Add latest changes from gitlab-org/gitlab@master

29 files changed, 241 insertions, 65 deletions

diff --git a/app/controllers/projects/google_cloud/service_accounts_controller.rb b/app/controllers/projects/google_cloud/service_accounts_controller.rb
index 31ef1463056..b5f2b658235 100644
--- a/app/controllers/projects/google_cloud/service_accounts_controller.rb
+++ b/app/controllers/projects/google_cloud/service_accounts_controller.rb
@@ -24,24 +24,15 @@ class Projects::GoogleCloud::ServiceAccountsController < Projects::GoogleCloud::
   end
 
   def create
-    google_api_client = GoogleApi::CloudPlatform::Client.new(token_in_session, nil)
-    service_accounts_service = GoogleCloud::ServiceAccountsService.new(project)
-    gcp_project = params[:gcp_project]
-    environment = params[:environment]
-    generated_name = "GitLab :: #{@project.name} :: #{environment}"
-    generated_desc = "GitLab generated service account for project '#{@project.name}' and environment '#{environment}'"
-
-    service_account = google_api_client.create_service_account(gcp_project, generated_name, generated_desc)
-    service_account_key = google_api_client.create_service_account_key(gcp_project, service_account.unique_id)
-
-    service_accounts_service.add_for_project(
-      environment,
-      service_account.project_id,
-      service_account.to_json,
-      service_account_key.to_json
-    )
+    response = GoogleCloud::CreateServiceAccountsService.new(
+      project,
+      current_user,
+      google_oauth2_token: token_in_session,
+      gcp_project_id: params[:gcp_project],
+      environment_name: params[:environment]
+    ).execute
 
-    redirect_to project_google_cloud_index_path(project), notice: _('Service account generated successfully')
+    redirect_to project_google_cloud_index_path(project), notice: response.message
   rescue Google::Apis::ClientError, Google::Apis::ServerError, Google::Apis::AuthorizationError => error
     handle_gcp_error(error, project)
   end
diff --git a/app/controllers/projects/packages/infrastructure_registry_controller.rb b/app/controllers/projects/packages/infrastructure_registry_controller.rb
index 4af2894590b..c02a0a56e03 100644
--- a/app/controllers/projects/packages/infrastructure_registry_controller.rb
+++ b/app/controllers/projects/packages/infrastructure_registry_controller.rb
@@ -9,7 +9,7 @@ module Projects
 
       def show
         @package = project.packages.find(params[:id])
-        @package_files = if Feature.enabled?(:packages_installable_package_files)
+        @package_files = if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
                            @package.installable_package_files.recent
                          else
                            @package.package_files.recent
diff --git a/app/finders/packages/package_file_finder.rb b/app/finders/packages/package_file_finder.rb
index a47a5af7325..55dc4be2001 100644
--- a/app/finders/packages/package_file_finder.rb
+++ b/app/finders/packages/package_file_finder.rb
@@ -19,7 +19,7 @@ class Packages::PackageFileFinder
   private
 
   def package_files
-    files = if Feature.enabled?(:packages_installable_package_files)
+    files = if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
               package.installable_package_files
             else
               package.package_files
diff --git a/app/graphql/types/packages/package_details_type.rb b/app/graphql/types/packages/package_details_type.rb
index 07d8cf93b4e..1d2cf9649d8 100644
--- a/app/graphql/types/packages/package_details_type.rb
+++ b/app/graphql/types/packages/package_details_type.rb
@@ -37,7 +37,7 @@ module Types
       end
 
       def package_files
-        if Feature.enabled?(:packages_installable_package_files)
+        if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
           object.installable_package_files
         else
           object.package_files
diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb
index ef5e72342fb..e6aa3d525a9 100644
--- a/app/models/application_setting.rb
+++ b/app/models/application_setting.rb
@@ -365,6 +365,10 @@ class ApplicationSetting < ApplicationRecord
             allow_nil: false,
             numericality: { only_integer: true, greater_than_or_equal_to: 0 }
 
