Add latest changes from gitlab-org/gitlab@master

GITALY_SERVER_VERSION

@@ -1 +1 @@
-438b2e236c53d8a0e44a1d2070b292accc9c3153
+3122df2998194b526609f89da20518fa05d1e80a

GITLAB_KAS_VERSION

@@ -1 +1 @@
-735fce904e4bc07a98eff809027b3a496e4369f6
+87ea5e79c5d609a9c2ba3e53cdcee4637dbe8968

app/assets/javascripts/diffs/components/compare_versions.vue

@@ -1,5 +1,13 @@
 <script>
-import { GlTooltipDirective, GlIcon, GlLink, GlButtonGroup, GlButton, GlSprintf } from '@gitlab/ui';
+import {
+  GlTooltipDirective,
+  GlIcon,
+  GlLink,
+  GlButtonGroup,
+  GlButton,
+  GlSprintf,
+  GlAnimatedSidebarIcon,
+} from '@gitlab/ui';
 // eslint-disable-next-line no-restricted-imports
 import { mapActions, mapGetters, mapState } from 'vuex';
 import { __ } from '~/locale';
@@ -22,6 +30,7 @@ export default {
     GlButtonGroup,
     GlButton,
     GlSprintf,
+    GlAnimatedSidebarIcon,
   },
   directives: {
     GlTooltip: GlTooltipDirective,
@@ -117,14 +126,15 @@ export default {
         v-if="toggleFileTreeVisible"
         v-gl-tooltip.html="toggleFileBrowserTooltip"
         variant="default"
-        icon="sidebar"
         class="js-toggle-tree-list btn-icon gl-mr-3"
         data-testid="file-tree-button"
         :aria-label="toggleFileBrowserTitle"
         :aria-keyshortcuts="toggleFileBrowserShortcutKey"
         :selected="showTreeList"
         @click="setShowTreeList({ showTreeList: !showTreeList })"
-      />
+      >
+        <gl-animated-sidebar-icon :is-on="showTreeList" />
+      </gl-button>
       <div v-if="commit">
         {{ __('Viewing commit') }}
         <gl-link :href="commit.commit_url" class="monospace">{{ commit.short_id }}</gl-link>

app/controllers/projects/environments_controller.rb

@@ -117,8 +117,10 @@ class Projects::EnvironmentsController < Projects::ApplicationController
   def stop
     return render_404 unless @environment.available?
 
-    stop_actions = @environment.stop_with_actions!
-    job = stop_actions.first if stop_actions&.count == 1
+    service_response = Environments::StopService.new(project, current_user).execute(@environment)
+    return render_403 unless service_response.success?
+
+    job = service_response[:actions].first if service_response[:actions]&.count == 1
 
     action_or_env_url =
       if job

app/finders/todos_finder.rb

@@ -24,7 +24,7 @@ class TodosFinder
 
   NONE = '0'
 
-  TODO_TYPES = Set.new(%w[Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]).freeze
+  TODO_TYPES = Set.new(%w[Commit Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]).freeze
 
   attr_accessor :current_user, :params
 

app/graphql/types/todo_target_enum.rb

@@ -8,6 +8,8 @@ module Types
     value 'MERGEREQUEST', value: 'MergeRequest', description: 'Merge request.'
     value 'DESIGN', value: 'DesignManagement::Design', description: 'Design.'
     value 'ALERT', value: 'AlertManagement::Alert', description: 'Alert.'
+    value 'PROJECT', value: 'Project', description: 'Project.'
+    value 'NAMESPACE', value: 'Namespace', description: 'Namespace.'
   end
 end
 

app/services/environments/stop_service.rb

@@ -12,10 +12,20 @@ module Environments
         )
       end
 
+      unsafe_execute!(environment)
+    end
+
+    ##
+    # Stops the environment without checking user permissions. This
+    # should only be used if initiated by a system action and a user
+    # cannot be specified.
+    def unsafe_execute!(environment)
       if params[:force]
+        actions = []
+
         environment.stop_complete!
       else
-        environment.stop_with_actions!
+        actions = environment.stop_with_actions!
       end
 
       unless environment.saved_change_to_attribute?(:state)
@@ -25,7 +35,7 @@ module Environments
         )
       end
 
