Add latest changes from gitlab-org/gitlab@master

17 files changed, 227 insertions, 93 deletions

diff --git a/spec/controllers/groups/runners_controller_spec.rb b/spec/controllers/groups/runners_controller_spec.rb
index e427b7c9572..a4e55a89f41 100644
--- a/spec/controllers/groups/runners_controller_spec.rb
+++ b/spec/controllers/groups/runners_controller_spec.rb
@@ -3,8 +3,9 @@
 require 'spec_helper'
 
 RSpec.describe Groups::RunnersController, feature_category: :runner_fleet do
-  let_it_be(:user)   { create(:user) }
-  let_it_be(:group)  { create(:group) }
+  let_it_be(:user) { create(:user) }
+  let_it_be(:namespace_settings) { create(:namespace_settings, runner_registration_enabled: true) }
+  let_it_be(:group) { create(:group, namespace_settings: namespace_settings) }
   let_it_be(:project) { create(:project, group: group) }
   let_it_be(:runner) { create(:ci_runner, :group, groups: [group]) }
 
@@ -226,6 +227,12 @@ RSpec.describe Groups::RunnersController, feature_category: :runner_fleet do
         expect(response).to render_template(:edit)
       end
 
+      it 'renders 404 for non-existing runner' do
+        get :edit, params: { group_id: group, id: non_existing_record_id }
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
       it 'renders 404 for instance runner' do
         get :edit, params: { group_id: group, id: instance_runner }
 
diff --git a/spec/finders/ci/runners_finder_spec.rb b/spec/finders/ci/runners_finder_spec.rb
index be1c96594fb..5d249ddb391 100644
--- a/spec/finders/ci/runners_finder_spec.rb
+++ b/spec/finders/ci/runners_finder_spec.rb
@@ -222,12 +222,14 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
       end
 
       shared_examples 'executes as normal user' do
-        it 'returns no runners' do
+        it 'raises Gitlab::Access::AccessDeniedError' do
           user = create :user
           create :ci_runner, active: true
           create :ci_runner, active: false
 
-          expect(described_class.new(current_user: user, params: {}).execute).to be_empty
+          expect do
+            described_class.new(current_user: user, params: {}).execute
+          end.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
 
@@ -250,12 +252,14 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
       end
 
       context 'when user is nil' do
-        it 'returns no runners' do
+        it 'raises Gitlab::Access::AccessDeniedError' do
           user = nil
           create :ci_runner, active: true
           create :ci_runner, active: false
 
-          expect(described_class.new(current_user: user, params: {}).execute).to be_empty
+          expect do
+            described_class.new(current_user: user, params: {}).execute
+          end.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
     end
@@ -306,10 +310,11 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
 
       shared_examples 'membership equal to :descendants' do
         it 'returns all descendant runners' do
-          expect(subject).to eq([runner_project_7, runner_project_6, runner_project_5,
-                                 runner_project_4, runner_project_3, runner_project_2,
-                                 runner_project_1, runner_sub_group_4, runner_sub_group_3,
-                                 runner_sub_group_2, runner_sub_group_1, runner_group])
+          is_expected.to contain_exactly(
+            runner_project_7, runner_project_6, runner_project_5,
+            runner_project_4, runner_project_3, runner_project_2,
+            runner_project_1, runner_sub_group_4, runner_sub_group_3,
+            runner_sub_group_2, runner_sub_group_1, runner_group)
         end
       end
 
@@ -340,7 +345,7 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
               let(:membership) { :direct }
 
               it 'returns runners belonging to group' do
-                expect(subject).to eq([runner_group])
+                is_expected.to contain_exactly(runner_group)
               end
             end
 
@@ -348,10 +353,11 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
               let(:membership) { :all_available }
 
               it 'returns runners available to group' do
-                expect(subject).to match_array([runner_project_7, runner_project_6, runner_project_5,
-                                                runner_project_4, runner_project_3, runner_project_2,
-                                                runner_project_1, runner_sub_group_4, runner_sub_group_3,
-                                                runner_sub_group_2, runner_sub_group_1, runner_group, runner_instance])
+                is_expected.to contain_exactly(
+                  runner_project_7, runner_project_6, runner_project_5,
+                  runner_project_4, runner_project_3, runner_project_2,
+                  runner_project_1, runner_sub_group_4, runner_sub_group_3,
+                  runner_sub_group_2, runner_sub_group_1, runner_group, runner_instance)
               end
             end
 
@@ -366,9 +372,9 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
             context 'with nil group' do
               let(:target_group) { nil }
 
-              it 'returns no runners' do
-                # Query should run against all runners, however since user is not admin, query returns no results
-                expect(subject).to eq([])
+              it 'raises Gitlab::Access::AccessDeniedError' do
+                # Query should run against all runners, however since user is not admin, we raise an error
+                expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
               end
             end
 
