Add latest changes from gitlab-org/gitlab@16-5-stable-eev16.5.0-rc42

75 files changed, 271 insertions, 160 deletions

diff --git a/lib/gitlab/ci/build/artifacts/metadata.rb b/lib/gitlab/ci/build/artifacts/metadata.rb
index 5748b8e34cf..7d9235ac460 100644
--- a/lib/gitlab/ci/build/artifacts/metadata.rb
+++ b/lib/gitlab/ci/build/artifacts/metadata.rb
@@ -11,8 +11,8 @@ module Gitlab
           ParserError = Class.new(StandardError)
           InvalidStreamError = Class.new(StandardError)
 
-          VERSION_PATTERN = /^[\w\s]+(\d+\.\d+\.\d+)/.freeze
-          INVALID_PATH_PATTERN = %r{(^\.?\.?/)|(/\.?\.?/)}.freeze
+          VERSION_PATTERN = /^[\w\s]+(\d+\.\d+\.\d+)/
+          INVALID_PATH_PATTERN = %r{(^\.?\.?/)|(/\.?\.?/)}
 
           attr_reader :stream, :path, :full_version
 
diff --git a/lib/gitlab/ci/build/context/build.rb b/lib/gitlab/ci/build/context/build.rb
index 81efbdb297b..48b138b0258 100644
--- a/lib/gitlab/ci/build/context/build.rb
+++ b/lib/gitlab/ci/build/context/build.rb
@@ -30,8 +30,16 @@ module Gitlab
             ::Ci::Build.new(build_attributes)
           end
 
+          # Assigning tags and needs is slow and they are not needed for rules
+          # evaluation since we don't use them to compute the variables at this point.
           def build_attributes
-            attributes.merge(pipeline_attributes, ci_stage_attributes)
+            if pipeline.reduced_build_attributes_list_for_rules?
+              attributes
+                .except(:tag_list, :needs_attributes)
+                .merge!(pipeline_attributes, ci_stage_attributes)
+            else
+              attributes.merge(pipeline_attributes, ci_stage_attributes)
+            end
           end
 
           def ci_stage_attributes
diff --git a/lib/gitlab/ci/build/duration_parser.rb b/lib/gitlab/ci/build/duration_parser.rb
index 97049a4f876..9385dccd5f3 100644
--- a/lib/gitlab/ci/build/duration_parser.rb
+++ b/lib/gitlab/ci/build/duration_parser.rb
@@ -41,7 +41,7 @@ module Gitlab
         def parse
           return if never?
 
-          ChronicDuration.parse(value, use_complete_matcher: true)
+          ChronicDuration.parse(value)
         end
 
         def validation_cache
diff --git a/lib/gitlab/ci/components/instance_path.rb b/lib/gitlab/ci/components/instance_path.rb
index 17c784c4d54..551284d9099 100644
--- a/lib/gitlab/ci/components/instance_path.rb
+++ b/lib/gitlab/ci/components/instance_path.rb
@@ -7,19 +7,17 @@ module Gitlab
         include Gitlab::Utils::StrongMemoize
 
         LATEST_VERSION_KEYWORD = '~latest'
-        TEMPLATES_DIR = 'templates'
 
         def self.match?(address)
           address.include?('@') && address.start_with?(Settings.gitlab_ci['component_fqdn'])
         end
 
-        attr_reader :host, :project_file_path
+        attr_reader :host
 
-        def initialize(address:, content_filename:)
+        def initialize(address:)
           @full_path, @version = address.to_s.split('@', 2)
-          @content_filename = content_filename
           @host = Settings.gitlab_ci['component_fqdn']
-          @project_file_path = nil
+          @component_project = ::Ci::Catalog::ComponentsProject.new(project, sha)
         end
 
         def fetch_content!(current_user:)
@@ -28,7 +26,7 @@ module Gitlab
 
           raise Gitlab::Access::AccessDeniedError unless Ability.allowed?(current_user, :download_code, project)
 
-          content(simple_template_path) || content(complex_template_path) || content(legacy_template_path)
+          @component_project.fetch_component(component_name)
         end
 
         def project
@@ -46,16 +44,7 @@ module Gitlab
 
         private
 
-        attr_reader :version, :path
-
-        def instance_path
-          @full_path.delete_prefix(host)
-        end
-
-        def component_path
-          instance_path.delete_prefix(project.full_path).delete_prefix('/')
-        end
-        strong_memoize_attr :component_path
+        attr_reader :version
 
         # Given a path like "my-org/sub-group/the-project/path/to/component"
         # find the project "my-org/sub-group/the-project" by looking at all possible paths.
@@ -65,45 +54,23 @@ module Gitlab
           while index = path.rindex('/') # find index of last `/` in a path
             possible_paths << (path = path[0..index - 1])
           end
-
           # remove shortest path as it is group
           possible_paths.pop
 
           ::Project.where_full_path_in(possible_paths).take # rubocop: disable CodeReuse/ActiveRecord
         end
 
-        def latest_version_sha
-          project.releases.latest&.sha
-        end
-
-        # A simple template consists of a single file
-        def simple_template_path
-          # Extract this line and move to fetch_content once we remove legacy fetching
-          return unless templates_dir_exists? && component_path.index('/').nil?
-
-          @project_file_path = File.join(TEMPLATES_DIR, "#{component_path}.yml")
-        end
-
-        # A complex template is directory-based and may consist of multiple files.
-        # Given a path like "my-org/sub-group/the-project/templates/component"
-        # returns the entry point path: "templates/component/template.yml".
-        def complex_template_path
-          # Extract this line and move to fetch_content once we remove legacy fetching
-          return unless templates_dir_exists? && component_path.index('/').nil?
-
-          @project_file_path = File.join(TEMPLATES_DIR, component_path, @content_filename)
-        end
-
-        def legacy_template_path
-          @project_file_path = File.join(component_path, @content_filename).delete_prefix('/')
+        def instance_path
+          @full_path.delete_prefix(host)
         end
 
-        def templates_dir_exists?
-          project.repository.tree.trees.map(&:name).include?(TEMPLATES_DIR)
+        def component_name
+          instance_path.delete_prefix(project.full_path).delete_prefix('/')
         end
+        strong_memoize_attr :component_name
 
-        def content(path)
-          project.repository.blob_data_at(sha, path)
+        def latest_version_sha
+          project.releases.latest&.sha
         end
       end
     end
diff --git a/lib/gitlab/ci/config/entry/artifacts.rb b/lib/gitlab/ci/config/entry/artifacts.rb
index 27206d7e3a8..3fd07811daf 100644
--- a/lib/gitlab/ci/config/entry/artifacts.rb
+++ b/lib/gitlab/ci/config/entry/artifacts.rb
@@ -14,7 +14,7 @@ module Gitlab
 
           ALLOWED_WHEN = %w[on_success on_failure always].freeze
           ALLOWED_KEYS = %i[name untracked paths reports when expire_in expose_as exclude public].freeze
-          EXPOSE_AS_REGEX = /\A\w[-\w ]*\z/.freeze
+          EXPOSE_AS_REGEX = /\A\w[-\w ]*\z/
           EXPOSE_AS_ERROR_MESSAGE = "can contain only letters, digits, '-', '_' and spaces"
 
           attributes ALLOWED_KEYS
diff --git a/lib/gitlab/ci/config/entry/job.rb b/lib/gitlab/ci/config/entry/job.rb
index c40d665f320..bf8a99ef45e 100644
--- a/lib/gitlab/ci/config/entry/job.rb
+++ b/lib/gitlab/ci/config/entry/job.rb
@@ -177,7 +177,7 @@ module Gitlab
           def parsed_timeout
             return unless has_timeout?
 
