diff --git a/.gitlab/CODEOWNERS b/.gitlab/CODEOWNERS
index 9b2c8340af8..cc138678fc9 100644
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@@ -1469,11 +1469,11 @@ lib/gitlab/checks/**
 # opportunity to refine specific rules defined in this section.
 # Note that frontend, CI templates and other concerns should be kept within
 # the same section.
-/app/**/ci/*.rb
-/ee/app/**/ci/*.rb
+/app/**/ci/**/*.rb
+/ee/app/**/ci/**/*.rb
 /lib/**/ci/
 /ee/lib/**/ci/
-/ee/app/**/merge_trains/*.rb
+/ee/app/**/merge_trains/**/*.rb
 /app/controllers/admin/jobs_controller.rb
 /app/controllers/admin/runner_projects_controller.rb
 /app/controllers/admin/runners_controller.rb
diff --git a/.rubocop_todo/database/avoid_using_pluck_without_limit.yml b/.rubocop_todo/database/avoid_using_pluck_without_limit.yml
index 2e2586b5d0a..871037f7efd 100644
--- a/.rubocop_todo/database/avoid_using_pluck_without_limit.yml
+++ b/.rubocop_todo/database/avoid_using_pluck_without_limit.yml
@@ -146,7 +146,6 @@ Database/AvoidUsingPluckWithoutLimit:
     - 'ee/app/services/security/security_orchestration_policies/process_scan_result_policy_service.rb'
     - 'ee/app/services/security/security_orchestration_policies/protected_branches_deletion_check_service.rb'
     - 'ee/app/services/security/security_orchestration_policies/protected_branches_push_service.rb'
-    - 'ee/app/services/security/security_orchestration_policies/rule_schedule_service.rb'
     - 'ee/app/services/security/security_orchestration_policies/validate_policy_service.rb'
     - 'ee/app/services/vulnerabilities/bulk_dismiss_service.rb'
     - 'ee/lib/ee/gitlab/background_migration/migrate_approver_to_approval_rules.rb'
diff --git a/.rubocop_todo/gitlab/feature_flag_without_actor.yml b/.rubocop_todo/gitlab/feature_flag_without_actor.yml
index 4b7b05718ed..d7da9540a11 100644
--- a/.rubocop_todo/gitlab/feature_flag_without_actor.yml
+++ b/.rubocop_todo/gitlab/feature_flag_without_actor.yml
@@ -95,7 +95,6 @@ Gitlab/FeatureFlagWithoutActor:
     - 'ee/app/graphql/resolvers/ai/user_chat_access_resolver.rb'
     - 'ee/app/graphql/types/epic_type.rb'
     - 'ee/app/helpers/billing_plans_helper.rb'
-    - 'ee/app/helpers/gitlab_subscriptions/code_suggestions_helper.rb'
     - 'ee/app/models/concerns/geo/replicable_model.rb'
     - 'ee/app/models/ee/application_setting.rb'
     - 'ee/app/models/integrations/git_guardian.rb'
@@ -122,7 +121,6 @@ Gitlab/FeatureFlagWithoutActor:
     - 'ee/app/workers/search/zoekt/scheduling_worker.rb'
     - 'ee/app/workers/zoekt/indexer_worker.rb'
     - 'ee/lib/api/code_suggestions.rb'
-    - 'ee/lib/api/epics.rb'
     - 'ee/lib/api/internal/search/zoekt.rb'
     - 'ee/lib/api/internal/suggested_reviewers.rb'
     - 'ee/lib/ee/api/entities/application_setting.rb'
diff --git a/.rubocop_todo/gitlab/strong_memoize_attr.yml b/.rubocop_todo/gitlab/strong_memoize_attr.yml
index d5477a47faf..608b8407084 100644
--- a/.rubocop_todo/gitlab/strong_memoize_attr.yml
+++ b/.rubocop_todo/gitlab/strong_memoize_attr.yml
@@ -25,7 +25,6 @@ Gitlab/StrongMemoizeAttr:
     - 'app/finders/ci/pipelines_for_merge_request_finder.rb'
     - 'app/finders/cluster_ancestors_finder.rb'
     - 'app/finders/concerns/finder_with_group_hierarchy.rb'
-    - 'app/finders/crm/organizations_finder.rb'
     - 'app/finders/groups/accepting_group_transfers_finder.rb'
     - 'app/finders/issuable_finder.rb'
     - 'app/finders/issuable_finder/params.rb'
diff --git a/.rubocop_todo/layout/array_alignment.yml b/.rubocop_todo/layout/array_alignment.yml
index 5fa3151f5d4..7296b30d34a 100644
--- a/.rubocop_todo/layout/array_alignment.yml
+++ b/.rubocop_todo/layout/array_alignment.yml
@@ -123,7 +123,6 @@ Layout/ArrayAlignment:
     - 'spec/graphql/resolvers/project_issues_resolver_spec.rb'
     - 'spec/graphql/types/blob_viewer_type_spec.rb'
     - 'spec/graphql/types/boards/board_issue_input_type_spec.rb'
-    - 'spec/graphql/types/container_repository_type_spec.rb'
     - 'spec/graphql/types/issuable_sort_enum_spec.rb'
     - 'spec/graphql/types/issue_type_spec.rb'
     - 'spec/graphql/types/project_type_spec.rb'
diff --git a/.rubocop_todo/layout/class_structure.yml b/.rubocop_todo/layout/class_structure.yml
index d70cef4d165..5966d54aaee 100644
--- a/.rubocop_todo/layout/class_structure.yml
+++ b/.rubocop_todo/layout/class_structure.yml
@@ -418,7 +418,6 @@ Layout/ClassStructure:
     - 'lib/gitlab/query_limiting/transaction.rb'
     - 'lib/gitlab/repository_cache.rb'
     - 'lib/gitlab/sidekiq_daemon/monitor.rb'
-    - 'lib/gitlab/sidekiq_middleware/duplicate_jobs/duplicate_job.rb'
     - 'lib/gitlab/slash_commands/base_command.rb'
     - 'lib/gitlab/sql/set_operator.rb'
     - 'lib/gitlab/suggestions/commit_message.rb'
diff --git a/.rubocop_todo/layout/line_break_after_final_mixin.yml b/.rubocop_todo/layout/line_break_after_final_mixin.yml
index e6b1ba128fb..32a79266c93 100644
--- a/.rubocop_todo/layout/line_break_after_final_mixin.yml
+++ b/.rubocop_todo/layout/line_break_after_final_mixin.yml
@@ -6,7 +6,6 @@ Layout/LineBreakAfterFinalMixin:
     - 'app/graphql/resolvers/projects/deploy_key_resolver.rb'
     - 'app/models/alert_management/metric_image.rb'
     - 'app/models/integrations/pushover.rb'
-    - 'app/models/integrations/telegram.rb'
     - 'app/models/protected_branch/merge_access_level.rb'
     - 'app/models/protected_branch/push_access_level.rb'
     - 'app/policies/project_member_policy.rb'
diff --git a/.rubocop_todo/layout/line_continuation_spacing.yml b/.rubocop_todo/layout/line_continuation_spacing.yml
index 45a70b5e182..38d86505bfa 100644
--- a/.rubocop_todo/layout/line_continuation_spacing.yml
+++ b/.rubocop_todo/layout/line_continuation_spacing.yml
@@ -26,7 +26,6 @@ Layout/LineContinuationSpacing:
     - 'ee/app/models/ee/epic.rb'
     - 'ee/app/models/ee/group_group_link.rb'
     - 'ee/app/models/ee/project_group_link.rb'
-    - 'ee/app/models/ee/vulnerability.rb'
     - 'ee/app/models/incident_management/oncall_shift.rb'
     - 'ee/app/services/audit_events/protected_branch_audit_event_service.rb'
     - 'ee/app/services/boards/epic_lists/destroy_service.rb'
diff --git a/.rubocop_todo/layout/line_end_string_concatenation_indentation.yml b/.rubocop_todo/layout/line_end_string_concatenation_indentation.yml
index 2174f6c93e3..316ead18b49 100644
--- a/.rubocop_todo/layout/line_end_string_concatenation_indentation.yml
+++ b/.rubocop_todo/layout/line_end_string_concatenation_indentation.yml
@@ -119,7 +119,6 @@ Layout/LineEndStringConcatenationIndentation:
     - 'ee/app/graphql/types/dast/site_profile_auth_type.rb'
     - 'ee/app/graphql/types/dast_scanner_profile_type.rb'
     - 'ee/app/graphql/types/dast_site_profile_type.rb'
-    - 'ee/app/graphql/types/epic_type.rb'
     - 'ee/app/graphql/types/geo/geo_node_type.rb'
     - 'ee/app/graphql/types/google_cloud/artifact_registry/repository_type.rb'
     - 'ee/app/graphql/types/protected_environment_type.rb'
@@ -141,7 +140,6 @@ Layout/LineEndStringConcatenationIndentation:
     - 'ee/app/models/concerns/audit_events/gcp_externally_destinationable.rb'
     - 'ee/app/models/ee/member.rb'
     - 'ee/app/models/ee/merge_request.rb'
-    - 'ee/app/models/ee/vulnerability.rb'
     - 'ee/app/models/incident_management/oncall_shift.rb'
     - 'ee/app/models/integrations/google_cloud_platform/artifact_registry.rb'
     - 'ee/app/models/members/member_role.rb'
diff --git a/.rubocop_todo/layout/line_length.yml b/.rubocop_todo/layout/line_length.yml
index 45fdf5f047e..c0e41337428 100644
--- a/.rubocop_todo/layout/line_length.yml
+++ b/.rubocop_todo/layout/line_length.yml
@@ -176,7 +176,6 @@ Layout/LineLength:
     - 'app/models/merge_requests_closing_issues.rb'
     - 'app/models/milestone.rb'
     - 'app/models/namespace.rb'
-    - 'app/models/namespace/package_setting.rb'
     - 'app/models/namespace_setting.rb'
     - 'app/models/namespaces/traversal/linear.rb'
     - 'app/models/notification_setting.rb'
@@ -501,7 +500,6 @@ Layout/LineLength:
     - 'ee/app/graphql/mutations/audit_events/external_audit_event_destinations/create.rb'
     - 'ee/app/graphql/mutations/boards/scoped_issue_board_arguments.rb'
     - 'ee/app/graphql/mutations/compliance_management/frameworks/destroy.rb'
-    - 'ee/app/graphql/mutations/concerns/mutations/shared_epic_arguments.rb'
     - 'ee/app/graphql/mutations/dast/profiles/update.rb'
     - 'ee/app/graphql/mutations/dast_scanner_profiles/create.rb'
     - 'ee/app/graphql/mutations/dast_scanner_profiles/update.rb'
@@ -748,7 +746,6 @@ Layout/LineLength:
     - 'ee/app/services/ee/resource_access_tokens/create_service.rb'
     - 'ee/app/services/ee/system_note_service.rb'
     - 'ee/app/services/ee/users/update_service.rb'
-    - 'ee/app/services/elastic/indexing_control_service.rb'
     - 'ee/app/services/epics/issue_promote_service.rb'
     - 'ee/app/services/epics/update_service.rb'
     - 'ee/app/services/external_status_checks/create_service.rb'
@@ -2412,7 +2409,6 @@ Layout/LineLength:
     - 'qa/qa/resource/file.rb'
     - 'qa/qa/resource/protected_branch.rb'
     - 'qa/qa/resource/registry_repository.rb'
-    - 'qa/qa/resource/repository/push.rb'
     - 'qa/qa/resource/snippet.rb'
     - 'qa/qa/resource/user_runners.rb'
     - 'qa/qa/resource/wiki/group_page.rb'
@@ -2436,7 +2432,6 @@ Layout/LineLength:
     - 'qa/qa/specs/features/browser_ui/2_plan/issue/comment_issue_spec.rb'
     - 'qa/qa/specs/features/browser_ui/2_plan/issue/custom_issue_template_spec.rb'
     - 'qa/qa/specs/features/browser_ui/2_plan/issue/export_as_csv_spec.rb'
-    - 'qa/qa/specs/features/browser_ui/2_plan/issue/filter_issue_comments_spec.rb'
     - 'qa/qa/specs/features/browser_ui/2_plan/issue/issue_suggestions_spec.rb'
     - 'qa/qa/specs/features/browser_ui/2_plan/issue/real_time_assignee_spec.rb'
     - 'qa/qa/specs/features/browser_ui/2_plan/related_issues/related_issues_spec.rb'
@@ -3550,7 +3545,6 @@ Layout/LineLength:
     - 'spec/models/import_export_upload_spec.rb'
     - 'spec/models/import_failure_spec.rb'
     - 'spec/models/instance_configuration_spec.rb'
-    - 'spec/models/integrations/base_chat_notification_spec.rb'
     - 'spec/models/integrations/base_issue_tracker_spec.rb'
     - 'spec/models/integrations/chat_message/base_message_spec.rb'
     - 'spec/models/integrations/chat_message/deployment_message_spec.rb'
diff --git a/.rubocop_todo/lint/redundant_cop_disable_directive.yml b/.rubocop_todo/lint/redundant_cop_disable_directive.yml
index 1fb50dbba97..bbee0e01aca 100644
--- a/.rubocop_todo/lint/redundant_cop_disable_directive.yml
+++ b/.rubocop_todo/lint/redundant_cop_disable_directive.yml
@@ -1,5 +1,10 @@
 ---
 # Cop supports --autocorrect.
 Lint/RedundantCopDisableDirective:
-  # Temporarily disabled
+  # Offense count: 3
+  # Temporarily disabled due to too many offenses
   Enabled: false
+  Exclude:
+    - 'ee/app/controllers/admin/gitlab_duo/configuration_controller.rb'
+    - 'ee/app/presenters/ee/onboarding/status_presenter.rb'
+    - 'ee/spec/helpers/admin/application_settings_helper_spec.rb'
diff --git a/.rubocop_todo/performance/string_identifier_argument.yml b/.rubocop_todo/performance/string_identifier_argument.yml
index 55873c24cfb..c913b506b2c 100644
--- a/.rubocop_todo/performance/string_identifier_argument.yml
+++ b/.rubocop_todo/performance/string_identifier_argument.yml
@@ -121,10 +121,8 @@ Performance/StringIdentifierArgument:
     - 'lib/sidebars/context.rb'
     - 'qa/qa/page/component/ci_icon.rb'
     - 'qa/qa/page/component/note.rb'
-    - 'qa/qa/resource/base.rb'
     - 'qa/qa/resource/integrations/web_hook/smockerable.rb'
     - 'qa/qa/runtime/address.rb'
-    - 'qa/qa/specs/features/browser_ui/10_govern/login/login_via_oauth_and_oidc_with_gitlab_as_idp_spec.rb'
     - 'qa/qa/specs/features/ee/browser_ui/9_data_stores/group/prevent_forking_outside_group_spec.rb'
     - 'qa/qa/support/matchers/have_matcher.rb'
     - 'scripts/perf/gc/print_gc_stats.rb'
diff --git a/.rubocop_todo/rake/require.yml b/.rubocop_todo/rake/require.yml
index 192184e38cb..6988292d875 100644
--- a/.rubocop_todo/rake/require.yml
+++ b/.rubocop_todo/rake/require.yml
@@ -7,7 +7,6 @@ Rake/Require:
     - 'lib/tasks/contracts/pipelines.rake'
     - 'lib/tasks/gitlab/artifacts/migrate.rake'
     - 'lib/tasks/gitlab/backup.rake'
-    - 'lib/tasks/gitlab/cleanup.rake'
     - 'lib/tasks/gitlab/docs/redirect.rake'
     - 'lib/tasks/gitlab/graphql.rake'
     - 'lib/tasks/gitlab/lfs/migrate.rake'
diff --git a/.rubocop_todo/rspec/any_instance_of.yml b/.rubocop_todo/rspec/any_instance_of.yml
index 3f848069b3a..04eede40f1e 100644
--- a/.rubocop_todo/rspec/any_instance_of.yml
+++ b/.rubocop_todo/rspec/any_instance_of.yml
@@ -22,7 +22,6 @@ RSpec/AnyInstanceOf:
     - 'ee/spec/lib/gitlab/geo/log_cursor/daemon_spec.rb'
     - 'ee/spec/lib/gitlab/legacy_github_import/project_creator_spec.rb'
     - 'ee/spec/models/geo_node_status_spec.rb'
-    - 'ee/spec/models/issue_spec.rb'
     - 'ee/spec/models/merge_request_spec.rb'
     - 'ee/spec/models/project_import_state_spec.rb'
     - 'ee/spec/models/push_rule_spec.rb'
diff --git a/.rubocop_todo/rspec/avoid_conditional_statements.yml b/.rubocop_todo/rspec/avoid_conditional_statements.yml
index 32ce10a6339..f784dc21dab 100644
--- a/.rubocop_todo/rspec/avoid_conditional_statements.yml
+++ b/.rubocop_todo/rspec/avoid_conditional_statements.yml
@@ -10,7 +10,6 @@ RSpec/AvoidConditionalStatements:
     - 'ee/spec/features/epic_boards/epic_boards_spec.rb'
     - 'ee/spec/features/epics/gfm_autocomplete_spec.rb'
     - 'ee/spec/features/group_protected_branches_spec.rb'
-    - 'ee/spec/features/groups/analytics/cycle_analytics/multiple_value_streams_spec.rb'
     - 'ee/spec/features/groups/iterations/user_views_iteration_spec.rb'
     - 'ee/spec/features/incidents/incident_details_spec.rb'
     - 'ee/spec/features/issues/user_sees_empty_state_spec.rb'
@@ -70,4 +69,3 @@ RSpec/AvoidConditionalStatements:
     - 'spec/features/search/user_uses_header_search_field_spec.rb'
     - 'spec/features/usage_stats_consent_spec.rb'
     - 'spec/features/users/login_spec.rb'
-    - 'spec/features/users/overview_spec.rb'
diff --git a/.rubocop_todo/rspec/be_eq.yml b/.rubocop_todo/rspec/be_eq.yml
index ec399141fb5..e43e107a502 100644
--- a/.rubocop_todo/rspec/be_eq.yml
+++ b/.rubocop_todo/rspec/be_eq.yml
@@ -345,8 +345,6 @@ RSpec/BeEq:
     - 'ee/spec/requests/api/graphql/merge_trains/trains_spec.rb'
     - 'ee/spec/requests/api/graphql/mutations/analytics/devops_adoption/enabled_namespaces/disable_spec.rb'
     - 'ee/spec/requests/api/graphql/mutations/audit_events/instance/amazon_s3_configurations/create_spec.rb'
-    - 'ee/spec/requests/api/graphql/mutations/boards/epic_boards/create_spec.rb'
-    - 'ee/spec/requests/api/graphql/mutations/boards/epic_boards/update_spec.rb'
     - 'ee/spec/requests/api/graphql/mutations/ci/namespace_ci_cd_settings_update_spec.rb'
     - 'ee/spec/requests/api/graphql/mutations/compliance_management/standards/refresh_adherence_checks_spec.rb'
     - 'ee/spec/requests/api/graphql/mutations/dast_scanner_profiles/create_spec.rb'
diff --git a/.rubocop_todo/rspec/change_by_zero.yml b/.rubocop_todo/rspec/change_by_zero.yml
index 0929c483dbf..74acf4d504e 100644
--- a/.rubocop_todo/rspec/change_by_zero.yml
+++ b/.rubocop_todo/rspec/change_by_zero.yml
@@ -37,7 +37,6 @@ RSpec/ChangeByZero:
     - 'ee/spec/services/search/zoekt/indexing_task_service_spec.rb'
     - 'ee/spec/services/security/ingestion/tasks/ingest_cvs_security_scanners_spec.rb'
     - 'ee/spec/services/security/orchestration/create_bot_service_spec.rb'
-    - 'ee/spec/services/security/security_orchestration_policies/rule_schedule_service_spec.rb'
     - 'ee/spec/services/software_license_policies/bulk_create_scan_result_policy_service_spec.rb'
     - 'ee/spec/services/vulnerabilities/manually_create_service_spec.rb'
     - 'ee/spec/services/vulnerabilities/security_finding/create_merge_request_service_spec.rb'
diff --git a/.rubocop_todo/rspec/contain_exactly.yml b/.rubocop_todo/rspec/contain_exactly.yml
index df37f8b848f..211870cfbdb 100644
--- a/.rubocop_todo/rspec/contain_exactly.yml
+++ b/.rubocop_todo/rspec/contain_exactly.yml
@@ -84,7 +84,6 @@ RSpec/ContainExactly:
     - 'spec/finders/ci/job_artifacts_finder_spec.rb'
     - 'spec/finders/ci/pipelines_finder_spec.rb'
     - 'spec/finders/merge_requests_finder_spec.rb'
-    - 'spec/finders/organizations/user_organizations_finder_spec.rb'
     - 'spec/finders/personal_access_tokens_finder_spec.rb'
     - 'spec/finders/projects_finder_spec.rb'
     - 'spec/finders/repositories/branch_names_finder_spec.rb'
diff --git a/.rubocop_todo/rspec/context_wording.yml b/.rubocop_todo/rspec/context_wording.yml
index 56d2e2f16e5..3b5c598ba31 100644
--- a/.rubocop_todo/rspec/context_wording.yml
+++ b/.rubocop_todo/rspec/context_wording.yml
@@ -1989,7 +1989,6 @@ RSpec/ContextWording:
     - 'spec/models/identity_spec.rb'
     - 'spec/models/import_export_upload_spec.rb'
     - 'spec/models/import_failure_spec.rb'
-    - 'spec/models/integrations/base_chat_notification_spec.rb'
     - 'spec/models/integrations/chat_message/issue_message_spec.rb'
     - 'spec/models/integrations/chat_message/merge_message_spec.rb'
     - 'spec/models/integrations/chat_message/note_message_spec.rb'
diff --git a/.rubocop_todo/rspec/excessive_docstring_spacing.yml b/.rubocop_todo/rspec/excessive_docstring_spacing.yml
index 3eff1f86de8..e3262c4235f 100644
--- a/.rubocop_todo/rspec/excessive_docstring_spacing.yml
+++ b/.rubocop_todo/rspec/excessive_docstring_spacing.yml
@@ -35,7 +35,6 @@ RSpec/ExcessiveDocstringSpacing:
     - 'ee/spec/services/users/service_accounts/create_service_spec.rb'
     - 'ee/spec/support/shared_examples/features/password_complexity_shared_examples.rb'
     - 'ee/spec/support/shared_examples/models/concerns/protected_ref_access_shared_examples.rb'
-    - 'ee/spec/views/gitlab_subscriptions/trials/duo_enterprise/_lead_form.html.haml_spec.rb.haml_spec.rb'
     - 'ee/spec/views/shared/promotions/_promotion_link_project.html.haml_spec.rb'
     - 'ee/spec/workers/analytics/code_review_metrics_worker_spec.rb'
     - 'ee/spec/workers/security/scan_execution_policies/create_pipeline_worker_spec.rb'
@@ -87,7 +86,6 @@ RSpec/ExcessiveDocstringSpacing:
     - 'spec/services/git/wiki_push_service_spec.rb'
     - 'spec/services/groups/nested_create_service_spec.rb'
     - 'spec/services/issues/update_service_spec.rb'
-    - 'spec/services/merge_requests/mergeability/check_ci_status_service_spec.rb'
     - 'spec/services/ml/experiment_tracking/candidate_repository_spec.rb'
     - 'spec/services/quick_actions/interpret_service_spec.rb'
     - 'spec/support/shared_examples/requests/projects/google_cloud/google_oauth2_config_examples.rb'
diff --git a/.rubocop_todo/rspec/expect_change.yml b/.rubocop_todo/rspec/expect_change.yml
index 80f81cc953f..9133fd16272 100644
--- a/.rubocop_todo/rspec/expect_change.yml
+++ b/.rubocop_todo/rspec/expect_change.yml
@@ -132,7 +132,6 @@ RSpec/ExpectChange:
     - 'ee/spec/services/security/orchestration/unassign_service_spec.rb'
     - 'ee/spec/services/security/security_orchestration_policies/create_pipeline_service_spec.rb'
     - 'ee/spec/services/security/security_orchestration_policies/process_rule_service_spec.rb'
-    - 'ee/spec/services/security/security_orchestration_policies/rule_schedule_service_spec.rb'
     - 'ee/spec/services/security/store_findings_service_spec.rb'
     - 'ee/spec/services/users/email_verification/send_custom_confirmation_instructions_service_spec.rb'
     - 'ee/spec/services/vulnerabilities/find_or_create_from_security_finding_service_spec.rb'
diff --git a/.rubocop_todo/rspec/expect_in_hook.yml b/.rubocop_todo/rspec/expect_in_hook.yml
index be1bd6c2b10..abae7f6fcd1 100644
--- a/.rubocop_todo/rspec/expect_in_hook.yml
+++ b/.rubocop_todo/rspec/expect_in_hook.yml
@@ -341,7 +341,6 @@ RSpec/ExpectInHook:
     - 'spec/services/members/destroy_service_spec.rb'
     - 'spec/services/merge_requests/cleanup_refs_service_spec.rb'
     - 'spec/services/merge_requests/merge_service_spec.rb'
-    - 'spec/services/merge_requests/mergeability/check_ci_status_service_spec.rb'
     - 'spec/services/merge_requests/mergeability/check_draft_status_service_spec.rb'
     - 'spec/services/merge_requests/mergeability/check_open_status_service_spec.rb'
     - 'spec/services/merge_requests/mergeability/run_checks_service_spec.rb'
diff --git a/.rubocop_todo/rspec/feature_category.yml b/.rubocop_todo/rspec/feature_category.yml
index 0ec7d883fe7..3ecf12aa4a4 100644
--- a/.rubocop_todo/rspec/feature_category.yml
+++ b/.rubocop_todo/rspec/feature_category.yml
@@ -481,7 +481,6 @@ RSpec/FeatureCategory:
     - 'ee/spec/lib/ee/gitlab/group_search_results_spec.rb'
     - 'ee/spec/lib/ee/gitlab/hook_data/group_member_builder_spec.rb'
     - 'ee/spec/lib/ee/gitlab/hook_data/issue_builder_spec.rb'
-    - 'ee/spec/lib/ee/gitlab/import_export/group/tree_saver_spec.rb'
     - 'ee/spec/lib/ee/gitlab/import_export/project/tree_saver_spec.rb'
     - 'ee/spec/lib/ee/gitlab/import_export/repo_restorer_spec.rb'
     - 'ee/spec/lib/ee/gitlab/import_export/wiki_repo_saver_spec.rb'
@@ -679,7 +678,6 @@ RSpec/FeatureCategory:
     - 'ee/spec/lib/gitlab/usage/metrics/instrumentations/count_groups_with_assigned_security_policy_project_metric_spec.rb'
     - 'ee/spec/lib/gitlab/usage/metrics/instrumentations/count_groups_with_event_streaming_destinations_metric_spec.rb'
     - 'ee/spec/lib/gitlab/usage/metrics/instrumentations/count_merge_requests_with_applied_scan_result_policies_metric_spec.rb'
-    - 'ee/spec/lib/gitlab/usage/metrics/instrumentations/count_projects_with_applied_scan_result_policies_metric_spec.rb'
     - 'ee/spec/lib/gitlab/usage/metrics/instrumentations/count_projects_with_assigned_security_policy_project_metric_spec.rb'
     - 'ee/spec/lib/gitlab/usage/metrics/instrumentations/count_projects_with_external_status_checks_metric_spec.rb'
     - 'ee/spec/lib/gitlab/usage/metrics/instrumentations/count_saml_group_links_metric_spec.rb'
@@ -1026,7 +1024,6 @@ RSpec/FeatureCategory:
     - 'ee/spec/services/audit_events/user_impersonation_group_audit_event_service_spec.rb'
     - 'ee/spec/services/award_emojis/add_service_spec.rb'
     - 'ee/spec/services/award_emojis/destroy_service_spec.rb'
-    - 'ee/spec/services/billable_members/destroy_service_spec.rb'
     - 'ee/spec/services/boards/create_service_spec.rb'
     - 'ee/spec/services/boards/epic_boards/create_service_spec.rb'
     - 'ee/spec/services/boards/epic_boards/destroy_service_spec.rb'
@@ -1211,7 +1208,6 @@ RSpec/FeatureCategory:
     - 'spec/controllers/help_controller_spec.rb'
     - 'spec/controllers/invites_controller_spec.rb'
     - 'spec/controllers/metrics_controller_spec.rb'
-    - 'spec/controllers/oauth/authorizations_controller_spec.rb'
     - 'spec/controllers/oauth/authorized_applications_controller_spec.rb'
     - 'spec/controllers/oauth/token_info_controller_spec.rb'
     - 'spec/controllers/profiles/accounts_controller_spec.rb'
@@ -1317,7 +1313,6 @@ RSpec/FeatureCategory:
     - 'spec/finders/concerns/finder_with_group_hierarchy_spec.rb'
     - 'spec/finders/container_repositories_finder_spec.rb'
     - 'spec/finders/context_commits_finder_spec.rb'
-    - 'spec/finders/crm/organizations_finder_spec.rb'
     - 'spec/finders/database/batched_background_migrations_finder_spec.rb'
     - 'spec/finders/deploy_tokens/tokens_finder_spec.rb'
     - 'spec/finders/design_management/designs_finder_spec.rb'
@@ -2553,7 +2548,6 @@ RSpec/FeatureCategory:
     - 'spec/lib/gitlab/fogbugz_import/importer_spec.rb'
     - 'spec/lib/gitlab/form_builders/gitlab_ui_form_builder_spec.rb'
     - 'spec/lib/gitlab/gfm/reference_rewriter_spec.rb'
-    - 'spec/lib/gitlab/gfm/uploads_rewriter_spec.rb'
     - 'spec/lib/gitlab/git/attributes_at_ref_parser_spec.rb'
     - 'spec/lib/gitlab/git/attributes_parser_spec.rb'
     - 'spec/lib/gitlab/git/base_error_spec.rb'
@@ -2963,7 +2957,6 @@ RSpec/FeatureCategory:
     - 'spec/lib/gitlab/search_context/builder_spec.rb'
     - 'spec/lib/gitlab/search_context/controller_concern_spec.rb'
     - 'spec/lib/gitlab/security/scan_configuration_spec.rb'
-    - 'spec/lib/gitlab/seeder_spec.rb'
     - 'spec/lib/gitlab/seeders/ci/daily_build_group_report_result_spec.rb'
     - 'spec/lib/gitlab/serializer/ci/variables_spec.rb'
     - 'spec/lib/gitlab/serializer/pagination_spec.rb'
@@ -3429,7 +3422,6 @@ RSpec/FeatureCategory:
     - 'spec/models/integrations/chat_message/pipeline_message_spec.rb'
     - 'spec/models/integrations/chat_message/push_message_spec.rb'
     - 'spec/models/integrations/chat_message/wiki_page_message_spec.rb'
-    - 'spec/models/integrations/emails_on_push_spec.rb'
     - 'spec/models/integrations/ewm_spec.rb'
     - 'spec/models/integrations/harbor_spec.rb'
     - 'spec/models/integrations/issue_tracker_data_spec.rb'
@@ -3575,7 +3567,6 @@ RSpec/FeatureCategory:
     - 'spec/policies/award_emoji_policy_spec.rb'
     - 'spec/policies/base_policy_spec.rb'
     - 'spec/policies/blob_policy_spec.rb'
-    - 'spec/policies/board_policy_spec.rb'
     - 'spec/policies/ci/bridge_policy_spec.rb'
     - 'spec/policies/clusters/agent_policy_spec.rb'
     - 'spec/policies/clusters/agent_token_policy_spec.rb'
diff --git a/.rubocop_todo/rspec/instance_variable.yml b/.rubocop_todo/rspec/instance_variable.yml
index c6446e263f7..2c8b8e15eed 100644
--- a/.rubocop_todo/rspec/instance_variable.yml
+++ b/.rubocop_todo/rspec/instance_variable.yml
@@ -28,8 +28,6 @@ RSpec/InstanceVariable:
     - 'ee/spec/views/projects/security/dast_profiles/show.html.haml_spec.rb'
     - 'ee/spec/views/projects/security/dast_scanner_profiles/new.html.haml_spec.rb'
     - 'ee/spec/views/projects/security/dast_site_profiles/new.html.haml_spec.rb'
-    - 'qa/qa/specs/features/browser_ui/3_create/repository/push_over_ssh_spec.rb'
-    - 'qa/qa/specs/features/browser_ui/3_create/repository/user_views_commit_diff_patch_spec.rb'
     - 'qa/qa/specs/features/ee/browser_ui/2_plan/issue_boards/project_issue_boards_spec.rb'
     - 'qa/qa/specs/features/ee/browser_ui/2_plan/multiple_assignees_for_issues/more_than_four_assignees_spec.rb'
