From 8d43de1d2fe26692d5267de363c0638309663755 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Mon, 27 Jan 2025 18:36:28 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .rubocop_todo/rails/output_safety.yml         |   1 -
 .rubocop_todo/rspec/be_empty.yml              |   1 -
 .rubocop_todo/rspec/be_eq.yml                 |   2 -
 .rubocop_todo/rspec/context_wording.yml       |   1 -
 .../rspec/factory_bot/avoid_create.yml        |   2 -
 .rubocop_todo/rspec/feature_category.yml      |   2 -
 .rubocop_todo/rspec/verified_doubles.yml      |   1 -
 .../wikis/components/wiki_more_dropdown.vue   |   1 +
 .../todos/components/todos_filter_bar.vue     |   8 +-
 .../groups_list/groups_list_item.vue          |   2 +-
 .../projects_list/projects_list_item.vue      |   3 +-
 .../components/resource_lists/list_item.vue   |   7 +-
 .../concerns/projects/look_ahead_preloads.rb  |  29 +++
 .../user_contributed_projects_resolver.rb     |   8 +-
 app/graphql/resolvers/projects_resolver.rb    |  16 +-
 .../user_starred_projects_resolver.rb         |   8 +-
 app/helpers/todos_helper.rb                   | 170 --------------
 app/models/ci/build.rb                        |  49 +----
 app/models/ci/build_tag.rb                    |   7 +
 app/models/ci/pipeline.rb                     |   4 +-
 app/models/ci/runner.rb                       |  43 +---
 app/models/ci/runner_tagging.rb               |   6 +
 app/models/ci/tag.rb                          |   9 +-
 app/models/concerns/ci/taggable.rb            |  50 +----
 app/models/concerns/taggable_queries.rb       |  14 +-
 app/models/work_item.rb                       |   2 +-
 app/services/audit_event_service.rb           |   3 +-
 app/services/audit_events/build_service.rb    |   5 +-
 app/validators/rsa_key_validator.rb           |  10 +-
 .../groups/settings/_permissions.html.haml    |   2 +-
 .../cloud_connector_keys.yml                  |  12 +
 .../{wip => beta}/your_work_projects_vue.yml  |   2 +-
 ..._sql_functions_for_primary_key_lookups.yml |   2 +-
 ...ill_merge_request_reviewers_project_id.yml |   2 +-
 ...ine_variables_from_ci_trigger_requests.yml |   8 +
 .../backfill_security_policies.yml            |   2 +-
 .../skip_company_onboarding_step.yml          |   2 +-
 ..._connector_keys_to_application_settings.rb |   9 +
 ...0250123100054_seed_cloud_connector_keys.rb |  33 +++
 ...707_finalize_backfill_security_policies.rb |  24 ++
 ...fill_merge_request_reviewers_project_id.rb |  21 ++
 ...line_variables_from_ci_trigger_requests.rb |  24 ++
 ...7_finalize_skip_company_onboarding_step.rb |  21 ++
 db/schema_migrations/20241210081707           |   1 +
 db/schema_migrations/20250108232951           |   1 +
 db/schema_migrations/20250113064942           |   1 +
 db/schema_migrations/20250122193107           |   1 +
 db/schema_migrations/20250123100033           |   1 +
 db/schema_migrations/20250123100054           |   1 +
 db/structure.sql                              |   1 +
 doc/api/graphql/reference/index.md            |  20 ++
 .../cells/application_settings_analysis.md    |   9 +-
 .../deprecation_guidelines/index.md           |  35 ++-
 doc/development/secure_coding_guidelines.md   | 196 ++++++++++++++++-
 .../dashboards/index.md                       |   4 +-
 .../secret_push_protection/index.md           |   2 +
 doc/user/group/moderate_users.md              |   2 +
 .../infrastructure/iac/terraform_state.md     |   2 +-
 doc/user/profile/service_accounts.md          |   2 +-
 lib/gitlab/audit/auditor.rb                   |  10 +-
 lib/gitlab/audit/scope_validation.rb          |  22 ++
 ...line_variables_from_ci_trigger_requests.rb |  71 ++++++
 lib/gitlab/ci/tags/bulk_insert.rb             |  16 +-
 .../issue_and_merge_request_actions.rb        |  31 ++-
 locale/gitlab.pot                             |  32 ++-
 qa/qa/page/dashboard/projects.rb              |  15 ++
 .../project/invite_group_to_project_spec.rb   |   1 +
 .../project/project_owner_permissions_spec.rb |   2 +
 spec/features/dashboard/projects_spec.rb      |   2 +-
 .../groups_list/groups_list_item_spec.js      |   2 +-
 .../projects_list/projects_list_item_spec.js  |   8 +-
 .../resource_lists/list_item_spec.js          |  10 +
 spec/helpers/todos_helper_spec.rb             | 208 ------------------
 spec/lib/gitlab/audit/auditor_spec.rb         |  11 -
 ...variables_from_ci_trigger_requests_spec.rb | 119 ++++++++++
 spec/lib/gitlab/ci/tags/bulk_insert_spec.rb   | 102 +--------
 ...variables_from_ci_trigger_requests_spec.rb |  26 +++
 ...23100054_seed_cloud_connector_keys_spec.rb |  21 ++
 spec/models/ci/build_spec.rb                  |  20 +-
 spec/models/ci/processable_spec.rb            |   2 +-
 spec/models/ci/runner_spec.rb                 |  40 +---
 spec/models/ci/runner_tagging_spec.rb         |   4 +-
 spec/models/ci/tag_spec.rb                    |  11 +-
 spec/models/concerns/ci/taggable_spec.rb      |  95 +++++---
 spec/models/work_item_spec.rb                 |   2 +-
 .../user/contributed_projects_query_spec.rb   |  26 +++
 .../user/starred_projects_query_spec.rb       |  26 +++
 spec/services/audit_event_service_spec.rb     |  38 +++-
 .../audit_events/build_service_spec.rb        |  47 +++-
 ...date_project_runners_owner_service_spec.rb |   2 +-
 .../quick_actions/interpret_service_spec.rb   |  30 ++-
 spec/support/rspec_order_todo.yml             |   2 -
 spec/validators/rsa_key_validator_spec.rb     |  25 ++-
 93 files changed, 1123 insertions(+), 863 deletions(-)
 create mode 100644 app/graphql/resolvers/concerns/projects/look_ahead_preloads.rb
 delete mode 100644 app/helpers/todos_helper.rb
 create mode 100644 config/application_setting_columns/cloud_connector_keys.yml
 rename config/feature_flags/{wip => beta}/your_work_projects_vue.yml (96%)
 create mode 100644 db/docs/batched_background_migrations/backfill_p_ci_pipeline_variables_from_ci_trigger_requests.yml
 create mode 100644 db/migrate/20250123100033_add_cloud_connector_keys_to_application_settings.rb
 create mode 100644 db/migrate/20250123100054_seed_cloud_connector_keys.rb
 create mode 100644 db/post_migrate/20241210081707_finalize_backfill_security_policies.rb
 create mode 100644 db/post_migrate/20250108232951_finalize_backfill_merge_request_reviewers_project_id.rb
 create mode 100644 db/post_migrate/20250113064942_queue_backfill_p_ci_pipeline_variables_from_ci_trigger_requests.rb
 create mode 100644 db/post_migrate/20250122193107_finalize_skip_company_onboarding_step.rb
 create mode 100644 db/schema_migrations/20241210081707
 create mode 100644 db/schema_migrations/20250108232951
 create mode 100644 db/schema_migrations/20250113064942
 create mode 100644 db/schema_migrations/20250122193107
 create mode 100644 db/schema_migrations/20250123100033
 create mode 100644 db/schema_migrations/20250123100054
 create mode 100644 lib/gitlab/audit/scope_validation.rb
 create mode 100644 lib/gitlab/background_migration/backfill_p_ci_pipeline_variables_from_ci_trigger_requests.rb
 delete mode 100644 spec/helpers/todos_helper_spec.rb
 create mode 100644 spec/lib/gitlab/background_migration/backfill_p_ci_pipeline_variables_from_ci_trigger_requests_spec.rb
 create mode 100644 spec/migrations/20250113064942_queue_backfill_p_ci_pipeline_variables_from_ci_trigger_requests_spec.rb
 create mode 100644 spec/migrations/20250123100054_seed_cloud_connector_keys_spec.rb

diff --git a/.rubocop_todo/rails/output_safety.yml b/.rubocop_todo/rails/output_safety.yml
index cbcf1591b36..95a9de4e332 100644
--- a/.rubocop_todo/rails/output_safety.yml
+++ b/.rubocop_todo/rails/output_safety.yml
@@ -31,7 +31,6 @@ Rails/OutputSafety:
     - 'app/helpers/sidebars_helper.rb'
     - 'app/helpers/tags_helper.rb'
     - 'app/helpers/timeboxes_helper.rb'
-    - 'app/helpers/todos_helper.rb'
     - 'app/helpers/version_check_helper.rb'
     - 'app/helpers/visibility_level_helper.rb'
     - 'app/mailers/notify.rb'
diff --git a/.rubocop_todo/rspec/be_empty.yml b/.rubocop_todo/rspec/be_empty.yml
index 68e4116f28e..a836b97d9b7 100644
--- a/.rubocop_todo/rspec/be_empty.yml
+++ b/.rubocop_todo/rspec/be_empty.yml
@@ -14,7 +14,6 @@ RSpec/BeEmpty:
     - 'spec/helpers/dashboard_helper_spec.rb'
     - 'spec/helpers/nav/new_dropdown_helper_spec.rb'
     - 'spec/helpers/preferences_helper_spec.rb'
-    - 'spec/helpers/todos_helper_spec.rb'
     - 'spec/helpers/users_helper_spec.rb'
     - 'spec/lib/click_house/iterator_spec.rb'
     - 'spec/lib/gitlab/checks/changes_access_spec.rb'
diff --git a/.rubocop_todo/rspec/be_eq.yml b/.rubocop_todo/rspec/be_eq.yml
index edf2c2546b4..70630feb284 100644
--- a/.rubocop_todo/rspec/be_eq.yml
+++ b/.rubocop_todo/rspec/be_eq.yml
@@ -66,7 +66,6 @@ RSpec/BeEq:
     - 'ee/spec/helpers/ee/namespace_user_cap_reached_alert_helper_spec.rb'
     - 'ee/spec/helpers/ee/protected_branches_helper_spec.rb'
     - 'ee/spec/helpers/ee/security_orchestration_helper_spec.rb'
-    - 'ee/spec/helpers/ee/todos_helper_spec.rb'
     - 'ee/spec/helpers/ee/users/callouts_helper_spec.rb'
     - 'ee/spec/helpers/gitlab_subscriptions/upcoming_reconciliation_helper_spec.rb'
     - 'ee/spec/helpers/kerberos_helper_spec.rb'
@@ -657,7 +656,6 @@ RSpec/BeEq:
     - 'spec/helpers/recaptcha_helper_spec.rb'
     - 'spec/helpers/stat_anchors_helper_spec.rb'
     - 'spec/helpers/time_zone_helper_spec.rb'
-    - 'spec/helpers/todos_helper_spec.rb'
     - 'spec/helpers/users/group_callouts_helper_spec.rb'
     - 'spec/helpers/users_helper_spec.rb'
     - 'spec/helpers/web_hooks/web_hooks_helper_spec.rb'
diff --git a/.rubocop_todo/rspec/context_wording.yml b/.rubocop_todo/rspec/context_wording.yml
index 597f2a64dfd..9d7eb7d89f5 100644
--- a/.rubocop_todo/rspec/context_wording.yml
+++ b/.rubocop_todo/rspec/context_wording.yml
@@ -1331,7 +1331,6 @@ RSpec/ContextWording:
     - 'spec/helpers/routing/pseudonymization_helper_spec.rb'
     - 'spec/helpers/submodule_helper_spec.rb'
     - 'spec/helpers/timeboxes_helper_spec.rb'
-    - 'spec/helpers/todos_helper_spec.rb'
     - 'spec/helpers/tree_helper_spec.rb'
     - 'spec/helpers/users_helper_spec.rb'
     - 'spec/helpers/web_hooks/web_hooks_helper_spec.rb'
diff --git a/.rubocop_todo/rspec/factory_bot/avoid_create.yml b/.rubocop_todo/rspec/factory_bot/avoid_create.yml
index a16979a2e9a..a8cea6738dc 100644
--- a/.rubocop_todo/rspec/factory_bot/avoid_create.yml
+++ b/.rubocop_todo/rspec/factory_bot/avoid_create.yml
@@ -43,7 +43,6 @@ RSpec/FactoryBot/AvoidCreate:
     - 'ee/spec/helpers/ee/releases_helper_spec.rb'
     - 'ee/spec/helpers/ee/security_orchestration_helper_spec.rb'
     - 'ee/spec/helpers/ee/subscribable_banner_helper_spec.rb'
-    - 'ee/spec/helpers/ee/todos_helper_spec.rb'
     - 'ee/spec/helpers/ee/users/callouts_helper_spec.rb'
     - 'ee/spec/helpers/ee/wiki_helper_spec.rb'
     - 'ee/spec/helpers/epics_helper_spec.rb'
@@ -300,7 +299,6 @@ RSpec/FactoryBot/AvoidCreate:
     - 'spec/helpers/storage_helper_spec.rb'
     - 'spec/helpers/submodule_helper_spec.rb'
     - 'spec/helpers/timeboxes_helper_spec.rb'
-    - 'spec/helpers/todos_helper_spec.rb'
     - 'spec/helpers/tree_helper_spec.rb'
     - 'spec/helpers/users/callouts_helper_spec.rb'
     - 'spec/helpers/users/group_callouts_helper_spec.rb'
diff --git a/.rubocop_todo/rspec/feature_category.yml b/.rubocop_todo/rspec/feature_category.yml
index 7d460430d69..44d324ff6b7 100644
--- a/.rubocop_todo/rspec/feature_category.yml
+++ b/.rubocop_todo/rspec/feature_category.yml
@@ -380,7 +380,6 @@ RSpec/FeatureCategory:
     - 'ee/spec/helpers/ee/sorting_helper_spec.rb'
     - 'ee/spec/helpers/ee/subscribable_banner_helper_spec.rb'
     - 'ee/spec/helpers/ee/system_note_helper_spec.rb'
-    - 'ee/spec/helpers/ee/todos_helper_spec.rb'
     - 'ee/spec/helpers/ee/users/callouts_helper_spec.rb'
     - 'ee/spec/helpers/epics_helper_spec.rb'
     - 'ee/spec/helpers/gitlab_subscriptions/upcoming_reconciliation_helper_spec.rb'
@@ -1822,7 +1821,6 @@ RSpec/FeatureCategory:
     - 'spec/helpers/tab_helper_spec.rb'
     - 'spec/helpers/time_helper_spec.rb'
     - 'spec/helpers/time_zone_helper_spec.rb'
-    - 'spec/helpers/todos_helper_spec.rb'
     - 'spec/helpers/tracking_helper_spec.rb'
     - 'spec/helpers/users/group_callouts_helper_spec.rb'
     - 'spec/helpers/version_check_helper_spec.rb'
diff --git a/.rubocop_todo/rspec/verified_doubles.yml b/.rubocop_todo/rspec/verified_doubles.yml
index 33e1404a449..ca559f25436 100644
--- a/.rubocop_todo/rspec/verified_doubles.yml
+++ b/.rubocop_todo/rspec/verified_doubles.yml
@@ -268,7 +268,6 @@ RSpec/VerifiedDoubles:
     - 'spec/helpers/routing/pseudonymization_helper_spec.rb'
     - 'spec/helpers/sorting_helper_spec.rb'
     - 'spec/helpers/submodule_helper_spec.rb'
-    - 'spec/helpers/todos_helper_spec.rb'
     - 'spec/helpers/version_check_helper_spec.rb'
     - 'spec/initializers/doorkeeper_spec.rb'
     - 'spec/initializers/global_id_spec.rb'
diff --git a/app/assets/javascripts/pages/shared/wikis/components/wiki_more_dropdown.vue b/app/assets/javascripts/pages/shared/wikis/components/wiki_more_dropdown.vue
index d8ef8efb2a4..222e05a1aef 100644
--- a/app/assets/javascripts/pages/shared/wikis/components/wiki_more_dropdown.vue
+++ b/app/assets/javascripts/pages/shared/wikis/components/wiki_more_dropdown.vue
@@ -103,6 +103,7 @@ export default {
   <gl-disclosure-dropdown
     v-gl-tooltip="showDropdownTooltip"
     icon="ellipsis_v"
+    category="tertiary"
     placement="bottom-end"
     no-caret
     data-testid="wiki-more-dropdown"
diff --git a/app/assets/javascripts/todos/components/todos_filter_bar.vue b/app/assets/javascripts/todos/components/todos_filter_bar.vue
index ad0b3c40b7b..d18d7f01ee1 100644
--- a/app/assets/javascripts/todos/components/todos_filter_bar.vue
+++ b/app/assets/javascripts/todos/components/todos_filter_bar.vue
@@ -59,10 +59,6 @@ export const SORT_OPTIONS = [
 ];
 const LEGAL_SORT_OPTIONS = SORT_OPTIONS.map(({ value }) => value);
 
