diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index b61336e57c1..046e403397a 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -2290,6 +2290,7 @@
   rules:
     - <<: *if-merge-request
       changes: ["**/*click_house*"]
+    - <<: *if-merge-request-labels-run-all-rspec
 
 #########################
 # Static analysis rules #
diff --git a/.rubocop_todo/style/redundant_freeze.yml b/.rubocop_todo/style/redundant_freeze.yml
index a637a2dc28f..12c9200bf54 100644
--- a/.rubocop_todo/style/redundant_freeze.yml
+++ b/.rubocop_todo/style/redundant_freeze.yml
@@ -2,54 +2,6 @@
 # Cop supports --autocorrect.
 Style/RedundantFreeze:
   Exclude:
-    - 'app/controllers/help_controller.rb'
-    - 'app/controllers/import/bitbucket_server_controller.rb'
-    - 'app/finders/issuable_finder.rb'
-    - 'app/finders/repositories/changelog_commits_finder.rb'
-    - 'app/helpers/auth_helper.rb'
-    - 'app/helpers/colors_helper.rb'
-    - 'app/helpers/sidekiq_helper.rb'
-    - 'app/models/application_setting_implementation.rb'
-    - 'app/models/badge.rb'
-    - 'app/models/blob_viewer/go_mod.rb'
-    - 'app/models/ci/runner.rb'
-    - 'app/models/commit.rb'
-    - 'app/models/commit_range.rb'
-    - 'app/models/concerns/ci/maskable.rb'
-    - 'app/models/concerns/pg_full_text_searchable.rb'
-    - 'app/models/concerns/redactable.rb'
-    - 'app/models/concerns/taskable.rb'
-    - 'app/models/custom_emoji.rb'
-    - 'app/models/environment_status.rb'
-    - 'app/models/error_tracking/project_error_tracking_setting.rb'
-    - 'app/models/hooks/web_hook.rb'
-    - 'app/models/integrations/apple_app_store.rb'
-    - 'app/models/integrations/chat_message/base_message.rb'
-    - 'app/models/integrations/confluence.rb'
-    - 'app/models/integrations/datadog.rb'
-    - 'app/models/integrations/discord.rb'
-    - 'app/models/integrations/teamcity.rb'
-    - 'app/models/license_template.rb'
-    - 'app/models/members/group_member.rb'
-    - 'app/models/members/project_member.rb'
-    - 'app/models/merge_request.rb'
-    - 'app/models/namespaces/randomized_suffix_path.rb'
-    - 'app/models/note.rb'
-    - 'app/models/packages/debian.rb'
-    - 'app/models/packages/debian/file_entry.rb'
-    - 'app/models/personal_access_token.rb'
-    - 'app/models/releases/link.rb'
-    - 'app/models/snippet_repository.rb'
-    - 'app/models/terraform/state.rb'
-    - 'app/services/clusters/agent_tokens/track_usage_service.rb'
-    - 'app/services/import/validate_remote_git_endpoint_service.rb'
-    - 'app/services/issues/base_service.rb'
-    - 'app/services/projects/import_error_filter.rb'
-    - 'app/services/projects/lfs_pointers/lfs_object_download_list_service.rb'
-    - 'app/uploaders/file_uploader.rb'
-    - 'app/validators/certificate_fingerprint_validator.rb'
-    - 'app/validators/json_schema_validator.rb'
-    - 'app/validators/line_code_validator.rb'
     - 'lib/api/api.rb'
     - 'lib/api/debian_group_packages.rb'
     - 'lib/api/go_proxy.rb'
diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 3eedc2dac46..9e8cbaab078 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-f1d2afbee25a73855d931ad2d406e04e2062dc96
+5688f0d78dfb631f600868b80e8bfa9f13834f65
diff --git a/Gemfile b/Gemfile
index b116ea0345c..111131e04ff 100644
--- a/Gemfile
+++ b/Gemfile
@@ -496,7 +496,7 @@ group :test do
   gem 'gitlab_quality-test_tooling', '~> 0.9.3', require: false
 end
 
-gem 'octokit', '~> 4.15'
+gem 'octokit', '~> 6.0'
 
 gem 'gitlab-mail_room', '~> 0.0.23', require: 'mail_room'
 
diff --git a/Gemfile.checksum b/Gemfile.checksum
index 8bd050f828d..4bd3126c7d1 100644
--- a/Gemfile.checksum
+++ b/Gemfile.checksum
@@ -96,7 +96,7 @@
 {"name":"crystalball","version":"0.7.0","platform":"ruby","checksum":"6e729f372a5071daec877adb40c5df4cb25fe21f350635e2a9624373fc151ef2"},
 {"name":"css_parser","version":"1.14.0","platform":"ruby","checksum":"f2ce6148cd505297b07bdbe7a5db4cce5cf530071f9b732b9a23538d6cdc0113"},
 {"name":"cvss-suite","version":"3.0.1","platform":"ruby","checksum":"b5ca9e9e94032a42fd0dc28c1e305378b62c949e35ed7111fc4a1d76f68ad3f9"},
-{"name":"danger","version":"8.6.1","platform":"ruby","checksum":"d95eb58b41f68d3aaa9bbef697916b6b4d161a38819517c98562531be75cdfd8"},
+{"name":"danger","version":"9.3.1","platform":"ruby","checksum":"9070fbac181eb45fb9b69ea25e6ea4faa86796ef33bf8d00346cab4385e51df5"},
 {"name":"danger-gitlab","version":"8.0.0","platform":"ruby","checksum":"497dd7d0f6513913de651019223d8058cf494df10acbd17de92b175dfa04a3a8"},
 {"name":"database_cleaner","version":"1.7.0","platform":"ruby","checksum":"bdf833c197afac7054015bcde2567c3834c366bbfe6a377c30151ca984b32016"},
 {"name":"date","version":"3.3.3","platform":"java","checksum":"584e0a582d1eb2207b4eaac089d8a43f2ca10bea02682f286099642f15c56cce"},
@@ -204,7 +204,7 @@
 {"name":"gettext","version":"3.3.6","platform":"ruby","checksum":"ee6bbd1b2f833ee52d7797fa68acbfecc4726aec6b6280fd7eab92aa0190b413"},
 {"name":"gettext_i18n_rails","version":"1.11.0","platform":"ruby","checksum":"e19c7e4a256c500f7f38396dca44a282b9838ae278f57c362993a54964b22bbe"},
 {"name":"gettext_i18n_rails_js","version":"1.3.0","platform":"ruby","checksum":"5d10afe4be3639bff78c50a56768c20f39aecdabc580c08aa45573911c2bd687"},
-{"name":"git","version":"1.11.0","platform":"ruby","checksum":"7e95ba4da8298a0373ef1a6862aa22007d761f3c8274b675aa787966fecea0f1"},
+{"name":"git","version":"1.18.0","platform":"ruby","checksum":"c9b80462e4565cd3d7a9ba8440c41d2c52244b17b0dad0bfddb46de70630c465"},
 {"name":"gitaly","version":"16.3.0.pre.rc1","platform":"ruby","checksum":"55d9cc414a4f3859588f3770bd88d7c67c0f5454a1178b018b7a6f6913674c43"},
 {"name":"gitlab","version":"4.19.0","platform":"ruby","checksum":"3f645e3e195dbc24f0834fbf83e8ccfb2056d8e9712b01a640aad418a6949679"},
 {"name":"gitlab-chronic","version":"0.10.5","platform":"ruby","checksum":"f80f18dc699b708870a80685243331290bc10cfeedb6b99c92219722f729c875"},
@@ -406,7 +406,7 @@
 {"name":"numerizer","version":"0.2.0","platform":"ruby","checksum":"e58076d5ee5370417b7e52d9cb25836d62acd1b8d9a194c308707986c1705d7b"},
 {"name":"oauth","version":"0.5.6","platform":"ruby","checksum":"4085fe28e0c5e2434135e00a6555294fd2a4ff96a98d1bdecdcd619fc6368dff"},
 {"name":"oauth2","version":"2.0.9","platform":"ruby","checksum":"b21f9defcf52dc1610e0dfab4c868342173dcd707fd15c777d9f4f04e153f7fb"},
-{"name":"octokit","version":"4.25.1","platform":"ruby","checksum":"c02092ee82dcdfe84db0e0ea630a70d32becc54245a4f0bacfd21c010df09b96"},
+{"name":"octokit","version":"6.1.1","platform":"ruby","checksum":"920e4a9d820205f70738f58de6a7e6ef0e2f25b27db954b5806a63105207b0bf"},
 {"name":"ohai","version":"17.9.0","platform":"ruby","checksum":"c59cf16124c0a6481fb85013ec7ec5b398651b6abed782d3e06ab058ce9a5406"},
 {"name":"oj","version":"3.13.23","platform":"ruby","checksum":"206dfdc4020ad9974705037f269cfba211d61b7662a58c717cce771829ccef51"},
 {"name":"oj-introspect","version":"0.7.2","platform":"ruby","checksum":"c415a44567ed2870d8e963a69421d9322128e194fab7867e37e54d5a25d5333d"},
diff --git a/Gemfile.lock b/Gemfile.lock
index c3bccda1433..ee916862c50 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -389,18 +389,18 @@ GEM
     css_parser (1.14.0)
       addressable
     cvss-suite (3.0.1)
-    danger (8.6.1)
+    danger (9.3.1)
       claide (~> 1.0)
       claide-plugins (>= 0.9.2)
       colored2 (~> 3.1)
       cork (~> 0.1)
-      faraday (>= 0.9.0, < 2.0)
+      faraday (>= 0.9.0, < 3.0)
       faraday-http-cache (~> 2.0)
-      git (~> 1.7)
+      git (~> 1.13)
       kramdown (~> 2.3)
       kramdown-parser-gfm (~> 1.0)
       no_proxy_fix
-      octokit (~> 4.7)
+      octokit (~> 6.0)
       terminal-table (>= 1, < 4)
     danger-gitlab (8.0.0)
       danger
@@ -634,7 +634,8 @@ GEM
       gettext_i18n_rails (>= 0.7.1)
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
-    git (1.11.0)
+    git (1.18.0)
+      addressable (~> 2.8)
       rchardet (~> 1.8)
     gitaly (16.3.0.pre.rc1)
       grpc (~> 1.0)
@@ -1074,7 +1075,7 @@ GEM
       rack (>= 1.2, < 4)
       snaky_hash (~> 2.0)
       version_gem (~> 1.1)
-    octokit (4.25.1)
+    octokit (6.1.1)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
     ohai (17.9.0)
@@ -1911,7 +1912,7 @@ DEPENDENCIES
   net-protocol (~> 0.1.3)
   nokogiri (~> 1.15, >= 1.15.4)
   oauth2 (~> 2.0)
-  octokit (~> 4.15)
+  octokit (~> 6.0)
   ohai (~> 17.9)
   oj (~> 3.13.21)
   oj-introspect (~> 0.7)
diff --git a/app/assets/javascripts/ci/pipeline_details/pipeline_details_bundle.js b/app/assets/javascripts/ci/pipeline_details/pipeline_details_bundle.js
index c4cc6939121..da09852a7f4 100644
--- a/app/assets/javascripts/ci/pipeline_details/pipeline_details_bundle.js
+++ b/app/assets/javascripts/ci/pipeline_details/pipeline_details_bundle.js
@@ -33,10 +33,16 @@ export default async function initPipelineDetailsBundle() {
 
   if (tabsEl) {
     const { dataset } = tabsEl;
+    const dismissalDescriptions = JSON.parse(dataset.dismissalDescriptions || '{}');
     const { createAppOptions } = await import('ee_else_ce/ci/pipeline_details/pipeline_tabs');
     const { createPipelineTabs } = await import('./pipeline_tabs');
     const { routes } = await import('ee_else_ce/ci/pipeline_details/routes');
 
+    const securityRoute = routes.find((route) => route.path === '/security');
+    if (securityRoute) {
+      securityRoute.props = { dismissalDescriptions };
+    }
+
     const router = new VueRouter({
       mode: 'history',
       base: dataset.pipelinePath,
diff --git a/app/assets/javascripts/ci/pipeline_editor/components/file_nav/pipeline_editor_file_nav.vue b/app/assets/javascripts/ci/pipeline_editor/components/file_nav/pipeline_editor_file_nav.vue
index da165413341..20b42e26f08 100644
--- a/app/assets/javascripts/ci/pipeline_editor/components/file_nav/pipeline_editor_file_nav.vue
+++ b/app/assets/javascripts/ci/pipeline_editor/components/file_nav/pipeline_editor_file_nav.vue
@@ -52,7 +52,7 @@ export default {
 };
 </script>
 <template>
-  <div class="gl-display-flex gl-flex-wrap gl-gap-3">
+  <div class="gl-display-flex gl-flex-wrap gl-gap-3 gl-mb-4">
     <gl-button
       v-if="showFileTreeToggle"
       id="file-tree-toggle"
diff --git a/app/assets/javascripts/ci/pipeline_editor/components/header/pipeline_editor_header.vue b/app/assets/javascripts/ci/pipeline_editor/components/header/pipeline_editor_header.vue
index eecf8e42f4b..665ca907ed9 100644
--- a/app/assets/javascripts/ci/pipeline_editor/components/header/pipeline_editor_header.vue
+++ b/app/assets/javascripts/ci/pipeline_editor/components/header/pipeline_editor_header.vue
@@ -33,7 +33,7 @@ export default {
 </script>
 <template>
   <gl-card
-    class="gl-new-card gl-mb-3"
+    class="gl-new-card gl-mb-3 gl-mt-0"
     header-class="gl-new-card-header"
     body-class="gl-new-card-body gl-py-4 gl-px-5"
   >
diff --git a/app/assets/javascripts/merge_requests/components/compare_app.vue b/app/assets/javascripts/merge_requests/components/compare_app.vue
index 8e02048f494..20c95174989 100644
--- a/app/assets/javascripts/merge_requests/components/compare_app.vue
+++ b/app/assets/javascripts/merge_requests/components/compare_app.vue
@@ -23,9 +23,6 @@ export default {
     currentProject: {
       default: () => ({}),
     },
-    currentBranch: {
-      default: () => ({}),
-    },
     inputs: {
       default: () => ({}),
     },
@@ -39,6 +36,13 @@ export default {
       default: '',
     },
   },
+  props: {
+    currentBranch: {
+      type: Object,
+      required: false,
+      default: () => ({}),
+    },
+  },
   data() {
     return {
       selectedProject: this.currentProject,
@@ -57,6 +61,12 @@ export default {
       return this.commitHtml || this.loading || !this.selectedBranch.value;
     },
   },
+  watch: {
+    currentBranch(newVal) {
+      this.selectedBranch = newVal;
+      this.fetchCommit();
+    },
+  },
   mounted() {
     this.fetchCommit();
   },
@@ -67,6 +77,7 @@ export default {
     selectBranch(branch) {
       this.selectedBranch = branch;
       this.fetchCommit();
+      this.$emit('select-branch', branch.value);
     },
     async fetchCommit() {
       if (!this.selectedBranch.value) return;
@@ -109,6 +120,7 @@ export default {
           :default="currentBranch"
           :toggle-class="toggleClass.branch"
           :qa-selector="branchQaSelector"
+          data-testid="compare-dropdown"
           @selected="selectBranch"
         />
       </div>
diff --git a/app/assets/javascripts/merge_requests/components/compare_dropdown.vue b/app/assets/javascripts/merge_requests/components/compare_dropdown.vue
index a5a4e683214..6f46b41ee5b 100644
--- a/app/assets/javascripts/merge_requests/components/compare_dropdown.vue
+++ b/app/assets/javascripts/merge_requests/components/compare_dropdown.vue
@@ -70,6 +70,12 @@ export default {
       );
     },
   },
+  watch: {
+    default(newVal) {
+      this.current = newVal;
+      this.selected = newVal.value;
+    },
+  },
   methods: {
     async fetchData() {
       if (!this.endpoint) return;
diff --git a/app/assets/javascripts/pages/projects/merge_requests/creations/new/branch_finder.js b/app/assets/javascripts/pages/projects/merge_requests/creations/new/branch_finder.js
new file mode 100644
index 00000000000..ee84f54978a
--- /dev/null
+++ b/app/assets/javascripts/pages/projects/merge_requests/creations/new/branch_finder.js
@@ -0,0 +1 @@
+export const findTargetBranch = async () => {};
diff --git a/app/assets/javascripts/pages/projects/merge_requests/creations/new/index.js b/app/assets/javascripts/pages/projects/merge_requests/creations/new/index.js
index f71a1041068..9db400b3b0a 100644
--- a/app/assets/javascripts/pages/projects/merge_requests/creations/new/index.js
+++ b/app/assets/javascripts/pages/projects/merge_requests/creations/new/index.js
@@ -2,6 +2,8 @@ import Vue from 'vue';
 
 import { mountMarkdownEditor } from 'ee_else_ce/vue_shared/components/markdown/mount_markdown_editor';
 
+import { findTargetBranch } from 'ee_else_ce/pages/projects/merge_requests/creations/new/branch_finder';
+
 import initPipelines from '~/commit/pipelines/pipelines_bundle';
 import MergeRequest from '~/merge_request';
 import CompareApp from '~/merge_requests/components/compare_app.vue';
@@ -13,14 +15,15 @@ if (mrNewCompareNode) {
   const targetCompareEl = document.getElementById('js-target-project-dropdown');
   const sourceCompareEl = document.getElementById('js-source-project-dropdown');
   const compareEl = document.querySelector('.js-merge-request-new-compare');
+  const targetBranch = Vue.observable({ name: '' });
 
+  const currentSourceBranch = JSON.parse(sourceCompareEl.dataset.currentBranch);
   // eslint-disable-next-line no-new
   new Vue({
     el: sourceCompareEl,
     name: 'SourceCompareApp',
     provide: {
       currentProject: JSON.parse(sourceCompareEl.dataset.currentProject),
-      currentBranch: JSON.parse(sourceCompareEl.dataset.currentBranch),
       branchCommitPath: compareEl.dataset.sourceBranchUrl,
       inputs: {
         project: {
@@ -42,18 +45,34 @@ if (mrNewCompareNode) {
       },
       branchQaSelector: 'source_branch_dropdown',
     },
+    methods: {
+      async selectedBranch(branchName) {
+        const targetBranchName = await findTargetBranch(branchName);
+
+        if (targetBranchName) {
+          targetBranch.name = targetBranchName;
+        }
+      },
+    },
     render(h) {
-      return h(CompareApp);
+      return h(CompareApp, {
+        props: {
+          currentBranch: currentSourceBranch,
+        },
+        on: {
+          'select-branch': this.selectedBranch,
+        },
+      });
     },
   });
 
+  const currentTargetBranch = JSON.parse(targetCompareEl.dataset.currentBranch);
   // eslint-disable-next-line no-new
   new Vue({
     el: targetCompareEl,
     name: 'TargetCompareApp',
     provide: {
       currentProject: JSON.parse(targetCompareEl.dataset.currentProject),
-      currentBranch: JSON.parse(targetCompareEl.dataset.currentBranch),
       projectsPath: targetCompareEl.dataset.targetProjectsPath,
       branchCommitPath: compareEl.dataset.targetBranchUrl,
       inputs: {
@@ -75,8 +94,17 @@ if (mrNewCompareNode) {
         branch: 'js-target-branch gl-font-monospace',
       },
     },
+    computed: {
+      currentBranch() {
+        if (targetBranch.name) {
+          return { text: targetBranch.name, value: targetBranch.name };
+        }
+
+        return currentTargetBranch;
+      },
+    },
     render(h) {
-      return h(CompareApp);
+      return h(CompareApp, { props: { currentBranch: this.currentBranch } });
     },
   });
 } else {
diff --git a/app/assets/javascripts/projects/settings_service_desk/components/custom_email_form.vue b/app/assets/javascripts/projects/settings_service_desk/components/custom_email_form.vue
index 3ce41121100..09bc275cbd4 100644
--- a/app/assets/javascripts/projects/settings_service_desk/components/custom_email_form.vue
+++ b/app/assets/javascripts/projects/settings_service_desk/components/custom_email_form.vue
@@ -1,5 +1,14 @@
 <script>
-import { GlButton, GlForm, GlFormGroup, GlFormInputGroup, GlFormInput } from '@gitlab/ui';
+import {
+  GlButton,
+  GlForm,
+  GlFormGroup,
+  GlFormInputGroup,
+  GlFormInput,
+  GlLink,
+  GlSprintf,
+} from '@gitlab/ui';
+import { helpPagePath } from '~/helpers/help_page_helper';
 import { isEmptyValue, hasMinimumLength, isIntegerGreaterThan, isEmail } from '~/lib/utils/forms';
 import ClipboardButton from '~/vue_shared/components/clipboard_button.vue';
 import {
@@ -23,6 +32,9 @@ import {
 } from '../custom_email_constants';
 
 export default {
+  customEmailHelpUrl: helpPagePath('user/project/service_desk/configure.html', {
+    anchor: 'custom-email-address',
+  }),
   components: {
     ClipboardButton,
     GlButton,
@@ -30,6 +42,8 @@ export default {
     GlFormGroup,
     GlFormInputGroup,
     GlFormInput,
+    GlLink,
+    GlSprintf,
   },
   I18N_FORM_INTRODUCTION_PARAGRAPH,
   I18N_FORM_CUSTOM_EMAIL_LABEL,
@@ -137,7 +151,19 @@ export default {
 