     - 'spec/commands/metrics_server/metrics_server_spec.rb'
diff --git a/.rubocop_todo/rspec/named_subject.yml b/.rubocop_todo/rspec/named_subject.yml
index 95e387e8b4c..2abc9a4f504 100644
--- a/.rubocop_todo/rspec/named_subject.yml
+++ b/.rubocop_todo/rspec/named_subject.yml
@@ -226,7 +226,6 @@ RSpec/NamedSubject:
     - 'ee/spec/lib/api/entities/protected_environments/approval_rule_spec.rb'
     - 'ee/spec/lib/api/entities/protected_environments/deploy_access_level_spec.rb'
     - 'ee/spec/lib/audit_events/base_changes_auditor_spec.rb'
-    - 'ee/spec/lib/audit_events/external_destination_streamer_spec.rb'
     - 'ee/spec/lib/audit_events/strategies/amazon_s3_destination_strategy_spec.rb'
     - 'ee/spec/lib/audit_events/strategies/external_destination_strategy_spec.rb'
     - 'ee/spec/lib/audit_events/strategies/google_cloud_logging_destination_strategy_spec.rb'
@@ -1142,7 +1141,6 @@ RSpec/NamedSubject:
     - 'ee/spec/workers/vulnerabilities/mark_dropped_as_resolved_worker_spec.rb'
     - 'ee/spec/workers/vulnerabilities/update_namespace_ids_of_vulnerability_reads_worker_spec.rb'
     - 'qa/spec/ee/runtime/geo_spec.rb'
-    - 'qa/spec/factory/resource/user_spec.rb'
     - 'qa/spec/page/base_spec.rb'
     - 'qa/spec/page/element_spec.rb'
     - 'qa/spec/page/logging_spec.rb'
@@ -2199,7 +2197,6 @@ RSpec/NamedSubject:
     - 'spec/lib/gitlab/sidekiq_middleware/admin_mode/client_spec.rb'
     - 'spec/lib/gitlab/sidekiq_middleware/admin_mode/server_spec.rb'
     - 'spec/lib/gitlab/sidekiq_middleware/client_metrics_spec.rb'
-    - 'spec/lib/gitlab/sidekiq_middleware/duplicate_jobs/duplicate_job_spec.rb'
     - 'spec/lib/gitlab/sidekiq_middleware/extra_done_log_metadata_spec.rb'
     - 'spec/lib/gitlab/sidekiq_middleware/instrumentation_logger_spec.rb'
     - 'spec/lib/gitlab/sidekiq_middleware/monitor_spec.rb'
@@ -2507,7 +2504,6 @@ RSpec/NamedSubject:
     - 'spec/models/integrations/asana_spec.rb'
     - 'spec/models/integrations/assembla_spec.rb'
     - 'spec/models/integrations/bamboo_spec.rb'
-    - 'spec/models/integrations/base_chat_notification_spec.rb'
     - 'spec/models/integrations/base_issue_tracker_spec.rb'
     - 'spec/models/integrations/bugzilla_spec.rb'
     - 'spec/models/integrations/buildkite_spec.rb'
diff --git a/.rubocop_todo/rspec/no_expectation_example.yml b/.rubocop_todo/rspec/no_expectation_example.yml
index e3006dd1364..a60724b1597 100644
--- a/.rubocop_todo/rspec/no_expectation_example.yml
+++ b/.rubocop_todo/rspec/no_expectation_example.yml
@@ -54,7 +54,6 @@ RSpec/NoExpectationExample:
     - 'qa/qa/specs/features/ee/browser_ui/10_govern/group/group_ldap_sync_spec.rb'
     - 'qa/qa/specs/features/ee/browser_ui/10_govern/security_reports_spec.rb'
     - 'qa/qa/specs/features/ee/browser_ui/12_systems/geo/wiki_ssh_push_spec.rb'
-    - 'qa/qa/specs/features/ee/browser_ui/13_secure/cvs_dependency_scanning_spec.rb'
     - 'qa/qa/specs/features/ee/browser_ui/9_data_stores/group/prevent_forking_outside_group_spec.rb'
     - 'qa/spec/specs/helpers/context_selector_spec.rb'
     - 'qa/spec/specs/helpers/feature_flag_spec.rb'
diff --git a/.rubocop_todo/rspec/receive_messages.yml b/.rubocop_todo/rspec/receive_messages.yml
index e1975dc43fd..c88a1663ce8 100644
--- a/.rubocop_todo/rspec/receive_messages.yml
+++ b/.rubocop_todo/rspec/receive_messages.yml
@@ -406,7 +406,6 @@ RSpec/ReceiveMessages:
     - 'spec/models/concerns/participable_spec.rb'
     - 'spec/models/concerns/require_email_verification_spec.rb'
     - 'spec/models/diff_viewer/base_spec.rb'
-    - 'spec/models/integrations/base_chat_notification_spec.rb'
     - 'spec/models/integrations/chat_message/pipeline_message_spec.rb'
     - 'spec/models/integrations/discord_spec.rb'
     - 'spec/models/issue_spec.rb'
@@ -503,7 +502,6 @@ RSpec/ReceiveMessages:
     - 'spec/services/issuable/import_csv/base_service_spec.rb'
     - 'spec/services/issues/relative_position_rebalancing_service_spec.rb'
     - 'spec/services/merge_requests/after_create_service_spec.rb'
-    - 'spec/services/merge_requests/mergeability/check_ci_status_service_spec.rb'
     - 'spec/services/merge_requests/mergeability/check_commits_status_service_spec.rb'
     - 'spec/services/merge_requests/mergeability/check_lfs_file_locks_service_spec.rb'
     - 'spec/services/merge_requests/mergeability/run_checks_service_spec.rb'
diff --git a/.rubocop_todo/style/arguments_forwarding.yml b/.rubocop_todo/style/arguments_forwarding.yml
index 0b0890b919b..7f08ab95cca 100644
--- a/.rubocop_todo/style/arguments_forwarding.yml
+++ b/.rubocop_todo/style/arguments_forwarding.yml
@@ -2,205 +2,7 @@
 # Cop supports --autocorrect.
 Style/ArgumentsForwarding:
   Exclude:
-    - 'app/controllers/admin/users_controller.rb'
-    - 'app/controllers/application_controller.rb'
-    - 'app/controllers/concerns/product_analytics_tracking.rb'
-    - 'app/controllers/concerns/sessionless_authentication.rb'
-    - 'app/controllers/oauth/applications_controller.rb'
-    - 'app/controllers/repositories/git_http_client_controller.rb'
-    - 'app/graphql/types/permission_types/base_permission_type.rb'
-    - 'app/helpers/application_helper.rb'
-    - 'app/helpers/merge_requests_helper.rb'
-    - 'app/mailers/application_mailer.rb'
-    - 'app/models/application_record.rb'
-    - 'app/models/ci/build_trace_chunk.rb'
-    - 'app/models/ci/partition.rb'
-    - 'app/models/ci/unlock_pipeline_request.rb'
-    - 'app/models/commit.rb'
-    - 'app/models/commit_collection.rb'
-    - 'app/models/concerns/after_commit_queue.rb'
-    - 'app/models/concerns/cross_database_ignored_tables.rb'
-    - 'app/models/concerns/redis_cacheable.rb'
-    - 'app/models/network/commit.rb'
-    - 'app/models/project.rb'
-    - 'app/models/system/broadcast_message.rb'
-    - 'app/presenters/gitlab/blame_presenter.rb'
-    - 'app/services/base_count_service.rb'
-    - 'app/services/concerns/projects/remove_refs.rb'
-    - 'app/services/packages/terraform_module/process_package_file_service.rb'
-    - 'app/services/projects/forks/sync_service.rb'
-    - 'app/services/projects/lfs_pointers/lfs_download_link_list_service.rb'
-    - 'app/services/projects/lfs_pointers/lfs_download_service.rb'
-    - 'app/services/projects/lfs_pointers/lfs_object_download_list_service.rb'
-    - 'app/services/protected_branches/cache_service.rb'
-    - 'app/services/user_project_access_changed_service.rb'
-    - 'app/services/users/update_service.rb'
-    - 'app/workers/authorized_project_update/user_refresh_from_replica_worker.rb'
-    - 'app/workers/concerns/limited_capacity/job_tracker.rb'
-    - 'app/workers/container_expiration_policies/cleanup_container_repository_worker.rb'
-    - 'app/workers/container_expiration_policy_worker.rb'
-    - 'app/workers/gitlab_performance_bar_stats_worker.rb'
-    - 'app/workers/packages/cleanup/delete_orphaned_dependencies_worker.rb'
-    - 'app/workers/projects/inactive_projects_deletion_cron_worker.rb'
-    - 'config/initializers/6_labkit_middleware.rb'
-    - 'config/initializers/mail_starttls_patch.rb'
-    - 'config/initializers/rest-client-hostname_override.rb'
-    - 'ee/app/controllers/ee/application_controller.rb'
-    - 'ee/app/models/ci/instance_runner_failed_jobs.rb'
-    - 'ee/app/models/dast_site_profile.rb'
-    - 'ee/app/models/ee/group.rb'
-    - 'ee/app/models/elastic/migration_record.rb'
-    - 'ee/app/models/license.rb'
-    - 'ee/app/models/security/orchestration_policy_configuration.rb'
-    - 'ee/app/services/elastic/indexing_control_service.rb'
-    - 'ee/app/services/elastic/process_bookkeeping_service.rb'
-    - 'ee/app/services/external_status_checks/base_service.rb'
-    - 'ee/app/services/vulnerability_exports/exporters/csv_service.rb'
-    - 'ee/app/workers/compliance_management/merge_requests/compliance_violations_consistency_worker.rb'
-    - 'ee/lib/ee/gitlab/auth/ldap/user.rb'
-    - 'ee/lib/gitlab/elastic/elasticsearch_enabled_cache.rb'
-    - 'ee/lib/gitlab/elastic/expr_name.rb'
-    - 'ee/lib/gitlab/license_scanning/package_licenses.rb'
-    - 'ee/lib/gitlab/llm/chain/concerns/ai_dependent.rb'
-    - 'ee/lib/gitlab/llm/chain/tools/tool.rb'
-    - 'ee/lib/gitlab/llm/chat_storage.rb'
-    - 'ee/lib/gitlab/llm/concerns/exponential_backoff.rb'
-    - 'ee/lib/gitlab/package_metadata/connector/gcp.rb'
-    - 'ee/lib/search/zoekt/cache.rb'
-    - 'ee/lib/security/scan_result_policies/policy_violation_comment.rb'
-    - 'lib/api/helpers/internal_helpers.rb'
-    - 'lib/backup/targets/database.rb'
-    - 'lib/banzai/reference_parser/base_parser.rb'
-    - 'lib/bitbucket/exponential_backoff.rb'
-    - 'lib/bitbucket_server/retry_with_delay.rb'
-    - 'lib/bulk_imports/clients/http.rb'
-    - 'lib/error_tracking/sentry_client.rb'
-    - 'lib/gitlab/application_context.rb'
-    - 'lib/gitlab/application_rate_limiter/base_strategy.rb'
-    - 'lib/gitlab/auth/ldap/dn.rb'
-    - 'lib/gitlab/avatar_cache.rb'
-    - 'lib/gitlab/background_migration/job_coordinator.rb'
-    - 'lib/gitlab/cache/ci/project_pipeline_status.rb'
-    - 'lib/gitlab/cache/import/caching.rb'
-    - 'lib/gitlab/changes_list.rb'
-    - 'lib/gitlab/ci/config/interpolation/config.rb'
-    - 'lib/gitlab/ci/pipeline/logger.rb'
-    - 'lib/gitlab/ci/secure_files/migration_helper.rb'
-    - 'lib/gitlab/ci/trace.rb'
-    - 'lib/gitlab/ci/variables/collection.rb'
-    - 'lib/gitlab/ci/variables/collection/sort.rb'
-    - 'lib/gitlab/ci/yaml_processor/dag.rb'
-    - 'lib/gitlab/circuit_breaker.rb'
-    - 'lib/gitlab/circuit_breaker/store.rb'
-    - 'lib/gitlab/cluster/lifecycle_events.rb'
-    - 'lib/gitlab/color_modes.rb'
-    - 'lib/gitlab/color_schemes.rb'
-    - 'lib/gitlab/config/entry/inheritable.rb'
-    - 'lib/gitlab/config/entry/simplifiable.rb'
-    - 'lib/gitlab/config/entry/validatable.rb'
-    - 'lib/gitlab/container_repository/tags/cache.rb'
-    - 'lib/gitlab/counters/buffered_counter.rb'
     - 'lib/gitlab/current_settings.rb'
-    - 'lib/gitlab/database/async_indexes/index_creator.rb'
-    - 'lib/gitlab/database/async_indexes/index_destructor.rb'
-    - 'lib/gitlab/database/background_migration/batch_metrics.rb'
-    - 'lib/gitlab/database/consistency.rb'
     - 'lib/gitlab/database/load_balancing/connection_proxy.rb'
-    - 'lib/gitlab/database/load_balancing/load_balancer.rb'
-    - 'lib/gitlab/database/load_balancing/sticking.rb'
-    - 'lib/gitlab/database/lock_writes_manager.rb'
-    - 'lib/gitlab/database/migrations/lock_retry_mixin.rb'
-    - 'lib/gitlab/database/migrations/runner_backoff/communicator.rb'
-    - 'lib/gitlab/database/migrations/test_batched_background_runner.rb'
-    - 'lib/gitlab/database/partitioning/detached_partition_dropper.rb'
-    - 'lib/gitlab/database/partitioning/list/locking_configuration.rb'
-    - 'lib/gitlab/database/partitioning/partition_manager.rb'
-    - 'lib/gitlab/database/partitioning/sliding_list_strategy.rb'
-    - 'lib/gitlab/database/partitioning_migration_helpers/index_helpers.rb'
-    - 'lib/gitlab/database/postgres_partitioned_table.rb'
-    - 'lib/gitlab/database/query_analyzers/prevent_cross_database_modification.rb'
-    - 'lib/gitlab/database/tables_locker.rb'
-    - 'lib/gitlab/database/tables_sorted_by_foreign_keys.rb'
-    - 'lib/gitlab/diff/highlight_cache.rb'
-    - 'lib/gitlab/diff/position_collection.rb'
-    - 'lib/gitlab/discussions_diff/file_collection.rb'
-    - 'lib/gitlab/discussions_diff/highlight_cache.rb'
-    - 'lib/gitlab/encrypted_configuration.rb'
-    - 'lib/gitlab/etag_caching/store.rb'
-    - 'lib/gitlab/external_authorization/cache.rb'
-    - 'lib/gitlab/git/cross_repo.rb'
-    - 'lib/gitlab/git/diff_collection.rb'
-    - 'lib/gitlab/git/diff_stats_collection.rb'
-    - 'lib/gitlab/gitaly_client/cleanup_service.rb'
-    - 'lib/gitlab/gitaly_client/storage_settings.rb'
-    - 'lib/gitlab/gpg.rb'
-    - 'lib/gitlab/graphql/laziness.rb'
-    - 'lib/gitlab/graphql/lazy.rb'
-    - 'lib/gitlab/health_checks/base_abstract_check.rb'
-    - 'lib/gitlab/http.rb'
-    - 'lib/gitlab/i18n.rb'
-    - 'lib/gitlab/import_export/json/streaming_serializer.rb'
-    - 'lib/gitlab/issues/rebalancing/state.rb'
-    - 'lib/gitlab/kubernetes/node.rb'
-    - 'lib/gitlab/legacy_github_import/client.rb'
-    - 'lib/gitlab/markdown_cache/redis/store.rb'
     - 'lib/gitlab/memory/watchdog/configuration.rb'
-    - 'lib/gitlab/merge_requests/mergeability/redis_interface.rb'
-    - 'lib/gitlab/metrics/subscribers/active_record.rb'
-    - 'lib/gitlab/metrics/transaction.rb'
-    - 'lib/gitlab/namespaced_session_store.rb'
-    - 'lib/gitlab/pagination/keyset/in_operator_optimization/order_by_columns.rb'
-    - 'lib/gitlab/popen.rb'
-    - 'lib/gitlab/rack_attack.rb'
-    - 'lib/gitlab/rack_attack/store.rb'
     - 'lib/gitlab/redis/multi_store.rb'
-    - 'lib/gitlab/repository_archive_rate_limiter.rb'
-    - 'lib/gitlab/repository_cache.rb'
-    - 'lib/gitlab/repository_hash_cache.rb'
-    - 'lib/gitlab/repository_set_cache.rb'
-    - 'lib/gitlab/safe_request_loader.rb'
-    - 'lib/gitlab/search/recent_items.rb'
-    - 'lib/gitlab/set_cache.rb'
-    - 'lib/gitlab/shard_health_cache.rb'
-    - 'lib/gitlab/sidekiq_middleware/concurrency_limit/client.rb'
-    - 'lib/gitlab/sidekiq_middleware/concurrency_limit/server.rb'
-    - 'lib/gitlab/sidekiq_middleware/duplicate_jobs/client.rb'
-    - 'lib/gitlab/sidekiq_middleware/duplicate_jobs/duplicate_job.rb'
-    - 'lib/gitlab/sidekiq_middleware/duplicate_jobs/server.rb'
-    - 'lib/gitlab/sidekiq_middleware/pause_control/client.rb'
-    - 'lib/gitlab/sidekiq_middleware/pause_control/pause_control_service.rb'
-    - 'lib/gitlab/sidekiq_middleware/pause_control/server.rb'
-    - 'lib/gitlab/sidekiq_middleware/pause_control/strategy_handler.rb'
-    - 'lib/gitlab/sidekiq_middleware/worker_context.rb'
-    - 'lib/gitlab/sidekiq_sharding/validator.rb'
-    - 'lib/gitlab/terraform/state_migration_helper.rb'
-    - 'lib/gitlab/themes.rb'
-    - 'lib/gitlab/utils/measuring.rb'
-    - 'lib/gitlab/workhorse.rb'
-    - 'lib/gitlab_settings.rb'
-    - 'lib/mattermost/client.rb'
-    - 'lib/object_storage/pending_direct_upload.rb'
-    - 'lib/uploaded_file.rb'
-    - 'lib/users/internal.rb'
-    - 'qa/qa/ee/page/insights/show.rb'
-    - 'qa/qa/ee/page/operations_dashboard.rb'
-    - 'qa/qa/page/admin/overview/users/show.rb'
-    - 'qa/qa/page/base.rb'
-    - 'qa/qa/page/component/blob_content.rb'
-    - 'qa/qa/page/component/snippet.rb'
-    - 'qa/qa/page/project/web_ide/vscode.rb'
-    - 'qa/qa/resource/protected_branch.rb'
-    - 'qa/qa/scenario/actable.rb'
-    - 'rubocop/code_reuse_helpers.rb'
-    - 'spec/lib/gitlab/pagination/offset_pagination_spec.rb'
-    - 'spec/support/database/prevent_cross_database_modification.rb'
-    - 'spec/support/helpers/form_builder_helpers.rb'
-    - 'spec/support/helpers/git_http_helpers.rb'
-    - 'spec/support/helpers/graphql_helpers.rb'
-    - 'spec/support/helpers/query_recorder.rb'
-    - 'spec/support/helpers/redis_commands/recorder.rb'
-    - 'spec/support/helpers/routes_helpers.rb'
-    - 'spec/support/helpers/stub_method_calls.rb'
-    - 'spec/support/matchers/internal_events_cli_matchers.rb'
-    - 'spec/support/protected_branch_helpers.rb'
-    - 'spec/support/sidekiq_middleware.rb'
diff --git a/.rubocop_todo/style/format_string.yml b/.rubocop_todo/style/format_string.yml
index 6444b6f8608..b2065d154ae 100644
--- a/.rubocop_todo/style/format_string.yml
+++ b/.rubocop_todo/style/format_string.yml
@@ -132,7 +132,6 @@ Style/FormatString:
     - 'ee/app/helpers/billing_plans_helper.rb'
     - 'ee/app/helpers/ee/application_helper.rb'
     - 'ee/app/helpers/ee/geo_helper.rb'
-    - 'ee/app/helpers/ee/groups/settings_helper.rb'
     - 'ee/app/helpers/ee/groups_helper.rb'
     - 'ee/app/helpers/ee/import_helper.rb'
     - 'ee/app/helpers/ee/profiles_helper.rb'
diff --git a/.rubocop_todo/style/guard_clause.yml b/.rubocop_todo/style/guard_clause.yml
index 42e551789da..4b6bebe726c 100644
--- a/.rubocop_todo/style/guard_clause.yml
+++ b/.rubocop_todo/style/guard_clause.yml
@@ -509,7 +509,6 @@ Style/GuardClause:
     - 'scripts/setup/find-jh-branch.rb'
     - 'scripts/trigger-build.rb'
     - 'spec/features/issuables/issuable_list_spec.rb'
-    - 'spec/features/projects/blobs/edit_spec.rb'
     - 'spec/lib/gitlab/database/migrations/background_migration_helpers_spec.rb'
     - 'spec/services/issues/relative_position_rebalancing_service_spec.rb'
     - 'spec/services/packages/maven/metadata/append_package_file_service_spec.rb'
diff --git a/.rubocop_todo/style/if_unless_modifier.yml b/.rubocop_todo/style/if_unless_modifier.yml
index 94d36bea145..4b0b0fdd25c 100644
--- a/.rubocop_todo/style/if_unless_modifier.yml
+++ b/.rubocop_todo/style/if_unless_modifier.yml
@@ -316,7 +316,6 @@ Style/IfUnlessModifier:
     - 'ee/app/services/ee/protected_branches/create_service.rb'
     - 'ee/app/services/ee/todo_service.rb'
     - 'ee/app/services/ee/users/update_service.rb'
-    - 'ee/app/services/elastic/indexing_control_service.rb'
     - 'ee/app/services/epics/base_service.rb'
     - 'ee/app/services/epics/create_service.rb'
     - 'ee/app/services/epics/epic_links/create_service.rb'
@@ -685,7 +684,6 @@ Style/IfUnlessModifier:
     - 'qa/qa/page/page_concern.rb'
     - 'qa/qa/page/view.rb'
     - 'qa/qa/resource/registry_repository.rb'
-    - 'qa/qa/resource/repository/push.rb'
     - 'qa/qa/resource/snippet.rb'
     - 'qa/qa/scenario/bootable.rb'
     - 'qa/qa/service/praefect_manager.rb'
diff --git a/.rubocop_todo/style/inline_disable_annotation.yml b/.rubocop_todo/style/inline_disable_annotation.yml
index 847e54693ce..48721104063 100644
--- a/.rubocop_todo/style/inline_disable_annotation.yml
+++ b/.rubocop_todo/style/inline_disable_annotation.yml
@@ -55,7 +55,6 @@ Style/InlineDisableAnnotation:
     - 'app/controllers/dashboard/projects_controller.rb'
     - 'app/controllers/explore/projects_controller.rb'
     - 'app/controllers/graphql_controller.rb'
-    - 'app/controllers/groups/milestones_controller.rb'
     - 'app/controllers/groups_controller.rb'
     - 'app/controllers/help_controller.rb'
     - 'app/controllers/import/base_controller.rb'
@@ -465,7 +464,6 @@ Style/InlineDisableAnnotation:
     - 'app/policies/email_policy.rb'
     - 'app/policies/event_policy.rb'
     - 'app/policies/group_group_link_policy.rb'
-    - 'app/policies/issue_policy.rb'
     - 'app/policies/list_policy.rb'
     - 'app/policies/namespace_ci_cd_setting_policy.rb'
     - 'app/policies/project_group_link_policy.rb'
@@ -1330,14 +1328,11 @@ Style/InlineDisableAnnotation:
     - 'ee/app/services/security/security_orchestration_policies/fetch_policy_approvers_service.rb'
     - 'ee/app/services/security/security_orchestration_policies/policy_branches_service.rb'
     - 'ee/app/services/security/security_orchestration_policies/process_scan_result_policy_service.rb'
-    - 'ee/app/services/security/security_orchestration_policies/rule_schedule_service.rb'
     - 'ee/app/services/security/security_orchestration_policies/validate_policy_service.rb'
-    - 'ee/app/services/security/token_revocation_service.rb'
     - 'ee/app/services/security/update_training_service.rb'
     - 'ee/app/services/status_page/publish_base_service.rb'
     - 'ee/app/services/timebox/event_aggregation_service.rb'
     - 'ee/app/services/timebox_report_service.rb'
-    - 'ee/app/services/vulnerabilities/bulk_dismiss_service.rb'
     - 'ee/app/services/vulnerabilities/create_service_base.rb'
     - 'ee/app/services/vulnerabilities/manually_create_service.rb'
     - 'ee/app/validators/user_existence_validator.rb'
@@ -1361,7 +1356,6 @@ Style/InlineDisableAnnotation:
     - 'ee/app/workers/compliance_management/merge_requests/compliance_violations_consistency_worker.rb'
     - 'ee/app/workers/compliance_management/timeout_pending_status_check_responses_worker.rb'
     - 'ee/app/workers/concerns/elastic/bulk_cron_worker.rb'
-    - 'ee/app/workers/concerns/elastic/indexing_control.rb'
     - 'ee/app/workers/concerns/geo/base_registry_sync_worker.rb'
     - 'ee/app/workers/create_github_webhook_worker.rb'
     - 'ee/app/workers/ee/post_receive.rb'
@@ -1574,9 +1568,7 @@ Style/InlineDisableAnnotation:
     - 'ee/spec/factories/security_scans.rb'
     - 'ee/spec/features/dependency_proxy/packages/maven_spec.rb'
     - 'ee/spec/features/groups/group_settings_spec.rb'
-    - 'ee/spec/features/groups/settings/domain_verification_spec.rb'
     - 'ee/spec/features/merge_request/draft_comments_spec.rb'
-    - 'ee/spec/features/projects/mirror_spec.rb'
     - 'ee/spec/features/registrations/combined_registration_spec.rb'
     - 'ee/spec/features/registrations/saas/standard_flow_with_2fa_spec.rb'
     - 'ee/spec/finders/audit_event_finder_spec.rb'
@@ -1604,8 +1596,6 @@ Style/InlineDisableAnnotation:
     - 'ee/spec/lib/gitlab/patch/database_config_spec.rb'
     - 'ee/spec/lib/gitlab/sitemaps/sitemap_file_spec.rb'
     - 'ee/spec/lib/gitlab/timebox/snapshot_builder_spec.rb'
-    - 'ee/spec/lib/gitlab/usage/metrics/instrumentations/count_secure_pipelines_metric_spec.rb'
-    - 'ee/spec/lib/gitlab/usage/metrics/instrumentations/count_security_scans_metric_spec.rb'
     - 'ee/spec/lib/gitlab/usage/metrics/instrumentations/protected_environment_approval_rules_required_approvals_average_metric_spec.rb'
     - 'ee/spec/lib/repositories/group_push_rules_changes_auditor_spec.rb'
     - 'ee/spec/lib/repositories/project_push_rules_changes_auditor_spec.rb'
@@ -1756,7 +1746,6 @@ Style/InlineDisableAnnotation:
     - 'lib/api/protected_branches.rb'
     - 'lib/api/protected_tags.rb'
     - 'lib/api/resource_access_tokens.rb'
-    - 'lib/api/rubygem_packages.rb'
     - 'lib/api/settings.rb'
     - 'lib/api/sidekiq_metrics.rb'
     - 'lib/api/snippet_repository_storage_moves.rb'
@@ -2007,7 +1996,6 @@ Style/InlineDisableAnnotation:
     - 'lib/gitlab/legacy_github_import/importer.rb'
     - 'lib/gitlab/legacy_github_import/issuable_formatter.rb'
     - 'lib/gitlab/lets_encrypt/client.rb'
-    - 'lib/gitlab/lfs_token.rb'
     - 'lib/gitlab/local_and_remote_storage_migration/base_migrater.rb'
     - 'lib/gitlab/marginalia/comment.rb'
     - 'lib/gitlab/markdown_cache/redis/store.rb'
@@ -2033,7 +2021,6 @@ Style/InlineDisableAnnotation:
     - 'lib/gitlab/patch/sidekiq_cron_poller.rb'
     - 'lib/gitlab/performance_bar.rb'
     - 'lib/gitlab/performance_bar/redis_adapter_when_peek_enabled.rb'
-    - 'lib/gitlab/popen/runner.rb'
     - 'lib/gitlab/profiler.rb'
     - 'lib/gitlab/project_search_results.rb'
     - 'lib/gitlab/project_stats_refresh_conflicts_logger.rb'
@@ -2144,14 +2131,11 @@ Style/InlineDisableAnnotation:
     - 'qa/qa/scenario/test/integration/ldap_no_tls.rb'
     - 'qa/qa/scenario/test/integration/ldap_tls.rb'
     - 'qa/qa/scenario/test/integration/registry_with_cdn.rb'
-    - 'qa/qa/service/docker_run/gitlab_runner.rb'
     - 'qa/qa/service/shellout.rb'
     - 'qa/qa/specs/features/api/1_manage/migration/gitlab_migration_large_project_spec.rb'
     - 'qa/qa/specs/features/browser_ui/10_govern/user/user_access_termination_spec.rb'
     - 'qa/qa/specs/features/browser_ui/1_manage/integrations/jira/jira_basic_integration_spec.rb'
-    - 'qa/qa/specs/features/ee/api/10_govern/instance_audit_event_streaming_spec.rb'
     - 'qa/qa/specs/features/ee/browser_ui/10_govern/create_merge_request_with_secure_spec.rb'
-    - 'qa/qa/specs/features/ee/browser_ui/10_govern/group/group_audit_event_streaming_spec.rb'
     - 'qa/qa/specs/features/ee/browser_ui/10_govern/group/group_audit_logs_1_spec.rb'
     - 'qa/qa/specs/features/ee/browser_ui/10_govern/instance/instance_audit_logs_spec.rb'
     - 'qa/qa/specs/features/ee/browser_ui/1_manage/integrations/jira_issues_list_spec.rb'
@@ -2162,7 +2146,6 @@ Style/InlineDisableAnnotation:
     - 'qa/qa/support/run.rb'
     - 'qa/qa/support/wait_for_requests.rb'
     - 'qa/qa/tools/reliable_report.rb'
-    - 'qa/qa/vendor/one_password/cli.rb'
     - 'qa/spec/ee/resource/mixins/group_base_spec.rb'
     - 'qa/spec/page/base_spec.rb'
     - 'qa/spec/resource/project_web_hook_spec.rb'
@@ -2204,7 +2187,6 @@ Style/InlineDisableAnnotation:
     - 'spec/factories/projects/ci_feature_usages.rb'
     - 'spec/factories/wiki_pages.rb'
     - 'spec/features/markdown/math_spec.rb'
-    - 'spec/features/merge_request/user_edits_mr_spec.rb'
     - 'spec/features/merge_request/user_sees_avatar_on_diff_notes_spec.rb'
     - 'spec/features/merge_request/user_sees_merge_request_pipelines_spec.rb'
     - 'spec/features/projects/members/import_project_members_spec.rb'
@@ -2270,8 +2252,6 @@ Style/InlineDisableAnnotation:
     - 'spec/lib/gitlab/database/load_balancing/load_balancer_spec.rb'
     - 'spec/lib/gitlab/database/migrations/instrumentation_spec.rb'
     - 'spec/lib/gitlab/database_spec.rb'
-    - 'spec/lib/gitlab/doorkeeper_secret_storing/secret/pbkdf2_sha512_spec.rb'
-    - 'spec/lib/gitlab/doorkeeper_secret_storing/token/pbkdf2_sha512_spec.rb'
     - 'spec/lib/gitlab/encoding_helper_spec.rb'
     - 'spec/lib/gitlab/git/object_pool_spec.rb'
     - 'spec/lib/gitlab/git/remote_mirror_spec.rb'
@@ -2306,11 +2286,9 @@ Style/InlineDisableAnnotation:
     - 'spec/lib/gitlab/memory/reports_daemon_spec.rb'
     - 'spec/lib/gitlab/memory/reports_uploader_spec.rb'
     - 'spec/lib/gitlab/memory/watchdog/handlers/puma_handler_spec.rb'
-    - 'spec/lib/gitlab/merge_requests/message_generator_spec.rb'
     - 'spec/lib/gitlab/pagination/keyset/iterator_spec.rb'
     - 'spec/lib/gitlab/pagination/keyset/order_spec.rb'
     - 'spec/lib/gitlab/patch/database_config_spec.rb'
-    - 'spec/lib/gitlab/search/abuse_detection_spec.rb'
     - 'spec/lib/gitlab/shard_health_cache_spec.rb'
     - 'spec/lib/gitlab/usage/metrics/instrumentations/count_deployments_metric_spec.rb'
     - 'spec/lib/gitlab/usage/metrics/instrumentations/gitaly_apdex_metric_spec.rb'
@@ -2332,7 +2310,6 @@ Style/InlineDisableAnnotation:
     - 'spec/models/ci/persistent_ref_spec.rb'
     - 'spec/models/ci/pipeline_spec.rb'
     - 'spec/models/concerns/bulk_insertable_associations_spec.rb'
-    - 'spec/models/concerns/encrypted_user_password_spec.rb'
