Add latest changes from gitlab-org/gitlab@master

38 files changed, 480 insertions, 26 deletions

diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index f61490fab6e..2577208bfe5 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-d4c721263cf338984810e84d1af4039364954b5f
+87304fdbc72c480c9173b9e181eab885069e5399
diff --git a/app/helpers/application_settings_helper.rb b/app/helpers/application_settings_helper.rb
index 3abaae98c29..59ba5fa65d3 100644
--- a/app/helpers/application_settings_helper.rb
+++ b/app/helpers/application_settings_helper.rb
@@ -248,6 +248,7 @@ module ApplicationSettingsHelper
       :default_project_visibility,
       :default_projects_limit,
       :default_snippet_visibility,
+      :default_syntax_highlighting_theme,
       :delete_inactive_projects,
       :disable_admin_oauth_scopes,
       :disable_feed_token,
diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb
index 98adbd3ab06..5319f4aee77 100644
--- a/app/models/application_setting.rb
+++ b/app/models/application_setting.rb
@@ -698,6 +698,11 @@ class ApplicationSetting < MainClusterwide::ApplicationRecord
             allow_nil: false,
             inclusion: { in: [true, false], message: N_('must be a boolean value') }
 
+  validates :default_syntax_highlighting_theme,
+            allow_nil: false,
+            numericality: { only_integer: true, greater_than: 0 },
+            inclusion: { in: Gitlab::ColorSchemes.valid_ids, message: N_('must be a valid syntax highlighting theme ID') }
+
   before_validation :ensure_uuid!
   before_validation :coerce_repository_storages_weighted, if: :repository_storages_weighted_changed?
   before_validation :normalize_default_branch_name
diff --git a/app/models/ci/runner_machine_build.rb b/app/models/ci/runner_machine_build.rb
index 2e0a6a76bcc..ac2b258557a 100644
--- a/app/models/ci/runner_machine_build.rb
+++ b/app/models/ci/runner_machine_build.rb
@@ -11,8 +11,8 @@ module Ci
     partitionable scope: :build
     partitioned_by :partition_id,
       strategy: :ci_sliding_list,
-      next_partition_if: -> { false },
-      detach_partition_if: -> { false }
+      next_partition_if: proc { false },
+      detach_partition_if: proc { false }
 
     belongs_to :build, inverse_of: :runner_machine_build, class_name: 'Ci::Build'
     belongs_to :runner_machine, inverse_of: :runner_machine_builds, class_name: 'Ci::RunnerMachine'
diff --git a/app/models/namespace.rb b/app/models/namespace.rb
index 252fb9aa308..b136c0ffac2 100644
--- a/app/models/namespace.rb
+++ b/app/models/namespace.rb
@@ -286,11 +286,15 @@ class Namespace < ApplicationRecord
   end
 
   def any_project_has_container_registry_tags?
-    all_projects.includes(:container_repositories).any?(&:has_container_registry_tags?)
+    first_project_with_container_registry_tags.present?
   end
 
   def first_project_with_container_registry_tags
-    all_projects.find(&:has_container_registry_tags?)
+    if Gitlab.com? && Feature.enabled?(:use_sub_repositories_api)
+      ContainerRegistry::GitlabApiClient.one_project_with_container_registry_tag(full_path)
+    else
+      all_projects.includes(:container_repositories).find(&:has_container_registry_tags?)
+    end
   end
 
   def send_update_instructions
diff --git a/app/models/user.rb b/app/models/user.rb
index f3e8f14adf5..9a9530c4d3a 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -71,6 +71,7 @@ class User < ApplicationRecord
   attribute :notified_of_own_activity, default: false
   attribute :preferred_language, default: -> { Gitlab::CurrentSettings.default_preferred_language }
   attribute :theme_id, default: -> { gitlab_config.default_theme }
+  attribute :color_scheme_id, default: -> { Gitlab::CurrentSettings.default_syntax_highlighting_theme }
 
   attr_encrypted :otp_secret,
     key: Gitlab::Application.secrets.otp_key_base,
diff --git a/app/policies/concerns/archived_abilities.rb b/app/policies/concerns/archived_abilities.rb
index b4dfad599c7..7d61f83528e 100644
--- a/app/policies/concerns/archived_abilities.rb
+++ b/app/policies/concerns/archived_abilities.rb
@@ -37,6 +37,7 @@ module ArchivedAbilities
     pages
     cluster
     release
+    timelog
   ].freeze
 
