diff --git a/.gitlab/ci/artifact-collector/as-if-foss.gitlab-ci.yml b/.gitlab/ci/artifact-collector/as-if-foss.gitlab-ci.yml index a80b37f7e81..ebea59cc5a9 100644 --- a/.gitlab/ci/artifact-collector/as-if-foss.gitlab-ci.yml +++ b/.gitlab/ci/artifact-collector/as-if-foss.gitlab-ci.yml @@ -16,9 +16,9 @@ rspec:artifact-collector as-if-foss: # optional: true - project: "${CI_PROJECT_NAMESPACE}/gitlab-foss" ref: as-if-foss/${CI_COMMIT_REF_NAME} - job: rspec:artifact-collector system + job: rspec:artifact-collector part-a # optional: true - project: "${CI_PROJECT_NAMESPACE}/gitlab-foss" ref: as-if-foss/${CI_COMMIT_REF_NAME} - job: rspec:artifact-collector remainder + job: rspec:artifact-collector part-b # optional: true diff --git a/.gitlab/ci/rails.gitlab-ci.yml b/.gitlab/ci/rails.gitlab-ci.yml index 0e2993bffcf..4b13741f7d0 100644 --- a/.gitlab/ci/rails.gitlab-ci.yml +++ b/.gitlab/ci/rails.gitlab-ci.yml @@ -436,29 +436,29 @@ rspec:artifact-collector unit: - .artifact-collector - .rails:rules:artifact-collector-unit needs: - - job: rspec unit pg14 # 32 jobs + - job: rspec unit pg14 # 44 jobs optional: true - job: rspec unit clickhouse # 1 job optional: true -rspec:artifact-collector system: +rspec:artifact-collector part-a: extends: - .artifact-collector - - .rails:rules:artifact-collector-system + - .rails:rules:artifact-collector-part-a needs: - job: rspec system pg14 # 32 jobs optional: true + - job: rspec background_migration pg14 # 10 jobs + optional: true -rspec:artifact-collector remainder: +rspec:artifact-collector part-b: extends: - .artifact-collector - - .rails:rules:artifact-collector-remainder + - .rails:rules:artifact-collector-part-b needs: - - job: rspec integration pg14 # 16 jobs + - job: rspec integration pg14 # 20 jobs optional: true - - job: rspec migration pg14 # 15 jobs - optional: true - - job: rspec background_migration pg14 # 5 jobs + - job: rspec migration pg14 # 26 jobs optional: true rspec:artifact-collector unit single-redis: @@ -466,7 +466,7 @@ rspec:artifact-collector unit single-redis: - .artifact-collector - .rails:rules:single-redis needs: - - job: rspec unit pg14 single-redis # 32 jobs + - job: rspec unit pg14 single-redis # 44 jobs optional: true rspec:artifact-collector system single-redis: @@ -482,26 +482,32 @@ rspec:artifact-collector remainder single-redis: - .artifact-collector - .rails:rules:single-redis needs: - - job: rspec integration pg14 single-redis # 16 jobs + - job: rspec integration pg14 single-redis # 20 jobs optional: true -rspec:artifact-collector ee single-redis: +rspec:artifact-collector ee unit single-redis: extends: - .artifact-collector - .rails:rules:single-redis needs: - - job: rspec-ee unit pg14 single-redis # 28 jobs + - job: rspec-ee unit pg14 single-redis # 39 jobs optional: true - - job: rspec-ee integration pg14 single-redis # 7 jobs + +rspec:artifact-collector ee remainder single-redis: + extends: + - .artifact-collector + - .rails:rules:single-redis + needs: + - job: rspec-ee integration pg14 single-redis # 9 jobs optional: true - - job: rspec-ee system pg14 single-redis # 14 jobs + - job: rspec-ee system pg14 single-redis # 16 jobs optional: true rspec:artifact-collector ee unit: extends: - .artifact-collector needs: - - job: rspec-ee unit pg14 # 28 jobs + - job: rspec-ee unit pg14 # 39 jobs optional: true rules: - !reference ['.rails:rules:ee-only-unit', rules] @@ -512,13 +518,13 @@ rspec:artifact-collector ee remainder: needs: - job: rspec-ee migration pg14 # 2 jobs optional: true - - job: rspec-ee background_migration pg14 # 2 jobs + - job: rspec-ee background_migration pg14 # 3 jobs optional: true - job: rspec-ee unit clickhouse # 1 job optional: true - - job: rspec-ee integration pg14 # 7 jobs + - job: rspec-ee integration pg14 # 9 jobs optional: true - - job: rspec-ee system pg14 # 14 jobs + - job: rspec-ee system pg14 # 16 jobs optional: true rules: - !reference ['.rails:rules:ee-only-migration', rules] @@ -538,9 +544,9 @@ rspec:coverage: # FOSS/EE jobs - job: rspec:artifact-collector unit optional: true - - job: rspec:artifact-collector