     - 'spec/models/concerns/legacy_bulk_insert_spec.rb'
     - 'spec/models/concerns/manual_inverse_association_spec.rb'
     - 'spec/models/concerns/noteable_spec.rb'
@@ -2353,7 +2330,6 @@ Style/InlineDisableAnnotation:
     - 'spec/presenters/member_presenter_spec.rb'
     - 'spec/presenters/ml/candidates_csv_presenter_spec.rb'
     - 'spec/presenters/packages/nuget/search_results_presenter_spec.rb'
-    - 'spec/requests/api/alert_management_alerts_spec.rb'
     - 'spec/requests/api/ci/runner/jobs_artifacts_spec.rb'
     - 'spec/requests/api/graphql/groups_query_spec.rb'
     - 'spec/requests/api/graphql/issues_spec.rb'
@@ -2438,7 +2414,6 @@ Style/InlineDisableAnnotation:
     - 'spec/support/helpers/stub_feature_flags.rb'
     - 'spec/support/helpers/stub_object_storage.rb'
     - 'spec/support/helpers/stub_snowplow.rb'
-    - 'spec/support/helpers/wait_for_requests.rb'
     - 'spec/support/shared_contexts/controllers/ambiguous_ref_controller_shared_context.rb'
     - 'spec/support/shared_contexts/disable_user_tracking.rb'
     - 'spec/support/shared_contexts/policies/project_policy_table_shared_context.rb'
@@ -2448,7 +2423,6 @@ Style/InlineDisableAnnotation:
     - 'spec/support/shared_examples/db/seeds/data_seeder_shared_examples.rb'
     - 'spec/support/shared_examples/deployments/create_for_job_shared_examples.rb'
     - 'spec/support/shared_examples/environments/create_for_job_shared_examples.rb'
-    - 'spec/support/shared_examples/features/milestone_editing_shared_examples.rb'
     - 'spec/support/shared_examples/features/wiki/user_previews_wiki_changes_shared_examples.rb'
     - 'spec/support/shared_examples/features/wiki/user_updates_wiki_page_shared_examples.rb'
     - 'spec/support/shared_examples/features/wiki/user_views_asciidoc_page_with_includes_shared_examples.rb'
@@ -2508,7 +2482,6 @@ Style/InlineDisableAnnotation:
     - 'spec/workers/repository_check/single_repository_worker_spec.rb'
     - 'tooling/danger/database_dictionary.rb'
     - 'tooling/danger/saas_feature.rb'
-    - 'tooling/danger/sidekiq_queues.rb'
     - 'tooling/danger/stable_branch.rb'
     - 'tooling/lib/tooling/fast_quarantine.rb'
     - 'tooling/lib/tooling/find_changes.rb'
diff --git a/.rubocop_todo/style/map_into_array.yml b/.rubocop_todo/style/map_into_array.yml
index 5082e181e1b..5f5ccc05785 100644
--- a/.rubocop_todo/style/map_into_array.yml
+++ b/.rubocop_todo/style/map_into_array.yml
@@ -4,12 +4,18 @@ Style/MapIntoArray:
   Exclude:
     - 'app/finders/projects/members/effective_access_level_finder.rb'
     - 'app/services/packages/nuget/extract_metadata_content_service.rb'
+    - 'app/services/snippets/base_service.rb'
     - 'config/settings.rb'
+    - 'ee/app/workers/product_analytics/move_funnels_worker.rb'
+    - 'ee/lib/elastic/latest/user_class_proxy.rb'
+    - 'ee/lib/gitlab/search/zoekt/client.rb'
     - 'ee/spec/lib/search/elastic/references/embedding_spec.rb'
     - 'lib/gitlab/database/query_analyzers/prevent_set_operator_mismatch/node.rb'
     - 'lib/gitlab/git/blame.rb'
     - 'lib/gitlab/grape_logging/loggers/exception_logger.rb'
     - 'lib/google_api/cloud_platform/client.rb'
     - 'qa/qa/tools/delete_user_projects.rb'
+    - 'qa/qa/tools/generate_perf_testdata.rb'
     - 'spec/lib/gitlab/color_schemes_spec.rb'
+    - 'spec/lib/gitlab/git/blame_spec.rb'
     - 'spec/lib/gitlab/themes_spec.rb'
diff --git a/GITLAB_KAS_VERSION b/GITLAB_KAS_VERSION
index 89b4cc04091..a3c93503315 100644
--- a/GITLAB_KAS_VERSION
+++ b/GITLAB_KAS_VERSION
@@ -1 +1 @@
-456a8af358cfde87bef3b63373bdf8b7b3ab9032
+4fe9bfd64a3a6ed177743db3f0905aaffb2c10c2
diff --git a/Gemfile.checksum b/Gemfile.checksum
index 5851869209b..c1633e7243c 100644
--- a/Gemfile.checksum
+++ b/Gemfile.checksum
@@ -238,7 +238,7 @@
 {"name":"gitlab-net-dns","version":"0.9.2","platform":"ruby","checksum":"f726d978479d43810819f12a45c0906d775a07e34df111bbe693fffbbef3059d"},
 {"name":"gitlab-sdk","version":"0.3.1","platform":"ruby","checksum":"48ba49084f4ab92df7c7ef9f347020d9dfdf6ed9c1e782b67264e98ffe6ea710"},
 {"name":"gitlab-security_report_schemas","version":"0.1.2.min15.0.0.max15.2.1","platform":"ruby","checksum":"300037487ec9d51a814f648514ff521cb82b94fc51d9fe53389175b36ac680ae"},
-{"name":"gitlab-styles","version":"13.0.1","platform":"ruby","checksum":"bf1840fe97b215ab76fe1f1a83af0aee30d33ded905415918462b832004b68bd"},
+{"name":"gitlab-styles","version":"13.0.2","platform":"ruby","checksum":"e662b9334643763b55a861f9e26091096547f98179bd89b0fa8d6c6fb8cec861"},
 {"name":"gitlab_chronic_duration","version":"0.12.0","platform":"ruby","checksum":"0d766944d415b5c831f176871ee8625783fc0c5bfbef2d79a3a616f207ffc16d"},
 {"name":"gitlab_omniauth-ldap","version":"2.2.0","platform":"ruby","checksum":"bb4d20acb3b123ed654a8f6a47d3fac673ece7ed0b6992edb92dca14bad2838c"},
 {"name":"gitlab_quality-test_tooling","version":"2.2.0","platform":"ruby","checksum":"d8fdaa7e5b529d0157485db4c81876a492303b53f30d9e8246f91f37f689295a"},
@@ -610,7 +610,7 @@
 {"name":"rspec-support","version":"3.13.1","platform":"ruby","checksum":"48877d4f15b772b7538f3693c22225f2eda490ba65a0515c4e7cf6f2f17de70f"},
 {"name":"rspec_junit_formatter","version":"0.6.0","platform":"ruby","checksum":"40dde674e6ae4e6cc0ff560da25497677e34fefd2338cc467a8972f602b62b15"},
 {"name":"rspec_profiling","version":"0.0.9","platform":"ruby","checksum":"6199be2daeaa14bac3d10d704dbb0a8df052cf046332c505603263aea24f7590"},
-{"name":"rubocop","version":"1.67.0","platform":"ruby","checksum":"8ccca7226e76d0a9974af960ea446d1fb38adf0c491214294e2fed75a85c378c"},
+{"name":"rubocop","version":"1.68.0","platform":"ruby","checksum":"07df508504d81e97174e8d21030f25d52c1be7ee8615939db43f3b377ea6c12b"},
 {"name":"rubocop-ast","version":"1.32.3","platform":"ruby","checksum":"40201e861c73a3c2d59428c7627828ef81fb2f8a306bc4a1c1801452afe3fe0f"},
 {"name":"rubocop-capybara","version":"2.21.0","platform":"ruby","checksum":"5d264efdd8b6c7081a3d4889decf1451a1cfaaec204d81534e236bc825b280ab"},
 {"name":"rubocop-factory_bot","version":"2.26.1","platform":"ruby","checksum":"8de13cd4edcee5ca800f255188167ecef8dbfc3d1fae9f15734e9d2e755392aa"},
diff --git a/Gemfile.lock b/Gemfile.lock
index 91a57ee4b98..22d646d7d71 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -777,8 +777,8 @@ GEM
     gitlab-security_report_schemas (0.1.2.min15.0.0.max15.2.1)
       activesupport (>= 6, < 8)
       json_schemer (~> 2.3.0)
-    gitlab-styles (13.0.1)
-      rubocop (~> 1.67.0)
+    gitlab-styles (13.0.2)
+      rubocop (~> 1.68.0)
       rubocop-capybara (~> 2.21.0)
       rubocop-factory_bot (~> 2.26.1)
       rubocop-graphql (~> 1.5.4)
@@ -1636,7 +1636,7 @@ GEM
       activerecord
       get_process_mem
       rails
-    rubocop (1.67.0)
+    rubocop (1.68.0)
       json (~> 2.3)
       language_server-protocol (>= 3.17.0)
       parallel (~> 1.10)
diff --git a/Gemfile.next.checksum b/Gemfile.next.checksum
index 130d3eb2905..e6ba3b995f5 100644
--- a/Gemfile.next.checksum
+++ b/Gemfile.next.checksum
@@ -239,7 +239,7 @@
 {"name":"gitlab-net-dns","version":"0.9.2","platform":"ruby","checksum":"f726d978479d43810819f12a45c0906d775a07e34df111bbe693fffbbef3059d"},
 {"name":"gitlab-sdk","version":"0.3.1","platform":"ruby","checksum":"48ba49084f4ab92df7c7ef9f347020d9dfdf6ed9c1e782b67264e98ffe6ea710"},
 {"name":"gitlab-security_report_schemas","version":"0.1.2.min15.0.0.max15.2.1","platform":"ruby","checksum":"300037487ec9d51a814f648514ff521cb82b94fc51d9fe53389175b36ac680ae"},
-{"name":"gitlab-styles","version":"13.0.1","platform":"ruby","checksum":"bf1840fe97b215ab76fe1f1a83af0aee30d33ded905415918462b832004b68bd"},
+{"name":"gitlab-styles","version":"13.0.2","platform":"ruby","checksum":"e662b9334643763b55a861f9e26091096547f98179bd89b0fa8d6c6fb8cec861"},
 {"name":"gitlab_chronic_duration","version":"0.12.0","platform":"ruby","checksum":"0d766944d415b5c831f176871ee8625783fc0c5bfbef2d79a3a616f207ffc16d"},
 {"name":"gitlab_omniauth-ldap","version":"2.2.0","platform":"ruby","checksum":"bb4d20acb3b123ed654a8f6a47d3fac673ece7ed0b6992edb92dca14bad2838c"},
 {"name":"gitlab_quality-test_tooling","version":"2.2.0","platform":"ruby","checksum":"d8fdaa7e5b529d0157485db4c81876a492303b53f30d9e8246f91f37f689295a"},
@@ -620,7 +620,7 @@
 {"name":"rspec-support","version":"3.13.1","platform":"ruby","checksum":"48877d4f15b772b7538f3693c22225f2eda490ba65a0515c4e7cf6f2f17de70f"},
 {"name":"rspec_junit_formatter","version":"0.6.0","platform":"ruby","checksum":"40dde674e6ae4e6cc0ff560da25497677e34fefd2338cc467a8972f602b62b15"},
 {"name":"rspec_profiling","version":"0.0.9","platform":"ruby","checksum":"6199be2daeaa14bac3d10d704dbb0a8df052cf046332c505603263aea24f7590"},
-{"name":"rubocop","version":"1.67.0","platform":"ruby","checksum":"8ccca7226e76d0a9974af960ea446d1fb38adf0c491214294e2fed75a85c378c"},
+{"name":"rubocop","version":"1.68.0","platform":"ruby","checksum":"07df508504d81e97174e8d21030f25d52c1be7ee8615939db43f3b377ea6c12b"},
 {"name":"rubocop-ast","version":"1.32.3","platform":"ruby","checksum":"40201e861c73a3c2d59428c7627828ef81fb2f8a306bc4a1c1801452afe3fe0f"},
 {"name":"rubocop-capybara","version":"2.21.0","platform":"ruby","checksum":"5d264efdd8b6c7081a3d4889decf1451a1cfaaec204d81534e236bc825b280ab"},
 {"name":"rubocop-factory_bot","version":"2.26.1","platform":"ruby","checksum":"8de13cd4edcee5ca800f255188167ecef8dbfc3d1fae9f15734e9d2e755392aa"},
diff --git a/Gemfile.next.lock b/Gemfile.next.lock
index 7a6f70d3c54..a73ab81b1a6 100644
--- a/Gemfile.next.lock
+++ b/Gemfile.next.lock
@@ -787,8 +787,8 @@ GEM
     gitlab-security_report_schemas (0.1.2.min15.0.0.max15.2.1)
       activesupport (>= 6, < 8)
       json_schemer (~> 2.3.0)
-    gitlab-styles (13.0.1)
-      rubocop (~> 1.67.0)
+    gitlab-styles (13.0.2)
+      rubocop (~> 1.68.0)
       rubocop-capybara (~> 2.21.0)
       rubocop-factory_bot (~> 2.26.1)
       rubocop-graphql (~> 1.5.4)
@@ -1662,7 +1662,7 @@ GEM
       activerecord
       get_process_mem
       rails
-    rubocop (1.67.0)
+    rubocop (1.68.0)
       json (~> 2.3)
       language_server-protocol (>= 3.17.0)
       parallel (~> 1.10)
diff --git a/app/assets/javascripts/ci/pipeline_editor/components/file_tree/container.vue b/app/assets/javascripts/ci/pipeline_editor/components/file_tree/container.vue
index 59653c2b2d9..12627172982 100644
--- a/app/assets/javascripts/ci/pipeline_editor/components/file_tree/container.vue
+++ b/app/assets/javascripts/ci/pipeline_editor/components/file_tree/container.vue
@@ -54,7 +54,7 @@ export default {
     <div
       v-gl-tooltip
       :title="ciConfigPath"
-      class="gl-mb-3 gl-rounded-base gl-bg-gray-50 gl-px-3 gl-py-2"
+      class="gl-mb-3 gl-rounded-base gl-bg-strong gl-px-3 gl-py-2"
     >
       <span class="file-row-name gl-str-truncated" :title="ciConfigPath">
         <file-icon class="file-row-icon" :file-name="ciConfigPath" />
diff --git a/app/assets/javascripts/ci/pipeline_editor/components/file_tree/file_item.vue b/app/assets/javascripts/ci/pipeline_editor/components/file_tree/file_item.vue
index 3a57a36fb61..78eb9d6c56a 100644
--- a/app/assets/javascripts/ci/pipeline_editor/components/file_tree/file_item.vue
+++ b/app/assets/javascripts/ci/pipeline_editor/components/file_tree/file_item.vue
@@ -34,7 +34,7 @@ export default {
     :href="filePath"
     :title="fileName"
     target="_blank"
-    class="file-tree-includes-link gl-flex gl-justify-between gl-rounded-base gl-px-3 gl-py-2 gl-text-default hover:gl-bg-gray-50 hover:gl-text-gray-900 hover:gl-no-underline"
+    class="file-tree-includes-link gl-flex gl-justify-between gl-rounded-base gl-px-3 gl-py-2 gl-text-default hover:gl-bg-strong hover:gl-text-strong hover:gl-no-underline"
   >
     <span class="file-row-name gl-str-truncated" :title="fileName">
       <file-icon class="file-row-icon" :file-name="fileName" />
diff --git a/app/assets/javascripts/content_editor/components/wrappers/code_block.vue b/app/assets/javascripts/content_editor/components/wrappers/code_block.vue
index 6b78897fd49..91f7db00def 100644
--- a/app/assets/javascripts/content_editor/components/wrappers/code_block.vue
+++ b/app/assets/javascripts/content_editor/components/wrappers/code_block.vue
@@ -290,8 +290,11 @@ export default {
       <node-view-content
         ref="nodeViewContent"
         as="code"
-        class="line_content new code gl-relative gl-z-1 !gl-break-words gl-text-sm"
-        :class="themeClass"
+        class="gl-relative gl-z-1 !gl-break-words"
+        :class="{
+          'line_content new code': isCodeSuggestion,
+          themeClass: isCodeSuggestion,
+        }"
         spellcheck="false"
         data-testid="suggestion-field"
       />
diff --git a/app/assets/javascripts/content_editor/constants/code_block_languages.js b/app/assets/javascripts/content_editor/constants/code_block_languages.js
index 1a4dbe4fa22..caa43b1c87e 100644
--- a/app/assets/javascripts/content_editor/constants/code_block_languages.js
+++ b/app/assets/javascripts/content_editor/constants/code_block_languages.js
@@ -66,6 +66,7 @@ const CODE_BLOCK_LANGUAGES = [
   { syntax: 'gauss', variants: 'gss', label: 'GAUSS' },
   { syntax: 'gcode', variants: 'nc', label: 'G-code (ISO 6983)' },
   { syntax: 'gherkin', variants: 'feature', label: 'Gherkin' },
+  { syntax: 'glql', label: 'GitLab Query Language (GLQL)' },
   { syntax: 'glsl', label: 'GLSL' },
   { syntax: 'gml', label: 'GML' },
   { syntax: 'go', variants: 'golang', label: 'Go' },
diff --git a/app/assets/javascripts/diffs/components/app.vue b/app/assets/javascripts/diffs/components/app.vue
index be2a2309383..3adf1530687 100644
--- a/app/assets/javascripts/diffs/components/app.vue
+++ b/app/assets/javascripts/diffs/components/app.vue
@@ -4,6 +4,7 @@ import { GlBreakpointInstance as bp } from '@gitlab/ui/dist/utils';
 import { debounce, throttle } from 'lodash';
 // eslint-disable-next-line no-restricted-imports
 import { mapState, mapGetters, mapActions } from 'vuex';
+import FindingsDrawer from 'ee_component/diffs/components/shared/findings_drawer.vue';
 import glFeatureFlagsMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import { convertToGraphQLId } from '~/graphql_shared/utils';
 import api from '~/api';
@@ -51,7 +52,6 @@ import { reviewStatuses } from '../utils/file_reviews';
 import { diffsApp } from '../utils/performance';
 import { updateChangesTabCount, extractFileHash } from '../utils/merge_request';
 import { queueRedisHllEvents } from '../utils/queue_events';
-import FindingsDrawer from './shared/findings_drawer.vue';
 import CollapsedFilesWarning from './collapsed_files_warning.vue';
 import CommitWidget from './commit_widget.vue';
 import CompareVersions from './compare_versions.vue';
diff --git a/app/assets/javascripts/diffs/components/diff_file_header.vue b/app/assets/javascripts/diffs/components/diff_file_header.vue
index 3ab00261aac..8c248162cb0 100644
--- a/app/assets/javascripts/diffs/components/diff_file_header.vue
+++ b/app/assets/javascripts/diffs/components/diff_file_header.vue
@@ -340,7 +340,7 @@ export default {
         v-if="isModeChanged"
         ref="fileMode"
         v-gl-tooltip.hover.focus
-        class="mr-1"
+        class="gl-mr-2 gl-text-subtle"
         :title="$options.i18n.fileModeTooltip"
       >
         {{ diffFile.a_mode }} → {{ diffFile.b_mode }}
diff --git a/app/assets/javascripts/diffs/components/diff_file_row.vue b/app/assets/javascripts/diffs/components/diff_file_row.vue
index 21f062233cc..92de29e1a4c 100644
--- a/app/assets/javascripts/diffs/components/diff_file_row.vue
+++ b/app/assets/javascripts/diffs/components/diff_file_row.vue
@@ -43,7 +43,7 @@ export default {
     fileClasses() {
       return this.file.type === 'blob' && !this.viewedFiles[this.file.fileHash]
         ? 'gl-font-bold'
-        : '';
+        : 'gl-text-subtle';
     },
     isActive() {
       return this.currentDiffFileId === this.file.fileHash;
@@ -62,7 +62,7 @@ export default {
     :file-classes="fileClasses"
     v-on="$listeners"
   >
-    <file-row-stats v-if="showFileRowStats" :file="file" class="mr-1" />
+    <file-row-stats v-if="showFileRowStats" :file="file" class="gl-mr-2" />
     <changed-file-icon :file="file" :size="16" :show-tooltip="true" />
   </file-row>
 </template>
diff --git a/app/assets/javascripts/diffs/components/shared/findings_drawer.vue b/app/assets/javascripts/diffs/components/shared/findings_drawer.vue
deleted file mode 100644
index 578b559fa85..00000000000
--- a/app/assets/javascripts/diffs/components/shared/findings_drawer.vue
+++ /dev/null
@@ -1,138 +0,0 @@
-<script>
-import { GlDrawer, GlButton, GlButtonGroup, GlIcon, GlTooltipDirective } from '@gitlab/ui';
-import { s__ } from '~/locale';
-import { DRAWER_Z_INDEX } from '~/lib/utils/constants';
-import { getSeverity } from '~/ci/reports/utils';
-import { getContentWrapperHeight } from '~/lib/utils/dom_utils';
-import FindingsDrawerDetails from '~/diffs/components/shared/findings_drawer_details.vue';
-
-export const i18n = {
-  codeQualityFinding: s__('FindingsDrawer|Code Quality Finding'),
-  sastFinding: s__('FindingsDrawer|SAST Finding'),
-  codeQuality: s__('FindingsDrawer|Code Quality'),
-  detected: s__('FindingsDrawer|Detected in pipeline'),
-  nextButton: s__('FindingsDrawer|Next finding'),
-  previousButton: s__('FindingsDrawer|Previous finding'),
-};
-export const codeQuality = 'codeQuality';
-
-export default {
-  i18n,
-  codeQuality,
-  components: {
-    FindingsDrawerDetails,
-    GlDrawer,
-    GlButton,
-    GlButtonGroup,
-    GlIcon,
-  },
-  directives: {
-    GlTooltip: GlTooltipDirective,
-  },
-  props: {
-    drawer: {
-      type: Object,
-      required: true,
-    },
-    project: {
-      type: Object,
-      required: false,
-      default: () => {},
-    },
-  },
-  data() {
-    return {
-      activeIndex: 0,
-    };
-  },
-  computed: {
-    getDrawerHeaderHeight() {
-      return getContentWrapperHeight();
-    },
-    isCodeQuality() {
-      return this.activeElement.scale === this.$options.codeQuality;
-    },
-    activeElement() {
-      return this.drawer.findings[this.activeIndex];
-    },
-  },
-  DRAWER_Z_INDEX,
-  watch: {
-    drawer(newVal) {
-      this.activeIndex = newVal.index;
-    },
-  },
-  methods: {
-    getSeverity,
-    prev() {
-      if (this.activeIndex === 0) {
-        this.activeIndex = this.drawer.findings.length - 1;
-      } else {
-        this.activeIndex -= 1;
-      }
-    },
-    next() {
-      if (this.activeIndex === this.drawer.findings.length - 1) {
-        this.activeIndex = 0;
-      } else {
-        this.activeIndex += 1;
-      }
-    },
-  },
-};
-</script>
-<template>
-  <gl-drawer
-    :header-height="getDrawerHeaderHeight"
-    :z-index="$options.DRAWER_Z_INDEX"
-    class="findings-drawer"
-    :open="Object.keys(drawer).length !== 0"
-    @close="$emit('close')"
-  >
-    <template #title>
-      <h2 class="drawer-heading gl-mb-0 gl-mt-0 gl-w-28 gl-text-base">
-        <gl-icon
-          :size="12"
-          :name="getSeverity(activeElement).name"
-          :class="getSeverity(activeElement).class"
-          class="inline-findings-severity-icon !gl-align-baseline"
-        />
-        <span class="drawer-heading-severity">{{ activeElement.severity }}</span>
-        {{ isCodeQuality ? $options.i18n.codeQualityFinding : $options.i18n.sastFinding }}
-      </h2>
-      <div v-if="drawer.findings.length > 1">
-        <gl-button-group>
-          <gl-button
-            v-gl-tooltip.bottom
-            :title="$options.i18n.previousButton"
-            :aria-label="$options.i18n.previousButton"
-            size="small"
-            data-testid="findings-drawer-prev-button"
-            @click="prev"
-          >
-            <gl-icon
-              :size="14"
-              class="findings-drawer-nav-button gl-relative"
-              name="chevron-lg-left"
-            />
-          </gl-button>
-          <gl-button size="small" @click="next">
-            <gl-icon
-              v-gl-tooltip.bottom
-              data-testid="findings-drawer-next-button"
-              :title="$options.i18n.nextButton"
-              :aria-label="$options.i18n.nextButton"
-              class="findings-drawer-nav-button gl-relative"
-              :size="14"
-              name="chevron-lg-right"
-            />
-          </gl-button>
-        </gl-button-group>
-      </div>
-    </template>
-
-    <template #default>
-      <findings-drawer-details :drawer="activeElement" :project="project" />
-    </template>
-  </gl-drawer>
-</template>
diff --git a/app/assets/javascripts/diffs/components/shared/findings_drawer_details.vue b/app/assets/javascripts/diffs/components/shared/findings_drawer_details.vue
deleted file mode 100644
index 1b48f5ffe57..00000000000
--- a/app/assets/javascripts/diffs/components/shared/findings_drawer_details.vue
+++ /dev/null
@@ -1,119 +0,0 @@
-<script>
-import { GlBadge, GlLink } from '@gitlab/ui';
-import { __, s__ } from '~/locale';
-import DrawerItem from '~/diffs/components/shared/findings_drawer_item.vue';
-import { SAST_FINDING_DISMISSED } from '~/diffs/constants';
-
-export default {
-  name: 'FindingsDrawerDetails',
-  DrawerItem,
-  components: { DrawerItem, GlBadge, GlLink },
-  props: {
-    drawer: {
-      type: Object,
-      required: true,
-    },
-    project: {
-      type: Object,
-      required: false,
-      default: () => {},
-    },
-  },
-  computed: {
-    findingsStatus() {
-      return this.drawer.state === SAST_FINDING_DISMISSED ? 'muted' : 'warning';
-    },
-    isCodeQuality() {
-      return this.drawer.scale === this.$options.codeQuality;
-    },
-  },
-  methods: {
-    concatIdentifierName(name, index) {
-      return name + (index !== this.drawer.identifiers.length - 1 ? ', ' : '');
-    },
-  },
-  i18n: {
-    name: __('Name'),
-    status: __('Status'),
-    description: __('Description'),
-    project: __('Project'),
-    file: __('File'),
-    identifiers: __('Identifiers'),
-    tool: __('Tool'),
-    codeQuality: s__('FindingsDrawer|Code Quality'),
-    sast: __('SAST'),
-    engine: __('Engine'),
-  },
-};
-</script>
-
-<template>
-  <ul class="gl-mb-0 gl-list-none !gl-pb-0 gl-border-b-initial">
-    <drawer-item
-      v-if="drawer.title"
-      :description="$options.i18n.name"
-      :value="drawer.title"
-      data-testid="findings-drawer-title"
-    />
-
-    <drawer-item v-if="drawer.state" :description="$options.i18n.status">
-      <template #value>
-        <gl-badge :variant="findingsStatus" class="text-capitalize">{{ drawer.state }}</gl-badge>
-      </template>
-    </drawer-item>
-
-    <drawer-item
-      v-if="drawer.description"
-      :description="$options.i18n.description"
-      :value="drawer.description"
-    />
-
-    <drawer-item
-      v-if="project && drawer.scale !== $options.codeQuality"
-      :description="$options.i18n.project"
-    >
-      <template #value>
-        <gl-link :href="`/${project.fullPath}`">{{ project.nameWithNamespace }}</gl-link>
-      </template>
-    </drawer-item>
-
-    <drawer-item v-if="drawer.location || drawer.webUrl" :description="$options.i18n.file">
-      <template #value>
-        <span v-if="drawer.webUrl && drawer.filePath && drawer.line">
-          <gl-link :href="drawer.webUrl">{{ drawer.filePath }}:{{ drawer.line }}</gl-link>
-        </span>
-        <span v-else-if="drawer.location">
-          {{ drawer.location.file }}:{{ drawer.location.startLine }}
-        </span>
-      </template>
-    </drawer-item>
-
-    <drawer-item
-      v-if="drawer.identifiers && drawer.identifiers.length"
-      :description="$options.i18n.identifiers"
-    >
-      <template #value>
-        <span v-for="(identifier, index) in drawer.identifiers" :key="identifier.externalId">
-          <gl-link v-if="identifier.url" :href="identifier.url">
-            {{ concatIdentifierName(identifier.name, index) }}
-          </gl-link>
-          <span v-else>
-            {{ concatIdentifierName(identifier.name, index) }}
-          </span>
-        </span>
-      </template>
-    </drawer-item>
-
-    <drawer-item
-      v-if="drawer.scale"
-      :description="$options.i18n.tool"
-      :value="isCodeQuality ? $options.i18n.codeQuality : $options.i18n.sast"
-    />
-
-    <drawer-item
-      v-if="drawer.engineName"
-      :description="$options.i18n.engine"
-      :value="drawer.engineName"
-    />
-  </ul>
-</template>
diff --git a/app/assets/javascripts/diffs/components/shared/findings_drawer_item.vue b/app/assets/javascripts/diffs/components/shared/findings_drawer_item.vue
deleted file mode 100644
index 65ba461b871..00000000000
--- a/app/assets/javascripts/diffs/components/shared/findings_drawer_item.vue
+++ /dev/null
@@ -1,28 +0,0 @@
-<script>
-export default {
-  props: {
-    description: {
-      type: String,
-      required: false,
-      default: '',
-    },
-    value: {
-      type: String,
-      required: false,
-      default: '',
-    },
-  },
-};
-</script>
-<template>
-  <li class="gl-mb-4">
-    <p class="gl-leading-20">
-      <span data-testid="findings-drawer-item-description" class="gl-mb-1 gl-block gl-font-bold">{{
-        description
-      }}</span>
-      <slot name="value">
-        <span data-testid="findings-drawer-item-value-prop">{{ value }}</span>
-      </slot>
-    </p>
-  </li>
-</template>
diff --git a/app/assets/javascripts/repository/components/blob_button_group.vue b/app/assets/javascripts/repository/components/blob_button_group.vue
index 3aec35ee960..f8d43a0922e 100644
--- a/app/assets/javascripts/repository/components/blob_button_group.vue
+++ b/app/assets/javascripts/repository/components/blob_button_group.vue
@@ -1,6 +1,8 @@
 <script>
 import { GlButtonGroup, GlButton } from '@gitlab/ui';
 import { uniqueId } from 'lodash';
+import axios from '~/lib/utils/axios_utils';
+import { visitUrl } from '~/lib/utils/url_utility';
 import { sprintf, __ } from '~/locale';
 import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import getRefMixin from '../mixins/get_ref';
@@ -105,6 +107,15 @@ export default {
 