-            ChronicDuration.parse(timeout.to_s, use_complete_matcher: true)
+            ChronicDuration.parse(timeout.to_s)
           end
 
           def ignored?
diff --git a/lib/gitlab/ci/config/external/file/base.rb b/lib/gitlab/ci/config/external/file/base.rb
index efba81c7420..b3c802e5657 100644
--- a/lib/gitlab/ci/config/external/file/base.rb
+++ b/lib/gitlab/ci/config/external/file/base.rb
@@ -10,7 +10,7 @@ module Gitlab
 
             attr_reader :location, :params, :context, :errors
 
-            YAML_WHITELIST_EXTENSION = /.+\.(yml|yaml)$/i.freeze
+            YAML_WHITELIST_EXTENSION = /.+\.(yml|yaml)$/i
 
             def initialize(params, context)
               @params = params
@@ -114,7 +114,9 @@ module Gitlab
 
             def content_result
               context.logger.instrument(:config_file_fetch_content_hash) do
-                ::Gitlab::Ci::Config::Yaml::Loader.new(content, inputs: content_inputs).load
+                ::Gitlab::Ci::Config::Yaml::Loader.new(
+                  content, inputs: content_inputs, variables: context.variables
+                ).load
               end
             end
             strong_memoize_attr :content_result
diff --git a/lib/gitlab/ci/config/external/file/component.rb b/lib/gitlab/ci/config/external/file/component.rb
index de6de1bb7a8..03063e76dde 100644
--- a/lib/gitlab/ci/config/external/file/component.rb
+++ b/lib/gitlab/ci/config/external/file/component.rb
@@ -20,7 +20,7 @@ module Gitlab
 
               ::Gitlab::UsageDataCounters::HLLRedisCounter.track_event('cicd_component_usage', values: context.user.id)
 
-              component_result.payload.fetch(:content)
+              component_payload.fetch(:content)
             end
             strong_memoize_attr :content
 
@@ -65,30 +65,30 @@ module Gitlab
             override :expand_context_attrs
             def expand_context_attrs
               {
-                project: component_path.project,
-                sha: component_path.sha,
+                project: component_payload.fetch(:project),
+                sha: component_payload.fetch(:sha),
                 user: context.user,
                 variables: context.variables
               }
             end
 
             def masked_blob
-              return unless component_path
+              return unless component_payload
 
               context.mask_variables_from(
                 Gitlab::Routing.url_helpers.project_blob_url(
-                  component_path.project,
-                  ::File.join(component_path.sha, component_path.project_file_path))
+                  component_payload.fetch(:project),
+                  ::File.join(component_payload.fetch(:sha), component_payload.fetch(:path)))
               )
             end
             strong_memoize_attr :masked_blob
 
-            def component_path
+            def component_payload
               return unless component_result.success?
 
-              component_result.payload.fetch(:path)
+              component_result.payload
             end
-            strong_memoize_attr :component_path
+            strong_memoize_attr :component_payload
           end
         end
       end
diff --git a/lib/gitlab/ci/config/header/input.rb b/lib/gitlab/ci/config/header/input.rb
index 76a89a3080e..dcb96006459 100644
--- a/lib/gitlab/ci/config/header/input.rb
+++ b/lib/gitlab/ci/config/header/input.rb
@@ -11,12 +11,16 @@ module Gitlab
           include ::Gitlab::Config::Entry::Validatable
           include ::Gitlab::Config::Entry::Attributable
 
-          attributes :default, :type, prefix: :input
+          ALLOWED_KEYS = %i[default description regex type].freeze
+
+          attributes ALLOWED_KEYS, prefix: :input
 
           validations do
-            validates :config, type: Hash, allowed_keys: [:default, :type]
+            validates :config, type: Hash, allowed_keys: ALLOWED_KEYS
             validates :key, alphanumeric: true
             validates :input_default, alphanumeric: true, allow_nil: true
+            validates :input_description, alphanumeric: true, allow_nil: true
+            validates :input_regex, type: String, allow_nil: true
             validates :input_type, allow_nil: true, allowed_values: Interpolation::Inputs.input_types
           end
         end
diff --git a/lib/gitlab/ci/config/interpolation/block.rb b/lib/gitlab/ci/config/interpolation/block.rb
index cf8420f924e..aec19299e86 100644
--- a/lib/gitlab/ci/config/interpolation/block.rb
+++ b/lib/gitlab/ci/config/interpolation/block.rb
@@ -62,7 +62,7 @@ module Gitlab
             return @errors.concat(access.errors) unless access.valid?
             return @errors.push('too many functions in interpolation block') if functions.count > MAX_FUNCTIONS
 
-            result = Interpolation::FunctionsStack.new(functions).evaluate(access.value)
+            result = Interpolation::FunctionsStack.new(functions, ctx).evaluate(access.value)
 
             if result.success?
               @value = result.value
diff --git a/lib/gitlab/ci/config/interpolation/context.rb b/lib/gitlab/ci/config/interpolation/context.rb
index f5e7db03291..19ea619f7da 100644
--- a/lib/gitlab/ci/config/interpolation/context.rb
+++ b/lib/gitlab/ci/config/interpolation/context.rb
@@ -14,8 +14,11 @@ module Gitlab
 
           MAX_DEPTH = 3
 
-          def initialize(hash)
-            @context = hash
+          attr_reader :variables
+
+          def initialize(data, variables: [])
+            @data = data
+            @variables = Ci::Variables::Collection.fabricate(variables)
 
             raise ContextTooComplexError if depth > MAX_DEPTH
           end
@@ -32,25 +35,25 @@ module Gitlab
           end
 
           def depth
-            deep_depth(@context)
+            deep_depth(@data)
           end
 
           def fetch(field)
-            @context.fetch(field)
+            @data.fetch(field)
           end
 
           def key?(name)
-            @context.key?(name)
+            @data.key?(name)
           end
 
           def to_h
-            @context.to_h
+            @data.to_h
           end
 
           private
 
-          def deep_depth(context, depth = 0)
-            values = context.values.map do |value|
+          def deep_depth(data, depth = 0)
+            values = data.values.map do |value|
               if value.is_a?(Hash)
                 deep_depth(value, depth + 1)
               else
@@ -61,10 +64,10 @@ module Gitlab
             values.max.to_i
           end
 
-          def self.fabricate(context)
+          def self.fabricate(context, variables: [])
             case context
             when Hash
-              new(context)
+              new(context, variables: variables)
             when Interpolation::Context
               context
             else
diff --git a/lib/gitlab/ci/config/interpolation/functions/base.rb b/lib/gitlab/ci/config/interpolation/functions/base.rb
index b9ce8cdc5bc..b04152a1558 100644
--- a/lib/gitlab/ci/config/interpolation/functions/base.rb
+++ b/lib/gitlab/ci/config/interpolation/functions/base.rb
@@ -20,9 +20,10 @@ module Gitlab
               function_expression_pattern.match?(function_expression)
             end
 