-      ServiceResponse.success(payload: { environment: environment })
+      ServiceResponse.success(payload: { environment: environment, actions: actions })
     end
 
     def execute_for_branch(branch_name)

app/workers/environments/auto_stop_worker.rb

@@ -9,7 +9,9 @@ module Environments
     feature_category :continuous_delivery
 
     def perform(environment_id, params = {})
-      Environment.find_by_id(environment_id).try(&:stop_with_actions!)
+      Environment.find_by_id(environment_id).try do |environment|
+        Environments::StopService.new(environment.project).unsafe_execute!(environment)
+      end
     end
   end
 end

db/migrate/20240925021414_add_watermark_to_zoekt_indices.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class AddWatermarkToZoektIndices < Gitlab::Database::Migration[2.2]
+  milestone '17.5'
+
+  def up
+    add_column :zoekt_indices, :watermark_level, :integer, null: false, limit: 2, default: 0
+  end
+
+  def down
+    remove_column :zoekt_indices, :watermark_level
+  end
+end

db/schema_migrations/20240925021414

@@ -0,0 +1 @@
+93c7710406d919772542b5142dd862f7faa0ff8db45f322cdba5674245deffe0

db/structure.sql

@@ -21040,7 +21040,8 @@ CREATE TABLE zoekt_indices (
     state smallint DEFAULT 0 NOT NULL,
     zoekt_replica_id bigint,
     reserved_storage_bytes bigint DEFAULT '10737418240'::bigint,
-    used_storage_bytes bigint DEFAULT 0 NOT NULL
+    used_storage_bytes bigint DEFAULT 0 NOT NULL,
+    watermark_level smallint DEFAULT 0 NOT NULL
 );
 
 CREATE SEQUENCE zoekt_indices_id_seq

doc/api/graphql/reference/index.md

@@ -38670,6 +38670,8 @@ Sort options for todos.
 | <a id="todotargetenumepic"></a>`EPIC` | An Epic. |
 | <a id="todotargetenumissue"></a>`ISSUE` | Issue. |
 | <a id="todotargetenummergerequest"></a>`MERGEREQUEST` | Merge request. |
+| <a id="todotargetenumnamespace"></a>`NAMESPACE` | Namespace. |
+| <a id="todotargetenumproject"></a>`PROJECT` | Project. |
 | <a id="todotargetenumworkitem"></a>`WORKITEM` | Work item. |
 
 ### `TrainingUrlRequestStatus`

doc/development/internal_analytics/internal_event_instrumentation/quick_start.md

@@ -78,8 +78,26 @@ track_internal_event(
 
 Additional properties can be passed when tracking events. They can be used to save additional data related to given event.
 
-Tracking classes have built-in properties with keys `label` (string), `property` (string) and `value`(numeric). It's recommended
-to use these properties first.
+Tracking classes already have three built-in properties:
+
+- `label` (string)
+- `property` (string)
+- `value`(numeric)
+
+The arbitrary naming and typing of the these three properties is due to constraints from the data extraction process.
+It's recommended to use these properties first, even if their name does not match with the data you want to track.
+This recommendation is particularly important if you want to leverage these attributes as
+[metric filters](metric_definition_guide.md#filters). You can further describe what is the actual data being tracked
+by using the `description` property in the YAML definition of the event. For an example, see
+[`create_ci_internal_pipeline.yml`](https://gitlab.com/gitlab-org/gitlab/-/blob/537ea367dab731e886e6040d8399c430fdb67ab7/config/events/create_ci_internal_pipeline.yml):
+
+```ruby
+additional_properties:
+  label:
+    description: The source of the pipeline, e.g. a push, a schedule or similar.
+  property:
+    description: The source of the config, e.g. the repository, auto_devops or similar.
+```
 
 Additional properties are passed by including the `additional_properties` hash in the `#track_event` call:
 
