From 59bb4f16f3eb1226f37ea16231ba1e5f5b1e4153 Mon Sep 17 00:00:00 2001 From: GitLab Bot Date: Tue, 9 Jul 2024 09:24:18 +0000 Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master --- .gitlab/ci/cng/main.gitlab-ci.yml | 7 +- .gitlab/ci/release-environments.gitlab-ci.yml | 28 +++ .../release-environments/main.gitlab-ci.yml | 3 +- .../security.gitlab-ci.yml | 143 +++++++++++++ .gitlab/ci/rules.gitlab-ci.yml | 23 +++ .../javascripts/access_level/constants.js | 72 ++++++- .../javascripts/analytics/shared/constants.js | 6 +- .../components/invite_modal_base.vue | 71 ++----- .../{table/drawer => }/role_selector.vue | 14 +- .../table/drawer/role_details_drawer.vue | 17 +- .../members/components/table/max_role.vue | 4 +- app/assets/javascripts/members/utils.js | 18 +- app/services/merge_requests/base_service.rb | 14 ++ ...viewer_assignment_timestamp_in_metrics.yml | 9 + .../beta/use_sidekiq_dedup_lock.yml | 9 + db/docs/external_status_checks.yml | 2 +- ...05055935_add_mr_first_reviewer_assigned.rb | 9 + db/schema_migrations/20240705055935 | 1 + db/structure.sql | 1 + doc/architecture/blueprints/_template.md | 189 ------------------ .../duo-workflow-architecture-gitlab-com.png | Bin 310791 -> 96843 bytes ...orkflow-architecture-self-managed-full.png | Bin 322525 -> 100628 bytes ...rkflow-architecture-self-managed-mixed.png | Bin 419296 -> 126440 bytes .../duo-workflow-without-executor.png | Bin 152112 -> 47740 bytes .../blueprints/organization/index.md | 14 +- .../pipeline_execution_policy/index.md | 12 ++ doc/ci/runners/img/runner_fleet_dashboard.png | Bin 105692 -> 52821 bytes .../img/runner_fleet_dashboard_groups.png | Bin 173011 -> 62702 bytes doc/ci/yaml/img/ci_log_timestamp.png | Bin 69434 -> 53458 bytes doc/development/img/trigger_omnibus_v16_3.png | Bin 80336 -> 22967 bytes doc/development/work_items_widgets.md | 12 +- .../container_scanning/index.md | 28 ++- .../policies/scan-result-policies.md | 2 +- doc/user/tasks.md | 17 +- .../sidekiq_logging/deduplication_logger.rb | 7 + .../duplicate_jobs/duplicate_job.rb | 32 +-- .../duplicate_jobs/strategies/base.rb | 19 ++ .../deduplicates_when_scheduling.rb | 41 ++-- .../strategies/until_executed.rb | 13 +- locale/gitlab.pot | 30 ++- scripts/custom_models/create_index.py | 67 +++++-- ...construct-release-environments-versions.rb | 34 +++- scripts/trigger-build.rb | 2 +- .../components/invite_modal_base_spec.js | 72 +++---- .../{table/drawer => }/role_selector_spec.js | 4 +- .../table/drawer/role_details_drawer_spec.js | 47 ++++- .../components/table/drawer/utils_spec.js | 2 +- spec/frontend/members/mock_data.js | 2 +- spec/frontend/members/utils_spec.js | 23 +-- spec/lib/gitlab/internal_events_spec.rb | 1 + .../strategies/until_executed_spec.rb | 22 +- spec/models/packages/package_file_spec.rb | 2 +- .../release_environments_model_spec.rb | 47 +++-- .../merge_requests/update_service_spec.rb | 33 +++ .../strategy_shared_examples.rb | 85 ++++++++ 55 files changed, 841 insertions(+), 469 deletions(-) create mode 100644 .gitlab/ci/release-environments/security.gitlab-ci.yml rename app/assets/javascripts/members/components/{table/drawer => }/role_selector.vue (84%) create mode 100644 config/feature_flags/beta/store_first_reviewer_assignment_timestamp_in_metrics.yml create mode 100644 config/feature_flags/beta/use_sidekiq_dedup_lock.yml create mode 100644 db/migrate/20240705055935_add_mr_first_reviewer_assigned.rb create mode 100644 db/schema_migrations/20240705055935 delete mode 100644 doc/architecture/blueprints/_template.md rename spec/frontend/members/components/{table/drawer => }/role_selector_spec.js (94%) diff --git