Add latest changes from gitlab-org/gitlab@master

6 files changed, 123 insertions, 30 deletions

diff --git a/doc/administration/geo/replication/configuration.md b/doc/administration/geo/replication/configuration.md
index 0b076e7ff3c..3c56d0c8ddd 100644
--- a/doc/administration/geo/replication/configuration.md
+++ b/doc/administration/geo/replication/configuration.md
@@ -316,17 +316,15 @@ It is important to note that selective synchronization:
 
 ### Git operations on unreplicated respositories
 
-> [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/2562) in GitLab 12.10.
+> [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/2562) in GitLab 12.10 for HTTP(S) and in GitLab 13.0 for SSH.
 
-Git clone, pull, and push operations over HTTP(S) are supported for repositories that
+Git clone, pull, and push operations over HTTP(S) and SSH are supported for repositories that
 exist on the **primary** node but not on **secondary** nodes. This situation can occur
 when:
 
 - Selective synchronization does not include the project attached to the repository.
 - The repository is actively being replicated but has not completed yet.
 
-SSH [support is planned](https://gitlab.com/groups/gitlab-org/-/epics/2562).
-
 ## Upgrading Geo
 
 See the [updating the Geo nodes document](updating_the_geo_nodes.md).
diff --git a/doc/development/pipelines.md b/doc/development/pipelines.md
index b98d6200cad..701262dbf1f 100644
--- a/doc/development/pipelines.md
+++ b/doc/development/pipelines.md
@@ -19,6 +19,9 @@ The current stages are:
   <https://gitlab.com/gitlab-org/gitlab-foss>.
 - `prepare`: This stage includes jobs that prepare artifacts that are needed by
   jobs in subsequent stages.
+- `build-images`: This stage includes jobs that prepare docker images
+  that are needed by jobs in subsequent stages or downstream pipelines.
+- `fixtures`: This stage includes jobs that prepare fixtures needed by frontend tests.
 - `test`: This stage includes most of the tests, DB/migration jobs, and static analysis jobs.
 - `post-test`: This stage includes jobs that build reports or gather data from
   the `test` stage's jobs (e.g. coverage, Knapsack metadata etc.).
@@ -30,7 +33,6 @@ The current stages are:
   that is deployed in the previous stage.
 - `post-qa`: This stage includes jobs that build reports or gather data from
   the `qa` stage's jobs (e.g. Review App performance report).
-- `notification`: This stage includes jobs that sends notifications about pipeline status.
 - `pages`: This stage includes a job that deploys the various reports as
   GitLab Pages (e.g. <https://gitlab-org.gitlab.io/gitlab/coverage-ruby/>,
   <https://gitlab-org.gitlab.io/gitlab/coverage-javascript/>,
@@ -74,6 +76,7 @@ that are scoped to a single [configuration parameter](../ci/yaml/README.md#confi
 | `.use-pg9-ee` | Same as `.use-pg9` but also use the `docker.elastic.co/elasticsearch/elasticsearch:6.4.2` services. |
 | `.use-pg10-ee` | Same as `.use-pg10` but also use the `docker.elastic.co/elasticsearch/elasticsearch:6.4.2` services. |
 | `.use-pg11-ee` | Same as `.use-pg11` but also use the `docker.elastic.co/elasticsearch/elasticsearch:6.4.2` services. |
+| `.use-kaniko` | Allows a job to use the `kaniko` tool to build Docker images. |
 | `.as-if-foss` | Simulate the FOSS project by setting the `FOSS_ONLY='1'` environment variable. |
 
 ## `workflow:rules`
@@ -255,14 +258,21 @@ graph RL;
   2_2-5["webpack-dev-server (7.62 minutes)"];
   click 2_2-5 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=8404303&udv=0"
 
+  2_3-1["build-assets-image"];
+  class 2_3-1 criticalPath;
+
   subgraph "Needs `setup-test-env` & `compile-assets`";
     2_2-1 & 2_2-2 & 2_2-4 & 2_2-5 --> 1-6 & 1-3;
     2_2-3 --> 1-6 & 1-4;
   end
 
-  subgraph "Needs `build-qa-image` & `gitlab:assets:compile`";
-    2_3-1["package-and-qa (manual)"] --> 1-2 & 1-5;
-    click 2_3-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=6914305&udv=0"
+  subgraph "Needs `gitlab:assets:compile`";
+    2_3-1 --> 1-5
+  end
+
+  subgraph "Needs `build-qa-image` & `build-assets-image`";
+    2_4-1["package-and-qa (manual)"] --> 1-2 & 2_3-1;
+    click 2_4-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=6914305&udv=0"
   end
 
   subgraph "Needs `compile-assets`, `setup-test-env, & `retrieve-tests-metadata`";
@@ -363,26 +373,33 @@ graph RL;
   2_2-5["webpack-dev-server (7.62 minutes)"];
   click 2_2-5 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=8404303&udv=0"
 
+  2_3-1["build-assets-image"];
+  class 2_3-1 criticalPath;
+
   subgraph "Needs `setup-test-env` & `compile-assets`";
     2_2-1 & 2_2-2 & 2_2-4 & 2_2-5 --> 1-6 & 1-3;
     2_2-3 --> 1-6 & 1-4;
   end
 