+  validates :packages_cleanup_package_file_worker_capacity,
+            allow_nil: false,
+            numericality: { only_integer: true, greater_than_or_equal_to: 0 }
+
   validates :invisible_captcha_enabled,
             inclusion: { in: [true, false], message: _('must be a boolean value') }
 
diff --git a/app/models/concerns/packages/debian/distribution.rb b/app/models/concerns/packages/debian/distribution.rb
index 3334cd69ed3..2d46889ce6a 100644
--- a/app/models/concerns/packages/debian/distribution.rb
+++ b/app/models/concerns/packages/debian/distribution.rb
@@ -97,7 +97,7 @@ module Packages
         end
 
         def package_files
-          if Feature.enabled?(:packages_installable_package_files)
+          if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
             ::Packages::PackageFile.installable
                                    .for_package_ids(packages.select(:id))
           else
diff --git a/app/models/concerns/packages/destructible.rb b/app/models/concerns/packages/destructible.rb
new file mode 100644
index 00000000000..a3b7d8580c1
--- /dev/null
+++ b/app/models/concerns/packages/destructible.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Packages
+  module Destructible
+    extend ActiveSupport::Concern
+
+    class_methods do
+      def next_pending_destruction(order_by: nil)
+        set = pending_destruction.limit(1).lock('FOR UPDATE SKIP LOCKED')
+        set = set.order(order_by) if order_by
+        set.take
+      end
+    end
+  end
+end
diff --git a/app/models/concerns/ttl_expirable.rb b/app/models/concerns/ttl_expirable.rb
index 6d89521255c..1c2147beedd 100644
--- a/app/models/concerns/ttl_expirable.rb
+++ b/app/models/concerns/ttl_expirable.rb
@@ -7,16 +7,10 @@ module TtlExpirable
     validates :status, presence: true
     default_value_for :read_at, Time.zone.now
 
-    enum status: { default: 0, expired: 1, processing: 2, error: 3 }
+    enum status: { default: 0, pending_destruction: 1, processing: 2, error: 3 }
 
     scope :read_before, ->(number_of_days) { where("read_at <= ?", Time.zone.now - number_of_days.days) }
     scope :active, -> { where(status: :default) }
-
-    scope :lock_next_by, ->(sort) do
-      order(sort)
-        .limit(1)
-        .lock('FOR UPDATE SKIP LOCKED')
-    end
   end
 
   def read!
diff --git a/app/models/dependency_proxy/blob.rb b/app/models/dependency_proxy/blob.rb
index bd5c022e692..e4018ab4770 100644
--- a/app/models/dependency_proxy/blob.rb
+++ b/app/models/dependency_proxy/blob.rb
@@ -3,6 +3,7 @@
 class DependencyProxy::Blob < ApplicationRecord
   include FileStoreMounter
   include TtlExpirable
+  include Packages::Destructible
   include EachBatch
 
   belongs_to :group
diff --git a/app/models/dependency_proxy/manifest.rb b/app/models/dependency_proxy/manifest.rb
index 64f484942ef..fe887c99e81 100644
--- a/app/models/dependency_proxy/manifest.rb
+++ b/app/models/dependency_proxy/manifest.rb
@@ -3,6 +3,7 @@
 class DependencyProxy::Manifest < ApplicationRecord
   include FileStoreMounter
   include TtlExpirable
+  include Packages::Destructible
   include EachBatch
 
   belongs_to :group
diff --git a/app/models/packages/package.rb b/app/models/packages/package.rb
index ebb9774b875..52dd0aba43b 100644
--- a/app/models/packages/package.rb
+++ b/app/models/packages/package.rb
@@ -133,7 +133,7 @@ class Packages::Package < ApplicationRecord
   scope :without_nuget_temporary_name, -> { where.not(name: Packages::Nuget::TEMPORARY_PACKAGE_NAME) }
 