   class_methods do
diff --git a/config/feature_flags/development/use_sub_repositories_api.yml b/config/feature_flags/development/use_sub_repositories_api.yml
new file mode 100644
index 00000000000..1ce845b46bf
--- /dev/null
+++ b/config/feature_flags/development/use_sub_repositories_api.yml
@@ -0,0 +1,8 @@
+---
+name: use_sub_repositories_api
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/110664
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/392372
+milestone: '15.10'
+type: development
+group: group::container registry
+default_enabled: false
diff --git a/db/migrate/20230202094723_add_default_syntax_highlighting_theme_to_application_settings.rb b/db/migrate/20230202094723_add_default_syntax_highlighting_theme_to_application_settings.rb
new file mode 100644
index 00000000000..048afb51f26
--- /dev/null
+++ b/db/migrate/20230202094723_add_default_syntax_highlighting_theme_to_application_settings.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddDefaultSyntaxHighlightingThemeToApplicationSettings < Gitlab::Database::Migration[2.1]
+  def change
+    add_column :application_settings, :default_syntax_highlighting_theme, :integer, default: 1, null: false
+  end
+end
diff --git a/db/migrate/20230213213559_add_index_on_project_id_and_scanner_id_and_vulnerability_id_on_vulnerability_reads.rb b/db/migrate/20230213213559_add_index_on_project_id_and_scanner_id_and_vulnerability_id_on_vulnerability_reads.rb
new file mode 100644
index 00000000000..ee9e15d2484
--- /dev/null
+++ b/db/migrate/20230213213559_add_index_on_project_id_and_scanner_id_and_vulnerability_id_on_vulnerability_reads.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class AddIndexOnProjectIdAndScannerIdAndVulnerabilityIdOnVulnerabilityReads < Gitlab::Database::Migration[2.1]
+  INDEX_NAME = "idx_vulnerability_reads_project_id_scanner_id_vulnerability_id"
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_index :vulnerability_reads, [:project_id, :scanner_id, :vulnerability_id], name: INDEX_NAME
+  end
+
+  def down
+    remove_concurrent_index_by_name :vulnerability_reads, INDEX_NAME
+  end
+end
diff --git a/db/post_migrate/20230126101907_add_partition_index_to_web_hook_logs.rb b/db/post_migrate/20230126101907_add_partition_index_to_web_hook_logs.rb
new file mode 100644
index 00000000000..4196767033c
--- /dev/null
+++ b/db/post_migrate/20230126101907_add_partition_index_to_web_hook_logs.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class AddPartitionIndexToWebHookLogs < Gitlab::Database::Migration[2.1]
+  include Gitlab::Database::PartitioningMigrationHelpers
+
+  disable_ddl_transaction!
+
+  INDEX_NAME = 'index_web_hook_logs_on_web_hook_id_and_created_at'
+
+  def up
+    add_concurrent_partitioned_index(
+      :web_hook_logs,
+      [:web_hook_id, :created_at],
+      name: INDEX_NAME
+    )
+  end
+
+  def down
+    remove_concurrent_partitioned_index_by_name :web_hook_logs, INDEX_NAME
+  end
+end
diff --git a/db/post_migrate/20230220134145_validate_fk_on_ci_build_needs_partition_id_and_build_id.rb b/db/post_migrate/20230220134145_validate_fk_on_ci_build_needs_partition_id_and_build_id.rb
new file mode 100644
index 00000000000..eec60a51834
--- /dev/null
+++ b/db/post_migrate/20230220134145_validate_fk_on_ci_build_needs_partition_id_and_build_id.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class ValidateFkOnCiBuildNeedsPartitionIdAndBuildId < Gitlab::Database::Migration[2.1]
+  TABLE_NAME = :ci_build_needs
+  FK_NAME = :fk_rails_3cf221d4ed_p
+  COLUMNS = [:partition_id, :build_id]
+
+  def up
+    validate_foreign_key(TABLE_NAME, COLUMNS, name: FK_NAME)
+  end
+
+  def down
+    # no-op
+  end
+end
diff --git a/db/post_migrate/20230220134146_remove_fk_to_ci_builds_ci_build_needs_on_build_id.rb b/db/post_migrate/20230220134146_remove_fk_to_ci_builds_ci_build_needs_on_build_id.rb
new file mode 100644
index 00000000000..04e7ec11ee6
--- /dev/null
+++ b/db/post_migrate/20230220134146_remove_fk_to_ci_builds_ci_build_needs_on_build_id.rb
@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+class RemoveFkToCiBuildsCiBuildNeedsOnBuildId < Gitlab::Database::Migration[2.1]
+  disable_ddl_transaction!
+
+  SOURCE_TABLE_NAME = :ci_build_needs
+  TARGET_TABLE_NAME = :ci_builds
+  COLUMN = :build_id
+  TARGET_COLUMN = :id
+  FK_NAME = :fk_rails_3cf221d4ed
+
+  def up
+    with_lock_retries do
+      remove_foreign_key_if_exists(
+        SOURCE_TABLE_NAME,
+        TARGET_TABLE_NAME,
+        name: FK_NAME,
+        reverse_lock_order: true
+      )
+    end
+  end
+
+  def down
+    add_concurrent_foreign_key(
+      SOURCE_TABLE_NAME,
+      TARGET_TABLE_NAME,
+      column: COLUMN,
+      target_column: TARGET_COLUMN,
+      validate: true,
+      reverse_lock_order: true,
+      on_delete: :cascade,
+      name: FK_NAME
+    )
+  end
+end
diff --git a/db/schema_migrations/20230126101907 b/db/schema_migrations/20230126101907
new file mode 100644
index 00000000000..e7006b46b1a
--- /dev/null
+++ b/db/schema_migrations/20230126101907
@@ -0,0 +1 @@
+f6fccc22b53fdc590d5af1b5924275b43334820b66d4f488b3ef6f6d70b4e415
\ No newline at end of file
diff --git a/db/schema_migrations/20230202094723 b/db/schema_migrations/20230202094723
new file mode 100644
index 00000000000..6d18a0b1cf9
--- /dev/null
+++ b/db/schema_migrations/20230202094723
@@ -0,0 +1 @@
+54e3ad80c034d87621c266befc0a6d77b56927bb9afc71375767dcb647bb1aa9
\ No newline at end of file
diff --git a/db/schema_migrations/20230213213559 b/db/schema_migrations/20230213213559
new file mode 100644
index 00000000000..cfe68dc78e4
--- /dev/null
+++ b/db/schema_migrations/20230213213559
@@ -0,0 +1 @@
+bd11c9514186437d2929b32f034256ee2442cf839b0bc6e64490ecff9978d017
\ No newline at end of file
diff --git a/db/schema_migrations/20230220134145 b/db/schema_migrations/20230220134145
new file mode 100644
index 00000000000..91238639d78
--- /dev/null
+++ b/db/schema_migrations/20230220134145
@@ -0,0 +1 @@
+d20d4bd35b5e4132515c731e7df802c0fd6f3e88d4bee2d3b9fe42af4307977c
\ No newline at end of file
diff --git a/db/schema_migrations/20230220134146 b/db/schema_migrations/20230220134146
new file mode 100644
index 00000000000..3d0745d3f22
--- /dev/null
+++ b/db/schema_migrations/20230220134146
@@ -0,0 +1 @@
+7fe8e5e2e9019ccb29f29df161f7b7c45aa2576188b326e60f758dd2d5f56a47
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index fd115fd89c9..caddc2a4956 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -11717,6 +11717,7 @@ CREATE TABLE application_settings (
     allow_runner_registration_token boolean DEFAULT true NOT NULL,
     user_defaults_to_private_profile boolean DEFAULT false NOT NULL,
     allow_possible_spam boolean DEFAULT false NOT NULL,
+    default_syntax_highlighting_theme integer DEFAULT 1 NOT NULL,
     encrypted_product_analytics_clickhouse_connection_string bytea,
     encrypted_product_analytics_clickhouse_connection_string_iv bytea,
     search_max_shard_size_gb integer DEFAULT 50 NOT NULL,
@@ -28961,6 +28962,8 @@ CREATE UNIQUE INDEX idx_vulnerability_issue_links_on_vulnerability_id_and_issue_
 