-/**
- * The IDs must match the ones defined in the `todo_actions_options` method in
- * `app/helpers/todos_helper.rb`.
- */
 export const TARGET_TYPES = [
   {
     // eslint-disable-next-line @gitlab/require-i18n-strings
@@ -71,7 +67,7 @@ export const TARGET_TYPES = [
     title: s__('Todos|Issue'),
   },
   {
-    id: 'WorkItem', // Note: This ID has no equivalent in `app/helpers/todos_helper.rb`.
+    id: 'WorkItem',
     value: TODO_TARGET_TYPE_WORK_ITEM,
     title: s__('Todos|Work item'),
   },
@@ -92,7 +88,7 @@ export const TARGET_TYPES = [
   },
   {
     // eslint-disable-next-line @gitlab/require-i18n-strings
-    id: 'Epic', // Note: This ID has no equivalent in `app/helpers/todos_helper.rb`.
+    id: 'Epic',
     value: TODO_TARGET_TYPE_EPIC,
     title: s__('Todos|Epic'),
   },
diff --git a/app/assets/javascripts/vue_shared/components/groups_list/groups_list_item.vue b/app/assets/javascripts/vue_shared/components/groups_list/groups_list_item.vue
index f91078d64e5..4b6c0239bfa 100644
--- a/app/assets/javascripts/vue_shared/components/groups_list/groups_list_item.vue
+++ b/app/assets/javascripts/vue_shared/components/groups_list/groups_list_item.vue
@@ -134,7 +134,7 @@ export default {
         :name="visibilityIcon"
         variant="subtle"
       />
-      <gl-badge v-if="shouldShowAccessLevel" class="gl-block" data-testid="access-level-badge">{{
+      <gl-badge v-if="shouldShowAccessLevel" class="gl-block" data-testid="user-access-role">{{
         accessLevelLabel
       }}</gl-badge>
     </template>
diff --git a/app/assets/javascripts/vue_shared/components/projects_list/projects_list_item.vue b/app/assets/javascripts/vue_shared/components/projects_list/projects_list_item.vue
index 2e39daeb23a..e63e694dc66 100644
--- a/app/assets/javascripts/vue_shared/components/projects_list/projects_list_item.vue
+++ b/app/assets/javascripts/vue_shared/components/projects_list/projects_list_item.vue
@@ -227,6 +227,7 @@ export default {
     icon-name="project"
     :timestamp-type="timestampType"
     :data-testid="dataTestid"
+    content-testid="project-content"
   >
     <template #avatar-meta>
       <gl-icon
@@ -243,7 +244,7 @@ export default {
         :href="project.exploreCatalogPath"
         >{{ $options.i18n.ciCatalogBadge }}</gl-badge
       >
-      <gl-badge v-if="shouldShowAccessLevel" class="gl-block" data-testid="access-level-badge">{{
+      <gl-badge v-if="shouldShowAccessLevel" class="gl-block" data-testid="user-access-role">{{
         accessLevelLabel
       }}</gl-badge>
     </template>
diff --git a/app/assets/javascripts/vue_shared/components/resource_lists/list_item.vue b/app/assets/javascripts/vue_shared/components/resource_lists/list_item.vue
index c6411acafae..457c3eff9fc 100644
--- a/app/assets/javascripts/vue_shared/components/resource_lists/list_item.vue
+++ b/app/assets/javascripts/vue_shared/components/resource_lists/list_item.vue
@@ -65,6 +65,11 @@ export default {
         return TIMESTAMP_TYPES.includes(value);
       },
     },
+    contentTestid: {
+      type: String,
+      required: false,
+      default: null,
+    },
   },
   computed: {
     statsPadding() {
@@ -89,7 +94,7 @@ export default {
 <template>
   <li class="gl-border-b gl-flex gl-items-start gl-py-4">
     <div class="gl-grow gl-items-start md:gl-flex">
-      <div class="gl-flex gl-grow">
+      <div class="gl-flex gl-grow" :data-testid="contentTestid">
         <div v-if="showIcon" class="gl-mr-3 gl-flex gl-h-7 gl-shrink-0 gl-items-center">
           <gl-icon variant="subtle" :name="iconName" />
         </div>
diff --git a/app/graphql/resolvers/concerns/projects/look_ahead_preloads.rb b/app/graphql/resolvers/concerns/projects/look_ahead_preloads.rb
new file mode 100644
index 00000000000..dc559ebc79b
--- /dev/null
+++ b/app/graphql/resolvers/concerns/projects/look_ahead_preloads.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Projects
+  module LookAheadPreloads
+    extend ActiveSupport::Concern
+
+    prepended do
+      include ::LooksAhead
+    end
+
+    private
+
+    def preloads
+      {
+        full_path: [:route],
+        topics: [:topics],
+        import_status: [:import_state],
+        service_desk_address: [:project_feature, :service_desk_setting],
+        jira_import_status: [:jira_imports],
+        container_repositories: [:container_repositories],
+        container_repositories_count: [:container_repositories],
+        web_url: { namespace: [:route] },
+        is_catalog_resource: [:catalog_resource]
+      }
+    end
+  end
+end
+
+Projects::LookAheadPreloads.prepend_mod
diff --git a/app/graphql/resolvers/projects/user_contributed_projects_resolver.rb b/app/graphql/resolvers/projects/user_contributed_projects_resolver.rb
index cc3a9d1c945..9ffd81f16bb 100644
--- a/app/graphql/resolvers/projects/user_contributed_projects_resolver.rb
+++ b/app/graphql/resolvers/projects/user_contributed_projects_resolver.rb
@@ -3,6 +3,8 @@
 module Resolvers
   module Projects
     class UserContributedProjectsResolver < BaseResolver
+      prepend ::Projects::LookAheadPreloads
+
       type Types::ProjectType.connection_type, null: true
 
       argument :search, GraphQL::Types::String,
@@ -29,7 +31,7 @@ module Resolvers
 
       alias_method :user, :object
 
-      def resolve(**args)
+      def resolve_with_lookahead(**args)
         contributed_projects = ContributedProjectsFinder.new(
           user: user,
           current_user: current_user,
@@ -41,9 +43,9 @@ module Resolvers
           }
         ).execute
 
-        return contributed_projects if args[:include_personal]
+        return apply_lookahead(contributed_projects) if args[:include_personal]
 
-        contributed_projects.joined(user)
+        apply_lookahead(contributed_projects.joined(user))
       end
     end
   end
diff --git a/app/graphql/resolvers/projects_resolver.rb b/app/graphql/resolvers/projects_resolver.rb
index 1bc621a2e3e..af24d9128fd 100644
--- a/app/graphql/resolvers/projects_resolver.rb
+++ b/app/graphql/resolvers/projects_resolver.rb
@@ -2,8 +2,8 @@
 
 module Resolvers
   class ProjectsResolver < BaseResolver
+    prepend ::Projects::LookAheadPreloads
     include ProjectSearchArguments
-    include LooksAhead
 
     type Types::ProjectType.connection_type, null: true
 
@@ -61,20 +61,6 @@ module Resolvers
       [:creator, :group, :invited_groups, :project_setting]
     end
 
-    def preloads
-      {
-        full_path: [:route],
-        topics: [:topics],
-        import_status: [:import_state],
-        service_desk_address: [:project_feature, :service_desk_setting],
-        jira_import_status: [:jira_imports],
-        container_repositories: [:container_repositories],
-        container_repositories_count: [:container_repositories],
-        web_url: { namespace: [:route] },
-        is_catalog_resource: [:catalog_resource]
-      }
-    end
-
     def finder_params(args)
       {
         **project_finder_params(args),
diff --git a/app/graphql/resolvers/user_starred_projects_resolver.rb b/app/graphql/resolvers/user_starred_projects_resolver.rb
index efdf3f3ad9a..eea20a2f848 100644
--- a/app/graphql/resolvers/user_starred_projects_resolver.rb
+++ b/app/graphql/resolvers/user_starred_projects_resolver.rb
@@ -2,6 +2,8 @@
 
 module Resolvers
   class UserStarredProjectsResolver < BaseResolver
+    prepend ::Projects::LookAheadPreloads
+
     type Types::ProjectType.connection_type, null: true
 
     argument :search, GraphQL::Types::String,
@@ -23,8 +25,8 @@ module Resolvers
 
     alias_method :user, :object
 
-    def resolve(**args)
-      StarredProjectsFinder.new(
+    def resolve_with_lookahead(**args)
+      projects = StarredProjectsFinder.new(
         user,
         params: {
           search: args[:search],
@@ -34,6 +36,8 @@ module Resolvers
         },
         current_user: current_user
       ).execute
+
+      apply_lookahead(projects)
     end
   end
 end
diff --git a/app/helpers/todos_helper.rb b/app/helpers/todos_helper.rb
deleted file mode 100644
index 4228ee5b331..00000000000
--- a/app/helpers/todos_helper.rb
+++ /dev/null
@@ -1,170 +0,0 @@
-# frozen_string_literal: true
-
-module TodosHelper
-  def todos_pending_count
-    @todos_pending_count ||= current_user.todos_pending_count
-  end
-
-  def todos_done_count
-    @todos_done_count ||= current_user.todos_done_count
-  end
-
-  def todo_parent_path(todo)
-    if todo.resource_parent.is_a?(Group)
-      todo.resource_parent.name
-    else
-      # Note: Some todos (like for expired SSH keys) are neither related to a project nor a group.
-      return unless todo.project.present?
-
-      title = content_tag(:span, todo.project.name, class: 'project-name')
-      namespace = content_tag(:span, "#{todo.project.namespace.human_name} / ", class: 'namespace-name')
-
-      title.prepend(namespace) if todo.project.namespace
-
-      title
-    end
-  end
-
-  def todo_target_path(todo)
-    return unless todo.target.present?
-
-    path_options = todo_target_path_options(todo)
-
-    if todo.for_commit?
-      project_commit_path(todo.project, todo.target, path_options)
-    elsif todo.for_design?
-      todos_design_path(todo, path_options)
-    elsif todo.for_alert?
-      details_project_alert_management_path(todo.project, todo.target)
-    elsif todo.for_issue_or_work_item?
-      path_options[:only_path] = true
-      Gitlab::UrlBuilder.build(todo.target, **path_options)
-    elsif todo.for_ssh_key?
-      user_settings_ssh_key_path(todo.target)
-    elsif todo.member_access_requested?
-      todo.access_request_url(only_path: true)
-    else
-      path = [todo.resource_parent, todo.target]
-
-      path.unshift(:pipelines) if todo.build_failed?
-
-      polymorphic_path(path, path_options)
-    end
-  end
-
-  def todo_target_path_options(todo)
-    { anchor: todo_target_path_anchor(todo) }
-  end
-
-  def todo_target_path_anchor(todo)
-    dom_id(todo.note) if todo.note.present?
-  end
-
-  def todos_filter_params
-    {
-      state: params[:state].presence,
-      project_id: params[:project_id],
-      author_id: params[:author_id],
-      type: params[:type],
-      action_id: params[:action_id]
-    }.compact
-  end
-
-  def todos_filter_empty?
-    todos_filter_params.values.none?
-  end
-
-  def no_todos_messages
-    [
-      s_('Todos|Good job! Looks like you don\'t have anything left on your To-Do List'),
-      s_('Todos|Isn\'t an empty To-Do List beautiful?'),
-      s_('Todos|Give yourself a pat on the back!'),
-      s_('Todos|Nothing left to do. High five!'),
-      s_('Todos|Henceforth, you shall be known as "To-Do Destroyer"')
-    ]
-  end
-
-  def todos_filter_path(options = {})
-    without = options.delete(:without)
-
-    options = todos_filter_params.merge(options)
-
-    if without.present?
-      without.each do |key|
-        options.delete(key)
-      end
-    end
-
-    "#{request.path}?#{options.to_param}"
-  end
-
-  def todo_actions_options
-    [
-      { id: '', text: s_('Todos|Any Action') },
-      { id: Todo::ASSIGNED, text: s_('Todos|Assigned') },
-      { id: Todo::REVIEW_REQUESTED, text: s_('Todos|Review requested') },
-      { id: Todo::MENTIONED, text: s_('Todos|Mentioned') },
-      { id: Todo::MARKED, text: s_('Todos|Added') },
-      { id: Todo::BUILD_FAILED, text: s_('Todos|Pipelines') },
-      { id: Todo::MEMBER_ACCESS_REQUESTED, text: s_('Todos|Member access requested') },
-      { id: Todo::SSH_KEY_EXPIRED, text: s_('Todos|SSH key expired') },
-      { id: Todo::SSH_KEY_EXPIRING_SOON, text: s_('Todos|SSH key expiring soon') }
-    ]
-  end
-
-  def todo_types_options
-    [
-      { id: '', text: s_('Todos|Any Type') },
-      { id: 'Issue', text: s_('Todos|Issue') },
-      { id: 'MergeRequest', text: s_('Todos|Merge request') },
-      { id: 'DesignManagement::Design', text: s_('Todos|Design') },
-      { id: 'AlertManagement::Alert', text: s_('Todos|Alert') },
-      { id: 'Key', text: s_('Todos|SSH key') }
-    ]
-  end
-
-  def todo_actions_dropdown_label(selected_action_id, default_action)
-    selected_action = todo_actions_options.find { |action| action[:id] == selected_action_id.to_i }
-    selected_action ? selected_action[:text] : default_action
-  end
-
-  def todo_types_dropdown_label(selected_type, default_type)
-    selected_type = todo_types_options.find { |type| type[:id] == selected_type && type[:id] != '' }
-    selected_type ? selected_type[:text] : default_type
-  end
-
-  def todo_groups_requiring_saml_reauth(_todos)
-    []
-  end
-
-  private
-
-  def todos_design_path(todo, path_options)
-    design = todo.target
-
-    designs_project_issue_path(
-      todo.resource_parent,
-      design.issue,
-      path_options.merge(
-        vueroute: design.filename
-      )
-    )
-  end
-
-  def todo_action_subject(todo)
-    todo.self_added? ? s_('Todos|yourself') : _('you')
-  end
-
-  def show_todo_state?(todo)
-    case todo.target
-    when MergeRequest, Issue
-      %w[closed merged].include?(todo.target.state)
-    when AlertManagement::Alert
-      %i[resolved].include?(todo.target.state)
-    else
-      false
-    end
-  end
-end
-
-TodosHelper.prepend_mod_with('TodosHelper')
diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index 8492975a005..11449f42175 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -96,16 +96,15 @@ module Ci
 
     has_many :pages_deployments, foreign_key: :ci_build_id, inverse_of: :ci_build
 
-    has_many :tag_links,
-      ->(build) { in_partition(build) },
+    has_many :taggings, ->(build) { in_partition(build) },
       class_name: 'Ci::BuildTag',
       foreign_key: :build_id,
       partition_foreign_key: :partition_id,
       inverse_of: :build
 
-    has_many :simple_tags,
+    has_many :tags,
       class_name: 'Ci::Tag',
-      through: :tag_links,
+      through: :taggings,
       source: :tag
 
     Ci::JobArtifact.file_types.each_key do |key|
@@ -425,16 +424,8 @@ module Ci
       in_merge_request(merge_request_id).pluck(:id)
     end
 
-    def self.arel_tag_names_array
+    def self.taggings_join_model
       ::Ci::BuildTag
-        .joins(:tag)
-        .where(::Ci::BuildTag.arel_table[:build_id].eq(arel_table[:id]))
-        .where(::Ci::BuildTag.arel_table[:partition_id].eq(arel_table[:partition_id]))
-        .select('COALESCE(array_agg(tags.name ORDER BY name), ARRAY[]::text[])')
-    end
-
-    def tags_ids_relation
-      simple_tags
     end
 
     # A Ci::Bridge may transition to `canceling` as a result of strategy: :depend
@@ -799,14 +790,6 @@ module Ci
       update!(token_encrypted: nil)
     end
 
-    def tag_list
-      if tags.loaded?
-        tags.map(&:name)
-      else
-        super
-      end
-    end
-
     def has_tags?
       tag_list.any?
     end
@@ -1386,30 +1369,6 @@ module Ci
     def prefix_and_partition_for_token
       TOKEN_PREFIX + partition_id_prefix_in_16_bit_encode
     end
-
-    override :save_tags
-    def save_tags
-      super do |new_tags, old_tags|
-        if old_tags.present?
-          tag_links
-            .where(tag_id: old_tags)
-            .delete_all
-        end
-
-        ci_builds_tags = new_tags.map do |tag|
-          Ci::BuildTag.new(
-            build_id: id, partition_id: partition_id,
-            tag_id: tag.id, project_id: project_id)
-        end
-
-        ::Ci::BuildTag.bulk_insert!(
-          ci_builds_tags,
-          validate: false,
-          unique_by: [:tag_id, :build_id, :partition_id],
-          returns: :id
-        )
-      end
-    end
   end
 end
 
diff --git a/app/models/ci/build_tag.rb b/app/models/ci/build_tag.rb
index ef28620234c..fc660b91018 100644
--- a/app/models/ci/build_tag.rb
+++ b/app/models/ci/build_tag.rb
@@ -16,5 +16,12 @@ module Ci
     belongs_to :tag, class_name: 'Ci::Tag', optional: false
 
     validates :project_id, presence: true
+
+    scope :scoped_builds, -> do
+      where(arel_table[:build_id].eq(Ci::Build.arel_table[Ci::Build.primary_key]))
+        .where(arel_table[:partition_id].eq(Ci::Build.arel_table[:partition_id]))
+    end
+
+    scope :scoped_taggables, -> { scoped_builds }
   end
 end
diff --git a/app/models/ci/pipeline.rb b/app/models/ci/pipeline.rb
index ec82c12e9ca..b6f8d678fcd 100644
--- a/app/models/ci/pipeline.rb
+++ b/app/models/ci/pipeline.rb
@@ -610,11 +610,11 @@ module Ci
     end
 
     def tags_count
-      Ci::Tagging.where(taggable: builds).count
+      Ci::BuildTag.in_partition(self).where(build: builds).count
     end
 
     def distinct_tags_count
-      Ci::Tagging.where(taggable: builds).count('distinct(tag_id)')
+      Ci::BuildTag.in_partition(self).where(build: builds).count('distinct(tag_id)')
     end
 
     def stages_names
diff --git a/app/models/ci/runner.rb b/app/models/ci/runner.rb
index 0de33166f79..6e97b95ea63 100644
--- a/app/models/ci/runner.rb
+++ b/app/models/ci/runner.rb
@@ -87,7 +87,8 @@ module Ci
     has_many :projects, through: :runner_projects, disable_joins: true
     has_many :runner_namespaces, inverse_of: :runner, autosave: true
     has_many :groups, through: :runner_namespaces, disable_joins: true
-    has_many :tag_links, class_name: 'Ci::RunnerTagging', inverse_of: :runner
+    has_many :taggings, class_name: 'Ci::RunnerTagging', inverse_of: :runner
+    has_many :tags, class_name: 'Ci::Tag', through: :taggings, source: :tag
 
     # currently we have only 1 namespace assigned, but order is here for consistency
     has_one :owner_runner_namespace, -> { order(:id) }, class_name: 'Ci::RunnerNamespace'
@@ -338,6 +339,10 @@ module Ci
       end
     end
 
+    def self.taggings_join_model
+      ::Ci::RunnerTagging
+    end
+
     def runner_matcher
       Gitlab::Ci::Matching::RunnerMatcher.new({
         runner_ids: [id],
@@ -441,46 +446,10 @@ module Ci
       token[start_index..start_index + RUNNER_SHORT_SHA_LENGTH - 1]
     end
 
-    def tag_list
-      if tags.loaded?
-        tags.map(&:name)
-      else
-        super
-      end
-    end
-
     def has_tags?
       tag_list.any?
     end
 