@@ -443,23 +449,23 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
           context 'with :sub_group_1 as target group' do
             let(:target_group) { sub_group_1 }
 
-            it 'returns no runners' do
-              is_expected.to be_empty
+            it 'raises Gitlab::Access::AccessDeniedError' do
+              expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
             end
           end
 
           context 'with :group as target group' do
             let(:target_group) { group }
 
-            it 'returns no runners' do
-              is_expected.to be_empty
+            it 'raises Gitlab::Access::AccessDeniedError' do
+              expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
             end
 
             context 'with :all_available membership' do
               let(:membership) { :all_available }
 
-              it 'returns no runners' do
-                expect(subject).to be_empty
+              it 'raises Gitlab::Access::AccessDeniedError' do
+                expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
               end
             end
           end
@@ -467,35 +473,31 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
       end
 
       context 'when user has no access' do
-        it 'returns no runners' do
-          expect(subject).to be_empty
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
 
       context 'when user is nil' do
-        let_it_be(:user) { nil }
+        let(:user) { nil }
 
-        it 'returns no runners' do
-          expect(subject).to be_empty
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
     end
 
     describe '#sort_key' do
-      subject { described_class.new(current_user: user, params: params.merge(group: group)).sort_key }
+      subject(:sort_key) { described_class.new(current_user: user, params: params.merge(group: group)).sort_key }
 
       context 'without params' do
-        it 'returns created_at_desc' do
-          expect(subject).to eq('created_at_desc')
-        end
+        it { is_expected.to eq('created_at_desc') }
       end
 
       context 'with params' do
         let(:extra_params) { { sort: 'contacted_asc' } }
 
-        it 'returns contacted_asc' do
-          expect(subject).to eq('contacted_asc')
-        end
+        it { is_expected.to eq('contacted_asc') }
       end
     end
   end
@@ -510,7 +512,7 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
     let(:params) { { project: project }.merge(extra_params).reject { |_, v| v.nil? } }
 
     describe '#execute' do
-      subject { described_class.new(current_user: user, params: params).execute }
+      subject(:execute) { described_class.new(current_user: user, params: params).execute }
 
       context 'with user as project admin' do
         before do
@@ -521,7 +523,7 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
           let_it_be(:runner_project) { create(:ci_runner, :project, contacted_at: 7.minutes.ago, projects: [project]) }
 
           it 'returns runners available to project' do
-            expect(subject).to match_array([runner_project])
+            is_expected.to match_array([runner_project])
           end
         end
 
@@ -530,7 +532,7 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
           let_it_be(:runner_group) { create(:ci_runner, :group, contacted_at: 12.minutes.ago, groups: [group]) }
 
           it 'returns runners available to project' do
-            expect(subject).to match_array([runner_instance, runner_group])
+            is_expected.to match_array([runner_instance, runner_group])
           end
         end
 
@@ -616,24 +618,24 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
           project.add_developer(user)
         end
 
-        it 'returns no runners' do
-          expect(subject).to be_empty
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
 
       context 'when user is nil' do
         let_it_be(:user) { nil }
 
-        it 'returns no runners' do
-          expect(subject).to be_empty
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
 
       context 'with nil project_full_path' do
         let(:project_full_path) { nil }
 
-        it 'returns no runners' do
-          expect(subject).to be_empty
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
     end
diff --git a/spec/frontend/ci/pipeline_editor/components/header/pipeline_editor_header_spec.js b/spec/frontend/ci/pipeline_editor/components/header/pipeline_editor_header_spec.js
index a651664851e..655bfe538c6 100644
--- a/spec/frontend/ci/pipeline_editor/components/header/pipeline_editor_header_spec.js
+++ b/spec/frontend/ci/pipeline_editor/components/header/pipeline_editor_header_spec.js
@@ -1,4 +1,5 @@
 import { shallowMount } from '@vue/test-utils';
+import { GlCard } from '@gitlab/ui';
 import PipelineEditorHeader from '~/ci/pipeline_editor/components/header/pipeline_editor_header.vue';
 import PipelineStatus from '~/ci/pipeline_editor/components/header/pipeline_status.vue';
 import ValidationSegment from '~/ci/pipeline_editor/components/header/validation_segment.vue';
@@ -20,6 +21,9 @@ describe('Pipeline editor header', () => {
         isNewCiConfigFile: false,
         ...props,
       },
+      stubs: {
+        GlCard,
+      },
     });
   };
 