a/.gitlab/ci/cng/main.gitlab-ci.yml b/.gitlab/ci/cng/main.gitlab-ci.yml index 214669fa4d9..af33e3db637 100644 --- a/.gitlab/ci/cng/main.gitlab-ci.yml +++ b/.gitlab/ci/cng/main.gitlab-ci.yml @@ -1,3 +1,8 @@ +spec: + inputs: + cng_path: + type: string + default: 'build/CNG-mirror' --- default: interruptible: true @@ -61,6 +66,6 @@ include: TOP_UPSTREAM_MERGE_REQUEST_IID: "${TOP_UPSTREAM_MERGE_REQUEST_IID}" TOP_UPSTREAM_SOURCE_SHA: "${TOP_UPSTREAM_SOURCE_SHA}" trigger: - project: ${CI_PROJECT_NAMESPACE}/build/CNG-mirror + project: '${CI_PROJECT_NAMESPACE}/$[[ inputs.cng_path ]]' branch: $TRIGGER_BRANCH strategy: depend diff --git a/.gitlab/ci/release-environments.gitlab-ci.yml b/.gitlab/ci/release-environments.gitlab-ci.yml index a6a0e268451..bcd1a3b047c 100644 --- a/.gitlab/ci/release-environments.gitlab-ci.yml +++ b/.gitlab/ci/release-environments.gitlab-ci.yml @@ -26,3 +26,31 @@ start-release-environments-pipeline: - project: 'gitlab-org/gitlab' ref: 'master' file: '.gitlab/ci/release-environments/main.gitlab-ci.yml' + +start-release-environments-security-pipeline: + allow_failure: true + extends: + - .release-environments:rules:start-release-environments-security-pipeline + stage: release-environments + # We do not want to have ALL global variables passed as trigger variables, + # as they cannot be overridden. See this issue for more context: + # + # https://gitlab.com/gitlab-org/gitlab/-/issues/387183 + inherit: + variables: + - RUBY_VERSION_DEFAULT + - RUBY_VERSION_NEXT + - RUBY_VERSION + + # These variables are set in the pipeline schedules. + # They need to be explicitly passed on to the child pipeline. + # https://docs.gitlab.com/ee/ci/pipelines/multi_project_pipelines.html#pass-cicd-variables-to-a-downstream-pipeline-by-using-the-variables-keyword + variables: + # This is needed by `release-environments-build-cng-env` (`.gitlab/ci/release-environments/security.gitlab-ci.yml`). + PARENT_PIPELINE_ID: $CI_PIPELINE_ID + trigger: + strategy: depend + include: + - project: 'gitlab-org/security/gitlab' + ref: 'master' + file: '.gitlab/ci/release-environments/security.gitlab-ci.yml' diff --git a/.gitlab/ci/release-environments/main.gitlab-ci.yml b/.gitlab/ci/release-environments/main.gitlab-ci.yml index e174a12fea2..a8a05965132 100644 --- a/.gitlab/ci/release-environments/main.gitlab-ci.yml +++ b/.gitlab/ci/release-environments/main.gitlab-ci.yml @@ -1,6 +1,8 @@ --- include: - local: .gitlab/ci/cng/main.gitlab-ci.yml + inputs: + cng_path: 'build/CNG-mirror' - project: 'gitlab-org/quality/pipeline-common' ref: '8.18.4' file: ci/base.gitlab-ci.yml @@ -95,7 +97,6 @@ release-environments-qa: GITLAB_INITIAL_ROOT_PASSWORD: "${RELEASE_ENVIRONMENTS_ROOT_PASSWORD}" QA_PRAEFECT_REPOSITORY_STORAGE: "default" SIGNUP_DISABLED: "true" - resource_group: release-environment-${CI_COMMIT_REF_SLUG} release-environments-notification-failure: stage: finish diff --git a/.gitlab/ci/release-environments/security.gitlab-ci.yml b/.gitlab/ci/release-environments/security.gitlab-ci.yml new file mode 100644 index 00000000000..0b68cab6e4b --- /dev/null +++ b/.gitlab/ci/release-environments/security.gitlab-ci.yml @@ -0,0 +1,143 @@ +# Similar to .gitlab/ci/release-environments/main.gitlab-ci.yml, for release-environment pipelines in the security mirror. +# Referenced in .gitlab/ci/release-environments.gitlab-ci.yml to differentiate from the canonical (main) version. +# This file includes .gitlab/ci/cng/security.gitlab-ci.yml, instead of .gitlab/ci/cng/main.gitlab-ci.yml. +--- +include: + - local: .gitlab/ci/cng/main.gitlab-ci.yml + inputs: + cng_path: 'charts/components/images' + - project: 'gitlab-org/quality/pipeline-common' + ref: '8.18.4' + file: ci/base.gitlab-ci.yml + +stages: + - prepare + - start + - deploy + - qa + - finish + +.inherit_variables: + inherit: + variables: + - GIT_DEPTH + - GIT_STRATEGY + +workflow: + auto_cancel: + on_new_commit: none + +variables: + GIT_DEPTH: 20 + GIT_STRATEGY: fetch + +release-environments-build-cng-env: + extends: .build-cng-env + +release-environments-build-cng: + extends: .build-cng + needs: ["release-environments-build-cng-env"] + variables: + IMAGE_TAG_EXT: "-${CI_COMMIT_SHORT_SHA}" + +release-environments-deploy-env: + stage: prepare + needs: ["release-environments-build-cng"] + variables: + DEPLOY_ENV: deploy.env + script: + - ./scripts/release_environment/construct-release-environments-versions.rb + artifacts: + reports: + dotenv: $DEPLOY_ENV + paths: + - $DEPLOY_ENV + expire_in: 7 days + when: always + +release-environments-update-resource-group: + stage: prepare + script: + # Make sure pipelines run in order + # See https://docs.gitlab.com/ee/ci/resource_groups/index.html#change-the-process-mode + - | + curl --request PUT --data "process_mode=oldest_first" --header "PRIVATE-TOKEN:${ENVIRONMENT_API_TOKEN}" \ + "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/resource_groups/release-environment-${CI_COMMIT_REF_SLUG}" + +release-environments-notification-start: + stage: start + extends: .inherit_variables + variables: + RELEASE_ENVIRONMENT_NOTIFICATION_TYPE: "deploy" + script: + - ruby scripts/release_environment/notification.rb + needs: ["release-environments-deploy-env"] + +release-environments-deploy: + stage: deploy + inherit: + variables: false + variables: + VERSIONS: "${VERSIONS}" + ENVIRONMENT: "${ENVIRONMENT}" + trigger: + project: gitlab-com/gl-infra/release-environments + branch: main + strategy: depend + needs: ["release-environments-deploy-env"] + resource_group: release-environment-${CI_COMMIT_REF_SLUG} + +release-environments-qa: + stage: qa + extends: + - .qa-base + timeout: 30m + parallel: 5 + variables: + QA_SCENARIO: "Test::Instance::Smoke" + RELEASE: "${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab-ee-qa:${CI_COMMIT_SHA}" + GITLAB_QA_OPTS: --address "https://gitlab.${ENVIRONMENT}.release.gke.gitlab.net" + GITLAB_INITIAL_ROOT_PASSWORD: "${RELEASE_ENVIRONMENTS_ROOT_PASSWORD}" + QA_PRAEFECT_REPOSITORY_STORAGE: "default" + SIGNUP_DISABLED: "true" + before_script: + - !reference [.qa-base, before_script] + - echo "$CI_REGISTRY_PASSWORD" | docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin + +release-environments-notification-failure: + stage: finish + extends: .inherit_variables + variables: + RELEASE_ENVIRONMENT_NOTIFICATION_TYPE: "deploy" + script: + - ruby scripts/release_environment/notification.rb + needs: + - job: release-environments-deploy + artifacts: false + - job: release-environments-deploy-env + when: on_failure + +release-environments-notification-success: + stage: finish + extends: .inherit_variables + variables: + RELEASE_ENVIRONMENT_NOTIFICATION_TYPE: "deploy" + script: + - ruby scripts/release_environment/notification.rb + needs: + - job: release-environments-qa + artifacts: false + - job: release-environments-deploy-env + +release-environments-notification-qa-failure: + stage: finish + extends: .inherit_variables + variables: + RELEASE_ENVIRONMENT_NOTIFICATION_TYPE: "qa" + script: + - ruby scripts/release_environment/notification.rb + needs: + - job: release-environments-qa + artifacts: false + - job: release-environments-deploy-env + when: on_failure diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml index 20fbbcd9ace..ddea2cf48ca 100644 --- a/.gitlab/ci/rules.gitlab-ci.yml +++ b/.gitlab/ci/rules.gitlab-ci.yml @@ -176,6 +176,9 @@ .if-dot-com-gitlab-org-ee-tag: &if-dot-com-gitlab-org-ee-tag if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_COMMIT_TAG =~ /^v?