 <template>
   <div>
-    <p>{{ $options.I18N_FORM_INTRODUCTION_PARAGRAPH }}</p>
+    <p>
+      <gl-sprintf :message="$options.I18N_FORM_INTRODUCTION_PARAGRAPH">
+        <template #link="{ content }">
+          <gl-link
+            :href="$options.customEmailHelpUrl"
+            class="gl-display-inline-block"
+            target="_blank"
+          >
+            {{ content }}
+          </gl-link>
+        </template>
+      </gl-sprintf>
+    </p>
     <gl-form class="js-quick-submit" @submit.prevent="onSubmit">
       <gl-form-group
         :label="$options.I18N_FORM_FORWARDING_LABEL"
diff --git a/app/assets/javascripts/projects/settings_service_desk/components/custom_email_wrapper.vue b/app/assets/javascripts/projects/settings_service_desk/components/custom_email_wrapper.vue
index 7e040e6001a..03ba99bcf71 100644
--- a/app/assets/javascripts/projects/settings_service_desk/components/custom_email_wrapper.vue
+++ b/app/assets/javascripts/projects/settings_service_desk/components/custom_email_wrapper.vue
@@ -233,6 +233,7 @@ export default {
               <gl-link
                 :href="$options.FEEDBACK_ISSUE_URL"
                 target="_blank"
+                data-testid="feedback-link"
                 class="gl-text-blue-600 font-size-inherit"
                 >{{ content }}
               </gl-link>
diff --git a/app/assets/javascripts/projects/settings_service_desk/custom_email_constants.js b/app/assets/javascripts/projects/settings_service_desk/custom_email_constants.js
index cdf2e53982e..aafd77bd25e 100644
--- a/app/assets/javascripts/projects/settings_service_desk/custom_email_constants.js
+++ b/app/assets/javascripts/projects/settings_service_desk/custom_email_constants.js
@@ -17,7 +17,7 @@ export const I18N_TOAST_ENABLED = s__('ServiceDesk|Custom email enabled.');
 export const I18N_TOAST_DISABLED = s__('ServiceDesk|Custom email disabled.');
 
 export const I18N_FORM_INTRODUCTION_PARAGRAPH = s__(
-  'ServiceDesk|Connect a custom email address your customers can use to create Service Desk issues. Forward all emails from your custom email address to the Service Desk email address of this project. GitLab will send Service Desk emails from the custom address on your behalf using your SMTP credentials.',
+  'ServiceDesk|Connect a custom email address your customers can use to create Service Desk issues. Forward all emails from your custom email address to the Service Desk email address of this project. GitLab will send Service Desk emails from the custom address on your behalf using your SMTP credentials. %{linkStart}Learn more about prerequisites and the verification process%{linkEnd}.',
 );
 export const I18N_FORM_FORWARDING_LABEL = s__(
   'ServiceDesk|Service Desk email address to forward emails to',
diff --git a/app/assets/javascripts/super_sidebar/components/nav_item.vue b/app/assets/javascripts/super_sidebar/components/nav_item.vue
index 93e004f0328..46735c2c70a 100644
--- a/app/assets/javascripts/super_sidebar/components/nav_item.vue
+++ b/app/assets/javascripts/super_sidebar/components/nav_item.vue
@@ -1,6 +1,6 @@
 <script>
 import { GlAvatar, GlButton, GlIcon, GlBadge, GlTooltipDirective } from '@gitlab/ui';
-import { s__ } from '~/locale';
+import { s__, sprintf } from '~/locale';
 import {
   CLICK_MENU_ITEM_ACTION,
   CLICK_PINNED_MENU_ITEM_ACTION,
@@ -12,7 +12,9 @@ import NavItemRouterLink from './nav_item_router_link.vue';
 
 export default {
   i18n: {
+    pin: s__('Navigation|Pin %{title}'),
     pinItem: s__('Navigation|Pin item'),
+    unpin: s__('Navigation|Unpin %{title}'),
     unpinItem: s__('Navigation|Unpin item'),
   },
   name: 'NavItem',
@@ -143,6 +145,16 @@ export default {
     avatarShape() {
       return this.item.avatar_shape || 'rect';
     },
+    pinAriaLabel() {
+      return sprintf(this.$options.i18n.pin, {
+        title: this.item.title,
+      });
+    },
+    unpinAriaLabel() {
+      return sprintf(this.$options.i18n.unpin, {
+        title: this.item.title,
+      });
+    },
   },
   mounted() {
     if (this.item.is_active) {
@@ -151,26 +163,27 @@ export default {
   },
   methods: {
     togglePointerEvents() {
-      if (this.isMouseIn) {
-        this.canClickPinButton = true;
-      } else {
-        this.canClickPinButton = false;
-      }
+      this.canClickPinButton = this.isMouseIn;
     },
   },
 };
 </script>
 
 <template>
-  <li @mouseenter="isMouseIn = true" @mouseleave="isMouseIn = false">
+  <li
+    class="gl-relative show-on-focus-or-hover--context hide-on-focus-or-hover--context transition-opacity-on-hover--context"
+    data-testid="nav-item"
+    @mouseenter="isMouseIn = true"
+    @mouseleave="isMouseIn = false"
+  >
     <component
       :is="navItemLinkComponent"
       #default="{ isActive }"
       v-bind="linkProps"
-      class="nav-item-link gl-relative gl-display-flex gl-align-items-center gl-min-h-7 gl-gap-3 gl-mb-1 gl-py-2 gl-text-black-normal! gl-hover-bg-t-gray-a-08 gl-focus-bg-t-gray-a-08 gl-text-decoration-none! gl-focus--focus show-on-focus-or-hover--context"
+      class="gl-relative gl-display-flex gl-align-items-center gl-min-h-7 gl-gap-3 gl-mb-1 gl-py-2 gl-text-black-normal! gl-hover-bg-t-gray-a-08 gl-focus-bg-t-gray-a-08 gl-text-decoration-none! gl-focus--focus show-on-focus-or-hover--control hide-on-focus-or-hover--control"
       :class="computedLinkClasses"
-      data-qa-selector="nav_item_link"
       data-testid="nav-item-link"
+      data-qa-selector="nav_item_link"
     >
       <div
         :class="[isActive ? 'gl-opacity-10' : 'gl-opacity-0']"
@@ -204,41 +217,47 @@ export default {
         </div>
       </div>
       <slot name="actions"></slot>
-      <span v-if="hasPill || isPinnable" class="gl-text-right gl-relative gl-min-w-8">
+      <span v-if="hasPill" class="gl-text-right gl-relative gl-min-w-8">
         <gl-badge
           v-if="hasPill"
           size="sm"
           variant="neutral"
           class="gl-bg-t-gray-a-08!"
-          :class="{ 'nav-item-badge gl-absolute gl-right-0 gl-top-2': isPinnable }"
+          :class="{
+            'hide-on-focus-or-hover--target transition-opacity-on-hover--target': isPinnable,
+          }"
         >
           {{ pillData }}
         </gl-badge>
-        <gl-button
-          v-if="isPinnable && !isPinned"
-          v-gl-tooltip.ds500.right.viewport="$options.i18n.pinItem"
-          size="small"
-          category="tertiary"
-          icon="thumbtack"
-          class="show-on-focus-or-hover--target"
-          :class="{ 'gl-pointer-events-none': !canClickPinButton }"
-          :aria-label="$options.i18n.pinItem"
-          @click.prevent="$emit('pin-add', item.id)"
-          @transitionend="togglePointerEvents"
-        />
-        <gl-button
-          v-else-if="isPinnable && isPinned"
-          v-gl-tooltip.ds500.right.viewport="$options.i18n.unpinItem"
-          size="small"
-          category="tertiary"
-          :aria-label="$options.i18n.unpinItem"
-          icon="thumbtack-solid"
-          class="show-on-focus-or-hover--target"
-          :class="{ 'gl-pointer-events-none': !canClickPinButton }"
-          @click.prevent="$emit('pin-remove', item.id)"
-          @transitionend="togglePointerEvents"
-        />
       </span>
     </component>
+    <template v-if="isPinnable">
+      <gl-button
+        v-if="isPinned"
+        v-gl-tooltip.noninteractive.ds500.right.viewport="$options.i18n.unpinItem"
+        :aria-label="unpinAriaLabel"
+        category="tertiary"
+        class="show-on-focus-or-hover--target transition-opacity-on-hover--target always-animate gl-absolute gl-right-3 gl-top-2"
+        :class="{ 'gl-pointer-events-none': !canClickPinButton }"
+        data-testid="nav-item-unpin"
+        icon="thumbtack-solid"
+        size="small"
+        @click="$emit('pin-remove', item.id)"
+        @transitionend="togglePointerEvents"
+      />
+      <gl-button
+        v-else
+        v-gl-tooltip.noninteractive.ds500.right.viewport="$options.i18n.pinItem"
+        :aria-label="pinAriaLabel"
+        category="tertiary"
+        class="show-on-focus-or-hover--target transition-opacity-on-hover--target always-animate gl-absolute gl-right-3 gl-top-2"
+        :class="{ 'gl-pointer-events-none': !canClickPinButton }"
+        data-testid="nav-item-pin"
+        icon="thumbtack"
+        size="small"
+        @click="$emit('pin-add', item.id)"
+        @transitionend="togglePointerEvents"
+      />
+    </template>
   </li>
 </template>
diff --git a/app/assets/javascripts/super_sidebar/components/super_sidebar.vue b/app/assets/javascripts/super_sidebar/components/super_sidebar.vue
index 2c939487784..83c0419664a 100644
--- a/app/assets/javascripts/super_sidebar/components/super_sidebar.vue
+++ b/app/assets/javascripts/super_sidebar/components/super_sidebar.vue
@@ -150,7 +150,7 @@ export default {
       <user-bar :has-collapse-button="!showOverlay" :sidebar-data="sidebarData" />
       <div v-if="showTrialStatusWidget" class="gl-px-2 gl-py-2">
         <trial-status-widget
-          class="gl-rounded-base gl-relative gl-display-flex gl-align-items-center gl-mb-1 gl-px-3 gl-line-height-normal gl-text-black-normal! gl-hover-bg-t-gray-a-08 gl-focus-bg-t-gray-a-08 gl-text-decoration-none! nav-item-link gl-py-3"
+          class="gl-rounded-base gl-relative gl-display-flex gl-align-items-center gl-mb-1 gl-px-3 gl-line-height-normal gl-text-black-normal! gl-hover-bg-t-gray-a-08 gl-focus-bg-t-gray-a-08 gl-text-decoration-none! gl-py-3"
         />
         <trial-status-popover />
       </div>
diff --git a/app/assets/stylesheets/disable_animations.scss b/app/assets/stylesheets/disable_animations.scss
index 1566425ad42..7472340896f 100644
--- a/app/assets/stylesheets/disable_animations.scss
+++ b/app/assets/stylesheets/disable_animations.scss
@@ -1,6 +1,6 @@
 *:not(
   /* Keep transition enabled where it would otherwise break specs */
-  .nav-item-link .show-on-focus-or-hover--target /* for spec/features/nav/pinned_nav_items_spec.rb */
+  .always-animate
 ) {
   /* stylelint-disable property-no-vendor-prefix */
   -o-transition: none !important;
diff --git a/app/assets/stylesheets/framework/super_sidebar.scss b/app/assets/stylesheets/framework/super_sidebar.scss
index 75031cac416..a4ad8635c3e 100644
--- a/app/assets/stylesheets/framework/super_sidebar.scss
+++ b/app/assets/stylesheets/framework/super_sidebar.scss
@@ -158,23 +158,6 @@ $super-sidebar-transition-hint-duration: $super-sidebar-transition-duration / 4;
     }
   }
 
-  .nav-item-link {
-    button.show-on-focus-or-hover--target {
-      transition: opacity $gl-transition-duration-fast;
-    }
-
-    &:hover,
-    &:focus-within {
-      .nav-item-badge {
-        opacity: 0;
-      }
-
-      button.show-on-focus-or-hover--target {
-        transition-delay: $gl-transition-duration-slow;
-      }
-    }
-  }
-
   #trial-status-sidebar-widget:hover {
     text-decoration: none;
     @include gl-text-contrast-light;
@@ -320,19 +303,71 @@ $super-sidebar-transition-hint-duration: $super-sidebar-transition-duration / 4;
   }
 }
 
+.transition-opacity-on-hover--context {
+  .transition-opacity-on-hover--target {
+    transition: opacity $gl-transition-duration-fast linear;
+
+    &:hover {
+      transition-delay: $gl-transition-duration-slow;
+    }
+  }
+
+  &:hover {
+    .transition-opacity-on-hover--target {
+      transition-delay: $gl-transition-duration-slow;
+    }
+  }
+}
+
 .show-on-focus-or-hover--context {
   .show-on-focus-or-hover--target {
     opacity: 0;
+
+    &:hover,
+    &:focus {
+      opacity: 1;
+    }
   }
 
   &:hover,
-  &:focus {
+  &:focus-within {
+    .show-on-focus-or-hover--control {
+      @include gl-bg-t-gray-a-08;
+    }
+
     .show-on-focus-or-hover--target {
       opacity: 1;
     }
   }
 
-  .show-on-focus-or-hover--target:focus {
-    opacity: 1;
+  .show-on-focus-or-hover--control {
+    &:hover,
+    &:focus {
+      + .show-on-focus-or-hover--target {
+        opacity: 1;
+      }
+    }
+  }
+}
+
+.hide-on-focus-or-hover--context {
+  .hide-on-focus-or-hover--target {
+    opacity: 1;
+  }
+
+  &:hover,
+  &:focus-within {
+    .hide-on-focus-or-hover--target {
+      opacity: 0;
+    }
+  }
+
+  .hide-on-focus-or-hover--control {
+    &:hover,
+    &:focus {
+      .hide-on-focus-or-hover--target {
+        opacity: 0;
+      }
+    }
   }
 }
diff --git a/app/controllers/help_controller.rb b/app/controllers/help_controller.rb
index 9635e476510..df8128f24fe 100644
--- a/app/controllers/help_controller.rb
+++ b/app/controllers/help_controller.rb
@@ -9,7 +9,7 @@ class HelpController < ApplicationController
 
   # Taken from Jekyll
   # https://github.com/jekyll/jekyll/blob/3.5-stable/lib/jekyll/document.rb#L13
-  YAML_FRONT_MATTER_REGEXP = /\A(---\s*\n.*?\n?)^((---|\.\.\.)\s*$\n?)/m.freeze
+  YAML_FRONT_MATTER_REGEXP = /\A(---\s*\n.*?\n?)^((---|\.\.\.)\s*$\n?)/m
 
   def index
     @help_index = get_markdown_without_frontmatter(path_to_doc('index.md'))
diff --git a/app/controllers/import/bitbucket_server_controller.rb b/app/controllers/import/bitbucket_server_controller.rb
index e17cd00d053..ba2743e1002 100644
--- a/app/controllers/import/bitbucket_server_controller.rb
+++ b/app/controllers/import/bitbucket_server_controller.rb
@@ -22,8 +22,8 @@ class Import::BitbucketServerController < Import::BaseController
   # (https://community.atlassian.com/t5/Answers-Developer-Questions/stash-repository-names/qaq-p/499054)
   #
   # Bitbucket Server starts personal project names with a tilde.
-  VALID_BITBUCKET_PROJECT_CHARS = /\A~?[\w\-\.\s]+\z/.freeze
-  VALID_BITBUCKET_CHARS = /\A[\w\-\.\s]+\z/.freeze
+  VALID_BITBUCKET_PROJECT_CHARS = /\A~?[\w\-\.\s]+\z/
+  VALID_BITBUCKET_CHARS = /\A[\w\-\.\s]+\z/
 
   def new
   end
diff --git a/app/finders/issuable_finder.rb b/app/finders/issuable_finder.rb
index bbbf14bb0d0..93b7292bb69 100644
--- a/app/finders/issuable_finder.rb
+++ b/app/finders/issuable_finder.rb
@@ -48,7 +48,7 @@ class IssuableFinder
   requires_cross_project_access unless: -> { params.project? }
 
   FULL_TEXT_SEARCH_TERM_PATTERN = '[\u0000-\u02FF\u1E00-\u1EFF\u2070-\u218F]*'
-  FULL_TEXT_SEARCH_TERM_REGEX = /\A#{FULL_TEXT_SEARCH_TERM_PATTERN}\z/.freeze
+  FULL_TEXT_SEARCH_TERM_REGEX = /\A#{FULL_TEXT_SEARCH_TERM_PATTERN}\z/
   NEGATABLE_PARAMS_HELPER_KEYS = %i[project_id scope status include_subgroups].freeze
 
   attr_accessor :current_user, :params
diff --git a/app/finders/repositories/changelog_commits_finder.rb b/app/finders/repositories/changelog_commits_finder.rb
index b80b8e94e59..863a1186205 100644
--- a/app/finders/repositories/changelog_commits_finder.rb
+++ b/app/finders/repositories/changelog_commits_finder.rb
@@ -21,7 +21,7 @@ module Repositories
     COMMITS_PER_PAGE = 1024
 
     # The regex to use for extracting the SHA of a reverted commit.
-    REVERT_REGEX = /^This reverts commit (?<sha>[0-9a-f]{40})/i.freeze
+    REVERT_REGEX = /^This reverts commit (?<sha>[0-9a-f]{40})/i
 
     # The `project` argument specifies the project for which to obtain the
     # commits.
diff --git a/app/helpers/auth_helper.rb b/app/helpers/auth_helper.rb
index 6218cb28dc1..0e3a3413427 100644
--- a/app/helpers/auth_helper.rb
+++ b/app/helpers/auth_helper.rb
@@ -19,7 +19,7 @@ module AuthHelper
     shibboleth
     twitter
   ].freeze
-  LDAP_PROVIDER = /\Aldap/.freeze
+  LDAP_PROVIDER = /\Aldap/
   POPULAR_PROVIDERS = %w[google_oauth2 github].freeze
 
   delegate :slack_app_id, to: :'Gitlab::CurrentSettings.current_application_settings'
diff --git a/app/helpers/colors_helper.rb b/app/helpers/colors_helper.rb
index 80cf6f197e5..3cd7263c39e 100644
--- a/app/helpers/colors_helper.rb
+++ b/app/helpers/colors_helper.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module ColorsHelper
-  HEX_COLOR_PATTERN = /\A\#(?:[0-9A-Fa-f]{3}){1,2}\Z/.freeze
+  HEX_COLOR_PATTERN = /\A\#(?:[0-9A-Fa-f]{3}){1,2}\Z/
 
   def hex_color_to_rgb_array(hex_color)
     unless hex_color.is_a?(String) && HEX_COLOR_PATTERN.match?(hex_color)
diff --git a/app/helpers/merge_requests_helper.rb b/app/helpers/merge_requests_helper.rb
index b018c03eefd..a90a16e120c 100644
--- a/app/helpers/merge_requests_helper.rb
+++ b/app/helpers/merge_requests_helper.rb
@@ -226,6 +226,13 @@ module MergeRequestsHelper
     }
   end
 
+  def mr_compare_form_data(_, merge_request)
+    {
+      source_branch_url: project_new_merge_request_branch_from_path(merge_request.source_project),
+      target_branch_url: project_new_merge_request_branch_to_path(merge_request.source_project)
+    }
+  end
+
   private
 
   def review_requested_merge_requests_count
diff --git a/app/helpers/sidekiq_helper.rb b/app/helpers/sidekiq_helper.rb
index 07d83b8d850..21aa82aff1c 100644
--- a/app/helpers/sidekiq_helper.rb
+++ b/app/helpers/sidekiq_helper.rb
@@ -8,7 +8,7 @@ module SidekiqHelper
     (?<state>[DIEKNRSTVWXZLpsl\+<>/\d]+)\s+
     (?<start>.+?)\s+
     (?<command>(?:ruby\d+:\s+)?sidekiq.*\].*)
-    \z}x.freeze
+    \z}x
 
   def parse_sidekiq_ps(line)
     match = line.strip.match(SIDEKIQ_PS_REGEXP)
diff --git a/app/models/analytics/cycle_analytics/runtime_limiter.rb b/app/models/analytics/cycle_analytics/runtime_limiter.rb
new file mode 100644
index 00000000000..063377c3ddb
--- /dev/null
+++ b/app/models/analytics/cycle_analytics/runtime_limiter.rb
@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Analytics
+  module CycleAnalytics
+    class RuntimeLimiter
+      delegate :monotonic_time, to: :'Gitlab::Metrics::System'
+
+      DEFAULT_MAX_RUNTIME = 200.seconds
+
+      attr_reader :max_runtime, :start_time
+
+      def initialize(max_runtime = DEFAULT_MAX_RUNTIME)
+        @start_time = monotonic_time
+        @max_runtime = max_runtime
+      end
+
+      def elapsed_time
+        monotonic_time - start_time
+      end
+
+      def over_time?
+        @last_check = elapsed_time >= max_runtime
+      end
+
+      def was_over_time?
+        !!@last_check
+      end
+    end
+  end
+end
diff --git a/app/models/application_setting_implementation.rb b/app/models/application_setting_implementation.rb
index d441140cd4f..657fdee3ca0 100644
--- a/app/models/application_setting_implementation.rb
+++ b/app/models/application_setting_implementation.rb
@@ -9,7 +9,7 @@ module ApplicationSettingImplementation
                             \s              # any whitespace character
                             |               # or
                             [\r\n]          # any number of newline characters
-                          }x.freeze
+                          }x
 
   # Setting a key restriction to `-1` means that all keys of this type are
   # forbidden.
diff --git a/app/models/badge.rb b/app/models/badge.rb
index 23e6f305c32..f4e719887ba 100644
--- a/app/models/badge.rb
+++ b/app/models/badge.rb
@@ -18,7 +18,7 @@ class Badge < ApplicationRecord
   # This regex is built dynamically using the keys from the PLACEHOLDER struct.
   # So, we can easily add new placeholder just by modifying the PLACEHOLDER hash.
   # This regex will build the new PLACEHOLDER_REGEX with the new information
-  PLACEHOLDERS_REGEX = /(#{PLACEHOLDERS.keys.join('|')})/.freeze
+  PLACEHOLDERS_REGEX = /(#{PLACEHOLDERS.keys.join('|')})/
 
   default_scope { order_created_at_asc } # rubocop:disable Cop/DefaultScope
 
diff --git a/app/models/blob_viewer/go_mod.rb b/app/models/blob_viewer/go_mod.rb
index 777511a5c3c..eebf057c6dc 100644
--- a/app/models/blob_viewer/go_mod.rb
+++ b/app/models/blob_viewer/go_mod.rb
@@ -11,7 +11,7 @@ module BlobViewer
       (?<name>.*?) (?# module name)
       \s*(?://.*)? (?# comment)
       (?:\n|\z) (?# newline or end of file)
-    }x.freeze
+    }x
 
     self.file_types = %i[go_mod go_sum]
 
diff --git a/app/models/bulk_imports/batch_tracker.rb b/app/models/bulk_imports/batch_tracker.rb
index 2e79d41d46e..eb7fe9f9913 100644
--- a/app/models/bulk_imports/batch_tracker.rb
+++ b/app/models/bulk_imports/batch_tracker.rb
@@ -18,6 +18,8 @@ module BulkImports
 
       event :start do
         transition created: :started
+        # To avoid errors when re-starting a pipeline in case of network errors
+        transition started: :started
       end
 
       event :retry do
diff --git a/app/models/ci/runner.rb b/app/models/ci/runner.rb
index 36b45d15921..05d50625583 100644
--- a/app/models/ci/runner.rb
+++ b/app/models/ci/runner.rb
@@ -52,7 +52,7 @@ module Ci
     RUNNER_QUEUE_EXPIRY_TIME = 1.hour
 
     # The `UPDATE_CONTACT_COLUMN_EVERY` defines how often the Runner DB entry can be updated
-    UPDATE_CONTACT_COLUMN_EVERY = (40.minutes..55.minutes).freeze
+    UPDATE_CONTACT_COLUMN_EVERY = (40.minutes..55.minutes)
 
     # The `STALE_TIMEOUT` constant defines the how far past the last contact or creation date a runner will be considered stale
     STALE_TIMEOUT = 3.months
diff --git a/app/models/commit.rb b/app/models/commit.rb
index df4b9e0ff70..39e12b53f21 100644
--- a/app/models/commit.rb
+++ b/app/models/commit.rb
@@ -30,10 +30,10 @@ class Commit
 
   MIN_SHA_LENGTH = Gitlab::Git::Commit::MIN_SHA_LENGTH
   MAX_SHA_LENGTH = Gitlab::Git::Commit::MAX_SHA_LENGTH
-  COMMIT_SHA_PATTERN = Gitlab::Git::Commit::SHA_PATTERN.freeze
-  EXACT_COMMIT_SHA_PATTERN = /\A#{COMMIT_SHA_PATTERN}\z/.freeze
+  COMMIT_SHA_PATTERN = Gitlab::Git::Commit::SHA_PATTERN
+  EXACT_COMMIT_SHA_PATTERN = /\A#{COMMIT_SHA_PATTERN}\z/
   # Used by GFM to match and present link extensions on node texts and hrefs.
-  LINK_EXTENSION_PATTERN = /(patch)/.freeze
+  LINK_EXTENSION_PATTERN = /(patch)/
 
   DEFAULT_MAX_DIFF_LINES_SETTING = 50_000
   DEFAULT_MAX_DIFF_FILES_SETTING = 1_000
@@ -539,7 +539,7 @@ class Commit
   #   added by `git commit --fixup` which is used by some community members.
   #   https://gitlab.com/gitlab-org/gitlab/-/issues/342937#note_892065311
   #
-  DRAFT_REGEX = /\A\s*#{Gitlab::Regex.merge_request_draft}|(fixup!|squash!)\s/.freeze
+  DRAFT_REGEX = /\A\s*#{Gitlab::Regex.merge_request_draft}|(fixup!|squash!)\s/
 
   def draft?
     !!(title =~ DRAFT_REGEX)
diff --git a/app/models/commit_range.rb b/app/models/commit_range.rb
index d882a185464..cb24297f2c8 100644
--- a/app/models/commit_range.rb
+++ b/app/models/commit_range.rb
@@ -28,11 +28,11 @@ class CommitRange
 