@@ -88,8 +106,8 @@ track_internal_event(
   "create_ci_build",
   user: user,
   additional_properties: {
-    label: 'scheduled',
-    value: 20
+    label: source, # The label is tracking the source of the pipeline
+    property: config_source # The property is tracking the source of the configuration
   }
 )
 ```
@@ -100,10 +118,9 @@ If you need to pass more than three additional properties, you can use the `addi
 track_internal_event(
   "code_suggestion_accepted",
   user: user,
-  additional_properties: {
-    label: 'vsc',
-    property: 'automatic',
-    value: 200,
+    label: editor_name,
+    property: suggestion_type,
+    value: suggestion_shown_duration
     lang: 'ruby',
     custom_key: 'custom_value'
   }

doc/user/application_security/dependency_scanning/index.md

@@ -677,7 +677,7 @@ The `gemnasium` analyzer scans supports JavaScript projects for vendored librari
 #### Go
 
 Multiple files are supported. When a `go.mod` file is detected, the analyzer attempts to generate a [build list](https://go.dev/ref/mod#glos-build-list) using
-[Minimal Version Selection](https://go.dev/ref/mod#glos-minimal-version-selection).
+[Minimal Version Selection](https://go.dev/ref/mod#glos-minimal-version-selection). If this fails, the analyzer instead attempts to parse the dependencies within the `go.mod` file.
 
 As a requirement, the `go.mod` file should be cleaned up using the command `go mod tidy` to ensure proper management of dependencies. The process is repeated for every detected `go.mod` file.
 

doc/user/application_security/sast/index.md

@@ -621,10 +621,10 @@ The following are Docker image-related CI/CD variables.
 
 #### Vulnerability filters
 
-| CI/CD variable               | Default value            | Description                                                                                                                                                                                                                 |
-|------------------------------|--------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| CI/CD variable               | Default value            | Description |
+|------------------------------|--------------------------|-------------|
 | `SAST_EXCLUDED_PATHS`        | `spec, test, tests, tmp` | Exclude vulnerabilities from output based on the paths. This is a comma-separated list of patterns. Patterns can be globs (see [`doublestar.Match`](https://pkg.go.dev/github.com/bmatcuk/doublestar/v4@v4.0.2#Match) for supported patterns), or file or folder paths (for example, `doc,spec`). Parent directories also match patterns. You might need to exclude temporary directories used by your build tool as these can generate false positives. To exclude paths, copy and paste the default excluded paths, then **add** your own paths to be excluded. If you don't specify the default excluded paths, you override the defaults and _only_ paths you specify are excluded from the SAST scans. |
-| `SEARCH_MAX_DEPTH`           | [Semgrep](https://gitlab.com/gitlab-org/security-products/analyzers/semgrep) 20; all other SAST analyzers 4                        | SAST searches the repository to detect the programming languages used, and selects the matching analyzers. Set the value of `SEARCH_MAX_DEPTH` to specify how many directory levels the search phase should span. After the analyzers have been selected, the _entire_ repository is analyzed. |
+| `SEARCH_MAX_DEPTH`           | 20 for [Advanced SAST](gitlab_advanced_sast.md) and [Semgrep](https://gitlab.com/gitlab-org/security-products/analyzers/semgrep); 4 for all other SAST analyzers | SAST searches the repository to detect the programming languages used, and selects the matching analyzers. Set the value of `SEARCH_MAX_DEPTH` to specify how many directory levels the search phase should span. After the analyzers have been selected, the _entire_ repository is analyzed. |
 
 #### Analyzer settings
 

doc/user/project/time_tracking.md

@@ -11,9 +11,11 @@ DETAILS:
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
 
 > - Time tracking for tasks [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/438577) in GitLab 17.0.
+> - Time tracking for epics [introduced](https://gitlab.com/groups/gitlab-org/-/epics/12396) in GitLab 17.5.
 
 You can estimate and track the time you spend on an item, such as:
 
+- [Epic](../group/epics/index.md)
 - [Issue](issues/index.md)
 - [Task](../tasks.md)
 - [Merge request](merge_requests/index.md)
@@ -166,14 +168,14 @@ To delete all the time spent at once, use the `/remove_time_spent` [quick action
 
 To view a time tracking report of time spent on an item:
 
-- For an issue or merge request:
+- For an issue or a merge request:
 
   1. Go to an issue or a merge request.
   1. In the right sidebar, select **Time tracking report**.
 
-- For a task:
+- For an epic or a task:
 
-  1. Go to a task.
+  1. Go to an epic or a task.