   scope :has_version, -> { where.not(version: nil) }
-  scope :preload_files, -> { Feature.enabled?(:packages_installable_package_files) ? preload(:installable_package_files) : preload(:package_files) }
+  scope :preload_files, -> { Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml) ? preload(:installable_package_files) : preload(:package_files) }
   scope :preload_pipelines, -> { preload(pipelines: :user) }
   scope :last_of_each_version, -> { where(id: all.select('MAX(id) AS id').group(:version)) }
   scope :limit_recent, ->(limit) { order_created_desc.limit(limit) }
diff --git a/app/models/packages/package_file.rb b/app/models/packages/package_file.rb
index 34533a82ccd..072ff4a3a5f 100644
--- a/app/models/packages/package_file.rb
+++ b/app/models/packages/package_file.rb
@@ -3,6 +3,7 @@ class Packages::PackageFile < ApplicationRecord
   include UpdateProjectStatistics
   include FileStoreMounter
   include Packages::Installable
+  include Packages::Destructible
 
   INSTALLABLE_STATUSES = [:default].freeze
 
@@ -11,7 +12,7 @@ class Packages::PackageFile < ApplicationRecord
   delegate :file_type, :dsc?, :component, :architecture, :fields, to: :debian_file_metadatum, prefix: :debian
   delegate :channel, :metadata, to: :helm_file_metadatum, prefix: :helm
 
-  enum status: { default: 0, pending_destruction: 1 }
+  enum status: { default: 0, pending_destruction: 1, processing: 2, error: 3 }
 
   belongs_to :package
 
@@ -57,7 +58,7 @@ class Packages::PackageFile < ApplicationRecord
                .merge(project.packages.helm.installable)
                .joins(:helm_file_metadatum)
                .where(packages_helm_file_metadata: { channel: channel })
-    result = result.installable if Feature.enabled?(:packages_installable_package_files)
+    result = result.installable if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
     result
   end
 
@@ -108,7 +109,7 @@ class Packages::PackageFile < ApplicationRecord
     cte_name = :packages_cte
     cte = Gitlab::SQL::CTE.new(cte_name, packages.select(:id))
 
-    package_files = if Feature.enabled?(:packages_installable_package_files)
+    package_files = if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
                       ::Packages::PackageFile.installable.limit_recent(1)
                         .where(arel_table[:package_id].eq(Arel.sql("#{cte_name}.id")))
                     else
diff --git a/app/presenters/packages/conan/package_presenter.rb b/app/presenters/packages/conan/package_presenter.rb
index 49f3c79a31a..57636922676 100644
--- a/app/presenters/packages/conan/package_presenter.rb
+++ b/app/presenters/packages/conan/package_presenter.rb
@@ -81,7 +81,7 @@ module Packages
         return unless @package
 
         strong_memoize(:package_files) do
-          if Feature.enabled?(:packages_installable_package_files)
+          if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
             @package.installable_package_files.preload_conan_file_metadata
           else
             @package.package_files.preload_conan_file_metadata
diff --git a/app/presenters/packages/detail/package_presenter.rb b/app/presenters/packages/detail/package_presenter.rb
index 2a410002696..c257edcadfb 100644
--- a/app/presenters/packages/detail/package_presenter.rb
+++ b/app/presenters/packages/detail/package_presenter.rb
@@ -39,7 +39,7 @@ module Packages
       private
 
       def package_file_views
-        package_files = if Feature.enabled?(:packages_installable_package_files)
+        package_files = if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
                           @package.installable_package_files
                         else
                           @package.package_files
diff --git a/app/presenters/packages/npm/package_presenter.rb b/app/presenters/packages/npm/package_presenter.rb
index 6fb64970872..1f94187204f 100644
--- a/app/presenters/packages/npm/package_presenter.rb
+++ b/app/presenters/packages/npm/package_presenter.rb
@@ -26,7 +26,7 @@ module Packages
                                      .preload_npm_metadatum
 
