Add latest changes from gitlab-org/gitlab@master

12 files changed, 46 insertions, 41 deletions

diff --git a/doc/.vale/gitlab/LatinTerms.yml b/doc/.vale/gitlab/LatinTerms.yml
index 0f098979b16..9fbaf278da9 100644
--- a/doc/.vale/gitlab/LatinTerms.yml
+++ b/doc/.vale/gitlab/LatinTerms.yml
@@ -15,4 +15,4 @@ swap:
   e\. g\.: for example
   i\.e\.: that is
   i\. e\.: that is
-  via: "Use 'with', 'through', or 'by using' instead."
+  via: "with', 'through', or 'by using"
diff --git a/doc/administration/auth/ldap/index.md b/doc/administration/auth/ldap/index.md
index 62395ebdcd2..49841b5e1be 100644
--- a/doc/administration/auth/ldap/index.md
+++ b/doc/administration/auth/ldap/index.md
@@ -1210,10 +1210,9 @@ For more information on synchronizing users and groups between LDAP and GitLab,
 
 ## Move from LDAP to SAML
 
-1. [Configure SAML](../../../integration/saml.md). Add `auto_link_ldap_user` to:
+1. [Add SAML configuration](../../../integration/saml.md) to:
    - [`gitlab.rb` for Linux package installations](../../../integration/saml.html?tab=Linux+package+%28Omnibus%29).
    - [`values.yml` for Helm chart installations](../../../integration/saml.html?tab=Helm+chart+%28Kubernetes%29).
-   For more information, see the [initial settings for all providers](../../../integration/omniauth.md#configure-initial-settings).
 
 1. Optional. [Disable the LDAP auth from the sign-in page](#disable-ldap-web-sign-in).
 
diff --git a/doc/administration/monitoring/prometheus/gitlab_metrics.md b/doc/administration/monitoring/prometheus/gitlab_metrics.md
index 80121c7c235..f1d1b504c9d 100644
--- a/doc/administration/monitoring/prometheus/gitlab_metrics.md
+++ b/doc/administration/monitoring/prometheus/gitlab_metrics.md
@@ -180,6 +180,8 @@ The following metrics are available:
 | `gitlab_connection_pool_size` | Gauge | 16.7 | Size of connection pool |
 | `gitlab_connection_pool_available_count` | Gauge | 16.7 | Number of available connections in the pool |
 | `gitlab_security_policies_scan_result_process_duration_seconds` | Histogram | 16.7 | The amount of time to process scan result policies |
+| `gitlab_highlight_usage` | Counter | 16.8 | The number of times `Gitlab::Highlight` is used | `used_on` |
+| `dependency_linker_usage` | Counter | 16.8 | The number of times dependency linker is used | `used_on` |
 
 ## Metrics controlled by a feature flag
 
diff --git a/doc/api/users.md b/doc/api/users.md
index 83947f63384..59dbff1cc62 100644
--- a/doc/api/users.md
+++ b/doc/api/users.md
@@ -554,6 +554,7 @@ Parameters:
 | `bio`                                | No       | User's biography                                                                                                                                        |
 | `can_create_group`                   | No       | User can create top-level groups - true or false                                                                                                                  |
 | `color_scheme_id`                    | No       | User's color scheme for the file viewer (for more information, see the [user preference documentation](../user/profile/preferences.md#change-the-syntax-highlighting-theme)) |
+| `commit_email`                       | No       | User's commit email address                                                                                                                        |
 | `email`                              | Yes      | Email                                                                                                                                                   |
 | `extern_uid`                         | No       | External UID                                                                                                                                            |
 | `external`                           | No       | Flags the user as external - true or false (default)                                                                                                    |
@@ -568,7 +569,9 @@ Parameters:
 | `password`                           | No       | Password                                                                                                                                                |
 | `private_profile`                    | No       | User's profile is private - true or false. The default value is determined by [this](../administration/settings/account_and_limit_settings.md#set-profiles-of-new-users-to-private-by-default) setting. |
 | `projects_limit`                     | No       | Number of projects user can create                                                                                                                      |
+| `pronouns`                           | No       | User's pronouns                                                                                                                                    |
 | `provider`                           | No       | External provider name                                                                                                                                  |
+| `public_email`                       | No       | User's public email address                                                                                                                        |
 | `reset_password`                     | No       | Send user password reset link - true or false(default)                                                                                                  |
 | `shared_runners_minutes_limit` **(PREMIUM ALL)**  | No       | Can be set by administrators only. Maximum number of monthly compute minutes for this user. Can be `nil` (default; inherit system default), `0` (unlimited), or `> 0`.                                                                                                      |
 | `skip_confirmation`                  | No       | Skip confirmation - true or false (default)                                                                                                             |
diff --git a/doc/ci/yaml/artifacts_reports.md b/doc/ci/yaml/artifacts_reports.md
index 5867a5b3506..131f9e502fe 100644
--- a/doc/ci/yaml/artifacts_reports.md
+++ b/doc/ci/yaml/artifacts_reports.md
@@ -322,13 +322,13 @@ The `repository_xray` report collects information about your repository for use
 