   1. In the right sidebar, select the time next to **Spent**.
 
 ![Time tracking report](img/time_tracking_report_v15_1.png)

spec/controllers/projects/environments_controller_spec.rb

@@ -398,8 +398,11 @@ RSpec.describe Projects::EnvironmentsController, feature_category: :continuous_d
       it 'returns job url for a stop action when job is build' do
         action = create(:ci_build, :manual)
 
-        allow_any_instance_of(Environment)
-          .to receive_messages(available?: true, stop_with_actions!: [action])
+        allow_next_instance_of(Environments::StopService) do |service|
+          response = ServiceResponse.success(payload: { environment: environment, actions: [action] })
+
+          allow(service).to receive(:execute).with(environment).and_return(response)
+        end
 
         subject
 
@@ -412,8 +415,11 @@ RSpec.describe Projects::EnvironmentsController, feature_category: :continuous_d
       it 'returns pipeline url for a stop action when job is bridge' do
         action = create(:ci_bridge, :manual)
 
-        allow_any_instance_of(Environment)
-          .to receive_messages(available?: true, stop_with_actions!: [action])
+        allow_next_instance_of(Environments::StopService) do |service|
+          response = ServiceResponse.success(payload: { environment: environment, actions: [action] })
+
+          allow(service).to receive(:execute).with(environment).and_return(response)
+        end
 
         subject
 
@@ -426,8 +432,11 @@ RSpec.describe Projects::EnvironmentsController, feature_category: :continuous_d
       it 'returns environment url for multiple stop actions' do
         actions = create_list(:ci_build, 2, :manual)
 
-        allow_any_instance_of(Environment)
-        .to receive_messages(available?: true, stop_with_actions!: actions)
+        allow_next_instance_of(Environments::StopService) do |service|
+          response = ServiceResponse.success(payload: { environment: environment, actions: actions })
+
+          allow(service).to receive(:execute).with(environment).and_return(response)
+        end
 
         subject
 
@@ -437,6 +446,18 @@ RSpec.describe Projects::EnvironmentsController, feature_category: :continuous_d
               project_environment_url(project, environment) })
       end
 
+      it 'returns 403 if there was an error stopping the environment' do
+        allow_next_instance_of(Environments::StopService) do |service|
+          response = ServiceResponse.error(message: 'error message')
+
+          allow(service).to receive(:execute).with(environment).and_return(response)
+        end
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+
       it_behaves_like 'tracking unique visits', :stop do
         let(:request_params) { environment_params(format: :json) }
         let(:target_id) { 'users_visiting_environments_pages' }
@@ -445,8 +466,11 @@ RSpec.describe Projects::EnvironmentsController, feature_category: :continuous_d
 
     context 'when no stop action' do
       it 'returns env url' do
-        allow_any_instance_of(Environment)
-          .to receive_messages(available?: true, stop_with_actions!: nil)
+        allow_next_instance_of(Environments::StopService) do |service|
+          response = ServiceResponse.success(payload: { environment: environment, actions: [] })
+
+          allow(service).to receive(:execute).with(environment).and_return(response)
+        end
 
         subject
 

spec/finders/todos_finder_spec.rb

@@ -342,9 +342,9 @@ RSpec.describe TodosFinder, feature_category: :team_planning do
     it 'returns the expected types' do
       expected_result =
         if Gitlab.ee?
-          %w[Epic Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]
+          %w[Epic Commit Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]
         else
-          %w[Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]
+          %w[Commit Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]
         end
 
       expect(described_class.todo_types).to contain_exactly(*expected_result)

spec/frontend/diffs/components/compare_versions_spec.js

@@ -1,3 +1,4 @@
+import { GlAnimatedSidebarIcon } from '@gitlab/ui';
 import { mount } from '@vue/test-utils';
 import { nextTick } from 'vue';
 import getDiffWithCommit from 'test_fixtures/merge_request_diffs/with_commit.json';
@@ -84,7 +85,7 @@ describe('CompareVersions', () => {
 
       expect(treeListBtn.exists()).toBe(true);
       expect(treeListBtn.attributes('aria-label')).toBe('Hide file browser');
-      expect(treeListBtn.props('icon')).toBe('sidebar');
+      expect(treeListBtn.findComponent(GlAnimatedSidebarIcon).exists()).toBe(true);
     });
 
     it('should render comparison dropdowns with correct values', () => {

spec/graphql/types/todo_action_enum_spec.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe GitlabSchema.types['TodoActionEnum'], feature_category: :notifications do