           batched_packages.each do |package|
-            package_file = if Feature.enabled?(:packages_installable_package_files)
+            package_file = if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
                              package.installable_package_files.last
                            else
                              package.package_files.last
diff --git a/app/presenters/packages/nuget/presenter_helpers.rb b/app/presenters/packages/nuget/presenter_helpers.rb
index 1f0a64e4e6e..cd3e123033c 100644
--- a/app/presenters/packages/nuget/presenter_helpers.rb
+++ b/app/presenters/packages/nuget/presenter_helpers.rb
@@ -27,7 +27,7 @@ module Packages
       end
 
       def archive_url_for(package)
-        package_files = if Feature.enabled?(:packages_installable_package_files)
+        package_files = if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
                           package.installable_package_files
                         else
                           package.package_files
diff --git a/app/presenters/packages/pypi/package_presenter.rb b/app/presenters/packages/pypi/package_presenter.rb
index a14e0f99cd9..33854e4d2fc 100644
--- a/app/presenters/packages/pypi/package_presenter.rb
+++ b/app/presenters/packages/pypi/package_presenter.rb
@@ -36,7 +36,7 @@ module Packages
         refs = []
 
         @packages.map do |package|
-          package_files = if Feature.enabled?(:packages_installable_package_files)
+          package_files = if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
                             package.installable_package_files
                           else
                             package.package_files
diff --git a/app/services/google_cloud/create_service_accounts_service.rb b/app/services/google_cloud/create_service_accounts_service.rb
new file mode 100644
index 00000000000..fa025e8f672
--- /dev/null
+++ b/app/services/google_cloud/create_service_accounts_service.rb
@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module GoogleCloud
+  class CreateServiceAccountsService < :: BaseService
+    def execute
+      service_account = google_api_client.create_service_account(gcp_project_id, service_account_name, service_account_desc)
+      service_account_key = google_api_client.create_service_account_key(gcp_project_id, service_account.unique_id)
+
+      service_accounts_service.add_for_project(
+        environment_name,
+        service_account.project_id,
+        service_account.to_json,
+        service_account_key.to_json,
+        environment_protected?
+      )
+
+      ServiceResponse.success(message: _('Service account generated successfully'), payload: {
+        service_account: service_account,
+        service_account_key: service_account_key
+      })
+    end
+
+    private
+
+    def google_oauth2_token
+      @params[:google_oauth2_token]
+    end
+
+    def gcp_project_id
+      @params[:gcp_project_id]
+    end
+
+    def environment_name
+      @params[:environment_name]
+    end
+
+    def google_api_client
+      GoogleApi::CloudPlatform::Client.new(google_oauth2_token, nil)
+    end
+
+    def service_accounts_service
+      GoogleCloud::ServiceAccountsService.new(project)
+    end
+
+    def service_account_name
+      "GitLab :: #{project.name} :: #{environment_name}"
+    end
+
+    def service_account_desc
+      "GitLab generated service account for project '#{project.name}' and environment '#{environment_name}'"
+    end
+
+    # Overriden in EE
+    def environment_protected?
+      false
+    end
+  end
+end
+
+GoogleCloud::CreateServiceAccountsService.prepend_mod
diff --git a/app/services/google_cloud/service_accounts_service.rb b/app/services/google_cloud/service_accounts_service.rb
index a512b27493d..3014daf08e2 100644
--- a/app/services/google_cloud/service_accounts_service.rb
+++ b/app/services/google_cloud/service_accounts_service.rb
@@ -27,39 +27,42 @@ module GoogleCloud
       end
     end
 
-    def add_for_project(environment, gcp_project_id, service_account, service_account_key)
+    def add_for_project(environment, gcp_project_id, service_account, service_account_key, is_protected)
       project_var_create_or_replace(
         environment,
         'GCP_PROJECT_ID',
-        gcp_project_id
+        gcp_project_id,
+        is_protected
       )
       project_var_create_or_replace(
         environment,
         'GCP_SERVICE_ACCOUNT',
-        service_account
+        service_account,
+        is_protected
       )
       project_var_create_or_replace(
         environment,
         'GCP_SERVICE_ACCOUNT_KEY',
-        service_account_key
+        service_account_key,
+        is_protected
       )
     end
 
     private
 
     def group_vars_by_environment
-      filtered_vars = @project.variables.filter { |variable| GCP_KEYS.include? variable.key }
+      filtered_vars = project.variables.filter { |variable| GCP_KEYS.include? variable.key }
       filtered_vars.each_with_object({}) do |variable, grouped|
         grouped[variable.environment_scope] ||= {}
         grouped[variable.environment_scope][variable.key] = variable.value
       end
     end
 