-            def initialize(function_expression)
+            def initialize(function_expression, ctx)
               @errors = []
               @function_args = parse_args(function_expression)
+              @ctx = ctx
             end
 
             def valid?
@@ -35,10 +36,11 @@ module Gitlab
 
             private
 
-            attr_reader :function_args
+            attr_reader :function_args, :ctx
 
             def error(message)
               errors << "error in `#{self.class.name}` function: #{message}"
+              nil
             end
 
             def parse_args(function_expression)
diff --git a/lib/gitlab/ci/config/interpolation/functions/expand_vars.rb b/lib/gitlab/ci/config/interpolation/functions/expand_vars.rb
new file mode 100644
index 00000000000..658964018b5
--- /dev/null
+++ b/lib/gitlab/ci/config/interpolation/functions/expand_vars.rb
@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    class Config
+      module Interpolation
+        module Functions
+          class ExpandVars < Base
+            def self.function_expression_pattern
+              /^#{name}$/
+            end
+
+            def self.name
+              'expand_vars'
+            end
+
+            def execute(input_value)
+              unless input_value.is_a?(String)
+                error("invalid input type: #{self.class.name} can only be used with string inputs")
+                return
+              end
+
+              ExpandVariables.expand_existing(input_value, ctx.variables, fail_on_masked: true)
+            rescue ExpandVariables::VariableExpansionError => e
+              error("variable expansion error: #{e.message}")
+              nil
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/config/interpolation/functions_stack.rb b/lib/gitlab/ci/config/interpolation/functions_stack.rb
index 951d1121d4f..4cb3e67b3e3 100644
--- a/lib/gitlab/ci/config/interpolation/functions_stack.rb
+++ b/lib/gitlab/ci/config/interpolation/functions_stack.rb
@@ -16,12 +16,14 @@ module Gitlab
           end
 
           FUNCTIONS = [
-            Functions::Truncate
+            Functions::Truncate,
+            Functions::ExpandVars
           ].freeze
 
           attr_reader :errors
 
-          def initialize(function_expressions)
+          def initialize(function_expressions, ctx)
+            @ctx = ctx
             @errors = []
             @functions = build_stack(function_expressions)
           end
@@ -48,14 +50,14 @@ module Gitlab
 
           private
 
-          attr_reader :functions
+          attr_reader :functions, :ctx
 
           def build_stack(function_expressions)
             function_expressions.map do |function_expression|
               matching_function = FUNCTIONS.find { |function| function.matches?(function_expression) }
 
               if matching_function.present?
-                matching_function.new(function_expression)
+                matching_function.new(function_expression, ctx)
               else
                 message = "no function matching `#{function_expression}`: " \
                           'check that the function name, arguments, and types are correct'
diff --git a/lib/gitlab/ci/config/interpolation/inputs/base_input.rb b/lib/gitlab/ci/config/interpolation/inputs/base_input.rb
index 5648c4d31ea..ba519776635 100644
--- a/lib/gitlab/ci/config/interpolation/inputs/base_input.rb
+++ b/lib/gitlab/ci/config/interpolation/inputs/base_input.rb
@@ -62,7 +62,15 @@ module Gitlab
               end
 
               # validate provided value
-              error("provided value is not a #{self.class.type_name}") unless valid_value?(actual_value)
+              return error("provided value is not a #{self.class.type_name}") unless valid_value?(actual_value)
+
+              validate_regex!
+            end
+
+            def validate_regex!
+              return unless spec.key?(:regex)
+
+              error('RegEx validation can only be used with string inputs')
             end
 
             def error(message)
diff --git a/lib/gitlab/ci/config/interpolation/inputs/string_input.rb b/lib/gitlab/ci/config/interpolation/inputs/string_input.rb
index 39870582d0c..3f40e851f11 100644
--- a/lib/gitlab/ci/config/interpolation/inputs/string_input.rb
+++ b/lib/gitlab/ci/config/interpolation/inputs/string_input.rb
@@ -25,6 +25,24 @@ module Gitlab
             def valid_value?(value)
               value.nil? || value.is_a?(String)
             end
+
+            private
+
+            def validate_regex!
+              return unless spec.key?(:regex)
+
+              safe_regex = ::Gitlab::UntrustedRegexp.new(spec[:regex])
+
+              return if safe_regex.match?(actual_value)
+
+              if value.nil?
+                error('default value does not match required RegEx pattern')
+              else
+                error('provided value does not match required RegEx pattern')
+              end
+            rescue RegexpError
+              error('invalid regular expression')
+            end
           end
         end
       end
diff --git a/lib/gitlab/ci/config/interpolation/interpolator.rb b/lib/gitlab/ci/config/interpolation/interpolator.rb
index 95c419d7427..5b21b777c1d 100644
--- a/lib/gitlab/ci/config/interpolation/interpolator.rb
+++ b/lib/gitlab/ci/config/interpolation/interpolator.rb
@@ -8,11 +8,12 @@ module Gitlab
         # Performs CI config file interpolation, and surfaces all possible interpolation errors.
         #
         class Interpolator
-          attr_reader :config, :args, :errors
+          attr_reader :config, :args, :variables, :errors
 
-          def initialize(config, args)
+          def initialize(config, args, variables)
             @config = config
             @args = args.to_h
+            @variables = variables
             @errors = []
             @interpolated = false
           end
@@ -86,7 +87,7 @@ module Gitlab
           end
 
           def context
-            @context ||= Context.new({ inputs: inputs.to_hash })
+            @context ||= Context.new({ inputs: inputs.to_hash }, variables: variables)
           end
 
           def template
diff --git a/lib/gitlab/ci/config/yaml/loader.rb b/lib/gitlab/ci/config/yaml/loader.rb
index 5d56061a8bb..1e9ac2b3dd5 100644
--- a/lib/gitlab/ci/config/yaml/loader.rb
+++ b/lib/gitlab/ci/config/yaml/loader.rb
@@ -10,9 +10,10 @@ module Gitlab
           AVAILABLE_TAGS = [Config::Yaml::Tags::Reference].freeze
           MAX_DOCUMENTS = 2
 
-          def initialize(content, inputs: {})
+          def initialize(content, inputs: {}, variables: [])
             @content = content
             @inputs = inputs
+            @variables = variables
           end
 
           def load
@@ -20,7 +21,7 @@ module Gitlab
 
             return yaml_result unless yaml_result.valid?
 
-            interpolator = Interpolation::Interpolator.new(yaml_result, inputs)
+            interpolator = Interpolation::Interpolator.new(yaml_result, inputs, variables)
 
             interpolator.interpolate!
 