 CREATE UNIQUE INDEX idx_vulnerability_issue_links_on_vulnerability_id_and_link_type ON vulnerability_issue_links USING btree (vulnerability_id, link_type) WHERE (link_type = 2);
 
+CREATE INDEX idx_vulnerability_reads_project_id_scanner_id_vulnerability_id ON vulnerability_reads USING btree (project_id, scanner_id, vulnerability_id);
+
 CREATE UNIQUE INDEX idx_work_item_types_on_namespace_id_and_name_null_namespace ON work_item_types USING btree (btrim(lower(name)), ((namespace_id IS NULL))) WHERE (namespace_id IS NULL);
 
 CREATE INDEX index_abuse_reports_on_status_and_id ON abuse_reports USING btree (status, id);
@@ -32197,6 +32200,8 @@ CREATE UNIQUE INDEX index_vulns_user_mentions_on_vulnerability_id ON vulnerabili
 
 CREATE UNIQUE INDEX index_vulns_user_mentions_on_vulnerability_id_and_note_id ON vulnerability_user_mentions USING btree (vulnerability_id, note_id);
 
+CREATE INDEX index_web_hook_logs_on_web_hook_id_and_created_at ON ONLY web_hook_logs USING btree (web_hook_id, created_at);
+
 CREATE INDEX index_web_hook_logs_part_on_created_at_and_web_hook_id ON ONLY web_hook_logs USING btree (created_at, web_hook_id);
 
 CREATE INDEX index_web_hook_logs_part_on_web_hook_id ON ONLY web_hook_logs USING btree (web_hook_id);
@@ -35191,10 +35196,7 @@ ALTER TABLE ONLY chat_teams
     ADD CONSTRAINT fk_rails_3b543909cb FOREIGN KEY (namespace_id) REFERENCES namespaces(id) ON DELETE CASCADE;
 
 ALTER TABLE ONLY ci_build_needs
-    ADD CONSTRAINT fk_rails_3cf221d4ed FOREIGN KEY (build_id) REFERENCES ci_builds(id) ON DELETE CASCADE;
-
-ALTER TABLE ONLY ci_build_needs
-    ADD CONSTRAINT fk_rails_3cf221d4ed_p FOREIGN KEY (partition_id, build_id) REFERENCES ci_builds(partition_id, id) ON UPDATE CASCADE ON DELETE CASCADE NOT VALID;
+    ADD CONSTRAINT fk_rails_3cf221d4ed_p FOREIGN KEY (partition_id, build_id) REFERENCES ci_builds(partition_id, id) ON UPDATE CASCADE ON DELETE CASCADE;
 
 ALTER TABLE ONLY cluster_groups
     ADD CONSTRAINT fk_rails_3d28377556 FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
diff --git a/doc/administration/audit_events.md b/doc/administration/audit_events.md
index c51b5fbb431..0d6f6630014 100644
--- a/doc/administration/audit_events.md
+++ b/doc/administration/audit_events.md
@@ -120,7 +120,7 @@ Successful sign-in events are the only audit events available at all tiers. To s
 1. Select your avatar.
 1. Select **Edit profile > Authentication log**.
 
-After upgrading to a paid tier, you can see also see successful sign-in events on audit event pages.
+After upgrading to a paid tier, you can also see successful sign-in events on audit event pages.
 
 ## Filter audit events
 
diff --git a/doc/administration/package_information/supported_os.md b/doc/administration/package_information/supported_os.md
index 9d1c8dcde5a..da16a6c2012 100644
--- a/doc/administration/package_information/supported_os.md
+++ b/doc/administration/package_information/supported_os.md
@@ -32,6 +32,7 @@ The following lists the currently supported OSs and their possible EOL dates.
 | Ubuntu 20.04                                                 | GitLab CE / GitLab EE 13.2.0   | amd64, arm64    | [Ubuntu Install Documentation](https://about.gitlab.com/install/#ubuntu) | April 2025 | <https://wiki.ubuntu.com/Releases>                           |
 | Ubuntu 22.04                                                 | GitLab CE / GitLab EE 15.5.0   | amd64, arm64    | [Ubuntu Install Documentation](https://about.gitlab.com/install/#ubuntu) | April 2027 | <https://wiki.ubuntu.com/Releases>                           |
 | Amazon Linux 2                                               | GitLab CE / GitLab EE 14.9.0   | amd64, arm64    | [Amazon Linux 2 Install Documentation](https://about.gitlab.com/install/#amazonlinux-2) | June 2023  | <https://aws.amazon.com/amazon-linux-2/faqs/>                |
+| Amazon Linux 2022                                            | GitLab CE / GitLab EE 15.9.0   | amd64, arm64    | [Amazon Linux 2022 Install Documentation](https://about.gitlab.com/install/#amazonlinux-2022) | October 2027  | <https://aws.amazon.com/linux/amazon-linux-2022/faqs/>                |
 | Raspberry Pi OS (Buster) (formerly known as Raspbian Buster) | GitLab CE 12.2.0               | armhf           | [Raspberry Pi Install Documentation](https://about.gitlab.com/install/#raspberry-pi-os) | 2024       | [Raspberry Pi Details](https://www.raspberrypi.com/news/new-old-functionality-with-raspberry-pi-os-legacy/) |
 | Raspberry Pi OS (Bullseye) | GitLab CE 15.5.0               | armhf           | [Raspberry Pi Install Documentation](https://about.gitlab.com/install/#raspberry-pi-os) | 2026       | [Raspberry Pi Details](https://www.raspberrypi.com/news/raspberry-pi-os-debian-bullseye/) |
 
