- a/app/assets/javascripts/pages/admin/broadcast_messages/broadcast_message.js
+++ b/app/assets/javascripts/pages/admin/broadcast_messages/broadcast_message.js
@@ -2,52 +2,41 @@ import $ from 'jquery';
 import { debounce } from 'lodash';
 import createFlash from '~/flash';
 import axios from '~/lib/utils/axios_utils';
-import { textColorForBackground } from '~/lib/utils/color_utils';
 import { DEFAULT_DEBOUNCE_AND_THROTTLE_MS } from '~/lib/utils/constants';
 import { __ } from '~/locale';
 
 export default () => {
-  const $broadcastMessageColor = $('.js-broadcast-message-color');
+  const $broadcastMessageTheme = $('.js-broadcast-message-theme');
   const $broadcastMessageType = $('.js-broadcast-message-type');
-  const $broadcastBannerMessagePreview = $('.js-broadcast-banner-message-preview');
+  const $broadcastBannerMessagePreview = $('.js-broadcast-banner-message-preview [role="alert"]');
   const $broadcastMessage = $('.js-broadcast-message-message');
-  const $jsBroadcastMessagePreview = $('.js-broadcast-message-preview');
+  const $jsBroadcastMessagePreview = $('#broadcast-message-preview');
 
   const reloadPreview = function reloadPreview() {
     const previewPath = $broadcastMessage.data('previewPath');
     const message = $broadcastMessage.val();
     const type = $broadcastMessageType.val();
-
-    if (message === '') {
-      $jsBroadcastMessagePreview.text(__('Your message here'));
-    } else {
-      axios
-        .post(previewPath, {
-          broadcast_message: {
-            message,
-            broadcast_type: type,
-          },
-        })
-        .then(({ data }) => {
-          $jsBroadcastMessagePreview.html(data.message);
-        })
-        .catch(() =>
-          createFlash({
-            message: __('An error occurred while rendering preview broadcast message'),
-          }),
-        );
-    }
+    const theme = $broadcastMessageTheme.val();
+
+    axios
+      .post(previewPath, {
+        broadcast_message: {
+          message,
+          broadcast_type: type,
+          theme,
+        },
+      })
+      .then(({ data }) => {
+        $jsBroadcastMessagePreview.html(data);
+      })
+      .catch(() =>
+        createFlash({
+          message: __('An error occurred while rendering preview broadcast message'),
+        }),
+      );
   };
 
-  $broadcastMessageColor.on('input', function onMessageColorInput() {
-    const previewColor = $(this).val();
-    $broadcastBannerMessagePreview.css('background-color', previewColor);
-  });
-
-  $('input#broadcast_message_font').on('input', function onMessageFontInput() {
-    const previewColor = $(this).val();
-    $broadcastBannerMessagePreview.css('color', previewColor);
-  });
+  $broadcastMessageTheme.on('change', reloadPreview);
 
   $broadcastMessageType.on('change', () => {
     const $broadcastMessageColorFormGroup = $('.js-broadcast-message-background-color-form-group');
@@ -68,37 +57,4 @@ export default () => {
       reloadPreview();
     }, DEFAULT_DEBOUNCE_AND_THROTTLE_MS),
   );
-
-  const updateColorPreview = () => {
-    const selectedBackgroundColor = $broadcastMessageColor.val();
-    const contrastTextColor = textColorForBackground(selectedBackgroundColor);
-
-    // save contrastTextColor to hidden input field
-    $('input.text-font-color').val(contrastTextColor);
-
-    // Updates the preview color with the hex-color input
-    const selectedColorStyle = {
-      backgroundColor: selectedBackgroundColor,
-      color: contrastTextColor,
-    };
-
-    $('.label-color-preview').css(selectedColorStyle);
-
-    return $jsBroadcastMessagePreview.css(selectedColorStyle);
-  };
-
-  const setSuggestedColor = (e) => {
-    const color = $(e.currentTarget).data('color');
-    $broadcastMessageColor
-      .val(color)
-      // Notify the form, that color has changed
-      .trigger('input');
-    // Only banner supports colors
-    if ($broadcastMessageType === 'banner') {
-      updateColorPreview();
-    }
-    return e.preventDefault();
-  };
-
-  $(document).on('click', '.suggest-colors a', setSuggestedColor);
 };
diff --git a/app/assets/javascripts/repository/components/last_commit.vue b/app/assets/javascripts/repository/components/last_commit.vue
index 6b5874c1e5b..2810db33e64 100644
--- a/app/assets/javascripts/repository/components/last_commit.vue
+++ b/app/assets/javascripts/repository/components/last_commit.vue
@@ -171,7 +171,7 @@ export default {
         <div class="commit-actions flex-row">
           <div
             v-if="commit.signatureHtml"
-            v-safe-html:[$options.safeHtmlConfig]="commit.signatureHtml"
+            v-html="commit.signatureHtml /* eslint-disable-line vue/no-v-html */"
           ></div>
           <div v-if="commit.pipeline" class="ci-status-link">
             <gl-link
diff --git a/app/assets/stylesheets/framework/broadcast_messages.scss b/app/assets/stylesheets/framework/broadcast_messages.scss
index b8934d2797a..58f986ec0ae 100644
--- a/app/assets/stylesheets/framework/broadcast_messages.scss
+++ b/app/assets/stylesheets/framework/broadcast_messages.scss
@@ -15,6 +15,10 @@
 