+  specify { expect(described_class.graphql_name).to eq('TodoActionEnum') }
+
+  it 'exposes all existing Todo::ACTION_NAMES with the same name and value' do
+    enum_as_hash = described_class.values.values.to_h do |enum|
+      [enum.value, enum.graphql_name.to_sym]
+    end
+    expect(enum_as_hash).to eq(Todo::ACTION_NAMES)
+  end
+end

spec/graphql/types/todo_target_enum_spec.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe GitlabSchema.types['TodoTargetEnum'], feature_category: :notifications do
+  specify { expect(described_class.graphql_name).to eq('TodoTargetEnum') }
+
+  it 'exposes all TodosFinder.todo_types as a value' do
+    expect(described_class.values.values).to contain_exactly(
+      *::TodosFinder.todo_types.map do |class_name|
+        have_attributes(value: class_name)
+      end
+    )
+  end
+end

spec/services/environments/stop_service_spec.rb

@@ -5,14 +5,9 @@ require 'spec_helper'
 RSpec.describe Environments::StopService, feature_category: :continuous_delivery do
   include CreateEnvironmentsHelpers
 
-  let(:project) { create(:project, :private, :repository) }
-  let(:user) { create(:user) }
-
   let(:service) { described_class.new(project, user) }
 
-  describe '#execute' do
-    subject { service.execute(environment) }
-
+  shared_examples_for 'stopping environment' do
     let_it_be(:project) { create(:project, :private, :repository) }
     let_it_be(:developer) { create(:user, developer_of: project) }
     let_it_be(:reporter) { create(:user, reporter_of: project) }
@@ -65,21 +60,39 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
       it 'stops the environment' do
         expect { subject }.to change { environment.reload.state }.from('available').to('stopped')
       end
+    end
+  end
 
-      context 'when the actor is a reporter' do
-        let(:user) { reporter }
+  describe '#execute' do
+    subject { service.execute(environment) }
 
-        it 'does not stop the environment' do
-          expect { subject }.not_to change { environment.reload.state }
-        end
+    include_examples 'stopping environment'
+
+    context 'when the actor does not have permission to stop the environment' do
+      let!(:environment) { create(:environment, project: project) }
+      let(:user) { reporter }
+
+      it 'does not stop the environment' do
+        expect { subject }.not_to change { environment.reload.state }
       end
     end
   end
 
+  describe '#unsafe_execute!' do
+    let(:user) { nil }
+
+    subject { service.unsafe_execute!(environment) }
+
+    include_examples 'stopping environment'
+  end
+
   describe '#execute_for_branch' do
+    let_it_be(:project) { create(:project, :private, :repository) }
+    let_it_be(:user) { create(:user) }
+
     context 'when environment with review app exists' do
       context 'when user has permission to stop environment' do
-        before do
+        before_all do
           project.add_developer(user)
         end
 
@@ -122,7 +135,7 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
 
       context 'when user does not have permission to stop environment' do
         context 'when user has no access to manage deployments' do
-          before do
+          before_all do
             project.add_guest(user)
           end
 
@@ -133,7 +146,7 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
       end
 
       context 'when branch for stop action is protected' do
-        before do
+        before_all do
           project.add_developer(user)
           create(:protected_branch, :no_one_can_push, name: 'master', project: project)
         end
@@ -150,7 +163,7 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
       end
 
       context 'when user has permission to stop environments' do
-        before do
+        before_all do
           project.add_maintainer(user)
         end
 
@@ -171,9 +184,9 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
   describe '#execute_for_merge_request_pipeline' do
     subject { service.execute_for_merge_request_pipeline(merge_request) }
 
-    let(:merge_request) { create(:merge_request, source_branch: 'feature', target_branch: 'master') }
-    let(:project) { merge_request.project }
-    let(:user) { create(:user) }
+    let_it_be_with_reload(:merge_request) { create(:merge_request, source_branch: 'feature', target_branch: 'master') }
+    let_it_be(:project) { merge_request.project }
+    let_it_be(:user) { create(:user) }
 
     let(:pipeline) do
       create(:ci_pipeline,
@@ -196,7 +209,7 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
     end
 
     context 'when user is a developer' do
-      before do
+      before_all do
         project.add_developer(user)
       end
 
@@ -256,7 +269,7 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
     end
 
     context 'when user is a reporter' do
-      before do
+      before_all do
         project.add_reporter(user)
       end