@@ -32,16 +33,16 @@ module Gitlab
             end
           end
 
-          private
-
-          attr_reader :content, :inputs
-
           def load_uninterpolated_yaml
             Yaml::Result.new(config: load_yaml!, error: nil)
           rescue ::Gitlab::Config::Loader::FormatError => e
             Yaml::Result.new(error: e.message, error_class: e)
           end
 
+          private
+
+          attr_reader :content, :inputs, :variables
+
           def load_yaml!
             ensure_custom_tags
 
diff --git a/lib/gitlab/ci/config/yaml/result.rb b/lib/gitlab/ci/config/yaml/result.rb
index a68cfde6653..0e7e9230467 100644
--- a/lib/gitlab/ci/config/yaml/result.rb
+++ b/lib/gitlab/ci/config/yaml/result.rb
@@ -39,6 +39,10 @@ module Gitlab
 
             @config.first || {}
           end
+
+          def inputs
+            (has_header? && header[:spec][:inputs]) || {}
+          end
         end
       end
     end
diff --git a/lib/gitlab/ci/lint.rb b/lib/gitlab/ci/lint.rb
index 54861e2769e..f213bc83d90 100644
--- a/lib/gitlab/ci/lint.rb
+++ b/lib/gitlab/ci/lint.rb
@@ -25,12 +25,12 @@ module Gitlab
 
       LOG_MAX_DURATION_THRESHOLD = 2.seconds
 
-      def initialize(project:, current_user:, sha: nil)
+      def initialize(project:, current_user:, sha: nil, verify_project_sha: true)
         @project = project
         @current_user = current_user
         # If the `sha` is not provided, the default is the project's head commit (or nil). In such case, we
         # don't need to call `YamlProcessor.verify_project_sha!`, which prevents redundant calls to Gitaly.
-        @verify_project_sha = sha.present?
+        @verify_project_sha = verify_project_sha && sha.present?
         @sha = sha || project&.repository&.commit&.sha
       end
 
diff --git a/lib/gitlab/ci/parsers/security/common.rb b/lib/gitlab/ci/parsers/security/common.rb
index ee1da82f285..9032faa66d4 100644
--- a/lib/gitlab/ci/parsers/security/common.rb
+++ b/lib/gitlab/ci/parsers/security/common.rb
@@ -140,7 +140,10 @@ module Gitlab
                 signatures: signatures,
                 project_id: @project.id,
                 found_by_pipeline: report.pipeline,
-                vulnerability_finding_signatures_enabled: @signatures_enabled))
+                vulnerability_finding_signatures_enabled: @signatures_enabled,
+                cvss: data['cvss'] || []
+              )
+            )
           end
 
           def create_signatures(tracking)
diff --git a/lib/gitlab/ci/parsers/test/junit.rb b/lib/gitlab/ci/parsers/test/junit.rb
index d95ecff85cd..5b8abccc6d4 100644
--- a/lib/gitlab/ci/parsers/test/junit.rb
+++ b/lib/gitlab/ci/parsers/test/junit.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Test
         class Junit
           JunitParserError = Class.new(Gitlab::Ci::Parsers::ParserError)
-          ATTACHMENT_TAG_REGEX = /\[\[ATTACHMENT\|(?<path>.+?)\]\]/.freeze
+          ATTACHMENT_TAG_REGEX = /\[\[ATTACHMENT\|(?<path>.+?)\]\]/
 
           def parse!(xml_data, test_report, job:)
             test_suite = test_report.get_suite(job.test_suite_name)
@@ -64,13 +64,16 @@ module Gitlab
           end
 
           def create_test_case(data, test_suite, job)
+            system_out = data.key?('system_out') ? "System Out:\n\n#{data['system_out']}" : nil
+            system_err = data.key?('system_err') ? "System Err:\n\n#{data['system_err']}" : nil
+
             if data.key?('failure')
               status = ::Gitlab::Ci::Reports::TestCase::STATUS_FAILED
-              system_output = data['failure'] || data['system_err']
+              system_output = [data['failure'], system_out, system_err].compact.join("\n\n")
               attachment = attachment_path(data['system_out'])
             elsif data.key?('error')
               status = ::Gitlab::Ci::Reports::TestCase::STATUS_ERROR
-              system_output = data['error'] || data['system_err']
+              system_output = [data['error'], system_out, system_err].compact.join("\n\n")
               attachment = attachment_path(data['system_out'])
             elsif data.key?('skipped')
               status = ::Gitlab::Ci::Reports::TestCase::STATUS_SKIPPED
diff --git a/lib/gitlab/ci/pipeline/chain/skip.rb b/lib/gitlab/ci/pipeline/chain/skip.rb
index 76dfb4cbd87..152ea700eb7 100644
--- a/lib/gitlab/ci/pipeline/chain/skip.rb
+++ b/lib/gitlab/ci/pipeline/chain/skip.rb
@@ -7,7 +7,7 @@ module Gitlab
         class Skip < Chain::Base
           include ::Gitlab::Utils::StrongMemoize
 
-          SKIP_PATTERN = /\[(ci[ _-]skip|skip[ _-]ci)\]/i.freeze
+          SKIP_PATTERN = /\[(ci[ _-]skip|skip[ _-]ci)\]/i
 
           def perform!
             if skipped?
diff --git a/lib/gitlab/ci/pipeline/chain/validate/abilities.rb b/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
index 1939b1ff395..c89f9933616 100644
--- a/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
+++ b/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
@@ -19,7 +19,7 @@ module Gitlab
               end
 
               if project.import_in_progress?
-                return error('Import in progress')
+                return error('You cannot run pipelines before project import is complete.')
               end
 
               unless allowed_to_create_pipeline?
diff --git a/lib/gitlab/ci/pipeline/expression.rb b/lib/gitlab/ci/pipeline/expression.rb
index 61d392121d8..a7b82395b6d 100644
--- a/lib/gitlab/ci/pipeline/expression.rb
+++ b/lib/gitlab/ci/pipeline/expression.rb
@@ -5,7 +5,6 @@ module Gitlab
     module Pipeline
       module Expression
         ExpressionError = Class.new(StandardError)
-        RuntimeError = Class.new(ExpressionError)
       end
     end
   end
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/and.rb b/lib/gitlab/ci/pipeline/expression/lexeme/and.rb
index 422735bd104..70d439e2d20 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/and.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/and.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Expression
         module Lexeme
           class And < Lexeme::LogicalOperator
-            PATTERN = /&&/.freeze
+            PATTERN = /&&/
 
             def evaluate(variables = {})
               @left.evaluate(variables) && @right.evaluate(variables)
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/equals.rb b/lib/gitlab/ci/pipeline/expression/lexeme/equals.rb
index d35be12c996..9a45105eeaf 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/equals.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/equals.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Expression
         module Lexeme
           class Equals < Lexeme::LogicalOperator
-            PATTERN = /==/.freeze
+            PATTERN = /==/
 
             def evaluate(variables = {})
               @left.evaluate(variables) == @right.evaluate(variables)
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb b/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
index c4f06c4686d..35e08776820 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Expression
         module Lexeme
           class Matches < Lexeme::LogicalOperator
-            PATTERN = /=~/.freeze
+            PATTERN = /=~/
 
             def evaluate(variables = {})
               text = @left.evaluate(variables)
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/not_equals.rb b/lib/gitlab/ci/pipeline/expression/lexeme/not_equals.rb
index 64485a7e6b3..54ae3b0c369 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/not_equals.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/not_equals.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Expression
         module Lexeme
           class NotEquals < Lexeme::LogicalOperator
-            PATTERN = /!=/.freeze
+            PATTERN = /!=/
 