diff --git a/spec/frontend/merge_request_tabs_spec.js b/spec/frontend/merge_request_tabs_spec.js
index 3b8c9dd3bf3..6c4ea7063ad 100644
--- a/spec/frontend/merge_request_tabs_spec.js
+++ b/spec/frontend/merge_request_tabs_spec.js
@@ -281,6 +281,14 @@ describe('MergeRequestTabs', () => {
       testContext.class.expandViewContainer();
       expect($('.content-wrapper .container-limited')).toHaveLength(0);
     });
+
+    it('adds the diff-specific width-limiter', () => {
+      testContext.class.expandViewContainer();
+
+      expect(testContext.class.contentWrapper.classList.contains('diffs-container-limited')).toBe(
+        true,
+      );
+    });
   });
 
   describe('resetViewContainer', () => {
@@ -302,6 +310,14 @@ describe('MergeRequestTabs', () => {
 
       expect($('.content-wrapper .container-limited')).toHaveLength(1);
     });
+
+    it('removes the diff-specific width-limiter', () => {
+      testContext.class.resetViewContainer();
+
+      expect(testContext.class.contentWrapper.classList.contains('diffs-container-limited')).toBe(
+        false,
+      );
+    });
   });
 
   describe('tabShown', () => {
diff --git a/spec/graphql/resolvers/ci/group_runners_resolver_spec.rb b/spec/graphql/resolvers/ci/group_runners_resolver_spec.rb
index ff343f3f43d..fedae5c86a8 100644
--- a/spec/graphql/resolvers/ci/group_runners_resolver_spec.rb
+++ b/spec/graphql/resolvers/ci/group_runners_resolver_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe Resolvers::Ci::GroupRunnersResolver, feature_category: :runner_fl
   include GraphqlHelpers
 
   describe '#resolve' do
-    subject do
+    subject(:resolve_scope) do
       resolve(described_class, obj: obj, ctx: { current_user: user }, args: args,
                                arg_style: :internal)
     end
@@ -18,8 +18,10 @@ RSpec.describe Resolvers::Ci::GroupRunnersResolver, feature_category: :runner_fl
 
     # First, we can do a couple of basic real tests to verify common cases. That ensures that the code works.
     context 'when user cannot see runners' do
-      it 'returns no runners' do
-        expect(subject.items.to_a).to eq([])
+      it 'returns Gitlab::Graphql::Errors::ResourceNotAvailable' do
+        expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ResourceNotAvailable) do
+          resolve_scope
+        end
       end
     end
 
@@ -29,14 +31,16 @@ RSpec.describe Resolvers::Ci::GroupRunnersResolver, feature_category: :runner_fl
       end
 
       it 'returns all the runners' do
-        expect(subject.items.to_a).to contain_exactly(inactive_project_runner, offline_project_runner, group_runner, subgroup_runner)
+        expect(resolve_scope.items.to_a).to contain_exactly(
+          inactive_project_runner, offline_project_runner, group_runner, subgroup_runner
+        )
       end
 
       context 'with membership direct' do
         let(:args) { { membership: :direct } }
 
         it 'returns only direct runners' do
-          expect(subject.items.to_a).to contain_exactly(group_runner)
+          expect(resolve_scope.items.to_a).to contain_exactly(group_runner)
         end
       end
     end
@@ -46,7 +50,7 @@ RSpec.describe Resolvers::Ci::GroupRunnersResolver, feature_category: :runner_fl
       let(:obj) { nil }
 
       it 'raises an error' do
-        expect { subject }.to raise_error('Expected group missing')
+        expect { resolve_scope }.to raise_error('Expected group missing')
       end
     end
 
@@ -54,7 +58,7 @@ RSpec.describe Resolvers::Ci::GroupRunnersResolver, feature_category: :runner_fl
       let(:obj) { build(:project) }
 
       it 'raises an error' do
-        expect { subject }.to raise_error('Expected group missing')
+        expect { resolve_scope }.to raise_error('Expected group missing')
       end
     end
 
@@ -90,7 +94,7 @@ RSpec.describe Resolvers::Ci::GroupRunnersResolver, feature_category: :runner_fl
         allow(::Ci::RunnersFinder).to receive(:new).with(current_user: user, params: expected_params).once.and_return(finder)
         allow(finder).to receive(:execute).once.and_return([:execute_return_value])
 