 .broadcast-banner-message {
   text-align: center;
+
+  p {
+    margin-bottom: 0;
+  }
 }
 
 .broadcast-notification-message {
diff --git a/app/controllers/admin/broadcast_messages_controller.rb b/app/controllers/admin/broadcast_messages_controller.rb
index ef843a84e6c..8b672929f88 100644
--- a/app/controllers/admin/broadcast_messages_controller.rb
+++ b/app/controllers/admin/broadcast_messages_controller.rb
@@ -45,8 +45,8 @@ class Admin::BroadcastMessagesController < Admin::ApplicationController
   end
 
   def preview
-    broadcast_message = BroadcastMessage.new(broadcast_message_params)
-    render json: { message: render_broadcast_message(broadcast_message) }
+    @broadcast_message = BroadcastMessage.new(broadcast_message_params)
+    render partial: 'admin/broadcast_messages/preview'
   end
 
   protected
@@ -58,8 +58,8 @@ class Admin::BroadcastMessagesController < Admin::ApplicationController
   def broadcast_message_params
     params.require(:broadcast_message).permit(%i(
       color
+      theme
       ends_at
-      font
       message
       starts_at
       target_path
diff --git a/app/helpers/broadcast_messages_helper.rb b/app/helpers/broadcast_messages_helper.rb
index dda834ee2c5..b138e9aeb0c 100644
--- a/app/helpers/broadcast_messages_helper.rb
+++ b/app/helpers/broadcast_messages_helper.rb
@@ -25,23 +25,7 @@ module BroadcastMessagesHelper
   def broadcast_message(message, opts = {})
     return unless message.present?
 
-    render "shared/broadcast_message", { message: message, opts: opts }
-  end
-
-  def broadcast_message_style(broadcast_message)
-    return '' if broadcast_message.notification?
-
-    style = []
-
-    if broadcast_message.color.present?
-      style << "background-color: #{broadcast_message.color}"
-    end
-
-    if broadcast_message.font.present?
-      style << "color: #{broadcast_message.font}"
-    end
-
-    style.join('; ')
+    render "shared/broadcast_message", { message: message, **opts }
   end
 
   def broadcast_message_status(broadcast_message)
@@ -70,6 +54,10 @@ module BroadcastMessagesHelper
     BroadcastMessage.broadcast_types.keys.map { |w| [w.humanize, w] }
   end
 
+  def broadcast_theme_options
+    BroadcastMessage.themes.keys
+  end
+
   def target_access_level_options
     BroadcastMessage::ALLOWED_TARGET_ACCESS_LEVELS.map do |access_level|
       [Gitlab::Access.human_access(access_level), access_level]
diff --git a/app/models/broadcast_message.rb b/app/models/broadcast_message.rb
index 949902fbb77..b255c774347 100644
--- a/app/models/broadcast_message.rb
+++ b/app/models/broadcast_message.rb
@@ -32,6 +32,19 @@ class BroadcastMessage < ApplicationRecord
 
   after_commit :flush_redis_cache
 
+  enum theme: {
+    indigo: 0,
+    'light-indigo': 1,
+    blue: 2,
+    'light-blue': 3,
+    green: 4,
+    'light-green': 5,
+    red: 6,
+    'light-red': 7,
+    dark: 8,
+    light: 9
+  }, _default: 0, _prefix: true
+
   enum broadcast_type: {
     banner: 1,
     notification: 2
diff --git a/app/views/admin/application_settings/_email.html.haml b/app/views/admin/application_settings/_email.html.haml
index 0ab462a3fa8..fd65d4029f5 100644
--- a/app/views/admin/application_settings/_email.html.haml
+++ b/app/views/admin/application_settings/_email.html.haml
@@ -1,21 +1,11 @@
-= form_for @application_setting, url: preferences_admin_application_settings_path(anchor: 'js-email-settings'), html: { class: 'fieldset-form' } do |f|
+= gitlab_ui_form_for @application_setting, url: preferences_admin_application_settings_path(anchor: 'js-email-settings'), html: { class: 'fieldset-form' } do |f|
   = form_errors(@application_setting)
 
   %fieldset
     .form-group
-      .form-check
-        = f.check_box :email_author_in_body, class: 'form-check-input'
-        = f.label :email_author_in_body, class: 'form-check-label' do
-          = _('Include author name in notification email body')
-        .form-text.text-muted
-          = _("Include the name of the author of the issue, merge request or comment in the email body. By default, GitLab overrides the email sender's name. Some email servers don't support that option.")
+      = f.gitlab_ui_checkbox_component :email_author_in_body, _('Include author name in notification email body'), help_text: _("Include the name of the author of the issue, merge request or comment in the email body. By default, GitLab overrides the email sender's name. Some email servers don't support that option.")
     .form-group
-      .form-check
-        = f.check_box :html_emails_enabled, class: 'form-check-input'
-        = f.label :html_emails_enabled, class: 'form-check-label' do
-          = _('Enable multipart emails')
-        .form-text.text-muted
-          = _('Send email in multipart format (HTML and plain text). Uncheck to send email messages in plain text only.')
+      = f.gitlab_ui_checkbox_component :html_emails_enabled, _('Enable multipart emails'), help_text: _('Send email in multipart format (HTML and plain text). Uncheck to send email messages in plain text only.')
     .form-group
       = f.label :commit_email_hostname, _('Custom hostname (for private commit emails)'), class: 'label-bold'
       = f.text_field :commit_email_hostname, class: 'form-control gl-form-input'
@@ -26,19 +16,9 @@
     = render_if_exists 'admin/application_settings/email_additional_text_setting', form: f
 
