Add latest changes from gitlab-org/gitlab@master

6 files changed, 24 insertions, 5 deletions

diff --git a/app/models/project.rb b/app/models/project.rb
index 3af5fc3db35..f50395a4acd 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -2843,13 +2843,17 @@ class Project < ApplicationRecord
   end
 
   def all_protected_branches
-    if Feature.enabled?(:group_protected_branches, group)
+    if allow_protected_branches_for_group?
       @all_protected_branches ||= ProtectedBranch.from_union([protected_branches, group_protected_branches])
     else
       protected_branches
     end
   end
 
+  def allow_protected_branches_for_group?
+    Feature.enabled?(:group_protected_branches, group) || Feature.enabled?(:allow_protected_branches_for_group, group)
+  end
+
   def self_monitoring?
     Gitlab::CurrentSettings.self_monitoring_project_id == id
   end
diff --git a/app/models/protected_branch.rb b/app/models/protected_branch.rb
index 64690645d0c..01bdbba1955 100644
--- a/app/models/protected_branch.rb
+++ b/app/models/protected_branch.rb
@@ -45,7 +45,7 @@ class ProtectedBranch < ApplicationRecord
   end
 
   def self.allow_force_push?(project, ref_name)
-    if Feature.enabled?(:group_protected_branches, project.group)
+    if allow_protected_branches_for_group?(project.group)
       protected_branches = project.all_protected_branches.matching(ref_name)
 
       project_protected_branches, group_protected_branches = protected_branches.partition(&:project_id)
@@ -60,6 +60,10 @@ class ProtectedBranch < ApplicationRecord
     end
   end
 
+  def self.allow_protected_branches_for_group?(group)
+    Feature.enabled?(:group_protected_branches, group) || Feature.enabled?(:allow_protected_branches_for_group, group)
+  end
+
   def self.any_protected?(project, ref_names)
     protected_refs(project).any? do |protected_ref|
       ref_names.any? do |ref_name|
diff --git a/app/models/terraform/state.rb b/app/models/terraform/state.rb
index 8a207c891e2..93c128c989c 100644
--- a/app/models/terraform/state.rb
+++ b/app/models/terraform/state.rb
@@ -8,6 +8,8 @@ module Terraform
     HEX_REGEXP = %r{\A\h+\z}.freeze
     UUID_LENGTH = 32
 
+    self.locking_column = :activerecord_lock_version
+
     belongs_to :project
     belongs_to :locked_by_user, class_name: 'User'
 
diff --git a/app/models/terraform/state_version.rb b/app/models/terraform/state_version.rb
index d6a16ad5b99..6727c81f17b 100644
--- a/app/models/terraform/state_version.rb
+++ b/app/models/terraform/state_version.rb
@@ -5,7 +5,7 @@ module Terraform
     include EachBatch
     include FileStoreMounter
 
-    belongs_to :terraform_state, class_name: 'Terraform::State', optional: false
+    belongs_to :terraform_state, class_name: 'Terraform::State', optional: false, touch: true
     belongs_to :created_by_user, class_name: 'User', optional: true
     belongs_to :build, class_name: 'Ci::Build', optional: true, foreign_key: :ci_build_id
 
diff --git a/app/services/protected_branches/cache_service.rb b/app/services/protected_branches/cache_service.rb
index 2f0d3945014..cb2977796d7 100644
--- a/app/services/protected_branches/cache_service.rb
+++ b/app/services/protected_branches/cache_service.rb
@@ -74,13 +74,18 @@ module ProtectedBranches
 
     def redis_key
       group = project_or_group.is_a?(Group) ? project_or_group : project_or_group.group
-      @redis_key ||= if Feature.enabled?(:group_protected_branches, group)
+      @redis_key ||= if allow_protected_branches_for_group?(group)
                        [CACHE_ROOT_KEY, project_or_group.class.name, project_or_group.id].join(':')
                      else
                        [CACHE_ROOT_KEY, project_or_group.id].join(':')
                      end
     end
 
+    def allow_protected_branches_for_group?(group)
+      Feature.enabled?(:group_protected_branches, group) ||
+        Feature.enabled?(:allow_protected_branches_for_group, group)
+    end
+
     def metrics
       @metrics ||= Gitlab::Cache::Metrics.new(cache_metadata)
     end
diff --git a/app/services/terraform/remote_state_handler.rb b/app/services/terraform/remote_state_handler.rb
index d044cf30387..f72bf0390e4 100644
--- a/app/services/terraform/remote_state_handler.rb
+++ b/app/services/terraform/remote_state_handler.rb
@@ -2,6 +2,8 @@
 
 module Terraform
   class RemoteStateHandler < BaseService
+    include Gitlab::OptimisticLocking
+
     StateLockedError = Class.new(StandardError)
     StateDeletedError = Class.new(StandardError)
     UnauthorizedError = Class.new(StandardError)
@@ -59,7 +61,9 @@ module Terraform
     private
 
     def retrieve_with_lock(find_only: false)
-      create_or_find!(find_only: find_only).tap { |state| state.with_lock { yield state } }
+      create_or_find!(find_only: find_only).tap do |state|
+        retry_lock(state, name: "Terraform state: #{state.id}") { yield state }
+      end
     end
 
     def create_or_find!(find_only:)