system + - job: rspec:artifact-collector part-a optional: true - - job: rspec:artifact-collector remainder + - job: rspec:artifact-collector part-b optional: true - job: rspec:artifact-collector unit single-redis optional: true @@ -552,7 +558,9 @@ rspec:coverage: - job: rspec:artifact-collector as-if-foss optional: true # EE jobs - - job: rspec:artifact-collector ee single-redis + - job: rspec:artifact-collector ee unit single-redis + optional: true + - job: rspec:artifact-collector ee remainder single-redis optional: true - job: rspec:artifact-collector ee unit optional: true diff --git a/.gitlab/ci/rails/shared.gitlab-ci.yml b/.gitlab/ci/rails/shared.gitlab-ci.yml index 941e974484b..9453bdd9b8d 100644 --- a/.gitlab/ci/rails/shared.gitlab-ci.yml +++ b/.gitlab/ci/rails/shared.gitlab-ci.yml @@ -339,33 +339,51 @@ include: # rspec job parallel configs # Adjusting these parallel job counts has an impact on the # rspec:artifact-collector jobs in .gitlab/ci/rails.gitlab-ci.yml -# Please double-check and adjust accordingly +# Please double-check and adjust accordingly. At the moment, +# each job can only have needs from up to 50 jobs. +# +# To calculate the number of jobs we need for each RSpec, follow this formula: +# +# parallel_job_count = ceil(current_job_count * (average_duration / target_duration)) +# +# At the moment, we set the target to 30 minutes +# +# https://app.snowflake.com/ys68254/gitlab/w2woEkSvsfYa/chart .rspec-migration-parallel: - parallel: 15 + parallel: 26 +# https://app.snowflake.com/ys68254/gitlab/wpUmrAF0RJL/chart .rspec-background-migration-parallel: - parallel: 5 + parallel: 10 +# https://app.snowflake.com/ys68254/gitlab/w4cxPH8ySQlP/chart .rspec-ee-migration-parallel: parallel: 2 +# https://app.snowflake.com/ys68254/gitlab/w20QT8KSVZAi/chart .rspec-ee-background-migration-parallel: - parallel: 2 + parallel: 3 +# https://app.snowflake.com/ys68254/gitlab/w1tkkoZAXSsZ/chart .rspec-unit-parallel: - parallel: 32 + parallel: 44 +# https://app.snowflake.com/ys68254/gitlab/w2GlD4YqHSbO/chart .rspec-ee-unit-parallel: - parallel: 28 + parallel: 39 +# https://app.snowflake.com/ys68254/gitlab/w56UXaCA4xkG/chart .rspec-integration-parallel: - parallel: 16 + parallel: 20 +# https://app.snowflake.com/ys68254/gitlab/w4tXhUkSsFj/chart .rspec-ee-integration-parallel: - parallel: 7 + parallel: 9 +# https://app.snowflake.com/ys68254/gitlab/w3Y3rkdbS25v/chart .rspec-system-parallel: parallel: 32 +# https://app.snowflake.com/ys68254/gitlab/w4zGboX1YRrY/chart .rspec-ee-system-parallel: - parallel: 14 + parallel: 16 diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml index e775ccfd9d1..5d3b4a6e022 100644 --- a/.gitlab/ci/rules.gitlab-ci.yml +++ b/.gitlab/ci/rules.gitlab-ci.yml @@ -1767,6 +1767,7 @@ - <<: *if-dot-com-gitlab-org-schedule variables: KNAPSACK_GENERATE_REPORT: "true" + PROCESS_TEST_RESULTS: "true" QA_SAVE_TEST_METRICS: "true" QA_EXPORT_TEST_METRICS: "false" allow_failure: true @@ -2323,17 +2324,17 @@ - if: '$START_AS_IF_FOSS == "true"' - !reference [".rails:rules:ee-and-foss-unit", rules] -.rails:rules:artifact-collector-system: +.rails:rules:artifact-collector-part-a: rules: - if: '$START_AS_IF_FOSS == "true"' - !reference [".rails:rules:ee-and-foss-system", rules] + - !reference ['.rails:rules:ee-and-foss-background-migration', rules] -.rails:rules:artifact-collector-remainder: +.rails:rules:artifact-collector-part-b: rules: - if: '$START_AS_IF_FOSS == "true"' - !reference ['.rails:rules:ee-and-foss-integration', rules] - !reference ['.rails:rules:ee-and-foss-migration', rules] - - !reference ['.rails:rules:ee-and-foss-background-migration', rules] .rails:rules:detect-tests: rules: diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION index 3e9dd8c9bb8..20bdc79a14a 100644 --- a/GITALY_SERVER_VERSION +++ b/GITALY_SERVER_VERSION @@ -1 +1 @@ -e0d259fbab04ca8f84b6ca1f39b4f1fa52361c7d +3de800d8941899f2495baa33ea20fb58ff93dd7d diff --git a/data/deprecations/15-3-omniauth-crowd.yml b/data/deprecations/15-3-omniauth-crowd.yml deleted file mode 100644 index 2230bbd17ed..00000000000 --- a/data/deprecations/15-3-omniauth-crowd.yml +++ /dev/null @@ -1,15 +0,0 @@ -# -# REQUIRED FIELDS -# -- title: "Atlassian Crowd OmniAuth provider" # (required) The name of the feature to be deprecated - announcement_milestone: "15.3" # (required) The milestone when this feature was first announced as deprecated. - removal_milestone: "18.0" # (required) The milestone when this feature is planned to be removed - breaking_change: true # (required) If this deprecation is a breaking change, set this value to true - reporter: hsutor # (required) GitLab username of the person reporting the deprecation - stage: Manage # (required) String value of the stage that the feature was created in. e.g., Growth - issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/369117 # (required) Link to the deprecation issue in GitLab - body: | # (required) Do not modify this line, instead modify the lines below. - The `omniauth_crowd` gem that provides GitLab with the Atlassian Crowd OmniAuth provider will be removed in our - next major release, GitLab 18.0. This gem sees very little use and its - [lack of compatibility](https://github.com/robdimarco/omniauth_crowd/issues/37) with OmniAuth 2.0 is - [blocking our upgrade](https://gitlab.com/gitlab-org/gitlab/-/issues/30073). diff --git a/db/docs/batched_background_migrations/backfill_upstream_pipeline_partition_id_on_p_ci_builds.yml b/db/docs/batched_background_migrations/backfill_upstream_pipeline_partition_id_on_p_ci_builds.yml new file mode 100644 index 00000000000..d6567c319eb --- /dev/null +++ b/db/docs/batched_background_migrations/backfill_upstream_pipeline_partition_id_on_p_ci_builds.yml @@ -0,0 +1,10 @@ +--- +migration_job_name: BackfillUpstreamPipelinePartitionIdOnPCiBuilds +description: # Please capture what BackfillUpstreamPipelinePartitionIdOnPCiBuilds does +feature_category: continuous_integration +introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/158622 +milestone: '17.3' +queued_migration_version: 20240708105034 +# Replace with the approximate date you think it's best to ensure the completion of this BBM. +finalize_after: '2024-08-22' +finalized_by: # version of the migration that finalized this BBM diff --git a/db/migrate/20240418032555_add_code_suggestions_api_rate_limit_to_application_settings.rb b/db/migrate/20240418032555_add_code_suggestions_api_rate_limit_to_application_settings.rb index fd250ce549b..a31a4c49987 100644 --- a/db/migrate/20240418032555_add_code_suggestions_api_rate_limit_to_application_settings.rb +++ b/db/migrate/20240418032555_add_code_suggestions_api_rate_limit_to_application_settings.rb @@ -1,7 +1,7 @@ # frozen_string_literal: true class AddCodeSuggestionsApiRateLimitToApplicationSettings < Gitlab::Database::Migration[2.2] - milestone '17.0' + milestone '17.2' def change add_column :application_settings, :code_suggestions_api_rate_limit, :integer, default: 60, null: false diff --git a/db/migrate/20240708104110_add_upstream_pipeline_partition_id_to_p_ci_builds.rb b/db/migrate/20240708104110_add_upstream_pipeline_partition_id_to_p_ci_builds.rb new file mode 100644 index 00000000000..23b9ce0612c --- /dev/null +++ b/db/migrate/20240708104110_add_upstream_pipeline_partition_id_to_p_ci_builds.rb @@ -0,0 +1,11 @@ +# frozen_string_literal: true + +class AddUpstreamPipelinePartitionIdToPCiBuilds < Gitlab::Database::Migration[2.2] + milestone '17.3' + + # rubocop:disable Migration/AddColumnsToWideTables -- composable FK + def change + add_column :p_ci_builds, :upstream_pipeline_partition_id, :bigint + end + # rubocop:enable Migration/AddColumnsToWideTables +end diff --git a/db/post_migrate/20240708105034_queue_backfill_upstream_pipeline_partition_id_on_p_ci_builds.rb b/db/post_migrate/20240708105034_queue_backfill_upstream_pipeline_partition_id_on_p_ci_builds.rb new file mode 100644 index 00000000000..3ee587f10a4 --- /dev/null +++ b/db/post_migrate/20240708105034_queue_backfill_upstream_pipeline_partition_id_on_p_ci_builds.rb @@ -0,0 +1,27 @@ +# frozen_string_literal: true + +class QueueBackfillUpstreamPipelinePartitionIdOnPCiBuilds < Gitlab::Database::Migration[2.2] + milestone '17.3' + restrict_gitlab_migration gitlab_schema: :gitlab_ci + + MIGRATION = "BackfillUpstreamPipelinePartitionIdOnPCiBuilds" + DELAY_INTERVAL = 2.minutes + BATCH_SIZE = 1_000 + SUB_BATCH_SIZE = 100 + + def up + queue_batched_background_migration( + MIGRATION, + :p_ci_builds, + :upstream_pipeline_id, + batch_class_name: 'LooseIndexScanBatchingStrategy', + job_interval: DELAY_INTERVAL, + batch_size: BATCH_SIZE, + sub_batch_size: SUB_BATCH_SIZE + ) + end + + def down + delete_batched_background_migration(MIGRATION, :p_ci_builds, :upstream_pipeline_id, []) + end +end diff --git a/db/schema_migrations/20240708104110 b/db/schema_migrations/20240708104110 new file mode 100644 index 00000000000..23ecf8957e2 --- /dev/null +++ b/db/schema_migrations/20240708104110 @@ -0,0 +1 @@ +f44cf2abd285e9ac420c926b1f4daeeddcbd4bb048d0d1c75329d11c0434b2f7 \ No newline at end of file diff --git a/db/schema_migrations/20240708105034 b/db/schema_migrations/20240708105034 new file mode 100644 index 00000000000..60a05e1c155 --- /dev/null +++ b/db/schema_migrations/20240708105034 @@ -0,0 +1 @@ +cf6cbca050e00abce963c37fdaa28e4732201ceb5b18f6becb8ca592a1b421cd \ No newline at end of file diff --git a/db/structure.sql b/db/structure.sql index b49ea094f99..6da2d0d2bba 100644 --- a/db/structure.sql +++ b/db/structure.sql @@ -2197,6 +2197,7 @@ CREATE TABLE p_ci_builds ( upstream_pipeline_id bigint, user_id bigint, execution_config_id bigint, + upstream_pipeline_partition_id bigint, CONSTRAINT check_1e2fbd1b39 CHECK ((lock_version IS NOT NULL)) ) PARTITION BY LIST (partition_id); @@ -7514,6 +7515,7 @@ CREATE TABLE ci_builds ( upstream_pipeline_id bigint, user_id bigint, execution_config_id bigint, + upstream_pipeline_partition_id bigint, CONSTRAINT check_1e2fbd1b39 CHECK ((lock_version IS NOT NULL)) ); diff --git a/doc/security/token_overview.md b/doc/security/token_overview.md index 2a8bf31407e..bef02cc2a12 100644 --- a/doc/security/token_overview.md +++ b/doc/security/token_overview.md @@ -298,6 +298,47 @@ result in `403 Forbidden` responses from GitLab.com. For more information on authentication request limits, see [Git and container registry failed authentication ban](../user/gitlab_com/index.md#git-and-container-registry-failed-authentication-ban). +### Identify expired access tokens from logs + +> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/464652) in GitLab 17.2. + +Prerequisites: + +You must: + +- Be an administrator. +- Have access to the [`api_json.log`](../administration/logs/index.md#api_jsonlog) file. + +To identify which `401 Unauthorized` requests are failing due to +expired access tokens, use the following fields in the `api_json.log` file: + +|Field name|Description| +|----------|-----------| +|`meta.auth_fail_reason`|The reason the request was rejected. Possible values: `token_expired`, `token_revoked`, `insufficient_scope`, and `impersonation_disabled`.| +|`meta.auth_fail_token_id`|A string describing the type and ID of the attempted token.| + +When a user attempts to use an expired token, the `meta.auth_fail_reason` +is `token_expired`. The following shows an excerpt from a log +entry: + +```json +{ + "status": 401, + "method": "GET", + "path": "/api/v4/user", + ... + "meta.auth_fail_reason": "token_expired", + "meta.auth_fail_token_id": "PersonalAccessToken/12", +} +``` + +`meta.auth_fail_token_id` indicates that an access token of ID 12 was used. + +To find more information about this token, use the [personal access token API](../api/personal_access_tokens.md#get-single-personal-access-token). +You can also use the API to [rotate the token](../api/personal_access_tokens.md#rotate-a-personal-access-token). + +### Replace expired access tokens + To replace the token: 1. Check where this token may have been used previously, and remove it from any diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md index 6c5856ded08..2bcf8222da9 100644 --- a/doc/update/deprecations.md +++ b/doc/update/deprecations.md @@ -101,23 +101,6 @@ automatically from GitLab 16.0 onwards.