     .form-group
-      .form-check
-        = f.check_box :in_product_marketing_emails_enabled, class: 'form-check-input'
-        = f.label :in_product_marketing_emails_enabled, class: 'form-check-label' do
-          = _('Enable in-product marketing emails')
-        .form-text.text-muted
-          = _('Send emails to help guide new users through the onboarding process.')
+      = f.gitlab_ui_checkbox_component :in_product_marketing_emails_enabled, _('Enable in-product marketing emails'), help_text: _('Send emails to help guide new users through the onboarding process.')
 
     .form-group
-      .form-check
-        = f.check_box :user_deactivation_emails_enabled, class: 'form-check-input'
-        = f.label :user_deactivation_emails_enabled, class: 'form-check-label' do
-          = _('Enable user deactivation emails')
-        .form-text.text-muted
-          = _('Send emails to users upon account deactivation.')
+      = f.gitlab_ui_checkbox_component :user_deactivation_emails_enabled, _('Enable user deactivation emails'), help_text: _('Send emails to users upon account deactivation.')
 
   = f.submit _('Save changes'), class: "gl-button btn btn-confirm", data: { qa_selector: 'save_changes_button' }
diff --git a/app/views/admin/broadcast_messages/_form.html.haml b/app/views/admin/broadcast_messages/_form.html.haml
index 3e698f0508c..4102918931f 100644
--- a/app/views/admin/broadcast_messages/_form.html.haml
+++ b/app/views/admin/broadcast_messages/_form.html.haml
@@ -1,20 +1,5 @@
-.broadcast-message.broadcast-banner-message.gl-alert-warning.js-broadcast-banner-message-preview.gl-mt-3{ style: broadcast_message_style(@broadcast_message), class: ('gl-display-none' unless @broadcast_message.banner? ) }
-  .gl-alert-container
-    = sprite_icon('bullhorn', css_class: 'vertical-align-text-top')
-    .js-broadcast-message-preview
-      .gl-alert-content
-        - if @broadcast_message.message.present?
-          = render_broadcast_message(@broadcast_message)
-        - else
-          = _('Your message here')
-.d-flex.justify-content-center
-  .broadcast-message.broadcast-notification-message.preview.js-broadcast-notification-message-preview.mt-2{ class: ('hidden' unless @broadcast_message.notification? ) }
-    = sprite_icon('bullhorn', css_class: 'vertical-align-text-top')
-    .js-broadcast-message-preview
-      - if @broadcast_message.message.present?
-        = render_broadcast_message(@broadcast_message)
-      - else
-        = _('Your message here')
+#broadcast-message-preview
+  = render 'preview'
 
 = gitlab_ui_form_for [:admin, @broadcast_message], html: { class: 'broadcast-message-form js-quick-submit js-requires-input'} do |f|
   = form_errors(@broadcast_message)
@@ -34,19 +19,10 @@
       = f.select :broadcast_type, broadcast_type_options, {}, class: 'form-control js-broadcast-message-type'
   .form-group.row.js-broadcast-message-background-color-form-group{ class: ('hidden' unless @broadcast_message.banner? ) }
     .col-sm-2.col-form-label
-      = f.label :color, _("Background color")
+      = f.label :theme, _("Theme")
     .col-sm-10
       .input-group
-        .input-group-prepend
-          .input-group-text.label-color-preview{ :style => 'background-color: ' + @broadcast_message.color + '; color: ' + @broadcast_message.font }
-            = '&nbsp;'.html_safe
-        = f.text_field :color, class: "form-control gl-form-input js-broadcast-message-color"
-      .form-text.text-muted
-        = _('Choose any color.')
-        %br
-        = _("Or you can choose one of the suggested colors below")
-
-      = render_suggested_colors
+        = f.select :theme, broadcast_theme_options, {}, class: 'form-control js-broadcast-message-theme'
 
   .form-group.row.js-broadcast-message-dismissable-form-group{ class: ('hidden' unless @broadcast_message.banner? ) }
     .col-sm-2.col-form-label.pt-0
diff --git a/app/views/admin/broadcast_messages/_preview.html.haml b/app/views/admin/broadcast_messages/_preview.html.haml
new file mode 100644
index 00000000000..56168926a6e
--- /dev/null
+++ b/app/views/admin/broadcast_messages/_preview.html.haml
@@ -0,0 +1,3 @@
+.js-broadcast-banner-message-preview
+  = render "shared/broadcast_message", { message: @broadcast_message, preview: true } do
+    = _('Your message here')
diff --git a/app/views/shared/_broadcast_message.html.haml b/app/views/shared/_broadcast_message.html.haml
index 7aaae3a88f3..ab6423e9ade 100644
--- a/app/views/shared/_broadcast_message.html.haml
+++ b/app/views/shared/_broadcast_message.html.haml
@@ -1,12 +1,29 @@
-- is_banner = message.broadcast_type == 'banner'
+- icon_name = 'bullhorn'
+- dismissable = message.dismissable?
+- preview = local_assigns.fetch(:preview, false)
 
