diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 8ebf52b81da..962f6120732 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-438b2e236c53d8a0e44a1d2070b292accc9c3153
+3122df2998194b526609f89da20518fa05d1e80a
diff --git a/GITLAB_KAS_VERSION b/GITLAB_KAS_VERSION
index 7a26eb9741b..860d3b30320 100644
--- a/GITLAB_KAS_VERSION
+++ b/GITLAB_KAS_VERSION
@@ -1 +1 @@
-735fce904e4bc07a98eff809027b3a496e4369f6
+87ea5e79c5d609a9c2ba3e53cdcee4637dbe8968
diff --git a/app/assets/javascripts/diffs/components/compare_versions.vue b/app/assets/javascripts/diffs/components/compare_versions.vue
index 8b5c6bb25df..4b72f7291d5 100644
--- a/app/assets/javascripts/diffs/components/compare_versions.vue
+++ b/app/assets/javascripts/diffs/components/compare_versions.vue
@@ -1,5 +1,13 @@
 <script>
-import { GlTooltipDirective, GlIcon, GlLink, GlButtonGroup, GlButton, GlSprintf } from '@gitlab/ui';
+import {
+  GlTooltipDirective,
+  GlIcon,
+  GlLink,
+  GlButtonGroup,
+  GlButton,
+  GlSprintf,
+  GlAnimatedSidebarIcon,
+} from '@gitlab/ui';
 // eslint-disable-next-line no-restricted-imports
 import { mapActions, mapGetters, mapState } from 'vuex';
 import { __ } from '~/locale';
@@ -22,6 +30,7 @@ export default {
     GlButtonGroup,
     GlButton,
     GlSprintf,
+    GlAnimatedSidebarIcon,
   },
   directives: {
     GlTooltip: GlTooltipDirective,
@@ -117,14 +126,15 @@ export default {
         v-if="toggleFileTreeVisible"
         v-gl-tooltip.html="toggleFileBrowserTooltip"
         variant="default"
-        icon="sidebar"
         class="js-toggle-tree-list btn-icon gl-mr-3"
         data-testid="file-tree-button"
         :aria-label="toggleFileBrowserTitle"
         :aria-keyshortcuts="toggleFileBrowserShortcutKey"
         :selected="showTreeList"
         @click="setShowTreeList({ showTreeList: !showTreeList })"
-      />
+      >
+        <gl-animated-sidebar-icon :is-on="showTreeList" />
+      </gl-button>
       <div v-if="commit">
         {{ __('Viewing commit') }}
         <gl-link :href="commit.commit_url" class="monospace">{{ commit.short_id }}</gl-link>
diff --git a/app/controllers/projects/environments_controller.rb b/app/controllers/projects/environments_controller.rb
index b3ab9b98489..aa30540e95a 100644
--- a/app/controllers/projects/environments_controller.rb
+++ b/app/controllers/projects/environments_controller.rb
@@ -117,8 +117,10 @@ class Projects::EnvironmentsController < Projects::ApplicationController
   def stop
     return render_404 unless @environment.available?
 
-    stop_actions = @environment.stop_with_actions!
-    job = stop_actions.first if stop_actions&.count == 1
+    service_response = Environments::StopService.new(project, current_user).execute(@environment)
+    return render_403 unless service_response.success?
+
+    job = service_response[:actions].first if service_response[:actions]&.count == 1
 
     action_or_env_url =
       if job
diff --git a/app/finders/todos_finder.rb b/app/finders/todos_finder.rb
index d31b915caa9..dc62f7d155a 100644
--- a/app/finders/todos_finder.rb
+++ b/app/finders/todos_finder.rb
@@ -24,7 +24,7 @@ class TodosFinder
 
   NONE = '0'
 
-  TODO_TYPES = Set.new(%w[Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]).freeze
+  TODO_TYPES = Set.new(%w[Commit Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]).freeze
 
   attr_accessor :current_user, :params
 
diff --git a/app/graphql/types/todo_target_enum.rb b/app/graphql/types/todo_target_enum.rb
index d2527ef5267..2b47e80ca7e 100644
--- a/app/graphql/types/todo_target_enum.rb
+++ b/app/graphql/types/todo_target_enum.rb
@@ -8,6 +8,8 @@ module Types
     value 'MERGEREQUEST', value: 'MergeRequest', description: 'Merge request.'
     value 'DESIGN', value: 'DesignManagement::Design', description: 'Design.'
     value 'ALERT', value: 'AlertManagement::Alert', description: 'Alert.'
+    value 'PROJECT', value: 'Project', description: 'Project.'
+    value 'NAMESPACE', value: 'Namespace', description: 'Namespace.'
   end
 end
 
diff --git a/app/services/environments/stop_service.rb b/app/services/environments/stop_service.rb
index 17e78daca35..4a096a978eb 100644
--- a/app/services/environments/stop_service.rb
+++ b/app/services/environments/stop_service.rb
@@ -12,10 +12,20 @@ module Environments
         )
       end
 