-        expect(subject.items.to_a).to eq([:execute_return_value])
+        expect(resolve_scope.items.to_a).to eq([:execute_return_value])
       end
     end
   end
diff --git a/spec/graphql/resolvers/ci/project_runners_resolver_spec.rb b/spec/graphql/resolvers/ci/project_runners_resolver_spec.rb
index 83435db2ea7..55a98106baf 100644
--- a/spec/graphql/resolvers/ci/project_runners_resolver_spec.rb
+++ b/spec/graphql/resolvers/ci/project_runners_resolver_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe Resolvers::Ci::ProjectRunnersResolver, feature_category: :runner_
   include GraphqlHelpers
 
   describe '#resolve' do
-    subject do
+    subject(:resolve_scope) do
       resolve(described_class, obj: obj, ctx: { current_user: user }, args: args,
                                arg_style: :internal)
     end
@@ -17,8 +17,10 @@ RSpec.describe Resolvers::Ci::ProjectRunnersResolver, feature_category: :runner_
     let(:args) { {} }
 
     context 'when user cannot see runners' do
-      it 'returns no runners' do
-        expect(subject.items.to_a).to eq([])
+      it 'returns Gitlab::Graphql::Errors::ResourceNotAvailable' do
+        expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ResourceNotAvailable) do
+          resolve_scope
+        end
       end
     end
 
@@ -30,7 +32,7 @@ RSpec.describe Resolvers::Ci::ProjectRunnersResolver, feature_category: :runner_
       let(:available_runners) { [inactive_project_runner, offline_project_runner, group_runner, instance_runner] }
 
       it 'returns all runners available to the project' do
-        expect(subject.items.to_a).to match_array(available_runners)
+        expect(resolve_scope.items.to_a).to match_array(available_runners)
       end
     end
 
@@ -38,7 +40,7 @@ RSpec.describe Resolvers::Ci::ProjectRunnersResolver, feature_category: :runner_
       let(:obj) { nil }
 
       it 'raises an error' do
-        expect { subject }.to raise_error('Expected project missing')
+        expect { resolve_scope }.to raise_error('Expected project missing')
       end
     end
 
@@ -46,7 +48,7 @@ RSpec.describe Resolvers::Ci::ProjectRunnersResolver, feature_category: :runner_
       let(:obj) { build(:group) }
 
       it 'raises an error' do
-        expect { subject }.to raise_error('Expected project missing')
+        expect { resolve_scope }.to raise_error('Expected project missing')
       end
     end
 
@@ -79,7 +81,7 @@ RSpec.describe Resolvers::Ci::ProjectRunnersResolver, feature_category: :runner_
                                                          params: expected_params).once.and_return(finder)
         allow(finder).to receive(:execute).once.and_return([:execute_return_value])
 
-        expect(subject.items.to_a).to eq([:execute_return_value])
+        expect(resolve_scope.items.to_a).to contain_exactly(:execute_return_value)
       end
     end
   end
diff --git a/spec/graphql/resolvers/ci/runners_resolver_spec.rb b/spec/graphql/resolvers/ci/runners_resolver_spec.rb
index 02fc7d28255..35831579799 100644
--- a/spec/graphql/resolvers/ci/runners_resolver_spec.rb
+++ b/spec/graphql/resolvers/ci/runners_resolver_spec.rb
@@ -20,8 +20,10 @@ RSpec.describe Resolvers::Ci::RunnersResolver, feature_category: :runner_fleet d
     context 'when user cannot see runners' do
       let(:user) { build(:user) }
 
-      it 'returns no runners' do
-        expect(subject.items.to_a).to eq([])
+      it 'returns Gitlab::Graphql::Errors::ResourceNotAvailable' do
+        expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ResourceNotAvailable) do
+          resolve_scope
+        end
       end
     end
 
@@ -30,20 +32,26 @@ RSpec.describe Resolvers::Ci::RunnersResolver, feature_category: :runner_fleet d
 
       context 'when admin mode setting is disabled', :do_not_mock_admin_mode_setting do
         it 'returns all the runners' do
-          expect(subject.items.to_a).to contain_exactly(inactive_project_runner, offline_project_runner, group_runner, subgroup_runner, instance_runner)
+          expect(resolve_scope.items.to_a).to contain_exactly(
+            inactive_project_runner, offline_project_runner, group_runner, subgroup_runner, instance_runner
+          )
         end
       end
 
       context 'when admin mode setting is enabled' do
         context 'when in admin mode', :enable_admin_mode do
           it 'returns all the runners' do
-            expect(subject.items.to_a).to contain_exactly(inactive_project_runner, offline_project_runner, group_runner, subgroup_runner, instance_runner)
+            expect(resolve_scope.items.to_a).to contain_exactly(
+              inactive_project_runner, offline_project_runner, group_runner, subgroup_runner, instance_runner
+            )
           end
         end
 
         context 'when not in admin mode' do
-          it 'returns no runners' do
-            expect(subject.items.to_a).to eq([])
+          it 'returns Gitlab::Graphql::Errors::ResourceNotAvailable' do
+            expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ResourceNotAvailable) do
+              resolve_scope
+            end
           end
         end
       end
@@ -54,7 +62,7 @@ RSpec.describe Resolvers::Ci::RunnersResolver, feature_category: :runner_fleet d
       let(:obj) { build(:project) }
 
       it 'raises an error' do
-        expect { subject }.to raise_error(a_string_including('Unexpected parent type'))
+        expect { resolve_scope }.to raise_error(a_string_including('Unexpected parent type'))
       end
     end
 