-%div{ class: "broadcast-message #{'alert-warning' if is_banner} broadcast-#{message.broadcast_type}-message #{opts[:preview] && 'preview'} js-broadcast-notification-#{message.id} gl-display-flex",
-  style: broadcast_message_style(message), dir: 'auto' }
-  .gl-flex-grow-1.gl-text-right.gl-pr-3
-    = sprite_icon('bullhorn', css_class: 'vertical-align-text-top')
-  %div{ class: !fluid_layout && 'container-limited' }
-    = render_broadcast_message(message)
-  .gl-flex-grow-1.gl-flex-basis-0.gl-text-right
-    - if (message.notification? || message.dismissable?) && opts[:preview].blank?
+- unless message.notification?
+  .gl-broadcast-message.broadcast-banner-message{ role: "alert", class: "js-broadcast-notification-#{message.id} #{message.theme}" }
+    .gl-broadcast-message-content
+      .gl-broadcast-message-icon
+        = sprite_icon(icon_name)
+      .gl-broadcast-message-text.js-broadcast-message-preview
+        - if message.message.present?
+          = render_broadcast_message(message)
+        - else
+          = yield
+    - if dismissable && !preview
+      %button.btn.gl-close-btn-color-inherit.gl-broadcast-message-dismiss.btn-default.btn-sm.gl-button.btn-default-tertiary.btn-icon.js-dismiss-current-broadcast-notification{ 'aria-label' => _('Close'), :type => 'button', data: { id: message.id, expire_date: message.ends_at.iso8601 } }
+        = sprite_icon('close', size: 16, css_class: "gl-icon gl-mx-3! gl-text-white")
+- else
+  - notification_class = "js-broadcast-notification-#{message.id}"
+  - notification_class << ' preview' if preview
+  .broadcast-message.broadcast-notification-message.mt-2{ role: "alert", class: notification_class }
+    = sprite_icon(icon_name, css_class: 'vertical-align-text-top')
+    - if message.message.present?
+      = render_broadcast_message(message)
+    - else
+      = yield
+    - if !preview
       %button.js-dismiss-current-broadcast-notification.btn.btn-link.gl-button{ 'aria-label' => _('Close'), :type => 'button', data: { id: message.id, expire_date: message.ends_at.iso8601 } }
-        = sprite_icon('close', size: 16, css_class: "gl-icon gl-mx-3! #{is_banner ? 'gl-text-white' : 'gl-text-gray-700'}")
+        = sprite_icon('close', size: 16, css_class: "gl-icon gl-mx-3! gl-text-gray-700")
diff --git a/config/feature_flags/development/omniauth_initializer_fullhost_proc.yml b/config/feature_flags/development/omniauth_initializer_fullhost_proc.yml
new file mode 100644
index 00000000000..75ed8e642c6
--- /dev/null
+++ b/config/feature_flags/development/omniauth_initializer_fullhost_proc.yml
@@ -0,0 +1,8 @@
+---
+name: omniauth_initializer_fullhost_proc
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/82401
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/355579
+milestone: '14.10'
+type: development
+group: group::geo
+default_enabled: false
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index 478a5828809..24040d7b076 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -11,7 +11,15 @@ if Gitlab::Auth::Ldap::Config.enabled?
   end
 end
 
-OmniAuth.config.full_host = Settings.gitlab['base_url']
+OmniAuth.config.full_host =
+  if Feature.feature_flags_available? && ::Feature.enabled?(:omniauth_initializer_fullhost_proc, default_enabled: :yaml)
+    Gitlab::AppLogger.debug("Using OmniAuth proc initializer")
+    Gitlab::OmniauthInitializer.full_host
+  else
+    Gitlab::AppLogger.debug("Fallback to OmniAuth static full_host")
+    Settings.gitlab['base_url']
+  end
+
 OmniAuth.config.allowed_request_methods = [:post]
 # In case of auto sign-in, the GET method is used (users don't get to click on a button)
 OmniAuth.config.allowed_request_methods << :get if Gitlab.config.omniauth.auto_sign_in_with_provider.present?
diff --git a/db/migrate/20220329095632_add_theme_to_broadcast_message.rb b/db/migrate/20220329095632_add_theme_to_broadcast_message.rb
new file mode 100644
index 00000000000..ae5971469f9
--- /dev/null
+++ b/db/migrate/20220329095632_add_theme_to_broadcast_message.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddThemeToBroadcastMessage < Gitlab::Database::Migration[1.0]
+  def change
+    add_column :broadcast_messages, :theme, :smallint, null: false, default: 0
+  end
+end
diff --git a/db/schema_migrations/20220329095632 b/db/schema_migrations/20220329095632
new file mode 100644
index 00000000000..ba27739ccf7
--- /dev/null
+++ b/db/schema_migrations/20220329095632
@@ -0,0 +1 @@
+19ab6c5663ec07c7f4bdd92bf6d38e36766b27e6d0f0460f929a71b5e20fa396
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 7a0d24df681..6a8d5ebe079 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -12004,7 +12004,8 @@ CREATE TABLE broadcast_messages (
     target_path character varying(255),
     broadcast_type smallint DEFAULT 1 NOT NULL,
     dismissable boolean,
-    target_access_levels integer[] DEFAULT '{}'::integer[] NOT NULL
+    target_access_levels integer[] DEFAULT '{}'::integer[] NOT NULL,
+    theme smallint DEFAULT 0 NOT NULL
 );
 
