Add latest changes from gitlab-org/gitlab@master

18 files changed, 145 insertions, 32 deletions

diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 9b437bc4f05..74e958a0b93 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-5376d026d3b602a4227d767a10e8d7ef76208d33
+125aa5ddeb59977b974a13cc460663209c6bd2f4
diff --git a/app/assets/javascripts/pipelines/components/pipelines_list/pipeline_multi_actions.vue b/app/assets/javascripts/pipelines/components/pipelines_list/pipeline_multi_actions.vue
index 635511eb0b4..3470c963ade 100644
--- a/app/assets/javascripts/pipelines/components/pipelines_list/pipeline_multi_actions.vue
+++ b/app/assets/javascripts/pipelines/components/pipelines_list/pipeline_multi_actions.vue
@@ -100,7 +100,7 @@ export default {
 
     <gl-loading-icon v-if="isLoading" size="sm" />
 
-    <gl-dropdown-item v-if="!artifacts.length" data-testid="artifacts-empty-message">
+    <gl-dropdown-item v-if="!artifacts.length && !isLoading" data-testid="artifacts-empty-message">
       {{ $options.i18n.emptyArtifactsMessage }}
     </gl-dropdown-item>
 
diff --git a/app/experiments/combined_registration_experiment.rb b/app/experiments/combined_registration_experiment.rb
index 3ba6195a62a..da699449d77 100644
--- a/app/experiments/combined_registration_experiment.rb
+++ b/app/experiments/combined_registration_experiment.rb
@@ -3,6 +3,10 @@
 class CombinedRegistrationExperiment < ApplicationExperiment # rubocop:disable Gitlab/NamespacedClass
   include Rails.application.routes.url_helpers
 
+  def key_for(source, _ = nil)
+    super(source, 'force_company_trial')
+  end
+
   def redirect_path(trial_params)
     @trial_params = trial_params
 
diff --git a/app/graphql/types/ci/job_type.rb b/app/graphql/types/ci/job_type.rb
index 4a3518e1865..48bd91bfc5b 100644
--- a/app/graphql/types/ci/job_type.rb
+++ b/app/graphql/types/ci/job_type.rb
@@ -2,9 +2,10 @@
 
 module Types
   module Ci
+    # rubocop: disable Graphql/AuthorizeTypes
+    # The permission is presented through `StageType` that has its own authorization
     class JobType < BaseObject
       graphql_name 'CiJob'
-      authorize :read_commit_status
 
       connection_type_class(Types::CountableConnectionType)
 
diff --git a/app/graphql/types/terraform/state_version_type.rb b/app/graphql/types/terraform/state_version_type.rb
index e057be5f9b3..bf1af4565bc 100644
--- a/app/graphql/types/terraform/state_version_type.rb
+++ b/app/graphql/types/terraform/state_version_type.rb
@@ -23,7 +23,8 @@ module Types
 
       field :job, Types::Ci::JobType,
             null: true,
-            description: 'Job that created this version.'
+            description: 'Job that created this version.',
+            authorize: :read_commit_status
 
       field :serial, GraphQL::Types::Int,
             null: true,
diff --git a/data/deprecations/14-3-repository-push-audit-events.yml b/data/deprecations/14-3-repository-push-audit-events.yml
new file mode 100644
index 00000000000..9f9f9809663
--- /dev/null
+++ b/data/deprecations/14-3-repository-push-audit-events.yml
@@ -0,0 +1,14 @@
+- name: "Audit events for repository push events"
+  announcement_milestone: "14.3" # The milestone when this feature was first announced as deprecated.
+  removal_milestone: "15.0" # the milestone when this feature is planned to be removed
+  body: | # Do not modify this line, instead modify the lines below.
+    Audit events for [repository events](../administration/audit_events.md#repository-push) are now deprecated and will be removed in GitLab 15.0.
+
+    These events have always been disabled by default and had to be manually enabled with a
+    feature flag. Enabling them can cause too many events to be generated which can
+    dramatically slow down GitLab instances. For this reason, they are being removed.
+  stage: Manage
+  tiers: Premium
+  issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/337993
+  documentation_url: ../administration/audit_events.md
+  announcement_date: 2021-09-02 # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/69024
diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md
index ecfc6e16071..22b36110695 100644
--- a/doc/update/deprecations.md
+++ b/doc/update/deprecations.md
@@ -16,4 +16,12 @@ To add a deprecation, use the example.yml file in `/data/deprecations/templates`
 then run `bin/rake gitlab:docs:compile_deprecations`.
 -->
 