       this.$refs[modalId].show();
     },
+    handleBlobDelete(formData) {
+      return axios({
+        method: 'post',
+        url: this.deletePath,
+        data: formData,
+      }).then((response) => {
+        visitUrl(response.data.filePath);
+      });
+    },
   },
   replaceBlobModalId: REPLACE_BLOB_MODAL_ID,
 };
@@ -144,7 +155,6 @@ export default {
     <commit-changes-modal
       :ref="deleteModalId"
       :modal-id="deleteModalId"
-      :delete-path="deletePath"
       :commit-message="deleteModalCommitMessage"
       :target-branch="targetBranch || ref"
       :original-branch="originalBranch || ref"
@@ -152,6 +162,11 @@ export default {
       :can-push-to-branch="canPushToBranch"
       :empty-repo="emptyRepo"
       :is-using-lfs="isUsingLfs"
-    />
+      :handle-form-submit="handleBlobDelete"
+    >
+      <template #form-fields>
+        <input type="hidden" name="_method" value="delete" />
+      </template>
+    </commit-changes-modal>
   </div>
 </template>
diff --git a/app/assets/javascripts/repository/components/commit_changes_modal.vue b/app/assets/javascripts/repository/components/commit_changes_modal.vue
index 9b0b7d53575..90535115a0e 100644
--- a/app/assets/javascripts/repository/components/commit_changes_modal.vue
+++ b/app/assets/javascripts/repository/components/commit_changes_modal.vue
@@ -1,5 +1,6 @@
 <script>
 import {
+  GlAlert,
   GlModal,
   GlFormCheckbox,
   GlFormGroup,
@@ -25,6 +26,7 @@ import {
 export default {
   csrf,
   components: {
+    GlAlert,
     GlModal,
     GlFormCheckbox,
     GlFormGroup,
@@ -38,8 +40,14 @@ export default {
   },
   i18n: {
     BRANCH: __('Branch'),
+    BRANCH_IN_FORK_MESSAGE: __(
+      'GitLab will create a branch in your fork and start a merge request.',
+    ),
     CURRENT_BRANCH_LABEL: __('Commit to the current %{branchName} branch'),
     COMMIT_CHANGES: __('Commit changes'),
+    COMMIT_IN_BRANCH_MESSAGE: __(
+      'Your changes can be committed to %{branchName} because a merge request is open.',
+    ),
     COMMIT_LABEL,
     COMMIT_MESSAGE_HINT: __(
       'Try to keep the first line under 52 characters and the others under 72.',
@@ -65,10 +73,6 @@ export default {
       type: String,
       required: true,
     },
-    deletePath: {
-      type: String,
-      required: true,
-    },
     commitMessage: {
       type: String,
       required: true,
@@ -98,6 +102,15 @@ export default {
       required: false,
       default: false,
     },
+    branchAllowsCollaboration: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    handleFormSubmit: {
+      type: Function,
+      required: true,
+    },
   },
   data() {
     const form = {
@@ -174,7 +187,7 @@ export default {
         ? this.$options.i18n.LFS_WARNING_TITLE
         : this.$options.i18n.COMMIT_CHANGES;
     },
-    showDeleteForm() {
+    showForm() {
       return !this.isUsingLfs || (this.isUsingLfs && this.lfsWarningDismissed);
     },
   },
@@ -224,7 +237,15 @@ export default {
 