   # The beginning and ending refs can be named or SHAs, and
   # the range notation can be double- or triple-dot.
-  REF_PATTERN = /[0-9a-zA-Z][0-9a-zA-Z_.-]*[0-9a-zA-Z\^]/.freeze
-  PATTERN = /#{REF_PATTERN}\.{2,3}#{REF_PATTERN}/.freeze
+  REF_PATTERN = /[0-9a-zA-Z][0-9a-zA-Z_.-]*[0-9a-zA-Z\^]/
+  PATTERN = /#{REF_PATTERN}\.{2,3}#{REF_PATTERN}/
 
   # In text references, the beginning and ending refs can only be valid SHAs.
-  STRICT_PATTERN = /#{Gitlab::Git::Commit::RAW_SHA_PATTERN}\.{2,3}#{Gitlab::Git::Commit::RAW_SHA_PATTERN}/.freeze
+  STRICT_PATTERN = /#{Gitlab::Git::Commit::RAW_SHA_PATTERN}\.{2,3}#{Gitlab::Git::Commit::RAW_SHA_PATTERN}/
 
   def self.reference_prefix
     '@'
diff --git a/app/models/concerns/ci/maskable.rb b/app/models/concerns/ci/maskable.rb
index e2cef0981d1..15240385dd8 100644
--- a/app/models/concerns/ci/maskable.rb
+++ b/app/models/concerns/ci/maskable.rb
@@ -11,12 +11,12 @@ module Ci
     # * Minimal length of 8 characters
     # * Characters must be from the Base64 alphabet (RFC4648) with the addition of '@', ':', '.', and '~'
     # * Absolutely no fun is allowed
-    REGEX = %r{\A[a-zA-Z0-9_+=/@:.~-]{8,}\z}.freeze
+    REGEX = %r{\A[a-zA-Z0-9_+=/@:.~-]{8,}\z}
     # * Single line
     # * No spaces
     # * Minimal length of 8 characters
     # * Some fun is allowed
-    MASK_AND_RAW_REGEX = %r{\A\S{8,}\z}.freeze
+    MASK_AND_RAW_REGEX = %r{\A\S{8,}\z}
 
     included do
       validates :masked, inclusion: { in: [true, false] }
diff --git a/app/models/concerns/pg_full_text_searchable.rb b/app/models/concerns/pg_full_text_searchable.rb
index 562c8cf23f3..b7ca6f61573 100644
--- a/app/models/concerns/pg_full_text_searchable.rb
+++ b/app/models/concerns/pg_full_text_searchable.rb
@@ -21,11 +21,11 @@
 module PgFullTextSearchable
   extend ActiveSupport::Concern
 
-  LONG_WORDS_REGEX = %r([A-Za-z0-9+/@]{50,}).freeze
+  LONG_WORDS_REGEX = %r([A-Za-z0-9+/@]{50,})
   TSVECTOR_MAX_LENGTH = 1.megabyte.freeze
   TEXT_SEARCH_DICTIONARY = 'english'
-  URL_SCHEME_REGEX = %r{(?<=\A|\W)\w+://(?=\w+)}.freeze
-  TSQUERY_DISALLOWED_CHARACTERS_REGEX = %r{[^a-zA-Z0-9 .@/\-_"]}.freeze
+  URL_SCHEME_REGEX = %r{(?<=\A|\W)\w+://(?=\w+)}
+  TSQUERY_DISALLOWED_CHARACTERS_REGEX = %r{[^a-zA-Z0-9 .@/\-_"]}
 
   def update_search_data!
     tsvector_sql_nodes = self.class.pg_full_text_searchable_columns.map do |column, weight|
diff --git a/app/models/concerns/redactable.rb b/app/models/concerns/redactable.rb
index 53ae300ee2d..5ad96d6cc46 100644
--- a/app/models/concerns/redactable.rb
+++ b/app/models/concerns/redactable.rb
@@ -10,7 +10,7 @@
 module Redactable
   extend ActiveSupport::Concern
 
-  UNSUBSCRIBE_PATTERN = %r{/sent_notifications/\h{32}/unsubscribe}.freeze
+  UNSUBSCRIBE_PATTERN = %r{/sent_notifications/\h{32}/unsubscribe}
 
   class_methods do
     def redact_field(field)
diff --git a/app/models/concerns/taskable.rb b/app/models/concerns/taskable.rb
index bf645e99b5e..96f684522d2 100644
--- a/app/models/concerns/taskable.rb
+++ b/app/models/concerns/taskable.rb
@@ -11,8 +11,8 @@ require 'task_list/filter'
 module Taskable
   COMPLETED          = 'completed'
   INCOMPLETE         = 'incomplete'
-  COMPLETE_PATTERN   = /\[[xX]\]/.freeze
-  INCOMPLETE_PATTERN = /\[[[:space:]]\]/.freeze
+  COMPLETE_PATTERN   = /\[[xX]\]/
+  INCOMPLETE_PATTERN = /\[[[:space:]]\]/
   ITEM_PATTERN       = %r{
     ^
     (?:(?:>\s{0,4})*)               # optional blockquote characters
@@ -22,7 +22,7 @@ module Taskable
       #{COMPLETE_PATTERN}|#{INCOMPLETE_PATTERN}
     )
     (\s.+)                          # followed by whitespace and some text.
-  }x.freeze
+  }x
 
   ITEM_PATTERN_UNTRUSTED =
     '^' \
diff --git a/app/models/custom_emoji.rb b/app/models/custom_emoji.rb
index 625d68925c6..c704795130b 100644
--- a/app/models/custom_emoji.rb
+++ b/app/models/custom_emoji.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class CustomEmoji < ApplicationRecord
-  NAME_REGEXP = /[a-z0-9_-]+/.freeze
+  NAME_REGEXP = /[a-z0-9_-]+/
 
   belongs_to :namespace, inverse_of: :custom_emoji
 
diff --git a/app/models/environment_status.rb b/app/models/environment_status.rb
index db26f326cb8..f31615f2b3b 100644
--- a/app/models/environment_status.rb
+++ b/app/models/environment_status.rb
@@ -79,7 +79,7 @@ class EnvironmentStatus
 
   private
 
-  PAGE_EXTENSIONS = /\A\.(s?html?|php|asp|cgi|pl)\z/i.freeze
+  PAGE_EXTENSIONS = /\A\.(s?html?|php|asp|cgi|pl)\z/i
 
   def deployment_metrics
     @deployment_metrics ||= DeploymentMetrics.new(project, deployment)
diff --git a/app/models/error_tracking/project_error_tracking_setting.rb b/app/models/error_tracking/project_error_tracking_setting.rb
index c52f8a58c00..318538be645 100644
--- a/app/models/error_tracking/project_error_tracking_setting.rb
+++ b/app/models/error_tracking/project_error_tracking_setting.rb
@@ -19,7 +19,7 @@ module ErrorTracking
           (?<project>[^/]+)/*
         )?
       \z
-    }x.freeze
+    }x
 
     self.reactive_cache_key = ->(setting) { [setting.class.model_name.singular, setting.project_id] }
     self.reactive_cache_work_type = :external_dependency
diff --git a/app/models/event.rb b/app/models/event.rb
index 9e26efe11de..9e4a662aaa5 100644
--- a/app/models/event.rb
+++ b/app/models/event.rb
@@ -10,6 +10,7 @@ class Event < ApplicationRecord
   include UsageStatistics
   include ShaAttribute
   include IgnorableColumns
+  include EachBatch
 
   ignore_column :target_id_convert_to_bigint, remove_with: '16.4', remove_after: '2023-09-22'
 
diff --git a/app/models/hooks/web_hook.rb b/app/models/hooks/web_hook.rb
index d7a95363337..c0bfe31fb38 100644
--- a/app/models/hooks/web_hook.rb
+++ b/app/models/hooks/web_hook.rb
@@ -103,7 +103,7 @@ class WebHook < ApplicationRecord
   end
 
   # See app/validators/json_schemas/web_hooks_url_variables.json
-  VARIABLE_REFERENCE_RE = /\{([A-Za-z]+[0-9]*(?:[._-][A-Za-z0-9]+)*)\}/.freeze
+  VARIABLE_REFERENCE_RE = /\{([A-Za-z]+[0-9]*(?:[._-][A-Za-z0-9]+)*)\}/
 
   def interpolated_url(url = self.url, url_variables = self.url_variables)
     return url unless url.include?('{')
diff --git a/app/models/integrations/apple_app_store.rb b/app/models/integrations/apple_app_store.rb
index 6f96626718f..ef12fc6bf6f 100644
--- a/app/models/integrations/apple_app_store.rb
+++ b/app/models/integrations/apple_app_store.rb
@@ -4,8 +4,8 @@ require 'app_store_connect'
 
 module Integrations
   class AppleAppStore < Integration
-    ISSUER_ID_REGEX = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/.freeze
-    KEY_ID_REGEX = /\A(?=.*[A-Z])(?=.*[0-9])[A-Z0-9]+\z/.freeze
+    ISSUER_ID_REGEX = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/
+    KEY_ID_REGEX = /\A(?=.*[A-Z])(?=.*[0-9])[A-Z0-9]+\z/
     IS_KEY_CONTENT_BASE64 = "true"
 
     SECTION_TYPE_APPLE_APP_STORE = 'apple_app_store'
diff --git a/app/models/integrations/chat_message/base_message.rb b/app/models/integrations/chat_message/base_message.rb
index 501b214a769..600f07b97f1 100644
--- a/app/models/integrations/chat_message/base_message.rb
+++ b/app/models/integrations/chat_message/base_message.rb
@@ -3,7 +3,7 @@
 module Integrations
   module ChatMessage
     class BaseMessage
-      RELATIVE_LINK_REGEX = %r{!\[[^\]]*\]\((/uploads/[^\)]*)\)}.freeze
+      RELATIVE_LINK_REGEX = %r{!\[[^\]]*\]\((/uploads/[^\)]*)\)}
 
       attr_reader :markdown
       attr_reader :user_full_name
diff --git a/app/models/integrations/confluence.rb b/app/models/integrations/confluence.rb
index ee4a5a036b9..eda8c37fc72 100644
--- a/app/models/integrations/confluence.rb
+++ b/app/models/integrations/confluence.rb
@@ -2,9 +2,9 @@
 
 module Integrations
   class Confluence < BaseThirdPartyWiki
-    VALID_SCHEME_MATCH = %r{\Ahttps?\Z}.freeze
-    VALID_HOST_MATCH = %r{\A.+\.atlassian\.net\Z}.freeze
-    VALID_PATH_MATCH = %r{\A/wiki(/|\Z)}.freeze
+    VALID_SCHEME_MATCH = %r{\Ahttps?\Z}
+    VALID_HOST_MATCH = %r{\A.+\.atlassian\.net\Z}
+    VALID_PATH_MATCH = %r{\A/wiki(/|\Z)}
 
     validates :confluence_url, presence: true, if: :activated?
     validate :validate_confluence_url_is_cloud, if: :activated?
diff --git a/app/models/integrations/datadog.rb b/app/models/integrations/datadog.rb
index c4986f76df9..b1f1361afcd 100644
--- a/app/models/integrations/datadog.rb
+++ b/app/models/integrations/datadog.rb
@@ -12,7 +12,7 @@ module Integrations
       pipeline build archive_trace
     ].freeze
 
-    TAG_KEY_VALUE_RE = %r{\A [\w-]+ : .*\S.* \z}x.freeze
+    TAG_KEY_VALUE_RE = %r{\A [\w-]+ : .*\S.* \z}x
 
     field :datadog_site,
       exposes_secrets: true,
diff --git a/app/models/integrations/discord.rb b/app/models/integrations/discord.rb
index d8743683c94..815e3669d78 100644
--- a/app/models/integrations/discord.rb
+++ b/app/models/integrations/discord.rb
@@ -4,7 +4,7 @@ require "discordrb/webhooks"
 
 module Integrations
   class Discord < BaseChatNotification
-    ATTACHMENT_REGEX = /: (?<entry>.*?)\n - (?<name>.*)\n*/.freeze
+    ATTACHMENT_REGEX = /: (?<entry>.*?)\n - (?<name>.*)\n*/
 
     field :webhook,
       section: SECTION_TYPE_CONNECTION,
diff --git a/app/models/integrations/teamcity.rb b/app/models/integrations/teamcity.rb
index e3f30e3ed1c..575c3b8a334 100644
--- a/app/models/integrations/teamcity.rb
+++ b/app/models/integrations/teamcity.rb
@@ -6,7 +6,7 @@ module Integrations
     include ReactivelyCached
     prepend EnableSslVerification
 
-    TEAMCITY_SAAS_HOSTNAME = /\A[^\.]+\.teamcity\.com\z/i.freeze
+    TEAMCITY_SAAS_HOSTNAME = /\A[^\.]+\.teamcity\.com\z/i
 
     field :teamcity_url,
       title: -> { s_('ProjectService|TeamCity server URL') },
diff --git a/app/models/license_template.rb b/app/models/license_template.rb
index 548066107c1..bfe2a8d379e 100644
--- a/app/models/license_template.rb
+++ b/app/models/license_template.rb
@@ -5,12 +5,12 @@ class LicenseTemplate
     %r{[\<\{\[]
       (project|description|
       one\sline\s.+\swhat\sit\sdoes\.) # matching the start and end is enough here
-    [\>\}\]]}xi.freeze
-  YEAR_TEMPLATE_REGEX = /[<{\[](year|yyyy)[>}\]]/i.freeze
+    [\>\}\]]}xi
+  YEAR_TEMPLATE_REGEX = /[<{\[](year|yyyy)[>}\]]/i
   FULLNAME_TEMPLATE_REGEX =
     %r{[\<\{\[]
       (fullname|name\sof\s(author|copyright\sowner))
-    [\>\}\]]}xi.freeze
+    [\>\}\]]}xi
 
   attr_reader :key, :name, :project, :category, :nickname, :url, :meta
 
diff --git a/app/models/members/group_member.rb b/app/models/members/group_member.rb
index ada89345a7f..8585320ef5a 100644
--- a/app/models/members/group_member.rb
+++ b/app/models/members/group_member.rb
@@ -5,7 +5,7 @@ class GroupMember < Member
   include CreatedAtFilterable
 
   SOURCE_TYPE = 'Namespace'
-  SOURCE_TYPE_FORMAT = /\ANamespace\z/.freeze
+  SOURCE_TYPE_FORMAT = /\ANamespace\z/
 
   belongs_to :group, foreign_key: 'source_id'
   alias_attribute :namespace_id, :source_id
diff --git a/app/models/members/project_member.rb b/app/models/members/project_member.rb
index e0fecf702de..d07e4f9e298 100644
--- a/app/models/members/project_member.rb
+++ b/app/models/members/project_member.rb
@@ -2,7 +2,7 @@
 
 class ProjectMember < Member
   SOURCE_TYPE = 'Project'
-  SOURCE_TYPE_FORMAT = /\AProject\z/.freeze
+  SOURCE_TYPE_FORMAT = /\AProject\z/
 
   belongs_to :project, foreign_key: 'source_id'
 
diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index 5edbddc8c49..fa7b62603d5 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -643,7 +643,7 @@ class MergeRequest < ApplicationRecord
     end
   end
 
-  DRAFT_REGEX = /\A*#{Gitlab::Regex.merge_request_draft}+\s*/i.freeze
+  DRAFT_REGEX = /\A*#{Gitlab::Regex.merge_request_draft}+\s*/i
 
   def self.draft?(title)
     !!(title =~ DRAFT_REGEX)
diff --git a/app/models/namespaces/randomized_suffix_path.rb b/app/models/namespaces/randomized_suffix_path.rb
index 586d7bff5c3..b22ba789688 100644
--- a/app/models/namespaces/randomized_suffix_path.rb
+++ b/app/models/namespaces/randomized_suffix_path.rb
@@ -3,7 +3,7 @@
 module Namespaces
   class RandomizedSuffixPath
     MAX_TRIES = 4
-    LEADING_ZEROS = /^0+/.freeze
+    LEADING_ZEROS = /^0+/
 
     def initialize(path)
       @path = path
diff --git a/app/models/note.rb b/app/models/note.rb
index 279708d8202..8fc45436dc7 100644
--- a/app/models/note.rb
+++ b/app/models/note.rb
@@ -28,7 +28,7 @@ class Note < ApplicationRecord
 
   ignore_column :id_convert_to_bigint, remove_with: '16.3', remove_after: '2023-08-22'
 
-  ISSUE_TASK_SYSTEM_NOTE_PATTERN = /\A.*marked\sthe\stask.+as\s(completed|incomplete).*\z/.freeze
+  ISSUE_TASK_SYSTEM_NOTE_PATTERN = /\A.*marked\sthe\stask.+as\s(completed|incomplete).*\z/
 
   cache_markdown_field :note, pipeline: :note, issuable_reference_expansion_enabled: true
 
diff --git a/app/models/packages/debian.rb b/app/models/packages/debian.rb
index 2b8d0a4f51e..1fe4e28146e 100644
--- a/app/models/packages/debian.rb
+++ b/app/models/packages/debian.rb
@@ -4,13 +4,13 @@ module Packages
   module Debian
     TEMPORARY_PACKAGE_NAME = 'debian-temporary-package'
 
-    DISTRIBUTION_REGEX = %r{[a-z0-9][a-z0-9.-]*}i.freeze
+    DISTRIBUTION_REGEX = %r{[a-z0-9][a-z0-9.-]*}i
     COMPONENT_REGEX = DISTRIBUTION_REGEX.freeze
-    ARCHITECTURE_REGEX = %r{[a-z0-9][-a-z0-9]*}.freeze
+    ARCHITECTURE_REGEX = %r{[a-z0-9][-a-z0-9]*}
 
-    LETTER_REGEX = %r{(lib)?[a-z0-9]}.freeze
+    LETTER_REGEX = %r{(lib)?[a-z0-9]}
 
-    EMPTY_FILE_SHA256 = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'.freeze
+    EMPTY_FILE_SHA256 = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
 
     INCOMING_PACKAGE_NAME = 'incoming'
 
diff --git a/app/models/packages/debian/file_entry.rb b/app/models/packages/debian/file_entry.rb
index 7ea0dfe8765..4ac621dcbd4 100644
--- a/app/models/packages/debian/file_entry.rb
+++ b/app/models/packages/debian/file_entry.rb
@@ -6,7 +6,7 @@ module Packages
       include ActiveModel::Model
 
       DIGESTS = %i[md5 sha1 sha256].freeze
-      FILENAME_REGEX = %r{\A[a-zA-Z0-9][a-zA-Z0-9_.~+-]*\z}.freeze
+      FILENAME_REGEX = %r{\A[a-zA-Z0-9][a-zA-Z0-9_.~+-]*\z}
 
       attr_accessor :filename,
         :size,
diff --git a/app/models/personal_access_token.rb b/app/models/personal_access_token.rb
index 08f725de980..4dfe7252a0c 100644
--- a/app/models/personal_access_token.rb
+++ b/app/models/personal_access_token.rb
@@ -14,7 +14,7 @@ class PersonalAccessToken < ApplicationRecord
     format_with_prefix: :prefix_from_application_current_settings
 
   # PATs are 20 characters + optional configurable settings prefix (0..20)
-  TOKEN_LENGTH_RANGE = (20..40).freeze
+  TOKEN_LENGTH_RANGE = (20..40)
   MAX_PERSONAL_ACCESS_TOKEN_LIFETIME_IN_DAYS = 365
 
   serialize :scopes, Array # rubocop:disable Cop/ActiveRecordSerialize
diff --git a/app/models/releases/link.rb b/app/models/releases/link.rb
index 84a794f9a4f..e088fe81f6e 100644
--- a/app/models/releases/link.rb
+++ b/app/models/releases/link.rb
@@ -8,7 +8,7 @@ module Releases
 
     # See https://gitlab.com/gitlab-org/gitlab/-/issues/218753
     # Regex modified to prevent catastrophic backtracking
-    FILEPATH_REGEX = %r{\A\/[^\/](?!.*\/\/.*)[\-\.\w\/]+[\da-zA-Z]+\z}.freeze
+    FILEPATH_REGEX = %r{\A\/[^\/](?!.*\/\/.*)[\-\.\w\/]+[\da-zA-Z]+\z}
     FILEPATH_MAX_LENGTH = 128
 
     validates :url, presence: true, addressable_url: { schemes: %w[http https ftp] }, uniqueness: { scope: :release }
diff --git a/app/models/review.rb b/app/models/review.rb
index d47aaf027ce..98e9a314df7 100644
--- a/app/models/review.rb
+++ b/app/models/review.rb
@@ -31,6 +31,10 @@ class Review < ApplicationRecord
   def user_mentions
     merge_request.user_mentions.where.not(note_id: nil)
   end
+
+  def from_merge_request_author?
+    merge_request.author_id == author_id
+  end
 end
 
 Review.prepend_mod
diff --git a/app/models/snippet_repository.rb b/app/models/snippet_repository.rb
index 9139dc22a94..a262802c8af 100644
--- a/app/models/snippet_repository.rb
+++ b/app/models/snippet_repository.rb
@@ -5,7 +5,7 @@ class SnippetRepository < ApplicationRecord
   include Shardable
 
   DEFAULT_EMPTY_FILE_NAME = 'snippetfile'
-  EMPTY_FILE_PATTERN = /^#{DEFAULT_EMPTY_FILE_NAME}(\d+)\.txt$/.freeze
+  EMPTY_FILE_PATTERN = /^#{DEFAULT_EMPTY_FILE_NAME}(\d+)\.txt$/
 
   CommitError = Class.new(StandardError)
   InvalidPathError = Class.new(CommitError)
diff --git a/app/models/terraform/state.rb b/app/models/terraform/state.rb
index ecd3e27a9c4..7caf3a1040b 100644
--- a/app/models/terraform/state.rb
+++ b/app/models/terraform/state.rb
@@ -5,7 +5,7 @@ module Terraform
     include UsageStatistics
     include AfterCommitQueue
 
-    HEX_REGEXP = %r{\A\h+\z}.freeze
+    HEX_REGEXP = %r{\A\h+\z}
     UUID_LENGTH = 32
 
     self.locking_column = :activerecord_lock_version
diff --git a/app/services/clusters/agent_tokens/track_usage_service.rb b/app/services/clusters/agent_tokens/track_usage_service.rb
index fdc79ac0f8b..18fe236c44d 100644
--- a/app/services/clusters/agent_tokens/track_usage_service.rb
+++ b/app/services/clusters/agent_tokens/track_usage_service.rb
@@ -4,7 +4,7 @@ module Clusters
   module AgentTokens
     class TrackUsageService
       # The `UPDATE_USED_COLUMN_EVERY` defines how often the token DB entry can be updated
-      UPDATE_USED_COLUMN_EVERY = (40.minutes..55.minutes).freeze
+      UPDATE_USED_COLUMN_EVERY = (40.minutes..55.minutes)
 
       delegate :agent, to: :token
 
diff --git a/app/services/import/validate_remote_git_endpoint_service.rb b/app/services/import/validate_remote_git_endpoint_service.rb
index 2886bd5c9b7..a994072c4aa 100644
--- a/app/services/import/validate_remote_git_endpoint_service.rb
+++ b/app/services/import/validate_remote_git_endpoint_service.rb
@@ -8,7 +8,7 @@ module Import
 