 CREATE SEQUENCE broadcast_messages_id_seq
diff --git a/doc/administration/auth/ldap/index.md b/doc/administration/auth/ldap/index.md
index 2a396c4d53a..a7e070b755a 100644
--- a/doc/administration/auth/ldap/index.md
+++ b/doc/administration/auth/ldap/index.md
@@ -518,7 +518,7 @@ GitLab doesn't support TLS client authentication. Complete these steps on your L
 The TLS client authentication setting in your LDAP server cannot be mandatory and clients cannot be
 authenticated with the TLS protocol.
 
-## Deleting users
+## Users deleted from LDAP
 
 Users deleted from the LDAP server:
 
@@ -531,6 +531,16 @@ However, these users can continue to use Git with SSH until the next time the
 To delete the account immediately, you can manually
 [block the user](../../../user/admin_area/moderate_users.md#block-a-user).
 
+## Updating user email addresses
+
+Email addresses on the LDAP server are considered the source of truth for users when LDAP is used to sign in. Updating user email
+addresses must be done on the LDAP server that manages the user. The email address for GitLab is updated either:
+
+- When the user next signs in.
+- When the next [user sync](ldap_synchronization.md#user-sync) is run.
+
+The updated user's previous email address becomes the secondary email address to preserve that user's commit history.
+
 ## Google Secure LDAP
 
 > Introduced in GitLab 11.9.
diff --git a/doc/development/database/multiple_databases.md b/doc/development/database/multiple_databases.md
index bfd91939743..3b1b06b557c 100644
--- a/doc/development/database/multiple_databases.md
+++ b/doc/development/database/multiple_databases.md
@@ -112,9 +112,9 @@ already many such examples that need to be fixed in
 The following steps are the process to remove cross-database joins between
 `ci_*` and non `ci_*` tables:
 
-1. **{check-circle}** Add all failing specs to the [`cross-join-allowlist.yml`](https://gitlab.com/gitlab-org/gitlab/-/blob/f5de89daeb468fc45e1e95a76d1b5297aa53da11/spec/support/database/cross-join-allowlist.yml)
+1. **{check-circle}** Add all failing specs to the [`cross-join-allowlist.yml`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/spec/support/database/cross-join-allowlist.yml)
    file.
-1. **{dotted-circle}** Find the code that caused the spec failure and wrap the isolated code
+1. **{check-circle}** Find the code that caused the spec failure and wrap the isolated code
    in [`allow_cross_joins_across_databases`](#allowlist-for-existing-cross-joins).
    Link to a new issue assigned to the correct team to remove the specs from the
    `cross-join-allowlist.yml` file.
diff --git a/doc/update/index.md b/doc/update/index.md
index 751a9faa3e7..1e8badf59b4 100644
--- a/doc/update/index.md
+++ b/doc/update/index.md
@@ -446,6 +446,17 @@ that may remain stuck permanently in a **pending** state.
 - See [LFS objects import and mirror issue in GitLab 14.6.0 to 14.7.2](#lfs-objects-import-and-mirror-issue-in-gitlab-1460-to-1472).
 - If upgrading from a version earlier than 14.6.5, 14.7.4, or 14.8.2, please review the [Critical Security Release: 14.8.2, 14.7.4, and 14.6.5](https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/) blog post.
   Updating to 14.7.4 or later will reset runner registration tokens for your groups and projects.
+- GitLab 14.7 introduced a change where Gitaly expects persistent files in the `/tmp` directory.
+  When using the `noatime` mount option on `/tmp` in a node running Gitaly, most Linux distributions
+  run into [an issue with Git server hooks getting deleted](https://gitlab.com/gitlab-org/gitaly/-/issues/4113).
+  These conditions are present in the default Amazon Linux configuration.
+
+  If your Linux distribution manages files in `/tmp` with the `tmpfiles.d` service, you
+  can override the behavior of `tmpfiles.d` for the Gitaly files and avoid this issue:
+
+  ```shell
+  sudo echo "x /tmp/gitaly-hooks-*" > /etc/tmpfiles.d/gitaly-workaround.conf
+  ```
 
 ### 14.6.0
 
diff --git a/doc/user/markdown.md b/doc/user/markdown.md
index 000aa1dcb50..fc2f1de5ce2 100644
--- a/doc/user/markdown.md
+++ b/doc/user/markdown.md
@@ -1412,6 +1412,16 @@ while the equation for the theory of relativity is E = mc<sup>2</sup>.
 