 > [Moved](https://gitlab.com/groups/gitlab-org/-/epics/2098) from GitLab Ultimate to GitLab Free in 13.3.
 
-The `sast` report collects [SAST vulnerabilities](../../user/application_security/sast/index.md). The collected SAST
-report uploads to GitLab as an artifact.
+The `sast` report collects [SAST vulnerabilities](../../user/application_security/sast/index.md).
+The collected SAST report uploads to GitLab as an artifact.
 
-GitLab can display the results of one or more reports in:
+For more information, see:
 
-- The merge request [SAST widget](../../user/application_security/sast/index.md).
-- The [security dashboard](../../user/application_security/security_dashboard/index.md).
+- [View SAST results](../../user/application_security/sast/index.md#view-sast-results)
+- [SAST output](../../user/application_security/sast/index.md#output)
 
 ## `artifacts:reports:secret_detection`
 
diff --git a/doc/development/integrations/secure.md b/doc/development/integrations/secure.md
index 3fb89605bdd..34866a6c2d0 100644
--- a/doc/development/integrations/secure.md
+++ b/doc/development/integrations/secure.md
@@ -288,7 +288,7 @@ The report is a JSON document that combines vulnerabilities with possible remedi
 This documentation gives an overview of the report JSON format,
 as well as recommendations and examples to help integrators set its fields.
 The format is extensively described in the documentation of
-[SAST](../../user/application_security/sast/index.md#reports-json-format),
+[SAST](../../user/application_security/sast/index.md#output),
 [DAST](../../user/application_security/dast/proxy-based.md#reports),
 [Dependency Scanning](../../user/application_security/dependency_scanning/index.md#reports-json-format),
 and [Container Scanning](../../user/application_security/container_scanning/index.md#reports-json-format)
diff --git a/doc/development/integrations/secure_partner_integration.md b/doc/development/integrations/secure_partner_integration.md
index 53c333a6f13..8c27351f347 100644
--- a/doc/development/integrations/secure_partner_integration.md
+++ b/doc/development/integrations/secure_partner_integration.md
@@ -87,7 +87,7 @@ and complete an integration with the Secure stage.
    - Read about [job artifacts](../../ci/jobs/job_artifacts.md).
    - Your report artifact must be in one of our currently supported formats.
      For more information, see the [documentation on reports](secure.md#report).
-     - Documentation for [SAST reports](../../user/application_security/sast/index.md#reports-json-format).
+     - Documentation for [SAST output](../../user/application_security/sast/index.md#output).
      - Documentation for [Dependency Scanning reports](../../user/application_security/dependency_scanning/index.md#reports-json-format).
      - Documentation for [Container Scanning reports](../../user/application_security/container_scanning/index.md#reports-json-format).
      - See this [example secure job definition that also defines the artifact created](https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Jobs/Container-Scanning.gitlab-ci.yml).
diff --git a/doc/user/application_security/sast/analyzers.md b/doc/user/application_security/sast/analyzers.md
index a813ac9888d..1f5340758c6 100644
--- a/doc/user/application_security/sast/analyzers.md
+++ b/doc/user/application_security/sast/analyzers.md
@@ -54,7 +54,7 @@ support the following features:
 - [Scan projects](index.md#supported-languages-and-frameworks)
 - [Multi-project support](index.md#multi-project-support)
 - [Offline support](index.md#running-sast-in-an-offline-environment)
-- [Emits JSON report format](index.md#reports-json-format)
+- [Output results in JSON report format](index.md#output)
 - [SELinux support](index.md#running-sast-in-selinux)
 
 ## Post analyzers
diff --git a/doc/user/application_security/sast/customize_rulesets.md b/doc/user/application_security/sast/customize_rulesets.md
index 992e99f1cc7..a9ef89077ca 100644
--- a/doc/user/application_security/sast/customize_rulesets.md
+++ b/doc/user/application_security/sast/customize_rulesets.md
@@ -28,7 +28,7 @@ You can disable predefined rules for any SAST analyzer.
 