-    override :save_tags
-    def save_tags
-      super do |new_tags, old_tags|
-        if old_tags.present?
-          tag_links
-            .where(tag_id: old_tags)
-            .delete_all
-        end
-
-        # Avoid inserting partitioned taggings that refer to a missing ci_runners partitioned record, since
-        # the backfill is not yet finalized.
-        ensure_partitioned_runner_record_exists if new_tags.any?
-
-        ci_runner_taggings = new_tags.map do |tag|
-          Ci::RunnerTagging.new(
-            runner_id: id, runner_type: runner_type,
-            tag_id: tag.id, sharding_key_id: sharding_key_id)
-        end
-
-        ::Ci::RunnerTagging.bulk_insert!(
-          ci_runner_taggings,
-          validate: false,
-          unique_by: [:tag_id, :runner_id, :runner_type],
-          returns: :id
-        )
-      end
-    end
-
     # TODO: Remove once https://gitlab.com/gitlab-org/gitlab/-/issues/504277 is closed.
     def ensure_partitioned_runner_record_exists
       self.class.sharded_table_proxy_model.insert_all(
diff --git a/app/models/ci/runner_tagging.rb b/app/models/ci/runner_tagging.rb
index 8660e8e57a3..2486b0eae12 100644
--- a/app/models/ci/runner_tagging.rb
+++ b/app/models/ci/runner_tagging.rb
@@ -21,6 +21,12 @@ module Ci
     validates :runner_type, presence: true
     validates :sharding_key_id, presence: true
 
+    scope :scoped_runners, -> do
+      where(arel_table[:runner_id].eq(Ci::Runner.arel_table[Ci::Runner.primary_key]))
+    end
+
+    scope :scoped_taggables, -> { scoped_runners }
+
     private
 
     def set_runner_type
diff --git a/app/models/ci/tag.rb b/app/models/ci/tag.rb
index f455cce2a9f..9636fb619f0 100644
--- a/app/models/ci/tag.rb
+++ b/app/models/ci/tag.rb
@@ -6,7 +6,8 @@ module Ci
 
     self.table_name = :tags
 
-    has_many :taggings, dependent: :destroy, class_name: 'Ci::Tagging' # rubocop:disable Cop/ActiveRecordDependent -- existing
+    has_many :job_taggings, class_name: 'Ci::BuildTag'
+    has_many :runner_taggings, class_name: 'Ci::RunnerTagging'
 
     validates :name, presence: true
     validates :name, uniqueness: { case_sensitive: true }
@@ -19,12 +20,6 @@ module Ci
       list.map { |name| named(name) }.reduce(:or)
     end
 
-    scope :for_context, ->(context) do
-      joins(:taggings)
-        .where(taggings: { context: context })
-        .select("DISTINCT tags.*")
-    end
-
     def self.find_or_create_with_like_by_name(name)
       find_or_create_all_with_like_by_name([name]).first
     end
diff --git a/app/models/concerns/ci/taggable.rb b/app/models/concerns/ci/taggable.rb
index 8d815b8f708..dc6d2a0a4a8 100644
--- a/app/models/concerns/ci/taggable.rb
+++ b/app/models/concerns/ci/taggable.rb
@@ -8,25 +8,6 @@ module Ci
     included do
       after_save :save_tags
 
-      # rubocop:disable Cop/ActiveRecordDependent -- existing
-      has_many :tag_taggings, -> { includes(:tag).where(context: :tags) }, # rubocop:disable Rails/InverseOf -- existing
-        as: :taggable,
-        class_name: 'Ci::Tagging',
-        dependent: :destroy,
-        after_add: :dirtify_tag_list,
-        after_remove: :dirtify_tag_list
-
-      has_many :tags,
-        class_name: 'Ci::Tag',
-        through: :tag_taggings,
-        source: :tag,
-        after_add: :dirtify_tag_list,
-        after_remove: :dirtify_tag_list
-
-      has_many :taggings, as: :taggable, dependent: :destroy, class_name: '::Ci::Tagging'
-      has_many :base_tags, through: :taggings, source: :tag, class_name: '::Ci::Tag'
-      # rubocop:enable Cop/ActiveRecordDependent -- existing
-
       attribute :tag_list, Gitlab::Database::Type::TagListType.new
 
       scope :tagged_with, ->(tags, like_search_enabled: false) do
@@ -38,9 +19,7 @@ module Ci
       end
 
       scope :with_tag, ->(name, like_search_enabled: false) do
-        query = Tagging
-                  .merge(unscoped.scoped_tagging)
-                  .where(context: :tags)
+        query = taggings_join_model.scoped_taggables
 
         if like_search_enabled
           query = query.where(tag_id: Tag.where("name LIKE ?", "%#{sanitize_sql_like(name)}%")) # rubocop:disable GitlabSecurity/SqlInjection -- we are sanitizing
@@ -50,11 +29,6 @@ module Ci
 
         where_exists(query)
       end
-
-      scope :scoped_tagging, -> do
-        where(arel_table[primary_key].eq(Tagging.arel_table[:taggable_id]))
-          .where(Tagging.arel_table[:taggable_type].eq(base_class.name))
-      end
     end
 
     def tag_list
@@ -75,13 +49,8 @@ module Ci
 
     private
 
-    def dirtify_tag_list(_tag)
-      attribute_will_change!(:tag_list)
-      clear_memoization(:tag_list)
-    end
-
     def context_tags
-      base_tags.where(taggings: { context: :tags, tagger_id: nil })
+      tags
     end
 
     def tag_list_cache_set?
@@ -96,13 +65,18 @@ module Ci
       old_tags = current_tags - tags
       new_tags = tags - current_tags
 
-      taggings.by_context(:tags).where(tag_id: old_tags).delete_all if old_tags.present?
-
-      new_tags.each do |tag|
-        taggings.create!(tag_id: tag.id, context: 'tags', taggable: self)
+      if old_tags.present?
+        taggings.where(tag_id: old_tags).delete_all
+        Ci::Tagging.where(tag_id: old_tags, taggable_id: id, taggable_type: self.class.base_class.name).delete_all
       end
 
-      yield(new_tags, old_tags) if block_given?
+      if new_tags.present?
+        Ci::Tagging.where(tag_id: current_tags, taggable_id: id, taggable_type: self.class.base_class.name).delete_all
+        Gitlab::Ci::Tags::BulkInsert.bulk_insert_tags!([self])
+      end
+
+      taggings.reset
+      context_tags.reset
 
       true
     end
diff --git a/app/models/concerns/taggable_queries.rb b/app/models/concerns/taggable_queries.rb
index 47b3232e9ac..5163fd87581 100644
--- a/app/models/concerns/taggable_queries.rb
+++ b/app/models/concerns/taggable_queries.rb
@@ -8,23 +8,17 @@ module TaggableQueries
   TooManyTagsError = Class.new(StandardError)
 
   class_methods do
-    # context is a name `acts_as_taggable context`
-    def arel_tag_names_array(context = :tags)
-      Ci::Tagging
+    def arel_tag_names_array
+      taggings_join_model
+        .scoped_taggables
         .joins(:tag)
-        .where("taggings.taggable_id=#{quoted_table_name}.id") # rubocop:disable GitlabSecurity/SqlInjection
-        .where(taggings: { context: context, taggable_type: polymorphic_name })
         .select('COALESCE(array_agg(tags.name ORDER BY name), ARRAY[]::text[])')
     end
   end
 
   def tags_ids
-    tags_ids_relation.limit(MAX_TAGS_IDS).order('id ASC').pluck(:id).tap do |ids|
+    tags.limit(MAX_TAGS_IDS).order('id ASC').pluck(:id).tap do |ids|
       raise TooManyTagsError if ids.size >= MAX_TAGS_IDS
     end
   end
-
-  def tags_ids_relation
-    tags
-  end
 end
diff --git a/app/models/work_item.rb b/app/models/work_item.rb
index 3ba960b3b2f..9b841679d9b 100644
--- a/app/models/work_item.rb
+++ b/app/models/work_item.rb
@@ -5,7 +5,7 @@ class WorkItem < Issue
 
   COMMON_QUICK_ACTIONS_COMMANDS = [
     :title, :reopen, :close, :cc, :tableflip, :shrug, :type, :promote_to, :checkin_reminder,
-    :subscribe, :unsubscribe, :confidential, :award, :react, :move, :clone
+    :subscribe, :unsubscribe, :confidential, :award, :react, :move, :clone, :copy_metadata
   ].freeze
 
   self.table_name = 'issues'
diff --git a/app/services/audit_event_service.rb b/app/services/audit_event_service.rb
index 32c03f22566..3d3350ec08e 100644
--- a/app/services/audit_event_service.rb
+++ b/app/services/audit_event_service.rb
@@ -3,6 +3,7 @@
 class AuditEventService
   include AuditEventSaveType
   include ::Gitlab::Audit::Logging
+  include ::Gitlab::Audit::ScopeValidation
 
   # Instantiates a new service
   #
@@ -29,7 +30,7 @@ class AuditEventService
     @save_type = save_type
     @created_at = created_at
 
-    Gitlab::AppLogger.info(message: "AuditEventService initialized", scope_class: @entity.class.name)
+    validate_scope!(@entity)
   end
 
   # Builds the @details attribute for authentication
diff --git a/app/services/audit_events/build_service.rb b/app/services/audit_events/build_service.rb
index ae956ff5c17..29ead8caf7e 100644
--- a/app/services/audit_events/build_service.rb
+++ b/app/services/audit_events/build_service.rb
@@ -2,6 +2,8 @@
 
 module AuditEvents
   class BuildService
+    include ::Gitlab::Audit::ScopeValidation
+
     # Handle missing attributes
     MissingAttributeError = Class.new(StandardError)
 
@@ -12,10 +14,11 @@ module AuditEvents
       author:, scope:, target:, message:,
       created_at: DateTime.current, additional_details: {}, ip_address: nil, target_details: nil)
       raise MissingAttributeError, "author" if author.blank?
-      raise MissingAttributeError, "scope" if scope.blank?
       raise MissingAttributeError, "target" if target.blank?
       raise MissingAttributeError, "message" if message.blank?
 
+      validate_scope!(scope)
+
       @author = build_author(author)
       @scope = scope
       @target = build_target(target)
diff --git a/app/validators/rsa_key_validator.rb b/app/validators/rsa_key_validator.rb
index 64595454a8c..a903df447e4 100644
--- a/app/validators/rsa_key_validator.rb
+++ b/app/validators/rsa_key_validator.rb
@@ -10,17 +10,17 @@
 #
 class RsaKeyValidator < ActiveModel::EachValidator
   def validate_each(record, attribute, value)
-    unless valid_rsa_key?(value)
-      record.errors.add(attribute, "is not a valid RSA key")
+    unless valid_rsa_keys?(value)
+      record.errors.add(attribute, "contains invalid RSA keys")
     end
   end
 
   private
 
-  def valid_rsa_key?(value)
-    return false unless value
+  def valid_rsa_keys?(key_or_keys)
+    return false unless key_or_keys
 
-    OpenSSL::PKey::RSA.new(value)
+    Array(key_or_keys).each { |key_data| OpenSSL::PKey::RSA.new(key_data) }
   rescue OpenSSL::PKey::RSAError
     false
   end
diff --git a/app/views/groups/settings/_permissions.html.haml b/app/views/groups/settings/_permissions.html.haml
index a78c9bee24c..9ae178a8839 100644
--- a/app/views/groups/settings/_permissions.html.haml
+++ b/app/views/groups/settings/_permissions.html.haml
@@ -59,7 +59,7 @@
         input_id: 'group_crm_source_group_id',
         selected: @group.crm_settings&.source_group_id,
         clearable: 'true',
-        description: s_("GroupSettings|The group from which to source contacts for issues in this group and it's subgroups.")
+        description: s_("GroupSettings|The group from which to source contacts for issues in this group and its subgroups.")
       } }
 
     - if Feature.enabled?(:group_hierarchy_optimization, @group, type: :beta)
diff --git a/config/application_setting_columns/cloud_connector_keys.yml b/config/application_setting_columns/cloud_connector_keys.yml
new file mode 100644
index 00000000000..40ddc3ebb4a
--- /dev/null
+++ b/config/application_setting_columns/cloud_connector_keys.yml
@@ -0,0 +1,12 @@
+---
+api_type:
+attr: cloud_connector_keys
+clusterwide: true
+column: cloud_connector_keys
+db_type: jsonb
+default:
+description:
+encrypted: false
+gitlab_com_different_than_default: false
+jihu: false
+not_null: false
diff --git a/config/feature_flags/wip/your_work_projects_vue.yml b/config/feature_flags/beta/your_work_projects_vue.yml
similarity index 96%
rename from config/feature_flags/wip/your_work_projects_vue.yml
rename to config/feature_flags/beta/your_work_projects_vue.yml
index f19617a012f..00a1f159a82 100644
--- a/config/feature_flags/wip/your_work_projects_vue.yml
+++ b/config/feature_flags/beta/your_work_projects_vue.yml
@@ -4,6 +4,6 @@ feature_issue_url: https://gitlab.com/groups/gitlab-org/-/epics/13066
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/155472
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/465889
 milestone: '17.1'
-type: wip
+type: beta
 group: group::organizations
 default_enabled: false
diff --git a/config/feature_flags/development/use_sql_functions_for_primary_key_lookups.yml b/config/feature_flags/development/use_sql_functions_for_primary_key_lookups.yml
index c8ee2894aef..68fc9381348 100644
--- a/config/feature_flags/development/use_sql_functions_for_primary_key_lookups.yml
+++ b/config/feature_flags/development/use_sql_functions_for_primary_key_lookups.yml
@@ -4,5 +4,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/135196
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/429479
 milestone: '16.6'
 type: development
-group: group::optimize
+group: group::database frameworks
 default_enabled: false
diff --git a/db/docs/batched_background_migrations/backfill_merge_request_reviewers_project_id.yml b/db/docs/batched_background_migrations/backfill_merge_request_reviewers_project_id.yml
index 6e7ea263c08..1b3383e0a10 100644
--- a/db/docs/batched_background_migrations/backfill_merge_request_reviewers_project_id.yml
+++ b/db/docs/batched_background_migrations/backfill_merge_request_reviewers_project_id.yml
@@ -5,4 +5,4 @@ feature_category: code_review_workflow
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/157031
 milestone: '17.2'
 queued_migration_version: 20240621114937
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: '20250108232951'
diff --git a/db/docs/batched_background_migrations/backfill_p_ci_pipeline_variables_from_ci_trigger_requests.yml b/db/docs/batched_background_migrations/backfill_p_ci_pipeline_variables_from_ci_trigger_requests.yml
new file mode 100644
index 00000000000..6932b83ea18
--- /dev/null
+++ b/db/docs/batched_background_migrations/backfill_p_ci_pipeline_variables_from_ci_trigger_requests.yml
@@ -0,0 +1,8 @@
+---
+migration_job_name: BackfillPCiPipelineVariablesFromCiTriggerRequests
+description: Backfill p_ci_pipeline_variables from ci_trigger_requests.variables
+feature_category: continuous_integration
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/175399
+milestone: '17.9'
+queued_migration_version: 20250113064942
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/docs/batched_background_migrations/backfill_security_policies.yml b/db/docs/batched_background_migrations/backfill_security_policies.yml
index 4eeb7956fc5..4dfb5edabd8 100644
--- a/db/docs/batched_background_migrations/backfill_security_policies.yml
+++ b/db/docs/batched_background_migrations/backfill_security_policies.yml
@@ -9,4 +9,4 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/163945
 milestone: '17.6'
 queued_migration_version: 20241118124301
 finalize_after: '2024-12-22'
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: 20241210081707
diff --git a/db/docs/batched_background_migrations/skip_company_onboarding_step.yml b/db/docs/batched_background_migrations/skip_company_onboarding_step.yml
index f0549df0f44..4b870fb493d 100644
--- a/db/docs/batched_background_migrations/skip_company_onboarding_step.yml
+++ b/db/docs/batched_background_migrations/skip_company_onboarding_step.yml
@@ -5,4 +5,4 @@ feature_category: onboarding
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/176324
 milestone: '17.8'
 queued_migration_version: 20241219144523
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: 20250122193107
diff --git a/db/migrate/20250123100033_add_cloud_connector_keys_to_application_settings.rb b/db/migrate/20250123100033_add_cloud_connector_keys_to_application_settings.rb
new file mode 100644
index 00000000000..ffdd4fe913b
--- /dev/null
+++ b/db/migrate/20250123100033_add_cloud_connector_keys_to_application_settings.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddCloudConnectorKeysToApplicationSettings < Gitlab::Database::Migration[2.2]
+  milestone '17.9'
+
+  def change
+    add_column :application_settings, :cloud_connector_keys, :jsonb
+  end
+end
diff --git a/db/migrate/20250123100054_seed_cloud_connector_keys.rb b/db/migrate/20250123100054_seed_cloud_connector_keys.rb
new file mode 100644
index 00000000000..2bd23652e69
--- /dev/null
+++ b/db/migrate/20250123100054_seed_cloud_connector_keys.rb
@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+class SeedCloudConnectorKeys < Gitlab::Database::Migration[2.2]
+  milestone '17.9'
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  class ApplicationSetting < MigrationRecord
+    encrypts :cloud_connector_keys
+  end
+
+  def up
+    ApplicationSetting.reset_column_information
+    ApplicationSetting.find_each do |application_setting|
+      application_setting.cloud_connector_keys = populate_keys
+      application_setting.save!
+    end
+  end
+
+  def down
+    ApplicationSetting.reset_column_information
+    ApplicationSetting.find_each do |application_setting|
+      application_setting.cloud_connector_keys = nil
+      application_setting.save!
+    end
+  end
+
+  def populate_keys
+    old_key = Rails.application.credentials.openid_connect_signing_key
+    new_key = OpenSSL::PKey::RSA.new(2048).to_pem
+
+    [old_key, new_key]
+  end
+end
diff --git a/db/post_migrate/20241210081707_finalize_backfill_security_policies.rb b/db/post_migrate/20241210081707_finalize_backfill_security_policies.rb
new file mode 100644
index 00000000000..bd17f4c70c3
--- /dev/null
+++ b/db/post_migrate/20241210081707_finalize_backfill_security_policies.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class FinalizeBackfillSecurityPolicies < Gitlab::Database::Migration[2.2]
+  milestone '17.9'
+
+  disable_ddl_transaction!
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  MIGRATION = "BackfillSecurityPolicies"
+
+  def up
+    ensure_batched_background_migration_is_finished(
+      job_class_name: MIGRATION,
+      table_name: :security_orchestration_policy_configurations,
+      column_name: :id,
+      job_arguments: [],
+      finalize: true
+    )
+  end
+
+  def down
+    # no-op
+  end
+end
diff --git a/db/post_migrate/20250108232951_finalize_backfill_merge_request_reviewers_project_id.rb b/db/post_migrate/20250108232951_finalize_backfill_merge_request_reviewers_project_id.rb
new file mode 100644
index 00000000000..9b9b16e0d3a
--- /dev/null
+++ b/db/post_migrate/20250108232951_finalize_backfill_merge_request_reviewers_project_id.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class FinalizeBackfillMergeRequestReviewersProjectId < Gitlab::Database::Migration[2.2]
+  milestone '17.9'
+
+  disable_ddl_transaction!
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main_cell
+
+  def up
+    ensure_batched_background_migration_is_finished(
+      job_class_name: 'BackfillMergeRequestReviewersProjectId',
+      table_name: :merge_request_reviewers,
+      column_name: :id,
+      job_arguments: [:project_id, :merge_requests, :target_project_id, :merge_request_id],
+      finalize: true
+    )
+  end
+
+  def down; end
+end
diff --git a/db/post_migrate/20250113064942_queue_backfill_p_ci_pipeline_variables_from_ci_trigger_requests.rb b/db/post_migrate/20250113064942_queue_backfill_p_ci_pipeline_variables_from_ci_trigger_requests.rb
new file mode 100644
index 00000000000..3041ce1bc9d
--- /dev/null
+++ b/db/post_migrate/20250113064942_queue_backfill_p_ci_pipeline_variables_from_ci_trigger_requests.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class QueueBackfillPCiPipelineVariablesFromCiTriggerRequests < Gitlab::Database::Migration[2.2]
+  milestone '17.9'
+  restrict_gitlab_migration gitlab_schema: :gitlab_ci
+
+  MIGRATION = "BackfillPCiPipelineVariablesFromCiTriggerRequests"
+  TABLE = :ci_trigger_requests
+  COLUMN = :id
+  DELAY_INTERVAL = 2.minutes
+
+  def up
+    queue_batched_background_migration(
+      MIGRATION,
+      TABLE,
+      COLUMN,
+      job_interval: DELAY_INTERVAL
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, TABLE, COLUMN, [])
+  end
+end
diff --git a/db/post_migrate/20250122193107_finalize_skip_company_onboarding_step.rb b/db/post_migrate/20250122193107_finalize_skip_company_onboarding_step.rb
new file mode 100644
index 00000000000..94eace6081f
--- /dev/null
+++ b/db/post_migrate/20250122193107_finalize_skip_company_onboarding_step.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class FinalizeSkipCompanyOnboardingStep < Gitlab::Database::Migration[2.2]
+  milestone '17.9'
+
+  disable_ddl_transaction!
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  def up
+    ensure_batched_background_migration_is_finished(
+      job_class_name: 'SkipCompanyOnboardingStep',
+      table_name: :users,
+      column_name: :id,
+      job_arguments: [],
+      finalize: true
+    )
+  end
+
+  def down; end
+end
diff --git a/db/schema_migrations/20241210081707 b/db/schema_migrations/20241210081707
new file mode 100644
index 00000000000..f927fe56512
--- /dev/null
+++ b/db/schema_migrations/20241210081707
@@ -0,0 +1 @@
+d4142e3e70b8b7451e1dcbd2cdc098d1330e93ebef04a2959f52929c46240527
\ No newline at end of file
diff --git a/db/schema_migrations/20250108232951 b/db/schema_migrations/20250108232951
new file mode 100644
index 00000000000..93dffc904ab
--- /dev/null
+++ b/db/schema_migrations/20250108232951
@@ -0,0 +1 @@
+57a4645cd4389ee65f6e0bbda04f6dbb4b68be255c128bae5b906903d4059173
\ No newline at end of file
diff --git a/db/schema_migrations/20250113064942 b/db/schema_migrations/20250113064942
new file mode 100644
index 00000000000..1f969abd4de
--- /dev/null
+++ b/db/schema_migrations/20250113064942
@@ -0,0 +1 @@
+b4ce6c74f708843a369ae7d4a7aed742934e4880ad03378d9ad427445fb2b30e
\ No newline at end of file
diff --git a/db/schema_migrations/20250122193107 b/db/schema_migrations/20250122193107
new file mode 100644
index 00000000000..a0a3b63805b
--- /dev/null
+++ b/db/schema_migrations/20250122193107
@@ -0,0 +1 @@
+cf4c3240247f872c22699b9d3cf2597c624e508c5a39d5bc4c851c91dd4c9932
\ No newline at end of file
diff --git a/db/schema_migrations/20250123100033 b/db/schema_migrations/20250123100033
new file mode 100644
index 00000000000..06a7537b83b
--- /dev/null
+++ b/db/schema_migrations/20250123100033
@@ -0,0 +1 @@
+651ace456096e61294dd6061efaabdfa0a0edefe340920bbc516b69c9acffe3e
\ No newline at end of file
diff --git a/db/schema_migrations/20250123100054 b/db/schema_migrations/20250123100054
new file mode 100644
index 00000000000..ee582221ed8
--- /dev/null
+++ b/db/schema_migrations/20250123100054
@@ -0,0 +1 @@
+22685843d74f03ab5715c14eceb51ada18c33de54d49df472431f52d3c7c3ebd
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index baa5840f2d9..9498ab28ca2 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -7930,6 +7930,7 @@ CREATE TABLE application_settings (
     elasticsearch_max_code_indexing_concurrency integer DEFAULT 30 NOT NULL,
     observability_settings jsonb DEFAULT '{}'::jsonb NOT NULL,
     search jsonb DEFAULT '{}'::jsonb NOT NULL,
+    cloud_connector_keys jsonb,
     CONSTRAINT app_settings_container_reg_cleanup_tags_max_list_size_positive CHECK ((container_registry_cleanup_tags_service_max_list_size >= 0)),
     CONSTRAINT app_settings_dep_proxy_ttl_policies_worker_capacity_positive CHECK ((dependency_proxy_ttl_group_policy_worker_capacity >= 0)),
     CONSTRAINT app_settings_ext_pipeline_validation_service_url_text_limit CHECK ((char_length(external_pipeline_validation_service_url) <= 255)),
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 2b05f58e958..f49999cb0b3 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -8729,6 +8729,26 @@ Input type: `ProjectSecretCreateInput`
 | <a id="mutationprojectsecretcreateerrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
 | <a id="mutationprojectsecretcreateprojectsecret"></a>`projectSecret` | [`ProjectSecret`](#projectsecret) | Project secret. |
 