       this.loading = true;
       this.form.showValidation = false;
-      this.$refs.form.$el.submit();
+
+      const form = this.$refs.form.$el;
+      const formData = new FormData(form);
+
+      try {
+        this.handleFormSubmit(formData);
+      } finally {
+        this.loading = false;
+      }
     },
   },
   deleteLfsHelpPath: helpPagePath('topics/git/lfs', {
@@ -243,6 +264,7 @@ export default {
     :action-cancel="cancelOptions"
     @primary="handlePrimaryAction"
   >
+    <slot name="body"></slot>
     <div v-if="showLfsWarning">
       <p>
         <gl-sprintf :message="$options.i18n.LFS_WARNING_PRIMARY_CONTENT">
@@ -260,10 +282,10 @@ export default {
         </gl-sprintf>
       </p>
     </div>
-    <div v-if="showDeleteForm">
-      <gl-form ref="form" novalidate :action="deletePath" method="post">
-        <input type="hidden" name="_method" value="delete" />
+    <div v-if="showForm">
+      <gl-form ref="form" novalidate>
         <input :value="$options.csrf.token" type="hidden" name="authenticity_token" />
+        <slot name="form-fields"></slot>
         <template v-if="emptyRepo">
           <input type="hidden" name="branch_name" :value="originalBranch" class="js-branch-name" />
         </template>
@@ -354,6 +376,18 @@ export default {
               </gl-form-checkbox>
             </template>
           </gl-form-group>
+          <template v-else>
+            <gl-alert v-if="branchAllowsCollaboration" :dismissible="false" class="gl-my-3">
+              <gl-sprintf :message="$options.i18n.COMMIT_IN_BRANCH_MESSAGE">
+                <template #branchName
+                  ><strong>{{ originalBranch }}</strong>
+                </template>
+              </gl-sprintf></gl-alert
+            >
+            <gl-alert v-else :dismissible="false" class="gl-my-3">{{
+              $options.i18n.BRANCH_IN_FORK_MESSAGE
+            }}</gl-alert>
+          </template>
         </template>
       </gl-form>
     </div>
diff --git a/app/assets/javascripts/vue_shared/components/file_row.vue b/app/assets/javascripts/vue_shared/components/file_row.vue
index 04a34623372..4d94f5a4f09 100644
--- a/app/assets/javascripts/vue_shared/components/file_row.vue
+++ b/app/assets/javascripts/vue_shared/components/file_row.vue
@@ -156,7 +156,7 @@ export default {
         />
         <file-icon
           class="file-row-icon"
-          :class="{ 'text-secondary': file.type === 'tree' }"
+          :class="{ 'gl-text-subtle': file.type === 'tree' }"
           :file-name="file.name"
           :loading="file.loading"
           :folder="isTree"
diff --git a/app/assets/stylesheets/framework/diffs.scss b/app/assets/stylesheets/framework/diffs.scss
index 1f0464aaa15..292d1807e09 100644
--- a/app/assets/stylesheets/framework/diffs.scss
+++ b/app/assets/stylesheets/framework/diffs.scss
@@ -603,6 +603,7 @@ table.code {
 }
 