     GIT_SERVICE_NAME = "git-upload-pack"
     GIT_EXPECTED_FIRST_PACKET_LINE = "# service=#{GIT_SERVICE_NAME}"
-    GIT_BODY_MESSAGE_REGEXP = /^[0-9a-f]{4}#{GIT_EXPECTED_FIRST_PACKET_LINE}/.freeze
+    GIT_BODY_MESSAGE_REGEXP = /^[0-9a-f]{4}#{GIT_EXPECTED_FIRST_PACKET_LINE}/
     # https://github.com/git/git/blob/master/Documentation/technical/protocol-common.txt#L56-L59
     GIT_PROTOCOL_PKT_LEN = 4
     GIT_MINIMUM_RESPONSE_LENGTH = GIT_PROTOCOL_PKT_LEN + GIT_EXPECTED_FIRST_PACKET_LINE.length
diff --git a/app/services/issues/base_service.rb b/app/services/issues/base_service.rb
index 1b4e7583645..a5ae5854e33 100644
--- a/app/services/issues/base_service.rb
+++ b/app/services/issues/base_service.rb
@@ -21,7 +21,7 @@ module Issues
       Issues::CloseService
     end
 
-    NO_REBALANCING_NEEDED = ((RelativePositioning::MIN_POSITION * 0.9999)..(RelativePositioning::MAX_POSITION * 0.9999)).freeze
+    NO_REBALANCING_NEEDED = ((RelativePositioning::MIN_POSITION * 0.9999)..(RelativePositioning::MAX_POSITION * 0.9999))
 
     def rebalance_if_needed(issue)
       return unless issue
diff --git a/app/services/projects/import_error_filter.rb b/app/services/projects/import_error_filter.rb
index 737b794484d..a0fc5149bb4 100644
--- a/app/services/projects/import_error_filter.rb
+++ b/app/services/projects/import_error_filter.rb
@@ -4,7 +4,7 @@ module Projects
   # Used by project imports, it removes any potential paths
   # included in an error message that could be stored in the DB
   class ImportErrorFilter
-    ERROR_MESSAGE_FILTER = /[^\s]*#{File::SEPARATOR}[^\s]*(?=(\s|\z))/.freeze
+    ERROR_MESSAGE_FILTER = /[^\s]*#{File::SEPARATOR}[^\s]*(?=(\s|\z))/
     FILTER_MESSAGE = '[FILTERED]'
 
     def self.filter_message(message)
diff --git a/app/services/projects/lfs_pointers/lfs_object_download_list_service.rb b/app/services/projects/lfs_pointers/lfs_object_download_list_service.rb
index f52f8551834..0efe9fb16f6 100644
--- a/app/services/projects/lfs_pointers/lfs_object_download_list_service.rb
+++ b/app/services/projects/lfs_pointers/lfs_object_download_list_service.rb
@@ -9,7 +9,7 @@ module Projects
       include Gitlab::Utils::StrongMemoize
 
       HEAD_REV = 'HEAD'
-      LFS_ENDPOINT_PATTERN = /^\t?url\s*=\s*(.+)$/.freeze
+      LFS_ENDPOINT_PATTERN = /^\t?url\s*=\s*(.+)$/
       LFS_BATCH_API_ENDPOINT = '/info/lfs/objects/batch'
 
       LfsObjectDownloadListError = Class.new(StandardError)
diff --git a/app/uploaders/file_uploader.rb b/app/uploaders/file_uploader.rb
index 87a624ddb60..c28f0893c56 100644
--- a/app/uploaders/file_uploader.rb
+++ b/app/uploaders/file_uploader.rb
@@ -20,8 +20,8 @@ class FileUploader < GitlabUploader
     '!?\[.*?\]\(/uploads/(?P<secret>[0-9a-f]{32})/(?P<file>.*?)\)'
   )
 
-  DYNAMIC_PATH_PATTERN = %r{.*(?<secret>\b(\h{10}|\h{32}))\/(?<identifier>.*)}.freeze
-  VALID_SECRET_PATTERN = %r{\A\h{10,32}\z}.freeze
+  DYNAMIC_PATH_PATTERN = %r{.*(?<secret>\b(\h{10}|\h{32}))\/(?<identifier>.*)}
+  VALID_SECRET_PATTERN = %r{\A\h{10,32}\z}
 
   InvalidSecret = Class.new(StandardError)
 
diff --git a/app/validators/certificate_fingerprint_validator.rb b/app/validators/certificate_fingerprint_validator.rb
index 79d78653ec7..c4e317c3e79 100644
--- a/app/validators/certificate_fingerprint_validator.rb
+++ b/app/validators/certificate_fingerprint_validator.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class CertificateFingerprintValidator < ActiveModel::EachValidator
-  FINGERPRINT_PATTERN = /\A([a-zA-Z0-9]{2}[\s\-:]?){16,}\z/.freeze
+  FINGERPRINT_PATTERN = /\A([a-zA-Z0-9]{2}[\s\-:]?){16,}\z/
 
   def validate_each(record, attribute, value)
     unless value.try(:match, FINGERPRINT_PATTERN)
diff --git a/app/validators/json_schema_validator.rb b/app/validators/json_schema_validator.rb
index 2b03571d43e..2ef011df73e 100644
--- a/app/validators/json_schema_validator.rb
+++ b/app/validators/json_schema_validator.rb
@@ -10,7 +10,7 @@
 #   end
 #
 class JsonSchemaValidator < ActiveModel::EachValidator
-  FILENAME_ALLOWED = /\A[a-z0-9_-]*\Z/.freeze
+  FILENAME_ALLOWED = /\A[a-z0-9_-]*\Z/
   FilenameError = Class.new(StandardError)
   BASE_DIRECTORY = %w[app validators json_schemas].freeze
 
diff --git a/app/validators/line_code_validator.rb b/app/validators/line_code_validator.rb
index e1abccc1dff..54f9272a2ae 100644
--- a/app/validators/line_code_validator.rb
+++ b/app/validators/line_code_validator.rb
@@ -4,7 +4,7 @@
 #
 # Custom validator for GitLab line codes.
 class LineCodeValidator < ActiveModel::EachValidator
-  PATTERN = /\A[a-z0-9]+_\d+_\d+\z/.freeze
+  PATTERN = /\A[a-z0-9]+_\d+_\d+\z/
 
   def validate_each(record, attribute, value)
     unless PATTERN.match?(value)
diff --git a/app/views/projects/merge_requests/creations/_new_compare.html.haml b/app/views/projects/merge_requests/creations/_new_compare.html.haml
index 015f6423e7c..e6bd0b05f00 100644
--- a/app/views/projects/merge_requests/creations/_new_compare.html.haml
+++ b/app/views/projects/merge_requests/creations/_new_compare.html.haml
@@ -14,7 +14,7 @@
 = gitlab_ui_form_for [@project, @merge_request], url: project_new_merge_request_path(@project), method: :get, html: { class: "merge-request-form js-requires-input" } do |f|
   - if params[:nav_source].present?
     = hidden_field_tag(:nav_source, params[:nav_source])
-  .js-merge-request-new-compare.row{ 'data-source-branch-url': project_new_merge_request_branch_from_path(@source_project), 'data-target-branch-url': project_new_merge_request_branch_to_path(@source_project) }
+  .js-merge-request-new-compare.row{ data: mr_compare_form_data(current_user, @merge_request) }
     .col-lg-6
       .card-new-merge-request
         %h2.gl-font-size-h2
diff --git a/app/workers/build_success_worker.rb b/app/workers/build_success_worker.rb
index f5baa220715..b937dbf298a 100644
--- a/app/workers/build_success_worker.rb
+++ b/app/workers/build_success_worker.rb
@@ -13,15 +13,5 @@ class BuildSuccessWorker # rubocop:disable Scalability/IdempotentWorker
   queue_namespace :pipeline_processing
   urgency :high
 
-  def perform(build_id)
-    Ci::Build.find_by_id(build_id).try do |build|
-      stop_environment(build) if build.stops_environment? && build.stop_action_successful?
-    end
-  end
-
-  private
-
-  def stop_environment(build)
-    build.persisted_environment.fire_state_event(:stop_complete)
-  end
+  def perform(build_id); end
 end
diff --git a/app/workers/click_house/events_sync_worker.rb b/app/workers/click_house/events_sync_worker.rb
index 054e7763297..5b7398cb071 100644
--- a/app/workers/click_house/events_sync_worker.rb
+++ b/app/workers/click_house/events_sync_worker.rb
@@ -12,6 +12,47 @@ module ClickHouse
 
     # the job is scheduled every 3 minutes and we will allow maximum 2.5 minutes runtime
     MAX_TTL = 2.5.minutes.to_i
+    MAX_RUNTIME = 120.seconds
+    BATCH_SIZE = 500
+    INSERT_BATCH_SIZE = 5000
+    CSV_MAPPING = {
+      id: :id,
+      path: :path,
+      author_id: :author_id,
+      target_id: :target_id,
+      target_type: :target_type,
+      action: :raw_action,
+      created_at: :casted_created_at,
+      updated_at: :casted_updated_at
+    }.freeze
+
+    # transforms the traversal_ids to a String:
+    # Example: group_id/subgroup_id/group_or_projectnamespace_id/
+    PATH_COLUMN = <<~SQL
+      (
+        CASE
+          WHEN project_id IS NOT NULL THEN (SELECT array_to_string(traversal_ids, '/') || '/' FROM namespaces WHERE id = (SELECT project_namespace_id FROM projects WHERE id = events.project_id LIMIT 1) LIMIT 1)
+          WHEN group_id IS NOT NULL THEN (SELECT array_to_string(traversal_ids, '/') || '/' FROM namespaces WHERE id = events.group_id LIMIT 1)
+          ELSE ''
+        END
+      ) AS path
+    SQL
+
+    EVENT_PROJECTIONS = [
+      :id,
+      PATH_COLUMN,
+      :author_id,
+      :target_id,
+      :target_type,
+      'action AS raw_action',
+      'EXTRACT(epoch FROM created_at) AS casted_created_at',
+      'EXTRACT(epoch FROM updated_at) AS casted_updated_at'
+    ].freeze
+
+    INSERT_EVENTS_QUERY = <<~SQL.squish
+      INSERT INTO events (#{CSV_MAPPING.keys.join(', ')})
+      SETTINGS async_insert=1, wait_for_async_insert=1 FORMAT CSV
+    SQL
 
     def perform
       unless enabled?
@@ -22,12 +63,15 @@ module ClickHouse
 
       metadata = { status: :processed }
 
-      # Prevent parallel jobs
       begin
+        # Prevent parallel jobs
         in_lock(self.class.to_s, ttl: MAX_TTL, retries: 0) do
-          true
-        end
+          loop { break unless next_batch }
 
+          metadata.merge!(records_inserted: context.total_record_count, reached_end_of_table: context.no_more_records?)
+
+          ClickHouse::SyncCursor.update_cursor_for(:events, context.last_processed_id) if context.last_processed_id
+        end
       rescue Gitlab::ExclusiveLeaseHelpers::FailedToObtainLockError
         # Skip retrying, just let the next worker to start after a few minutes
         metadata = { status: :skipped }
@@ -38,8 +82,51 @@ module ClickHouse
 
     private
 
+    def context
+      @context ||= ClickHouse::RecordSyncContext.new(
+        last_record_id: ClickHouse::SyncCursor.cursor_for(:events),
+        max_records_per_batch: INSERT_BATCH_SIZE,
+        runtime_limiter: Analytics::CycleAnalytics::RuntimeLimiter.new(MAX_RUNTIME)
+      )
+    end
+
     def enabled?
       ClickHouse::Client.configuration.databases[:main].present? && Feature.enabled?(:event_sync_worker_for_click_house)
     end
+
+    def next_batch
+      context.new_batch!
+
+      CsvBuilder::Gzip.new(process_batch(context), CSV_MAPPING).render do |tempfile, rows_written|
+        unless rows_written == 0
+          ClickHouse::Client.insert_csv(INSERT_EVENTS_QUERY, File.open(tempfile.path),
+            :main)
+        end
+      end
+
+      !(context.over_time? || context.no_more_records?)
+    end
+
+    def process_batch(context)
+      Enumerator.new do |yielder|
+        has_data = false
+        # rubocop: disable CodeReuse/ActiveRecord
+        Event.where(Event.arel_table[:id].gt(context.last_record_id)).each_batch(of: BATCH_SIZE) do |relation|
+          has_data = true
+
+          relation.select(*EVENT_PROJECTIONS).each do |row|
+            yielder << row
+            context.last_processed_id = row.id
+
+            break if context.record_limit_reached?
+          end
+
+          break if context.over_time? || context.record_limit_reached?
+        end
+
+        context.no_more_records! if has_data == false
+        # rubocop: enable CodeReuse/ActiveRecord
+      end
+    end
   end
 end
diff --git a/config/feature_flags/development/ci_commit_statuses_api_exclusive_lock.yml b/config/feature_flags/development/ci_commit_statuses_api_exclusive_lock.yml
deleted file mode 100644
index 02eca998f4f..00000000000
--- a/config/feature_flags/development/ci_commit_statuses_api_exclusive_lock.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-name: ci_commit_statuses_api_exclusive_lock
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/129164
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/421657
-milestone: '16.4'
-type: development
-group: group::pipeline execution
-default_enabled: false
diff --git a/config/feature_flags/development/service_desk_custom_email.yml b/config/feature_flags/development/service_desk_custom_email.yml
index 42bac76033c..c23dd713da1 100644
--- a/config/feature_flags/development/service_desk_custom_email.yml
+++ b/config/feature_flags/development/service_desk_custom_email.yml
@@ -5,5 +5,5 @@ rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/329990
 milestone: '15.9'
 type: development
 group: group::incubation
-default_enabled: false
+default_enabled: true
 log_state_changes: true
diff --git a/config/feature_flags/development/service_desk_custom_email_reply.yml b/config/feature_flags/development/service_desk_custom_email_reply.yml
index ac718fd612c..37720f9d682 100644
--- a/config/feature_flags/development/service_desk_custom_email_reply.yml
+++ b/config/feature_flags/development/service_desk_custom_email_reply.yml
@@ -5,4 +5,4 @@ rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/423880
 milestone: '16.4'
 type: development
 group: group::incubation
-default_enabled: false
+default_enabled: true
diff --git a/config/initializers/1_database_single_connection.rb b/config/initializers/1_database_single_connection.rb
new file mode 100644
index 00000000000..cba203ab1cc
--- /dev/null
+++ b/config/initializers/1_database_single_connection.rb
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+Gitlab::Database.check_single_connection_and_print_warning
diff --git a/config/metrics/counts_7d/20210216184301_o_pipeline_authoring_unique_users_committing_ciconfigfile_weekly.yml b/config/metrics/counts_7d/20210216184301_o_pipeline_authoring_unique_users_committing_ciconfigfile_weekly.yml
index 6f40ec50f69..d97e445d076 100644
--- a/config/metrics/counts_7d/20210216184301_o_pipeline_authoring_unique_users_committing_ciconfigfile_weekly.yml
+++ b/config/metrics/counts_7d/20210216184301_o_pipeline_authoring_unique_users_committing_ciconfigfile_weekly.yml
@@ -1,5 +1,5 @@
 ---
-data_category: optional
+data_category: operational
 key_path: redis_hll_counters.pipeline_authoring.o_pipeline_authoring_unique_users_committing_ciconfigfile_weekly
 description: Weekly unique user count doing commits which contains the CI config file
 product_section: ops
diff --git a/config/metrics/counts_all/20210216175518_ci_pipeline_config_repository.yml b/config/metrics/counts_all/20210216175518_ci_pipeline_config_repository.yml
index 5510b841120..1db7c0b912a 100644
--- a/config/metrics/counts_all/20210216175518_ci_pipeline_config_repository.yml
+++ b/config/metrics/counts_all/20210216175518_ci_pipeline_config_repository.yml
@@ -1,5 +1,5 @@
 ---
-data_category: optional
+data_category: operational
 key_path: counts.ci_pipeline_config_repository
 description: Total Pipelines from CI files in repository
 product_section: ops
diff --git a/config/metrics/counts_all/20210216175533_ci_pipeline_config_repository.yml b/config/metrics/counts_all/20210216175533_ci_pipeline_config_repository.yml
index 15d31154ba6..d49b5625b4b 100644
--- a/config/metrics/counts_all/20210216175533_ci_pipeline_config_repository.yml
+++ b/config/metrics/counts_all/20210216175533_ci_pipeline_config_repository.yml
@@ -1,5 +1,5 @@
 ---
-data_category: optional
+data_category: operational
 key_path: usage_activity_by_stage.verify.ci_pipeline_config_repository
 description: Total count of unique users creating pipelines from CI files in the repository
 product_section: ops
diff --git a/config/metrics/counts_all/20210216175535_ci_pipeline_schedules.yml b/config/metrics/counts_all/20210216175535_ci_pipeline_schedules.yml
index 798de8216ff..65799428e7e 100644
--- a/config/metrics/counts_all/20210216175535_ci_pipeline_schedules.yml
+++ b/config/metrics/counts_all/20210216175535_ci_pipeline_schedules.yml
@@ -1,5 +1,5 @@
 ---
-data_category: optional
+data_category: operational
 key_path: usage_activity_by_stage.verify.ci_pipeline_schedules
 description: Distinct users creating pipeline schedules
 product_section: ops
diff --git a/db/click_house/main/20230808070520_create_events_cursor.sql b/db/click_house/main/20230808070520_create_events_cursor.sql
new file mode 100644
index 00000000000..effc3c64f60
--- /dev/null
+++ b/db/click_house/main/20230808070520_create_events_cursor.sql
@@ -0,0 +1,9 @@
+CREATE TABLE sync_cursors
+(
+  table_name LowCardinality(String) DEFAULT '',
+  primary_key_value UInt64 DEFAULT 0,
+  recorded_at DateTime64(6, 'UTC') DEFAULT now()
+)
+ENGINE = ReplacingMergeTree(recorded_at)
+ORDER BY (table_name)
+PRIMARY KEY (table_name)
diff --git a/doc/ci/runners/runners_scope.md b/doc/ci/runners/runners_scope.md
index 814b8a1c0d2..c6387a60495 100644
--- a/doc/ci/runners/runners_scope.md
+++ b/doc/ci/runners/runners_scope.md
@@ -274,7 +274,7 @@ The runner authentication token displays in the UI for only a short period of ti
 
 WARNING:
 The ability to pass a runner registration token, and support for certain configuration arguments was
-[deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872) in GitLab 15.6 and will be removed in GitLab 17.0. Authentication tokens
+[deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872) in GitLab 15.6 and will be removed in GitLab 18.0. Authentication tokens
 should be used instead. For more information, see [Migrating to the new runner registration workflow](new_creation_workflow.md).
 
 You must have the Owner role for the group.
diff --git a/doc/development/internal_api/index.md b/doc/development/internal_api/index.md
index 156df31192b..81fd78d1d27 100644
--- a/doc/development/internal_api/index.md
+++ b/doc/development/internal_api/index.md
@@ -178,6 +178,40 @@ Example response:
 
 - GitLab Shell
 
+## Authorized Certs
+
+This endpoint is called by the GitLab Shell to get the namespace that has a particular CA SSH certificate
+configured. It also accepts `user_identifier` to return a GitLab user for specified identifier.
+
+| Attribute             | Type   | Required | Description |
+|:----------------------|:-------|:---------|:------------|
+| `key`                 | string | yes      | The fingerprint of the SSH certificate. |
+| `user_identifier`     | string | yes      | The identifier of the user to whom the SSH certificate has been issued (username or primary email). |
+
+```plaintext
+GET /internal/authorized_certs
+```
+
+Example request:
+
+```shell
+curl --request GET --header "Gitlab-Shell-Api-Request: <JWT token>" "http://localhost:3001/api/v4/internal/authorized_certs?key=<key>&user_identifier=<user_identifier>"
+```
+
+Example response:
+
+```json
+{
+  "success": true,
+  "namespace": "gitlab-org",
+  "username": "root"
+}
+```
+
+### Known consumers
+
+- GitLab Shell
+
 ## Get user for user ID or key
 
 This endpoint is used when a user performs `ssh git@gitlab.com`. It
diff --git a/doc/user/analytics/analytics_dashboards.md b/doc/user/analytics/analytics_dashboards.md
index ad4ba8e89ae..68b9fef5cc7 100644
--- a/doc/user/analytics/analytics_dashboards.md
+++ b/doc/user/analytics/analytics_dashboards.md
@@ -29,15 +29,16 @@ The following data sources are configured for analytics dashboards:
 ## Built-in dashboards
 
 To help you get started with analytics, GitLab provides built-in dashboards with predefined visualizations.
+These dashboards are labeled **By GitLab**, and you cannot edit them.
+Instead, you can create a custom dashboard with a similar style.
 
 ### Product analytics
 
+When [product analytics](../product_analytics/index.md) is enabled and onboarded, two built-in dashboard are added:
+
 - **Audience** displays metrics related to traffic, such as the number of users and sessions.
 - **Behavior** displays metrics related to user activity, such as the number of page views and events.
 
-These dashboards are labeled **By GitLab**, and you cannot edit them.
-Instead, you can create a custom dashboard with a similar style.
-
 ### Value Stream Management
 
 - **Value Streams Dashboard** displays metrics related to [DevOps performance, security exposure, and workstream optimization](../analytics/value_streams_dashboard.md#devsecops-metrics-comparison-panel).
@@ -64,9 +65,6 @@ On self-managed GitLab, by default this feature is not available. To make it ava
 On GitLab.com, this feature is not available.
 This feature is not ready for production use.
 
-NOTE:
-This feature does not work in conjunction with the `product_analytics_snowplow_support` feature flag.
-
 You can use the dashboard designer to:
 
 - Create custom dashboards.
diff --git a/doc/user/product_analytics/index.md b/doc/user/product_analytics/index.md
index 8336b3af72d..d90b2d5c882 100644
--- a/doc/user/product_analytics/index.md
+++ b/doc/user/product_analytics/index.md
@@ -10,18 +10,14 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 > - `cube_api_proxy` revised to only reference the [Product Analytics API](../../api/product_analytics.md) in GitLab 15.6.
 > - `cube_api_proxy` removed and replaced with `product_analytics_internal_preview` in GitLab 15.10.
 > - `product_analytics_internal_preview` replaced with `product_analytics_dashboards` in GitLab 15.11.
-> - Snowplow integration introduced in GitLab 15.11 [with a flag](../../administration/feature_flags.md) named `product_analytics_snowplow_support`. Disabled by default.
+> - Snowplow integration [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/398253) in GitLab 15.11 [with a flag](../../administration/feature_flags.md) named `product_analytics_snowplow_support`. Disabled by default.
+> - Snowplow integration feature flag `product_analytics_snowplow_support` [removed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/130228) in GitLab 16.4.
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available per project or for your entire instance, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `product_analytics_dashboards`.
 On GitLab.com, this feature is not available.
 This feature is not ready for production use.
 
-FLAG:
-On self-managed GitLab, by default the Snowplow integration is not available. To make it available per project or for your entire instance, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `product_analytics_snowplow_support`.
-On GitLab.com, this feature is not available.
-This feature is not ready for production use.
-
 This page is a work in progress, and we're updating the information as we add more features.
 For more information, see the [group direction page](https://about.gitlab.com/direction/analytics/product-analytics/).
 To leave feedback about Product Analytics bugs or functionality, please comment in [issue 391970](https://gitlab.com/gitlab-org/gitlab/-/issues/391970) or open a new issue with the label `group::product analytics`.
@@ -67,7 +63,7 @@ flowchart TB
 > - `product_analytics_internal_preview` replaced with `product_analytics_dashboards` in GitLab 15.11.
 