[\d]+\.[\d]+\.[\d]+[\d\w-]*-ee$/' +.if-dot-com-gitlab-org-security-ee-tag: &if-dot-com-gitlab-org-security-ee-tag + if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/security/gitlab" && $CI_COMMIT_TAG =~ /^v?[\d]+\.[\d]+\.[\d]+[\d\w-]*-ee$/' + .if-ruby-branch: &if-ruby-branch if: '$CI_COMMIT_BRANCH =~ /^ruby\d+(_\d)*$/ || (($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby\d+(_\d)*/)' @@ -951,6 +954,7 @@ ARCH: amd64,arm64 - !reference [".build-images:rules:build-qa-image-merge-requests", rules] - !reference [".releases:rules:canonical-dot-com-gitlab-stable-branch-only-setup-test-env", rules] + - !reference [".releases:rules:canonical-dot-com-security-gitlab-stable-branch-only-setup-test-env", rules] .build-images:rules:build-qa-image-as-if-foss: rules: @@ -1685,6 +1689,8 @@ - !reference [".qa:rules:package-and-test-never-run", rules] - <<: *if-fork-merge-request when: never + - <<: *if-merge-request-targeting-stable-branch + when: never - <<: *if-merge-request-labels-run-cs-evaluation # Otherwise, only run in pipeline::tier-2 and above - !reference [".prevent-tier-1", rules] @@ -2531,6 +2537,13 @@ when: never - if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/security/gitlab" && $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable-ee$/' +.releases:rules:canonical-dot-com-security-gitlab-stable-branch-only-setup-test-env: + rules: + - if: '$CI_COMMIT_MESSAGE =~ /\[merge-train skip\]/' + when: never + - if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/security/gitlab" && $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable-ee$/' + changes: *setup-test-env-patterns + ################# # Reports rules # ################# @@ -3282,6 +3295,16 @@ when: always - !reference [".releases:rules:canonical-dot-com-gitlab-stable-branch-only", rules] +.release-environments:rules:start-release-environments-security-pipeline: + rules: + - <<: *if-not-ee + when: never + - <<: *if-merge-request-labels-pipeline-expedite + when: never + - <<: *if-dot-com-gitlab-org-security-ee-tag + when: always + - !reference [".releases:rules:canonical-dot-com-security-gitlab-stable-branch-only", rules] + ################### # Benchmark rules # ################### diff --git a/app/assets/javascripts/access_level/constants.js b/app/assets/javascripts/access_level/constants.js index 8a6cb8ce4c7..c53fa472b36 100644 --- a/app/assets/javascripts/access_level/constants.js +++ b/app/assets/javascripts/access_level/constants.js @@ -1,4 +1,4 @@ -import { __ } from '~/locale'; +import { __, s__ } from '~/locale'; // Matches `lib/gitlab/access.rb` export const ACCESS_LEVEL_NO_ACCESS_INTEGER = 0; @@ -19,16 +19,66 @@ const ACCESS_LEVEL_MAINTAINER = __('Maintainer'); const ACCESS_LEVEL_OWNER = __('Owner'); export const BASE_ROLES = [ - { value: 'GUEST', text: ACCESS_LEVEL_GUEST }, - { value: 'REPORTER', text: ACCESS_LEVEL_REPORTER }, - { value: 'DEVELOPER', text: ACCESS_LEVEL_DEVELOPER }, - { value: 'MAINTAINER', text: ACCESS_LEVEL_MAINTAINER }, - { value: 'OWNER', text: ACCESS_LEVEL_OWNER }, -]; - -export const BASE_ROLES_INC_MINIMAL_ACCESS = [ - { value: 'MINIMAL_ACCESS', text: ACCESS_LEVEL_MINIMAL_ACCESS }, - ...BASE_ROLES, + { + value: 'MINIMAL_ACCESS', + text: ACCESS_LEVEL_MINIMAL_ACCESS, + accessLevel: ACCESS_LEVEL_MINIMAL_ACCESS_INTEGER, + memberRoleId: null, + occupiesSeat: false, + description: s__( + 'MemberRole|The Minimal Access role is for users who need the least amount of access into groups