 .diff-wrap-lines .line_content {
+  font-size: 13px;
   white-space: pre-wrap;
 }
 
diff --git a/app/finders/issues_finder.rb b/app/finders/issues_finder.rb
index f907ffb3033..0d1799fc9c6 100644
--- a/app/finders/issues_finder.rb
+++ b/app/finders/issues_finder.rb
@@ -48,7 +48,8 @@ class IssuesFinder < IssuableFinder
   private
 
   def filter_items(items)
-    issues = super
+    issues = by_service_desk(items) # Call before super because we remove params
+    issues = super(issues)
     issues = by_due_date(issues)
     issues = by_due_after_or_before(issues)
     issues = by_confidential(issues)
@@ -119,6 +120,18 @@ class IssuesFinder < IssuableFinder
     items.with_issue_type(params[:issue_types])
   end
 
+  def by_service_desk(items)
+    return items unless params[:author_username] == "support-bot"
+
+    # Delete param so we don't additionally filter by author username
+    params.delete(:author_username)
+    # Also delete from here because we pass original_params to
+    # Issuables::AuthorFilter in IssuableFinder
+    original_params.delete(:author_username)
+
+    items.service_desk
+  end
+
   def by_negated_issue_types(items)
     issue_type_params = Array(not_params[:issue_types]).map(&:to_s) & WorkItems::Type.base_types.keys
     return items if issue_type_params.blank?
diff --git a/app/models/ci/job_token/allowlist.rb b/app/models/ci/job_token/allowlist.rb
index 3666e498286..c5248823d56 100644
--- a/app/models/ci/job_token/allowlist.rb
+++ b/app/models/ci/job_token/allowlist.rb
@@ -14,12 +14,12 @@ module Ci
       end
 
       def includes_group?(target_project)
-        allowlist_group_ids = group_links.pluck(:target_group_id)
-        target_project_group_path_ids = target_project.parent_groups.map(&:id)
+        group_links_for_target(target_project).any?
+      end
 
-        allowed_target_group_ids = allowlist_group_ids & target_project_group_path_ids
-
-        allowed_target_group_ids.any?
+      def nearest_scope_for_target_project(target_project)
+        source_links.with_target(target_project).first ||
+          group_links_for_target(target_project).first
       end
 
       def projects
@@ -70,6 +70,15 @@ module Ci
           .with_source(@source_project)
       end
 
+      def group_links_for_target(target_project)
+        target_group_ids = target_project.parent_groups.pluck(:id)
+        group_links.where(target_group_id: target_group_ids).order(
+          Arel.sql(
+            "array_position(ARRAY#{target_group_ids}::bigint[], ci_job_token_group_scope_links.target_group_id)"
+          )
+        )
+      end
+
       def target_project_ids
         source_links
           # pluck needed to avoid ci and main db join
diff --git a/app/models/ci/job_token/scope.rb b/app/models/ci/job_token/scope.rb
index a36a7d893e8..eb965ffe4d5 100644
--- a/app/models/ci/job_token/scope.rb
+++ b/app/models/ci/job_token/scope.rb
@@ -34,6 +34,14 @@ module Ci
         true
       end
 
+      def policy_allowed?(accessed_project, policy)
+        return true if self_referential?(accessed_project)
+        return true unless accessed_project.ci_inbound_job_token_scope_enabled?
+        return false unless inbound_accessible?(accessed_project)
+
+        policy_allowed_for_accessed_project?(accessed_project, policy)
+      end
+
       def outbound_projects
         outbound_allowlist.projects
       end
@@ -83,6 +91,17 @@ module Ci
         end
       end
 
+      def policy_allowed_for_accessed_project?(accessed_project, policy)
+        scope = nearest_scope(accessed_project)
+        return true if scope.default_permissions?
+
+        policy.to_s.in?(scope.job_token_policies)
+      end
+
+      def nearest_scope(accessed_project)
+        inbound_accessible_projects(accessed_project).nearest_scope_for_target_project(current_project)
+      end
+
       # We don't check the inbound allowlist here. That is because
       # the access check starts from the current project but the inbound
       # allowlist contains projects that can access the current project.
diff --git a/app/models/issue.rb b/app/models/issue.rb
index 3dda7d58045..fee5150d570 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -245,7 +245,14 @@ class Issue < ApplicationRecord
 
   scope :counts_by_state, -> { reorder(nil).group(:state_id).count }
 
-  scope :service_desk, -> { where(author: ::Users::Internal.support_bot) }
+  scope :service_desk, -> {
+    where(
+      "(author_id = ? AND work_item_type_id = ?) OR work_item_type_id = ?",
+      Users::Internal.support_bot.id,
+      WorkItems::Type.default_issue_type.id,
+      WorkItems::Type.default_by_type(:ticket).id
+    )
+  }
   scope :inc_relations_for_view, -> do
     includes(author: :status, assignees: :status)
     .allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/422155')
diff --git a/app/models/work_items/type.rb b/app/models/work_items/type.rb
index d45e0a78303..11eaff85c35 100644
--- a/app/models/work_items/type.rb
+++ b/app/models/work_items/type.rb
@@ -124,7 +124,7 @@ module WorkItems
     end
 
     def self.allowed_types_for_issues
-      base_types.keys.excluding('objective', 'key_result', 'epic', 'ticket')
+      base_types.keys.excluding('objective', 'key_result', 'epic')
     end
 
     # method overridden in EE to perform the corresponding checks for the Epic type
diff --git a/app/views/shared/integrations/_tabs.html.haml b/app/views/shared/integrations/_tabs.html.haml
index bb94590bb98..1607e09dbcf 100644
--- a/app/views/shared/integrations/_tabs.html.haml
+++ b/app/views/shared/integrations/_tabs.html.haml
@@ -1,4 +1,4 @@
-- custom_settings_title = @integration.title == 'Beyond Identity' && Feature.enabled?(:beyond_identity_exclusions) ? s_('Integrations|Exclusions') : s_('Integrations|Projects using custom settings')
+- custom_settings_title = @integration.title == 'Beyond Identity' ? s_('Integrations|Exclusions') : s_('Integrations|Projects using custom settings')
 - if integration.instance_level?
   .tabs.gl-tabs
     %div
diff --git a/app/views/shared/integrations/overrides.html.haml b/app/views/shared/integrations/overrides.html.haml
index f5e7948cc31..b54bbf394f6 100644
--- a/app/views/shared/integrations/overrides.html.haml
+++ b/app/views/shared/integrations/overrides.html.haml
@@ -5,7 +5,7 @@
 %h1.page-title.gl-text-size-h-display
   = @integration.title
 
-- if @integration.title == 'Beyond Identity' && Feature.enabled?(:beyond_identity_exclusions)
+- if @integration.title == 'Beyond Identity'
   .js-vue-beyond-identity-exclusions{ data: integration_overrides_data(@integration) }
 
 - else
diff --git a/config/events/change_require_codeowner_approval.yml b/config/events/change_require_codeowner_approval.yml
new file mode 100644
index 00000000000..228a90e4577
--- /dev/null
+++ b/config/events/change_require_codeowner_approval.yml
@@ -0,0 +1,21 @@
+---
+description: User changes require code owner approval protection.
+internal_events: true
+action: change_require_codeowner_approval
+identifiers:
+- project
+- namespace
+- user
+product_group: source_code
+milestone: '17.3'
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/160591
+distributions:
+- ce
+- ee
+tiers:
+- free
+- premium
+- ultimate
+additional_properties:
+  label:
+    description: location where the event happened - repository_settings or branch_rule_details
diff --git a/config/events/click_blob_results_show_more_less.yml b/config/events/click_blob_results_show_more_less.yml
index 81e7cfb3a5d..482a427d322 100644
--- a/config/events/click_blob_results_show_more_less.yml
+++ b/config/events/click_blob_results_show_more_less.yml
@@ -7,7 +7,7 @@ identifiers:
 - namespace
 - user
 additional_properties:
-  value:
+  label:
     description: Position of the result.
   property:
     description: Set to 'open' if show more is activated and 'close' if it is closed again.
diff --git a/config/events/click_create_issue_from_error.yml b/config/events/click_create_issue_from_error.yml
index ec9ffab8129..72db24276c7 100644
--- a/config/events/click_create_issue_from_error.yml
+++ b/config/events/click_create_issue_from_error.yml
@@ -11,3 +11,10 @@ tiers:
   - free
   - premium
   - ultimate
+additional_properties:
+  label:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  property:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  variant:
+    description: external or internal
diff --git a/config/events/users_clicked_license_testing_visit_external_website.yml b/config/events/click_external_link_license_compliance.yml
similarity index 100%
rename from config/events/users_clicked_license_testing_visit_external_website.yml
rename to config/events/click_external_link_license_compliance.yml
diff --git a/config/events/filter_ignored_status.yml b/config/events/filter_ignored_status.yml
index 50ccaab141b..33839310014 100644
--- a/config/events/filter_ignored_status.yml
+++ b/config/events/filter_ignored_status.yml
@@ -11,3 +11,10 @@ tiers:
   - free
   - premium
   - ultimate
+additional_properties:
+  label:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  property:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  variant:
+    description: external or internal
diff --git a/config/events/filter_resolved_status.yml b/config/events/filter_resolved_status.yml
index 383a5789022..8c51ab84a23 100644
--- a/config/events/filter_resolved_status.yml
+++ b/config/events/filter_resolved_status.yml
@@ -11,3 +11,10 @@ tiers:
   - free
   - premium
   - ultimate
+additional_properties:
+  label:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  property:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  variant:
+    description: external or internal
diff --git a/config/events/filter_unresolved_status.yml b/config/events/filter_unresolved_status.yml
index 5249e8b5065..0be0e94dbe7 100644
--- a/config/events/filter_unresolved_status.yml
+++ b/config/events/filter_unresolved_status.yml
@@ -11,3 +11,10 @@ tiers:
   - free
   - premium
   - ultimate
+additional_properties:
+  label:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  property:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  variant:
+    description: external or internal
diff --git a/config/events/press_enter_to_advanced_search.yml b/config/events/press_enter_to_advanced_search.yml
index d6ab13ca28e..b86017e0199 100644
--- a/config/events/press_enter_to_advanced_search.yml
+++ b/config/events/press_enter_to_advanced_search.yml
@@ -5,6 +5,9 @@ action: press_enter_to_advanced_search
 identifiers:
 - namespace
 - user
+additional_properties:
+  label:
+    description: Hardcoded value command_palette
 product_group: global_search
 milestone: '17.1'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/151681
diff --git a/config/events/sort_by_first_seen.yml b/config/events/sort_by_first_seen.yml
index 947a275020f..46acfff2fc7 100644
--- a/config/events/sort_by_first_seen.yml
+++ b/config/events/sort_by_first_seen.yml
@@ -11,3 +11,10 @@ tiers:
   - free
   - premium
   - ultimate
+additional_properties:
+  label:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  property:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  variant:
+    description: external or internal
diff --git a/config/events/sort_by_frequency.yml b/config/events/sort_by_frequency.yml
index 19d1abda7b1..c45bb8b7983 100644
--- a/config/events/sort_by_frequency.yml
+++ b/config/events/sort_by_frequency.yml
@@ -11,3 +11,10 @@ tiers:
   - free
   - premium
   - ultimate
+additional_properties:
+  label:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  property:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  variant:
+    description: external or internal
diff --git a/config/events/sort_by_last_seen.yml b/config/events/sort_by_last_seen.yml
index dd987394672..7a9c5f91f5e 100644
--- a/config/events/sort_by_last_seen.yml
+++ b/config/events/sort_by_last_seen.yml
@@ -11,3 +11,10 @@ tiers:
   - free
   - premium
   - ultimate
+additional_properties:
+  label:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  property:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  variant:
+    description: external or internal
diff --git a/config/events/unprotect_branch.yml b/config/events/unprotect_branch.yml
index 1c73917ede8..1863127cf41 100644
--- a/config/events/unprotect_branch.yml
+++ b/config/events/unprotect_branch.yml
@@ -18,4 +18,8 @@ tiers:
 - ultimate
 additional_properties:
   label:
-    description: location where the event happened - repository_settings or branch_rule_details 
+    description: location where the event happened - repository_settings or branch_rule_details
+  property:
+    description: branch rules
+  value:
+    description: branch value
diff --git a/config/events/update_ignored_status.yml b/config/events/update_ignored_status.yml
index eda034604fa..19b1ade560b 100644
--- a/config/events/update_ignored_status.yml
+++ b/config/events/update_ignored_status.yml
@@ -11,3 +11,10 @@ tiers:
   - free
   - premium
   - ultimate
+additional_properties:
+  label:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  property:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  variant:
+    description: external or internal
diff --git a/config/events/update_resolved_status.yml b/config/events/update_resolved_status.yml
index b69e706c3e3..d13d8b2b992 100644
--- a/config/events/update_resolved_status.yml
+++ b/config/events/update_resolved_status.yml
@@ -11,3 +11,10 @@ tiers:
   - free
   - premium
   - ultimate
+additional_properties:
+  label:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  property:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  variant:
+    description: external or internal
diff --git a/config/events/update_unresolved_status.yml b/config/events/update_unresolved_status.yml
index dbbf8c242f7..74b2b5e902f 100644
--- a/config/events/update_unresolved_status.yml
+++ b/config/events/update_unresolved_status.yml
@@ -11,3 +11,10 @@ tiers:
   - free
   - premium
   - ultimate
+additional_properties:
+  label:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  property:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  variant:
+    description: external or internal
diff --git a/config/events/users_visiting_testing_license_compliance_full_report.yml b/config/events/users_visiting_testing_license_compliance_full_report.yml
deleted file mode 100644
index 2c0a4dfce83..00000000000
--- a/config/events/users_visiting_testing_license_compliance_full_report.yml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-description: Tracks click on licence-compliance full report button
-internal_events: true
-action: click_full_report_license_compliance
-identifiers:
-  - project
-  - user
-  - namespace
-product_group: composition_analysis
-milestone: '17.0'
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/150952
-distributions:
-  - ee
-tiers:
-  - premium
-  - ultimate
diff --git a/config/events/view_error_details.yml b/config/events/view_error_details.yml
index 5b829412828..7d388d38caf 100644
--- a/config/events/view_error_details.yml
+++ b/config/events/view_error_details.yml
@@ -11,3 +11,10 @@ tiers:
   - free
   - premium
   - ultimate
+additional_properties:
+  label:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  property:
+    description: not actually used - to be fixed in https://gitlab.com/gitlab-org/gitlab/-/issues/501387
+  variant:
+    description: external or internal
diff --git a/config/feature_flags/beta/beyond_identity_exclusions.yml b/config/feature_flags/beta/beyond_identity_exclusions.yml
deleted file mode 100644
index 6b9c48cac17..00000000000
--- a/config/feature_flags/beta/beyond_identity_exclusions.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: beyond_identity_exclusions
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/454372
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/150664
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/457893
-milestone: '17.0'
-group: group::source code
-type: beta
-default_enabled: true
diff --git a/config/feature_flags/wip/enforce_job_token_policies.yml b/config/feature_flags/wip/enforce_job_token_policies.yml
new file mode 100644
index 00000000000..a58194885c6
--- /dev/null
+++ b/config/feature_flags/wip/enforce_job_token_policies.yml
@@ -0,0 +1,9 @@
+---
+name: enforce_job_token_policies
+feature_issue_url: https://gitlab.com/gitlab-org/govern/authorization/team-tasks/-/issues/67
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/169264
+rollout_issue_url:
+milestone: "17.7"
+group: group::authorization
+type: wip
+default_enabled: false
diff --git a/config/initializers/sidekiq.rb b/config/initializers/sidekiq.rb
index 81397aa9538..9efe767d24d 100644
--- a/config/initializers/sidekiq.rb
+++ b/config/initializers/sidekiq.rb
@@ -15,7 +15,6 @@ Gitlab::SidekiqSharding::Router.migrated_shards
 # can't be referred to.
 #
 # We do not need the custom command builder since Sidekiq will handle the typing of Redis arguments.
-queues_config_hash = Gitlab::Redis::Queues.params.except(:command_builder)
 queue_instance = ENV.fetch('SIDEKIQ_SHARD_NAME', Gitlab::Redis::Queues::SIDEKIQ_MAIN_SHARD_INSTANCE_NAME)
 queues_config_hash = Gitlab::Redis::Queues.instances[queue_instance].params.except(:command_builder)
 