 FLAG:
-On self-managed GitLab, by default this feature is not available. To make it available per project or for your entire instance, an administrator can [enable the feature flags](../../administration/feature_flags.md) named `product_analytics_dashboards`, `product_analytics_admin_settings`, `product_analytics_snowplow_support`, and `combined_analytics_dashboards`.
+On self-managed GitLab, by default this feature is not available. To make it available per project or for your entire instance, an administrator can [enable the feature flags](../../administration/feature_flags.md) named `product_analytics_dashboards`, `product_analytics_admin_settings`, and `combined_analytics_dashboards`.
 On GitLab.com, this feature is not available.
 This feature is not ready for production use.
 
diff --git a/doc/user/project/service_desk/configure.md b/doc/user/project/service_desk/configure.md
index 817bb5e5066..f8f4ab44e5a 100644
--- a/doc/user/project/service_desk/configure.md
+++ b/doc/user/project/service_desk/configure.md
@@ -157,12 +157,13 @@ To edit the custom email display name:
 
 ## Custom email address **(BETA)**
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/329990) in GitLab 16.3 [with a flag](../../../administration/feature_flags.md) named `service_desk_custom_email`. Disabled by default.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/329990) in GitLab 16.3 [with a flag](../../../administration/feature_flags.md) named `service_desk_custom_email`. Disabled by default.
+> - [Enabled on GitLab.com and self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/387003) in GitLab 16.4.
 
 FLAG:
-On self-managed GitLab, by default this feature is not available. To make it available per project or for your
-entire instance, an administrator can [enable the feature flag](../../../administration/feature_flags.md)
-named `service_desk_custom_email`. On GitLab.com, this feature is not available. The feature is not ready for production use.
+On self-managed GitLab, by default this feature is available. To hide the feature per project or for
+your entire instance, an administrator can [disable the feature flag](../../../administration/feature_flags.md)
+named `service_desk_custom_email`. On GitLab.com, this feature is available.
 
 Configure a custom email address to show as the sender of your support communication.
 Maintain brand identity and instill confidence among support requesters with a domain they recognize.
diff --git a/doc/user/workspace/index.md b/doc/user/workspace/index.md
index 86a91a7fca3..1284067a391 100644
--- a/doc/user/workspace/index.md
+++ b/doc/user/workspace/index.md
@@ -35,7 +35,8 @@ When you [create a workspace](configuration.md#set-up-a-workspace), you must:
 - Assign the workspace to a specific project.
 - Select a project with a [`.devfile.yaml`](#devfile) file.
 
-The workspace can then interact with the GitLab API based on the permissions granted to the current user.
+The workspace can interact with the GitLab API, with the access level defined by current user permissions.
+A running workspace remains accessible even if user permissions are later revoked.
 
 ### Open and manage workspaces from a project
 
diff --git a/gems/csv_builder/lib/csv_builder/gzip.rb b/gems/csv_builder/lib/csv_builder/gzip.rb
index 60875006a35..f97c066705a 100644
--- a/gems/csv_builder/lib/csv_builder/gzip.rb
+++ b/gems/csv_builder/lib/csv_builder/gzip.rb
@@ -2,12 +2,14 @@
 
 module CsvBuilder
   class Gzip < CsvBuilder::Builder
-    # Writes the CSV file compressed and yields the written tempfile.
+    # Writes the CSV file compressed and yields the written tempfile and rows written.
+    #
     #
     # Example:
-    # > CsvBuilder::Gzip.new(Issue, { title: -> (row) { row.title.upcase }, id: :id }).render do |tempfile|
+    # > CsvBuilder::Gzip.new(Issue, { title: -> (row) { row.title.upcase }, id: :id }).render do |tempfile, rows|
     # >   puts tempfile.path
     # >   puts `zcat #{tempfile.path}`
+    # >   puts rows
     # > end
     def render
       Tempfile.open(['csv_builder_gzip', '.csv.gz']) do |tempfile|
@@ -16,7 +18,7 @@ module CsvBuilder
         write_csv csv, until_condition: -> {} # truncation must be handled outside of the CsvBuilder
 
         csv.close
-        yield tempfile
+        yield tempfile, @rows_written
       end
     end
   end
diff --git a/gems/csv_builder/spec/csv_builder/gzip_spec.rb b/gems/csv_builder/spec/csv_builder/gzip_spec.rb
index 9d24d351247..22462d8dd0a 100644
--- a/gems/csv_builder/spec/csv_builder/gzip_spec.rb
+++ b/gems/csv_builder/spec/csv_builder/gzip_spec.rb
@@ -26,6 +26,13 @@ RSpec.describe CsvBuilder::Gzip do
         ])
     end
 
+    it 'yields the number of written rows as the second argument' do
+      row_count = 0
+      builder.render { |_, rows| row_count = rows }
+
+      expect(row_count).to eq(2)
+    end
+
     it 'requires a block' do
       expect { builder.render }.to raise_error(LocalJumpError)
     end
diff --git a/lib/api/commit_statuses.rb b/lib/api/commit_statuses.rb
index ad3169cee75..6a3e6823e50 100644
--- a/lib/api/commit_statuses.rb
+++ b/lib/api/commit_statuses.rb
@@ -80,85 +80,14 @@ module API
       post ':id/statuses/:sha' do
         authorize! :create_commit_status, user_project
 
-        if Feature.enabled?(:ci_commit_statuses_api_exclusive_lock, user_project)
-          response =
-            ::Ci::CreateCommitStatusService
-              .new(user_project, current_user, params)
-              .execute(optional_commit_status_params: optional_commit_status_params)
+        response =
+          ::Ci::CreateCommitStatusService
+            .new(user_project, current_user, params)
+            .execute(optional_commit_status_params: optional_commit_status_params)
 
-          if response.error?
-            render_api_error!(response.message, response.http_status)
-          else
-            present response.payload[:job], with: Entities::CommitStatus
-          end
+        if response.error?
+          render_api_error!(response.message, response.http_status)
         else
-          not_found! 'Commit' unless commit
-
-          # Since the CommitStatus is attached to ::Ci::Pipeline (in the future Pipeline)
-          # We need to always have the pipeline object
-          # To have a valid pipeline object that can be attached to specific MR
-          # Other CI service needs to send `ref`
-          # If we don't receive it, we will attach the CommitStatus to
-          # the first found branch on that commit
-
-          pipeline = all_matching_pipelines.first
-
-          ref = params[:ref]
-          ref ||= pipeline&.ref
-          ref ||= user_project.repository.branch_names_contains(commit.sha).first
-          not_found! 'References for commit' unless ref
-
-          name = params[:name] || params[:context] || 'default'
-
-          pipeline ||= user_project.ci_pipelines.build(
-            source: :external,
-            sha: commit.sha,
-            ref: ref,
-            user: current_user,
-            protected: user_project.protected_for?(ref))
-
-          pipeline.ensure_project_iid!
-          pipeline.save!
-
-          authorize! :update_pipeline, pipeline
-
-          # rubocop: disable Performance/ActiveRecordSubtransactionMethods
-          stage = pipeline.stages.safe_find_or_create_by!(name: 'external') do |stage|
-            stage.position = GenericCommitStatus::EXTERNAL_STAGE_IDX
-            stage.project = pipeline.project
-          end
-          # rubocop: enable Performance/ActiveRecordSubtransactionMethods
-
-          status = GenericCommitStatus.running_or_pending.find_or_initialize_by(
-            project: user_project,
-            pipeline: pipeline,
-            name: name,
-            ref: ref,
-            user: current_user,
-            protected: user_project.protected_for?(ref),
-            ci_stage: stage,
-            stage_idx: stage.position,
-            stage: 'external'
-          )
-
-          status.assign_attributes(optional_commit_status_params)
-
-          render_validation_error!(status) unless status.valid?
-
-          response = ::Ci::Pipelines::AddJobService.new(pipeline).execute!(status) do |job|
-            apply_job_state!(job)
-          rescue ::StateMachines::InvalidTransition => e
-            render_api_error!(e.message, 400)
-          end
-
-          render_validation_error!(response.payload[:job]) unless response.success?
-
-          if pipeline.latest?
-            MergeRequest
-              .where(source_project: user_project, source_branch: ref)
-              .update_all(head_pipeline_id: pipeline.id)
-          end
-
           present response.payload[:job], with: Entities::CommitStatus
         end
       end
diff --git a/lib/bitbucket/representation/pull_request.rb b/lib/bitbucket/representation/pull_request.rb
index 75183b1df95..91a55f9bd2d 100644
--- a/lib/bitbucket/representation/pull_request.rb
+++ b/lib/bitbucket/representation/pull_request.rb
@@ -54,6 +54,10 @@ module Bitbucket
         target_branch.dig('commit', 'hash')
       end
 
+      def merge_commit_sha
+        raw['merge_commit']&.dig('hash')
+      end
+
       private
 
       def source_branch
diff --git a/lib/click_house/record_sync_context.rb b/lib/click_house/record_sync_context.rb
new file mode 100644
index 00000000000..5d2d77d3283
--- /dev/null
+++ b/lib/click_house/record_sync_context.rb
@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module ClickHouse
+  class RecordSyncContext
+    attr_reader :last_record_id, :last_processed_id, :total_record_count, :record_count_in_current_batch
+
+    def initialize(
+      last_record_id:, max_records_per_batch:,
+      runtime_limiter: Analytics::CycleAnalytics::RuntimeLimiter.new)
+      @last_record_id = last_record_id
+      @runtime_limiter = runtime_limiter
+      @max_records_per_batch = max_records_per_batch
+      @last_processed_id = nil
+      @record_count_in_current_batch = 0
+      @total_record_count = 0
+    end
+
+    delegate :over_time?, to: :@runtime_limiter
+
+    def new_batch!
+      @record_count_in_current_batch = 0
+    end
+
+    def no_more_records!
+      @no_more_records = true
+    end
+
+    def no_more_records?
+      !!@no_more_records
+    end
+
+    def last_processed_id=(value)
+      @record_count_in_current_batch += 1
+      @total_record_count += 1
+      @last_processed_id = value
+      @last_record_id = value
+    end
+
+    def record_limit_reached?
+      @record_count_in_current_batch == @max_records_per_batch
+    end
+  end
+end
diff --git a/lib/click_house/sync_cursor.rb b/lib/click_house/sync_cursor.rb
new file mode 100644
index 00000000000..9426f727072
--- /dev/null
+++ b/lib/click_house/sync_cursor.rb
@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module ClickHouse
+  class SyncCursor
+    QUERY = <<~SQL
+      SELECT argMax(primary_key_value, recorded_at) AS primary_key_value
+      FROM sync_cursors
+      WHERE table_name = {table_name:String}
+      LIMIT 1
+    SQL
+
+    INSERT_CURSOR_QUERY = <<~SQL
+      INSERT INTO sync_cursors
+      (primary_key_value, table_name, recorded_at)
+      VALUES ({primary_key_value:UInt64}, {table_name:String}, {recorded_at:DateTime64})
+    SQL
+
+    def self.cursor_for(identifier)
+      query = ClickHouse::Client::Query.new(
+        raw_query: QUERY,
+        placeholders: { table_name: identifier.to_s }
+      )
+
+      # The query returns the default value (0) when no records are present.
+      ClickHouse::Client.select(query, :main).first['primary_key_value']
+    end
+
+    def self.update_cursor_for(identifier, value)
+      query = ClickHouse::Client::Query.new(
+        raw_query: INSERT_CURSOR_QUERY,
+        placeholders: {
+          primary_key_value: value,
+          table_name: identifier.to_s,
+          recorded_at: Time.current.to_f
+        }
+      )
+
+      ClickHouse::Client.execute(query, :main)
+    end
+  end
+end
diff --git a/lib/gitlab/bitbucket_import/importer.rb b/lib/gitlab/bitbucket_import/importer.rb
index e785ce558db..7f228c19b6b 100644
--- a/lib/gitlab/bitbucket_import/importer.rb
+++ b/lib/gitlab/bitbucket_import/importer.rb
@@ -210,7 +210,11 @@ module Gitlab
 
         source_branch_sha = pull_request.source_branch_sha
         target_branch_sha = pull_request.target_branch_sha
-        source_branch_sha = project.repository.commit(source_branch_sha)&.sha || source_branch_sha
+
+        source_sha_from_commit_sha = project.repository.commit(source_branch_sha)&.sha
+        source_sha_from_merge_sha = project.repository.commit(pull_request.merge_commit_sha)&.sha
+
+        source_branch_sha = source_sha_from_commit_sha || source_sha_from_merge_sha || source_branch_sha
         target_branch_sha = project.repository.commit(target_branch_sha)&.sha || target_branch_sha
 
         merge_request = project.merge_requests.create!(
diff --git a/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml b/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
index 6e2faf33a2f..fa1d8bec7e6 100644
--- a/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml
@@ -65,6 +65,10 @@ variables:
 
   DOCKER_TLS_CERTDIR: ""  # https://gitlab.com/gitlab-org/gitlab-runner/issues/4501
 
+  # License-Scanning job is removed from GitLab 16.3
+  # This is the fix for https://gitlab.com/gitlab-org/gitlab/-/issues/422791
+  LICENSE_MANAGEMENT_DISABLED: "true"
+
 stages:
   - build
   - test
diff --git a/lib/gitlab/database.rb b/lib/gitlab/database.rb
index 89065c11c4f..54eb0c0e0aa 100644
--- a/lib/gitlab/database.rb
+++ b/lib/gitlab/database.rb
@@ -216,6 +216,28 @@ module Gitlab
       end
     end
 
+    def self.check_single_connection_and_print_warning
+      return if Gitlab::Runtime.rails_runner?
+      return unless database_mode == MODE_SINGLE_DATABASE
+
+      Kernel.warn ERB.new(Rainbow.new.wrap(<<~EOS).red).result
+
+                  ██     ██  █████  ██████  ███    ██ ██ ███    ██  ██████ 
+                  ██     ██ ██   ██ ██   ██ ████   ██ ██ ████   ██ ██      
+                  ██  █  ██ ███████ ██████  ██ ██  ██ ██ ██ ██  ██ ██   ███ 
+                  ██ ███ ██ ██   ██ ██   ██ ██  ██ ██ ██ ██  ██ ██ ██    ██ 
+                   ███ ███  ██   ██ ██   ██ ██   ████ ██ ██   ████  ██████  
+
+        ******************************************************************************
+          Your database has a single connection, and single connections were
+          deprecated in GitLab 15.9 https://docs.gitlab.com/ee/update/deprecations.html#single-database-connection-is-deprecated.
+
+          Please add a :ci section to your database, following these instructions:
+          https://docs.gitlab.com/ee/install/installation.html#configure-gitlab-db-settings.
+        ******************************************************************************
+      EOS
+    end
+
     def self.random
       "RANDOM()"
     end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 8064c55b516..12af1d4121b 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -30812,6 +30812,9 @@ msgstr ""
 msgid "Navigation|Operate"
 msgstr ""
 
+msgid "Navigation|Pin %{title}"
+msgstr ""
+
 msgid "Navigation|Pin item"
 msgstr ""
 
@@ -30848,6 +30851,9 @@ msgstr ""
 msgid "Navigation|There was an error fetching search results."
 msgstr ""
 
+msgid "Navigation|Unpin %{title}"
+msgstr ""
+
 msgid "Navigation|Unpin item"
 msgstr ""
 
@@ -43481,7 +43487,7 @@ msgstr ""
 msgid "ServiceDesk|Configure a custom email address"
 msgstr ""
 
-msgid "ServiceDesk|Connect a custom email address your customers can use to create Service Desk issues. Forward all emails from your custom email address to the Service Desk email address of this project. GitLab will send Service Desk emails from the custom address on your behalf using your SMTP credentials."
+msgid "ServiceDesk|Connect a custom email address your customers can use to create Service Desk issues. Forward all emails from your custom email address to the Service Desk email address of this project. GitLab will send Service Desk emails from the custom address on your behalf using your SMTP credentials. %{linkStart}Learn more about prerequisites and the verification process%{linkEnd}."
 msgstr ""
 
 msgid "ServiceDesk|Copy Service Desk email address"
diff --git a/package.json b/package.json
index bb76aafe0f0..28d4b115967 100644
--- a/package.json
+++ b/package.json
@@ -193,8 +193,8 @@
     "remark-rehype": "^10.1.0",
     "scrollparent": "^2.0.1",
     "semver": "^7.3.4",
+    "sentrybrowser": "npm:@sentry/browser@7.66.0",
     "sentrybrowser5": "npm:@sentry/browser@5.30.0",
-    "sentrybrowser": "npm:@sentry/browser@^7.21.1",
     "sortablejs": "^1.10.2",
     "string-hash": "1.1.3",
     "style-loader": "^2.0.0",
diff --git a/spec/features/dashboard/shortcuts_spec.rb b/spec/features/dashboard/shortcuts_spec.rb
index 976dcc5a027..c8013d364e3 100644
--- a/spec/features/dashboard/shortcuts_spec.rb
+++ b/spec/features/dashboard/shortcuts_spec.rb
@@ -50,6 +50,7 @@ RSpec.describe 'Dashboard shortcuts', :js, feature_category: :shared do
 
   context 'logged out' do
     before do
+      stub_feature_flags(super_sidebar_logged_out: false)
       visit explore_root_path
     end
 
diff --git a/spec/features/explore/navbar_spec.rb b/spec/features/explore/navbar_spec.rb
index 8f281abe6a7..853d66ed4d1 100644
--- a/spec/features/explore/navbar_spec.rb
+++ b/spec/features/explore/navbar_spec.rb
@@ -7,6 +7,7 @@ RSpec.describe '"Explore" navbar', feature_category: :navigation do
 
   it_behaves_like 'verified navigation bar' do
     before do
+      stub_feature_flags(super_sidebar_logged_out: false)
       visit explore_projects_path
     end
   end
diff --git a/spec/features/explore/user_explores_projects_spec.rb b/spec/features/explore/user_explores_projects_spec.rb
index f259ba6a167..43d464e0c9f 100644
--- a/spec/features/explore/user_explores_projects_spec.rb
+++ b/spec/features/explore/user_explores_projects_spec.rb
@@ -3,6 +3,10 @@
 require 'spec_helper'
 
 RSpec.describe 'User explores projects', feature_category: :user_profile do
+  before do
+    stub_feature_flags(super_sidebar_logged_out: false)
+  end
+
   describe '"All" tab' do
     it_behaves_like 'an "Explore" page with sidebar and breadcrumbs', :explore_projects_path, :projects
   end
diff --git a/spec/features/nav/pinned_nav_items_spec.rb b/spec/features/nav/pinned_nav_items_spec.rb
index cf53e0a322a..1a3ac973ed4 100644
--- a/spec/features/nav/pinned_nav_items_spec.rb
+++ b/spec/features/nav/pinned_nav_items_spec.rb
@@ -168,17 +168,19 @@ RSpec.describe 'Navigation menu item pinning', :js, feature_category: :navigatio
 
   private
 
-  def add_pin(menu_item_title)
-    menu_item = find("[data-testid=\"nav-item-link\"]", text: menu_item_title)
-    menu_item.hover
-    menu_item.find("[data-testid=\"thumbtack-icon\"]").click
+  def add_pin(nav_item_title)
+    nav_item = find("[data-testid=\"nav-item\"]", text: nav_item_title)
+    nav_item.hover
+    pin_button = nav_item.find("[data-testid=\"nav-item-pin\"]")
+    pin_button.click
     wait_for_requests
   end
 
-  def remove_pin(menu_item_title)
-    menu_item = find("[data-testid=\"nav-item-link\"]", text: menu_item_title)
-    menu_item.hover
-    menu_item.find("[data-testid=\"thumbtack-solid-icon\"]").click
+  def remove_pin(nav_item_title)
+    nav_item = find("[data-testid=\"nav-item\"]", text: nav_item_title)
+    nav_item.hover
+    unpin_button = nav_item.find("[data-testid=\"nav-item-unpin\"]")
+    unpin_button.click
     wait_for_requests
   end
 
diff --git a/spec/features/search/user_searches_for_projects_spec.rb b/spec/features/search/user_searches_for_projects_spec.rb
index 48a94161927..51e5ad85e2b 100644
--- a/spec/features/search/user_searches_for_projects_spec.rb
+++ b/spec/features/search/user_searches_for_projects_spec.rb
@@ -8,7 +8,7 @@ RSpec.describe 'User searches for projects', :js, :disable_rate_limiter, feature
   context 'when signed out' do
     context 'when block_anonymous_global_searches is disabled' do
       before do
-        stub_feature_flags(block_anonymous_global_searches: false)
+        stub_feature_flags(block_anonymous_global_searches: false, super_sidebar_logged_out: false)
       end
 
       include_examples 'top right search form'
diff --git a/spec/features/signed_commits_spec.rb b/spec/features/signed_commits_spec.rb
index 0268c8ad0d4..08d2d0575eb 100644
--- a/spec/features/signed_commits_spec.rb
+++ b/spec/features/signed_commits_spec.rb
@@ -2,8 +2,8 @@
 
 require 'spec_helper'
 
-RSpec.describe 'GPG signed commits', feature_category: :source_code_management do
-  let(:project) { create(:project, :public, :repository) }
+RSpec.describe 'GPG signed commits', :js, feature_category: :source_code_management do
+  let_it_be(:project) { create(:project, :public, :repository) }
 
   it 'changes from unverified to verified when the user changes their email to match the gpg key', :sidekiq_might_not_need_inline do
     ref = GpgHelpers::SIGNED_AND_AUTHORED_SHA
@@ -47,7 +47,7 @@ RSpec.describe 'GPG signed commits', feature_category: :source_code_management d
     expect(page).to have_selector('.gl-badge', text: 'Verified')
   end
 
-  context 'shows popover badges', :js do
+  context 'shows popover badges' do
     let(:user_1) do
       create :user, email: GpgHelpers::User1.emails.first, username: 'nannie.bernhard', name: 'Nannie Bernhard'
     end
@@ -163,7 +163,7 @@ RSpec.describe 'GPG signed commits', feature_category: :source_code_management d
     end
   end
 
-  context 'view signed commit on the tree view', :js do
+  context 'view signed commit on the tree view' do
     shared_examples 'a commit with a signature' do
       before do
         visit project_tree_path(project, 'signed-commits')
diff --git a/spec/features/snippets/show_spec.rb b/spec/features/snippets/show_spec.rb
index a354499fa0c..bbb120edb80 100644
--- a/spec/features/snippets/show_spec.rb
+++ b/spec/features/snippets/show_spec.rb
@@ -6,6 +6,10 @@ RSpec.describe 'Snippet', :js, feature_category: :source_code_management do
   let_it_be(:user) { create(:user, :no_super_sidebar) }
   let_it_be(:snippet) { create(:personal_snippet, :public, :repository, author: user) }
 