+      unsafe_execute!(environment)
+    end
+
+    ##
+    # Stops the environment without checking user permissions. This
+    # should only be used if initiated by a system action and a user
+    # cannot be specified.
+    def unsafe_execute!(environment)
       if params[:force]
+        actions = []
+
         environment.stop_complete!
       else
-        environment.stop_with_actions!
+        actions = environment.stop_with_actions!
       end
 
       unless environment.saved_change_to_attribute?(:state)
@@ -25,7 +35,7 @@ module Environments
         )
       end
 
-      ServiceResponse.success(payload: { environment: environment })
+      ServiceResponse.success(payload: { environment: environment, actions: actions })
     end
 
     def execute_for_branch(branch_name)
diff --git a/app/workers/environments/auto_stop_worker.rb b/app/workers/environments/auto_stop_worker.rb
index 43e0a4c8a0c..29e5e1cec47 100644
--- a/app/workers/environments/auto_stop_worker.rb
+++ b/app/workers/environments/auto_stop_worker.rb
@@ -9,7 +9,9 @@ module Environments
     feature_category :continuous_delivery
 
     def perform(environment_id, params = {})
-      Environment.find_by_id(environment_id).try(&:stop_with_actions!)
+      Environment.find_by_id(environment_id).try do |environment|
+        Environments::StopService.new(environment.project).unsafe_execute!(environment)
+      end
     end
   end
 end
diff --git a/db/migrate/20240925021414_add_watermark_to_zoekt_indices.rb b/db/migrate/20240925021414_add_watermark_to_zoekt_indices.rb
new file mode 100644
index 00000000000..3400c0a24dc
--- /dev/null
+++ b/db/migrate/20240925021414_add_watermark_to_zoekt_indices.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class AddWatermarkToZoektIndices < Gitlab::Database::Migration[2.2]
+  milestone '17.5'
+
+  def up
+    add_column :zoekt_indices, :watermark_level, :integer, null: false, limit: 2, default: 0
+  end
+
+  def down
+    remove_column :zoekt_indices, :watermark_level
+  end
+end
diff --git a/db/schema_migrations/20240925021414 b/db/schema_migrations/20240925021414
new file mode 100644
index 00000000000..3e513c6da8e
--- /dev/null
+++ b/db/schema_migrations/20240925021414
@@ -0,0 +1 @@
+93c7710406d919772542b5142dd862f7faa0ff8db45f322cdba5674245deffe0
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 67e29d71846..883b68daf32 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -21040,7 +21040,8 @@ CREATE TABLE zoekt_indices (
     state smallint DEFAULT 0 NOT NULL,
     zoekt_replica_id bigint,
     reserved_storage_bytes bigint DEFAULT '10737418240'::bigint,
-    used_storage_bytes bigint DEFAULT 0 NOT NULL
+    used_storage_bytes bigint DEFAULT 0 NOT NULL,
+    watermark_level smallint DEFAULT 0 NOT NULL
 );
 
 CREATE SEQUENCE zoekt_indices_id_seq
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index da3f33cad21..933910880c5 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -38670,6 +38670,8 @@ Sort options for todos.
 | <a id="todotargetenumepic"></a>`EPIC` | An Epic. |
 | <a id="todotargetenumissue"></a>`ISSUE` | Issue. |
 | <a id="todotargetenummergerequest"></a>`MERGEREQUEST` | Merge request. |
+| <a id="todotargetenumnamespace"></a>`NAMESPACE` | Namespace. |
+| <a id="todotargetenumproject"></a>`PROJECT` | Project. |
 | <a id="todotargetenumworkitem"></a>`WORKITEM` | Work item. |
 
 ### `TrainingUrlRequestStatus`
diff --git a/doc/development/internal_analytics/internal_event_instrumentation/quick_start.md b/doc/development/internal_analytics/internal_event_instrumentation/quick_start.md
index b3b94067645..3e6159ad92f 100644
--- a/doc/development/internal_analytics/internal_event_instrumentation/quick_start.md
+++ b/doc/development/internal_analytics/internal_event_instrumentation/quick_start.md
@@ -78,8 +78,26 @@ track_internal_event(
 
 Additional properties can be passed when tracking events. They can be used to save additional data related to given event.
 
