Add latest changes from gitlab-org/gitlab@master

9 files changed, 13 insertions, 32 deletions

diff --git a/app/assets/javascripts/ci/jobs_page/components/job_cells/actions_cell.vue b/app/assets/javascripts/ci/jobs_page/components/job_cells/actions_cell.vue
index 3ad2582e36b..458281eb385 100644
--- a/app/assets/javascripts/ci/jobs_page/components/job_cells/actions_cell.vue
+++ b/app/assets/javascripts/ci/jobs_page/components/job_cells/actions_cell.vue
@@ -84,6 +84,9 @@ export default {
     artifactDownloadPath() {
       return this.hasArtifacts.downloadPath;
     },
+    canCancelJob() {
+      return this.job.userPermissions?.cancelBuild;
+    },
     canReadJob() {
       return this.job.userPermissions?.readBuild;
     },
@@ -185,7 +188,7 @@ export default {
   <gl-button-group>
     <template v-if="canReadJob && canUpdateJob">
       <gl-button
-        v-if="isActive"
+        v-if="isActive && canCancelJob"
         v-gl-tooltip
         icon="cancel"
         :title="$options.CANCEL"
diff --git a/app/assets/javascripts/ci/jobs_page/graphql/queries/get_jobs.query.graphql b/app/assets/javascripts/ci/jobs_page/graphql/queries/get_jobs.query.graphql
index 69719011079..b1ce3a8597a 100644
--- a/app/assets/javascripts/ci/jobs_page/graphql/queries/get_jobs.query.graphql
+++ b/app/assets/javascripts/ci/jobs_page/graphql/queries/get_jobs.query.graphql
@@ -71,6 +71,7 @@ query getJobs($fullPath: ID!, $after: String, $first: Int = 30, $statuses: [CiJo
           readBuild
           readJobArtifacts
           updateBuild
+          cancelBuild
         }
       }
     }
diff --git a/app/assets/javascripts/ci/pipeline_details/header/graphql/queries/get_pipeline_header_data.query.graphql b/app/assets/javascripts/ci/pipeline_details/header/graphql/queries/get_pipeline_header_data.query.graphql
index eb5643126a2..00c4c1ae3b4 100644
--- a/app/assets/javascripts/ci/pipeline_details/header/graphql/queries/get_pipeline_header_data.query.graphql
+++ b/app/assets/javascripts/ci/pipeline_details/header/graphql/queries/get_pipeline_header_data.query.graphql
@@ -10,6 +10,7 @@ query getPipelineHeaderData($fullPath: ID!, $iid: ID!) {
       userPermissions {
         destroyPipeline
         updatePipeline
+        cancelPipeline
       }
       detailedStatus {
         id
diff --git a/app/assets/javascripts/ci/pipeline_details/header/pipeline_details_header.vue b/app/assets/javascripts/ci/pipeline_details/header/pipeline_details_header.vue
index c0bde3a4411..4572e25face 100644
--- a/app/assets/javascripts/ci/pipeline_details/header/pipeline_details_header.vue
+++ b/app/assets/javascripts/ci/pipeline_details/header/pipeline_details_header.vue
@@ -312,7 +312,7 @@ export default {
     canCancelPipeline() {
       const { cancelable, userPermissions } = this.pipeline;
 
-      return cancelable && userPermissions.updatePipeline;
+      return cancelable && userPermissions.cancelPipeline;
     },
     showComputeMinutes() {
       return this.isFinished && this.computeMinutes;
diff --git a/app/assets/javascripts/graphql_shared/constants.js b/app/assets/javascripts/graphql_shared/constants.js
index 8269a7790a5..7f2c41d9aaf 100644
--- a/app/assets/javascripts/graphql_shared/constants.js
+++ b/app/assets/javascripts/graphql_shared/constants.js
@@ -29,3 +29,4 @@ export const TYPENAME_WORK_ITEM = 'WorkItem';
 export const TYPENAME_ORGANIZATION = 'Organization';
 export const TYPE_USERS_SAVED_REPLY = 'Users::SavedReply';
 export const TYPE_WORKSPACE = 'RemoteDevelopment::Workspace';
+export const TYPE_COMPLIANCE_FRAMEWORK = 'ComplianceManagement::Framework';
diff --git a/app/helpers/vite_helper.rb b/app/helpers/vite_helper.rb
index a8ecfe51f28..cf9a5008a69 100644
--- a/app/helpers/vite_helper.rb
+++ b/app/helpers/vite_helper.rb
@@ -5,7 +5,7 @@ module ViteHelper
     # vite is not production ready yet
     return false if Rails.env.production?
     # Enable vite if explicitly turned on in the GDK
-    return ViteRuby.env['VITE_ENABLED'] if ViteRuby.env.key?('VITE_ENABLED')
+    return Gitlab::Utils.to_boolean(ViteRuby.env['VITE_ENABLED'], false) if ViteRuby.env.key?('VITE_ENABLED')
 