             def evaluate(variables = {})
               @left.evaluate(variables) != @right.evaluate(variables)
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb b/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb
index 99d9206da74..4cd9e3f3572 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Expression
         module Lexeme
           class NotMatches < Lexeme::LogicalOperator
-            PATTERN = /\!~/.freeze
+            PATTERN = /\!~/
 
             def evaluate(variables = {})
               text = @left.evaluate(variables)
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/null.rb b/lib/gitlab/ci/pipeline/expression/lexeme/null.rb
index e7f7945532b..89b7e0b102e 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/null.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/null.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Expression
         module Lexeme
           class Null < Lexeme::Value
-            PATTERN = /null/.freeze
+            PATTERN = /null/
 
             def initialize(value = nil)
               super
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/or.rb b/lib/gitlab/ci/pipeline/expression/lexeme/or.rb
index c7d653ac859..1a7b619c49c 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/or.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/or.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Expression
         module Lexeme
           class Or < Lexeme::LogicalOperator
-            PATTERN = /\|\|/.freeze
+            PATTERN = /\|\|/
 
             def evaluate(variables = {})
               @left.evaluate(variables) || @right.evaluate(variables)
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/parenthesis_close.rb b/lib/gitlab/ci/pipeline/expression/lexeme/parenthesis_close.rb
index b0ca26c9f5d..29b5e47a65f 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/parenthesis_close.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/parenthesis_close.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Expression
         module Lexeme
           class ParenthesisClose < Lexeme::Operator
-            PATTERN = /\)/.freeze
+            PATTERN = /\)/
 
             def self.type
               :parenthesis_close
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/parenthesis_open.rb b/lib/gitlab/ci/pipeline/expression/lexeme/parenthesis_open.rb
index 924fe0663ab..80f92609154 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/parenthesis_open.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/parenthesis_open.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Expression
         module Lexeme
           class ParenthesisOpen < Lexeme::Operator
-            PATTERN = /\(/.freeze
+            PATTERN = /\(/
 
             def self.type
               :parenthesis_open
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/pattern.rb b/lib/gitlab/ci/pipeline/expression/lexeme/pattern.rb
index cd4106b16bb..17fe82b2236 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/pattern.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/pattern.rb
@@ -5,23 +5,17 @@ module Gitlab
     module Pipeline
       module Expression
         module Lexeme
-          require_dependency 're2'
-
           class Pattern < Lexeme::Value
-            PATTERN = %r{^\/([^\/]|\\/)+[^\\]\/[ismU]*}.freeze
+            PATTERN = %r{^\/([^\/]|\\/)+[^\\]\/[ismU]*}
 
             def initialize(regexp)
               super(regexp.gsub(%r{\\/}, '/'))
 
-              unless Gitlab::UntrustedRegexp::RubySyntax.valid?(@value)
-                raise Lexer::SyntaxError, 'Invalid regular expression!'
-              end
+              raise Lexer::SyntaxError, 'Invalid regular expression!' unless cached_regexp.valid?
             end
 
             def evaluate(variables = {})
-              Gitlab::UntrustedRegexp::RubySyntax.fabricate!(@value)
-            rescue RegexpError
-              raise Expression::RuntimeError, 'Invalid regular expression!'
+              cached_regexp.expression
             end
 
             def inspect
@@ -47,6 +41,12 @@ module Gitlab
 
               new_pattern.evaluate(variables)
             end
+
+            private
+
+            def cached_regexp
+              @cached_regexp ||= RegularExpression.new(@value)
+            end
           end
         end
       end
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/pattern/regular_expression.rb b/lib/gitlab/ci/pipeline/expression/lexeme/pattern/regular_expression.rb
new file mode 100644
index 00000000000..5b771abf4ba
--- /dev/null
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/pattern/regular_expression.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Pipeline
+      module Expression
+        module Lexeme
+          class Pattern
+            require_dependency 're2'
+            class RegularExpression
+              include Gitlab::Utils::StrongMemoize
+
+              attr_reader :value
+
+              def initialize(value)
+                @value = value
+              end
+
+              def expression
+                Gitlab::SafeRequestStore.fetch("#{self.class}#unsafe_regexp:#{value}") do
+                  Gitlab::UntrustedRegexp::RubySyntax.fabricate!(value)
+                end
+              end
+              strong_memoize_attr :expression
+
+              def valid?
+                !!expression
+              rescue RegexpError
+                false
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/string.rb b/lib/gitlab/ci/pipeline/expression/lexeme/string.rb
index 798cea34db6..c43150125b7 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/string.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/string.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Expression
         module Lexeme
           class String < Lexeme::Value
-            PATTERN = /("(?<string>.*?)")|('(?<string>.*?)')/.freeze
+            PATTERN = /("(?<string>.*?)")|('(?<string>.*?)')/
 
             def evaluate(variables = {})
               @value.to_s
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/variable.rb b/lib/gitlab/ci/pipeline/expression/lexeme/variable.rb
index 6da88fd287e..2ecd50d32e4 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/variable.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/variable.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Expression
         module Lexeme
           class Variable < Lexeme::Value
-            PATTERN = /\$(?<name>\w+)/.freeze
+            PATTERN = /\$(?<name>\w+)/
 
             def evaluate(variables = {})
               unless variables.is_a?(ActiveSupport::HashWithIndifferentAccess)
diff --git a/lib/gitlab/ci/reports/security/finding.rb b/lib/gitlab/ci/reports/security/finding.rb
index d439149158a..fa8494483d3 100644
--- a/lib/gitlab/ci/reports/security/finding.rb
+++ b/lib/gitlab/ci/reports/security/finding.rb
@@ -30,12 +30,13 @@ module Gitlab
           attr_reader :project_id
           attr_reader :original_data
           attr_reader :found_by_pipeline
+          attr_reader :cvss
 
           delegate :file_path, :start_line, :end_line, to: :location
 
           alias_method :cve, :compare_key
 
-          def initialize(compare_key:, identifiers:, flags: [], links: [], remediations: [], location:, evidence:, metadata_version:, name:, original_data:, report_type:, scanner:, scan:, uuid:, confidence: nil, severity: nil, details: {}, signatures: [], project_id: nil, vulnerability_finding_signatures_enabled: false, found_by_pipeline: nil) # rubocop:disable Metrics/ParameterLists
+          def initialize(compare_key:, identifiers:, flags: [], links: [], remediations: [], location:, evidence:, metadata_version:, name:, original_data:, report_type:, scanner:, scan:, uuid:, confidence: nil, severity: nil, details: {}, signatures: [], project_id: nil, vulnerability_finding_signatures_enabled: false, found_by_pipeline: nil, cvss: []) # rubocop:disable Metrics/ParameterLists
             @compare_key = compare_key
             @confidence = confidence
             @identifiers = identifiers
@@ -57,6 +58,7 @@ module Gitlab
             @project_id = project_id
             @vulnerability_finding_signatures_enabled = vulnerability_finding_signatures_enabled
             @found_by_pipeline = found_by_pipeline
+            @cvss = cvss
 