 <!-- vale gitlab.Spelling = YES -->
 
+### Keyboard HTML tag
+
+The `<kbd>` element is used to identify text that represents user keyboard input. Text surrounded by `<kbd>` tags is typically displayed in the browser's default monospace font.
+
+```html
+Press <kbd>Enter</kbd> to go to the next page.
+```
+
+Press <kbd>Enter</kbd> to go to the next page.
+
 ### Tables
 
 Tables are not part of the core Markdown spec, but they are part of GitLab Flavored Markdown.
diff --git a/lib/api/entities/commit_with_link.rb b/lib/api/entities/commit_with_link.rb
index a135cc19480..23efaca34d5 100644
--- a/lib/api/entities/commit_with_link.rb
+++ b/lib/api/entities/commit_with_link.rb
@@ -29,7 +29,7 @@ module API
       end
 
       expose :signature_html, if: { type: :full } do |commit|
-        render('projects/commit/_signature', signature: commit.signature) if commit.has_signature?
+        ::CommitPresenter.new(commit).signature_html
       end
 
       expose :prev_commit_id, if: { type: :full } do |commit|
@@ -50,12 +50,6 @@ module API
 
         pipelines_project_commit_path(pipeline_project, commit.id, ref: pipeline_ref)
       end
-
-      def render(*args)
-        return unless request.respond_to?(:render) && request.render.respond_to?(:call)
-
-        request.render.call(*args)
-      end
     end
   end
 end
diff --git a/lib/gitlab/omniauth_initializer.rb b/lib/gitlab/omniauth_initializer.rb
index f4984e11c14..51277497c99 100644
--- a/lib/gitlab/omniauth_initializer.rb
+++ b/lib/gitlab/omniauth_initializer.rb
@@ -38,6 +38,10 @@ module Gitlab
         end
       end
 
+      def full_host
+        proc { |_env| Settings.gitlab['base_url'] }
+      end
+
       private
 
       def cas3_signout_handler
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index e4d2a74340d..74d7d284a28 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -37962,6 +37962,9 @@ msgstr ""
 msgid "The vulnerability is no longer detected. Verify the vulnerability has been remediated before changing its status."
 msgstr ""
 
+msgid "Theme"
+msgstr ""
+
 msgid "There are Advanced Search migrations pending that require indexing to pause. Indexing must remain paused until GitLab completes the migrations."
 msgstr ""
 
diff --git a/spec/features/admin/admin_broadcast_messages_spec.rb b/spec/features/admin/admin_broadcast_messages_spec.rb
index e40f4c4678c..875eb9dd0ce 100644
--- a/spec/features/admin/admin_broadcast_messages_spec.rb
+++ b/spec/features/admin/admin_broadcast_messages_spec.rb
@@ -22,9 +22,8 @@ RSpec.describe 'Admin Broadcast Messages' do
 
   it 'creates a customized broadcast banner message' do
     fill_in 'broadcast_message_message', with: 'Application update from **4:00 CST to 5:00 CST**'
-    fill_in 'broadcast_message_color', with: '#f2dede'
     fill_in 'broadcast_message_target_path', with: '*/user_onboarded'
-    fill_in 'broadcast_message_font', with: '#b94a48'
+    select 'light-indigo', from: 'broadcast_message_theme'
     select Date.today.next_year.year, from: 'broadcast_message_ends_at_1i'
     check 'Guest'
     check 'Owner'
@@ -35,7 +34,7 @@ RSpec.describe 'Admin Broadcast Messages' do
     expect(page).to have_content 'Guest, Owner'
     expect(page).to have_content '*/user_onboarded'
     expect(page).to have_selector 'strong', text: '4:00 CST to 5:00 CST'
-    expect(page).to have_selector %(div[style="background-color: #f2dede; color: #b94a48"])
+    expect(page).to have_selector %(.light-indigo[role=alert])
   end
 
   it 'creates a customized broadcast notification message' do
@@ -90,7 +89,7 @@ RSpec.describe 'Admin Broadcast Messages' do
     fill_in 'broadcast_message_message', with: "Live **Markdown** previews. :tada:"
     select 'Notification', from: 'broadcast_message_broadcast_type'
 
-    page.within('.js-broadcast-notification-message-preview') do
+    page.within('#broadcast-message-preview') do
       expect(page).to have_selector('strong', text: 'Markdown')
       expect(page).to have_emoji('tada')
     end
diff --git a/spec/frontend/diffs/components/commit_item_spec.js b/spec/frontend/diffs/components/commit_item_spec.js
index 6574d725180..eee17e118a0 100644
--- a/spec/frontend/diffs/components/commit_item_spec.js
+++ b/spec/frontend/diffs/components/commit_item_spec.js
@@ -11,7 +11,9 @@ jest.mock('~/user_popovers');
 const TEST_AUTHOR_NAME = 'test';
 const TEST_AUTHOR_EMAIL = 'test+test@gitlab.com';
 const TEST_AUTHOR_GRAVATAR = `${TEST_HOST}/avatar/test?s=40`;
-const TEST_SIGNATURE_HTML = '<a>Legit commit</a>';
+const TEST_SIGNATURE_HTML = `<a class="btn gpg-status-box valid" data-content="signature-content" data-html="true" data-placement="top" data-title="signature-title" data-toggle="popover" role="button" tabindex="0">
+  Verified
+</a>`;
 const TEST_PIPELINE_STATUS_PATH = `${TEST_HOST}/pipeline/status`;
 
 describe('diffs/components/commit_item', () => {
@@ -156,8 +158,9 @@ describe('diffs/components/commit_item', () => {
 
     it('renders signature html', () => {
       const actionsElement = getCommitActionsElement();
+      const signatureElement = actionsElement.find('.gpg-status-box');
 