diff --git a/doc/api/settings.md b/doc/api/settings.md
index 94ed2b2e3db..5c7890fef23 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -305,6 +305,7 @@ listed in the descriptions of the relevant settings.
 | `default_project_visibility`             | string           | no                                   | What visibility level new projects receive. Can take `private`, `internal` and `public` as a parameter. Default is `private`. |
 | `default_projects_limit`                 | integer          | no                                   | Project limit per user. Default is `100000`. |
 | `default_snippet_visibility`             | string           | no                                   | What visibility level new snippets receive. Can take `private`, `internal` and `public` as a parameter. Default is `private`. |
+| `default_syntax_highlighting_theme`      | integer          | no                                   | Default syntax highlighting theme for users who are not signed in. See [IDs of available themes](https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/themes.rb#L16).
 | `delayed_project_deletion` **(PREMIUM SELF)** | boolean     | no                                   | Enable delayed project deletion by default in new groups. Default is `false`. [From GitLab 15.1](https://gitlab.com/gitlab-org/gitlab/-/issues/352960), can only be enabled when `delayed_group_deletion` is true. |
 | `delayed_group_deletion` **(PREMIUM SELF)**   | boolean     | no                                   | Enable delayed group deletion. Default is `true`. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/352959) in GitLab 15.0. [From GitLab 15.1](https://gitlab.com/gitlab-org/gitlab/-/issues/352960), disables and locks the group-level setting for delayed protect deletion when set to `false`.  |
 | `deletion_adjourned_period` **(PREMIUM SELF)** | integer    | no                                   | The number of days to wait before deleting a project or group that is marked for deletion. Value must be between `1` and `90`. Defaults to `7`. [From GitLab 15.1](https://gitlab.com/gitlab-org/gitlab/-/issues/352960), a hook on `deletion_adjourned_period` sets the period to `1` on every update, and sets both `delayed_project_deletion` and `delayed_group_deletion` to `false` if the period is `0`. |
diff --git a/lib/container_registry/gitlab_api_client.rb b/lib/container_registry/gitlab_api_client.rb
index 5dddd421223..d3c0ec03983 100644
--- a/lib/container_registry/gitlab_api_client.rb
+++ b/lib/container_registry/gitlab_api_client.rb
@@ -22,6 +22,8 @@ module ContainerRegistry
     REGISTRY_GITLAB_V1_API_FEATURE = 'gitlab_v1_api'
 
     MAX_TAGS_PAGE_SIZE = 1000
+    MAX_REPOSITORIES_PAGE_SIZE = 1000
+    PAGE_SIZE = 1
 
     UnsuccessfulResponseError = Class.new(StandardError)
 
@@ -37,6 +39,21 @@ module ContainerRegistry
       end
     end
 
+    def self.one_project_with_container_registry_tag(path)
+      with_dummy_client(token_config: { type: :nested_repositories_token, path: path&.downcase }) do |client|
+        page = client.sub_repositories_with_tag(path&.downcase, page_size: PAGE_SIZE)
+        details = page[:response_body]&.first
+
+        break unless details
+
+        path = ContainerRegistry::Path.new(details["path"])
+
+        break unless path.valid?
+
+        ContainerRepository.find_by_path(path)&.project
+      end
+    end
+
     # https://gitlab.com/gitlab-org/container-registry/-/blob/master/docs-gitlab/api.md#compliance-check
     def supports_gitlab_api?
       strong_memoize(:supports_gitlab_api) do
@@ -133,6 +150,37 @@ module ContainerRegistry
       end
     end
 
+    # https://gitlab.com/gitlab-org/container-registry/-/blob/master/docs-gitlab/api.md#list-sub-repositories
+    def sub_repositories_with_tag(path, page_size: 100, last: nil)
+      limited_page_size = [page_size, MAX_REPOSITORIES_PAGE_SIZE].min
+
+      with_token_faraday do |faraday_client|
+        url = "/gitlab/v1/repository-paths/#{path}/repositories/list/"
+        response = faraday_client.get(url) do |req|
+          req.params['n'] = limited_page_size
+          req.params['last'] = last if last
+        end
+
+        unless response.success?
+          Gitlab::ErrorTracking.log_exception(
+            UnsuccessfulResponseError.new,
+            class: self.class.name,
+            url: url,
+            status_code: response.status
+          )
+
+          break {}
+        end
+
+        link_parser = Gitlab::Utils::LinkHeaderParser.new(response.headers['link'])
+
+        {
+          pagination: link_parser.parse,
+          response_body: response_body(response)
+        }
+      end
+    end
+
     private
 
     def start_import_for(path, pre:)
diff --git a/lib/gitlab/color_schemes.rb b/lib/gitlab/color_schemes.rb
index 3884f5f0428..1ba99e23d65 100644
--- a/lib/gitlab/color_schemes.rb
+++ b/lib/gitlab/color_schemes.rb
@@ -46,7 +46,7 @@ module Gitlab
     #
     # Returns a Scheme
     def self.default
-      by_id(1)
+      by_id(Gitlab::CurrentSettings.default_syntax_highlighting_theme)
     end
 