-Deprecated features scheduled for removal will be listed here, sorted by GitLab milestone.
+## 15.0
+
+### Audit events for repository push events
+
+Audit events for [repository events](../administration/audit_events.md#repository-push) are now deprecated and will be removed in GitLab 15.0.
+
+These events have always been disabled by default and had to be manually enabled with a
+feature flag. Enabling them can cause too many events to be generated which can
+dramatically slow down GitLab instances. For this reason, they are being removed.
diff --git a/doc/user/group/roadmap/img/epics_state_dropdown_v12_10.png b/doc/user/group/roadmap/img/epics_state_dropdown_v12_10.png
deleted file mode 100644
index c6d0b17455f..00000000000
--- a/doc/user/group/roadmap/img/epics_state_dropdown_v12_10.png
+++ /dev/null
diff --git a/doc/user/group/roadmap/img/epics_state_dropdown_v14_3.png b/doc/user/group/roadmap/img/epics_state_dropdown_v14_3.png
new file mode 100644
index 00000000000..171876e34a9
--- /dev/null
+++ b/doc/user/group/roadmap/img/epics_state_dropdown_v14_3.png
diff --git a/doc/user/group/roadmap/img/roadmap_view_v13_2.png b/doc/user/group/roadmap/img/roadmap_view_v13_2.png
deleted file mode 100644
index 94cf2258569..00000000000
--- a/doc/user/group/roadmap/img/roadmap_view_v13_2.png
+++ /dev/null
diff --git a/doc/user/group/roadmap/img/roadmap_view_v14_3.png b/doc/user/group/roadmap/img/roadmap_view_v14_3.png
new file mode 100644
index 00000000000..ca4b87b9fdd
--- /dev/null
+++ b/doc/user/group/roadmap/img/roadmap_view_v14_3.png
diff --git a/doc/user/group/roadmap/index.md b/doc/user/group/roadmap/index.md
index 811297c6eda..656c40d1915 100644
--- a/doc/user/group/roadmap/index.md
+++ b/doc/user/group/roadmap/index.md
@@ -32,7 +32,7 @@ When you hover over a milestone bar or title, a popover appears with its title,
 date. You can also click the chevron (**{chevron-down}**) next to the **Milestones** heading to
 toggle the list of the milestone bars.
 
-![roadmap view](img/roadmap_view_v13_2.png)
+![roadmap view](img/roadmap_view_v14_3.png)
 
 ## Sort and filter the Roadmap
 
@@ -52,7 +52,7 @@ filtering them by what's important for you.
 
 A dropdown menu lets you show only open or closed epics. By default, all epics are shown.
 
-![epics state dropdown](img/epics_state_dropdown_v12_10.png)
+![epics state dropdown](img/epics_state_dropdown_v14_3.png)
 
 You can sort epics in the Roadmap view by:
 
@@ -101,18 +101,38 @@ Feature.disable(:async_filtering)
 > - Introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.0.
 > - In [GitLab 12.9](https://gitlab.com/gitlab-org/gitlab/-/issues/198062), Timelines were moved to the Premium tier.
 
-Roadmap supports the following date ranges:
+### Date range presets
 
-- Quarters
-- Months (default)
-- Weeks
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/204994) in GitLab 14.3. [Deployed behind the `roadmap_daterange_filter` flag](../../../administration/feature_flags.md), disabled by default.
+> - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/323917) in GitLab 14.3.
+
+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available per group,
+ask an administrator to [enable the `roadmap_daterange_filter` flag](../../../administration/feature_flags.md).
+On GitLab.com, this feature is available.
+The feature is ready for production use.
+
+Roadmap provides three date range options, each with predetermined timeline duration:
+
+- **This quarter**: includes weeks present in current quarter.
+- **This year**: includes weeks or months present in current year.
+- **Within 3 years**: includes weeks, months, or quarters present in the previous 18 months and
+  upcoming 18 months (that is, three years in total).
+
+### Layout presets
+
+Depending on selected [date range preset](#date-range-presets), Roadmap supports the following layout presets:
+
+- **Quarters**: only available when the "Within 3 years" date range is selected.
+- **Months**: available when either "This year" or "Within 3 years" date range is selected.
+- **Weeks** (default): available for all the date range presets.
 