-Tracking classes have built-in properties with keys `label` (string), `property` (string) and `value`(numeric). It's recommended
-to use these properties first.
+Tracking classes already have three built-in properties:
+
+- `label` (string)
+- `property` (string)
+- `value`(numeric)
+
+The arbitrary naming and typing of the these three properties is due to constraints from the data extraction process.
+It's recommended to use these properties first, even if their name does not match with the data you want to track.
+This recommendation is particularly important if you want to leverage these attributes as
+[metric filters](metric_definition_guide.md#filters). You can further describe what is the actual data being tracked
+by using the `description` property in the YAML definition of the event. For an example, see
+[`create_ci_internal_pipeline.yml`](https://gitlab.com/gitlab-org/gitlab/-/blob/537ea367dab731e886e6040d8399c430fdb67ab7/config/events/create_ci_internal_pipeline.yml):
+
+```ruby
+additional_properties:
+  label:
+    description: The source of the pipeline, e.g. a push, a schedule or similar.
+  property:
+    description: The source of the config, e.g. the repository, auto_devops or similar.
+```
 
 Additional properties are passed by including the `additional_properties` hash in the `#track_event` call:
 
@@ -88,8 +106,8 @@ track_internal_event(
   "create_ci_build",
   user: user,
   additional_properties: {
-    label: 'scheduled',
-    value: 20
+    label: source, # The label is tracking the source of the pipeline
+    property: config_source # The property is tracking the source of the configuration
   }
 )
 ```
@@ -100,10 +118,9 @@ If you need to pass more than three additional properties, you can use the `addi
 track_internal_event(
   "code_suggestion_accepted",
   user: user,
-  additional_properties: {
-    label: 'vsc',
-    property: 'automatic',
-    value: 200,
+    label: editor_name,
+    property: suggestion_type,
+    value: suggestion_shown_duration
     lang: 'ruby',
     custom_key: 'custom_value'
   }
diff --git a/doc/user/application_security/dependency_scanning/index.md b/doc/user/application_security/dependency_scanning/index.md
index 47f3051f047..9854280a948 100644
--- a/doc/user/application_security/dependency_scanning/index.md
+++ b/doc/user/application_security/dependency_scanning/index.md
@@ -677,7 +677,7 @@ The `gemnasium` analyzer scans supports JavaScript projects for vendored librari
 #### Go
 
 Multiple files are supported. When a `go.mod` file is detected, the analyzer attempts to generate a [build list](https://go.dev/ref/mod#glos-build-list) using
-[Minimal Version Selection](https://go.dev/ref/mod#glos-minimal-version-selection).
+[Minimal Version Selection](https://go.dev/ref/mod#glos-minimal-version-selection). If this fails, the analyzer instead attempts to parse the dependencies within the `go.mod` file.
 
 As a requirement, the `go.mod` file should be cleaned up using the command `go mod tidy` to ensure proper management of dependencies. The process is repeated for every detected `go.mod` file.
 
diff --git a/doc/user/application_security/sast/index.md b/doc/user/application_security/sast/index.md
index aab9ec01c6e..f6aacaa5a58 100644
--- a/doc/user/application_security/sast/index.md
+++ b/doc/user/application_security/sast/index.md
@@ -621,10 +621,10 @@ The following are Docker image-related CI/CD variables.
 
 #### Vulnerability filters
 
-| CI/CD variable               | Default value            | Description                                                                                                                                                                                                                 |
-|------------------------------|--------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| CI/CD variable               | Default value            | Description |
+|------------------------------|--------------------------|-------------|
 | `SAST_EXCLUDED_PATHS`        | `spec, test, tests, tmp` | Exclude vulnerabilities from output based on the paths. This is a comma-separated list of patterns. Patterns can be globs (see [`doublestar.Match`](https://pkg.go.dev/github.com/bmatcuk/doublestar/v4@v4.0.2#Match) for supported patterns), or file or folder paths (for example, `doc,spec`). Parent directories also match patterns. You might need to exclude temporary directories used by your build tool as these can generate false positives. To exclude paths, copy and paste the default excluded paths, then **add** your own paths to be excluded. If you don't specify the default excluded paths, you override the defaults and _only_ paths you specify are excluded from the SAST scans. |