diff --git a/db/migrate/20241126131337_add_default_permissions_to_group_scope_links.rb b/db/migrate/20241126131337_add_default_permissions_to_group_scope_links.rb
new file mode 100644
index 00000000000..c64e2e629a4
--- /dev/null
+++ b/db/migrate/20241126131337_add_default_permissions_to_group_scope_links.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddDefaultPermissionsToGroupScopeLinks < Gitlab::Database::Migration[2.2]
+  milestone '17.7'
+
+  def change
+    add_column :ci_job_token_group_scope_links, :default_permissions, :boolean, default: true, null: false
+  end
+end
diff --git a/db/migrate/20241126131359_add_default_permissions_to_project_scope_links.rb b/db/migrate/20241126131359_add_default_permissions_to_project_scope_links.rb
new file mode 100644
index 00000000000..b4aef453e59
--- /dev/null
+++ b/db/migrate/20241126131359_add_default_permissions_to_project_scope_links.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddDefaultPermissionsToProjectScopeLinks < Gitlab::Database::Migration[2.2]
+  milestone '17.7'
+
+  def change
+    add_column :ci_job_token_project_scope_links, :default_permissions, :boolean, default: true, null: false
+  end
+end
diff --git a/db/schema_migrations/20241126131337 b/db/schema_migrations/20241126131337
new file mode 100644
index 00000000000..e2e1b50dc48
--- /dev/null
+++ b/db/schema_migrations/20241126131337
@@ -0,0 +1 @@
+f09fcc2a54666828923787854ec7b5e0184a258016b85aea260740f7bb972ab5
\ No newline at end of file
diff --git a/db/schema_migrations/20241126131359 b/db/schema_migrations/20241126131359
new file mode 100644
index 00000000000..0b03ea672e1
--- /dev/null
+++ b/db/schema_migrations/20241126131359
@@ -0,0 +1 @@
+1994f25e32eb8a3fbb3c3357ab075a0db24a730e5bd434afda4dfc8e629ad05e
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index a64577c8e08..156626122a3 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -9006,7 +9006,8 @@ CREATE TABLE ci_job_token_group_scope_links (
     target_group_id bigint NOT NULL,
     added_by_id bigint,
     created_at timestamp with time zone NOT NULL,
-    job_token_policies jsonb DEFAULT '[]'::jsonb
+    job_token_policies jsonb DEFAULT '[]'::jsonb,
+    default_permissions boolean DEFAULT true NOT NULL
 );
 
 CREATE SEQUENCE ci_job_token_group_scope_links_id_seq
@@ -9025,7 +9026,8 @@ CREATE TABLE ci_job_token_project_scope_links (
     added_by_id bigint,
     created_at timestamp with time zone NOT NULL,
     direction smallint DEFAULT 0 NOT NULL,
-    job_token_policies jsonb DEFAULT '[]'::jsonb
+    job_token_policies jsonb DEFAULT '[]'::jsonb,
+    default_permissions boolean DEFAULT true NOT NULL
 );
 
 CREATE SEQUENCE ci_job_token_project_scope_links_id_seq
diff --git a/doc/.vale/gitlab_base/spelling-exceptions.txt b/doc/.vale/gitlab_base/spelling-exceptions.txt
index 5d0bfa83fe7..1f6f35b6b00 100644
--- a/doc/.vale/gitlab_base/spelling-exceptions.txt
+++ b/doc/.vale/gitlab_base/spelling-exceptions.txt
@@ -327,6 +327,7 @@ enqueued
 enqueues
 enricher
 enrichers
+Entra
 enum
 enums
 Enviroments
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index cbfd3c32d24..37d9a597ad1 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -10056,6 +10056,30 @@ Input type: `UpdateComplianceFrameworkInput`
 | <a id="mutationupdatecomplianceframeworkcomplianceframework"></a>`complianceFramework` | [`ComplianceFramework`](#complianceframework) | Compliance framework after mutation. |
 | <a id="mutationupdatecomplianceframeworkerrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
 
+### `Mutation.updateComplianceRequirement`
+
+DETAILS:
+**Introduced** in GitLab 17.7.
+**Status**: Experiment.
+
+Input type: `UpdateComplianceRequirementInput`
+
+#### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationupdatecompliancerequirementclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationupdatecompliancerequirementid"></a>`id` | [`ComplianceManagementComplianceFrameworkComplianceRequirementID!`](#compliancemanagementcomplianceframeworkcompliancerequirementid) | Global ID of the compliance requirement to update. |
+| <a id="mutationupdatecompliancerequirementparams"></a>`params` | [`ComplianceRequirementInput!`](#compliancerequirementinput) | Parameters to update the compliance requirement with. |
+
+#### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationupdatecompliancerequirementclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationupdatecompliancerequirementerrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
+| <a id="mutationupdatecompliancerequirementrequirement"></a>`requirement` | [`ComplianceRequirement`](#compliancerequirement) | Compliance requirement after updation. |
+
 ### `Mutation.updateContainerExpirationPolicy`
 
 Input type: `UpdateContainerExpirationPolicyInput`
@@ -39281,6 +39305,7 @@ Issue type.
 | <a id="issuetyperequirement"></a>`REQUIREMENT` | Requirement issue type. |
 | <a id="issuetypetask"></a>`TASK` | Task issue type. |
 | <a id="issuetypetest_case"></a>`TEST_CASE` | Test Case issue type. |
+| <a id="issuetypeticket"></a>`TICKET` | Ticket issue type. |
 
 ### `IterationSearchableField`
 
diff --git a/doc/development/permissions/custom_roles.md b/doc/development/permissions/custom_roles.md
index 34f9c9cc19d..882d02edc92 100644
--- a/doc/development/permissions/custom_roles.md
+++ b/doc/development/permissions/custom_roles.md
@@ -228,7 +228,7 @@ rule { custom_role_enables_read_dependency }.enable(:read_dependency)
 ```ruby
   let_it_be(:user) { create(:user) }
   let_it_be(:project) { create(:project, :repository, :in_group) }
-  let_it_be(:role) { create(:member_role, :guest, namespace: project.group, custom_permission: true) }
+  let_it_be(:role) { create(:member_role, :guest, :custom_permission, namespace: project.group) }
   let_it_be(:membership) { create(:project_member, :guest, member_role: role, user: user, project: project) }
 
   before do
@@ -254,7 +254,7 @@ rule { custom_role_enables_read_dependency }.enable(:read_dependency)
 ```ruby
   let_it_be(:user) { create(:user) }
   let_it_be(:project) { create(:project, :repository, :in_group) }
-  let_it_be(:role) { create(:member_role, :guest, namespace: project.group, custom_permission: true) }
+  let_it_be(:role) { create(:member_role, :guest, :custom_permission, namespace: project.group) }
   let_it_be(:membership) { create(:project_member, :guest, member_role: role, user: user, project: project) }
 
   before do
diff --git a/doc/user/compliance/audit_event_types.md b/doc/user/compliance/audit_event_types.md
index 8c7f6cbb003..9ae192fc47d 100644
--- a/doc/user/compliance/audit_event_types.md
+++ b/doc/user/compliance/audit_event_types.md
@@ -196,6 +196,7 @@ Audit event types belong to the following product categories.
 | [`smartcard_authentication_created`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/8120) | Triggered when a user authenticates with smartcard | **{check-circle}** Yes | GitLab [16.0](https://gitlab.com/gitlab-org/gitlab/-/issues/726) | User |
 | [`update_approval_rules`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/89939) | Event triggered on updating a merge approval rule | **{check-circle}** Yes | GitLab [15.2](https://gitlab.com/gitlab-org/gitlab/-/issues/363092) | Project |
 | [`update_compliance_framework`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74292) | Triggered when a compliance framework is updated | **{check-circle}** Yes | GitLab [14.6](https://gitlab.com/gitlab-org/gitlab/-/issues/340649) | Group |
+| [`update_compliance_requirement`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/169485) | Triggered when a compliance framework requirement is updated. | **{check-circle}** Yes | GitLab [17.7](https://gitlab.com/gitlab-org/gitlab/-/issues/470695) | Group |
 | [`update_status_check`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/84624) | Event triggered when an external status check is updated | **{check-circle}** Yes | GitLab [15.9](https://gitlab.com/gitlab-org/gitlab/-/issues/355805) | Project |
 
 ### Container registry
diff --git a/doc/user/project/integrations/beyond_identity.md b/doc/user/project/integrations/beyond_identity.md
index 4e083f84168..25ba451a59f 100644
--- a/doc/user/project/integrations/beyond_identity.md
+++ b/doc/user/project/integrations/beyond_identity.md
@@ -71,11 +71,7 @@ To skip the push check for [service accounts](../../profile/service_accounts.md)
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/454372) in GitLab 17.0 [with a flag](../../../administration/feature_flags.md) named `beyond_identity_exclusions`. Enabled by default.
 > - Ability to exclude groups [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/454372) in GitLab 17.1.
-
-FLAG:
-The availability of this feature is controlled by a feature flag.
-For more information, see the history.
-This feature is available for testing, but not ready for production use.
+> - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/457893) in GitLab 17.7. Feature flag `beyond_identity_exclusions` removed.
 
 Prerequisites:
 
diff --git a/doc/user/project/service_desk/configure.md b/doc/user/project/service_desk/configure.md
index ad4e7e06ea1..7a42921334b 100644
--- a/doc/user/project/service_desk/configure.md
+++ b/doc/user/project/service_desk/configure.md
@@ -418,8 +418,8 @@ Prerequisites:
 To configure a custom Service Desk email address with Google Workspace:
 
 1. [Configure a Google Workspace account](#configure-a-google-workspace-account).
-1. [Configure email forwarding](#configure-email-forwarding).
-1. [Configure custom email address](#configure-custom-email-address).
+1. [Configure email forwarding in Google Workspace](#configure-email-forwarding-in-google-workspace).
+1. [Configure custom email address using a Google Workspace account](#configure-custom-email-address-using-a-google-workspace-account).
 
 #### Configure a Google Workspace account
 
@@ -434,9 +434,9 @@ In Google Workspace:
    SMTP password.
    Store it in a secure place and remove spaces between the characters.
 
-Next, you must [configure email forwarding](#configure-email-forwarding).
+Next, you must [configure email forwarding in Google Workspace](#configure-email-forwarding-in-google-workspace).
 
-#### Configure email forwarding
+#### Configure email forwarding in Google Workspace
 
 The following steps require moving between GitLab and Google Workspace.
 
@@ -470,9 +470,10 @@ In Google Workspace:
    from the dropdown list.
 1. At the bottom of the page, select **Save Changes**.
 
-Next, [configure a custom email address](#configure-a-custom-email-address) to use with Service Desk.
+Next, [configure custom email address using a Google Workspace account](#configure-custom-email-address-using-a-google-workspace-account)
+to use with Service Desk.
 
-#### Configure custom email address
+#### Configure custom email address using a Google Workspace account
 
 In GitLab:
 
@@ -490,16 +491,144 @@ In GitLab:
 1. After the [verification process](#verification) you should be able to
    [enable the custom email address](#enable-or-disable-the-custom-email-address).
 
+### Use Microsoft 365 (Exchange online) with your own domain
+
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/496396) in GitLab 17.5.
+
+Set up a custom email address for Service Desk when using Microsoft 365 (Exchange) with your own domain.
+
+Prerequisites:
+
+- You already have a Microsoft 365 account.
+- You can create new accounts for your tenant.
+
+To configure a custom Service Desk email address with Microsoft 365:
+
+1. [Configure a Microsoft 365 account](#configure-a-microsoft-365-account).
+1. [Configure email forwarding in Microsoft 365](#configure-email-forwarding-in-microsoft-365).
+1. [Configure custom email address using a Microsoft 365 account](#configure-custom-email-address-using-a-microsoft-365-account).
+
+#### Configure a Microsoft 365 account
+
+First, you must create and configure a Microsoft 365 account.
+In this guide, use a licensed user for the custom email mailbox. 
+You can also experiment with other configuration options.
+
+In [Microsoft 365 admin center](https://admin.microsoft.com/Adminportal/Home#/homepage):
+
+1. Create a new account for the custom email address you'd like to use (for example, `support@example.com`).
+   1. Expand the **Users** section and select **Active users** from the menu.
+   1. Select **Add a user** and follow the instructions on the screen.
+1. In Microsoft Entra (previously named Active Directory), enable two-factor authentication for the account.
+1. [Allow users to create app passwords](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords).
+1. Enable **Authenticated SMTP** for the account.
+   1. Select the account from the list.
+   1. In the drawer select **Mail**.
+   1. Below **Email apps** select **Manage email apps**.
+   1. Check **Authenticated SMTP** and select **Save changes**.
+1. Depending on your overall Exchange online configuration you might need to configure the following:
+   1. Use Azure Cloud Shell to allow SMTP client authentication:
+
+      ```powershell
+      Set-TransportConfig -SmtpClientAuthenticationDisabled $false
+      ```
+
+   1. Use Azure Cloud Shell to allow
+      [legacy TLS clients using SMTP AUTH](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/opt-in-exchange-online-endpoint-for-legacy-tls-using-smtp-auth):
+
+      ```powershell
+      Set-TransportConfig -AllowLegacyTLSClients $true
+      ```
+
+   1. If you want to forward to an external recipient, please see this guide on how to enable
+      [external email forwarding](https://learn.microsoft.com/en-gb/defender-office-365/outbound-spam-policies-external-email-forwarding).
+      You might also want to [create an outbound anti-spam policy](https://security.microsoft.com/antispam)
+      to allow forwarding to external recipients only for users who need it.
+1. Sign in to that account and activate two-factor authentication.
+   <!-- vale gitlab_base.SubstitutionWarning = NO -->
+   1. From the menu in the upper-right corner, select **View account** and [browse to **Security Info**](https://mysignins.microsoft.com/security-info).
+   <!-- vale gitlab_base.SubstitutionWarning = YES -->
+   1. Select **Add sign-in method** and select a method that works for you (authenticator app, phone or email).
+   1. Follow the instructions on the screen.
+<!-- vale gitlab_base.SubstitutionWarning = NO -->
+1. On the [**Security Info**](https://mysignins.microsoft.com/security-info) page,
+   create an app password that you can use as your SMTP password.
+<!-- vale gitlab_base.SubstitutionWarning = YES -->
+   1. Select **Add sign-in method** and select **App password** from the dropdown list.
+   1. Set a descriptive name for the app password, such as `GitLab SD`.
+   1. Select **Next**.
+   1. Copy the displayed password and store it in a secure place.
+   1. Optional. Ensure you can send emails using SMTP using the [`swaks` command line tool](https://www.jetmore.org/john/code/swaks/).
+   1. Run the following command with your credentials and use the app password as the `auth-password`:
+
+      ```shell
+      swaks --to your-email@example.com \
+            --from custom-email@example.com \
+            --auth-user custom-email@example.com \
+            --server smtp.office365.com:587 \
+            -tls-optional \
+            --auth-password <your_app_password>
+      ```
+
+Next, you must [configure email forwarding in Microsoft 365](#configure-email-forwarding-in-microsoft-365).
+
+#### Configure email forwarding in Microsoft 365
+
+The following steps require moving between GitLab and Microsoft 365 admin center.
+
+In GitLab:
+
+1. On the left sidebar, select **Search or go to** and find your project.
+1. Select **Settings > General**
+1. Expand **Service Desk**.
+1. Note the email address below **Service Desk email address to forward emails to** without the
+   sub-address part.
+
+   Emails aren't forwarded if the recipient address contains a sub-address (for example reply
+   addresses generated by GitLab) and the forwarding email address contains a sub-address
+   (the **Service Desk email address to forward emails to**).
+
+   For example, `incoming+group-project-12346426-issue-@incoming.gitlab.com` becomes `incoming@incoming.gitlab.com`.
+   That's okay because Exchange online preserves the custom email address in the `To` header
+   after forwarding and GitLab can assign the correct project based on the custom email address.
+
+In [Microsoft 365 admin center](https://admin.microsoft.com/Adminportal/Home#/homepage):
+
+<!-- vale gitlab_base.SubstitutionWarning = NO -->
+1. Expand the **Users** section and select **Active users** from the menu.
+<!-- vale gitlab_base.SubstitutionWarning = YES -->
+1. Select the account you'd like to use for the custom email from the list.
+1. In the drawer select **Mail**.
+1. Below **Email forwarding** select **Manage email forwarding**.
+1. Check **Forward all emails sent to this mailbox**.
+1. Enter the Service Desk address from the custom email form in **Forwarding email address** without the sub-address part. 
+1. Select **Save changes**.
+
+Next, [configure a custom email address using a Microsoft 365 account](#configure-custom-email-address-using-a-microsoft-365-account)
+to use with Service Desk.
+
+#### Configure custom email address using a Microsoft 365 account
+
+In GitLab:
+
+1. On the left sidebar, select **Search or go to** and find your project.
+1. Select **Settings > General**
+1. Expand **Service Desk** and find the custom email settings.
+1. Complete the fields:
+   - **Custom email address**: Your custom email address.
+   - **SMTP host**: `smtp.office365.com`.
+   - **SMTP port**: `587`.
+   - **SMTP username**: Prefilled with the custom email address.
+   - **SMTP password**: The app password you previously created for the custom email account.
+   - **SMTP authentication method**: Login
+1. Select **Save and test connection**
+1. After the [verification process](#verification) you should be able to
+   [enable the custom email address](#enable-or-disable-the-custom-email-address).
+
 ### Known issues
 
 - Some service providers don't allow SMTP connections any more.
   Often you can enable them on a per user basis and create an app password.
-- Microsoft Exchange doesn't preserve the `From` header, so you cannot use a custom email from the same tenant.
-  As a workaround:
-  - On GitLab SaaS, use a transport rule to forward emails from the custom email address to the Service Desk email
-    from GitLab SaaS. Forwarding to an email address outside the current tenant preserves the original `From` header.
-  - On GitLab self-managed, use a subdomain or a different domain from another service provider for the
-    custom email address or the GitLab instance `incoming_email` or `service_desk_email`.
 
 ## Use an additional Service Desk alias email
 
diff --git a/lib/api/environments.rb b/lib/api/environments.rb
index a991cfe6c03..ef6265d36d3 100644
--- a/lib/api/environments.rb
+++ b/lib/api/environments.rb
@@ -39,6 +39,7 @@ module API
         mutually_exclusive :name, :search, message: 'cannot be used together'
       end
       route_setting :authentication, job_token_allowed: true
+      route_setting :authorization, job_token_policy: :read_environments
       get ':id/environments' do
         authorize! :read_environment, user_project
 
diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index 72c9e3f77cf..b7f1e3b06b2 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -169,6 +169,8 @@ module API
         return handle_job_token_failure!(project)
       end
 
+      return forbidden!(job_token_policy_unauthorized_message(project)) unless job_token_policy_authorized?(project)
+
       if project_moved?(id, project)
         return not_allowed!('Non GET methods are not allowed for moved projects') unless request.get?
 