 ### Quarters
 
 ![roadmap date range in quarters](img/roadmap_timeline_quarters.png)
 
 In the **Quarters** preset, roadmap shows epics and milestones which have start or due dates
-**falling within** or **going through** past quarter, current quarter, and the next four quarters,
+**falling within** currently selected date range preset,
 where **today**
 is shown by the vertical red line in the timeline. The sub-headers underneath the quarter name on
 the timeline header represent the month of the quarter.
@@ -123,7 +143,7 @@ the timeline header represent the month of the quarter.
 
 In the **Months** preset, roadmap shows epics and milestones which have start or due dates
 **falling within** or
-**going through** the past month, current month, and the next five months, where **today**
+**going through** currently selected date range preset, where **today**
 is shown by the vertical red line in the timeline. The sub-headers underneath the month name on
 the timeline header represent the date on starting day (Sunday) of the week. This preset is
 selected by default.
@@ -133,7 +153,7 @@ selected by default.
 ![roadmap date range in weeks](img/roadmap_timeline_weeks.png)
 
 In the **Weeks** preset, roadmap shows epics and milestones which have start or due dates **falling
-within** or **going through** the past week, current week and the next four weeks, where **today**
+within** or **going through** currently selected date range preset, where **today**
 is shown by the vertical red line in the timeline. The sub-headers underneath the week name on
 the timeline header represent the days of the week.
 
diff --git a/lib/api/ci/pipelines.rb b/lib/api/ci/pipelines.rb
index 6e786ecd500..03b59e7e6ad 100644
--- a/lib/api/ci/pipelines.rb
+++ b/lib/api/ci/pipelines.rb
@@ -7,8 +7,6 @@ module API
 
       before { authenticate_non_get! }
 
-      feature_category :continuous_integration
-
       params do
         requires :id, type: String, desc: 'The project ID'
       end
@@ -53,7 +51,7 @@ module API
                               desc: 'Sort pipelines'
           optional :source,   type: String, values: ::Ci::Pipeline.sources.keys
         end
-        get ':id/pipelines' do
+        get ':id/pipelines', feature_category: :continuous_integration do
           authorize! :read_pipeline, user_project
           authorize! :read_build, user_project
 
@@ -69,7 +67,7 @@ module API
           requires :ref, type: String, desc: 'Reference'
           optional :variables, Array, desc: 'Array of variables available in the pipeline'
         end
-        post ':id/pipeline' do
+        post ':id/pipeline', feature_category: :continuous_integration do
           Gitlab::QueryLimiting.disable!('https://gitlab.com/gitlab-org/gitlab/-/issues/20711')
 
           authorize! :create_pipeline, user_project
@@ -96,7 +94,7 @@ module API
         params do
           optional :ref, type: String, desc: 'branch ref of pipeline'
         end
-        get ':id/pipelines/latest' do
+        get ':id/pipelines/latest', feature_category: :continuous_integration do
           authorize! :read_pipeline, latest_pipeline
 
           present latest_pipeline, with: Entities::Ci::Pipeline
@@ -109,7 +107,7 @@ module API
         params do
           requires :pipeline_id, type: Integer, desc: 'The pipeline ID'
         end
-        get ':id/pipelines/:pipeline_id' do
+        get ':id/pipelines/:pipeline_id', feature_category: :continuous_integration do
           authorize! :read_pipeline, pipeline
 
           present pipeline, with: Entities::Ci::Pipeline
@@ -125,7 +123,7 @@ module API
           use :pagination
         end
 
-        get ':id/pipelines/:pipeline_id/jobs' do
+        get ':id/pipelines/:pipeline_id/jobs', feature_category: :continuous_integration do
           authorize!(:read_pipeline, user_project)
 
           pipeline = user_project.all_pipelines.find(params[:pipeline_id])
@@ -148,7 +146,7 @@ module API
           use :pagination
         end
 