+  before do
+    stub_feature_flags(super_sidebar_logged_out: false)
+  end
+
   it_behaves_like 'show and render proper snippet blob' do
     let(:anchor) { nil }
 
diff --git a/spec/features/unsubscribe_links_spec.rb b/spec/features/unsubscribe_links_spec.rb
index 01da9063f52..b78efa65888 100644
--- a/spec/features/unsubscribe_links_spec.rb
+++ b/spec/features/unsubscribe_links_spec.rb
@@ -22,6 +22,10 @@ RSpec.describe 'Unsubscribe links', :sidekiq_inline, feature_category: :shared d
   end
 
   context 'when logged out' do
+    before do
+      stub_feature_flags(super_sidebar_logged_out: false)
+    end
+
     context 'when visiting the link from the body' do
       it 'shows the unsubscribe confirmation page and redirects to root path when confirming' do
         visit body_link
diff --git a/spec/features/users/rss_spec.rb b/spec/features/users/rss_spec.rb
index 712e5056138..99451ac472d 100644
--- a/spec/features/users/rss_spec.rb
+++ b/spec/features/users/rss_spec.rb
@@ -22,6 +22,7 @@ RSpec.describe 'User RSS', feature_category: :user_profile do
 
     context 'when signed out' do
       before do
+        stub_feature_flags(super_sidebar_logged_out: false)
         visit path
       end
 
@@ -45,6 +46,7 @@ RSpec.describe 'User RSS', feature_category: :user_profile do
 
     context 'when signed out' do
       before do
+        stub_feature_flags(super_sidebar_logged_out: false)
         visit path
       end
 
diff --git a/spec/features/users/show_spec.rb b/spec/features/users/show_spec.rb
index f8653b22377..522eb12f507 100644
--- a/spec/features/users/show_spec.rb
+++ b/spec/features/users/show_spec.rb
@@ -7,6 +7,10 @@ RSpec.describe 'User page', feature_category: :user_profile do
 
   let_it_be(:user) { create(:user, bio: '<b>Lorem</b> <i>ipsum</i> dolor sit <a href="https://example.com">amet</a>') }
 
+  before do
+    stub_feature_flags(super_sidebar_logged_out: false)
+  end
+
   subject(:visit_profile) { visit(user_path(user)) }
 
   context 'with "user_profile_overflow_menu_vue" feature flag enabled', :js do
diff --git a/spec/features/users/snippets_spec.rb b/spec/features/users/snippets_spec.rb
index 6473753470b..98ac9fa5f92 100644
--- a/spec/features/users/snippets_spec.rb
+++ b/spec/features/users/snippets_spec.rb
@@ -7,7 +7,7 @@ RSpec.describe 'Snippets tab on a user profile', :js, feature_category: :source_
     let(:user) { create(:user, :no_super_sidebar) }
 
     before do
-      stub_feature_flags(profile_tabs_vue: false)
+      stub_feature_flags(profile_tabs_vue: false, super_sidebar_logged_out: false)
     end
 
     context 'pagination' do
diff --git a/spec/features/users/user_browses_projects_on_user_page_spec.rb b/spec/features/users/user_browses_projects_on_user_page_spec.rb
index fb2a80c61e0..5e047192e7b 100644
--- a/spec/features/users/user_browses_projects_on_user_page_spec.rb
+++ b/spec/features/users/user_browses_projects_on_user_page_spec.rb
@@ -29,7 +29,7 @@ RSpec.describe 'Users > User browses projects on user page', :js, feature_catego
   end
 
   before do
-    stub_feature_flags(profile_tabs_vue: false)
+    stub_feature_flags(profile_tabs_vue: false, super_sidebar_logged_out: false)
   end
 
   it 'hides loading spinner after load', :js do
diff --git a/spec/features/whats_new_spec.rb b/spec/features/whats_new_spec.rb
index 16a3deae7f3..c8bcf5f6ef0 100644
--- a/spec/features/whats_new_spec.rb
+++ b/spec/features/whats_new_spec.rb
@@ -6,6 +6,10 @@ RSpec.describe "renders a `whats new` dropdown item", feature_category: :onboard
   let_it_be(:user) { create(:user, :no_super_sidebar) }
 
   context 'when not logged in' do
+    before do
+      stub_feature_flags(super_sidebar_logged_out: false)
+    end
+
     it 'and on SaaS it renders', :saas do
       visit user_path(user)
 
diff --git a/spec/frontend/merge_requests/components/compare_app_spec.js b/spec/frontend/merge_requests/components/compare_app_spec.js
index ba129363ffd..887f79f9fad 100644
--- a/spec/frontend/merge_requests/components/compare_app_spec.js
+++ b/spec/frontend/merge_requests/components/compare_app_spec.js
@@ -1,10 +1,14 @@
-import { shallowMount } from '@vue/test-utils';
+import MockAdapter from 'axios-mock-adapter';
+import waitForPromises from 'helpers/wait_for_promises';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+import axios from '~/lib/utils/axios_utils';
 import CompareApp from '~/merge_requests/components/compare_app.vue';
 
 let wrapper;
+let mock;
 
 function factory(provideData = {}) {
-  wrapper = shallowMount(CompareApp, {
+  wrapper = shallowMountExtended(CompareApp, {
     provide: {
       inputs: {
         project: {
@@ -16,6 +20,7 @@ function factory(provideData = {}) {
           name: 'branch',
         },
       },
+      branchCommitPath: '/commit',
       toggleClass: {
         project: 'project',
         branch: 'branch',
@@ -29,7 +34,18 @@ function factory(provideData = {}) {
   });
 }
 
+const findCommitBox = () => wrapper.findByTestId('commit-box');
+
 describe('Merge requests compare app component', () => {
+  beforeEach(() => {
+    mock = new MockAdapter(axios);
+    mock.onGet('/commit').reply(200, 'commit content');
+  });
+
+  afterEach(() => {
+    mock.restore();
+  });
+
   it('shows commit box when selected branch is empty', () => {
     factory({
       currentBranch: {
@@ -38,9 +54,41 @@ describe('Merge requests compare app component', () => {
       },
     });
 
-    const commitBox = wrapper.find('[data-testid="commit-box"]');
+    const commitBox = findCommitBox();
 
     expect(commitBox.exists()).toBe(true);
     expect(commitBox.text()).toBe('Select a branch to compare');
   });
+
+  it('emits select-branch on selected event', () => {
+    factory({
+      currentBranch: {
+        text: '',
+        value: '',
+      },
+    });
+
+    wrapper.findByTestId('compare-dropdown').vm.$emit('selected', { value: 'main' });
+
+    expect(wrapper.emitted('select-branch')).toEqual([['main']]);
+  });
+
+  describe('currentBranch watcher', () => {
+    it('changes selected value', async () => {
+      factory({
+        currentBranch: {
+          text: '',
+          value: '',
+        },
+      });
+
+      expect(findCommitBox().text()).toBe('Select a branch to compare');
+
+      wrapper.setProps({ currentBranch: { text: 'main', value: 'main ' } });
+
+      await waitForPromises();
+
+      expect(findCommitBox().text()).toBe('commit content');
+    });
+  });
 });
diff --git a/spec/frontend/projects/settings_service_desk/components/custom_email_form_spec.js b/spec/frontend/projects/settings_service_desk/components/custom_email_form_spec.js
index ded8b181c4e..9b012995ea4 100644
--- a/spec/frontend/projects/settings_service_desk/components/custom_email_form_spec.js
+++ b/spec/frontend/projects/settings_service_desk/components/custom_email_form_spec.js
@@ -1,6 +1,8 @@
 import { mount } from '@vue/test-utils';
+import { GlLink } from '@gitlab/ui';
 import { nextTick } from 'vue';
 import { extendedWrapper } from 'helpers/vue_test_utils_helper';
+import { helpPagePath } from '~/helpers/help_page_helper';
 import CustomEmailForm from '~/projects/settings_service_desk/components/custom_email_form.vue';
 import ClipboardButton from '~/vue_shared/components/clipboard_button.vue';
 import { I18N_FORM_FORWARDING_CLIPBOARD_BUTTON_TITLE } from '~/projects/settings_service_desk/custom_email_constants';
@@ -15,6 +17,7 @@ describe('CustomEmailForm', () => {
 
   const findForm = () => wrapper.find('form');
   const findClipboardButton = () => wrapper.findComponent(ClipboardButton);
+  const findLink = () => wrapper.findComponent(GlLink);
   const findInputByTestId = (testId) => wrapper.findByTestId(testId).find('input');
   const findCustomEmailInput = () => findInputByTestId('form-custom-email');
   const findSmtpAddressInput = () => findInputByTestId('form-smtp-address');
@@ -35,6 +38,16 @@ describe('CustomEmailForm', () => {
     wrapper = extendedWrapper(mount(CustomEmailForm, { propsData: { ...defaultProps, ...props } }));
   };
 
+  it('displays help page link', () => {
+    createWrapper();
+
+    expect(findLink().attributes('href')).toBe(
+      helpPagePath('user/project/service_desk/configure.html', {
+        anchor: 'custom-email-address',
+      }),
+    );
+  });
+
   it('renders a copy to clipboard button', () => {
     createWrapper();
 
diff --git a/spec/frontend/projects/settings_service_desk/components/custom_email_wrapper_spec.js b/spec/frontend/projects/settings_service_desk/components/custom_email_wrapper_spec.js
index e54d09cf82f..174e05ceeee 100644
--- a/spec/frontend/projects/settings_service_desk/components/custom_email_wrapper_spec.js
+++ b/spec/frontend/projects/settings_service_desk/components/custom_email_wrapper_spec.js
@@ -1,7 +1,8 @@
 import { nextTick } from 'vue';
-import { GlLink, GlLoadingIcon, GlAlert } from '@gitlab/ui';
+import { GlLoadingIcon, GlAlert } from '@gitlab/ui';
 import { mount } from '@vue/test-utils';
 import AxiosMockAdapter from 'axios-mock-adapter';
+import { extendedWrapper } from 'helpers/vue_test_utils_helper';
 import axios from '~/lib/utils/axios_utils';
 import waitForPromises from 'helpers/wait_for_promises';
 import { HTTP_STATUS_OK, HTTP_STATUS_NOT_FOUND } from '~/lib/utils/http_status';
@@ -40,19 +41,21 @@ describe('CustomEmailWrapper', () => {
   const showToast = jest.fn();
 
   const createWrapper = (props = {}) => {
-    wrapper = mount(CustomEmailWrapper, {
-      propsData: { ...defaultProps, ...props },
-      mocks: {
-        $toast: {
-          show: showToast,
+    wrapper = extendedWrapper(
+      mount(CustomEmailWrapper, {
+        propsData: { ...defaultProps, ...props },
+        mocks: {
+          $toast: {
+            show: showToast,
+          },
         },
-      },
-    });
+      }),
+    );
   };
 
   const findLoadingIcon = () => wrapper.findComponent(GlLoadingIcon);
   const findAlert = () => wrapper.findComponent(GlAlert);
-  const findFeedbackLink = () => wrapper.findComponent(GlLink);
+  const findFeedbackLink = () => wrapper.findByTestId('feedback-link');
   const findCustomEmailForm = () => wrapper.findComponent(CustomEmailForm);
   const findCustomEmail = () => wrapper.findComponent(CustomEmail);
   const findCustomEmailConfirmModal = () => wrapper.findComponent(CustomEmailConfirmModal);
diff --git a/spec/frontend/super_sidebar/components/nav_item_spec.js b/spec/frontend/super_sidebar/components/nav_item_spec.js
index 25c7082bbf3..89d774c4b43 100644
--- a/spec/frontend/super_sidebar/components/nav_item_spec.js
+++ b/spec/frontend/super_sidebar/components/nav_item_spec.js
@@ -90,6 +90,10 @@ describe('NavItem component', () => {
         expect(findPinButton().exists()).toBe(true);
       });
 
+      it('contains an aria-label', () => {
+        expect(findPinButton().attributes('aria-label')).toBe('Pin Foo');
+      });
+
       it('toggles pointer events on after CSS fade-in', async () => {
         const pinButton = findPinButton();
 
diff --git a/spec/lib/bitbucket/representation/pull_request_spec.rb b/spec/lib/bitbucket/representation/pull_request_spec.rb
index f39222805d0..544dd498aea 100644
--- a/spec/lib/bitbucket/representation/pull_request_spec.rb
+++ b/spec/lib/bitbucket/representation/pull_request_spec.rb
@@ -56,4 +56,9 @@ RSpec.describe Bitbucket::Representation::PullRequest, feature_category: :import
   describe '#updated_at' do
     it { expect(described_class.new('updated_on' => '2023-01-01').updated_at).to eq('2023-01-01') }
   end
+
+  describe '#merge_commit_sha' do
+    it { expect(described_class.new('merge_commit' => { 'hash' => 'SHA' }).merge_commit_sha).to eq('SHA') }
+    it { expect(described_class.new({}).merge_commit_sha).to be_nil }
+  end
 end
diff --git a/spec/lib/click_house/record_sync_context_spec.rb b/spec/lib/click_house/record_sync_context_spec.rb
new file mode 100644
index 00000000000..7873796cd9c
--- /dev/null
+++ b/spec/lib/click_house/record_sync_context_spec.rb
@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe ClickHouse::RecordSyncContext, feature_category: :value_stream_management do
+  let(:records) { [Issue.new(id: 1), Issue.new(id: 2), Issue.new(id: 3), Issue.new(id: 4)] }
+
+  subject(:sync_context) { described_class.new(last_record_id: 0, max_records_per_batch: 3) }
+
+  it 'allows processing 3 records per batch' do
+    records.take(3).each do |record|
+      sync_context.last_processed_id = record.id
+    end
+
+    expect(sync_context).to be_record_limit_reached
+    expect(sync_context.last_processed_id).to eq(3)
+
+    expect { sync_context.new_batch! }.to change { sync_context.record_count_in_current_batch }.from(3).to(0)
+
+    expect(sync_context).not_to be_record_limit_reached
+
+    records.take(3).each do |record|
+      sync_context.last_processed_id = record.id
+    end
+
+    expect(sync_context).to be_record_limit_reached
+  end
+
+  it 'sets the no more records flag' do
+    expect { sync_context.no_more_records! }.to change { sync_context.no_more_records? }.from(false).to(true)
+  end
+end
diff --git a/spec/lib/click_house/sync_cursor_spec.rb b/spec/lib/click_house/sync_cursor_spec.rb
new file mode 100644
index 00000000000..43ffaa76e1d
--- /dev/null
+++ b/spec/lib/click_house/sync_cursor_spec.rb
@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe ClickHouse::SyncCursor, feature_category: :value_stream_management, click_house: {} do
+  def value
+    ClickHouse::SyncCursor.cursor_for(:my_table)
+  end
+
+  context 'when cursor is empty' do
+    it 'returns the default value: 0' do
+      expect(value).to eq(0)
+    end
+  end
+
+  context 'when cursor is present' do
+    it 'updates and returns the current cursor value' do
+      described_class.update_cursor_for(:my_table, 1111)
+
+      expect(value).to eq(1111)
+
+      described_class.update_cursor_for(:my_table, 2222)
+
+      expect(value).to eq(2222)
+    end
+  end
+
+  context 'when updating a different cursor' do
+    it 'does not affect the other cursors' do
+      described_class.update_cursor_for(:other_table, 1111)
+
+      expect(value).to eq(0)
+    end
+  end
+end
diff --git a/spec/lib/gitlab/bitbucket_import/importer_spec.rb b/spec/lib/gitlab/bitbucket_import/importer_spec.rb
index 4c94ecfe745..9786e7a364e 100644
--- a/spec/lib/gitlab/bitbucket_import/importer_spec.rb
+++ b/spec/lib/gitlab/bitbucket_import/importer_spec.rb
@@ -92,6 +92,7 @@ RSpec.describe Gitlab::BitbucketImport::Importer, :clean_gitlab_redis_cache, fea
 
   describe '#import_pull_requests' do
     let(:source_branch_sha) { sample.commits.last }
+    let(:merge_commit_sha) { sample.commits.second }
     let(:target_branch_sha) { sample.commits.first }
     let(:pull_request) do
       instance_double(
@@ -101,6 +102,7 @@ RSpec.describe Gitlab::BitbucketImport::Importer, :clean_gitlab_redis_cache, fea
         source_branch_name: Gitlab::Git::BRANCH_REF_PREFIX + sample.source_branch,
         target_branch_sha: target_branch_sha,
         target_branch_name: Gitlab::Git::BRANCH_REF_PREFIX + sample.target_branch,
+        merge_commit_sha: merge_commit_sha,
         title: 'This is a title',
         description: 'This is a test pull request',
         state: 'merged',
@@ -217,17 +219,29 @@ RSpec.describe Gitlab::BitbucketImport::Importer, :clean_gitlab_redis_cache, fea
       end
     end
 
-    context "when branches' sha is not found in the repository" do
+    context 'when source SHA is not found in the repository' do
       let(:source_branch_sha) { 'a' * Commit::MIN_SHA_LENGTH }
-      let(:target_branch_sha) { 'b' * Commit::MIN_SHA_LENGTH }
+      let(:target_branch_sha) { 'c' * Commit::MIN_SHA_LENGTH }
 
-      it 'uses the pull request sha references' do
+      it 'uses merge commit SHA for source' do
         expect { subject.execute }.to change { MergeRequest.count }.by(1)
 
         merge_request_diff = MergeRequest.first.merge_request_diff
-        expect(merge_request_diff.head_commit_sha).to eq source_branch_sha
+        expect(merge_request_diff.head_commit_sha).to eq merge_commit_sha
         expect(merge_request_diff.start_commit_sha).to eq target_branch_sha
       end
+
+      context 'when the merge commit SHA is also not found' do
+        let(:merge_commit_sha) { 'b' * Commit::MIN_SHA_LENGTH }
+
+        it 'uses the pull request sha references' do
+          expect { subject.execute }.to change { MergeRequest.count }.by(1)
+
+          merge_request_diff = MergeRequest.first.merge_request_diff
+          expect(merge_request_diff.head_commit_sha).to eq source_branch_sha
+          expect(merge_request_diff.start_commit_sha).to eq target_branch_sha
+        end
+      end
     end
 
     context "when target_branch_sha is blank" do
diff --git a/spec/lib/gitlab/database_spec.rb b/spec/lib/gitlab/database_spec.rb
index 0d8fa4dad6d..5af8f8c7bdd 100644
--- a/spec/lib/gitlab/database_spec.rb
+++ b/spec/lib/gitlab/database_spec.rb
@@ -251,6 +251,43 @@ RSpec.describe Gitlab::Database, feature_category: :database do
     end
   end
 
+  describe '.check_single_connection_and_print_warning' do
+    subject { described_class.check_single_connection_and_print_warning }
+
+    it 'prints a warning if single connection' do
+      allow(described_class).to receive(:database_mode).and_return(::Gitlab::Database::MODE_SINGLE_DATABASE)
+
+      expect(Kernel).to receive(:warn).with(/Your database has a single connection/)
+
+      subject
+    end
+
+    it 'does not print a warning if single ci connection' do
+      allow(described_class).to receive(:database_mode).and_return(::Gitlab::Database::MODE_SINGLE_DATABASE_CI_CONNECTION)
+
+      expect(Kernel).not_to receive(:warn)
+
+      subject
+    end
+
+    it 'does not print a warning if multiple connection' do
+      allow(described_class).to receive(:database_mode).and_return(::Gitlab::Database::MODE_MULTIPLE_DATABASES)
+
+      expect(Kernel).not_to receive(:warn)
+
+      subject
+    end
+
+    it 'does not print a warning in Rails runner environment' do
+      allow(described_class).to receive(:database_mode).and_return(::Gitlab::Database::MODE_SINGLE_DATABASE)
+      allow(Gitlab::Runtime).to receive(:rails_runner?).and_return(true)
+
+      expect(Kernel).not_to receive(:warn)
+
+      subject
+    end
+  end
+
   describe '.db_config_for_connection' do
     context 'when the regular connection is used' do
       it 'returns db_config' do
diff --git a/spec/models/analytics/cycle_analytics/runtime_limiter_spec.rb b/spec/models/analytics/cycle_analytics/runtime_limiter_spec.rb
new file mode 100644
index 00000000000..1a5200719c8
--- /dev/null
+++ b/spec/models/analytics/cycle_analytics/runtime_limiter_spec.rb
@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Analytics::CycleAnalytics::RuntimeLimiter, feature_category: :value_stream_management do
+  let(:max_runtime) { 321 }
+  let(:runtime_limiter) { described_class.new(max_runtime) }
+
+  describe '#elapsed_time' do
+    it 'reports monotonic elapsed time since instantiation' do
+      elapsed = 123
+      first_monotonic_time = 100
+      second_monotonic_time = first_monotonic_time + elapsed
+
+      expect(Gitlab::Metrics::System).to receive(:monotonic_time)
+        .and_return(first_monotonic_time, second_monotonic_time)
+
+      expect(runtime_limiter.elapsed_time).to eq(elapsed)
+    end
+  end
+
+  describe '#over_time?' do
+    it 'returns true if over time' do
+      start_time = 100
+      allow(Gitlab::Metrics::System).to receive(:monotonic_time).and_return(start_time, start_time + max_runtime - 1)
+
+      expect(runtime_limiter.over_time?).to be(false)
+
+      allow(Gitlab::Metrics::System).to receive(:monotonic_time).and_return(start_time + max_runtime)
+      expect(runtime_limiter.over_time?).to be(true)
+
+      allow(Gitlab::Metrics::System).to receive(:monotonic_time).and_return(start_time + max_runtime + 1)
+      expect(runtime_limiter.over_time?).to be(true)
+    end
+  end
+
+  describe '#was_over_time?' do
+    it 'returns true if over_time? returned true at an earlier step' do
+      first_monotonic_time = 10
+      second_monotonic_time = first_monotonic_time + 50
+      third_monotonic_time = second_monotonic_time + 50 # over time: 110 > 100
+
+      expect(Gitlab::Metrics::System).to receive(:monotonic_time)
+        .and_return(first_monotonic_time, second_monotonic_time, third_monotonic_time)
+
+      runtime_limiter = described_class.new(100)
+
+      expect(runtime_limiter.over_time?).to be(false) # uses the second_monotonic_time
+      expect(runtime_limiter.was_over_time?).to be(false)
+
+      expect(runtime_limiter.over_time?).to be(true) # uses the third_monotonic_time
+      expect(runtime_limiter.was_over_time?).to be(true)
+    end
+  end
+end
diff --git a/spec/models/review_spec.rb b/spec/models/review_spec.rb
index 2683dc93a4b..75cdea5bca7 100644
--- a/spec/models/review_spec.rb
+++ b/spec/models/review_spec.rb
@@ -41,4 +41,23 @@ RSpec.describe Review do
       expect(review.participants).to include(review.author)
     end
   end
+
+  describe '#from_merge_request_author?' do
+    let(:merge_request) { build_stubbed(:merge_request) }
+    let(:review) { build_stubbed(:review, merge_request: merge_request, author: author) }
+
+    subject(:from_merge_request_author?) { review.from_merge_request_author? }
+
+    context 'when review author is the merge request author' do
+      let(:author) { merge_request.author }
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'when review author is not the merge request author' do
+      let(:author) { build_stubbed(:user) }
+
+      it { is_expected.to eq(false) }
+    end
+  end
 end
diff --git a/spec/requests/api/commit_statuses_spec.rb b/spec/requests/api/commit_statuses_spec.rb
index b7377a45dc9..9247d9366b2 100644
--- a/spec/requests/api/commit_statuses_spec.rb
+++ b/spec/requests/api/commit_statuses_spec.rb
@@ -135,471 +135,463 @@ RSpec.describe API::CommitStatuses, :clean_gitlab_redis_cache, feature_category:
     end
   end
 
-  [true, false].each do |flag|
-    context "when feature flag ci_commit_statuses_api_exclusive_lock is set to #{flag}" do
-      before do
-        stub_feature_flags(ci_commit_statuses_api_exclusive_lock: flag)
-      end
+  describe 'POST /projects/:id/statuses/:sha' do
+    let(:post_url) { "/projects/#{project.id}/statuses/#{sha}" }
 