             @project_fingerprint = generate_project_fingerprint
           end
diff --git a/lib/gitlab/ci/status/canceled.rb b/lib/gitlab/ci/status/canceled.rb
index f173964b36c..a3376692570 100644
--- a/lib/gitlab/ci/status/canceled.rb
+++ b/lib/gitlab/ci/status/canceled.rb
@@ -5,7 +5,7 @@ module Gitlab
     module Status
       class Canceled < Status::Core
         def text
-          s_('CiStatusText|canceled')
+          s_('CiStatusText|Canceled')
         end
 
         def label
diff --git a/lib/gitlab/ci/status/core.rb b/lib/gitlab/ci/status/core.rb
index f60f5243666..c5306de830b 100644
--- a/lib/gitlab/ci/status/core.rb
+++ b/lib/gitlab/ci/status/core.rb
@@ -38,6 +38,10 @@ module Gitlab
           raise NotImplementedError
         end
 
+        def name
+          self.class.name.demodulize.underscore.upcase
+        end
+
         def group
           self.class.name.demodulize.underscore
         end
diff --git a/lib/gitlab/ci/status/created.rb b/lib/gitlab/ci/status/created.rb
index 33e67314d93..9ad4b2f079e 100644
--- a/lib/gitlab/ci/status/created.rb
+++ b/lib/gitlab/ci/status/created.rb
@@ -5,7 +5,7 @@ module Gitlab
     module Status
       class Created < Status::Core
         def text
-          s_('CiStatusText|created')
+          s_('CiStatusText|Created')
         end
 
         def label
diff --git a/lib/gitlab/ci/status/failed.rb b/lib/gitlab/ci/status/failed.rb
index 215d27734a7..cb498f72ffe 100644
--- a/lib/gitlab/ci/status/failed.rb
+++ b/lib/gitlab/ci/status/failed.rb
@@ -5,7 +5,7 @@ module Gitlab
     module Status
       class Failed < Status::Core
         def text
-          s_('CiStatusText|failed')
+          s_('CiStatusText|Failed')
         end
 
         def label
diff --git a/lib/gitlab/ci/status/manual.rb b/lib/gitlab/ci/status/manual.rb
index eb376df5f22..02e65dd1f4c 100644
--- a/lib/gitlab/ci/status/manual.rb
+++ b/lib/gitlab/ci/status/manual.rb
@@ -5,7 +5,7 @@ module Gitlab
     module Status
       class Manual < Status::Core
         def text
-          s_('CiStatusText|manual')
+          s_('CiStatusText|Manual')
         end
 
         def label
diff --git a/lib/gitlab/ci/status/pending.rb b/lib/gitlab/ci/status/pending.rb
index 4280ad84534..ddbdf94c089 100644
--- a/lib/gitlab/ci/status/pending.rb
+++ b/lib/gitlab/ci/status/pending.rb
@@ -5,7 +5,7 @@ module Gitlab
     module Status
       class Pending < Status::Core
         def text
-          s_('CiStatusText|pending')
+          s_('CiStatusText|Pending')
         end
 
         def label
diff --git a/lib/gitlab/ci/status/pipeline/blocked.rb b/lib/gitlab/ci/status/pipeline/blocked.rb
index ed13a439be0..2e01f4948a9 100644
--- a/lib/gitlab/ci/status/pipeline/blocked.rb
+++ b/lib/gitlab/ci/status/pipeline/blocked.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Pipeline
         class Blocked < Status::Extended
           def text
-            s_('CiStatusText|blocked')
+            s_('CiStatusText|Blocked')
           end
 
           def label
diff --git a/lib/gitlab/ci/status/pipeline/delayed.rb b/lib/gitlab/ci/status/pipeline/delayed.rb
index e61acdcd167..47048afbe1d 100644
--- a/lib/gitlab/ci/status/pipeline/delayed.rb
+++ b/lib/gitlab/ci/status/pipeline/delayed.rb
@@ -6,7 +6,7 @@ module Gitlab
       module Pipeline
         class Delayed < Status::Extended
           def text
-            s_('CiStatusText|delayed')
+            s_('CiStatusText|Delayed')
           end
 
           def label
diff --git a/lib/gitlab/ci/status/preparing.rb b/lib/gitlab/ci/status/preparing.rb
index e59d1d2eed1..e29b5416e8d 100644
--- a/lib/gitlab/ci/status/preparing.rb
+++ b/lib/gitlab/ci/status/preparing.rb
@@ -5,7 +5,7 @@ module Gitlab
     module Status
       class Preparing < Status::Core
         def text
-          s_('CiStatusText|preparing')
+          s_('CiStatusText|Preparing')
         end
 
         def label
diff --git a/lib/gitlab/ci/status/running.rb b/lib/gitlab/ci/status/running.rb
index eed1983e60e..dc36e62e2a3 100644
--- a/lib/gitlab/ci/status/running.rb
+++ b/lib/gitlab/ci/status/running.rb
@@ -5,11 +5,11 @@ module Gitlab
     module Status
       class Running < Status::Core
         def text
-          s_('CiStatus|running')
+          s_('CiStatusText|Running')
         end
 
         def label
-          s_('CiStatus|running')
+          s_('CiStatusLabel|running')
         end
 
         def icon
diff --git a/lib/gitlab/ci/status/scheduled.rb b/lib/gitlab/ci/status/scheduled.rb
index 8526becfef9..a3797c5c8d7 100644
--- a/lib/gitlab/ci/status/scheduled.rb
+++ b/lib/gitlab/ci/status/scheduled.rb
@@ -5,7 +5,7 @@ module Gitlab
     module Status
       class Scheduled < Status::Core
         def text
-          s_('CiStatusText|scheduled')
+          s_('CiStatusText|Scheduled')
         end
 
         def label
diff --git a/lib/gitlab/ci/status/skipped.rb b/lib/gitlab/ci/status/skipped.rb
index 238aa3ab4f9..4263536552b 100644
--- a/lib/gitlab/ci/status/skipped.rb
+++ b/lib/gitlab/ci/status/skipped.rb
@@ -5,7 +5,7 @@ module Gitlab
     module Status
       class Skipped < Status::Core
         def text
-          s_('CiStatusText|skipped')
+          s_('CiStatusText|Skipped')
         end
 
         def label
diff --git a/lib/gitlab/ci/status/success.rb b/lib/gitlab/ci/status/success.rb
index 2a10e60414e..9389138e034 100644
--- a/lib/gitlab/ci/status/success.rb
+++ b/lib/gitlab/ci/status/success.rb
@@ -5,7 +5,7 @@ module Gitlab
     module Status
       class Success < Status::Core
         def text
-          s_('CiStatusText|passed')
+          s_('CiStatusText|Passed')
         end
 
         def label
diff --git a/lib/gitlab/ci/status/success_warning.rb b/lib/gitlab/ci/status/success_warning.rb
index 84a0e52f518..91f0ba1a58f 100644
--- a/lib/gitlab/ci/status/success_warning.rb
+++ b/lib/gitlab/ci/status/success_warning.rb
@@ -9,7 +9,7 @@ module Gitlab
       #
       class SuccessWarning < Status::Extended
         def text
-          s_('CiStatusText|warning')
+          s_('CiStatusText|Warning')
         end
 
         def label
@@ -20,6 +20,10 @@ module Gitlab
           'status_warning'
         end
 