     # Enable vite the legacy way (in case GDK hasn't been updated)
     # This is going to be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/431041
diff --git a/app/models/concerns/pg_full_text_searchable.rb b/app/models/concerns/pg_full_text_searchable.rb
index f26330e1cba..d32c4c9baf1 100644
--- a/app/models/concerns/pg_full_text_searchable.rb
+++ b/app/models/concerns/pg_full_text_searchable.rb
@@ -29,6 +29,7 @@ module PgFullTextSearchable
   TEXT_SEARCH_DICTIONARY = 'english'
   URL_SCHEME_REGEX = %r{(?<=\A|\W)\w+://(?=\w+)}
   TSQUERY_DISALLOWED_CHARACTERS_REGEX = %r{[^a-zA-Z0-9 .@/\-_"]}
+  XML_TAG_REGEX = %r{</?([^>]+)>}
 
   def update_search_data!
     tsvector_sql_nodes = self.class.pg_full_text_searchable_columns.map do |column, weight|
@@ -58,6 +59,7 @@ module PgFullTextSearchable
     column_text = self[column].gsub(LONG_WORDS_REGEX, ' ')
     column_text = column_text[0..(TSVECTOR_MAX_LENGTH - 1)]
     column_text = ActiveSupport::Inflector.transliterate(column_text)
+    column_text = column_text.gsub(XML_TAG_REGEX, ' \1 ')
 
     Arel::Nodes::NamedFunction.new(
       'setweight',
diff --git a/app/models/member.rb b/app/models/member.rb
index 9690e16fd7d..efac1f52a38 100644
--- a/app/models/member.rb
+++ b/app/models/member.rb
@@ -57,9 +57,6 @@ class Member < ApplicationRecord
     },
     if: :project_bot?
   validate :access_level_inclusion
-  validate :validate_member_role_access_level
-  validate :validate_access_level_locked_for_member_role, on: :update
-  validate :validate_member_role_belongs_to_same_root_namespace
 
   scope :with_invited_user_state, -> do
     joins('LEFT JOIN users as invited_user ON invited_user.email = members.invite_email')
@@ -514,32 +511,6 @@ class Member < ApplicationRecord
     errors.add(:access_level, "is not included in the list")
   end
 
-  def validate_member_role_access_level
-    return unless member_role_id
-
-    if access_level != member_role.base_access_level
-      errors.add(:member_role_id, _("role's base access level does not match the access level of the membership"))
-    end
-  end
-
-  def validate_access_level_locked_for_member_role
-    return unless member_role_id
-    return if member_role_changed? # it is ok to change the access level when changing member role
-
-    if access_level_changed?
-      errors.add(:access_level, _("cannot be changed since member is associated with a custom role"))
-    end
-  end
-
-  def validate_member_role_belongs_to_same_root_namespace
-    return unless member_role_id
-
-    return if member_namespace.id == member_role.namespace_id
-    return if member_namespace.root_ancestor.id == member_role.namespace_id
-
-    errors.add(:member_namespace, _("must be in same hierarchy as custom role's namespace"))
-  end
-
   def send_invite
     # override in subclass
   end
diff --git a/app/views/projects/settings/ci_cd/_form.html.haml b/app/views/projects/settings/ci_cd/_form.html.haml
index d51acc5e708..0efd55f2e50 100644
--- a/app/views/projects/settings/ci_cd/_form.html.haml
+++ b/app/views/projects/settings/ci_cd/_form.html.haml
@@ -36,6 +36,8 @@
             s_("CICD|Use separate caches for protected branches"),
             help_text: (s_('CICD|Unprotected branches will not have access to the cache from protected branches.') + ' ' + help_link_separated_caches).html_safe
 
+        = render_if_exists 'projects/settings/ci_cd/pipeline_cancelation', form: f
+
         .form-group
           = f.label :ci_config_path, _('CI/CD configuration file'), class: 'label-bold'
           = f.text_field :ci_config_path, class: 'form-control', placeholder: '.gitlab-ci.yml'