-      describe 'POST /projects/:id/statuses/:sha' do
-        let(:post_url) { "/projects/#{project.id}/statuses/#{sha}" }
+    context 'developer user' do
+      context 'uses only required parameters' do
+        valid_statues = %w[pending running success failed canceled]
+        valid_statues.each do |status|
+          context "for #{status}" do
+            context 'when pipeline for sha does not exists' do
+              it 'creates commit status and sets pipeline iid' do
+                post api(post_url, developer), params: { state: status }
 
-        context 'developer user' do
-          context 'uses only required parameters' do
-            valid_statues = %w[pending running success failed canceled]
-            valid_statues.each do |status|
-              context "for #{status}" do
-                context 'when pipeline for sha does not exists' do
-                  it 'creates commit status and sets pipeline iid' do
-                    post api(post_url, developer), params: { state: status }
+                expect(response).to have_gitlab_http_status(:created)
+                expect(json_response['sha']).to eq(commit.id)
+                expect(json_response['status']).to eq(status)
+                expect(json_response['name']).to eq('default')
+                expect(json_response['ref']).not_to be_empty
+                expect(json_response['target_url']).to be_nil
+                expect(json_response['description']).to be_nil
+                expect(json_response['pipeline_id']).not_to be_nil
 
-                    expect(response).to have_gitlab_http_status(:created)
-                    expect(json_response['sha']).to eq(commit.id)
-                    expect(json_response['status']).to eq(status)
-                    expect(json_response['name']).to eq('default')
-                    expect(json_response['ref']).not_to be_empty
-                    expect(json_response['target_url']).to be_nil
-                    expect(json_response['description']).to be_nil
-                    expect(json_response['pipeline_id']).not_to be_nil
-
-                    if status == 'failed'
-                      expect(CommitStatus.find(json_response['id'])).to be_api_failure
-                    end
-
-                    expect(::Ci::Pipeline.last.iid).not_to be_nil
-                  end
-                end
-              end
-            end
-
-            context 'when pipeline already exists for the specified sha' do
-              let!(:pipeline) { create(:ci_pipeline, project: project, sha: sha, ref: 'ref') }
-              let(:params) { { state: 'pending' } }
-
-              shared_examples_for 'creates a commit status for the existing pipeline with an external stage' do
-                it do
-                  expect do
-                    post api(post_url, developer), params: params
-                  end.not_to change { Ci::Pipeline.count }
-
-                  job = pipeline.statuses.find_by_name(json_response['name'])
-
-                  expect(response).to have_gitlab_http_status(:created)
-                  expect(job.ci_stage.name).to eq('external')
-                  expect(job.ci_stage.position).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
-                  expect(job.ci_stage.pipeline).to eq(pipeline)
-                  expect(job.status).to eq('pending')
-                  expect(job.stage_idx).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
-                end
-              end
-
-              shared_examples_for 'updates the commit status with an external stage' do
-                before do
-                  post api(post_url, developer), params: { state: 'pending' }
+                if status == 'failed'
+                  expect(CommitStatus.find(json_response['id'])).to be_api_failure
                 end
 
-                it 'updates the commit status with the external stage' do
-                  post api(post_url, developer), params: { state: 'running' }
-                  job = pipeline.statuses.find_by_name(json_response['name'])
-
-                  expect(job.ci_stage.name).to eq('external')
-                  expect(job.ci_stage.position).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
-                  expect(job.ci_stage.pipeline).to eq(pipeline)
-                  expect(job.status).to eq('running')
-                  expect(job.stage_idx).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
-                end
-              end
-
-              context 'with pipeline for merge request' do
-                let!(:merge_request) { create(:merge_request, :with_detached_merge_request_pipeline, source_project: project) }
-                let!(:pipeline) { merge_request.all_pipelines.last }
-                let(:sha) { pipeline.sha }
-
-                it_behaves_like 'creates a commit status for the existing pipeline with an external stage'
-              end
-
-              context 'when an external stage does not exist' do
-                context 'when the commit status does not exist' do
-                  it_behaves_like 'creates a commit status for the existing pipeline with an external stage'
-                end
-
-                context 'when the commit status exists' do
-                  it_behaves_like 'updates the commit status with an external stage'
-                end
-              end
-
-              context 'when an external stage already exists' do
-                let(:stage) { create(:ci_stage, name: 'external', pipeline: pipeline, position: 1_000_000) }
-
-                context 'when the commit status exists' do
-                  it_behaves_like 'updates the commit status with an external stage'
-                end
-
-                context 'when the commit status does not exist' do
-                  it_behaves_like 'creates a commit status for the existing pipeline with an external stage'
-                end
-              end
-            end
-
-            context 'when the pipeline does not exist' do
-              it 'creates a commit status and a stage' do
-                expect do
-                  post api(post_url, developer), params: { state: 'pending' }
-                end.to change { Ci::Pipeline.count }.by(1)
-                job = Ci::Pipeline.last.statuses.find_by_name(json_response['name'])
-
-                expect(job.ci_stage.name).to eq('external')
-                expect(job.ci_stage.position).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
-                expect(job.status).to eq('pending')
-                expect(job.stage_idx).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
+                expect(::Ci::Pipeline.last.iid).not_to be_nil
               end
             end
           end
+        end
 
-          context 'when status transitions from pending' do
+        context 'when pipeline already exists for the specified sha' do
+          let!(:pipeline) { create(:ci_pipeline, project: project, sha: sha, ref: 'ref') }
+          let(:params) { { state: 'pending' } }
+
+          shared_examples_for 'creates a commit status for the existing pipeline with an external stage' do
+            it do
+              expect do
+                post api(post_url, developer), params: params
+              end.not_to change { Ci::Pipeline.count }
+
+              job = pipeline.statuses.find_by_name(json_response['name'])
+
+              expect(response).to have_gitlab_http_status(:created)
+              expect(job.ci_stage.name).to eq('external')
+              expect(job.ci_stage.position).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
+              expect(job.ci_stage.pipeline).to eq(pipeline)
+              expect(job.status).to eq('pending')
+              expect(job.stage_idx).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
+            end
+          end
+
+          shared_examples_for 'updates the commit status with an external stage' do
             before do
               post api(post_url, developer), params: { state: 'pending' }
             end
 
-            valid_statues = %w[running success failed canceled]
-            valid_statues.each do |status|
-              it "to #{status}" do
-                expect { post api(post_url, developer), params: { state: status } }.not_to change { CommitStatus.count }
+            it 'updates the commit status with the external stage' do
+              post api(post_url, developer), params: { state: 'running' }
+              job = pipeline.statuses.find_by_name(json_response['name'])
 
-                expect(response).to have_gitlab_http_status(:created)
-                expect(json_response['status']).to eq(status)
-              end
+              expect(job.ci_stage.name).to eq('external')
+              expect(job.ci_stage.position).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
+              expect(job.ci_stage.pipeline).to eq(pipeline)
+              expect(job.status).to eq('running')
+              expect(job.stage_idx).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
             end
           end
 
-          context 'with all optional parameters' do
-            context 'when creating a commit status' do
-              subject do
-                post api(post_url, developer), params: {
-                  state: 'success',
-                  context: 'coverage',
-                  ref: 'master',
-                  description: 'test',
-                  coverage: 80.0,
-                  target_url: 'http://gitlab.com/status'
-                }
-              end
+          context 'with pipeline for merge request' do
+            let!(:merge_request) { create(:merge_request, :with_detached_merge_request_pipeline, source_project: project) }
+            let!(:pipeline) { merge_request.all_pipelines.last }
+            let(:sha) { pipeline.sha }
 
-              it 'creates commit status' do
-                subject
+            it_behaves_like 'creates a commit status for the existing pipeline with an external stage'
+          end
 
-                expect(response).to have_gitlab_http_status(:created)
-                expect(json_response['sha']).to eq(commit.id)
-                expect(json_response['status']).to eq('success')
-                expect(json_response['name']).to eq('coverage')
-                expect(json_response['ref']).to eq('master')
-                expect(json_response['coverage']).to eq(80.0)
-                expect(json_response['description']).to eq('test')
-                expect(json_response['target_url']).to eq('http://gitlab.com/status')
-              end
-
-              context 'when merge request exists for given branch' do
-                let!(:merge_request) { create(:merge_request, source_project: project, source_branch: 'master', target_branch: 'develop') }
-
-                it 'sets head pipeline' do
-                  subject
-
-                  expect(response).to have_gitlab_http_status(:created)
-                  expect(merge_request.reload.head_pipeline).not_to be_nil
-                end
-              end
+          context 'when an external stage does not exist' do
+            context 'when the commit status does not exist' do
+              it_behaves_like 'creates a commit status for the existing pipeline with an external stage'
             end
 
-            context 'when updating a commit status' do
-              let(:parameters) do
-                {
-                  state: 'success',
-                  name: 'coverage',
-                  ref: 'master'
-                }
-              end
-
-              let(:updatable_optional_attributes) do
-                {
-                  description: 'new description',
-                  coverage: 90.0
-                }
-              end
-
-              # creating the initial commit status
-              before do
-                post api(post_url, developer), params: {
-                  state: 'running',
-                  context: 'coverage',
-                  ref: 'master',
-                  description: 'coverage test',
-                  coverage: 10.0,
-                  target_url: 'http://gitlab.com/status'
-                }
-              end
-
-              subject(:send_request) do
-                post api(post_url, developer), params: {
-                  **parameters,
-                  **updatable_optional_attributes
-                }
-              end
-
-              it 'updates a commit status' do
-                send_request
-
-                expect(response).to have_gitlab_http_status(:created)
-                expect(json_response['sha']).to eq(commit.id)
-                expect(json_response['status']).to eq('success')
-                expect(json_response['name']).to eq('coverage')
-                expect(json_response['ref']).to eq('master')
-                expect(json_response['coverage']).to eq(90.0)
-                expect(json_response['description']).to eq('new description')
-                expect(json_response['target_url']).to eq('http://gitlab.com/status')
-              end
-
-              it 'does not create a new commit status' do
-                expect { send_request }.not_to change { CommitStatus.count }
-              end
-
-              context 'when the `state` parameter is sent the same' do
-                let(:parameters) do
-                  {
-                    state: 'running',
-                    name: 'coverage',
-                    ref: 'master'
-                  }
-                end
-
-                it 'does not update the commit status' do
-                  send_request
-
-                  expect(response).to have_gitlab_http_status(:bad_request)
-                  expect(json_response['message']).to eq("Cannot transition status via :run from :running (Reason(s): Status cannot transition via \"run\")")
-
-                  commit_status = project.commit_statuses.find_by!(name: 'coverage')
-
-                  expect(commit_status.description).to eq('coverage test')
-                  expect(commit_status.coverage).to eq(10.0)
-                end
-              end
-            end
-
-            context 'when a pipeline id is specified' do
-              let!(:first_pipeline) do
-                project.ci_pipelines.build(source: :push, sha: commit.id, ref: 'master', status: 'created').tap do |p|
-                  p.ensure_project_iid! # Necessary to avoid cross-database modification error
-                  p.save!
-                end
-              end
-
-              let!(:other_pipeline) do
-                project.ci_pipelines.build(source: :push, sha: commit.id, ref: 'master', status: 'created').tap do |p|
-                  p.ensure_project_iid! # Necessary to avoid cross-database modification error
-                  p.save!
-                end
-              end
-
-              subject do
-                post api(post_url, developer), params: {
-                  pipeline_id: other_pipeline.id,
-                  state: 'success',
-                  ref: 'master'
-                }
-              end
-
-              it 'update the correct pipeline', :sidekiq_might_not_need_inline do
-                subject
-
-                expect(first_pipeline.reload.status).to eq('created')
-                expect(other_pipeline.reload.status).to eq('success')
-              end
+            context 'when the commit status exists' do
+              it_behaves_like 'updates the commit status with an external stage'
             end
           end
 
-          context 'when retrying a commit status' do
-            subject(:post_request) do
-              post api(post_url, developer),
-                params: { state: 'failed', name: 'test', ref: 'master' }
+          context 'when an external stage already exists' do
+            let(:stage) { create(:ci_stage, name: 'external', pipeline: pipeline, position: 1_000_000) }
 
-              post api(post_url, developer),
-                params: { state: 'success', name: 'test', ref: 'master' }
+            context 'when the commit status exists' do
+              it_behaves_like 'updates the commit status with an external stage'
             end
 
-            it 'correctly posts a new commit status' do
-              post_request
+            context 'when the commit status does not exist' do
+              it_behaves_like 'creates a commit status for the existing pipeline with an external stage'
+            end
+          end
+        end
+
+        context 'when the pipeline does not exist' do
+          it 'creates a commit status and a stage' do
+            expect do
+              post api(post_url, developer), params: { state: 'pending' }
+            end.to change { Ci::Pipeline.count }.by(1)
+            job = Ci::Pipeline.last.statuses.find_by_name(json_response['name'])
+
+            expect(job.ci_stage.name).to eq('external')
+            expect(job.ci_stage.position).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
+            expect(job.status).to eq('pending')
+            expect(job.stage_idx).to eq(GenericCommitStatus::EXTERNAL_STAGE_IDX)
+          end
+        end
+      end
+
+      context 'when status transitions from pending' do
+        before do
+          post api(post_url, developer), params: { state: 'pending' }
+        end
+
+        valid_statues = %w[running success failed canceled]
+        valid_statues.each do |status|
+          it "to #{status}" do
+            expect { post api(post_url, developer), params: { state: status } }.not_to change { CommitStatus.count }
+
+            expect(response).to have_gitlab_http_status(:created)
+            expect(json_response['status']).to eq(status)
+          end
+        end
+      end
+
+      context 'with all optional parameters' do
+        context 'when creating a commit status' do
+          subject do
+            post api(post_url, developer), params: {
+              state: 'success',
+              context: 'coverage',
+              ref: 'master',
+              description: 'test',
+              coverage: 80.0,
+              target_url: 'http://gitlab.com/status'
+            }
+          end
+
+          it 'creates commit status' do
+            subject
+
+            expect(response).to have_gitlab_http_status(:created)
+            expect(json_response['sha']).to eq(commit.id)
+            expect(json_response['status']).to eq('success')
+            expect(json_response['name']).to eq('coverage')
+            expect(json_response['ref']).to eq('master')
+            expect(json_response['coverage']).to eq(80.0)
+            expect(json_response['description']).to eq('test')
+            expect(json_response['target_url']).to eq('http://gitlab.com/status')
+          end
+
+          context 'when merge request exists for given branch' do
+            let!(:merge_request) { create(:merge_request, source_project: project, source_branch: 'master', target_branch: 'develop') }
+
+            it 'sets head pipeline' do
+              subject
 
               expect(response).to have_gitlab_http_status(:created)
-              expect(json_response['sha']).to eq(commit.id)
-              expect(json_response['status']).to eq('success')
-            end
-
-            it 'retries the commit status', :sidekiq_might_not_need_inline do
-              post_request
-
-              expect(CommitStatus.count).to eq 2
-              expect(CommitStatus.first).to be_retried
-              expect(CommitStatus.last.pipeline).to be_success
-            end
-          end
-
-          context 'when status is invalid' do
-            before do
-              post api(post_url, developer), params: { state: 'invalid' }
-            end
-
-            it 'does not create commit status' do
-              expect(response).to have_gitlab_http_status(:bad_request)
-              expect(json_response['message']).to eq(nil)
-            end
-          end
-
-          context 'when request without a state made' do
-            before do
-              post api(post_url, developer)
-            end
-
-            it 'does not create commit status' do
-              expect(response).to have_gitlab_http_status(:bad_request)
-              expect(json_response['message']).to eq(nil)
-            end
-          end
-
-          context 'when updating a protected ref' do
-            before do
-              create(:protected_branch, project: project, name: 'master')
-              post api(post_url, user), params: { state: 'running', ref: 'master' }
-            end
-
-            context 'with user as developer' do
-              let(:user) { developer }
-
-              it 'does not create commit status' do
-                expect(response).to have_gitlab_http_status(:forbidden)
-                expect(json_response['message']).to eq('403 Forbidden')
-              end
-            end
-
-            context 'with user as maintainer' do
-              let(:user) { create_user(:maintainer) }
-
-              it 'creates commit status' do
-                expect(response).to have_gitlab_http_status(:created)
-              end
-            end
-          end
-
-          context 'when commit SHA is invalid' do
-            let(:sha) { 'invalid_sha' }
-
-            before do
-              post api(post_url, developer), params: { state: 'running' }
-            end
-
-            it 'returns not found error' do
-              expect(response).to have_gitlab_http_status(:not_found)
-              expect(json_response['message']).to eq('404 Commit Not Found')
-            end
-          end
-
-          context 'when target URL is an invalid address' do
-            before do
-              post api(post_url, developer), params: {
-                                              state: 'pending',
-                                              target_url: 'invalid url'
-                                            }
-            end
-
-            it 'responds with bad request status and validation errors' do
-              expect(response).to have_gitlab_http_status(:bad_request)
-              expect(json_response['message']['target_url'])
-                .to include 'is blocked: Only allowed schemes are http, https'
-            end
-          end
-
-          context 'when target URL is an unsupported scheme' do
-            before do
-              post api(post_url, developer), params: {
-                                              state: 'pending',
-                                              target_url: 'git://example.com'
-                                            }
-            end
-
-            it 'responds with bad request status and validation errors' do
-              expect(response).to have_gitlab_http_status(:bad_request)
-              expect(json_response['message']['target_url'])
-                  .to include 'is blocked: Only allowed schemes are http, https'
-            end
-          end
-
-          context 'when trying to update a status of a different type' do
-            let!(:pipeline) { create(:ci_pipeline, project: project, sha: sha, ref: 'ref') }
-            let!(:ci_build) { create(:ci_build, pipeline: pipeline, name: 'test-job') }
-            let(:params) { { state: 'pending', name: 'test-job' } }
-
-            before do
-              post api(post_url, developer), params: params
-            end
-
-            it 'responds with bad request status and validation errors' do
-              expect(response).to have_gitlab_http_status(:bad_request)
-              expect(json_response['message']['name'])
-                  .to include 'has already been taken'
-            end
-          end
-
-          context 'with partitions', :ci_partitionable do
-            let(:current_partition_id) { ci_testing_partition_id }
-
-            before do
-              allow(Ci::Pipeline)
-                .to receive(:current_partition_value) { current_partition_id }
-            end
-
-            it 'creates records in the current partition' do
-              expect { post api(post_url, developer), params: { state: 'running' } }
-                .to change(CommitStatus, :count).by(1)
-                .and change(Ci::Pipeline, :count).by(1)
-
-              status = CommitStatus.find(json_response['id'])
-
-              expect(status.partition_id).to eq(current_partition_id)
-              expect(status.pipeline.partition_id).to eq(current_partition_id)
+              expect(merge_request.reload.head_pipeline).not_to be_nil
             end
           end
         end
 
-        context 'reporter user' do
-          before do
-            post api(post_url, reporter), params: { state: 'running' }
+        context 'when updating a commit status' do
+          let(:parameters) do
+            {
+              state: 'success',
+              name: 'coverage',
+              ref: 'master'
+            }
           end
 
+          let(:updatable_optional_attributes) do
+            {
+              description: 'new description',
+              coverage: 90.0
+            }
+          end
+
+          # creating the initial commit status
+          before do
+            post api(post_url, developer), params: {
+              state: 'running',
+              context: 'coverage',
+              ref: 'master',
+              description: 'coverage test',
+              coverage: 10.0,
+              target_url: 'http://gitlab.com/status'
+            }
+          end
+
+          subject(:send_request) do
+            post api(post_url, developer), params: {
+              **parameters,
+              **updatable_optional_attributes
+            }
+          end
+
+          it 'updates a commit status' do
+            send_request
+
+            expect(response).to have_gitlab_http_status(:created)
+            expect(json_response['sha']).to eq(commit.id)
+            expect(json_response['status']).to eq('success')
+            expect(json_response['name']).to eq('coverage')
+            expect(json_response['ref']).to eq('master')
+            expect(json_response['coverage']).to eq(90.0)
+            expect(json_response['description']).to eq('new description')
+            expect(json_response['target_url']).to eq('http://gitlab.com/status')
+          end
+
+          it 'does not create a new commit status' do
+            expect { send_request }.not_to change { CommitStatus.count }
+          end
+
+          context 'when the `state` parameter is sent the same' do
+            let(:parameters) do
+              {
+                state: 'running',
+                name: 'coverage',
+                ref: 'master'
+              }
+            end
+
+            it 'does not update the commit status' do
+              send_request
+
+              expect(response).to have_gitlab_http_status(:bad_request)
+              expect(json_response['message']).to eq("Cannot transition status via :run from :running (Reason(s): Status cannot transition via \"run\")")
+
+              commit_status = project.commit_statuses.find_by!(name: 'coverage')
+
+              expect(commit_status.description).to eq('coverage test')
+              expect(commit_status.coverage).to eq(10.0)
+            end
+          end
+        end
+
+        context 'when a pipeline id is specified' do
+          let!(:first_pipeline) do
+            project.ci_pipelines.build(source: :push, sha: commit.id, ref: 'master', status: 'created').tap do |p|
+              p.ensure_project_iid! # Necessary to avoid cross-database modification error
+              p.save!
+            end
+          end
+
+          let!(:other_pipeline) do
+            project.ci_pipelines.build(source: :push, sha: commit.id, ref: 'master', status: 'created').tap do |p|
+              p.ensure_project_iid! # Necessary to avoid cross-database modification error
+              p.save!
+            end
+          end
+
+          subject do
+            post api(post_url, developer), params: {
+              pipeline_id: other_pipeline.id,
+              state: 'success',
+              ref: 'master'
+            }
+          end
+
+          it 'update the correct pipeline', :sidekiq_might_not_need_inline do
+            subject
+
+            expect(first_pipeline.reload.status).to eq('created')
+            expect(other_pipeline.reload.status).to eq('success')
+          end
+        end
+      end
+
+      context 'when retrying a commit status' do
+        subject(:post_request) do
+          post api(post_url, developer),
+            params: { state: 'failed', name: 'test', ref: 'master' }
+
+          post api(post_url, developer),
+            params: { state: 'success', name: 'test', ref: 'master' }
+        end
+
+        it 'correctly posts a new commit status' do
+          post_request
+
+          expect(response).to have_gitlab_http_status(:created)
+          expect(json_response['sha']).to eq(commit.id)
+          expect(json_response['status']).to eq('success')
+        end
+
+        it 'retries the commit status', :sidekiq_might_not_need_inline do
+          post_request
+
+          expect(CommitStatus.count).to eq 2
+          expect(CommitStatus.first).to be_retried
+          expect(CommitStatus.last.pipeline).to be_success
+        end
+      end
+
+      context 'when status is invalid' do
+        before do
+          post api(post_url, developer), params: { state: 'invalid' }
+        end
+
+        it 'does not create commit status' do
+          expect(response).to have_gitlab_http_status(:bad_request)
+          expect(json_response['message']).to eq(nil)
+        end
+      end
+
+      context 'when request without a state made' do
+        before do
+          post api(post_url, developer)
+        end
+
+        it 'does not create commit status' do
+          expect(response).to have_gitlab_http_status(:bad_request)
+          expect(json_response['message']).to eq(nil)
+        end
+      end
+
+      context 'when updating a protected ref' do
+        before do
+          create(:protected_branch, project: project, name: 'master')
+          post api(post_url, user), params: { state: 'running', ref: 'master' }
+        end
+
+        context 'with user as developer' do
+          let(:user) { developer }
+
           it 'does not create commit status' do
             expect(response).to have_gitlab_http_status(:forbidden)
             expect(json_response['message']).to eq('403 Forbidden')
           end
         end
 