-      expect(actionsElement.html()).toContain(TEST_SIGNATURE_HTML);
+      expect(signatureElement.html()).toBe(TEST_SIGNATURE_HTML);
     });
   });
 
diff --git a/spec/frontend/repository/components/__snapshots__/last_commit_spec.js.snap b/spec/frontend/repository/components/__snapshots__/last_commit_spec.js.snap
index 7854325e4ed..fea937b905f 100644
--- a/spec/frontend/repository/components/__snapshots__/last_commit_spec.js.snap
+++ b/spec/frontend/repository/components/__snapshots__/last_commit_spec.js.snap
@@ -106,114 +106,3 @@ exports[`Repository last commit component renders commit widget 1`] = `
   </div>
 </div>
 `;
-
-exports[`Repository last commit component renders the signature HTML as returned by the backend 1`] = `
-<div
-  class="well-segment commit gl-p-5 gl-w-full"
->
-  <user-avatar-link-stub
-    class="avatar-cell"
-    imgalt=""
-    imgcssclasses=""
-    imgsize="40"
-    imgsrc="https://test.com"
-    linkhref="/test"
-    tooltipplacement="top"
-    tooltiptext=""
-    username=""
-  />
-   
-  <div
-    class="commit-detail flex-list"
-  >
-    <div
-      class="commit-content qa-commit-content"
-    >
-      <gl-link-stub
-        class="commit-row-message item-title"
-        href="/commit/123"
-      >
-        Commit title
-      </gl-link-stub>
-       
-      <!---->
-       
-      <div
-        class="committer"
-      >
-        <gl-link-stub
-          class="commit-author-link js-user-link"
-          href="/test"
-        >
-          
-            Test
-        </gl-link-stub>
-        
-          authored
-          
-        <timeago-tooltip-stub
-          cssclass=""
-          time="2019-01-01"
-          tooltipplacement="bottom"
-        />
-      </div>
-       
-      <!---->
-    </div>
-     
-    <div
-      class="commit-actions flex-row"
-    >
-      <div>
-        <button>
-          Verified
-        </button>
-      </div>
-       
-      <div
-        class="ci-status-link"
-      >
-        <gl-link-stub
-          class="js-commit-pipeline"
-          href="https://test.com/pipeline"
-          title="Pipeline: failed"
-        >
-          <ci-icon-stub
-            aria-label="Pipeline: failed"
-            cssclasses=""
-            size="24"
-            status="[object Object]"
-          />
-        </gl-link-stub>
-      </div>
-       
-      <gl-button-group-stub
-        class="gl-ml-4 js-commit-sha-group"
-      >
-        <gl-button-stub
-          buttontextclasses=""
-          category="primary"
-          class="gl-font-monospace"
-          data-testid="last-commit-id-label"
-          icon=""
-          label="true"
-          size="medium"
-          variant="default"
-        >
-          12345678
-        </gl-button-stub>
-         
-        <clipboard-button-stub
-          category="secondary"
-          class="input-group-text"
-          size="medium"
-          text="123456789"
-          title="Copy commit SHA"
-          tooltipplacement="top"
-          variant="default"
-        />
-      </gl-button-group-stub>
-    </div>
-  </div>
-</div>
-`;
diff --git a/spec/frontend/repository/components/last_commit_spec.js b/spec/frontend/repository/components/last_commit_spec.js
index bb710c3a96c..cfbf74e34aa 100644
--- a/spec/frontend/repository/components/last_commit_spec.js
+++ b/spec/frontend/repository/components/last_commit_spec.js
@@ -143,11 +143,30 @@ describe('Repository last commit component', () => {
   });
 
   it('renders the signature HTML as returned by the backend', async () => {
-    factory(createCommitData({ signatureHtml: '<button>Verified</button>' }));
+    factory(
+      createCommitData({
+        signatureHtml: `<a
+        class="btn gpg-status-box valid"
+        data-content="signature-content"
+        data-html="true"
+        data-placement="top"
+        data-title="signature-title"
+        data-toggle="popover"
+        role="button"
+        tabindex="0"
+        >
+          Verified
+        </a>`,
+      }),
+    );
 
     await nextTick();
 
-    expect(vm.element).toMatchSnapshot();
+    expect(vm.find('.gpg-status-box').html()).toBe(
+      `<a class="btn gpg-status-box valid" data-content="signature-content" data-html="true" data-placement="top" data-title="signature-title" data-toggle="popover" role="button" tabindex="0">
+  Verified
+</a>`,
+    );
   });
 
   it('sets correct CSS class if the commit message is empty', async () => {
diff --git a/spec/helpers/broadcast_messages_helper_spec.rb b/spec/helpers/broadcast_messages_helper_spec.rb
index e721a3fdc95..d4021a2eb59 100644
--- a/spec/helpers/broadcast_messages_helper_spec.rb
+++ b/spec/helpers/broadcast_messages_helper_spec.rb
@@ -115,37 +115,8 @@ RSpec.describe BroadcastMessagesHelper do
     end
 