     # Iterate through each Scheme
diff --git a/lib/gitlab/database/partitioning/partition_manager.rb b/lib/gitlab/database/partitioning/partition_manager.rb
index 55ca9ff8645..124fae582d3 100644
--- a/lib/gitlab/database/partitioning/partition_manager.rb
+++ b/lib/gitlab/database/partitioning/partition_manager.rb
@@ -34,6 +34,8 @@ module Gitlab
             create(partitions_to_create) unless partitions_to_create.empty?
             detach(partitions_to_detach) unless partitions_to_detach.empty?
           end
+        rescue ArgumentError => e
+          Gitlab::ErrorTracking.track_and_raise_for_dev_exception(e)
         rescue StandardError => e
           Gitlab::AppLogger.error(
             message: "Failed to create / detach partition(s)",
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 9d9a472a40c..7b97996e855 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -51407,6 +51407,9 @@ msgstr ""
 msgid "must be a valid json schema"
 msgstr ""
 
+msgid "must be a valid syntax highlighting theme ID"
+msgstr ""
+
 msgid "must be after start"
 msgstr ""
 
diff --git a/spec/db/schema_spec.rb b/spec/db/schema_spec.rb
index 17647a0a6c9..8b9bcfdeaba 100644
--- a/spec/db/schema_spec.rb
+++ b/spec/db/schema_spec.rb
@@ -35,7 +35,7 @@ RSpec.describe 'Database schema', feature_category: :database do
     boards: %w[milestone_id iteration_id],
     chat_names: %w[chat_id team_id user_id integration_id],
     chat_teams: %w[team_id],
-    ci_build_needs: %w[partition_id],
+    ci_build_needs: %w[partition_id build_id],
     ci_build_pending_states: %w[partition_id build_id],
     ci_build_report_results: %w[partition_id],
     ci_build_trace_chunks: %w[partition_id build_id],
diff --git a/spec/factories/users.rb b/spec/factories/users.rb
index a3a2af52807..10de7bc3b5b 100644
--- a/spec/factories/users.rb
+++ b/spec/factories/users.rb
@@ -10,6 +10,7 @@ FactoryBot.define do
     confirmed_at { Time.now }
     confirmation_token { nil }
     can_create_group { true }
+    color_scheme_id { 1 }
 
     trait :admin do
       admin { true }
diff --git a/spec/lib/container_registry/gitlab_api_client_spec.rb b/spec/lib/container_registry/gitlab_api_client_spec.rb
index 7d78aad8b13..73364ec9698 100644
--- a/spec/lib/container_registry/gitlab_api_client_spec.rb
+++ b/spec/lib/container_registry/gitlab_api_client_spec.rb
@@ -320,6 +320,98 @@ RSpec.describe ContainerRegistry::GitlabApiClient do
     end
   end
 
+  describe '#sub_repositories_with_tag' do
+    let(:path) { 'namespace/path/to/repository' }
+    let(:page_size) { 100 }
+    let(:last) { nil }
+    let(:response) do
+      [
+        {
+          "name": "docker-alpine",
+          "path": "gitlab-org/build/cng/docker-alpine",
+          "created_at": "2022-06-07T12:11:13.633+00:00",
+          "updated_at": "2022-06-07T14:37:49.251+00:00"
+        },
+        {
+          "name": "git-base",
+          "path": "gitlab-org/build/cng/git-base",
+          "created_at": "2022-06-07T12:11:13.633+00:00",
+          "updated_at": "2022-06-07T14:37:49.251+00:00"
+        }
+      ]
+    end
+
+    let(:result_with_no_pagination) do
+      {
+        pagination: {},
+        response_body: ::Gitlab::Json.parse(response.to_json)
+      }
+    end
+
+    subject { client.sub_repositories_with_tag(path, page_size: page_size, last: last) }
+
+    context 'with valid parameters' do
+      before do
+        stub_sub_repositories_with_tag(path, page_size: page_size, respond_with: response)
+      end
+
+      it { is_expected.to eq(result_with_no_pagination) }
+    end
+
+    context 'with a response with a link header' do
+      let(:next_page_url) { 'http://sandbox.org/test?last=c' }
+      let(:expected) do
+        {
+          pagination: { next: { uri: URI(next_page_url) } },
+          response_body: ::Gitlab::Json.parse(response.to_json)
+        }
+      end
+
+      before do
+        stub_sub_repositories_with_tag(path, page_size: page_size, next_page_url: next_page_url, respond_with: response)
+      end
+
+      it { is_expected.to eq(expected) }
+    end
+
+    context 'with a large page size set' do
+      let(:page_size) { described_class::MAX_TAGS_PAGE_SIZE + 1000 }
+
+      before do
+        stub_sub_repositories_with_tag(path, page_size: described_class::MAX_TAGS_PAGE_SIZE, respond_with: response)
+      end
+
+      it { is_expected.to eq(result_with_no_pagination) }
+    end
+
+    context 'with a last parameter set' do
+      let(:last) { 'test' }
+
+      before do
+        stub_sub_repositories_with_tag(path, page_size: page_size, last: last, respond_with: response)
+      end
+
+      it { is_expected.to eq(result_with_no_pagination) }
+    end
+
+    context 'with non successful response' do
+      before do
+        stub_sub_repositories_with_tag(path, page_size: page_size, status_code: 404)
+      end
+
+      it 'logs an error and returns an empty hash' do
+        expect(Gitlab::ErrorTracking)
+          .to receive(:log_exception).with(
+            instance_of(described_class::UnsuccessfulResponseError),
+            class: described_class.name,
+            url: "/gitlab/v1/repository-paths/#{path}/repositories/list/",
+            status_code: 404
+          )
+        expect(subject).to eq({})
+      end
+    end
+  end
+
   describe '.supports_gitlab_api?' do
     subject { described_class.supports_gitlab_api? }
 