-        get ':id/pipelines/:pipeline_id/bridges' do
+        get ':id/pipelines/:pipeline_id/bridges', feature_category: :pipeline_authoring do
           authorize!(:read_build, user_project)
 
           pipeline = user_project.all_pipelines.find(params[:pipeline_id])
@@ -168,7 +166,7 @@ module API
         params do
           requires :pipeline_id, type: Integer, desc: 'The pipeline ID'
         end
-        get ':id/pipelines/:pipeline_id/variables' do
+        get ':id/pipelines/:pipeline_id/variables', feature_category: :pipeline_authoring do
           authorize! :read_pipeline_variable, pipeline
 
           present pipeline.variables, with: Entities::Ci::Variable
@@ -181,7 +179,7 @@ module API
         params do
           requires :pipeline_id, type: Integer, desc: 'The pipeline ID'
         end
-        get ':id/pipelines/:pipeline_id/test_report' do
+        get ':id/pipelines/:pipeline_id/test_report', feature_category: :code_testing do
           authorize! :read_build, pipeline
 
           present pipeline.test_reports, with: TestReportEntity, details: true
@@ -194,7 +192,7 @@ module API
         params do
           requires :pipeline_id, type: Integer, desc: 'The pipeline ID'
         end
-        get ':id/pipelines/:pipeline_id/test_report_summary' do
+        get ':id/pipelines/:pipeline_id/test_report_summary', feature_category: :code_testing do
           authorize! :read_build, pipeline
 
           present pipeline.test_report_summary, with: TestReportSummaryEntity
@@ -207,7 +205,7 @@ module API
         params do
           requires :pipeline_id, type: Integer, desc: 'The pipeline ID'
         end
-        delete ':id/pipelines/:pipeline_id' do
+        delete ':id/pipelines/:pipeline_id', feature_category: :continuous_integration do
           authorize! :destroy_pipeline, pipeline
 
           destroy_conditionally!(pipeline) do
@@ -222,7 +220,7 @@ module API
         params do
           requires :pipeline_id, type: Integer, desc: 'The pipeline ID'
         end
-        post ':id/pipelines/:pipeline_id/retry' do
+        post ':id/pipelines/:pipeline_id/retry', feature_category: :continuous_integration do
           authorize! :update_pipeline, pipeline
 
           pipeline.retry_failed(current_user)
@@ -237,7 +235,7 @@ module API
         params do
           requires :pipeline_id, type: Integer, desc: 'The pipeline ID'
         end
-        post ':id/pipelines/:pipeline_id/cancel' do
+        post ':id/pipelines/:pipeline_id/cancel', feature_category: :continuous_integration do
           authorize! :update_pipeline, pipeline
 
           pipeline.cancel_running
diff --git a/lib/api/group_variables.rb b/lib/api/group_variables.rb
index 13daf05fc78..e726f9b61cc 100644
--- a/lib/api/group_variables.rb
+++ b/lib/api/group_variables.rb
@@ -6,7 +6,7 @@ module API
 
     before { authenticate! }
     before { authorize! :admin_group, user_group }
-    feature_category :continuous_integration
+    feature_category :pipeline_authoring
 
     helpers ::API::Helpers::VariablesHelpers
 
diff --git a/lib/api/templates.rb b/lib/api/templates.rb
index a595129fd6a..85a299c5673 100644
--- a/lib/api/templates.rb
+++ b/lib/api/templates.rb
@@ -11,7 +11,7 @@ module API
       },
       gitlab_ci_ymls: {
         gitlab_version: 8.9,
-        feature_category: :continuous_integration
+        feature_category: :pipeline_authoring
       },
       dockerfiles: {
         gitlab_version: 8.15,
diff --git a/spec/frontend/pipelines/pipeline_multi_actions_spec.js b/spec/frontend/pipelines/pipeline_multi_actions_spec.js
index ce33b6011bf..a606595b37d 100644
--- a/spec/frontend/pipelines/pipeline_multi_actions_spec.js
+++ b/spec/frontend/pipelines/pipeline_multi_actions_spec.js
@@ -1,4 +1,4 @@
-import { GlAlert, GlDropdown, GlSprintf } from '@gitlab/ui';
+import { GlAlert, GlDropdown, GlSprintf, GlLoadingIcon } from '@gitlab/ui';
 import { shallowMount } from '@vue/test-utils';
 import MockAdapter from 'axios-mock-adapter';
 import { extendedWrapper } from 'helpers/vue_test_utils_helper';
@@ -51,6 +51,7 @@ describe('Pipeline Multi Actions Dropdown', () => {
 
   const findAlert = () => wrapper.findComponent(GlAlert);
   const findDropdown = () => wrapper.findComponent(GlDropdown);
+  const findLoadingIcon = () => wrapper.findComponent(GlLoadingIcon);
   const findAllArtifactItems = () => wrapper.findAllByTestId(artifactItemTestId);
   const findFirstArtifactItem = () => wrapper.findByTestId(artifactItemTestId);
   const findEmptyMessage = () => wrapper.findByTestId('artifacts-empty-message');
@@ -103,6 +104,15 @@ describe('Pipeline Multi Actions Dropdown', () => {
       expect(findEmptyMessage().exists()).toBe(true);
     });
 