+### `Mutation.projectSecretDelete`
+
+Input type: `ProjectSecretDeleteInput`
+
+#### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationprojectsecretdeleteclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationprojectsecretdeletename"></a>`name` | [`String!`](#string) | Name of the project secret. |
+| <a id="mutationprojectsecretdeleteprojectpath"></a>`projectPath` | [`ID!`](#id) | Project of the secret. |
+
+#### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationprojectsecretdeleteclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationprojectsecretdeleteerrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
+| <a id="mutationprojectsecretdeleteprojectsecret"></a>`projectSecret` | [`ProjectSecret`](#projectsecret) | Deleted project secret. |
+
 ### `Mutation.projectSecretsManagerInitialize`
 
 Input type: `ProjectSecretsManagerInitializeInput`
diff --git a/doc/development/cells/application_settings_analysis.md b/doc/development/cells/application_settings_analysis.md
index a72d28f08e1..08ac79a28d4 100644
--- a/doc/development/cells/application_settings_analysis.md
+++ b/doc/development/cells/application_settings_analysis.md
@@ -8,11 +8,11 @@ info: Analysis of Application Settings for Cells 1.0.
 ## Statistics
 
 - Number of attributes: 511
-- Number of encrypted attributes: 45 (9.0%)
-- Number of attributes documented: 312 (61.0%)
-- Number of attributes on GitLab.com different from the defaults: 222 (44.0%)
+- Number of encrypted attributes: 41 (8.0%)
+- Number of attributes documented: 311 (61.0%)
+- Number of attributes on GitLab.com different from the defaults: 221 (43.0%)
 - Number of attributes with `clusterwide` set: 511 (100.0%)
-- Number of attributes with `clusterwide: true` set: 124 (24.0%)
+- Number of attributes with `clusterwide: true` set: 126 (25.0%)
 
 ## Individual columns
 
@@ -64,6 +64,7 @@ info: Analysis of Application Settings for Cells 1.0.
 | `ci_max_includes` | `false` | `integer` | `integer` | `true` | `150` | `false` | `false`| `true` |
 | `ci_max_total_yaml_size_bytes` | `false` | `integer` | `integer` | `true` | `314572800` | `false` | `false`| `true` |
 | `clickhouse` | `false` | `jsonb` | `` | `true` | `'{}'::jsonb` | `true` | `true`| `false` |
+| `cloud_connector_keys` | `false` | `jsonb` | `` | `false` | `null` | `false` | `true`| `false` |
 | `cloud_license_auth_token` | `true` | `text` | `` | `false` | `null` | `false` | `false`| `false` |
 | `cluster_agents` | `false` | `jsonb` | `` | `true` | `'{}'::jsonb` | `true` | `true`| `false` |
 | `code_creation` | `false` | `jsonb` | `` | `true` | `'{}'::jsonb` | `true` | `true`| `false` |
diff --git a/doc/development/deprecation_guidelines/index.md b/doc/development/deprecation_guidelines/index.md
index 670f62a3802..a720604baf3 100644
--- a/doc/development/deprecation_guidelines/index.md
+++ b/doc/development/deprecation_guidelines/index.md
@@ -13,31 +13,42 @@ For details about the terms used on this page, see [the terminology](../../updat
 
 ## Minimize the impact of breaking changes
 
-Minimizing the impact to our customers ahead of a breaking change will ensure that disruptions will be minimized as much as possible. Product and Engineering teams should work closely together to understand 1) who would be most impacted and 2) whether tooling may help our users to migrate.
+Minimizing the impact to our customers ahead of a breaking change will ensure that disruptions will be as small as possible. Product and Engineering teams should work closely together to understand 1) who would be most impacted and how and 2) what tooling may help our users to migrate.
 
-It is **strongly recommended** that teams create an issue to track the work for each of the following:
+## Planning
 
-1. Measure product usage of the feature impacted by the breaking change.
-1. Assess how many customers will be impacted by the breaking change.
-1. Create tooling for users to manually migrate their own data or workflows.
-1. Allow them to manually enable the breaking change so that they can control when it takes effect.
-1. Automate the migration process **as much as possible** for users who do not take any manual steps to migrate.
-1. (Optional) Create UI controls for instance admins to disable the breaking change, providing flexibility to Self-Managed / Dedicated customers to plan for their migration path. Optional as this depends on the breaking change.
+If a deprecation or breaking change is unavoidable, then take the following steps:
 
-### Planning
+1. Review the [deprecation guidelines in our documentation](#minimize-the-impact-of-breaking-changes)
+1. Review the [breaking changes best practices](https://docs.google.com/document/d/1ByVZEhGJfjb6XTwiDeaSDRVwUiF6dsEQI01TW4BJA0k/edit?tab=t.0#heading=h.vxhro51h5zxn) (internal link)
+1. Review the [release post process for announcing breaking changes](https://handbook.gitlab.com/handbook/marketing/blog/release-posts/#deprecations-removals-and-breaking-changes)
+1. **(Required)** Create a [deprecation issue ticket](https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/issue_templates/Deprecations.md) and begin following the steps documented there 
 
-Each breaking change should have a:
+The [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/issue_templates/Deprecations.md) includes checklist that ensure each breaking change has sufficiently planned for:
 
+- Customer impact **(DRI: Engineering or Product, depending on change)**
+  - Measure product usage of the feature impacted by the breaking change
+  - Assess how many customers will be impacted and how, by the breaking change
 - Rollout plan **(DRI: Engineering)**
   - Is there a % roll out on GitLab.com?
   - During that major milestone, when should the roll out begin?
+  - And similar questions related to roll out preparedness
 - Migration plan **(DRI: Engineering)**
   - Are we instrumenting usage? If so, how are we using that data to inform what users will be impacted?
-  - How do we quickly and safely migrate them?
+  - How do we quickly and safely migrate them, preferably before the rollout?
+  - Can we create tooling for users to manually migrate their own data or workflows?
+  - Can we allow users to manually enable the breaking change so that they can control when it takes effect?
+  - Have we automated the migration process **as much as possible** for users who do not take any manual steps to migrate.
+  - Have we (optionally) created UI controls for instance admins to disable the breaking change, providing flexibility to Self-Managed / Dedicated customers to plan for their migration path?
+  - And similar questions related to migration options available to customers
 - Communication plan **(DRI: Product)**
   - Are customers aware of the upcoming changes?
   - Do they know when the changes will go into effect?
-  - Do they know what actions to take?
+  - Do they know what actions to take and when?
+  - Are internal stakeholders supporting affected customers aware of the upcoming changes?
+  - Have we gone beyond a public announcement to ensure that customers have received and acted upon the information?
+  - Have we engaged with customer-supporting teams (CS, Support, AEs, etc) to ensure that they have received and acted upon the information?
+  - And similar questions related to clear and proactive communication
 
 ## When can a feature be deprecated?
 
diff --git a/doc/development/secure_coding_guidelines.md b/doc/development/secure_coding_guidelines.md
index 88d0d542b51..14ce0db5bdb 100644
--- a/doc/development/secure_coding_guidelines.md
+++ b/doc/development/secure_coding_guidelines.md
@@ -19,8 +19,10 @@ For each of the vulnerabilities listed in this document, AppSec aims to have a S
 |---|---|---|
 | [Regular Expressions](#regular-expressions-guidelines)  | [1](https://gitlab.com/gitlab-com/gl-security/product-security/appsec/sast-custom-rules/-/blob/main/secure-coding-guidelines/ruby/ruby_insecure_regex.yml)  | ✅ |
 | [ReDOS](#denial-of-service-redos--catastrophic-backtracking) | [1](https://gitlab.com/gitlab-com/gl-security/product-security/appsec/sast-custom-rules/-/blob/main/secure-coding-guidelines/ruby/ruby_redos_1.yml), [2](https://gitlab.com/gitlab-com/gl-security/product-security/appsec/sast-custom-rules/-/blob/main/secure-coding-guidelines/ruby/ruby_redos_2.yml)  | ✅ |
+| [JWT](#json-web-tokens-jwt) | Pending | ❌ |
 | [SSRF](#server-side-request-forgery-ssrf) | [1](https://gitlab.com/gitlab-com/gl-security/product-security/appsec/sast-custom-rules/-/blob/main/secure-coding-guidelines/ruby/ruby_insecure_url.yml), [2](https://gitlab.com/gitlab-com/gl-security/product-security/appsec/sast-custom-rules/-/blob/main/secure-coding-guidelines/ruby/ruby_insecure_http.yml?ref_type=heads)  | ✅ |
 | [XSS](#xss-guidelines) | [1](https://gitlab.com/gitlab-com/gl-security/product-security/appsec/sast-custom-rules/-/tree/main/secure-coding-guidelines/ruby/ruby_xss_redirect.yml), [2](https://gitlab.com/gitlab-com/gl-security/product-security/appsec/sast-custom-rules/-/tree/main/secure-coding-guidelines/ruby/ruby_xss_html_safe.yml)  | ✅ |
+| [XXE](#xml-external-entities) | Pending | ❌ |
 | [Path traversal](#path-traversal-guidelines) (Ruby) | [1](https://gitlab.com/gitlab-com/gl-security/product-security/appsec/sast-custom-rules/-/blob/main/secure-coding-guidelines/ruby/ruby_path_traversal.yml?ref_type=heads) | ✅ |
 | [Path traversal](#path-traversal-guidelines) (Go) | [1](https://gitlab.com/gitlab-com/gl-security/product-security/appsec/sast-custom-rules/-/merge_requests/39)  | ✅ |
 | [OS command injection](#os-command-injection-guidelines) (Ruby) | [1](https://gitlab.com/gitlab-com/gl-security/product-security/appsec/sast-custom-rules/-/blob/main/secure-coding-guidelines/ruby/ruby_command_injection.yml?ref_type=heads) | ✅ |
@@ -108,7 +110,7 @@ The [CI/CD development guidelines](../development/cicd/index.md) are essential r
 
 ## Regular Expressions guidelines
 
-### Anchors / Multi line
+### Anchors / Multi line in Ruby
 
 Unlike other programming languages (for example, Perl or Python) Regular Expressions are matching multi-line by default in Ruby. Consider the following example in Python:
 
@@ -157,6 +159,56 @@ Here `params[:ip]` should not contain anything else but numbers and dots. Howeve
 
 In most cases the anchors `\A` for beginning of text and `\z` for end of text should be used instead of `^` and `$`.
 
+### Escape sequences in Go
+
+When a character in a string literal or regular expression literal is preceded by a backslash, it is interpreted as part of an escape sequence. For example, the escape sequence `\n` in a string literal corresponds to a single `newline` character, and not the `\` and `n` characters.
+
+There are two Go escape sequences that could produce surprising results. First, `regexp.Compile("\a")` matches the bell character, whereas `regexp.Compile("\\A")` matches the start of text and `regexp.Compile("\\a")` is a Vim (but not Go) regular expression matching any alphabetic character. Second, `regexp.Compile("\b")` matches a backspace, whereas `regexp.Compile("\\b")` matches the start of a word. Confusing one for the other could lead to a regular expression passing or failing much more often than expected, with potential security consequences.
+
+#### Examples
+
+The following example code fails to check for a forbidden word in an input string:
+
+```go
+package main
+
+import "regexp"
+
+func broken(hostNames []byte) string {
+  var hostRe = regexp.MustCompile("\bforbidden.host.org")
+  if hostRe.Match(hostNames) {
+    return "Must not target forbidden.host.org"
+  } else {
+    // This will be reached even if hostNames is exactly "forbidden.host.org",
+    // because the literal backspace is not matched
+    return ""
+  }
+}
+```
+
+#### Mitigation
+
+The above check does not work, but can be fixed by escaping the backslash:
+
+```go
+package main
+
+import "regexp"
+
+func fixed(hostNames []byte) string {
+  var hostRe = regexp.MustCompile(`\bforbidden.host.org`)
+  if hostRe.Match(hostNames) {
+    return "Must not target forbidden.host.org"
+  } else {
+    // hostNames definitely doesn't contain a word "forbidden.host.org", as "\\b"
+    // is the start-of-word anchor, not a literal backspace.
+    return ""
+  }
+}
+```
+
+Alternatively, you can use backtick-delimited raw string literals. For example, the `\b` in ``regexp.Compile(`hello\bworld`)``  matches a word boundary, not a backspace character, as within backticks `\b` is not an escape sequence.
+
 ## Denial of Service (ReDoS) / Catastrophic Backtracking
 
 When a regular expression (regex) is used to search for a string and can't find a match,
@@ -256,6 +308,112 @@ Go's [`regexp`](https://pkg.go.dev/regexp) package uses `re2` and isn't vulnerab
 - [The impact of regular expression denial of service (ReDoS) in practice: an empirical study at the ecosystem scale](https://davisjam.github.io/files/publications/DavisCoghlanServantLee-EcosystemREDOS-ESECFSE18.pdf). This research paper discusses approaches to automatically detect ReDoS vulnerabilities.
 - [Freezing the web: A study of ReDoS vulnerabilities in JavaScript-based web servers](https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-staicu.pdf). Another research paper about detecting ReDoS vulnerabilities.
 