@@ -439,6 +531,90 @@ RSpec.describe ContainerRegistry::GitlabApiClient do
     end
   end
 
+  describe '.one_project_with_container_registry_tag' do
+    let(:path) { 'build/cng/docker-alpine' }
+    let(:response_body) do
+      [
+        {
+          "name" => "docker-alpine",
+          "path" => path,
+          "created_at" => "2022-06-07T12:11:13.633+00:00",
+          "updated_at" => "2022-06-07T14:37:49.251+00:00"
+        }
+      ]
+    end
+
+    let(:response) do
+      {
+        pagination: { next: { uri: URI('http://sandbox.org/test?last=x') } },
+        response_body: ::Gitlab::Json.parse(response_body.to_json)
+      }
+    end
+
+    let_it_be(:group) { create(:group, path: 'build') }
+    let_it_be(:project) { create(:project, name: 'cng', namespace: group) }
+    let_it_be(:container_repository) { create(:container_repository, project: project, name: "docker-alpine") }
+
+    shared_examples 'fetching the project from container repository and path' do
+      it 'fetches the project from the given path details' do
+        expect(ContainerRegistry::Path).to receive(:new).with(path).and_call_original
+        expect(ContainerRepository).to receive(:find_by_path).and_call_original
+
+        expect(subject).to eq(project)
+      end
+
+      it 'returns nil when path is invalid' do
+        registry_path = ContainerRegistry::Path.new('invalid')
+        expect(ContainerRegistry::Path).to receive(:new).with(path).and_return(registry_path)
+        expect(registry_path.valid?).to eq(false)
+
+        expect(subject).to eq(nil)
+      end
+
+      it 'returns nil when there is no container_repository matching the path' do
+        expect(ContainerRegistry::Path).to receive(:new).with(path).and_call_original
+        expect(ContainerRepository).to receive(:find_by_path).and_return(nil)
+
+        expect(subject).to eq(nil)
+      end
+    end
+
+    subject { described_class.one_project_with_container_registry_tag(path) }
+
+    before do
+      expect(Auth::ContainerRegistryAuthenticationService).to receive(:pull_nested_repositories_access_token).with(path.downcase).and_return(token)
+      stub_container_registry_config(enabled: true, api_url: registry_api_url, key: 'spec/fixtures/x509_certificate_pk.key')
+    end
+
+    context 'with successful response' do
+      before do
+        stub_sub_repositories_with_tag(path, page_size: 1, respond_with: response_body)
+      end
+
+      it_behaves_like 'fetching the project from container repository and path'
+    end
+
+    context 'with unsuccessful response' do
+      before do
+        stub_sub_repositories_with_tag(path, page_size: 1, status_code: 404, respond_with: {})
+      end
+
+      it { is_expected.to eq(nil) }
+    end
+
+    context 'with uppercase path' do
+      let(:path) { 'BuilD/CNG/docker-alpine' }
+
+      before do
+        expect_next_instance_of(described_class) do |client|
+          expect(client).to receive(:sub_repositories_with_tag).with(path.downcase, page_size: 1).and_return(response.with_indifferent_access).once
+        end
+      end
+
+      it_behaves_like 'fetching the project from container repository and path'
+    end
+  end
+
   def stub_pre_import(path, status_code, pre:)
     import_type = pre ? 'pre' : 'final'
     stub_request(:put, "#{registry_api_url}/gitlab/v1/import/#{path}/?import_type=#{import_type}")
@@ -525,4 +701,30 @@ RSpec.describe ContainerRegistry::GitlabApiClient do
         headers: response_headers
       )
   end
+
+  def stub_sub_repositories_with_tag(path, page_size: nil, last: nil, next_page_url: nil, status_code: 200, respond_with: {})
+    params = { n: page_size, last: last }.compact
+
+    url = "#{registry_api_url}/gitlab/v1/repository-paths/#{path}/repositories/list/"
+
+    if params.present?
+      url += "?#{params.map { |param, val| "#{param}=#{val}" }.join('&')}"
+    end
+
+    request_headers = { 'Accept' => described_class::JSON_TYPE }
+    request_headers['Authorization'] = "bearer #{token}" if token
+
+    response_headers = { 'Content-Type' => described_class::JSON_TYPE }
+    if next_page_url
+      response_headers['Link'] = "<#{next_page_url}>; rel=\"next\""
+    end
+
+    stub_request(:get, url)
+      .with(headers: request_headers)
+      .to_return(
+        status: status_code,
+        body: respond_with.to_json,
+        headers: response_headers
+      )
+  end
 end
diff --git a/spec/lib/gitlab/color_schemes_spec.rb b/spec/lib/gitlab/color_schemes_spec.rb
index feb5648ff2d..bc69c8beeda 100644
--- a/spec/lib/gitlab/color_schemes_spec.rb
+++ b/spec/lib/gitlab/color_schemes_spec.rb
@@ -21,8 +21,9 @@ RSpec.describe Gitlab::ColorSchemes do
   end
 
   describe '.default' do
-    it 'returns the default scheme' do
-      expect(described_class.default.id).to eq 1
+    it 'use config default' do
+      stub_application_setting(default_syntax_highlighting_theme: 2)
+      expect(described_class.default.id).to eq 2
     end
   end
 