-    def project_var_create_or_replace(environment_scope, key, value)
+    def project_var_create_or_replace(environment_scope, key, value, is_protected)
       params = { key: key, filter: { environment_scope: environment_scope } }
-      existing_variable = ::Ci::VariablesFinder.new(@project, params).execute.first
+      existing_variable = ::Ci::VariablesFinder.new(project, params).execute.first
       existing_variable.destroy if existing_variable
-      @project.variables.create!(key: key, value: value, environment_scope: environment_scope, protected: true)
+      project.variables.create!(key: key, value: value, environment_scope: environment_scope, protected: is_protected)
     end
   end
 end
diff --git a/app/services/packages/maven/metadata/sync_service.rb b/app/services/packages/maven/metadata/sync_service.rb
index e60784a6489..4f35db36fb0 100644
--- a/app/services/packages/maven/metadata/sync_service.rb
+++ b/app/services/packages/maven/metadata/sync_service.rb
@@ -93,7 +93,7 @@ module Packages
         def metadata_package_file_for(package)
           return unless package
 
-          package_files = if Feature.enabled?(:packages_installable_package_files)
+          package_files = if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
                             package.installable_package_files
                           else
                             package.package_files
diff --git a/app/workers/all_queues.yml b/app/workers/all_queues.yml
index 8ae06030d88..14fa6599073 100644
--- a/app/workers/all_queues.yml
+++ b/app/workers/all_queues.yml
@@ -444,6 +444,15 @@
   :weight: 1
   :idempotent:
   :tags: []
+- :name: cronjob:packages_cleanup_package_registry
+  :worker_name: Packages::CleanupPackageRegistryWorker
+  :feature_category: :package_registry
+  :has_external_dependencies:
+  :urgency: :low
+  :resource_boundary: :unknown
+  :weight: 1
+  :idempotent: true
+  :tags: []
 - :name: cronjob:packages_composer_cache_cleanup
   :worker_name: Packages::Composer::CacheCleanupWorker
   :feature_category: :package_registry
@@ -1366,6 +1375,15 @@
   :weight: 1
   :idempotent:
   :tags: []
+- :name: package_cleanup:packages_cleanup_package_file
+  :worker_name: Packages::CleanupPackageFileWorker
+  :feature_category: :package_registry
+  :has_external_dependencies:
+  :urgency: :low
+  :resource_boundary: :unknown
+  :weight: 1
+  :idempotent: true
+  :tags: []
 - :name: package_repositories:packages_debian_generate_distribution
   :worker_name: Packages::Debian::GenerateDistributionWorker
   :feature_category: :package_registry
diff --git a/app/workers/concerns/dependency_proxy/expireable.rb b/app/workers/concerns/dependency_proxy/expireable.rb
index 9650ac85c6c..7e37db36bef 100644
--- a/app/workers/concerns/dependency_proxy/expireable.rb
+++ b/app/workers/concerns/dependency_proxy/expireable.rb
@@ -10,7 +10,7 @@ module DependencyProxy
 
     def expire_artifacts(collection)
       collection.each_batch(of: UPDATE_BATCH_SIZE) do |batch|
-        batch.update_all(status: :expired)
+        batch.update_all(status: :pending_destruction)
       end
     end
   end
diff --git a/app/workers/concerns/dependency_proxy/cleanup_worker.rb b/app/workers/concerns/packages/cleanup_artifact_worker.rb
index b668634f233..db6c7330ea3 100644
--- a/app/workers/concerns/dependency_proxy/cleanup_worker.rb
+++ b/app/workers/concerns/packages/cleanup_artifact_worker.rb
@@ -1,8 +1,9 @@
 # frozen_string_literal: true
 