 When you disable a rule:
 
-- Most analyzers still scan for the vulnerability. The results are removed as a processing step after the scan completes, and they don't appear in the [`gl-sast-report.json` artifact](index.md#reports-json-format).
+- Most analyzers still scan for the vulnerability. The results are removed as a processing step after the scan completes, and they don't appear in the [`gl-sast-report.json` artifact](index.md#output).
 - Findings for the disabled rule no longer appear in the [pipeline security tab](../index.md#pipeline-security-tab).
 - Existing findings for the disabled rule on the default branch are marked as [`No longer detected`](../vulnerability_report/index.md#activity-filter) in the [vulnerability report](../index.md#vulnerability-report).
 
@@ -196,7 +196,7 @@ rule that you wish to modify.
 | `value` | The value of the identifier used by the predefined rule. |
 
 You can look up the correct values for `type` and `value` by viewing the
-[`gl-sast-report.json`](index.md#reports-json-format) produced by the analyzer.
+[`gl-sast-report.json`](index.md#output) produced by the analyzer.
 You can download this file as a job artifact from the analyzer's CI job.
 
 For example, the snippet below shows a finding from a `semgrep` rule with three
diff --git a/doc/user/application_security/sast/index.md b/doc/user/application_security/sast/index.md
index f9639f7063e..669822f3f0f 100644
--- a/doc/user/application_security/sast/index.md
+++ b/doc/user/application_security/sast/index.md
@@ -220,7 +220,7 @@ as shown in the following table:
 | Automatically scan code with [appropriate analyzers](#supported-languages-and-frameworks) | **{check-circle}**  | **{check-circle}** |
 | [Configure SAST scanners](#configuration)                         | **{check-circle}**  | **{check-circle}** |
 | [Customize SAST settings](#available-cicd-variables)              | **{check-circle}**  | **{check-circle}** |
-| Download [JSON Report](#reports-json-format)                      | **{check-circle}**  | **{check-circle}** |
+| Download [SAST output](#output)                                   | **{check-circle}**  | **{check-circle}** |
 | See new findings in merge request widget                          | **{dotted-circle}** | **{check-circle}** |
 | See new findings in merge request changes                         | **{dotted-circle}** | **{check-circle}** |
 | [Manage vulnerabilities](../vulnerabilities/index.md)             | **{dotted-circle}** | **{check-circle}** |
@@ -230,13 +230,25 @@ as shown in the following table:
 | [Detect False Positives](#false-positive-detection)               | **{dotted-circle}** | **{check-circle}** |
 | [Track moved vulnerabilities](#advanced-vulnerability-tracking)   | **{dotted-circle}** | **{check-circle}** |
 
+## Output
+
+SAST outputs the file `gl-sast-report.json` as a job artifact. The file contains details of all
+detected vulnerabilities. You can
+[download](../../../ci/jobs/job_artifacts.md#download-job-artifacts) the file for processing
+outside GitLab.
+
+For more information, see:
+
+- [SAST report file schema](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/blob/master/dist/sast-report-format.json)
+- [Example SAST report file](https://gitlab.com/gitlab-org/security-products/analyzers/semgrep/-/blob/main/qa/expect/js/default/gl-sast-report.json)
+
 ## View SAST results
 
-SAST results are shown in the:
+The [SAST report file](#output) is processed by GitLab and the details are shown in the UI:
 
 - Merge request widget
 - Merge request changes view
-- Vulnerability Report
+- Vulnerability report
 