-        context 'guest user' do
-          before do
-            post api(post_url, guest), params: { state: 'running' }
-          end
+        context 'with user as maintainer' do
+          let(:user) { create_user(:maintainer) }
 
-          it 'does not create commit status' do
-            expect(response).to have_gitlab_http_status(:forbidden)
-            expect(json_response['message']).to eq('403 Forbidden')
+          it 'creates commit status' do
+            expect(response).to have_gitlab_http_status(:created)
           end
         end
+      end
 
-        context 'unauthorized user' do
-          before do
-            post api(post_url)
-          end
+      context 'when commit SHA is invalid' do
+        let(:sha) { 'invalid_sha' }
 
-          it 'does not create commit status' do
-            expect(response).to have_gitlab_http_status(:unauthorized)
-          end
+        before do
+          post api(post_url, developer), params: { state: 'running' }
         end
+
+        it 'returns not found error' do
+          expect(response).to have_gitlab_http_status(:not_found)
+          expect(json_response['message']).to eq('404 Commit Not Found')
+        end
+      end
+
+      context 'when target URL is an invalid address' do
+        before do
+          post api(post_url, developer), params: {
+                                          state: 'pending',
+                                          target_url: 'invalid url'
+                                        }
+        end
+
+        it 'responds with bad request status and validation errors' do
+          expect(response).to have_gitlab_http_status(:bad_request)
+          expect(json_response['message']['target_url'])
+            .to include 'is blocked: Only allowed schemes are http, https'
+        end
+      end
+
+      context 'when target URL is an unsupported scheme' do
+        before do
+          post api(post_url, developer), params: {
+                                          state: 'pending',
+                                          target_url: 'git://example.com'
+                                        }
+        end
+
+        it 'responds with bad request status and validation errors' do
+          expect(response).to have_gitlab_http_status(:bad_request)
+          expect(json_response['message']['target_url'])
+              .to include 'is blocked: Only allowed schemes are http, https'
+        end
+      end
+
+      context 'when trying to update a status of a different type' do
+        let!(:pipeline) { create(:ci_pipeline, project: project, sha: sha, ref: 'ref') }
+        let!(:ci_build) { create(:ci_build, pipeline: pipeline, name: 'test-job') }
+        let(:params) { { state: 'pending', name: 'test-job' } }
+
+        before do
+          post api(post_url, developer), params: params
+        end
+
+        it 'responds with bad request status and validation errors' do
+          expect(response).to have_gitlab_http_status(:bad_request)
+          expect(json_response['message']['name'])
+              .to include 'has already been taken'
+        end
+      end
+
+      context 'with partitions', :ci_partitionable do
+        let(:current_partition_id) { ci_testing_partition_id }
+
+        before do
+          allow(Ci::Pipeline)
+            .to receive(:current_partition_value) { current_partition_id }
+        end
+
+        it 'creates records in the current partition' do
+          expect { post api(post_url, developer), params: { state: 'running' } }
+            .to change(CommitStatus, :count).by(1)
+            .and change(Ci::Pipeline, :count).by(1)
+
+          status = CommitStatus.find(json_response['id'])
+
+          expect(status.partition_id).to eq(current_partition_id)
+          expect(status.pipeline.partition_id).to eq(current_partition_id)
+        end
+      end
+    end
+
+    context 'reporter user' do
+      before do
+        post api(post_url, reporter), params: { state: 'running' }
+      end
+
+      it 'does not create commit status' do
+        expect(response).to have_gitlab_http_status(:forbidden)
+        expect(json_response['message']).to eq('403 Forbidden')
+      end
+    end
+
+    context 'guest user' do
+      before do
+        post api(post_url, guest), params: { state: 'running' }
+      end
+
+      it 'does not create commit status' do
+        expect(response).to have_gitlab_http_status(:forbidden)
+        expect(json_response['message']).to eq('403 Forbidden')
+      end
+    end
+
+    context 'unauthorized user' do
+      before do
+        post api(post_url)
+      end
+
+      it 'does not create commit status' do
+        expect(response).to have_gitlab_http_status(:unauthorized)
       end
     end
   end
diff --git a/spec/requests/api/internal/base_spec.rb b/spec/requests/api/internal/base_spec.rb
index fa35e367420..cf0cd9a2e85 100644
--- a/spec/requests/api/internal/base_spec.rb
+++ b/spec/requests/api/internal/base_spec.rb
@@ -881,7 +881,6 @@ RSpec.describe API::Internal::Base, feature_category: :system_access do
     end
 
     context "custom action" do
-      let(:access_checker) { double(Gitlab::GitAccess) }
       let(:payload) do
         {
           'action' => 'geo_proxy_to_primary',
@@ -898,7 +897,8 @@ RSpec.describe API::Internal::Base, feature_category: :system_access do
 
       before do
         project.add_guest(user)
-        expect(Gitlab::GitAccess).to receive(:new).with(
+
+        expect_next_instance_of(Gitlab::GitAccess,
           key,
           project,
           'ssh',
@@ -907,11 +907,12 @@ RSpec.describe API::Internal::Base, feature_category: :system_access do
             repository_path: "#{project.full_path}.git",
             redirected_path: nil
           }
-        ).and_return(access_checker)
-        expect(access_checker).to receive(:check).with(
-          'git-receive-pack',
-          'd14d6c0abdd253381df51a723d58691b2ee1ab08 570e7b2abdd848b95f2f578043fc23bd6f6fd24d refs/heads/master'
-        ).and_return(custom_action_result)
+        ) do |access_checker|
+          expect(access_checker).to receive(:check).with(
+            'git-receive-pack',
+            'd14d6c0abdd253381df51a723d58691b2ee1ab08 570e7b2abdd848b95f2f578043fc23bd6f6fd24d refs/heads/master'
+          ).and_return(custom_action_result)
+        end
       end
 
       context "git push" do
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index a4957bff000..6c4589b7a5f 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -297,11 +297,6 @@ RSpec.configure do |config|
       stub_feature_flags(ci_queueing_disaster_recovery_disable_fair_scheduling: false)
       stub_feature_flags(ci_queueing_disaster_recovery_disable_quota: false)
 
-      # The anonymous super-sidebar is under heavy development and enabling the flag
-      # globally leads to a lot of errors. This issue is for fixing all test to work with the
-      # new nav: https://gitlab.com/gitlab-org/gitlab/-/issues/420119
-      stub_feature_flags(super_sidebar_logged_out: false)
-
       # It's disabled in specs because we don't support certain features which
       # cause spec failures.
       stub_feature_flags(gitlab_error_tracking: false)
diff --git a/spec/workers/bulk_imports/pipeline_batch_worker_spec.rb b/spec/workers/bulk_imports/pipeline_batch_worker_spec.rb
index c10e1b486ab..3c33910b62c 100644
--- a/spec/workers/bulk_imports/pipeline_batch_worker_spec.rb
+++ b/spec/workers/bulk_imports/pipeline_batch_worker_spec.rb
@@ -73,6 +73,16 @@ RSpec.describe BulkImports::PipelineBatchWorker, feature_category: :importers do
       end
     end
 
+    context 'when batch status is started' do
+      let(:batch) { create(:bulk_import_batch_tracker, :started, tracker: tracker) }
+
+      it 'runs the given pipeline batch successfully' do
+        subject.perform(batch.id)
+
+        expect(batch.reload).to be_finished
+      end
+    end
+
     context 'when exclusive lease cannot be obtained' do
       it 'does not run the pipeline' do
         expect(subject).to receive(:try_obtain_lease).and_return(false)
diff --git a/spec/workers/click_house/events_sync_worker_spec.rb b/spec/workers/click_house/events_sync_worker_spec.rb
index 8f328839cfd..01267db36a7 100644
--- a/spec/workers/click_house/events_sync_worker_spec.rb
+++ b/spec/workers/click_house/events_sync_worker_spec.rb
@@ -3,48 +3,125 @@
 require 'spec_helper'
 
 RSpec.describe ClickHouse::EventsSyncWorker, feature_category: :value_stream_management do
-  let(:databases) { { main: :some_db } }
   let(:worker) { described_class.new }
 
-  before do
-    allow(ClickHouse::Client.configuration).to receive(:databases).and_return(databases)
-  end
-
-  include_examples 'an idempotent worker' do
-    context 'when the event_sync_worker_for_click_house feature flag is on' do
+  it_behaves_like 'an idempotent worker' do
+    context 'when the event_sync_worker_for_click_house feature flag is on', :click_house do
       before do
         stub_feature_flags(event_sync_worker_for_click_house: true)
       end
 
-      it 'returns true' do
-        expect(worker).to receive(:log_extra_metadata_on_done).with(:result, { status: :processed })
-
-        worker.perform
-      end
-
-      context 'when no ClickHouse databases are configured' do
-        let(:databases) { {} }
-
-        it 'skips execution' do
-          expect(worker).to receive(:log_extra_metadata_on_done).with(:result, { status: :disabled })
+      context 'when there is nothing to sync' do
+        it 'adds metadata for the worker' do
+          expect(worker).to receive(:log_extra_metadata_on_done).with(:result,
+            { status: :processed, records_inserted: 0, reached_end_of_table: true })
 
           worker.perform
+
+          events = ClickHouse::Client.select('SELECT * FROM events', :main)
+          expect(events).to be_empty
         end
       end
 
-      context 'when exclusive lease error happens' do
-        it 'skips execution' do
-          expect(worker).to receive(:in_lock).and_raise(Gitlab::ExclusiveLeaseHelpers::FailedToObtainLockError)
-          expect(worker).to receive(:log_extra_metadata_on_done).with(:result, { status: :skipped })
+      context 'when syncing records' do
+        let_it_be(:group) { create(:group) }
+        let_it_be(:project) { create(:project, group: group) }
+        let_it_be(:issue) { create(:issue, project: project) }
+        let_it_be(:project_event2) { create(:event, :closed, project: project, target: issue) }
+        let_it_be(:event_without_parent) { create(:event, :joined, project: nil, group: nil) }
+        let_it_be(:group_event) { create(:event, :created, group: group, project: nil) }
+        let_it_be(:project_event1) { create(:event, :created, project: project, target: issue) }
+        # looks invalid but we have some records like this on PRD
+
+        it 'inserts all records' do
+          expect(worker).to receive(:log_extra_metadata_on_done).with(:result,
+            { status: :processed, records_inserted: 4, reached_end_of_table: true })
 
           worker.perform
+
+          expected_records = [
+            hash_including('id' => project_event2.id, 'path' => "#{group.id}/#{project.project_namespace.id}/",
+              'target_type' => 'Issue'),
+            hash_including('id' => event_without_parent.id, 'path' => '', 'target_type' => ''),
+            hash_including('id' => group_event.id, 'path' => "#{group.id}/", 'target_type' => ''),
+            hash_including('id' => project_event1.id, 'path' => "#{group.id}/#{project.project_namespace.id}/",
+              'target_type' => 'Issue')
+          ]
+
+          events = ClickHouse::Client.select('SELECT * FROM events ORDER BY id', :main)
+
+          expect(events).to match(expected_records)
+
+          last_processed_id = ClickHouse::SyncCursor.cursor_for(:events)
+          expect(last_processed_id).to eq(project_event1.id)
+        end
+
+        context 'when multiple batches are needed' do
+          before do
+            stub_const("#{described_class}::BATCH_SIZE", 1)
+            stub_const("#{described_class}::INSERT_BATCH_SIZE", 1)
+          end
+
+          it 'inserts all records' do
+            worker.perform
+
+            events = ClickHouse::Client.select('SELECT * FROM events', :main)
+            expect(events.size).to eq(4)
+          end
+        end
+
+        context 'when time limit is reached' do
+          before do
+            stub_const("#{described_class}::BATCH_SIZE", 1)
+          end
+
+          it 'stops the processing' do
+            allow_next_instance_of(Analytics::CycleAnalytics::RuntimeLimiter) do |runtime_limiter|
+              allow(runtime_limiter).to receive(:over_time?).and_return(false, true)
+            end
+
+            expect(worker).to receive(:log_extra_metadata_on_done).with(:result,
+              { status: :processed, records_inserted: 2, reached_end_of_table: false })
+
+            worker.perform
+
+            last_processed_id = ClickHouse::SyncCursor.cursor_for(:events)
+            expect(last_processed_id).to eq(event_without_parent.id)
+          end
+        end
+
+        context 'when syncing from a certain point' do
+          before do
+            ClickHouse::SyncCursor.update_cursor_for(:events, project_event2.id)
+          end
+
+          it 'syncs records after the cursor' do
+            worker.perform
+
+            events = ClickHouse::Client.select('SELECT id FROM events ORDER BY id', :main)
+            expect(events).to eq([{ 'id' => event_without_parent.id }, { 'id' => group_event.id },
+              { 'id' => project_event1.id }])
+          end
+
+          context 'when there is nothing to sync' do
+            it 'does nothing' do
+              expect(worker).to receive(:log_extra_metadata_on_done).with(:result,
+                { status: :processed, records_inserted: 0, reached_end_of_table: true })
+
+              ClickHouse::SyncCursor.update_cursor_for(:events, project_event1.id)
+              worker.perform
+
+              events = ClickHouse::Client.select('SELECT id FROM events ORDER BY id', :main)
+              expect(events).to be_empty
+            end
+          end
         end
       end
     end
 
-    context 'when the event_sync_worker_for_click_house feature flag is off' do
+    context 'when clickhouse is not configured' do
       before do
-        stub_feature_flags(event_sync_worker_for_click_house: false)
+        allow(ClickHouse::Client.configuration).to receive(:databases).and_return({})
       end
 
       it 'skips execution' do
@@ -54,4 +131,28 @@ RSpec.describe ClickHouse::EventsSyncWorker, feature_category: :value_stream_man
       end
     end
   end
+
+  context 'when exclusive lease error happens' do
+    it 'skips execution' do
+      stub_feature_flags(event_sync_worker_for_click_house: true)
+      allow(ClickHouse::Client.configuration).to receive(:databases).and_return({ main: :some_db })
+
+      expect(worker).to receive(:in_lock).and_raise(Gitlab::ExclusiveLeaseHelpers::FailedToObtainLockError)
+      expect(worker).to receive(:log_extra_metadata_on_done).with(:result, { status: :skipped })
+
+      worker.perform
+    end
+  end
+
+  context 'when the event_sync_worker_for_click_house feature flag is off' do
+    before do
+      stub_feature_flags(event_sync_worker_for_click_house: false)
+    end
+
+    it 'skips execution' do
+      expect(worker).to receive(:log_extra_metadata_on_done).with(:result, { status: :disabled })
+
+      worker.perform
+    end
+  end
 end
diff --git a/yarn.lock b/yarn.lock
index 543e2d79f01..423bd4ebfd1 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1913,6 +1913,16 @@
     estree-walker "^2.0.2"
     picomatch "^2.3.1"
 
+"@sentry-internal/tracing@7.66.0":
+  version "7.66.0"
+  resolved "https://registry.yarnpkg.com/@sentry-internal/tracing/-/tracing-7.66.0.tgz#45ea607917d55a5bcaa3229341387ff6ed9b3a2b"
+  integrity sha512-3vCgC2hC3T45pn53yTDVcRpHoJTBxelDPPZVsipAbZnoOVPkj7n6dNfDhj3I3kwWCBPahPkXmE+R4xViR8VqJg==
+  dependencies:
+    "@sentry/core" "7.66.0"
+    "@sentry/types" "7.66.0"
+    "@sentry/utils" "7.66.0"
+    tslib "^2.4.1 || ^1.9.3"
+
 "@sentry/core@5.30.0":
   version "5.30.0"
   resolved "https://registry.yarnpkg.com/@sentry/core/-/core-5.30.0.tgz#6b203664f69e75106ee8b5a2fe1d717379b331f3"
@@ -1924,14 +1934,14 @@
     "@sentry/utils" "5.30.0"
     tslib "^1.9.3"
 
-"@sentry/core@7.21.1":
-  version "7.21.1"
-  resolved "https://registry.yarnpkg.com/@sentry/core/-/core-7.21.1.tgz#d0423282d90875625802dfe380f9657e9242b72b"
-  integrity sha512-Og5wEEsy24fNvT/T7IKjcV4EvVK5ryY2kxbJzKY6GU2eX+i+aBl+n/vp7U0Es351C/AlTkS+0NOUsp2TQQFxZA==
+"@sentry/core@7.66.0":
+  version "7.66.0"
+  resolved "https://registry.yarnpkg.com/@sentry/core/-/core-7.66.0.tgz#8968f2a9e641d33e3750a8e24d1d39953680c4f2"
+  integrity sha512-WMAEPN86NeCJ1IT48Lqiz4MS5gdDjBwP4M63XP4msZn9aujSf2Qb6My5uT87AJr9zBtgk8MyJsuHr35F0P3q1w==
   dependencies:
-    "@sentry/types" "7.21.1"
-    "@sentry/utils" "7.21.1"
-    tslib "^1.9.3"
+    "@sentry/types" "7.66.0"
+    "@sentry/utils" "7.66.0"
+    tslib "^2.4.1 || ^1.9.3"
 
 "@sentry/hub@5.30.0":
   version "5.30.0"
@@ -1951,15 +1961,24 @@
     "@sentry/types" "5.30.0"
     tslib "^1.9.3"
 
+"@sentry/replay@7.66.0":
+  version "7.66.0"
+  resolved "https://registry.yarnpkg.com/@sentry/replay/-/replay-7.66.0.tgz#5469144192824e7688c475ed29586a8cce6606f6"
+  integrity sha512-5Y2SlVTOFTo3uIycv0mRneBakQtLgWkOnsJaC5LB0Ip0TqVKiMCbQ578vvXp+yvRj4LcS1gNd98xTTNojBoQNg==
+  dependencies:
+    "@sentry/core" "7.66.0"
+    "@sentry/types" "7.66.0"
+    "@sentry/utils" "7.66.0"
+
 "@sentry/types@5.30.0":
   version "5.30.0"
   resolved "https://registry.yarnpkg.com/@sentry/types/-/types-5.30.0.tgz#19709bbe12a1a0115bc790b8942917da5636f402"
   integrity sha512-R8xOqlSTZ+htqrfteCWU5Nk0CDN5ApUTvrlvBuiH1DyP6czDZ4ktbZB0hAgBlVcK0U+qpD3ag3Tqqpa5Q67rPw==
 
-"@sentry/types@7.21.1":
-  version "7.21.1"
-  resolved "https://registry.yarnpkg.com/@sentry/types/-/types-7.21.1.tgz#408a7b95a66ddc30c4359979594e03bee8f9fbdc"
-  integrity sha512-3/IKnd52Ol21amQvI+kz+WB76s8/LR5YvFJzMgIoI2S8d82smIr253zGijRXxHPEif8kMLX4Yt+36VzrLxg6+A==
+"@sentry/types@7.66.0":
+  version "7.66.0"
+  resolved "https://registry.yarnpkg.com/@sentry/types/-/types-7.66.0.tgz#4ec290cc6a3dd2024a61a0bffb468cedb409f7fb"
+  integrity sha512-uUMSoSiar6JhuD8p7ON/Ddp4JYvrVd2RpwXJRPH1A4H4Bd4DVt1mKJy1OLG6HdeQv39XyhB1lPZckKJg4tATPw==
 
 "@sentry/utils@5.30.0":
   version "5.30.0"
@@ -1969,13 +1988,13 @@
     "@sentry/types" "5.30.0"
     tslib "^1.9.3"
 
-"@sentry/utils@7.21.1":
-  version "7.21.1"
-  resolved "https://registry.yarnpkg.com/@sentry/utils/-/utils-7.21.1.tgz#96582345178015fd32fe9159c25c44ccf2f99d2a"
-  integrity sha512-F0W0AAi8tgtTx6ApZRI2S9HbXEA9ENX1phTZgdNNWcMFm1BNbc21XEwLqwXBNjub5nlA6CE8xnjXRgdZKx4kzQ==
+"@sentry/utils@7.66.0":
+  version "7.66.0"
+  resolved "https://registry.yarnpkg.com/@sentry/utils/-/utils-7.66.0.tgz#2e37c96610f26bc79ac064fca4222ea91fece68d"
+  integrity sha512-9GYUVgXjK66uXXcLXVMXVzlptqMtq1eJENCuDeezQiEFrNA71KkLDg00wESp+LL+bl3wpVTBApArpbF6UEG5hQ==
   dependencies:
-    "@sentry/types" "7.21.1"
-    tslib "^1.9.3"
+    "@sentry/types" "7.66.0"
+    tslib "^2.4.1 || ^1.9.3"
 
 "@sinclair/typebox@^0.24.1":
   version "0.24.40"
@@ -11868,15 +11887,17 @@ send@0.17.2:
     "@sentry/utils" "5.30.0"
     tslib "^1.9.3"
 
-"sentrybrowser@npm:@sentry/browser@^7.21.1":
-  version "7.21.1"
-  resolved "https://registry.yarnpkg.com/@sentry/browser/-/browser-7.21.1.tgz#bffa3ea19050c06400107d2297b9802f9719f98b"
-  integrity sha512-cS2Jz2+fs9+4pJqLJPtYqGyY97ywJDWAWIR1Yla3hs1QQuH6m0Nz3ojZD1gE2eKH9mHwkGbnNAh+hHcrYrfGzw==
+"sentrybrowser@npm:@sentry/browser@7.66.0":
+  version "7.66.0"
+  resolved "https://registry.yarnpkg.com/@sentry/browser/-/browser-7.66.0.tgz#9aa3078f8914d2f8acb4ad9fc7b2011c80e357f5"
+  integrity sha512-rW037rf8jkhyykG38+HUdwkRCKHJEMM5NkCqPIO5zuuxfLKukKdI2rbvgJ93s3/9UfsTuDFcKFL1u43mCn6sDw==
   dependencies:
-    "@sentry/core" "7.21.1"
-    "@sentry/types" "7.21.1"
-    "@sentry/utils" "7.21.1"
-    tslib "^1.9.3"
+    "@sentry-internal/tracing" "7.66.0"
+    "@sentry/core" "7.66.0"
+    "@sentry/replay" "7.66.0"
+    "@sentry/types" "7.66.0"
+    "@sentry/utils" "7.66.0"
+    tslib "^2.4.1 || ^1.9.3"
 
 serialize-javascript@^2.1.2:
   version "2.1.2"
@@ -12931,10 +12952,10 @@ tslib@^1.8.1, tslib@^1.9.0, tslib@^1.9.3:
   resolved "https://registry.yarnpkg.com/tslib/-/tslib-1.14.1.tgz#cf2d38bdc34a134bcaf1091c41f6619e2f672d00"
   integrity sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==
 
-tslib@^2.1.0, tslib@^2.2.0, tslib@^2.3.0, tslib@^2.3.1, tslib@^2.4.0, tslib@^2.4.1, tslib@^2.5.0:
-  version "2.5.0"
-  resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.5.0.tgz#42bfed86f5787aeb41d031866c8f402429e0fddf"
-  integrity sha512-336iVw3rtn2BUK7ORdIAHTyxHGRIHVReokCR3XjbckJMK7ms8FysBfhLR8IXnAgy7T0PTPNBWKiH514FOW/WSg==
+tslib@^2.1.0, tslib@^2.2.0, tslib@^2.3.0, tslib@^2.3.1, tslib@^2.4.0, tslib@^2.4.1, "tslib@^2.4.1 || ^1.9.3", tslib@^2.5.0:
+  version "2.6.2"
+  resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.6.2.tgz#703ac29425e7b37cd6fd456e92404d46d1f3e4ae"
+  integrity sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q==
 
 tsutils@^3.21.0:
   version "3.21.0"