+    describe('while loading artifacts', () => {
+      it('should render a loading spinner and no empty message', () => {
+        createComponent({ mockData: { isLoading: true, artifacts: [] } });
+
+        expect(findLoadingIcon().exists()).toBe(true);
+        expect(findEmptyMessage().exists()).toBe(false);
+      });
+    });
+
     describe('with a failing request', () => {
       it('should render an error message', async () => {
         const endpoint = artifactsEndpoint.replace(artifactsEndpointPlaceholder, pipelineId);
diff --git a/spec/graphql/types/ci/job_type_spec.rb b/spec/graphql/types/ci/job_type_spec.rb
index 54fe0c4b707..e95a7da4fe5 100644
--- a/spec/graphql/types/ci/job_type_spec.rb
+++ b/spec/graphql/types/ci/job_type_spec.rb
@@ -4,7 +4,6 @@ require 'spec_helper'
 
 RSpec.describe Types::Ci::JobType do
   specify { expect(described_class.graphql_name).to eq('CiJob') }
-  specify { expect(described_class).to require_graphql_authorizations(:read_commit_status) }
   specify { expect(described_class).to expose_permissions_using(Types::PermissionTypes::Ci::Job) }
 
   it 'exposes the expected fields' do
diff --git a/spec/graphql/types/terraform/state_version_type_spec.rb b/spec/graphql/types/terraform/state_version_type_spec.rb
index 18f869e4f1f..b015a2045da 100644
--- a/spec/graphql/types/terraform/state_version_type_spec.rb
+++ b/spec/graphql/types/terraform/state_version_type_spec.rb
@@ -3,6 +3,8 @@
 require 'spec_helper'
 
 RSpec.describe GitlabSchema.types['TerraformStateVersion'] do
+  include GraphqlHelpers
+
   it { expect(described_class.graphql_name).to eq('TerraformStateVersion') }
   it { expect(described_class).to require_graphql_authorizations(:read_terraform_state) }
 
@@ -19,4 +21,60 @@ RSpec.describe GitlabSchema.types['TerraformStateVersion'] do
     it { expect(described_class.fields['createdAt'].type).to be_non_null }
     it { expect(described_class.fields['updatedAt'].type).to be_non_null }
   end
+
+  describe 'query' do
+    let_it_be(:project) { create(:project) }
+    let_it_be(:user) { create(:user) }
+    let_it_be(:terraform_state) { create(:terraform_state, :with_version, :locked, project: project) }
+
+    before do
+      project.add_developer(user)
+    end
+
+    let(:query) do
+      <<~GRAPHQL
+        query {
+          project(fullPath: "#{project.full_path}") {
+            terraformState(name: "#{terraform_state.name}") {
+              latestVersion {
+                id
+                job {
+                  name
+                }
+              }
+            }
+          }
+        }
+      GRAPHQL
+    end
+
+    subject(:execute) { GitlabSchema.execute(query, context: { current_user: user }).as_json }
+
+    shared_examples 'returning latest version' do
+      it 'returns latest version of terraform state' do
+        expect(execute.dig('data', 'project', 'terraformState', 'latestVersion', 'id')).to eq(
+          global_id_of(terraform_state.latest_version)
+        )
+      end
+    end
+
+    it_behaves_like 'returning latest version'
+
+    it 'returns job of the latest version' do
+      expect(execute.dig('data', 'project', 'terraformState', 'latestVersion', 'job')).to be_present
+    end
+
+    context 'when user cannot read jobs' do
+      before do
+        allow(Ability).to receive(:allowed?).and_call_original
+        allow(Ability).to receive(:allowed?).with(user, :read_commit_status, terraform_state.latest_version).and_return(false)
+      end
+
+      it_behaves_like 'returning latest version'
+
+      it 'does not return job of the latest version' do
+        expect(execute.dig('data', 'project', 'terraformState', 'latestVersion', 'job')).not_to be_present
+      end
+    end
+  end
 end