+        def name
+          'SUCCESS_WITH_WARNINGS'
+        end
+
         def group
           'success-with-warnings'
         end
diff --git a/lib/gitlab/ci/status/waiting_for_resource.rb b/lib/gitlab/ci/status/waiting_for_resource.rb
index 9ced0aadb88..5714a68cac8 100644
--- a/lib/gitlab/ci/status/waiting_for_resource.rb
+++ b/lib/gitlab/ci/status/waiting_for_resource.rb
@@ -5,7 +5,7 @@ module Gitlab
     module Status
       class WaitingForResource < Status::Core
         def text
-          s_('CiStatusText|waiting')
+          s_('CiStatusText|Waiting')
         end
 
         def label
@@ -20,6 +20,10 @@ module Gitlab
           'favicon_status_pending'
         end
 
+        def name
+          'WAITING_FOR_RESOURCE'
+        end
+
         def group
           'waiting-for-resource'
         end
diff --git a/lib/gitlab/ci/templates/Code-Quality.gitlab-ci.yml b/lib/gitlab/ci/templates/Code-Quality.gitlab-ci.yml
index b4ccf96b859..3132535ef6b 100644
--- a/lib/gitlab/ci/templates/Code-Quality.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Code-Quality.gitlab-ci.yml
@@ -1,2 +1,2 @@
 include:
-  template: Jobs/Code-Quality.gitlab-ci.yml
+  - template: Jobs/Code-Quality.gitlab-ci.yml
diff --git a/lib/gitlab/ci/templates/Cosign.gitlab-ci.yml b/lib/gitlab/ci/templates/Cosign.gitlab-ci.yml
index 48c9422b469..356062c734e 100644
--- a/lib/gitlab/ci/templates/Cosign.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Cosign.gitlab-ci.yml
@@ -8,7 +8,7 @@
 # See https://docs.gitlab.com/ee/ci/yaml/signing_examples.html for more details.
 
 include:
-  template: Docker.gitlab-ci.yml
+  - template: Docker.gitlab-ci.yml
 
 docker-build:
   variables:
diff --git a/lib/gitlab/ci/templates/Docker.gitlab-ci.yml b/lib/gitlab/ci/templates/Docker.gitlab-ci.yml
index 1aa346aec67..416f424dfa5 100644
--- a/lib/gitlab/ci/templates/Docker.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Docker.gitlab-ci.yml
@@ -11,7 +11,7 @@
 
 docker-build:
   # Use the official docker image.
-  image: docker:latest
+  image: docker:cli
   stage: build
   services:
     - docker:dind
diff --git a/lib/gitlab/ci/templates/Jobs/Build.gitlab-ci.yml b/lib/gitlab/ci/templates/Jobs/Build.gitlab-ci.yml
index 07bc3fbe795..2d04c97b32e 100644
--- a/lib/gitlab/ci/templates/Jobs/Build.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Jobs/Build.gitlab-ci.yml
@@ -1,5 +1,5 @@
 variables:
-  AUTO_BUILD_IMAGE_VERSION: 'v1.41.0'
+  AUTO_BUILD_IMAGE_VERSION: 'v1.44.0'
 
 build:
   stage: build
diff --git a/lib/gitlab/ci/templates/Jobs/Build.latest.gitlab-ci.yml b/lib/gitlab/ci/templates/Jobs/Build.latest.gitlab-ci.yml
index 07bc3fbe795..2d04c97b32e 100644
--- a/lib/gitlab/ci/templates/Jobs/Build.latest.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Jobs/Build.latest.gitlab-ci.yml
@@ -1,5 +1,5 @@
 variables:
-  AUTO_BUILD_IMAGE_VERSION: 'v1.41.0'
+  AUTO_BUILD_IMAGE_VERSION: 'v1.44.0'
 
 build:
   stage: build
diff --git a/lib/gitlab/ci/templates/Jobs/Code-Quality.gitlab-ci.yml b/lib/gitlab/ci/templates/Jobs/Code-Quality.gitlab-ci.yml
index f9440bfe904..45547b87eb6 100644
--- a/lib/gitlab/ci/templates/Jobs/Code-Quality.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Jobs/Code-Quality.gitlab-ci.yml
@@ -7,7 +7,9 @@ code_quality:
       command: ['--tls=false', '--host=tcp://0.0.0.0:2375']
   variables:
     DOCKER_DRIVER: overlay2
+    DOCKER_CERT_PATH: ""
     DOCKER_TLS_CERTDIR: ""
+    DOCKER_TLS_VERIFY: ""
     CODE_QUALITY_IMAGE_TAG: "0.96.0"
     CODE_QUALITY_IMAGE: "$CI_TEMPLATE_REGISTRY_HOST/gitlab-org/ci-cd/codequality:$CODE_QUALITY_IMAGE_TAG"
     DOCKER_SOCKET_PATH: /var/run/docker.sock
diff --git a/lib/gitlab/ci/templates/Jobs/DAST-Default-Branch-Deploy.gitlab-ci.yml b/lib/gitlab/ci/templates/Jobs/DAST-Default-Branch-Deploy.gitlab-ci.yml
index e9ba938142d..4d53b92763a 100644
--- a/lib/gitlab/ci/templates/Jobs/DAST-Default-Branch-Deploy.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Jobs/DAST-Default-Branch-Deploy.gitlab-ci.yml
@@ -1,5 +1,5 @@
 variables:
-  DAST_AUTO_DEPLOY_IMAGE_VERSION: 'v2.56.0'
+  DAST_AUTO_DEPLOY_IMAGE_VERSION: 'v2.59.1'
 
 .dast-auto-deploy:
   image: "${CI_TEMPLATE_REGISTRY_HOST}/gitlab-org/cluster-integration/auto-deploy-image:${DAST_AUTO_DEPLOY_IMAGE_VERSION}"
diff --git a/lib/gitlab/ci/templates/Jobs/Deploy.gitlab-ci.yml b/lib/gitlab/ci/templates/Jobs/Deploy.gitlab-ci.yml
index eaaf171e4b5..390824e8e49 100644
--- a/lib/gitlab/ci/templates/Jobs/Deploy.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Jobs/Deploy.gitlab-ci.yml
@@ -1,5 +1,5 @@
 variables:
-  AUTO_DEPLOY_IMAGE_VERSION: 'v2.56.0'
+  AUTO_DEPLOY_IMAGE_VERSION: 'v2.59.1'
 
 .auto-deploy:
   image: "${CI_TEMPLATE_REGISTRY_HOST}/gitlab-org/cluster-integration/auto-deploy-image:${AUTO_DEPLOY_IMAGE_VERSION}"
diff --git a/lib/gitlab/ci/templates/Jobs/Deploy.latest.gitlab-ci.yml b/lib/gitlab/ci/templates/Jobs/Deploy.latest.gitlab-ci.yml
index d2e448fb6a1..a9681c0f927 100644
--- a/lib/gitlab/ci/templates/Jobs/Deploy.latest.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Jobs/Deploy.latest.gitlab-ci.yml
@@ -1,5 +1,5 @@
 variables:
-  AUTO_DEPLOY_IMAGE_VERSION: 'v2.56.0'
+  AUTO_DEPLOY_IMAGE_VERSION: 'v2.59.1'
 