-module DependencyProxy
-  module CleanupWorker
+module Packages
+  module CleanupArtifactWorker
     extend ActiveSupport::Concern
+    include LimitedCapacity::Worker
     include Gitlab::Utils::StrongMemoize
 
     def perform_work
@@ -15,12 +16,8 @@ module DependencyProxy
       artifact&.error!
     end
 
-    def max_running_jobs
-      ::Gitlab::CurrentSettings.dependency_proxy_ttl_group_policy_worker_capacity
-    end
-
     def remaining_work_count
-      expired_artifacts.limit(max_running_jobs + 1).count
+      artifacts_pending_destruction.limit(max_running_jobs + 1).count
     end
 
     private
@@ -52,12 +49,12 @@ module DependencyProxy
       end
     end
 
-    def expired_artifacts
-      model.expired
+    def artifacts_pending_destruction
+      model.pending_destruction
     end
 
     def next_item
-      expired_artifacts.lock_next_by(:updated_at).first
+      model.next_pending_destruction(order_by: :updated_at)
     end
   end
 end
diff --git a/app/workers/dependency_proxy/cleanup_blob_worker.rb b/app/workers/dependency_proxy/cleanup_blob_worker.rb
index 054bc5854a3..eab536cd191 100644
--- a/app/workers/dependency_proxy/cleanup_blob_worker.rb
+++ b/app/workers/dependency_proxy/cleanup_blob_worker.rb
@@ -3,9 +3,8 @@
 module DependencyProxy
   class CleanupBlobWorker
     include ApplicationWorker
-    include LimitedCapacity::Worker
+    include ::Packages::CleanupArtifactWorker
     include Gitlab::Utils::StrongMemoize
-    include DependencyProxy::CleanupWorker
 
     data_consistency :always
 
@@ -17,6 +16,10 @@ module DependencyProxy
     worker_resource_boundary :unknown
     idempotent!
 
+    def max_running_jobs
+      ::Gitlab::CurrentSettings.dependency_proxy_ttl_group_policy_worker_capacity
+    end
+
     private
 
     def model
diff --git a/app/workers/dependency_proxy/cleanup_dependency_proxy_worker.rb b/app/workers/dependency_proxy/cleanup_dependency_proxy_worker.rb
index d77c782267a..6a958d6e9d7 100644
--- a/app/workers/dependency_proxy/cleanup_dependency_proxy_worker.rb
+++ b/app/workers/dependency_proxy/cleanup_dependency_proxy_worker.rb
@@ -11,8 +11,8 @@ module DependencyProxy
     feature_category :dependency_proxy
 
     def perform
-      enqueue_blob_cleanup_job if DependencyProxy::Blob.expired.any?
-      enqueue_manifest_cleanup_job if DependencyProxy::Manifest.expired.any?
+      enqueue_blob_cleanup_job if DependencyProxy::Blob.pending_destruction.any?
+      enqueue_manifest_cleanup_job if DependencyProxy::Manifest.pending_destruction.any?
     end
 
     private
diff --git a/app/workers/dependency_proxy/cleanup_manifest_worker.rb b/app/workers/dependency_proxy/cleanup_manifest_worker.rb
index 1186efa2034..4445ee32e6d 100644
--- a/app/workers/dependency_proxy/cleanup_manifest_worker.rb
+++ b/app/workers/dependency_proxy/cleanup_manifest_worker.rb
@@ -3,9 +3,8 @@
 module DependencyProxy
   class CleanupManifestWorker
     include ApplicationWorker
-    include LimitedCapacity::Worker
+    include ::Packages::CleanupArtifactWorker
     include Gitlab::Utils::StrongMemoize
-    include DependencyProxy::CleanupWorker
 
     data_consistency :always
 
@@ -17,6 +16,10 @@ module DependencyProxy
     worker_resource_boundary :unknown
     idempotent!
 