-| `SEARCH_MAX_DEPTH`           | [Semgrep](https://gitlab.com/gitlab-org/security-products/analyzers/semgrep) 20; all other SAST analyzers 4                        | SAST searches the repository to detect the programming languages used, and selects the matching analyzers. Set the value of `SEARCH_MAX_DEPTH` to specify how many directory levels the search phase should span. After the analyzers have been selected, the _entire_ repository is analyzed. |
+| `SEARCH_MAX_DEPTH`           | 20 for [Advanced SAST](gitlab_advanced_sast.md) and [Semgrep](https://gitlab.com/gitlab-org/security-products/analyzers/semgrep); 4 for all other SAST analyzers | SAST searches the repository to detect the programming languages used, and selects the matching analyzers. Set the value of `SEARCH_MAX_DEPTH` to specify how many directory levels the search phase should span. After the analyzers have been selected, the _entire_ repository is analyzed. |
 
 #### Analyzer settings
 
diff --git a/doc/user/project/time_tracking.md b/doc/user/project/time_tracking.md
index f4aeb2fca3b..37c191885f7 100644
--- a/doc/user/project/time_tracking.md
+++ b/doc/user/project/time_tracking.md
@@ -11,9 +11,11 @@ DETAILS:
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
 
 > - Time tracking for tasks [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/438577) in GitLab 17.0.
+> - Time tracking for epics [introduced](https://gitlab.com/groups/gitlab-org/-/epics/12396) in GitLab 17.5.
 
 You can estimate and track the time you spend on an item, such as:
 
+- [Epic](../group/epics/index.md)
 - [Issue](issues/index.md)
 - [Task](../tasks.md)
 - [Merge request](merge_requests/index.md)
@@ -166,14 +168,14 @@ To delete all the time spent at once, use the `/remove_time_spent` [quick action
 
 To view a time tracking report of time spent on an item:
 
-- For an issue or merge request:
+- For an issue or a merge request:
 
   1. Go to an issue or a merge request.
   1. In the right sidebar, select **Time tracking report**.
 
-- For a task:
+- For an epic or a task:
 
-  1. Go to a task.
+  1. Go to an epic or a task.
   1. In the right sidebar, select the time next to **Spent**.
 
 ![Time tracking report](img/time_tracking_report_v15_1.png)
diff --git a/spec/controllers/projects/environments_controller_spec.rb b/spec/controllers/projects/environments_controller_spec.rb
index 4614ee53c07..ffb14e4af3e 100644
--- a/spec/controllers/projects/environments_controller_spec.rb
+++ b/spec/controllers/projects/environments_controller_spec.rb
@@ -398,8 +398,11 @@ RSpec.describe Projects::EnvironmentsController, feature_category: :continuous_d
       it 'returns job url for a stop action when job is build' do
         action = create(:ci_build, :manual)
 
-        allow_any_instance_of(Environment)
-          .to receive_messages(available?: true, stop_with_actions!: [action])
+        allow_next_instance_of(Environments::StopService) do |service|
+          response = ServiceResponse.success(payload: { environment: environment, actions: [action] })
+
+          allow(service).to receive(:execute).with(environment).and_return(response)
+        end
 
         subject
 
@@ -412,8 +415,11 @@ RSpec.describe Projects::EnvironmentsController, feature_category: :continuous_d
       it 'returns pipeline url for a stop action when job is bridge' do
         action = create(:ci_bridge, :manual)
 
-        allow_any_instance_of(Environment)
-          .to receive_messages(available?: true, stop_with_actions!: [action])
+        allow_next_instance_of(Environments::StopService) do |service|
+          response = ServiceResponse.success(payload: { environment: environment, actions: [action] })
+
+          allow(service).to receive(:execute).with(environment).and_return(response)
+        end
 
         subject
 
@@ -426,8 +432,11 @@ RSpec.describe Projects::EnvironmentsController, feature_category: :continuous_d
       it 'returns environment url for multiple stop actions' do
         actions = create_list(:ci_build, 2, :manual)
 
-        allow_any_instance_of(Environment)
-        .to receive_messages(available?: true, stop_with_actions!: actions)
+        allow_next_instance_of(Environments::StopService) do |service|