@@ -36,7 +37,8 @@ RSpec.describe Gitlab::ColorSchemes do
 
   describe '.for_user' do
     it 'returns default when user is nil' do
-      expect(described_class.for_user(nil).id).to eq 1
+      stub_application_setting(default_syntax_highlighting_theme: 2)
+      expect(described_class.for_user(nil).id).to eq 2
     end
 
     it "returns user's preferred color scheme" do
diff --git a/spec/lib/gitlab/database/partitioning/partition_manager_spec.rb b/spec/lib/gitlab/database/partitioning/partition_manager_spec.rb
index 2212cb09888..c7e4eaf8f46 100644
--- a/spec/lib/gitlab/database/partitioning/partition_manager_spec.rb
+++ b/spec/lib/gitlab/database/partitioning/partition_manager_spec.rb
@@ -45,7 +45,7 @@ RSpec.describe Gitlab::Database::Partitioning::PartitionManager do
         sync_partitions
       end
 
-      context 'with eplicitly provided connection' do
+      context 'with explicitly provided connection' do
         let(:connection) { Ci::ApplicationRecord.connection }
 
         it 'uses the explicitly provided connection when any' do
@@ -59,6 +59,14 @@ RSpec.describe Gitlab::Database::Partitioning::PartitionManager do
         end
       end
 
+      context 'when an ArgumentError occurs during partition management' do
+        it 'raises error' do
+          expect(partitioning_strategy).to receive(:missing_partitions).and_raise(ArgumentError)
+
+          expect { sync_partitions }.to raise_error(ArgumentError)
+        end
+      end
+
       context 'when an error occurs during partition management' do
         it 'does not raise an error' do
           expect(partitioning_strategy).to receive(:missing_partitions).and_raise('this should never happen (tm)')
diff --git a/spec/models/application_setting_spec.rb b/spec/models/application_setting_spec.rb
index 5b99c68ec80..762b613a585 100644
--- a/spec/models/application_setting_spec.rb
+++ b/spec/models/application_setting_spec.rb
@@ -1124,6 +1124,11 @@ RSpec.describe ApplicationSetting, feature_category: :not_owned, type: :model do
       it { is_expected.to allow_value(*Gitlab::I18n.available_locales).for(:default_preferred_language) }
       it { is_expected.not_to allow_value(nil, '', 'invalid_locale').for(:default_preferred_language) }
     end
+
+    context 'for default_syntax_highlighting_theme' do
+      it { is_expected.to allow_value(*Gitlab::ColorSchemes.valid_ids).for(:default_syntax_highlighting_theme) }
+      it { is_expected.not_to allow_value(nil, 0, Gitlab::ColorSchemes.available_schemes.size + 1).for(:default_syntax_highlighting_theme) }
+    end
   end
 
   context 'restrict creating duplicates' do
diff --git a/spec/models/ci/runner_machine_build_spec.rb b/spec/models/ci/runner_machine_build_spec.rb
index cf62731a551..b15d232cbb5 100644
--- a/spec/models/ci/runner_machine_build_spec.rb
+++ b/spec/models/ci/runner_machine_build_spec.rb
@@ -35,4 +35,16 @@ RSpec.describe Ci::RunnerMachineBuild, model: true, feature_category: :runner_fl
       end
     end
   end
+
+  describe 'ci_sliding_list partitioning' do
+    let(:connection) { described_class.connection }
+    let(:partition_manager) { Gitlab::Database::Partitioning::PartitionManager.new(described_class) }
+
+    let(:partitioning_strategy) { described_class.partitioning_strategy }
+
+    it { expect(partitioning_strategy.missing_partitions).to be_empty }
+    it { expect(partitioning_strategy.extra_partitions).to be_empty }
+    it { expect(partitioning_strategy.current_partitions).to include partitioning_strategy.initial_partition }
+    it { expect(partitioning_strategy.active_partition).to be_present }
+  end
 end
diff --git a/spec/models/container_repository_spec.rb b/spec/models/container_repository_spec.rb
index da7b54644bd..ef9ff145cfa 100644
--- a/spec/models/container_repository_spec.rb
+++ b/spec/models/container_repository_spec.rb
@@ -23,6 +23,9 @@ RSpec.describe ContainerRepository, :aggregate_failures, feature_category: :cont
         status: 200,
         body: Gitlab::Json.dump(tags: ['test_tag']),
         headers: { 'Content-Type' => 'application/json' })
+
+    # for the user callback: namespace_move_dir_allowed
+    allow(ContainerRegistry::GitlabApiClient).to receive(:one_project_with_container_registry_tag).and_return(nil)
   end
 
   it_behaves_like 'having unique enum values'
diff --git a/spec/models/namespace_spec.rb b/spec/models/namespace_spec.rb
index a0698ac30f5..3f6d5615164 100644
--- a/spec/models/namespace_spec.rb
+++ b/spec/models/namespace_spec.rb
@@ -713,20 +713,57 @@ RSpec.describe Namespace, feature_category: :subgroups do
     let(:container_repository) { create(:container_repository) }
     let!(:project) { create(:project, namespace: namespace, container_repositories: [container_repository]) }
 
-    before do
-      stub_container_registry_config(enabled: true)
-    end
+    context 'not on gitlab.com' do
+      before do
+        stub_container_registry_config(enabled: true)
+        allow(Gitlab).to receive(:com?).and_return(false)
+      end
+
+      it 'returns the project' do
+        stub_container_registry_tags(repository: :any, tags: ['tag'])
+
+        expect(namespace.first_project_with_container_registry_tags).to eq(project)
+      end
 
-    it 'returns the project' do
-      stub_container_registry_tags(repository: :any, tags: ['tag'])
+      it 'returns no project' do
+        stub_container_registry_tags(repository: :any, tags: nil)
 