@@ -93,7 +101,7 @@ RSpec.describe Resolvers::Ci::RunnersResolver, feature_category: :runner_fleet d
           expect(::Ci::RunnersFinder).to receive(:new).with(current_user: user, params: expected_params).once.and_return(finder)
           allow(finder).to receive(:execute).once.and_return([:execute_return_value])
 
-          expect(subject.items.to_a).to eq([:execute_return_value])
+          expect(resolve_scope.items.to_a).to contain_exactly :execute_return_value
         end
       end
 
@@ -116,7 +124,7 @@ RSpec.describe Resolvers::Ci::RunnersResolver, feature_category: :runner_fleet d
           expect(::Ci::RunnersFinder).to receive(:new).with(current_user: user, params: expected_params).once.and_return(finder)
           allow(finder).to receive(:execute).once.and_return([:execute_return_value])
 
-          expect(subject.items.to_a).to eq([:execute_return_value])
+          expect(resolve_scope.items.to_a).to contain_exactly :execute_return_value
         end
       end
 
@@ -136,7 +144,7 @@ RSpec.describe Resolvers::Ci::RunnersResolver, feature_category: :runner_fleet d
           expect(::Ci::RunnersFinder).to receive(:new).with(current_user: user, params: expected_params).once.and_return(finder)
           allow(finder).to receive(:execute).once.and_return([:execute_return_value])
 
-          expect(subject.items.to_a).to eq([:execute_return_value])
+          expect(resolve_scope.items.to_a).to contain_exactly :execute_return_value
         end
       end
 
@@ -153,7 +161,7 @@ RSpec.describe Resolvers::Ci::RunnersResolver, feature_category: :runner_fleet d
           expect(::Ci::RunnersFinder).to receive(:new).with(current_user: user, params: expected_params).once.and_return(finder)
           allow(finder).to receive(:execute).once.and_return([:execute_return_value])
 
-          expect(subject.items.to_a).to eq([:execute_return_value])
+          expect(resolve_scope.items.to_a).to contain_exactly :execute_return_value
         end
       end
     end
diff --git a/spec/lib/gitlab/github_import/attachments_downloader_spec.rb b/spec/lib/gitlab/github_import/attachments_downloader_spec.rb
index 086aa4be17e..27007e09ba4 100644
--- a/spec/lib/gitlab/github_import/attachments_downloader_spec.rb
+++ b/spec/lib/gitlab/github_import/attachments_downloader_spec.rb
@@ -93,6 +93,43 @@ RSpec.describe Gitlab::GithubImport::AttachmentsDownloader, feature_category: :i
         expect(File.basename(file)).to eq('av.png')
       end
     end
+
+    context 'when attachment is behind a redirect' do
+      let_it_be(:file_url) { "https://github.com/test/project/assets/142635249/4b9f9c90-f060-4845-97cf-b24c558bcb11" }
+      let(:redirect_url) { "https://https://github-production-user-asset-6210df.s3.amazonaws.com/142635249/740edb05293e.jpg" }
+      let(:sample_response) do
+        instance_double(HTTParty::Response, redirection?: true, headers: { location: redirect_url })
+      end
+
+      it 'gets redirection url' do
+        expect(Gitlab::HTTP).to receive(:perform_request)
+          .with(Net::HTTP::Get, file_url, { follow_redirects: false })
+          .and_return sample_response
+
+        expect(Gitlab::HTTP).to receive(:perform_request)
+          .with(Net::HTTP::Get, redirect_url, stream_body: true).and_yield(chunk_double)
+
+        file = downloader.perform
+
+        expect(File.exist?(file.path)).to eq(true)
+      end
+
+      context 'when url is not a redirection' do
+        let(:sample_response) do
+          instance_double(HTTParty::Response, code: 200, redirection?: false)
+        end
+
+        before do
+          allow(Gitlab::HTTP).to receive(:perform_request)
+            .with(Net::HTTP::Get, file_url, { follow_redirects: false })
+            .and_return sample_response
+        end
+
+        it 'raises upon unsuccessful redirection' do
+          expect { downloader.perform }.to raise_error("expected a redirect response, got #{sample_response.code}")
+        end
+      end
+    end
   end
 