+          response = ServiceResponse.success(payload: { environment: environment, actions: actions })
+
+          allow(service).to receive(:execute).with(environment).and_return(response)
+        end
 
         subject
 
@@ -437,6 +446,18 @@ RSpec.describe Projects::EnvironmentsController, feature_category: :continuous_d
               project_environment_url(project, environment) })
       end
 
+      it 'returns 403 if there was an error stopping the environment' do
+        allow_next_instance_of(Environments::StopService) do |service|
+          response = ServiceResponse.error(message: 'error message')
+
+          allow(service).to receive(:execute).with(environment).and_return(response)
+        end
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+
       it_behaves_like 'tracking unique visits', :stop do
         let(:request_params) { environment_params(format: :json) }
         let(:target_id) { 'users_visiting_environments_pages' }
@@ -445,8 +466,11 @@ RSpec.describe Projects::EnvironmentsController, feature_category: :continuous_d
 
     context 'when no stop action' do
       it 'returns env url' do
-        allow_any_instance_of(Environment)
-          .to receive_messages(available?: true, stop_with_actions!: nil)
+        allow_next_instance_of(Environments::StopService) do |service|
+          response = ServiceResponse.success(payload: { environment: environment, actions: [] })
+
+          allow(service).to receive(:execute).with(environment).and_return(response)
+        end
 
         subject
 
diff --git a/spec/finders/todos_finder_spec.rb b/spec/finders/todos_finder_spec.rb
index bb1cb0c1c11..ef47c66e8b2 100644
--- a/spec/finders/todos_finder_spec.rb
+++ b/spec/finders/todos_finder_spec.rb
@@ -342,9 +342,9 @@ RSpec.describe TodosFinder, feature_category: :team_planning do
     it 'returns the expected types' do
       expected_result =
         if Gitlab.ee?
-          %w[Epic Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]
+          %w[Epic Commit Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]
         else
-          %w[Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]
+          %w[Commit Issue WorkItem MergeRequest DesignManagement::Design AlertManagement::Alert Namespace Project]
         end
 
       expect(described_class.todo_types).to contain_exactly(*expected_result)
diff --git a/spec/frontend/diffs/components/compare_versions_spec.js b/spec/frontend/diffs/components/compare_versions_spec.js
index 87a93f543d4..b2bfc238c6a 100644
--- a/spec/frontend/diffs/components/compare_versions_spec.js
+++ b/spec/frontend/diffs/components/compare_versions_spec.js
@@ -1,3 +1,4 @@
+import { GlAnimatedSidebarIcon } from '@gitlab/ui';
 import { mount } from '@vue/test-utils';
 import { nextTick } from 'vue';
 import getDiffWithCommit from 'test_fixtures/merge_request_diffs/with_commit.json';
@@ -84,7 +85,7 @@ describe('CompareVersions', () => {
 
       expect(treeListBtn.exists()).toBe(true);
       expect(treeListBtn.attributes('aria-label')).toBe('Hide file browser');
-      expect(treeListBtn.props('icon')).toBe('sidebar');
+      expect(treeListBtn.findComponent(GlAnimatedSidebarIcon).exists()).toBe(true);
     });
 
     it('should render comparison dropdowns with correct values', () => {
diff --git a/spec/graphql/types/todo_action_enum_spec.rb b/spec/graphql/types/todo_action_enum_spec.rb
new file mode 100644
index 00000000000..bbbdd287bba
--- /dev/null
+++ b/spec/graphql/types/todo_action_enum_spec.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe GitlabSchema.types['TodoActionEnum'], feature_category: :notifications do
+  specify { expect(described_class.graphql_name).to eq('TodoActionEnum') }
+
+  it 'exposes all existing Todo::ACTION_NAMES with the same name and value' do
+    enum_as_hash = described_class.values.values.to_h do |enum|
+      [enum.value, enum.graphql_name.to_sym]
+    end
+    expect(enum_as_hash).to eq(Todo::ACTION_NAMES)
+  end
+end
diff --git a/spec/graphql/types/todo_target_enum_spec.rb b/spec/graphql/types/todo_target_enum_spec.rb
new file mode 100644
index 00000000000..2ebc393aacd
--- /dev/null
+++ b/spec/graphql/types/todo_target_enum_spec.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe GitlabSchema.types['TodoTargetEnum'], feature_category: :notifications do
+  specify { expect(described_class.graphql_name).to eq('TodoTargetEnum') }
+
+  it 'exposes all TodosFinder.todo_types as a value' do