-      expect(namespace.first_project_with_container_registry_tags).to eq(project)
+        expect(namespace.first_project_with_container_registry_tags).to be_nil
+      end
     end
 
-    it 'returns no project' do
-      stub_container_registry_tags(repository: :any, tags: nil)
+    context 'on gitlab.com' do
+      before do
+        allow(Gitlab).to receive(:com?).and_return(true)
+        stub_container_registry_config(enabled: true, api_url: 'http://container-registry', key: 'spec/fixtures/x509_certificate_pk.key')
+      end
 
-      expect(namespace.first_project_with_container_registry_tags).to be_nil
+      it 'calls and returns GitlabApiClient.one_project_with_container_registry_tag' do
+        expect(ContainerRegistry::GitlabApiClient)
+          .to receive(:one_project_with_container_registry_tag)
+          .with(namespace.full_path)
+          .and_return(project)
+
+        expect(namespace.first_project_with_container_registry_tags).to eq(project)
+      end
+
+      context 'when the feature flag use_sub_repositories_api is disabled' do
+        before do
+          stub_feature_flags(use_sub_repositories_api: false)
+        end
+
+        it 'returns the project' do
+          stub_container_registry_tags(repository: :any, tags: ['tag'])
+
+          expect(namespace.first_project_with_container_registry_tags).to eq(project)
+        end
+
+        it 'returns no project' do
+          stub_container_registry_tags(repository: :any, tags: nil)
+
+          expect(namespace.first_project_with_container_registry_tags).to be_nil
+        end
+      end
     end
   end
 
@@ -755,6 +792,7 @@ RSpec.describe Namespace, feature_category: :subgroups do
 
       with_them do
         before do
+          allow(ContainerRegistry::GitlabApiClient).to receive(:one_project_with_container_registry_tag).and_return(nil)
           stub_container_registry_config(enabled: true, api_url: 'http://container-registry', key: 'spec/fixtures/x509_certificate_pk.key')
           allow(Gitlab).to receive(:com?).and_return(true)
           allow(ContainerRegistry::GitlabApiClient).to receive(:supports_gitlab_api?).and_return(gitlab_api_supported)
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index e87667d9604..360aee8b531 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -188,6 +188,7 @@ RSpec.describe User, feature_category: :user_profile do
       it { expect(user.notified_of_own_activity).to be_falsey }
       it { expect(user.preferred_language).to eq(Gitlab::CurrentSettings.default_preferred_language) }
       it { expect(user.theme_id).to eq(described_class.gitlab_config.default_theme) }
+      it { expect(user.color_scheme_id).to eq(Gitlab::CurrentSettings.default_syntax_highlighting_theme) }
     end
 
     describe '#user_detail' do
diff --git a/spec/requests/api/settings_spec.rb b/spec/requests/api/settings_spec.rb
index 4d85849cff3..cc377e94038 100644
--- a/spec/requests/api/settings_spec.rb
+++ b/spec/requests/api/settings_spec.rb
@@ -66,6 +66,7 @@ RSpec.describe API::Settings, 'Settings', :do_not_mock_admin_mode_setting, featu
       expect(json_response['jira_connect_application_key']).to eq(nil)
       expect(json_response['jira_connect_proxy_url']).to eq(nil)
       expect(json_response['user_defaults_to_private_profile']).to eq(false)
+      expect(json_response['default_syntax_highlighting_theme']).to eq(1)
     end
   end
 
@@ -169,7 +170,8 @@ RSpec.describe API::Settings, 'Settings', :do_not_mock_admin_mode_setting, featu
             jira_connect_proxy_url: 'http://example.com',
             bulk_import_enabled: false,
             allow_runner_registration_token: true,
-            user_defaults_to_private_profile: true
+            user_defaults_to_private_profile: true,
+            default_syntax_highlighting_theme: 2
           }
 
         expect(response).to have_gitlab_http_status(:ok)
@@ -237,6 +239,7 @@ RSpec.describe API::Settings, 'Settings', :do_not_mock_admin_mode_setting, featu
         expect(json_response['bulk_import_enabled']).to be(false)
         expect(json_response['allow_runner_registration_token']).to be(true)
         expect(json_response['user_defaults_to_private_profile']).to be(true)
+        expect(json_response['default_syntax_highlighting_theme']).to eq(2)
       end
     end
 
diff --git a/spec/workers/container_registry/migration/guard_worker_spec.rb b/spec/workers/container_registry/migration/guard_worker_spec.rb
index 4ad2d5c300c..61138094e86 100644
--- a/spec/workers/container_registry/migration/guard_worker_spec.rb
+++ b/spec/workers/container_registry/migration/guard_worker_spec.rb
@@ -214,6 +214,8 @@ RSpec.describe ContainerRegistry::Migration::GuardWorker, :aggregate_failures do
         let(:stale_migration) { create(:container_repository, :pre_import_done, migration_pre_import_done_at: 11.minutes.ago) }
 
         before do
+          # for the user callback: namespace_move_dir_allowed
+          allow(ContainerRegistry::GitlabApiClient).to receive(:one_project_with_container_registry_tag).and_return(nil)
           allow(::ContainerRegistry::Migration).to receive(:max_step_duration).and_return(5.minutes)
         end
 
@@ -238,6 +240,8 @@ RSpec.describe ContainerRegistry::Migration::GuardWorker, :aggregate_failures do
         let(:import_status) { 'test' }
 
         before do
+          # for the user callback: namespace_move_dir_allowed
+          allow(ContainerRegistry::GitlabApiClient).to receive(:one_project_with_container_registry_tag).and_return(nil)
           allow_next_instance_of(ContainerRegistry::GitlabApiClient) do |client|
             allow(client).to receive(:import_status).and_return(import_status)
           end