   describe '#delete' do
diff --git a/spec/lib/gitlab/github_import/importer/note_attachments_importer_spec.rb b/spec/lib/gitlab/github_import/importer/note_attachments_importer_spec.rb
index 450ebe9a719..ffd68c92caf 100644
--- a/spec/lib/gitlab/github_import/importer/note_attachments_importer_spec.rb
+++ b/spec/lib/gitlab/github_import/importer/note_attachments_importer_spec.rb
@@ -53,6 +53,19 @@ RSpec.describe Gitlab::GithubImport::Importer::NoteAttachmentsImporter, feature_
       record.reload
       expect(record.description).to include("[link to other project blob file](#{other_project_blob_url})")
     end
+
+    context 'with new github image format' do
+      let(:image_url) { 'https://github.com/nickname/public-test-repo/assets/142635249/4b9f9c90-f060-4845-97cf-b24c558bcb11' }
+      let(:image_tag_url) { 'https://github.com/nickname/public-test-repo/assets/142635249/4b9f9c90-f060-4845-97cf-b24c558bcb11' }
+
+      it 'changes image attachment links' do
+        importer.execute
+
+        record.reload
+        expect(record.description).to include('![image.jpeg](/uploads/')
+        expect(record.description).to include('<img width="248" alt="tag-image" src="/uploads')
+      end
+    end
   end
 
   describe '#execute' do
@@ -60,16 +73,19 @@ RSpec.describe Gitlab::GithubImport::Importer::NoteAttachmentsImporter, feature_
     let(:tmp_stub_doc) { Tempfile.create('attachment_download_test.txt') }
     let(:tmp_stub_image) { Tempfile.create('image.jpeg') }
     let(:tmp_stub_image_tag) { Tempfile.create('image-tag.jpeg') }
+    let(:access_token) { 'exampleGitHubToken' }
+    let(:options) { { headers: { 'Authorization' => "Bearer #{access_token}" } } }
 
     before do
-      allow(Gitlab::GithubImport::AttachmentsDownloader).to receive(:new).with(doc_url)
+      allow(Gitlab::GithubImport::AttachmentsDownloader).to receive(:new).with(doc_url, options: options)
         .and_return(downloader_stub)
-      allow(Gitlab::GithubImport::AttachmentsDownloader).to receive(:new).with(image_url)
+      allow(Gitlab::GithubImport::AttachmentsDownloader).to receive(:new).with(image_url, options: options)
         .and_return(downloader_stub)
-      allow(Gitlab::GithubImport::AttachmentsDownloader).to receive(:new).with(image_tag_url)
+      allow(Gitlab::GithubImport::AttachmentsDownloader).to receive(:new).with(image_tag_url, options: options)
         .and_return(downloader_stub)
       allow(downloader_stub).to receive(:perform).and_return(tmp_stub_doc, tmp_stub_image, tmp_stub_image_tag)
       allow(downloader_stub).to receive(:delete).exactly(3).times
+      allow(client).to receive_message_chain(:octokit, :access_token).and_return(access_token)
     end
 
     context 'when importing release attachments' do
diff --git a/spec/lib/gitlab/github_import/markdown/attachment_spec.rb b/spec/lib/gitlab/github_import/markdown/attachment_spec.rb
index 84b0886ebcc..5b9d077aac9 100644
--- a/spec/lib/gitlab/github_import/markdown/attachment_spec.rb
+++ b/spec/lib/gitlab/github_import/markdown/attachment_spec.rb
@@ -5,6 +5,7 @@ require 'spec_helper'
 RSpec.describe Gitlab::GithubImport::Markdown::Attachment, feature_category: :importers do
   let(:name) { FFaker::Lorem.word }
   let(:url) { FFaker::Internet.uri('https') }
+  let(:import_source) { 'nickname/public-test-repo' }
 
   describe '.from_markdown' do
     context "when it's a doc attachment" do
@@ -75,6 +76,17 @@ RSpec.describe Gitlab::GithubImport::Markdown::Attachment, feature_category: :im
 
         it { expect(described_class.from_markdown(markdown_node)).to eq nil }
       end
+
+      context 'when image attachment is in the new format' do
+        let(:url) { "https://github.com/#{import_source}/assets/142635249/4b9f9c90-f060-4845-97cf-b24c558bcb11" }
+
+        it 'returns instance with attachment info' do
+          attachment = described_class.from_markdown(markdown_node)
+
+          expect(attachment.name).to eq name
+          expect(attachment.url).to eq url
+        end
+      end
     end
 
     context "when it's an inline html node" do
@@ -103,7 +115,6 @@ RSpec.describe Gitlab::GithubImport::Markdown::Attachment, feature_category: :im
 
   describe '#part_of_project_blob?' do
     let(:attachment) { described_class.new('test', url) }
-    let(:import_source) { 'nickname/public-test-repo' }
 
     context 'when url is a part of project blob' do
       let(:url) { "https://github.com/#{import_source}/blob/main/example.md" }
@@ -120,7 +131,6 @@ RSpec.describe Gitlab::GithubImport::Markdown::Attachment, feature_category: :im
 
   describe '#doc_belongs_to_project?' do
     let(:attachment) { described_class.new('test', url) }
-    let(:import_source) { 'nickname/public-test-repo' }
 
     context 'when url relates to this project' do
       let(:url) { "https://github.com/#{import_source}/files/9020437/git-cheat-sheet.txt" }
@@ -147,13 +157,19 @@ RSpec.describe Gitlab::GithubImport::Markdown::Attachment, feature_category: :im
     context 'when it is a media link' do
       let(:url) { 'https://user-images.githubusercontent.com/6833842/0cf366b61ef2.jpeg' }
 