+## JSON Web Tokens (JWT)
+
+### Description
+
+Insecure implementation of JWTs can lead to several security vulnerabilities, including:
+
+1. Identity spoofing
+1. Information disclosure
+1. Session hijacking
+1. Token forgery
+1. Replay attacks
+
+### Examples
+
+- Weak secret:
+
+  ```ruby
+  # Ruby
+  require 'jwt'
+
+  weak_secret = 'easy_to_guess'
+  payload = { user_id: 123 }
+  token = JWT.encode(payload, weak_secret, 'HS256')
+  ```
+
+- Insecure algorithm usage:
+
+  ```ruby
+  # Ruby
+  require 'jwt'
+
+  payload = { user_id: 123 }
+  token = JWT.encode(payload, nil, 'none')  # 'none' algorithm is insecure
+  ```
+
+- Improper signature verification:
+
+  ```go
+  // Go
+  import "github.com/golang-jwt/jwt/v5"
+
+  token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
+      // This function should verify the signature first
+      // before performing any sensitive actions
+      return []byte("secret"), nil
+  })
+  ```
+
+### Working securely with JWTs
+
+- Token generation:
+Use a strong, unique secret key for signing tokens. Prefer asymmetric algorithms (RS256, ES256) over symmetric ones (HS256). Include essential claims: 'exp' (expiration time), 'iat' (issued at), 'iss' (issuer), 'aud' (audience).
+
+  ```ruby
+  # Ruby
+  require 'jwt'
+  require 'openssl'
+
+  private_key = OpenSSL::PKey::RSA.generate(2048)
+
+  payload = {
+    user_id: user.id,
+    exp: Time.now.to_i + 3600,
+    iat: Time.now.to_i,
+    iss: 'your_app_name',
+    aud: 'your_api'
+  }
+  token = JWT.encode(payload, private_key, 'RS256')
+  ```
+
+- Token validation:
+  - Always verify the token signature and hardcode the algorithm during verification and decoding.
+  - Check the expiration time.
+  - Validate all claims, including custom ones.
+
+  ```go
+  // Go
+  import "github.com/golang-jwt/jwt/v5"
+
+  func validateToken(tokenString string) (*jwt.Token, error) {
+      token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
+          if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
+              // Only use RSA, reject all other algorithms
+              return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+          }
+          return publicKey, nil
+      })
+
+      if err != nil {
+        return nil, err
+      }
+      // Verify claims after signature has been verified
+      if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
+          if !claims.VerifyExpiresAt(time.Now().Unix(), true) {
+              return nil, fmt.Errorf("token has expired")
+          }
+          if !claims.VerifyIssuer("your_app_name", true) {
+              return nil, fmt.Errorf("invalid issuer")
+          }
+          // Add more claim validations as needed
+      }
+
+      return token, nil
+  }
+  ```
+
 ## Server Side Request Forgery (SSRF)
 
 ### Description
@@ -525,6 +683,42 @@ References:
 - <i class="fa fa-youtube-play youtube" aria-hidden="true"></i> [Allowlist input validation](https://youtu.be/2VFavqfDS6w?t=7816)
 - <i class="fa fa-youtube-play youtube" aria-hidden="true"></i> [Content Security Policy](https://www.youtube.com/watch?v=2VFavqfDS6w&t=12991s)
 
+## XML external entities
+
+### Description
+
+XML external entity (XXE) injection is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. It can lead to disclosure of confidential data, denial of service, server-side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.
+
+### Example
+
+```ruby
+require 'rexml/document'
+
+# Vulnerable code
+xml = <<-EOX
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE foo [
+  <!ELEMENT foo ANY >
+  <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
+<foo>&xxe;</foo>
+EOX
+
+# Parsing XML without proper safeguards
+doc = REXML::Document.new(xml)
+puts doc.root.text  # This could output the contents of /etc/passwd
+```
+
+### XXE mitigation in Ruby
+
+Use a safe XML parser: We prefer using Nokogiri when coding in Ruby. Nokogiri is a great option because it provides secure defaults that protect against XXE attacks. For more information, see the [Nokogiri documentation on parsing an HTML / XML Document](https://nokogiri.org/tutorials/parsing_an_html_xml_document.html#parse-options).
+
+```ruby
+require 'nokogiri'
+
+# Safe by default
+doc = Nokogiri::XML(xml_string)
+```
+
 ## Path Traversal guidelines
 
 ### Description
diff --git a/doc/development/stage_group_observability/dashboards/index.md b/doc/development/stage_group_observability/dashboards/index.md
index a0797ec659a..422eaa77dbf 100644
--- a/doc/development/stage_group_observability/dashboards/index.md
+++ b/doc/development/stage_group_observability/dashboards/index.md
@@ -34,7 +34,7 @@ Some generated dashboards are already available:
 
 ## Time range controls
 
-![Default time filter](img/stage_group_dashboards_time_filter_v14_10.png)
+![Time range selection menu with absolute and relative time range options.](img/stage_group_dashboards_time_filter_v14_10.png)
 
 By default, all the times are in UTC time zone.
 [We use UTC when communicating in Engineering.](https://handbook.gitlab.com/handbook/communication/#writing-style-guidelines)
@@ -54,7 +54,7 @@ Some special events are meaningful to development and operational activities.
 [Grafana annotations](https://grafana.com/docs/grafana/latest/dashboards/build-dashboards/annotate-visualizations/) mark them
 directly on the graphs.
 
-![Filters and annotations](img/stage_group_dashboards_filters_v14_10.png)
+![Dashboard filters and annotation switches.](img/stage_group_dashboards_filters_v14_10.png)
 
 | Name            | Type       | Description |
 | --------------- | ---------- | ----------- |
diff --git a/doc/user/application_security/secret_detection/secret_push_protection/index.md b/doc/user/application_security/secret_detection/secret_push_protection/index.md
index 91be9616ee0..248a5432191 100644
--- a/doc/user/application_security/secret_detection/secret_push_protection/index.md
+++ b/doc/user/application_security/secret_detection/secret_push_protection/index.md
@@ -189,6 +189,8 @@ secret push protection is skipped. Audit event details include:
 - GitLab account name.
 - Date and time at which secret push protection was skipped.
 - Name of project that the secret was pushed to.
+- Target branch. (Introduced in GitLab 17.4)
+- Commits that skipped secret push protection. (Introduced in GitLab 17.9)
 
 If [pipeline secret detection](../pipeline/index.md) is enabled, the content of all commits are
 scanned after they are pushed to the repository.
diff --git a/doc/user/group/moderate_users.md b/doc/user/group/moderate_users.md
index 97a80d9f1db..a548d50c9e9 100644
--- a/doc/user/group/moderate_users.md
+++ b/doc/user/group/moderate_users.md
@@ -68,8 +68,10 @@ To unban a user:
 DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** GitLab.com
+**Status:** Beta
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/461339) in GitLab 17.1 [with a flag](../../administration/feature_flags.md) named `group_remove_dormant_members`. Disabled by default.
+> [Released](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/178851) as a [beta](../../policy/development_stages_support.md#beta) feature in GitLab 17.9.
 
 FLAG:
 The availability of this feature is controlled by a feature flag.
diff --git a/doc/user/infrastructure/iac/terraform_state.md b/doc/user/infrastructure/iac/terraform_state.md
index 8d37f10e2f3..ee83fb8e9f4 100644
--- a/doc/user/infrastructure/iac/terraform_state.md
+++ b/doc/user/infrastructure/iac/terraform_state.md
@@ -252,7 +252,7 @@ You can use a GitLab-managed OpenTofu state backend as an
    example_access_token = "<GitLab personal access token>"
    ```
 
-1. In a `.tf` file, define the data source by using [OpenTofu input variables](https://opentofu.org/docs/language/values/variables/s):
+1. In a `.tf` file, define the data source by using [OpenTofu input variables](https://opentofu.org/docs/language/values/variables/):
 
    ```hcl
    data "terraform_remote_state" "example" {
diff --git a/doc/user/profile/service_accounts.md b/doc/user/profile/service_accounts.md
index b4ba5640cae..2181e55d656 100644
--- a/doc/user/profile/service_accounts.md
+++ b/doc/user/profile/service_accounts.md
@@ -97,7 +97,7 @@ Prerequisites:
 
 1. [List all service account users](../../api/user_service_accounts.md#list-all-service-account-users).
 
-1. [Create a personal access token](../../api/user_tokens.md#create-a-personal-access-token)
+1. [Create a personal access token](../../api/user_tokens.md#create-a-personal-access-token-for-a-user)
    for the service account user.
 
    You define the scopes for the service account by [setting the scopes for the personal access token](personal_access_tokens.md#personal-access-token-scopes).
diff --git a/lib/gitlab/audit/auditor.rb b/lib/gitlab/audit/auditor.rb
index 0ea8a3fed2c..d455f8864ca 100644
--- a/lib/gitlab/audit/auditor.rb
+++ b/lib/gitlab/audit/auditor.rb
@@ -81,15 +81,11 @@ module Gitlab
         @authentication_event = @context.fetch(:authentication_event, false)
         @authentication_provider = @context[:authentication_provider]
 
-        if @is_audit_event_yaml_defined
-          Gitlab::AppLogger.info(message: "Auditor initialized", scope_class: @scope.class.name)
-
-          return
-        end
+        return if @is_audit_event_yaml_defined
 
         raise StandardError, "Audit event type YML file is not defined for #{@name}. Please read " \
-                             "https://docs.gitlab.com/ee/development/audit_event_guide/" \
-                             "#how-to-instrument-new-audit-events for adding a new audit event"
+          "https://docs.gitlab.com/ee/development/audit_event_guide/" \
+          "#how-to-instrument-new-audit-events for adding a new audit event"
       end
 
       def single_audit
diff --git a/lib/gitlab/audit/scope_validation.rb b/lib/gitlab/audit/scope_validation.rb
new file mode 100644
index 00000000000..45649773ce2
--- /dev/null
+++ b/lib/gitlab/audit/scope_validation.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Audit
+    module ScopeValidation
+      private
+
+      def permitted_scope_classes
+        %w[Project Group User]
+      end
+
+      def validate_scope!(scope)
+        scope_class = scope.class.name
+        return if permitted_scope_classes.include?(scope_class)
+
+        raise ArgumentError, "Invalid scope class: #{scope_class}"
+      end
+    end
+  end
+end
+
+Gitlab::Audit::ScopeValidation.prepend_mod
diff --git a/lib/gitlab/background_migration/backfill_p_ci_pipeline_variables_from_ci_trigger_requests.rb b/lib/gitlab/background_migration/backfill_p_ci_pipeline_variables_from_ci_trigger_requests.rb
new file mode 100644
index 00000000000..3242377076d
--- /dev/null
+++ b/lib/gitlab/background_migration/backfill_p_ci_pipeline_variables_from_ci_trigger_requests.rb
@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class BackfillPCiPipelineVariablesFromCiTriggerRequests < BatchedMigrationJob
+      operation_name :backfill_p_ci_pipeline_variables_from_ci_trigger_requests
+      feature_category :continuous_integration
+
+      UNIQUE_BY = %i[pipeline_id key partition_id].freeze
+
+      class CiPipelineVariable < ::Ci::ApplicationRecord
+        self.table_name = :p_ci_pipeline_variables
+        self.primary_key = :id
+
+        attr_encrypted :value,
+          mode: :per_attribute_iv_and_salt,
+          insecure_mode: true,
+          key: Settings.attr_encrypted_db_key_base,
+          algorithm: 'aes-256-cbc'
+      end
+
+      class CiTriggerRequest < ::Ci::ApplicationRecord
+        self.table_name = :ci_trigger_requests
+        self.primary_key = :id
+
+        serialize :variables
+      end
+
+      def perform
+        each_sub_batch do |sub_batch|
+          pipeline_variable_attributes =
+            to_ci_pipeline_variable_attributes(sub_batch)
+              .uniq { |attr| attr.slice(*UNIQUE_BY) }
+              .map { |attr| CiPipelineVariable.new(attr).attributes }
+
+          next if pipeline_variable_attributes.blank?
+
+          CiPipelineVariable.upsert_all(pipeline_variable_attributes, unique_by: UNIQUE_BY, on_duplicate: :skip)
+        end
+      end
+
+      private
+
+      def to_ci_pipeline_variable_attributes(sub_batch)
+        sub_batch
+          .joins('INNER JOIN p_ci_pipelines ON p_ci_pipelines.id = ci_trigger_requests.commit_id')
+          .where.not(variables: nil)
+          .pluck(
+            'p_ci_pipelines.id', 'p_ci_pipelines.partition_id', 'p_ci_pipelines.project_id',
+            'ci_trigger_requests.variables'
+          )
+          .flat_map do |(pipeline_id, partition_id, project_id, variables)|
+            deserialize(variables)
+            .map do |key, value|
+              {
+                project_id: project_id,
+                pipeline_id: pipeline_id,
+                partition_id: partition_id,
+                key: key,
+                value: value
+              }
+            end
+          end
+      end
+
+      def deserialize(variables)
+        CiTriggerRequest.type_for_attribute('variables').deserialize(variables)
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/tags/bulk_insert.rb b/lib/gitlab/ci/tags/bulk_insert.rb
index 2f8831f9354..ba3ad52b387 100644
--- a/lib/gitlab/ci/tags/bulk_insert.rb
+++ b/lib/gitlab/ci/tags/bulk_insert.rb
@@ -59,6 +59,7 @@ module Gitlab
             join_model.bulk_insert!(
               monomorphic_taggings,
               validate: false,
+              skip_duplicates: true,
               unique_by: config.unique_by,
               batch_size: TAGGINGS_BATCH_SIZE,
               returns: :id
@@ -93,11 +94,8 @@ module Gitlab
 
             tags = tag_records_by_name.values_at(*tag_list)
             tags.each do |tag|
-              accumulator[:taggings] << tagging_attributes(tag, taggable) if polymorphic_taggings_available?
-
-              if monomorphic_taggings_available?(taggable)
-                accumulator[:monomorphic_taggings] << monomorphic_taggings_record(tag, taggable)
-              end
+              accumulator[:taggings] << tagging_attributes(tag, taggable)
+              accumulator[:monomorphic_taggings] << monomorphic_taggings_record(tag, taggable)
             end
           end
 
@@ -128,14 +126,6 @@ module Gitlab
             []
           end
         end
-
-        def monomorphic_taggings_available?(taggable)
-          config.monomorphic_taggings?(taggable)
-        end
-
-        def polymorphic_taggings_available?
-          config.polymorphic_taggings?
-        end
       end
     end
   end
diff --git a/lib/gitlab/quick_actions/issue_and_merge_request_actions.rb b/lib/gitlab/quick_actions/issue_and_merge_request_actions.rb
index 7436955a2b5..fff3ad8b694 100644
--- a/lib/gitlab/quick_actions/issue_and_merge_request_actions.rb
+++ b/lib/gitlab/quick_actions/issue_and_merge_request_actions.rb
@@ -143,19 +143,21 @@ module Gitlab
         #
         # /copy_metadata
         #
-        desc { _('Copy labels and milestone from other issue or merge request in this project') }
+        desc { _('Copy labels and milestone from other work item or merge request in the same namespace') }
         explanation do |source_issuable|
           _("Copy labels and milestone from %{source_issuable_reference}.") % { source_issuable_reference: source_issuable.to_reference }
         end
-        params '#issue | !merge_request'
-        types Issue, MergeRequest
+        params '#item | !merge_request | URL'
+        types Issue, MergeRequest, WorkItem
         condition do
           current_user.can?(:"set_#{quick_action_target.to_ability_name}_metadata", quick_action_target)
         end
         parse_params do |issuable_param|
           extract_references(issuable_param, :issue).first ||
+            extract_references(issuable_param, :work_item).first ||
+            extract_references(issuable_param, :epic).first ||
             extract_references(issuable_param, :merge_request).first ||
-            failed_parse(_("Failed to find issue or merge request"))
+            failed_parse(_("Failed to find work item or merge request"))
         end
         command :copy_metadata do |source_issuable|
           if can_copy_metadata?(source_issuable)
@@ -356,7 +358,26 @@ module Gitlab
         end
 
         def can_copy_metadata?(source_issuable)
-          source_issuable.present? && source_issuable.project_id == quick_action_target.project_id
+          source_issuable.present? && find_namespace(source_issuable) == find_namespace(quick_action_target)
+        end
+
+        def find_namespace(item)
+          case item
+          # WorkItem check should be before Issue, as WorkItem is a subclass of Issue
+          when WorkItem
+            handle_namespace_type(item.namespace)
+          when MergeRequest, Issue
+            item.project
+          end
+        end
+
+        def handle_namespace_type(namespace)
+          case namespace
+          when Project, Group
+            namespace
+          when Namespaces::ProjectNamespace
+            namespace.project
+          end
         end
 
         def format_time_estimate(time_estimate)
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 0d5cde19b84..9eaab26fb2e 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -1104,6 +1104,9 @@ msgstr ""
 msgid "%{name} (Busy)"
 msgstr ""
 
+msgid "%{name} checked"
+msgstr ""
+
 msgid "%{name} is already being used for another emoji"
 msgstr ""
 
@@ -1113,6 +1116,9 @@ msgstr ""
 msgid "%{name} is scheduled for %{action}"
 msgstr ""
 
+msgid "%{name} not checked"
+msgstr ""
+
 msgid "%{name}'s avatar"
 msgstr ""
 
@@ -1482,6 +1488,9 @@ msgstr ""
 msgid "%{title} webhook (for example, `%{example}`)."
 msgstr ""
 
+msgid "%{tooltipText} image"
+msgstr ""
+
 msgid "%{totalCpu} (%{freeSpacePercentage}%{percentSymbol} free)"
 msgstr ""
 
@@ -16396,7 +16405,7 @@ msgstr ""
 msgid "Copy labels and milestone from %{source_issuable_reference}."
 msgstr ""
 
-msgid "Copy labels and milestone from other issue or merge request in this project"
+msgid "Copy labels and milestone from other work item or merge request in the same namespace"
 msgstr ""
 
 msgid "Copy link"
@@ -23954,10 +23963,10 @@ msgstr ""
 msgid "Failed to find import label for Jira import."
 msgstr ""
 
-msgid "Failed to find issue or merge request"
+msgid "Failed to find users for %{missing}"
 msgstr ""
 
-msgid "Failed to find users for %{missing}"
+msgid "Failed to find work item or merge request"
 msgstr ""
 
 msgid "Failed to format markdown."
@@ -27914,7 +27923,7 @@ msgstr ""
 msgid "GroupSettings|The Auto DevOps pipeline runs if no alternative CI configuration file is found."
 msgstr ""
 
-msgid "GroupSettings|The group from which to source contacts for issues in this group and it's subgroups."
+msgid "GroupSettings|The group from which to source contacts for issues in this group and its subgroups."
 msgstr ""
 
 msgid "GroupSettings|There was a problem updating Auto DevOps pipeline: %{error_messages}."
@@ -59244,9 +59253,6 @@ msgstr ""
 msgid "Todos|(removed)"
 msgstr ""
 