-  subgraph "Needs `build-qa-image` & `gitlab:assets:compile`";
-    2_3-1["package-and-qa (manual)"] --> 1-2 & 1-5;
-    click 2_3-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=6914305&udv=0"
+  subgraph "Needs `gitlab:assets:compile`";
+    2_3-1 --> 1-5
+  end
+  
+  subgraph "Needs `build-qa-image` & `build-assets-image`";
+    2_4-1["package-and-qa (manual)"] --> 1-2 & 2_3-1;
+    click 2_4-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=6914305&udv=0"
   end
 
   subgraph "Needs `compile-assets`, `setup-test-env, & `retrieve-tests-metadata`";
-    2_4-1["rspec & db jobs (12-22 minutes)"] --> 1-3 & 1-6 & 1-14;
-    class 2_4-1 criticalPath;
-    click 2_4-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations"
+    2_5-1["rspec & db jobs (12-22 minutes)"] --> 1-3 & 1-6 & 1-14;
+    class 2_5-1 criticalPath;
+    click 2_5-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations"
   end
 
-  subgraph "Needs `gitlab:assets:compile`";
-    2_5-1["review-build-cng (27.3 minutes)"] --> 1-5;
-    class 2_5-1 criticalPath;
-    click 2_5-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=6914314&udv=0"
+  subgraph "Needs `build-assets-image`";
+    2_6-1["review-build-cng (27.3 minutes)"] --> 2_3-1;
+    class 2_6-1 criticalPath;
+    click 2_6-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=6914314&udv=0"
   end
 
   3_1-1["jest (11.2 minutes)"];
@@ -401,7 +418,7 @@ graph RL;
   end
 
   subgraph "Depends on `rspec` jobs";
-    3_2-1["rspec:coverage (7.67 minutes)"] -.->|"(don't use needs because of limitations)"| 2_4-1;
+    3_2-1["rspec:coverage (7.67 minutes)"] -.->|"(don't use needs because of limitations)"| 2_5-1;
     class 3_2-1 criticalPath;
     click 3_2-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=7248745&udv=0"
   end
@@ -413,7 +430,7 @@ graph RL;
   end
 
   subgraph "Played by `review-build-cng`";
-    3_3-1["review-deploy (6 minutes)"] --> 2_5-1;
+    3_3-1["review-deploy (6 minutes)"] --> 2_6-1;
     class 3_3-1 criticalPath;
     click 3_3-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=6721130&udv=0"
   end
@@ -484,10 +501,15 @@ graph RL;
     2_2-1 --> 1-6 & 1-3;
   end
 