-      it { expect(attachment.media?).to eq true }
+      it { expect(attachment.media?(import_source)).to eq true }
+
+      context 'when it is a new media link' do
+        let(:url) { "https://github.com/#{import_source}/assets/142635249/4b9f9c90-f060-4845-97cf-b24c558bcb11" }
+
+        it { expect(attachment.media?(import_source)).to eq true }
+      end
     end
 
     context 'when it is not a media link' do
       let(:url) { 'https://github.com/nickname/public-test-repo/files/9020437/git-cheat-sheet.txt' }
 
-      it { expect(attachment.media?).to eq false }
+      it { expect(attachment.media?(import_source)).to eq false }
     end
   end
 
diff --git a/spec/mailers/emails/service_desk_spec.rb b/spec/mailers/emails/service_desk_spec.rb
index 857d95631be..e3fe36237df 100644
--- a/spec/mailers/emails/service_desk_spec.rb
+++ b/spec/mailers/emails/service_desk_spec.rb
@@ -172,10 +172,14 @@ RSpec.describe Emails::ServiceDesk, feature_category: :service_desk do
       project.reset
 
       service_desk_setting.update!(custom_email_enabled: true) unless service_desk_setting.custom_email_enabled?
+
+      allow(Gitlab::AppLogger).to receive(:info)
     end
 
     it 'uses SMTP delivery method and custom email settings' do
       expect_service_desk_custom_email_delivery_options(service_desk_setting)
+
+      expect(Gitlab::AppLogger).to have_received(:info).with({ category: 'custom_email' })
     end
 
     it 'generates Reply-To address from custom email' do
diff --git a/spec/requests/api/graphql/ci/runner_web_url_edge_spec.rb b/spec/requests/api/graphql/ci/runner_web_url_edge_spec.rb
index e84a1ca4cc4..76e2dda4ce2 100644
--- a/spec/requests/api/graphql/ci/runner_web_url_edge_spec.rb
+++ b/spec/requests/api/graphql/ci/runner_web_url_edge_spec.rb
@@ -25,16 +25,22 @@ RSpec.describe 'RunnerWebUrlEdge', feature_category: :runner_fleet do
       GQL
     end
 
-    before do
+    subject(:request) do
       post_graphql(query, current_user: user, variables: { path: group.full_path })
     end
 
     context 'with an authorized user' do
       let(:user) { create_default(:user, :admin) }
 
-      it_behaves_like 'a working graphql query'
+      it_behaves_like 'a working graphql query' do
+        before do
+          request
+        end
+      end
 
       it 'returns correct URLs' do
+        request
+
         expect(edges_graphql_data).to match_array [
           {
             'editUrl' => Gitlab::Routing.url_helpers.edit_group_runner_url(group, group_runner),
@@ -47,10 +53,14 @@ RSpec.describe 'RunnerWebUrlEdge', feature_category: :runner_fleet do
     context 'with an unauthorized user' do
       let(:user) { create(:user) }
 
-      it_behaves_like 'a working graphql query'
+      it 'returns nil runners and an error' do
+        request
 
-      it 'returns no edges' do
-        expect(edges_graphql_data).to be_empty
+        expect(graphql_data.dig('group', 'runners')).to be_nil
+        expect(graphql_errors).to contain_exactly(a_hash_including(
+          'message' => a_string_including("you don't have permission to perform this action"),
+          'path' => %w[group runners]
+        ))
       end
     end
   end
diff --git a/spec/requests/api/graphql/group_query_spec.rb b/spec/requests/api/graphql/group_query_spec.rb
index 6debe2d3d67..1dcbc44c587 100644
--- a/spec/requests/api/graphql/group_query_spec.rb
+++ b/spec/requests/api/graphql/group_query_spec.rb
@@ -17,7 +17,7 @@ RSpec.describe 'getting group information', :with_license, feature_category: :gr
   # similar to the API "GET /groups/:id"
   describe "Query group(fullPath)" do
     def group_query(group)
-      fields = all_graphql_fields_for('Group')
+      fields = all_graphql_fields_for('Group', excluded: %w[runners])
       # TODO: Set required timelogs args elsewhere https://gitlab.com/gitlab-org/gitlab/-/issues/325499
       fields.selection['timelogs(startDate: "2021-03-01" endDate: "2021-03-30")'] = fields.selection.delete('timelogs')
 