-msgid "Todos|Added"
-msgstr ""
-
 msgid "Todos|Added approver"
 msgstr ""
 
@@ -59256,12 +59262,6 @@ msgstr ""
 msgid "Todos|All"
 msgstr ""
 
-msgid "Todos|Any Action"
-msgstr ""
-
-msgid "Todos|Any Type"
-msgstr ""
-
 msgid "Todos|Approval required"
 msgstr ""
 
@@ -59369,9 +59369,6 @@ msgstr[1] ""
 msgid "Todos|Member access request"
 msgstr ""
 
-msgid "Todos|Member access requested"
-msgstr ""
-
 msgid "Todos|Mentioned"
 msgstr ""
 
@@ -59390,9 +59387,6 @@ msgstr ""
 msgid "Todos|OKR checkin requested"
 msgstr ""
 
-msgid "Todos|Pipelines"
-msgstr ""
-
 msgid "Todos|Raw text search is not currently supported"
 msgstr ""
 
diff --git a/qa/qa/page/dashboard/projects.rb b/qa/qa/page/dashboard/projects.rb
index 6321897b1cd..bbba8ac3409 100644
--- a/qa/qa/page/dashboard/projects.rb
+++ b/qa/qa/page/dashboard/projects.rb
@@ -35,6 +35,7 @@ module QA
           filter_input.click
           filter_input.set(name)
           click_element 'search-button'
+          wait_for_requests
         end
 
         def go_to_project(name)
@@ -47,12 +48,26 @@ module QA
           click_element('new-project-button', Page::Project::New)
         end
 
+        # The tab names of the HAML and Vue version of the UI differ slightly.
+        # The Vue version defaults to a "Contributed" tab where-as the HAML version
+        # defaults to a "Yours" tab. Here we conditionally click the "Member" tab
+        # if it exists (only on the Vue version). This allows the tests to
+        # pass in both versions.
+        # We can remove this conditional check when code behind the
+        # your_work_projects_vue feature flag becomes the default.
+        def click_member_tab
+          text = 'Member'
+          click_link(text) if has_link?(text)
+          wait_for_requests
+        end
+
         def self.path
           '/'
         end
 
         def clear_project_filter
           click_element 'filtered-search-clear-button'
+          wait_for_requests
         end
 
         private
diff --git a/qa/qa/specs/features/browser_ui/9_data_stores/project/invite_group_to_project_spec.rb b/qa/qa/specs/features/browser_ui/9_data_stores/project/invite_group_to_project_spec.rb
index e7ba6c8e7a0..4f720d94b2d 100644
--- a/qa/qa/specs/features/browser_ui/9_data_stores/project/invite_group_to_project_spec.rb
+++ b/qa/qa/specs/features/browser_ui/9_data_stores/project/invite_group_to_project_spec.rb
@@ -19,6 +19,7 @@ module QA
           Flow::Login.sign_in(as: user)
 
           Page::Dashboard::Projects.perform do |projects|
+            projects.click_member_tab
             expect(projects).to have_filtered_project_with_access_role(project.name, 'Developer')
           end
 
diff --git a/qa/qa/specs/features/browser_ui/9_data_stores/project/project_owner_permissions_spec.rb b/qa/qa/specs/features/browser_ui/9_data_stores/project/project_owner_permissions_spec.rb
index d8a59e110e0..ceecba96bf2 100644
--- a/qa/qa/specs/features/browser_ui/9_data_stores/project/project_owner_permissions_spec.rb
+++ b/qa/qa/specs/features/browser_ui/9_data_stores/project/project_owner_permissions_spec.rb
@@ -19,6 +19,7 @@ module QA
 
         it "has owner role and permissions", testcase: testcase do
           Page::Dashboard::Projects.perform do |projects|
+            projects.click_member_tab
             expect(projects).to have_filtered_project_with_access_role(project.name, 'Owner')
           end
 
@@ -44,6 +45,7 @@ module QA
 
         it "has maintainer role without owner permissions", testcase: testcase do
           Page::Dashboard::Projects.perform do |projects|
+            projects.click_member_tab
             expect(projects).to have_filtered_project_with_access_role(project.name, 'Maintainer')
           end
 
diff --git a/spec/features/dashboard/projects_spec.rb b/spec/features/dashboard/projects_spec.rb
index f2a956f36c6..9059362e4d8 100644
--- a/spec/features/dashboard/projects_spec.rb
+++ b/spec/features/dashboard/projects_spec.rb
@@ -47,7 +47,7 @@ RSpec.describe 'Dashboard Projects', :js, feature_category: :groups_and_projects
         wait_for_requests
 
         within_testid("projects-list-item-#{project.id}") do
-          expect(find_by_testid('access-level-badge')).to have_content('Developer')
+          expect(find_by_testid('user-access-role')).to have_content('Developer')
         end
       end
     end
diff --git a/spec/frontend/vue_shared/components/groups_list/groups_list_item_spec.js b/spec/frontend/vue_shared/components/groups_list/groups_list_item_spec.js
index 1c19fbb5705..b8e8feda776 100644
--- a/spec/frontend/vue_shared/components/groups_list/groups_list_item_spec.js
+++ b/spec/frontend/vue_shared/components/groups_list/groups_list_item_spec.js
@@ -41,7 +41,7 @@ describe('GroupsListItem', () => {
   const findListActions = () => wrapper.findComponent(ListActions);
   const findConfirmationModal = () => wrapper.findComponent(GroupListItemDeleteModal);
   const findPreventDeleteModal = () => wrapper.findComponent(GroupListItemPreventDeleteModal);
-  const findAccessLevelBadge = () => wrapper.findByTestId('access-level-badge');
+  const findAccessLevelBadge = () => wrapper.findByTestId('user-access-role');
   const findTimeAgoTooltip = () => wrapper.findComponent(TimeAgoTooltip);
   const fireDeleteAction = () => findListActions().props('actions')[ACTION_DELETE].action();
 
diff --git a/spec/frontend/vue_shared/components/projects_list/projects_list_item_spec.js b/spec/frontend/vue_shared/components/projects_list/projects_list_item_spec.js
index 94793e33f9c..75746cc8731 100644
--- a/spec/frontend/vue_shared/components/projects_list/projects_list_item_spec.js
+++ b/spec/frontend/vue_shared/components/projects_list/projects_list_item_spec.js
@@ -78,7 +78,7 @@ describe('ProjectsListItem', () => {
   const findForksStat = () => wrapper.findByTestId('forks-btn');
   const findVisibilityIcon = () => findAvatarLabeled().findComponent(GlIcon);
   const findListActions = () => wrapper.findComponent(ProjectListItemActions);
-  const findAccessLevelBadge = () => wrapper.findByTestId('access-level-badge');
+  const findAccessLevelBadge = () => wrapper.findByTestId('user-access-role');
   const findCiCatalogBadge = () => wrapper.findByTestId('ci-catalog-badge');
   const findProjectDescription = () => wrapper.findComponent(ProjectListItemDescription);
   const findInactiveBadge = () => wrapper.findComponent(ProjectListItemInactiveBadge);
@@ -518,4 +518,10 @@ describe('ProjectsListItem', () => {
       expect(wrapper.findComponent(CiIcon).props('status')).toBe(detailedStatus);
     });
   });
+
+  it('adds data-testid attribute to content', () => {
+    createComponent();
+
+    expect(wrapper.findByTestId('project-content').exists()).toBe(true);
+  });
 });
diff --git a/spec/frontend/vue_shared/components/resource_lists/list_item_spec.js b/spec/frontend/vue_shared/components/resource_lists/list_item_spec.js
index edf3701a447..f32374523d9 100644
--- a/spec/frontend/vue_shared/components/resource_lists/list_item_spec.js
+++ b/spec/frontend/vue_shared/components/resource_lists/list_item_spec.js
@@ -246,4 +246,14 @@ describe('ListItem', () => {
       expect(findTimeAgoTooltip().exists()).toBe(false);
     });
   });
+
+  describe('when contentTestid props is passed', () => {
+    beforeEach(() => {
+      createComponent({ propsData: { contentTestid: 'foo' } });
+    });
+
+    it('adds data-testid attribute to content', () => {
+      expect(wrapper.findByTestId('foo').exists()).toBe(true);
+    });
+  });
 });
diff --git a/spec/helpers/todos_helper_spec.rb b/spec/helpers/todos_helper_spec.rb
deleted file mode 100644
index 76b17340c1e..00000000000
--- a/spec/helpers/todos_helper_spec.rb
+++ /dev/null
@@ -1,208 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe TodosHelper do
-  let_it_be(:user) { create(:user) }
-  let_it_be(:author) { create(:user) }
-  let_it_be(:project) { create(:project) }
-  let_it_be(:issue) { create(:issue, title: 'Issue 1', project: project) }
-  let_it_be(:design) { create(:design, issue: issue) }
-  let_it_be(:note) do
-    create(:note, project: issue.project, note: 'I am note, hear me roar')
-  end
-
-  let_it_be(:group) { create(:group, :public, name: 'Group 1') }
-
-  let_it_be(:design_todo) do
-    create(
-      :todo,
-      :mentioned,
-      user: user,
-      project: project,
-      target: design,
-      author: author,
-      note: note
-    )
-  end
-
-  let_it_be(:alert_todo) do
-    alert = create(:alert_management_alert, iid: 1001)
-    create(:todo, target: alert)
-  end
-
-  let_it_be(:task_todo) do
-    task = create(:work_item, :task, project: project)
-    create(:todo, target: task, target_type: task.class.name, project: project)
-  end
-
-  let_it_be(:issue_todo) do
-    create(:todo, target: issue)
-  end
-
-  let_it_be(:group_todo) do
-    create(:todo, target: group, group: group, project: nil, user: user)
-  end
-
-  let_it_be(:project_access_request_todo) do
-    create(:todo, target: project, action: Todo::MEMBER_ACCESS_REQUESTED)
-  end
-
-  describe '#todo_target_path' do
-    context 'when given a design' do
-      let(:todo) { design_todo }
-
-      it 'responds with an appropriate path' do
-        path = helper.todo_target_path(todo)
-        issue_path = Gitlab::Routing.url_helpers
-          .project_issue_path(issue.project, issue)
-
-        expect(path).to eq("#{issue_path}/designs/#{design.filename}##{dom_id(design_todo.note)}")
-      end
-    end
-
-    context 'when given an alert' do
-      let(:todo) { alert_todo }
-
-      it 'responds with an appropriate path' do
-        path = helper.todo_target_path(todo)
-
-        expect(path).to eq(
-          "/#{todo.project.full_path}/-/alert_management/#{todo.target.iid}/details"
-        )
-      end
-    end
-
-    context 'when given a task' do
-      let(:todo) { task_todo }
-
-      it 'responds with an appropriate path using iid' do
-        path = helper.todo_target_path(todo)
-
-        expect(path).to eq("/#{todo.project.full_path}/-/work_items/#{todo.target.iid}")
-      end
-    end
-
-    context 'when given an issue with a note anchor' do
-      let(:todo) { create(:todo, project: issue.project, target: issue, note: note) }
-
-      it 'responds with an appropriate path' do
-        path = helper.todo_target_path(todo)
-
-        expect(path).to eq("/#{issue.project.full_path}/-/issues/#{issue.iid}##{dom_id(note)}")
-      end
-    end
-
-    context 'when a user requests access to group' do
-      let_it_be(:group_access_request_todo) do
-        create(
-          :todo,
-          target_id: group.id,
-          target_type: group.class.polymorphic_name,
-          group: group,
-          action: Todo::MEMBER_ACCESS_REQUESTED
-        )
-      end
-
-      it 'responds with access requests tab' do
-        path = helper.todo_target_path(group_access_request_todo)
-
-        access_request_path = Gitlab::Routing.url_helpers.group_group_members_path(group, tab: 'access_requests')
-
-        expect(path).to eq(access_request_path)
-      end
-    end
-
-    context 'when a user requests access to project' do
-      it 'responds with access requests tab' do
-        path = helper.todo_target_path(project_access_request_todo)
-
-        access_request_path = Gitlab::Routing.url_helpers.project_project_members_path(project, tab: 'access_requests')
-
-        expect(path).to eq(access_request_path)
-      end
-    end
-
-    context 'when a SSH expired' do
-      subject { helper.todo_target_path(todo) }
-
-      let(:key) { create(:key, user: user) }
-      let(:todo) { build(:todo, target: key, project: nil, user: user) }
-
-      it { is_expected.to eq user_settings_ssh_key_path(key) }
-    end
-  end
-
-  describe '#todo_types_options' do
-    it 'includes a match for a design todo' do
-      options = helper.todo_types_options
-      design_option = options.find { |o| o[:id] == design_todo.target_type }
-
-      expect(design_option).to include(text: 'Design')
-    end
-  end
-
-  describe '#no_todos_messages' do
-    context 'when getting todos messages' do
-      it 'return these sentences' do
-        expected_sentences = [
-          s_('Todos|Good job! Looks like you don\'t have anything left on your To-Do List'),
-          s_('Todos|Isn\'t an empty To-Do List beautiful?'),
-          s_('Todos|Give yourself a pat on the back!'),
-          s_('Todos|Nothing left to do. High five!'),
-          s_('Todos|Henceforth, you shall be known as "To-Do Destroyer"')
-        ]
-        expect(helper.no_todos_messages).to eq(expected_sentences)
-      end
-    end
-  end
-
-  describe '#todos_filter_params' do
-    using RSpec::Parameterized::TableSyntax
-
-    where(:state, :result) do
-      'done'    | 'done'
-      'pending' | 'pending'
-      ''        | nil
-    end
-
-    with_them do
-      before do
-        allow(helper).to receive(:params).and_return({ state: state })
-      end
-
-      it { expect(helper.todos_filter_params[:state]).to eq(result) }
-    end
-  end
-
-  describe '#todo_parent_path' do
-    context 'when todo resource parent is a group' do
-      subject(:result) { helper.todo_parent_path(group_todo) }
-
-      it { expect(result).to eq(group_todo.group.name) }
-    end
-
-    context 'when todo resource parent is not a group' do
-      context 'when todo belongs to no project either' do
-        let(:todo) { build(:todo, group: nil, project: nil, user: user) }
-
-        subject(:result) { helper.todo_parent_path(todo) }
-
-        it { expect(result).to eq(nil) }
-      end
-
-      it 'returns project title with namespace' do
-        result = helper.todo_parent_path(project_access_request_todo)
-
-        expect(result).to include(project_access_request_todo.project.name)
-        expect(result).to include(project_access_request_todo.project.namespace.human_name)
-      end
-    end
-  end
-
-  describe '.todo_groups_requiring_saml_reauth', feature_category: :system_access do
-    it 'returns an empty array' do
-      expect(helper.todo_groups_requiring_saml_reauth([])).to match_array([])
-    end
-  end
-end
diff --git a/spec/lib/gitlab/audit/auditor_spec.rb b/spec/lib/gitlab/audit/auditor_spec.rb
index 6230cd1601b..17fc063c085 100644
--- a/spec/lib/gitlab/audit/auditor_spec.rb
+++ b/spec/lib/gitlab/audit/auditor_spec.rb
@@ -54,17 +54,6 @@ RSpec.describe Gitlab::Audit::Auditor, feature_category: :audit_events do
       it 'does not raise an error' do
         expect { audit! }.not_to raise_error
       end
-
-      it 'logs the initialization with correct parameters' do
-        audit!
-
-        expect(Gitlab::AppLogger).to have_received(:info).with(
-          {
-            message: "Auditor initialized",
-            scope_class: group.class.name
-          }
-        )
-      end
     end
 
     context 'when authentication event' do
diff --git a/spec/lib/gitlab/background_migration/backfill_p_ci_pipeline_variables_from_ci_trigger_requests_spec.rb b/spec/lib/gitlab/background_migration/backfill_p_ci_pipeline_variables_from_ci_trigger_requests_spec.rb
new file mode 100644
index 00000000000..63897773e8c
--- /dev/null
+++ b/spec/lib/gitlab/background_migration/backfill_p_ci_pipeline_variables_from_ci_trigger_requests_spec.rb
@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::BackgroundMigration::BackfillPCiPipelineVariablesFromCiTriggerRequests,
+  migration: :gitlab_ci, feature_category: :continuous_integration do
+  let(:migration) do
+    described_class.new(
+      batch_table: :ci_trigger_requests,
+      batch_column: :id,
+      job_arguments: [nil],
+      sub_batch_size: 2,
+      pause_ms: 2,
+      connection: ci_pipeline.connection
+    )
+  end
+
+  let(:ci_pipeline) { table(:p_ci_pipelines, primary_key: :id) }
+  let(:ci_build) { table(:p_ci_builds, primary_key: :id) }
+  let(:ci_trigger) { table(:ci_triggers) }
+  let(:ci_trigger_request) { table(:ci_trigger_requests) { |klass| klass.serialize :variables } }
+  let(:ci_pipeline_variable) do
+    table(:p_ci_pipeline_variables, primary_key: :id) do |klass|
+      klass.include(::Ci::HasVariable)
+      klass.include(::Ci::RawVariable)
+    end
+  end
+
+  let!(:trigger1) { ci_trigger.create!(owner_id: 1) }
+
+  let!(:pipeline1) { ci_pipeline.create!(partition_id: 100, project_id: 1) }
+
+  context 'when one pipeline has one ci_trigger_requests' do
+    let!(:trigger2) { ci_trigger.create!(owner_id: 1) }
+    let!(:trigger3) { ci_trigger.create!(owner_id: 1) }
+
+    let!(:pipeline2) { ci_pipeline.create!(partition_id: 100, project_id: 1) }
+
+    before do
+      ci_trigger_request.create!(commit_id: pipeline1.id, trigger_id: trigger1.id, variables: { ENV1: true })
+      ci_trigger_request.create!(commit_id: pipeline2.id, trigger_id: trigger2.id, variables: { ENV2: false })
+      ci_trigger_request.create!(commit_id: nil, trigger_id: trigger3.id)
+    end
+
+    it 'upserts p_ci_pipeline_variables' do
+      expect { migration.perform }
+        .to change { ci_pipeline_variable.count }.from(0).to(2)
+      expect(ci_pipeline_variable.first).to have_attributes(
+        pipeline_id: pipeline1.id,
+        partition_id: pipeline1.partition_id,
+        key: 'ENV1',
+        value: 'true',
+        encrypted_value: an_instance_of(String),
+        encrypted_value_salt: an_instance_of(String),
+        encrypted_value_iv: an_instance_of(String),
+        variable_type: 'env_var',
+        raw: false
+      )
+      expect(ci_pipeline_variable.last).to have_attributes(
+        pipeline_id: pipeline2.id,
+        partition_id: pipeline2.partition_id,
+        key: 'ENV2',
+        value: 'false',
+        encrypted_value: an_instance_of(String),
+        encrypted_value_salt: an_instance_of(String),
+        encrypted_value_iv: an_instance_of(String),
+        variable_type: 'env_var',
+        raw: false
+      )
+    end
+  end
+
+  context 'when one pipeline has multiple ci_trigger_requests' do
+    before do
+      ci_trigger_request.create!(commit_id: pipeline1.id, trigger_id: trigger1.id,
+        variables: { ENV1: true, VAR1_ONLY: true })
+      ci_trigger_request.create!(commit_id: pipeline1.id, trigger_id: trigger1.id,
+        variables: { ENV1: false, VAR2_ONLY: false })
+    end
+
+    it 'upserts p_ci_pipeline_variables' do
+      expect { migration.perform }
+        .to change { ci_pipeline_variable.count }.from(0).to(3)
+      expect(ci_pipeline_variable.first).to have_attributes(
+        pipeline_id: pipeline1.id,
+        partition_id: pipeline1.partition_id,
+        key: 'ENV1',
+        value: 'true',
+        encrypted_value: an_instance_of(String),
+        encrypted_value_salt: an_instance_of(String),
+        encrypted_value_iv: an_instance_of(String),
+        variable_type: 'env_var',
+        raw: false
+      )
+      expect(ci_pipeline_variable.second).to have_attributes(
+        pipeline_id: pipeline1.id,
+        partition_id: pipeline1.partition_id,
+        key: 'VAR1_ONLY',
+        value: 'true',
+        encrypted_value: an_instance_of(String),
+        encrypted_value_salt: an_instance_of(String),
+        encrypted_value_iv: an_instance_of(String),
+        variable_type: 'env_var',
+        raw: false
+      )
+      expect(ci_pipeline_variable.last).to have_attributes(
+        pipeline_id: pipeline1.id,
+        partition_id: pipeline1.partition_id,
+        key: 'VAR2_ONLY',
+        value: 'false',
+        encrypted_value: an_instance_of(String),
+        encrypted_value_salt: an_instance_of(String),
+        encrypted_value_iv: an_instance_of(String),
+        variable_type: 'env_var',
+        raw: false
+      )
+    end
+  end
+end
diff --git a/spec/lib/gitlab/ci/tags/bulk_insert_spec.rb b/spec/lib/gitlab/ci/tags/bulk_insert_spec.rb
index 93ed0912731..8306477ac9f 100644
--- a/spec/lib/gitlab/ci/tags/bulk_insert_spec.rb
+++ b/spec/lib/gitlab/ci/tags/bulk_insert_spec.rb
@@ -14,7 +14,7 @@ RSpec.describe Gitlab::Ci::Tags::BulkInsert, feature_category: :continuous_integ
   let_it_be_with_refind(:other_runner) { create(:ci_runner, :project_type, projects: [project]) }
 