-  subgraph "Needs `build-qa-image` & `gitlab:assets:compile`";
-    2_3-1["package-and-qa (108 minutes)"] --> 1-2 & 1-5;
+  subgraph "Needs `gitlab:assets:compile`";
+    2_3-1["build-assets-image (2 minutes)"] --> 1-5
     class 2_3-1 criticalPath;
-    click 2_3-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=6914305&udv=0"
+  end
+
+  subgraph "Needs `build-qa-image` & `build-assets-image`";
+    2_4-1["package-and-qa (108 minutes)"] --> 1-2 & 2_3-1;
+    class 2_4-1 criticalPath;
+    click 2_4-1 "https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations?widget=6914305&udv=0"
   end
 ```
 
diff --git a/doc/user/admin_area/settings/visibility_and_access_controls.md b/doc/user/admin_area/settings/visibility_and_access_controls.md
index 322dcfc8b9b..d38637e2e9e 100644
--- a/doc/user/admin_area/settings/visibility_and_access_controls.md
+++ b/doc/user/admin_area/settings/visibility_and_access_controls.md
@@ -28,6 +28,21 @@ For more details, see [Protected branches](../../project/protected_branches.md).
 
 To change this setting for a specific group, see [Default branch protection for groups](../../group/index.md#changing-the-default-branch-protection-of-a-group)
 
+### Disable group owners from updating default branch protection **(PREMIUM ONLY)**
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/211944) in GitLab 13.0.
+
+By default, group owners are allowed to override the branch protection set at the global level.
+
+In [GitLab Premium or higher](https://about.gitlab.com/pricing/), GitLab administrators can disable this privilege of group owners.
+
+To do this:
+
+1. Uncheck the **Allow owners to manage default branch protection in groups** checkbox.
+
+NOTE: **Note:**
+GitLab administrators can still update the default branch protection of a group.
+
 ## Default project creation protection
 
 Project creation protection specifies which roles can create projects.
diff --git a/doc/user/group/index.md b/doc/user/group/index.md
index 941462f84a0..19c608915eb 100644
--- a/doc/user/group/index.md
+++ b/doc/user/group/index.md
@@ -196,6 +196,9 @@ To change this setting for a specific group:
 
 To change this setting globally, see [Default branch protection](../admin_area/settings/visibility_and_access_controls.md#default-branch-protection).
 
+NOTE: **Note:**
+In [GitLab Premium or higher](https://about.gitlab.com/pricing/), GitLab administrators can choose to [disable group owners from updating the default branch protection](../admin_area/settings/visibility_and_access_controls.md#disable-group-owners-from-updating-default-branch-protection-premium-only).
+
 ## Add projects to a group
 
 There are two different ways to add a new project to a group:
diff --git a/doc/user/project/img/service_desk_custom_email_address_v13_0.png b/doc/user/project/img/service_desk_custom_email_address_v13_0.png
new file mode 100644
index 00000000000..6ce8bf45085
--- /dev/null
+++ b/doc/user/project/img/service_desk_custom_email_address_v13_0.png
diff --git a/doc/user/project/service_desk.md b/doc/user/project/service_desk.md
index f18a202c63b..35119459bbe 100644
--- a/doc/user/project/service_desk.md
+++ b/doc/user/project/service_desk.md
@@ -95,18 +95,18 @@ directory in your repository. Commit and push to your default branch.
 
 The **Thank you email** is the email sent to a user after they submit an issue.
 The file name of the template has to be `thank_you.md`.
-You can use `%{ISSUE_ID}` placeholder which will be replaced by an issue iid in the email and
-`%{ISSUE_PATH}` placeholder which will be replaced by project path and the issue iid.
+You can use `%{ISSUE_ID}` placeholder which will be replaced by an issue IID in the email and
+`%{ISSUE_PATH}` placeholder which will be replaced by project path and the issue IID.
 As the service desk issues are created as confidential (only project members can see them)
-the response email doesn't provide the issue link.
+the response email does not provide the issue link.
 
 #### New note email
 
 The **New note email** is the email sent to a user when the issue they submitted has a new comment.
 The file name of the template has to be `new_note.md`.
-You can use `%{ISSUE_ID}` placeholder which will be replaced by an issue iid
+You can use `%{ISSUE_ID}` placeholder which will be replaced by an issue IID
 in the email, `%{ISSUE_PATH}` placeholder which will be replaced by
- project path and the issue iid and `%{NOTE_TEXT}` placeholder which will be replaced by the note text.
+ project path and the issue IID and `%{NOTE_TEXT}` placeholder which will be replaced by the note text.
 
 ### Using custom email display name
 
@@ -115,11 +115,66 @@ in the email, `%{ISSUE_PATH}` placeholder which will be replaced by
 You can customize the email display name. Emails sent from Service Desk will have
 this name in the `From` header. The default display name is `GitLab Support Bot`.
 
+### Using custom email address
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/issues/2201) in [GitLab Premium](https://about.gitlab.com/pricing/) 13.0.
+
+NOTE: **Note:**
+This feature is disabled by default. For steps to enable it, see [Enable custom email address](#enable-custom-email-address).
+
+If the `service_desk_email` feature flag is enabled in your configuration,
+then it's possible to create Service Desk issues by sending emails to the
+custom Service Desk email address, which should have the following format:
+`project_contact+%{key}@example.com`.
+
+The `%{key}` part is used to find the project where the issue should be created. The
+`%{key}` part combines the path to the project and configurable project name suffix:
+`<project_full_path>-<project_name_suffix>`.
+
+You can set the project name suffix in your project's Service Desk settings.
+It can contain only lowercase letters (`a-z`), numbers (`0-9`), or underscores (`_`).
+
+![Setting custom Service Desk email address](img/service_desk_custom_email_address_v13_0.png)
+
+For example, suppose you add the following to your configuration:
+
+```yaml
+service_desk_email:
+  enabled: true
+  address: "project_contact+%{key}@example.com"
+  user: "project_support@example.com"
+  password: "[REDACTED]"
+  host: "imap.gmail.com"
+  port: 993
+  ssl: true
+  start_tls: false
+  log_path: "log/mailroom.log"
+  mailbox: "inbox"
+  idle_timeout: 60
+```
+
+In this case, suppose the `mygroup/myproject` project Service Desk settings has the project name
+suffix set to `support`, and a user sends an email to `project_contact+mygroup-myproject-support@example.com`.
+As a result, a new Service Desk issue is created from this email in the `mygroup/myproject` project.
+
+#### Enable custom email address
+
+This feature comes with the `service_desk_email` feature flag disabled by default.
+To turn on the feature, ask a GitLab administrator with Rails console access to run the following
+command:
+
+```ruby
+Feature.enable(service_desk_email)
+```
+
+The configuration options are the same as for configuring
+[incoming email](../../administration/incoming_email.md#set-it-up).
+
 ## Using Service Desk
 
 ### As an end user (issue creator)
 
-To create a Service Desk issue, an end user doesn't need to know anything about
+To create a Service Desk issue, an end user does not need to know anything about
 the GitLab instance. They just send an email to the address they are given, and
 receive an email back confirming receipt:
 
@@ -136,7 +191,7 @@ And any responses they send will be displayed in the issue itself.
 
 ### As a responder to the issue
 
-For responders to the issue, everything works as usual. They'll see a familiar looking
+For responders to the issue, everything works as usual. They will see a familiar looking
 issue tracker, where they can see issues created via customer support requests and
 filter and interact with them just like other GitLab issues.