+    expect(described_class.values.values).to contain_exactly(
+      *::TodosFinder.todo_types.map do |class_name|
+        have_attributes(value: class_name)
+      end
+    )
+  end
+end
diff --git a/spec/services/environments/stop_service_spec.rb b/spec/services/environments/stop_service_spec.rb
index f06c7160ae3..2b7f1294024 100644
--- a/spec/services/environments/stop_service_spec.rb
+++ b/spec/services/environments/stop_service_spec.rb
@@ -5,14 +5,9 @@ require 'spec_helper'
 RSpec.describe Environments::StopService, feature_category: :continuous_delivery do
   include CreateEnvironmentsHelpers
 
-  let(:project) { create(:project, :private, :repository) }
-  let(:user) { create(:user) }
-
   let(:service) { described_class.new(project, user) }
 
-  describe '#execute' do
-    subject { service.execute(environment) }
-
+  shared_examples_for 'stopping environment' do
     let_it_be(:project) { create(:project, :private, :repository) }
     let_it_be(:developer) { create(:user, developer_of: project) }
     let_it_be(:reporter) { create(:user, reporter_of: project) }
@@ -65,21 +60,39 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
       it 'stops the environment' do
         expect { subject }.to change { environment.reload.state }.from('available').to('stopped')
       end
+    end
+  end
 
-      context 'when the actor is a reporter' do
-        let(:user) { reporter }
+  describe '#execute' do
+    subject { service.execute(environment) }
 
-        it 'does not stop the environment' do
-          expect { subject }.not_to change { environment.reload.state }
-        end
+    include_examples 'stopping environment'
+
+    context 'when the actor does not have permission to stop the environment' do
+      let!(:environment) { create(:environment, project: project) }
+      let(:user) { reporter }
+
+      it 'does not stop the environment' do
+        expect { subject }.not_to change { environment.reload.state }
       end
     end
   end
 
+  describe '#unsafe_execute!' do
+    let(:user) { nil }
+
+    subject { service.unsafe_execute!(environment) }
+
+    include_examples 'stopping environment'
+  end
+
   describe '#execute_for_branch' do
+    let_it_be(:project) { create(:project, :private, :repository) }
+    let_it_be(:user) { create(:user) }
+
     context 'when environment with review app exists' do
       context 'when user has permission to stop environment' do
-        before do
+        before_all do
           project.add_developer(user)
         end
 
@@ -122,7 +135,7 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
 
       context 'when user does not have permission to stop environment' do
         context 'when user has no access to manage deployments' do
-          before do
+          before_all do
             project.add_guest(user)
           end
 
@@ -133,7 +146,7 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
       end
 
       context 'when branch for stop action is protected' do
-        before do
+        before_all do
           project.add_developer(user)
           create(:protected_branch, :no_one_can_push, name: 'master', project: project)
         end
@@ -150,7 +163,7 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
       end
 
       context 'when user has permission to stop environments' do
-        before do
+        before_all do
           project.add_maintainer(user)
         end
 
@@ -171,9 +184,9 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
   describe '#execute_for_merge_request_pipeline' do
     subject { service.execute_for_merge_request_pipeline(merge_request) }
 
-    let(:merge_request) { create(:merge_request, source_branch: 'feature', target_branch: 'master') }
-    let(:project) { merge_request.project }
-    let(:user) { create(:user) }
+    let_it_be_with_reload(:merge_request) { create(:merge_request, source_branch: 'feature', target_branch: 'master') }
+    let_it_be(:project) { merge_request.project }
+    let_it_be(:user) { create(:user) }
 
     let(:pipeline) do
       create(:ci_pipeline,
@@ -196,7 +209,7 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
     end
 
     context 'when user is a developer' do
-      before do
+      before_all do
         project.add_developer(user)
       end
 
@@ -256,7 +269,7 @@ RSpec.describe Environments::StopService, feature_category: :continuous_delivery
     end
 
     context 'when user is a reporter' do
-      before do
+      before_all do
         project.add_reporter(user)
       end