diff --git a/spec/requests/api/graphql/groups_query_spec.rb b/spec/requests/api/graphql/groups_query_spec.rb
index 460cb40b68a..7310382553f 100644
--- a/spec/requests/api/graphql/groups_query_spec.rb
+++ b/spec/requests/api/graphql/groups_query_spec.rb
@@ -12,7 +12,7 @@ RSpec.describe 'searching groups', :with_license, feature_category: :groups_and_
   let(:fields) do
     <<~FIELDS
       nodes {
-        #{all_graphql_fields_for('Group')}
+        #{all_graphql_fields_for('Group', excluded: %w[runners])}
       }
     FIELDS
   end
diff --git a/spec/requests/api/graphql/packages/package_spec.rb b/spec/requests/api/graphql/packages/package_spec.rb
index 7610a4aaac1..c8cef07c4ff 100644
--- a/spec/requests/api/graphql/packages/package_spec.rb
+++ b/spec/requests/api/graphql/packages/package_spec.rb
@@ -16,7 +16,7 @@ RSpec.describe 'package details', feature_category: :package_registry do
   end
 
   let(:depth) { 3 }
-  let(:excluded) { %w[metadata apiFuzzingCiConfiguration pipeline packageFiles] }
+  let(:excluded) { %w[metadata apiFuzzingCiConfiguration pipeline packageFiles runners] }
   let(:metadata) { query_graphql_fragment('ComposerMetadata') }
   let(:package_files) { all_graphql_fields_for('PackageFile') }
   let(:package_global_id) { global_id_of(composer_package) }
diff --git a/spec/requests/api/graphql/project/merge_request_spec.rb b/spec/requests/api/graphql/project/merge_request_spec.rb
index 28aadf850f0..9ca5df95d30 100644
--- a/spec/requests/api/graphql/project/merge_request_spec.rb
+++ b/spec/requests/api/graphql/project/merge_request_spec.rb
@@ -21,9 +21,11 @@ RSpec.describe 'getting merge request information nested in a project', feature_
   end
 
   it_behaves_like 'a working graphql query' do
-    # we exclude Project.pipeline because it needs arguments
-    # and codequalityReportsComparer because no pipeline exist yet
-    let(:mr_fields) { all_graphql_fields_for('MergeRequest', excluded: %w[jobs pipeline codequalityReportsComparer]) }
+    # we exclude Project.pipeline because it needs arguments,
+    # codequalityReportsComparer because no pipeline exist yet
+    # and runners because the user is not an admin and therefore has no access
+    let(:excluded) { %w[jobs pipeline runners codequalityReportsComparer] }
+    let(:mr_fields) { all_graphql_fields_for('MergeRequest', excluded: excluded) }
 
     before do
       post_graphql(query, current_user: current_user)
diff --git a/spec/requests/api/graphql/project/runners_spec.rb b/spec/requests/api/graphql/project/runners_spec.rb
index bee7ce2e372..68e95de49bc 100644
--- a/spec/requests/api/graphql/project/runners_spec.rb
+++ b/spec/requests/api/graphql/project/runners_spec.rb
@@ -28,6 +28,8 @@ RSpec.describe 'Project.runners', feature_category: :runner do
     )
   end
 
+  subject(:request) { post_graphql(query, current_user: user) }
+
   context 'when the user is a project admin' do
     before do
       project.add_maintainer(user)
@@ -36,7 +38,7 @@ RSpec.describe 'Project.runners', feature_category: :runner do
     let(:expected_ids) { [project_runner, group_runner, instance_runner].map { |g| g.to_global_id.to_s } }
 
     it 'returns all runners available to project' do
-      post_graphql(query, current_user: user)
+      request
 
       expect(graphql_data_at(:project, :runners, :nodes).pluck('id')).to match_array(expected_ids)
     end
@@ -47,10 +49,14 @@ RSpec.describe 'Project.runners', feature_category: :runner do
       project.add_developer(user)
     end
 
-    it 'returns no runners' do
-      post_graphql(query, current_user: user)
+    it 'returns nil runners and an error' do
+      request
 
-      expect(graphql_data_at(:project, :runners, :nodes)).to be_empty
+      expect(graphql_data_at(:project, :runners)).to be_nil
+      expect(graphql_errors).to contain_exactly(a_hash_including(
+        'message' => a_string_including("you don't have permission to perform this action"),
+        'path' => %w[project runners]
+      ))
     end
   end
 end