   let(:statuses) { [taggable, other_taggable] }
-  let(:config) { described_class::NoConfig.new }
+  let(:config) { nil }
 
   subject(:service) { described_class.new(statuses, config: config) }
 
@@ -43,6 +43,10 @@ RSpec.describe Gitlab::Ci::Tags::BulkInsert, feature_category: :continuous_integ
     end
 
     describe '#insert!' do
+      it 'generates a valid config' do
+        expect(service.config).to be_a(expected_configuration)
+      end
+
       context 'without tags' do
         it { expect(service.insert!).to be_truthy }
       end
@@ -98,105 +102,11 @@ RSpec.describe Gitlab::Ci::Tags::BulkInsert, feature_category: :continuous_integ
 
           it 'inserts taggings in batches' do
             recorder = ActiveRecord::QueryRecorder.new { service.insert! }
-            count = recorder.log.count { |query| query.include?('INSERT INTO "taggings"') }
+            count = recorder.log.count { |query| query.include?("INSERT INTO \"#{tagging_class.table_name}\"") }
 
             expect(count).to eq(3)
           end
         end
-
-        context 'with no config provided' do
-          it 'does not persist tag links' do
-            service.insert!
-
-            expect(taggable.tag_links).to be_empty
-            expect(other_taggable.tag_links).to be_empty
-          end
-        end
-
-        context 'with config provided by the factory' do
-          let(:config) { nil }
-
-          it 'generates a valid config' do
-            expect(service.config).to be_a(expected_configuration)
-          end
-
-          context 'with flags' do
-            before do
-              allow(service.config).to receive(:monomorphic_taggings?) { monomorphic_taggings }
-              allow(service.config).to receive(:polymorphic_taggings?) { polymorphic_taggings }
-            end
-
-            context 'when writing to both tables' do
-              let(:monomorphic_taggings) { true }
-              let(:polymorphic_taggings) { true }
-
-              it 'persists tag links and taggings' do
-                service.insert!
-
-                expect(taggable.tag_links).not_to be_empty
-                expect(other_taggable.tag_links).not_to be_empty
-
-                expect(tagged_with('tag1')).to contain_exactly(taggable)
-                expect(tagged_with('tag2')).to contain_exactly(taggable, other_taggable)
-                expect(tagged_with('tag3')).to contain_exactly(other_taggable)
-
-                expect(taggable.taggings).not_to be_empty
-                expect(other_taggable.taggings).not_to be_empty
-
-                expect(taggable_class.tagged_with('tag1')).to contain_exactly(taggable)
-                expect(taggable_class.tagged_with('tag2')).to contain_exactly(taggable, other_taggable)
-                expect(taggable_class.tagged_with('tag3')).to contain_exactly(other_taggable)
-              end
-            end
-
-            context 'when writing only to taggings' do
-              let(:monomorphic_taggings) { false }
-              let(:polymorphic_taggings) { true }
-
-              it 'persists taggings' do
-                service.insert!
-
-                expect(taggable.tag_links).to be_empty
-                expect(other_taggable.tag_links).to be_empty
-
-                expect(taggable.taggings).not_to be_empty
-                expect(other_taggable.taggings).not_to be_empty
-
-                expect(taggable_class.tagged_with('tag1')).to contain_exactly(taggable)
-                expect(taggable_class.tagged_with('tag2')).to contain_exactly(taggable, other_taggable)
-                expect(taggable_class.tagged_with('tag3')).to contain_exactly(other_taggable)
-              end
-            end
-
-            context 'when writing only to link table' do
-              let(:monomorphic_taggings) { true }
-              let(:polymorphic_taggings) { false }
-
-              it 'persists tag links' do
-                service.insert!
-
-                expect(taggable.tag_links).not_to be_empty
-                expect(other_taggable.tag_links).not_to be_empty
-
-                expect(tagged_with('tag1')).to contain_exactly(taggable)
-                expect(tagged_with('tag2')).to contain_exactly(taggable, other_taggable)
-                expect(tagged_with('tag3')).to contain_exactly(other_taggable)
-
-                expect(taggable.taggings).to be_empty
-                expect(other_taggable.taggings).to be_empty
-              end
-            end
-
-            def tagged_with(tag)
-              scope = tagging_class
-                .where(tag_id: Ci::Tag.where(name: tag))
-                .where(tagging_class.arel_table[taggable_id_column].eq(taggable_class.arel_table[:id]))
-                .where(tagging_class.arel_table[partition_column].eq(taggable_class.arel_table[partition_column]))
-
-              taggable_class.where_exists(scope)
-            end
-          end
-        end
       end
 
       context 'with tags for only one taggable' do
diff --git a/spec/migrations/20250113064942_queue_backfill_p_ci_pipeline_variables_from_ci_trigger_requests_spec.rb b/spec/migrations/20250113064942_queue_backfill_p_ci_pipeline_variables_from_ci_trigger_requests_spec.rb
new file mode 100644
index 00000000000..0513662d46f
--- /dev/null
+++ b/spec/migrations/20250113064942_queue_backfill_p_ci_pipeline_variables_from_ci_trigger_requests_spec.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueBackfillPCiPipelineVariablesFromCiTriggerRequests,
+  migration: :gitlab_ci, feature_category: :continuous_integration do
+  let!(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          gitlab_schema: :gitlab_ci,
+          table_name: :ci_trigger_requests,
+          column_name: :id,
+          interval: described_class::DELAY_INTERVAL
+        )
+      }
+    end
+  end
+end
diff --git a/spec/migrations/20250123100054_seed_cloud_connector_keys_spec.rb b/spec/migrations/20250123100054_seed_cloud_connector_keys_spec.rb
new file mode 100644
index 00000000000..0585d47eb3a
--- /dev/null
+++ b/spec/migrations/20250123100054_seed_cloud_connector_keys_spec.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe SeedCloudConnectorKeys, migration: :gitlab_main, feature_category: :cloud_connector do
+  it 'seeds Cloud Connector keys' do
+    settings = table(:application_settings).create!
+
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(settings.reload.cloud_connector_keys).to be_nil
+      }
+
+      migration.after -> {
+        # Should contain encryption data as a hash
+        expect(settings.reload.cloud_connector_keys).to include("h" => instance_of(Hash))
+      }
+    end
+  end
+end
diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb
index 0c0905239f8..e81c339afc6 100644
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@@ -46,8 +46,8 @@ RSpec.describe Ci::Build, feature_category: :continuous_integration, factory_def
   it { is_expected.to have_many(:job_variables).with_foreign_key(:job_id) }
   it { is_expected.to have_many(:report_results).with_foreign_key(:build_id) }
   it { is_expected.to have_many(:pages_deployments).with_foreign_key(:ci_build_id) }
-  it { is_expected.to have_many(:tag_links).with_foreign_key(:build_id).class_name('Ci::BuildTag').inverse_of(:build) }
-  it { is_expected.to have_many(:simple_tags).class_name('Ci::Tag').through(:tag_links).source(:tag) }
+  it { is_expected.to have_many(:taggings).with_foreign_key(:build_id).class_name('Ci::BuildTag').inverse_of(:build) }
+  it { is_expected.to have_many(:tags).class_name('Ci::Tag').through(:taggings).source(:tag) }
 
   it { is_expected.to have_one(:runner_manager).through(:runner_manager_build) }
   it { is_expected.to have_one(:runner_session).with_foreign_key(:build_id) }
@@ -1941,8 +1941,8 @@ RSpec.describe Ci::Build, feature_category: :continuous_integration, factory_def
 
       expect(build.tags.count).to eq(1)
       expect(build.tags.first.name).to eq('tag')
-      expect(build.tag_links.count).to eq(1)
-      expect(build.tag_links.first.tag.name).to eq('tag')
+      expect(build.taggings.count).to eq(1)
+      expect(build.taggings.first.tag.name).to eq('tag')
     end
 
     it 'strips tags' do
@@ -1959,7 +1959,7 @@ RSpec.describe Ci::Build, feature_category: :continuous_integration, factory_def
         end
 
         expect(build.tags).to be_empty
-        expect(build.tag_links).to be_empty
+        expect(build.taggings).to be_empty
       end
     end
   end
@@ -6223,16 +6223,6 @@ RSpec.describe Ci::Build, feature_category: :continuous_integration, factory_def
     end
   end
 
-  describe '#tags_ids_relation' do
-    let(:tag_list) { %w[ruby postgres docker] }
-
-    before do
-      build.update!(tag_list: tag_list)
-    end
-
-    it { expect(build.tags_ids_relation.pluck(:name)).to match_array(tag_list) }
-  end
-
   describe '#token' do
     subject(:token) { build.token }
 
diff --git a/spec/models/ci/processable_spec.rb b/spec/models/ci/processable_spec.rb
index b705a3dfd4d..bf31374d4ee 100644
--- a/spec/models/ci/processable_spec.rb
+++ b/spec/models/ci/processable_spec.rb
@@ -89,7 +89,7 @@ RSpec.describe Ci::Processable, feature_category: :continuous_integration do
       let(:ignore_accessors) do
         %i[type namespace lock_version target_url base_tags trace_sections
            commit_id deployment erased_by_id project_id project_mirror
-           runner_id tag_taggings taggings tags tag_links simple_tags trigger_request_id
+           runner_id taggings tags trigger_request_id
            user_id auto_canceled_by_id retried failure_reason
            sourced_pipelines sourced_pipeline artifacts_file_store artifacts_metadata_store
            metadata runner_manager_build runner_manager runner_session trace_chunks
diff --git a/spec/models/ci/runner_spec.rb b/spec/models/ci/runner_spec.rb
index 35662e33515..c0988c15735 100644
--- a/spec/models/ci/runner_spec.rb
+++ b/spec/models/ci/runner_spec.rb
@@ -25,7 +25,8 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     it { is_expected.to have_many(:groups).through(:runner_namespaces) }
     it { is_expected.to have_one(:owner_runner_namespace).class_name('Ci::RunnerNamespace') }
 
-    it { is_expected.to have_many(:tag_links).class_name('Ci::RunnerTagging').inverse_of(:runner) }
+    it { is_expected.to have_many(:taggings).class_name('Ci::RunnerTagging').inverse_of(:runner) }
+    it { is_expected.to have_many(:tags).class_name('Ci::Tag') }
   end
 
   it_behaves_like 'having unique enum values'
@@ -114,41 +115,6 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
           expect(described_class.tagged_with(tag_name)).to include(runner)
         end
       end
-
-      context 'when runner is not yet synced to partitioned table' do
-        let(:connection) { Ci::ApplicationRecord.connection }
-
-        before do
-          # Simulate legacy runners not present in sharded table (created when FK was not present)
-          runner
-
-          connection.execute(<<~SQL)
-            DELETE FROM ci_runners_e59bb2812d;
-          SQL
-        end
-
-        context 'tag does not exist' do
-          before do
-            runner.tag_list = [tag_name]
-          end
-
-          it 'creates a tag and syncs runner to partitioned table' do
-            expect { runner.save! }
-              .to change(Ci::Tag, :count).by(1)
-              .and change { partitioned_runner_exists?(runner) }.from(false).to(true)
-          end
-        end
-
-        private
-
-        def partitioned_runner_exists?(runner)
-          result = connection.execute(<<~SQL)
-            SELECT COUNT(*) FROM ci_runners_e59bb2812d WHERE id = #{runner.id};
-          SQL
-
-          result.first['count'].positive?
-        end
-      end
     end
   end
 
@@ -1328,7 +1294,7 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
 
       expect(runner.tags.count).to eq(1)
       expect(runner.tags.first.name).to eq('tag')
-      expect(runner.tag_links.count).to eq(1)
+      expect(runner.taggings.count).to eq(1)
     end
 
     it 'strips tags' do
diff --git a/spec/models/ci/runner_tagging_spec.rb b/spec/models/ci/runner_tagging_spec.rb
index e47ee9d6da3..18cd0cc5b23 100644
--- a/spec/models/ci/runner_tagging_spec.rb
+++ b/spec/models/ci/runner_tagging_spec.rb
@@ -48,7 +48,7 @@ RSpec.describe Ci::RunnerTagging, feature_category: :runner do
         let(:runner_ids) { runners.take(2).map(&:id) }
 
         it 'returns requested runner namespaces' do
-          is_expected.to eq(runners.take(2).flat_map(&:tag_links))
+          is_expected.to eq(runners.take(2).flat_map(&:taggings))
         end
       end
 
@@ -56,7 +56,7 @@ RSpec.describe Ci::RunnerTagging, feature_category: :runner do
         let(:runner_ids) { runners.first }
 
         it 'returns requested runner namespaces' do
-          is_expected.to eq(runners.first.tag_links)
+          is_expected.to eq(runners.first.taggings)
         end
       end
     end
diff --git a/spec/models/ci/tag_spec.rb b/spec/models/ci/tag_spec.rb
index 8655e7e9a38..5a594333d17 100644
--- a/spec/models/ci/tag_spec.rb
+++ b/spec/models/ci/tag_spec.rb
@@ -7,7 +7,8 @@ RSpec.describe Ci::Tag, feature_category: :continuous_integration do
     [create(:ci_tag, name: 'Awesome'), create(:ci_tag, name: 'awesome'), create(:ci_tag, name: 'epic')]
   end
 
-  it { is_expected.to have_many(:taggings).class_name('Ci::Tagging') }
+  it { is_expected.to have_many(:job_taggings).class_name('Ci::BuildTag') }
+  it { is_expected.to have_many(:runner_taggings).class_name('Ci::RunnerTagging') }
 
   describe 'validations' do
     it { is_expected.to validate_presence_of(:name) }
@@ -27,14 +28,6 @@ RSpec.describe Ci::Tag, feature_category: :continuous_integration do
     it { expect(described_class.named_any(%w[awesome epic])).to contain_exactly(*tags[1..]) }
   end
 
-  describe '.for_context' do
-    it 'returns the tags for the specified context' do
-      Ci::Tagging.create!(tag_id: tags.first.id, context: 'tags')
-
-      expect(described_class.for_context('tags')).to contain_exactly(tags.first)
-    end
-  end
-
   describe '.find_or_create_all_with_like_by_name' do
     let(:tags) { %w[tag] }
 
diff --git a/spec/models/concerns/ci/taggable_spec.rb b/spec/models/concerns/ci/taggable_spec.rb
index e40d2d5352d..e92c297d6a0 100644
--- a/spec/models/concerns/ci/taggable_spec.rb
+++ b/spec/models/concerns/ci/taggable_spec.rb
@@ -3,10 +3,13 @@
 require 'spec_helper'
 
 RSpec.describe Ci::Taggable, feature_category: :continuous_integration do
-  let_it_be(:taggable_model) do
+  let_it_be(:taggings_model) do
     Class.new(Ci::ApplicationRecord) do |_model|
       connection.create_table :_test_gitlab_ci_taggings, force: true do |t|
-        t.string :name
+        t.integer :tag_id
+        t.integer :test_ci_taggable_id
+
+        t.index [:tag_id, :test_ci_taggable_id], unique: true, name: '_test_taggable_idx'
       end
 
       self.table_name = '_test_gitlab_ci_taggings'
@@ -15,16 +18,65 @@ RSpec.describe Ci::Taggable, feature_category: :continuous_integration do
         'TestCiTaggings'
       end
 
+      include BulkInsertSafe
+
+      belongs_to :tag, class_name: 'Ci::Tag', optional: false
+    end
+  end
+
+  let_it_be(:taggable_model) do
+    Class.new(Ci::ApplicationRecord) do |_model|
+      connection.create_table :_test_gitlab_ci_taggable, force: true do |t|
+        t.string :name
+      end
+
+      self.table_name = '_test_gitlab_ci_taggable'
+
+      def self.name
+        'TestCiTaggable'
+      end
+
       include Ci::Taggable
     end
   end
 
+  let_it_be(:configuration_class) do
+    Class.new do
+      attr_accessor :join_model, :unique_by
+
+      def attributes_map(record)
+        { test_ci_taggable_id: record.id }
+      end
+    end
+  end
+
+  let_it_be(:configuration) do
+    configuration_class.new.tap do |c|
+      c.join_model = taggings_model
+      c.unique_by = [:tag_id, :test_ci_taggable_id]
+    end
+  end
+
   let(:taggable_record) { taggable_model.new(name: 'tags') }
 