 ### Merge request widget **(ULTIMATE ALL)**
 
@@ -647,21 +659,6 @@ variables:
   SAST_EXPERIMENTAL_FEATURES: "true"
 ```
 
-## Reports JSON format
-
-SAST outputs a report file in JSON format. The report file contains details of all found vulnerabilities.
-To download the report file, you can either:
-
-- Download the file from the CI/CD pipelines page.
-- In the pipelines tab on merge requests, set [`artifacts: paths`](../../../ci/yaml/index.md#artifactspaths) to `gl-sast-report.json`.
-
-For information, see [Download job artifacts](../../../ci/jobs/job_artifacts.md#download-job-artifacts).
-
-For details of the report file's schema, see
-[SAST report file schema](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/blob/master/dist/sast-report-format.json).
-
-For an example SAST report file, see [`gl-sast-report.json`](https://gitlab.com/gitlab-org/security-products/analyzers/semgrep/-/blob/main/qa/expect/js/default/gl-sast-report.json) example.
-
 ## Running SAST in an offline environment
 
 For self-managed GitLab instances in an environment with limited, restricted, or intermittent access
diff --git a/doc/user/application_security/secret_detection/index.md b/doc/user/application_security/secret_detection/index.md
index bf7375a58d7..6b4d7ebec4c 100644
--- a/doc/user/application_security/secret_detection/index.md
+++ b/doc/user/application_security/secret_detection/index.md
@@ -56,17 +56,17 @@ If you operate a cloud or SaaS product and you're interested in partnering with
 
 Different features are available in different [GitLab tiers](https://about.gitlab.com/pricing/).
 
-| Capability                                                       | In Free & Premium      | In Ultimate            |
-|:---------------------------------------------------------------- |:-----------------------|:-----------------------|
-| [Configure Secret Detection scanner](#enable-secret-detection)   | **{check-circle}** Yes | **{check-circle}** Yes |
-| [Customize Secret Detection settings](#configure-scan-settings)  | **{check-circle}** Yes | **{check-circle}** Yes |
-| Download [JSON Report](../sast/index.md#reports-json-format)     | **{check-circle}** Yes | **{check-circle}** Yes |
+| Capability                                                                                           | In Free & Premium      | In Ultimate            |
+|:-----------------------------------------------------------------------------------------------------|:-----------------------|:-----------------------|
+| [Configure Secret Detection scanner](#enable-secret-detection)                                       | **{check-circle}** Yes | **{check-circle}** Yes |
+| [Customize Secret Detection settings](#configure-scan-settings)                                      | **{check-circle}** Yes | **{check-circle}** Yes |
+| Download [SAST output](../sast/index.md#output)                                                      | **{check-circle}** Yes | **{check-circle}** Yes |
 | [Check text for potential secrets](#warnings-for-potential-leaks-in-text-content) before it's posted | **{check-circle}** Yes | **{check-circle}** Yes |
-| See new findings in the merge request widget                     | **{dotted-circle}** No | **{check-circle}** Yes |
-| View identified secrets in the pipelines' **Security** tab       | **{dotted-circle}** No | **{check-circle}** Yes |
-| [Manage vulnerabilities](../vulnerability_report/index.md)       | **{dotted-circle}** No | **{check-circle}** Yes |
-| [Access the Security Dashboard](../security_dashboard/index.md)  | **{dotted-circle}** No | **{check-circle}** Yes |
-| [Customize Secret Detection rulesets](#custom-rulesets)          | **{dotted-circle}** No | **{check-circle}** Yes |
+| See new findings in the merge request widget                                                         | **{dotted-circle}** No | **{check-circle}** Yes |
+| View identified secrets in the pipelines' **Security** tab                                           | **{dotted-circle}** No | **{check-circle}** Yes |
+| [Manage vulnerabilities](../vulnerability_report/index.md)                                           | **{dotted-circle}** No | **{check-circle}** Yes |
+| [Access the Security Dashboard](../security_dashboard/index.md)                                      | **{dotted-circle}** No | **{check-circle}** Yes |
+| [Customize Secret Detection rulesets](#custom-rulesets)                                              | **{dotted-circle}** No | **{check-circle}** Yes |
 
 ## Coverage
 
diff --git a/doc/user/project/repository/code_suggestions/repository_xray.md b/doc/user/project/repository/code_suggestions/repository_xray.md
index 296af1101fc..fc28d67667b 100644
--- a/doc/user/project/repository/code_suggestions/repository_xray.md
+++ b/doc/user/project/repository/code_suggestions/repository_xray.md
@@ -54,3 +54,7 @@ xray:
 - The added rules restrict the job to the default branch only. Restricting the job this way ensures development changes do not impact the baseline X-Ray data used for production code suggestions.
 
 After the initial x-ray job completes and uploads the repository analysis reports, no further action is required. Repository X-Ray automatically enriches all code generation requests from that point forward.
+
+The X-Ray data for your project updates each time a CI/CD pipeline containing the `xray`
+job is run. To learn more about pipeline configuration and triggers, see the
+[pipelines documentation](../../../../ci/pipelines/merge_request_pipelines.md).