     it 'includes the current message' do
-      allow(helper).to receive(:broadcast_message_style).and_return(nil)
-
       expect(helper.broadcast_message(current_broadcast_message)).to include 'Current Message'
     end
-
-    it 'includes custom style' do
-      allow(helper).to receive(:broadcast_message_style).and_return('foo')
-
-      expect(helper.broadcast_message(current_broadcast_message)).to include 'style="foo"'
-    end
-  end
-
-  describe 'broadcast_message_style' do
-    it 'defaults to no style' do
-      broadcast_message = spy
-
-      expect(helper.broadcast_message_style(broadcast_message)).to eq ''
-    end
-
-    it 'allows custom style for banner messages' do
-      broadcast_message = BroadcastMessage.new(color: '#f2dede', font: '#b94a48', broadcast_type: "banner")
-
-      expect(helper.broadcast_message_style(broadcast_message))
-        .to match('background-color: #f2dede; color: #b94a48')
-    end
-
-    it 'does not add style for notification messages' do
-      broadcast_message = BroadcastMessage.new(color: '#f2dede', broadcast_type: "notification")
-
-      expect(helper.broadcast_message_style(broadcast_message)).to eq ''
-    end
   end
 
   describe 'broadcast_message_status' do
diff --git a/spec/initializers/omniauth_spec.rb b/spec/initializers/omniauth_spec.rb
new file mode 100644
index 00000000000..928eac8c533
--- /dev/null
+++ b/spec/initializers/omniauth_spec.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'OmniAuth initializer for GitLab' do
+  let(:load_omniauth_initializer) do
+    load Rails.root.join('config/initializers/omniauth.rb')
+  end
+
+  describe '#full_host' do
+    subject { OmniAuth.config.full_host }
+
+    let(:base_url) { 'http://localhost/test' }
+
+    before do
+      allow(Settings).to receive(:gitlab).and_return({ 'base_url' => base_url })
+      allow(Gitlab::OmniauthInitializer).to receive(:full_host).and_return('proc')
+    end
+
+    context 'with feature flags not available' do
+      before do
+        expect(Feature).to receive(:feature_flags_available?).and_return(false)
+        load_omniauth_initializer
+      end
+
+      it { is_expected.to eq(base_url) }
+    end
+
+    context 'with the omniauth_initializer_fullhost_proc FF disabled' do
+      before do
+        stub_feature_flags(omniauth_initializer_fullhost_proc: false)
+        load_omniauth_initializer
+      end
+
+      it { is_expected.to eq(base_url) }
+    end
+
+    context 'with the omniauth_initializer_fullhost_proc FF disabled' do
+      before do
+        load_omniauth_initializer
+      end
+
+      it { is_expected.to eq('proc') }
+    end
+  end
+end
diff --git a/spec/lib/gitlab/omniauth_initializer_spec.rb b/spec/lib/gitlab/omniauth_initializer_spec.rb
index 8b959cf787f..c91b14a33ba 100644
--- a/spec/lib/gitlab/omniauth_initializer_spec.rb
+++ b/spec/lib/gitlab/omniauth_initializer_spec.rb
@@ -309,4 +309,16 @@ RSpec.describe Gitlab::OmniauthInitializer do
       subject.execute([conf])
     end
   end
+
+  describe '.full_host' do
+    subject { described_class.full_host.call({}) }
+
+    let(:base_url) { 'http://localhost/test' }
+
+    before do
+      allow(Settings).to receive(:gitlab).and_return({ 'base_url' => base_url })
+    end
+
+    it { is_expected.to eq(base_url) }
+  end
 end
diff --git a/spec/serializers/commit_entity_spec.rb b/spec/serializers/commit_entity_spec.rb
index 6b4346faf5b..ba2d7e17d1a 100644
--- a/spec/serializers/commit_entity_spec.rb
+++ b/spec/serializers/commit_entity_spec.rb
@@ -3,8 +3,6 @@
 require 'spec_helper'
 
 RSpec.describe CommitEntity do
-  let(:signature_html) { 'TEST' }
-
   let(:entity) do
     described_class.new(commit, request: request)
   end
@@ -16,11 +14,7 @@ RSpec.describe CommitEntity do
   subject { entity.as_json }
 
   before do
-    render = double('render')
-    allow(render).to receive(:call).and_return(signature_html)
-
     allow(request).to receive(:project).and_return(project)
-    allow(request).to receive(:render).and_return(render)
   end
 
   context 'when commit author is a user' do
@@ -83,8 +77,7 @@ RSpec.describe CommitEntity do
       let(:commit) { project.commit(TestEnv::BRANCH_SHA['signed-commits']) }
 
       it 'exposes "signature_html"' do
-        expect(request.render).to receive(:call)
-        expect(subject.fetch(:signature_html)).to be signature_html
+        expect(subject.fetch(:signature_html)).not_to be_nil
       end
     end
 
diff --git a/spec/tasks/dev_rake_spec.rb b/spec/tasks/dev_rake_spec.rb
index af7bd4bdf0b..73b1604aa10 100644
--- a/spec/tasks/dev_rake_spec.rb
+++ b/spec/tasks/dev_rake_spec.rb
@@ -12,6 +12,15 @@ RSpec.describe 'dev rake tasks' do
   end
 
   describe 'setup' do
+    around do |example|
+      old_force_value = ENV['force']
+
+      # setup rake task sets the force env var, so reset it
+      example.run
+
+      ENV['force'] = old_force_value # rubocop:disable RSpec/EnvAssignment
+    end
+
     subject(:setup_task) { run_rake_task('dev:setup') }
 
     let(:connections) { Gitlab::Database.database_base_models.values.map(&:connection) }