and projects. You can assign this role as a default, before giving a user another role with more permissions.', + ), + }, + { + value: 'GUEST', + text: ACCESS_LEVEL_GUEST, + accessLevel: ACCESS_LEVEL_GUEST_INTEGER, + memberRoleId: null, + occupiesSeat: false, + description: s__( + 'MemberRole|The Guest role is for users who need visibility into a project or group but should not have the ability to make changes, such as external stakeholders.', + ), + }, + { + value: 'REPORTER', + text: ACCESS_LEVEL_REPORTER, + accessLevel: ACCESS_LEVEL_REPORTER_INTEGER, + memberRoleId: null, + occupiesSeat: true, + description: s__( + 'MemberRole|The Reporter role is suitable for team members who need to stay informed about a project or group but do not actively contribute code.', + ), + }, + { + value: 'DEVELOPER', + text: ACCESS_LEVEL_DEVELOPER, + accessLevel: ACCESS_LEVEL_DEVELOPER_INTEGER, + memberRoleId: null, + occupiesSeat: true, + description: s__( + 'MemberRole|The Developer role strikes a balance between giving users the necessary access to contribute code while restricting sensitive administrative actions.', + ), + }, + { + value: 'MAINTAINER', + text: ACCESS_LEVEL_MAINTAINER, + accessLevel: ACCESS_LEVEL_MAINTAINER_INTEGER, + memberRoleId: null, + occupiesSeat: true, + description: s__( + 'MemberRole|The Maintainer role is primarily used for managing code reviews, approvals, and administrative settings for projects. This role can also manage project memberships.', + ), + }, + { + value: 'OWNER', + text: ACCESS_LEVEL_OWNER, + accessLevel: ACCESS_LEVEL_OWNER_INTEGER, + memberRoleId: null, + occupiesSeat: true, + description: s__( + 'MemberRole|The Owner role is normally assigned to the individual or team responsible for managing and maintaining the group or creating the project. This role has the highest level of administrative control, and can manage all aspects of the group or project, including managing other Owners.', + ), + }, ]; export const ACCESS_LEVEL_LABELS = { diff --git a/app/assets/javascripts/analytics/shared/constants.js b/app/assets/javascripts/analytics/shared/constants.js index 498a582b0e4..2c81c3145f8 100644 --- a/app/assets/javascripts/analytics/shared/constants.js +++ b/app/assets/javascripts/analytics/shared/constants.js @@ -212,7 +212,9 @@ export const METRIC_TOOLTIPS = { }), }, [VULNERABILITY_METRICS.CRITICAL]: { - description: s__('ValueStreamAnalytics|Critical vulnerabilities over time.'), + description: s__( + 'ValueStreamAnalytics|Number of critical vulnerabilities identified per month.', + ), groupLink: '-/security/vulnerabilities?severity=CRITICAL', projectLink: '-/security/vulnerability_report?severity=CRITICAL', docsLink: helpPagePath('user/application_security/vulnerabilities/severities.html'), @@ -224,7 +226,7 @@ export const METRIC_TOOLTIPS = { docsLink: helpPagePath('user/application_security/vulnerabilities/severities.html'), }, [MERGE_REQUEST_METRICS.THROUGHPUT]: { - description: s__('ValueStreamAnalytics|The number of merge requests merged by month.'), + description: s__('ValueStreamAnalytics|Number of merge requests merged by month.'), groupLink: '-/analytics/productivity_analytics', projectLink: `-/analytics/merge_request_analytics?start_date=${formatDateParam( mrThroughputStartDate, diff --git a/app/assets/javascripts/invite_members/components/invite_modal_base.vue b/app/assets/javascripts/invite_members/components/invite_modal_base.vue index c14cc371fa7..4827871f0ac 100644 --- a/app/assets/javascripts/invite_members/components/invite_modal_base.vue +++ b/app/assets/javascripts/invite_members/components/invite_modal_base.vue @@ -1,18 +1,11 @@