-  it { expect(taggable_record).to have_many(:taggings).class_name('Ci::Tagging') }
-  it { expect(taggable_record).to have_many(:tag_taggings).class_name('Ci::Tagging') }
-  it { expect(taggable_record).to have_many(:tags).class_name('Ci::Tag').through(:tag_taggings) }
-  it { expect(taggable_record).to have_many(:base_tags).class_name('Ci::Tag').through(:taggings) }
+  before do
+    taggable_model.has_many :taggings, anonymous_class: taggings_model
+    taggable_model.has_many :tags, class_name: 'Ci::Tag', through: :taggings, source: :tag
+
+    taggings_model.scope :scoped_taggables, -> {
+      where('_test_gitlab_ci_taggings.test_ci_taggable_id = _test_gitlab_ci_taggable.id')
+    }
+
+    allow(taggable_model).to receive(:taggings_join_model) { taggings_model }
+
+    config = instance_double(Gitlab::Ci::Tags::BulkInsert::ConfigurationFactory, build: configuration)
+
+    allow(Gitlab::Ci::Tags::BulkInsert::ConfigurationFactory).to receive(:new)
+      .with(an_instance_of(taggable_model)).and_return(config)
+  end
+
+  it { expect(taggable_record).to have_many(:taggings) }
+  it { expect(taggable_record).to have_many(:tags).class_name('Ci::Tag').through(:taggings) }
 
   it { expect(taggable_record.tag_list).to be_empty }
   it { expect(taggable_record.tag_list).to be_a(Gitlab::Ci::Tags::TagList) }
@@ -56,7 +108,10 @@ RSpec.describe Ci::Taggable, feature_category: :continuous_integration do
     taggable_record.save!
 
     taggable_record.tag_list = 'ruby, docker'
-    expect { taggable_record.save! }.to change { Ci::Tagging.count }.by(-1)
+    expect { taggable_record.save! }
+      .to change { taggings_model.count }.by(-1)
+      .and change { Ci::Tagging.count }.by(-1)
+
     expect(taggable_record.reload.tag_list).to match_array(%w[ruby docker])
   end
 
@@ -68,14 +123,15 @@ RSpec.describe Ci::Taggable, feature_category: :continuous_integration do
 
     expect { taggable_record.save! }
       .to change { Ci::Tag.count }.by(2)
+      .and change { taggings_model.count }.by(1)
       .and change { Ci::Tagging.count }.by(1)
 
     expect(taggable_record.reload.tag_list).to match_array(%w[ruby docker elasticsearch golang])
   end
 
   describe '.tagged_with' do
-    let_it_be(:tags) { taggable_model.create!(name: 'tags', tag_list: 'ruby, docker, postgres') }
-    let_it_be(:other_tags) { taggable_model.create!(name: 'other tags', tag_list: 'ruby, golang') }
+    let!(:tags) { taggable_model.create!(name: 'tags', tag_list: 'ruby, docker, postgres') }
+    let!(:other_tags) { taggable_model.create!(name: 'other tags', tag_list: 'ruby, golang') }
 
     it { expect(taggable_model.tagged_with('ruby')).to match_array([tags, other_tags]) }
     it { expect(taggable_model.tagged_with('ruby, docker')).to match_array([tags]) }
@@ -94,25 +150,4 @@ RSpec.describe Ci::Taggable, feature_category: :continuous_integration do
 
     it { expect { taggable_record.reload }.to change { taggable_record.tag_list.object_id } }
   end
-
-  describe '#dirtify_tag_list' do
-    before do
-      taggable_record.tag_list = 'ruby, docker, postgres'
-      taggable_record.save!
-    end
-
-    it 'resets the tag list after a tag is added' do
-      expect { taggable_record.tags << create(:ci_tag) }
-        .to change { Ci::Tagging.count }.by(1)
-        .and change { taggable_record.tag_list.size }.by(1)
-        .and change { taggable_record.tag_list_changed? }.to(true)
-    end
-
-    it 'resets the tag list after a tag is removed' do
-      expect { taggable_record.tags.destroy(Ci::Tag.find_by_name('docker')) }
-        .to change { Ci::Tagging.count }.by(-1)
-        .and change { taggable_record.tag_list.size }.by(-1)
-        .and change { taggable_record.tag_list_changed? }.to(true)
-    end
-  end
 end
diff --git a/spec/models/work_item_spec.rb b/spec/models/work_item_spec.rb
index bcc3b217f15..b8c18242a7e 100644
--- a/spec/models/work_item_spec.rb
+++ b/spec/models/work_item_spec.rb
@@ -264,7 +264,7 @@ RSpec.describe WorkItem, feature_category: :portfolio_management do
 
     it 'returns quick action commands supported for all work items' do
       is_expected.to include(:title, :reopen, :close, :cc, :tableflip, :shrug, :type, :promote_to, :checkin_reminder,
-        :subscribe, :unsubscribe, :confidential, :award, :move, :clone)
+        :subscribe, :unsubscribe, :confidential, :award, :move, :clone, :copy_metadata)
     end
 
     it 'omits quick action commands from assignees widget' do
diff --git a/spec/requests/api/graphql/user/contributed_projects_query_spec.rb b/spec/requests/api/graphql/user/contributed_projects_query_spec.rb
index 92a81abca5a..a7db28e722b 100644
--- a/spec/requests/api/graphql/user/contributed_projects_query_spec.rb
+++ b/spec/requests/api/graphql/user/contributed_projects_query_spec.rb
@@ -36,6 +36,32 @@ RSpec.describe 'Getting contributedProjects of the user', feature_category: :gro
     end
   end
 
+  context 'when all fields are requested' do
+    let(:user_fields) do
+      "contributedProjects { nodes {#{all_graphql_fields_for('Project', max_depth: 1,
+        excluded: ['productAnalyticsState'])} } }"
+    end
+
+    it 'avoids N+1 queries', :use_sql_query_cache, :clean_gitlab_redis_cache do
+      post_graphql(query, current_user: current_user)
+
+      control = ActiveRecord::QueryRecorder.new(skip_cached: false) do
+        post_graphql(query, current_user: current_user)
+      end
+
+      new_project = create(:project, :public, name: 'New project', path: 'new-project')
+      new_project.add_developer(user)
+      travel_to(4.hours.from_now) { create(:push_event, project: new_project, author: user) }
+
+      # There is an N+1 query for max_member_access_for_user_ids
+      # There is an N+1 query for duo_features_enabled cascading setting
+      # https://gitlab.com/gitlab-org/gitlab/-/issues/442164
+      expect do
+        post_graphql(query, current_user: current_user)
+      end.not_to exceed_all_query_limit(control).with_threshold(7)
+    end
+  end
+
   describe 'sorting' do
     let(:user_fields_with_sort) { "contributedProjects(sort: #{sort_parameter}) { nodes { id } }" }
     let(:query_with_sort) { graphql_query_for(:user, user_params, user_fields_with_sort) }
diff --git a/spec/requests/api/graphql/user/starred_projects_query_spec.rb b/spec/requests/api/graphql/user/starred_projects_query_spec.rb
index 50c9576a005..7a9f8acea4f 100644
--- a/spec/requests/api/graphql/user/starred_projects_query_spec.rb
+++ b/spec/requests/api/graphql/user/starred_projects_query_spec.rb
@@ -59,6 +59,32 @@ RSpec.describe 'Getting starredProjects of the user', feature_category: :groups_
         a_graphql_entity_for(project_c)
       )
     end
+
+    context 'when all fields are requested' do
+      let(:user_fields) do
+        "starredProjects { nodes {#{all_graphql_fields_for('Project', max_depth: 1,
+          excluded: ['productAnalyticsState'])} } }"
+      end
+
+      it 'avoids N+1 queries', :use_sql_query_cache, :clean_gitlab_redis_cache do
+        post_graphql(query, current_user: current_user)
+
+        control = ActiveRecord::QueryRecorder.new(skip_cached: false) do
+          post_graphql(query, current_user: current_user)
+        end
+
+        project_d = create(:project, :public, name: 'ProjectD', path: 'Project-D', star_count: 30)
+        project_d.add_reporter(user)
+        user.toggle_star(project_d)
+
+        # There is an N+1 query for max_member_access_for_user_ids
+        # There is an N+1 query for duo_features_enabled cascading setting
+        # https://gitlab.com/gitlab-org/gitlab/-/issues/442164
+        expect do
+          post_graphql(query, current_user: current_user)
+        end.not_to exceed_all_query_limit(control).with_threshold(7)
+      end
+    end
   end
 
   context 'the current user is a member of a private project the user starred' do
diff --git a/spec/services/audit_event_service_spec.rb b/spec/services/audit_event_service_spec.rb
index b68b62c8131..a49829317c7 100644
--- a/spec/services/audit_event_service_spec.rb
+++ b/spec/services/audit_event_service_spec.rb
@@ -11,17 +11,39 @@ RSpec.describe AuditEventService, :with_license, feature_category: :audit_events
   let(:logger) { instance_double(Gitlab::AuditJsonLogger) }
 
   describe '#initialize' do
-    before do
-      allow(Gitlab::AppLogger).to receive(:info).and_call_original
+    context 'when scope is valid' do
+      where(:entity_type) do
+        [
+          [:group],
+          [:project],
+          [:user]
+        ]
+      end
+
+      with_them do
+        let(:entity) do
+          case entity_type
+          when :group then create(:group)
+          when :project then create(:project)
+          when :user then create(:user)
+          end
+        end
+
+        it 'initializes without error' do
+          expect { described_class.new(user, entity) }.not_to raise_error
+        end
+      end
     end
 
-    it 'logs initialization message' do
-      expect(Gitlab::AppLogger).to receive(:info).with(
-        message: "AuditEventService initialized",
-        scope_class: "Project"
-      )
+    context 'with invalid scope' do
+      let(:entity) { create(:user_namespace) }
 
-      described_class.new(user, project, { action: :destroy })
+      it 'raises ArgumentError' do
+        expect { described_class.new(user, entity) }.to raise_error(
+          ArgumentError,
+          "Invalid scope class: Namespaces::UserNamespace"
+        )
+      end
     end
   end
 
diff --git a/spec/services/audit_events/build_service_spec.rb b/spec/services/audit_events/build_service_spec.rb
index d5a3d1bbaf7..1dfbca823f4 100644
--- a/spec/services/audit_events/build_service_spec.rb
+++ b/spec/services/audit_events/build_service_spec.rb
@@ -132,12 +132,6 @@ RSpec.describe AuditEvents::BuildService, feature_category: :audit_events do
         it { expect { service }.to raise_error(described_class::MissingAttributeError, "author") }
       end
 
-      context 'when scope is missing' do
-        let(:scope) { nil }
-
-        it { expect { service }.to raise_error(described_class::MissingAttributeError, "scope") }
-      end
-
       context 'when target is missing' do
         let(:target) { nil }
 
@@ -150,5 +144,46 @@ RSpec.describe AuditEvents::BuildService, feature_category: :audit_events do
         it { expect { service }.to raise_error(described_class::MissingAttributeError, "message") }
       end
     end
+
+    context 'when scope is valid' do
+      where(:scope_type) do
+        [
+          [:group],
+          [:project],
+          [:user]
+        ]
+      end
+      with_them do
+        let(:scope) do
+          case scope_type
+          when :group then create(:group)
+          when :project then create(:project)
+          when :user then create(:user)
+          end
+        end
+
+        it 'does not raise error' do
+          expect { service.execute }.not_to raise_error
+        end
+      end
+    end
+
+    context 'when scope is invalid' do
+      context 'when user namespace is passed as scope' do
+        let(:scope) { create(:user_namespace) }
+
+        it 'raises error' do
+          expect { service.execute }.to raise_error(ArgumentError, "Invalid scope class: Namespaces::UserNamespace")
+        end
+      end
+
+      context 'when scope is nil' do
+        let(:scope) { nil }
+
+        it 'raises error' do
+          expect { service.execute }.to raise_error(ArgumentError, "Invalid scope class: NilClass")
+        end
+      end
+    end
   end
 end
diff --git a/spec/services/ci/runners/update_project_runners_owner_service_spec.rb b/spec/services/ci/runners/update_project_runners_owner_service_spec.rb
index 94adc150208..6dfd98cf850 100644
--- a/spec/services/ci/runners/update_project_runners_owner_service_spec.rb
+++ b/spec/services/ci/runners/update_project_runners_owner_service_spec.rb
@@ -69,6 +69,6 @@ RSpec.describe ::Ci::Runners::UpdateProjectRunnersOwnerService, '#execute', feat
   private
 
   def tagging_sharding_key_id_for_runner(runner)
-    runner.tag_links.pluck(:sharding_key_id).uniq.sole
+    runner.taggings.pluck(:sharding_key_id).uniq.sole
   end
 end
diff --git a/spec/services/quick_actions/interpret_service_spec.rb b/spec/services/quick_actions/interpret_service_spec.rb
index c918b8df96d..ac32da6cf9a 100644
--- a/spec/services/quick_actions/interpret_service_spec.rb
+++ b/spec/services/quick_actions/interpret_service_spec.rb
@@ -33,6 +33,8 @@ RSpec.describe QuickActions::InterpretService, feature_category: :text_editors d
     project.add_developer(current_user)
   end
 
+  before_all { Users::Internal.support_bot_id }
+
   describe '#execute' do
     let_it_be(:work_item) { create(:work_item, :task, project: project) }
     let(:merge_request) { create(:merge_request, source_project: project) }
@@ -1932,6 +1934,28 @@ RSpec.describe QuickActions::InterpretService, feature_category: :text_editors d
         let(:issuable) { issue }
       end
 
+      context "when a work item type issue is passed" do
+        let(:content) { "/copy_metadata #{source_issuable.to_reference(project)}" }
+        let(:issuable) { create(:work_item, project: project) }
+
+        it_behaves_like 'copy_metadata command' do
+          let(:source_issuable) do
+            create(:work_item, project: project, milestone: milestone).tap do |wi|
+              wi.labels << [todo_label, inreview_label]
+            end
+          end
+        end
+
+        it_behaves_like 'failed command' do
+          let(:other_project) { build(:project, :public) }
+          let(:source_issuable) do
+            create(:work_item, project: other_project).tap do |wi|
+              wi.labels << [todo_label, inreview_label]
+            end
+          end
+        end
+      end
+
       context 'when the parent issuable has a milestone' do
         it_behaves_like 'copy_metadata command' do
           let(:source_issuable) { create(:labeled_issue, project: project, labels: [todo_label, inreview_label], milestone: milestone) }
@@ -2834,7 +2858,7 @@ RSpec.describe QuickActions::InterpretService, feature_category: :text_editors d
           expect(message).to eq(s_('ServiceDesk|Converted issue to Service Desk ticket.'))
           expect(issuable).to have_attributes(
             confidential: expected_confidentiality,
-            author_id: Users::Internal.support_bot.id,
+            author_id: Users::Internal.support_bot_id,
             service_desk_reply_to: 'user@example.com'
           )
         end
@@ -2910,7 +2934,7 @@ RSpec.describe QuickActions::InterpretService, feature_category: :text_editors d
       context 'when issue is Service Desk issue' do
         before do
           issue.update!(
-            author: Users::Internal.support_bot,
+            author_id: Users::Internal.support_bot_id,
             service_desk_reply_to: 'user@example.com'
           )
         end
@@ -3403,7 +3427,7 @@ RSpec.describe QuickActions::InterpretService, feature_category: :text_editors d
           _, explanations = service.explain(content, merge_request)
 
           expect(explanations)
-            .to contain_exactly _("Problem with copy_metadata command: Failed to find issue or merge request.")
+            .to contain_exactly _("Problem with copy_metadata command: Failed to find work item or merge request.")
         end
       end
     end
diff --git a/spec/support/rspec_order_todo.yml b/spec/support/rspec_order_todo.yml
index f16976682b7..3a9ab2e719a 100644
--- a/spec/support/rspec_order_todo.yml
+++ b/spec/support/rspec_order_todo.yml
@@ -686,7 +686,6 @@
 - './ee/spec/helpers/ee/sorting_helper_spec.rb'
 - './ee/spec/helpers/ee/subscribable_banner_helper_spec.rb'
 - './ee/spec/helpers/ee/system_note_helper_spec.rb'
-- './ee/spec/helpers/ee/todos_helper_spec.rb'
 - './ee/spec/helpers/ee/users/callouts_helper_spec.rb'
 - './ee/spec/helpers/ee/wiki_helper_spec.rb'
 - './ee/spec/helpers/epics_helper_spec.rb'
@@ -3886,7 +3885,6 @@
 - './spec/helpers/timeboxes_helper_spec.rb'
 - './spec/helpers/time_helper_spec.rb'
 - './spec/helpers/time_zone_helper_spec.rb'
-- './spec/helpers/todos_helper_spec.rb'
 - './spec/helpers/tracking_helper_spec.rb'
 - './spec/helpers/tree_helper_spec.rb'
 - './spec/helpers/users/callouts_helper_spec.rb'
diff --git a/spec/validators/rsa_key_validator_spec.rb b/spec/validators/rsa_key_validator_spec.rb
index b4e74ec5605..4bb6e3bf179 100644
--- a/spec/validators/rsa_key_validator_spec.rb
+++ b/spec/validators/rsa_key_validator_spec.rb
@@ -19,22 +19,41 @@ RSpec.describe RsaKeyValidator do
 
   subject(:validator) { described_class.new(attributes: [:signing_key]) }
 
-  it 'is not valid when invalid RSA key is provided' do
+  it 'is not valid when single invalid RSA key is provided' do
     record = validatable.new('invalid RSA key')
 
     validator.validate(record)
 
     aggregate_failures do
       expect(record).not_to be_valid
-      expect(record.errors[:signing_key]).to include('is not a valid RSA key')
+      expect(record.errors[:signing_key]).to include('contains invalid RSA keys')
     end
   end
 
-  it 'is valid when valid RSA key is provided' do
+  it 'is not valid when list containing invalid RSA key is provided' do
+    record = validatable.new([OpenSSL::PKey::RSA.new(1024).to_pem, 'invalid RSA key'])
+
+    validator.validate(record)
+
+    aggregate_failures do
+      expect(record).not_to be_valid
+      expect(record.errors[:signing_key]).to include('contains invalid RSA keys')
+    end
+  end
+
+  it 'is valid when single valid RSA key is provided' do
     record = validatable.new(OpenSSL::PKey::RSA.new(1024).to_pem)
 
     validator.validate(record)
 
     expect(record).to be_valid
   end
+
+  it 'is valid when multiple valid RSA keys are provided' do
+    record = validatable.new([OpenSSL::PKey::RSA.new(1024).to_pem])
+
+    validator.validate(record)
+
+    expect(record).to be_valid
+  end
 end