+    def max_running_jobs
+      ::Gitlab::CurrentSettings.dependency_proxy_ttl_group_policy_worker_capacity
+    end
+
     private
 
     def model
diff --git a/app/workers/dependency_proxy/image_ttl_group_policy_worker.rb b/app/workers/dependency_proxy/image_ttl_group_policy_worker.rb
index 3de2364fc71..89099ab6398 100644
--- a/app/workers/dependency_proxy/image_ttl_group_policy_worker.rb
+++ b/app/workers/dependency_proxy/image_ttl_group_policy_worker.rb
@@ -26,8 +26,8 @@ module DependencyProxy
 
     def log_counts
       use_replica_if_available do
-        expired_blob_count = DependencyProxy::Blob.expired.count
-        expired_manifest_count = DependencyProxy::Manifest.expired.count
+        expired_blob_count = DependencyProxy::Blob.pending_destruction.count
+        expired_manifest_count = DependencyProxy::Manifest.pending_destruction.count
         processing_blob_count = DependencyProxy::Blob.processing.count
         processing_manifest_count = DependencyProxy::Manifest.processing.count
         error_blob_count = DependencyProxy::Blob.error.count
diff --git a/app/workers/packages/cleanup_package_file_worker.rb b/app/workers/packages/cleanup_package_file_worker.rb
new file mode 100644
index 00000000000..cb2b2a12c5e
--- /dev/null
+++ b/app/workers/packages/cleanup_package_file_worker.rb
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Packages
+  class CleanupPackageFileWorker
+    include ApplicationWorker
+    include ::Packages::CleanupArtifactWorker
+    include Gitlab::Utils::StrongMemoize
+
+    data_consistency :always
+    queue_namespace :package_cleanup
+    feature_category :package_registry
+    urgency :low
+    worker_resource_boundary :unknown
+    idempotent!
+
+    def max_running_jobs
+      ::Gitlab::CurrentSettings.packages_cleanup_package_file_worker_capacity
+    end
+
+    private
+
+    def model
+      Packages::PackageFile
+    end
+
+    def next_item
+      model.next_pending_destruction
+    end
+
+    def log_metadata(package_file)
+      log_extra_metadata_on_done(:package_file_id, package_file.id)
+      log_extra_metadata_on_done(:package_id, package_file.package_id)
+    end
+
+    def log_cleanup_item(package_file)
+      logger.info(
+        structured_payload(
+          package_id: package_file.package_id,
+          package_file_id: package_file.id
+        )
+      )
+    end
+  end
+end
diff --git a/app/workers/packages/cleanup_package_registry_worker.rb b/app/workers/packages/cleanup_package_registry_worker.rb
new file mode 100644
index 00000000000..a849e055b64
--- /dev/null
+++ b/app/workers/packages/cleanup_package_registry_worker.rb
@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Packages
+  class CleanupPackageRegistryWorker
+    include ApplicationWorker
+    include CronjobQueue # rubocop:disable Scalability/CronWorkerContext
+
+    data_consistency :always
+    idempotent!
+
+    feature_category :package_registry
+
+    def perform
+      enqueue_package_file_cleanup_job if Packages::PackageFile.pending_destruction.exists?
+
+      log_counts
+    end
+
+    private
+
+    def enqueue_package_file_cleanup_job
+      Packages::CleanupPackageFileWorker.perform_with_capacity
+    end
+
+    def log_counts
+      use_replica_if_available do
+        pending_destruction_package_files_count = Packages::PackageFile.pending_destruction.count
+        processing_package_files_count = Packages::PackageFile.processing.count
+        error_package_files_count = Packages::PackageFile.error.count
+
+        log_extra_metadata_on_done(:pending_destruction_package_files_count, pending_destruction_package_files_count)
+        log_extra_metadata_on_done(:processing_package_files_count, processing_package_files_count)
+        log_extra_metadata_on_done(:error_package_files_count, error_package_files_count)
+      end
+    end
+
+    def use_replica_if_available(&block)
+      ::Gitlab::Database::LoadBalancing::Session.current.use_replicas_for_read_queries(&block)
+    end
+  end
+end