 .auto-deploy:
   image: "${CI_TEMPLATE_REGISTRY_HOST}/gitlab-org/cluster-integration/auto-deploy-image:${AUTO_DEPLOY_IMAGE_VERSION}"
diff --git a/lib/gitlab/ci/templates/Python.gitlab-ci.yml b/lib/gitlab/ci/templates/Python.gitlab-ci.yml
index d53f3ddcad4..c19a08bd11d 100644
--- a/lib/gitlab/ci/templates/Python.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Python.gitlab-ci.yml
@@ -12,15 +12,10 @@ image: python:latest
 variables:
   PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
 
-# Pip's cache doesn't store the python packages
 # https://pip.pypa.io/en/stable/topics/caching/
-#
-# If you want to also cache the installed packages, you have to install
-# them in a virtualenv and cache it as well.
 cache:
   paths:
     - .cache/pip
-    - venv/
 
 before_script:
   - python --version ; pip --version  # For debugging
diff --git a/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml
index 879d6a7a468..d6384f59bc1 100644
--- a/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml
@@ -2,4 +2,4 @@
 # Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/381665
 
 include:
-  template: Jobs/Container-Scanning.gitlab-ci.yml
+  - template: Jobs/Container-Scanning.gitlab-ci.yml
diff --git a/lib/gitlab/ci/templates/Security/Container-Scanning.latest.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/Container-Scanning.latest.gitlab-ci.yml
index 7a4f451314e..f4fd9e97665 100644
--- a/lib/gitlab/ci/templates/Security/Container-Scanning.latest.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/Container-Scanning.latest.gitlab-ci.yml
@@ -2,4 +2,4 @@
 # Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/381665
 
 include:
-  template: Jobs/Container-Scanning.latest.gitlab-ci.yml
+  - template: Jobs/Container-Scanning.latest.gitlab-ci.yml
diff --git a/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml
index 1785d4216e7..2055b5e181f 100644
--- a/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml
@@ -2,4 +2,4 @@
 # Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/292977
 
 include:
-  template: Jobs/Dependency-Scanning.gitlab-ci.yml
+  - template: Jobs/Dependency-Scanning.gitlab-ci.yml
diff --git a/lib/gitlab/ci/templates/Security/License-Scanning.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/License-Scanning.gitlab-ci.yml
index a99fe4a6dcf..0fe544b2c84 100644
--- a/lib/gitlab/ci/templates/Security/License-Scanning.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/License-Scanning.gitlab-ci.yml
@@ -2,4 +2,4 @@
 # Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/292977
 
 include:
-  template: Jobs/License-Scanning.gitlab-ci.yml
+  - template: Jobs/License-Scanning.gitlab-ci.yml
diff --git a/lib/gitlab/ci/templates/Security/SAST-IaC.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/SAST-IaC.gitlab-ci.yml
index 2207d4ec17a..4cc51c01b63 100644
--- a/lib/gitlab/ci/templates/Security/SAST-IaC.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/SAST-IaC.gitlab-ci.yml
@@ -1,2 +1,2 @@
 include:
-  template: Jobs/SAST-IaC.gitlab-ci.yml
+  - template: Jobs/SAST-IaC.gitlab-ci.yml
diff --git a/lib/gitlab/ci/templates/Security/SAST-IaC.latest.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/SAST-IaC.latest.gitlab-ci.yml
index 8c0d72ff282..a411fc03122 100644
--- a/lib/gitlab/ci/templates/Security/SAST-IaC.latest.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/SAST-IaC.latest.gitlab-ci.yml
@@ -1,2 +1,2 @@
 include:
-  template: Jobs/SAST-IaC.latest.gitlab-ci.yml
+  - template: Jobs/SAST-IaC.latest.gitlab-ci.yml
diff --git a/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
index 77ce813dd4f..6c25d628d55 100644
--- a/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
@@ -2,4 +2,4 @@
 # Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/292977
 
 include:
-  template: Jobs/SAST.gitlab-ci.yml
+  - template: Jobs/SAST.gitlab-ci.yml
diff --git a/lib/gitlab/ci/templates/Security/Secret-Detection.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/Secret-Detection.gitlab-ci.yml
index d4ea7165d0a..353d523daf3 100644
--- a/lib/gitlab/ci/templates/Security/Secret-Detection.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/Secret-Detection.gitlab-ci.yml
@@ -2,4 +2,4 @@
 # Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/292977
 
 include:
-  template: Jobs/Secret-Detection.gitlab-ci.yml
+  - template: Jobs/Secret-Detection.gitlab-ci.yml
diff --git a/lib/gitlab/ci/trace/section_parser.rb b/lib/gitlab/ci/trace/section_parser.rb
index f33f8cc56c1..a6c1bf28f24 100644
--- a/lib/gitlab/ci/trace/section_parser.rb
+++ b/lib/gitlab/ci/trace/section_parser.rb
@@ -74,7 +74,7 @@ module Gitlab
         end
 
         def beginning_of_section_regex
-          @beginning_of_section_regex ||= /section_/.freeze
+          @beginning_of_section_regex ||= /section_/
         end
 
         def find_next_marker(scanner)
diff --git a/lib/gitlab/ci/variables/collection/item.rb b/lib/gitlab/ci/variables/collection/item.rb
index 73452d83bce..2334db0718f 100644
--- a/lib/gitlab/ci/variables/collection/item.rb
+++ b/lib/gitlab/ci/variables/collection/item.rb
@@ -7,7 +7,7 @@ module Gitlab
         class Item
           include Gitlab::Utils::StrongMemoize
 
-          VARIABLES_REGEXP = /\$\$|%%|\$(?<key>[a-zA-Z_][a-zA-Z0-9_]*)|\${\g<key>?}|%\g<key>%/.freeze.freeze
+          VARIABLES_REGEXP = /\$\$|%%|\$(?<key>[a-zA-Z_][a-zA-Z0-9_]*)|\${\g<key>?}|%\g<key>%/
           VARIABLE_REF_CHARS = %w[$ %].freeze
 
           def initialize(key:, value:, public: true, file: false, masked: false, raw: false)
@@ -34,6 +34,10 @@ module Gitlab
             @variable.fetch(:file)
           end
 
+          def masked?
+            @variable.fetch(:masked)
+          end
+
           def [](key)
             @variable.fetch(key)
           end
diff --git a/lib/gitlab/ci/yaml_processor.rb b/lib/gitlab/ci/yaml_processor.rb
index 289f41b4ec7..cf5755242e2 100644
--- a/lib/gitlab/ci/yaml_processor.rb
+++ b/lib/gitlab/ci/yaml_processor.rb
@@ -209,7 +209,8 @@ module Gitlab
         return unless project && sha && project.repository_exists? && project.commit(sha)
 
         unless project_ref_contains_sha?
-          error!('Could not validate configuration. Config originates from external project')
+          error!('Could not validate configuration. The configuration originates from an external ' \
+                 'project or a commit not associated with a Git reference (a detached commit)')
         end
       end