@@ -995,6 +997,28 @@ module API
         not_found!('Project')
       end
     end
+
+    def job_token_policy_authorized?(project)
+      return true unless current_user&.from_ci_job_token?
+      return true unless Feature.enabled?(:enforce_job_token_policies, current_user)
+
+      current_user.ci_job_token_scope.policy_allowed?(project, job_token_policy)
+    end
+
+    def job_token_policy_unauthorized_message(project)
+      policy = job_token_policy
+      if policy.present?
+        format("The %{permission} permission on %{project} is not authorized for this CI/CD job token.", permission: policy, project: project.path)
+      else
+        'This action is not authorized for CI/CD job tokens.'
+      end
+    end
+
+    def job_token_policy
+      return unless respond_to?(:route_setting)
+
+      route_setting(:authorization).try(:fetch, :job_token_policy, nil)
+    end
   end
 end
 
diff --git a/lib/gitlab/search/found_blob.rb b/lib/gitlab/search/found_blob.rb
index eb4d61977ea..50c391f024a 100644
--- a/lib/gitlab/search/found_blob.rb
+++ b/lib/gitlab/search/found_blob.rb
@@ -9,7 +9,7 @@ module Gitlab
       include Gitlab::Utils::StrongMemoize
       include BlobActiveModel
 
-      attr_reader :project, :content_match, :blob_path, :highlight_line, :matched_lines_count, :group_level_blob, :group
+      attr_reader :project, :content_match, :blob_path, :highlight_line, :group_level_blob, :group
 
       PATH_REGEXP = /\A(?<ref>[^:]*):(?<path>[^\x00]*)\x00/
       CONTENT_REGEXP = /^(?<ref>[^:]*):(?<path>[^\x00]*)\x00(?<startline>\d+)\x00/
@@ -25,7 +25,6 @@ module Gitlab
         @binary_path = opts.fetch(:path, nil)
         @binary_basename = opts.fetch(:basename, nil)
         @ref = opts.fetch(:ref, nil)
-        @matched_lines_count = opts.fetch(:matched_lines_count, nil)
         @startline = opts.fetch(:startline, nil)
         @highlight_line = opts.fetch(:highlight_line, nil)
         @binary_data = opts.fetch(:data, nil)
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index abb44408e5c..b2b0eb66b5a 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -3899,6 +3899,9 @@ msgstr ""
 msgid "AdminSelfHostedModels|An error occurred while loading self-hosted models. Please try again."
 msgstr ""
 
+msgid "AdminSelfHostedModels|An error occurred while loading the self-hosted model. Please try again."
+msgstr ""
+
 msgid "AdminSelfHostedModels|An error occurred while updating the sefl-hosted model, please try again."
 msgstr ""
 
@@ -23046,6 +23049,9 @@ msgstr ""
 msgid "Failed to update branch!"
 msgstr ""
 
+msgid "Failed to update compliance requirement"
+msgstr ""
+
 msgid "Failed to update environment!"
 msgstr ""
 
@@ -36538,6 +36544,9 @@ msgstr ""
 msgid "Not permitted to reset user feed token"
 msgstr ""
 
+msgid "Not permitted to update requirement"
+msgstr ""
+
 msgid "Not ready yet. Try again later."
 msgstr ""
 
@@ -64339,6 +64348,9 @@ msgstr ""
 msgid "Your browser doesn't support WebAuthn. Please use a supported browser, e.g. Chrome (67+) or Firefox (60+)."
 msgstr ""
 
+msgid "Your changes can be committed to %{branchName} because a merge request is open."
+msgstr ""
+
 msgid "Your changes can be committed to %{branch_name} because a merge request is open."
 msgstr ""
 
diff --git a/scripts/frontend/quarantined_vue3_specs.txt b/scripts/frontend/quarantined_vue3_specs.txt
index dd87414f125..b34ce7891e3 100644
--- a/scripts/frontend/quarantined_vue3_specs.txt
+++ b/scripts/frontend/quarantined_vue3_specs.txt
@@ -36,7 +36,6 @@ ee/spec/frontend/boards/components/epic_board_content_sidebar_spec.js
 ee/spec/frontend/boards/components/epics_swimlanes_spec.js
 ee/spec/frontend/ci/pipeline_details/header/pipeline_header_spec.js
 ee/spec/frontend/ci/runner/components/runner_details_spec.js
-ee/spec/frontend/ci/runner/components/runner_header_spec.js
 ee/spec/frontend/ci/runner/components/stat/runner_upgrade_status_stats_spec.js
 ee/spec/frontend/ci/secrets/components/secrets_app_spec.js
 ee/spec/frontend/ci/secrets/components/secrets_breadcrumbs_spec.js
@@ -91,7 +90,6 @@ ee/spec/frontend/projects/settings/components/shared_runners_toggle_spec.js
 ee/spec/frontend/protected_environments/protected_environment_edit_spec.js
 ee/spec/frontend/related_items_tree/components/related_items_tree_body_spec.js
 ee/spec/frontend/related_items_tree/components/tree_root_spec.js
-ee/spec/frontend/repository/components/blob_button_group_spec.js
 ee/spec/frontend/requirements/components/requirement_item_spec.js
 ee/spec/frontend/requirements/components/requirements_root_spec.js
 ee/spec/frontend/roadmap/components/roadmap_shell_spec.js
diff --git a/spec/frontend/__helpers__/tracking_internal_events_helper.js b/spec/frontend/__helpers__/tracking_internal_events_helper.js
index 4fc90929df9..749fcd07df2 100644
--- a/spec/frontend/__helpers__/tracking_internal_events_helper.js
+++ b/spec/frontend/__helpers__/tracking_internal_events_helper.js
@@ -1,9 +1,60 @@
+import fs from 'fs/promises';
+import yaml from 'js-yaml';
 import { InternalEvents } from '~/tracking';
 
+async function loadYamlFile(path) {
+  try {
+    const fileData = await fs.readFile(path, 'utf8');
+    return yaml.safeLoad(fileData);
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      return null;
+    }
+    throw new Error(`Error reading event definition file at ${path}: ${err.message}`);
+  }
+}
+
+export async function readEventDefinition(eventName) {
+  const isEE = expect.getState().testPath.includes('/ee/');
+  const eePath = `./ee/config/events/${eventName}.yml`;
+  const cePath = `./config/events/${eventName}.yml`;
+
+  let eventDefinition;
+
+  if (isEE) {
+    eventDefinition = (await loadYamlFile(eePath)) || (await loadYamlFile(cePath));
+  } else {
+    eventDefinition = await loadYamlFile(cePath);
+  }
+
+  if (!eventDefinition) {
+    throw new Error(`Event definition file not found for ${eventName}`);
+  }
+
+  return eventDefinition;
+}
+
 export function useMockInternalEventsTracking() {
   let originalSnowplow;
   let trackEventSpy;
   let disposables = [];
+  let eventDefinition;
+
+  const validateEvent = async (eventName, properties) => {
+    eventDefinition = await readEventDefinition(eventName);
+    if (eventDefinition.action !== eventName) {
+      throw new Error(`Event "${eventName}" is not defined in event definitions.`);
+    }
+
+    const definedProperties = eventDefinition.additional_properties || {};
+    Object.keys(properties).forEach((prop) => {
+      if (!definedProperties[prop]) {
+        throw new Error(
+          `Property "${prop}" is not defined for event "${eventName} in event definition file".`,
+        );
+      }
+    });
+  };
 
   const bindInternalEventDocument = (parent = document) => {
     const dispose = InternalEvents.bindInternalEventDocument(parent);
@@ -21,15 +72,18 @@ export function useMockInternalEventsTracking() {
   };
 
   beforeEach(() => {
-    trackEventSpy = jest.spyOn(InternalEvents, 'trackEvent');
+    trackEventSpy = jest
+      .spyOn(InternalEvents, 'trackEvent')
+      .mockImplementation(async (eventName, properties = {}) => {
+        await validateEvent(eventName, properties);
+      });
+
     originalSnowplow = window.snowplow;
     window.snowplow = () => {};
   });
 
-  afterEach(() => {
-    disposables.forEach((dispose) => {
-      if (dispose) dispose();
-    });
+  afterEach(async () => {
+    await Promise.all(disposables.map((dispose) => dispose && dispose()));
     disposables = [];
     window.snowplow = originalSnowplow;
   });
diff --git a/spec/frontend/diffs/components/app_spec.js b/spec/frontend/diffs/components/app_spec.js
index 4d025aab13a..6fe33bd3f17 100644
--- a/spec/frontend/diffs/components/app_spec.js
+++ b/spec/frontend/diffs/components/app_spec.js
@@ -17,7 +17,7 @@ import CommitWidget from '~/diffs/components/commit_widget.vue';
 import CompareVersions from '~/diffs/components/compare_versions.vue';
 import DiffFile from '~/diffs/components/diff_file.vue';
 import NoChanges from '~/diffs/components/no_changes.vue';
-import FindingsDrawer from '~/diffs/components/shared/findings_drawer.vue';
+import FindingsDrawer from 'ee_component/diffs/components/shared/findings_drawer.vue';
 import DiffsFileTree from '~/diffs/components/diffs_file_tree.vue';
 import DiffAppControls from '~/diffs/components/diff_app_controls.vue';
 
diff --git a/spec/frontend/diffs/components/diff_file_row_spec.js b/spec/frontend/diffs/components/diff_file_row_spec.js
index 5fda5565010..abcf1ecffc2 100644
--- a/spec/frontend/diffs/components/diff_file_row_spec.js
+++ b/spec/frontend/diffs/components/diff_file_row_spec.js
@@ -55,9 +55,9 @@ describe('Diff File Row component', () => {
   it.each`
     fileType  | isViewed | expected
     ${'blob'} | ${false} | ${'gl-font-bold'}
-    ${'blob'} | ${true}  | ${''}
-    ${'tree'} | ${false} | ${''}
-    ${'tree'} | ${true}  | ${''}
+    ${'blob'} | ${true}  | ${'gl-text-subtle'}
+    ${'tree'} | ${false} | ${'gl-text-subtle'}
+    ${'tree'} | ${true}  | ${'gl-text-subtle'}
   `(
     'with (fileType="$fileType", isViewed=$isViewed), sets fileClasses="$expected"',
     ({ fileType, isViewed, expected }) => {
diff --git a/spec/frontend/diffs/components/shared/__snapshots__/findings_drawer_details_spec.js.snap b/spec/frontend/diffs/components/shared/__snapshots__/findings_drawer_details_spec.js.snap
deleted file mode 100644
index 3e126db3e60..00000000000
--- a/spec/frontend/diffs/components/shared/__snapshots__/findings_drawer_details_spec.js.snap
+++ /dev/null
@@ -1,129 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`Findings Drawer Details General Rendering matches the snapshot with detected badge 1`] = `
-<ul
-  class="!gl-pb-0 gl-border-b-initial gl-list-none gl-mb-0"
->
-  <drawer-item-stub
-    data-testid="findings-drawer-title"
-    description="Name"
-    value="mockedtitle"
-  />
-  <drawer-item-stub
-    description="Status"
-    value=""
-  >
-    <gl-badge-stub
-      class="text-capitalize"
-      iconsize="md"
-      tag="span"
-      target="_self"
-      variant="warning"
-    >
-      detected
-    </gl-badge-stub>
-  </drawer-item-stub>
-  <drawer-item-stub
-    description="Description"
-    value="fakedesc"
-  />
-  <drawer-item-stub
-    description="Project"
-    value=""
-  >
-    <gl-link-stub
-      href="/testpath"
-    >
-      testname
-    </gl-link-stub>
-  </drawer-item-stub>
-  <drawer-item-stub
-    description="File"
-    value=""
-  />
-  <drawer-item-stub
-    description="Identifiers"
-    value=""
-  >
-    <span>
-      <gl-link-stub
-        href="https://semgrep.dev/r/gitlab.eslint.detect-disable-mustache-escape"
-      >
-        eslint.detect-disable-mustache-escape
-      </gl-link-stub>
-    </span>
-  </drawer-item-stub>
-  <drawer-item-stub
-    description="Tool"
-    value="SAST"
-  />
-  <drawer-item-stub
-    description="Engine"
-    value="testengine name"
-  />
-</ul>
-`;
-
-exports[`Findings Drawer Details General Rendering matches the snapshot with dismissed badge 1`] = `
-<ul
-  class="!gl-pb-0 gl-border-b-initial gl-list-none gl-mb-0"
->
-  <drawer-item-stub
-    data-testid="findings-drawer-title"
-    description="Name"
-    value="mockedtitle"
-  />
-  <drawer-item-stub
-    description="Status"
-    value=""
-  >
-    <gl-badge-stub
-      class="text-capitalize"
-      iconsize="md"
-      tag="span"
-      target="_self"
-      variant="warning"
-    >
-      detected
-    </gl-badge-stub>
-  </drawer-item-stub>
-  <drawer-item-stub
-    description="Description"
-    value="fakedesc"
-  />
-  <drawer-item-stub
-    description="Project"
-    value=""
-  >
-    <gl-link-stub
-      href="/testpath"
-    >
-      testname
-    </gl-link-stub>
-  </drawer-item-stub>
-  <drawer-item-stub
-    description="File"
-    value=""
-  />
-  <drawer-item-stub
-    description="Identifiers"
-    value=""
-  >
-    <span>
-      <gl-link-stub
-        href="https://semgrep.dev/r/gitlab.eslint.detect-disable-mustache-escape"
-      >
-        eslint.detect-disable-mustache-escape
-      </gl-link-stub>
-    </span>
-  </drawer-item-stub>
-  <drawer-item-stub
-    description="Tool"
-    value="SAST"
-  />
-  <drawer-item-stub
-    description="Engine"
-    value="testengine name"
-  />
-</ul>
-`;
diff --git a/spec/frontend/diffs/components/shared/__snapshots__/findings_drawer_spec.js.snap b/spec/frontend/diffs/components/shared/__snapshots__/findings_drawer_spec.js.snap
deleted file mode 100644
index 35bd2abbe44..00000000000
--- a/spec/frontend/diffs/components/shared/__snapshots__/findings_drawer_spec.js.snap
+++ /dev/null
@@ -1,449 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`FindingsDrawer General Rendering matches the snapshot with detected badge 1`] = `
-<transition-stub
-  class="findings-drawer"
-  name="gl-drawer"
->
-  <aside
-    class="gl-drawer gl-drawer-default"
-    style="top: 0px; z-index: 252;"
-  >
-    <div
-      class="gl-drawer-header"
-    >
-      <div
-        class="gl-drawer-title"
-      >
-        <h2
-          class="drawer-heading gl-mb-0 gl-mt-0 gl-text-base gl-w-28"
-        >
-          <svg
-            aria-hidden="true"
-            class="!gl-align-baseline gl-fill-current gl-icon gl-text-orange-300 inline-findings-severity-icon s12"
-            data-testid="severity-low-icon"
-            role="img"
-          >
-            <use
-              href="file-mock#severity-low"
-            />
-          </svg>
-          <span
-            class="drawer-heading-severity"
-          >
-            low
-          </span>
-          SAST Finding
-        </h2>
-        <button
-          aria-label="Close drawer"
-          class="btn btn-default btn-default-tertiary btn-icon btn-sm gl-button gl-drawer-close-button"
-          type="button"
-        >
-          <svg
-            aria-hidden="true"
-            class="gl-button-icon gl-fill-current gl-icon s16"
-            data-testid="close-icon"
-            role="img"
-          >
-            <use
-              href="file-mock#close"
-            />
-          </svg>
-        </button>
-      </div>
-    </div>
-    <div
-      class="gl-drawer-body gl-drawer-body-scrim"
-    >
-      <ul
-        class="!gl-pb-0 gl-border-b-initial gl-list-none gl-mb-0"
-      >
-        <li
-          class="gl-mb-4"
-          data-testid="findings-drawer-title"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Name
-            </span>
-            <span
-              data-testid="findings-drawer-item-value-prop"
-            >
-              mockedtitle
-            </span>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Status
-            </span>
-            <span
-              class="badge badge-pill badge-warning gl-badge text-capitalize"
-            >
-              <span
-                class="gl-badge-content"
-              >
-                detected
-              </span>
-            </span>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Description
-            </span>
-            <span
-              data-testid="findings-drawer-item-value-prop"
-            >
-              fakedesc
-            </span>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Project
-            </span>
-            <a
-              class="gl-link"
-              href="/testpath"
-            >
-              testname
-            </a>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              File
-            </span>
-            <span
-              data-testid="findings-drawer-item-value-prop"
-            />
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Identifiers
-            </span>
-            <span>
-              <a
-                class="gl-link"
-                href="https://semgrep.dev/r/gitlab.eslint.detect-disable-mustache-escape"
-              >
-                eslint.detect-disable-mustache-escape
-              </a>
-            </span>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Tool
-            </span>
-            <span
-              data-testid="findings-drawer-item-value-prop"
-            >
-              SAST
-            </span>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Engine
-            </span>
-            <span
-              data-testid="findings-drawer-item-value-prop"
-            >
-              testengine name
-            </span>
-          </p>
-        </li>
-      </ul>
-    </div>
-  </aside>
-</transition-stub>
-`;
-
-exports[`FindingsDrawer General Rendering matches the snapshot with dismissed badge 1`] = `
-<transition-stub
-  class="findings-drawer"
-  name="gl-drawer"
->
-  <aside
-    class="gl-drawer gl-drawer-default"
-    style="top: 0px; z-index: 252;"
-  >
-    <div
-      class="gl-drawer-header"
-    >
-      <div
-        class="gl-drawer-title"
-      >
-        <h2
-          class="drawer-heading gl-mb-0 gl-mt-0 gl-text-base gl-w-28"
-        >
-          <svg
-            aria-hidden="true"
-            class="!gl-align-baseline gl-fill-current gl-icon gl-text-orange-300 inline-findings-severity-icon s12"
-            data-testid="severity-low-icon"
-            role="img"
-          >
-            <use
-              href="file-mock#severity-low"
-            />
-          </svg>
-          <span
-            class="drawer-heading-severity"
-          >
-            low
-          </span>
-          SAST Finding
-        </h2>
-        <button
-          aria-label="Close drawer"
-          class="btn btn-default btn-default-tertiary btn-icon btn-sm gl-button gl-drawer-close-button"
-          type="button"
-        >
-          <svg
-            aria-hidden="true"
-            class="gl-button-icon gl-fill-current gl-icon s16"
-            data-testid="close-icon"
-            role="img"
-          >
-            <use
-              href="file-mock#close"
-            />
-          </svg>
-        </button>
-      </div>
-    </div>
-    <div
-      class="gl-drawer-body gl-drawer-body-scrim"
-    >
-      <ul
-        class="!gl-pb-0 gl-border-b-initial gl-list-none gl-mb-0"
-      >
-        <li
-          class="gl-mb-4"
-          data-testid="findings-drawer-title"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Name
-            </span>
-            <span
-              data-testid="findings-drawer-item-value-prop"
-            >
-              mockedtitle
-            </span>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Status
-            </span>
-            <span
-              class="badge badge-pill badge-warning gl-badge text-capitalize"
-            >
-              <span
-                class="gl-badge-content"
-              >
-                detected
-              </span>
-            </span>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Description
-            </span>
-            <span
-              data-testid="findings-drawer-item-value-prop"
-            >
-              fakedesc
-            </span>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Project
-            </span>
-            <a
-              class="gl-link"
-              href="/testpath"
-            >
-              testname
-            </a>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              File
-            </span>
-            <span
-              data-testid="findings-drawer-item-value-prop"
-            />
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Identifiers
-            </span>
-            <span>
-              <a
-                class="gl-link"
-                href="https://semgrep.dev/r/gitlab.eslint.detect-disable-mustache-escape"
-              >
-                eslint.detect-disable-mustache-escape
-              </a>
-            </span>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Tool
-            </span>
-            <span
-              data-testid="findings-drawer-item-value-prop"
-            >
-              SAST
-            </span>
-          </p>
-        </li>
-        <li
-          class="gl-mb-4"
-        >
-          <p
-            class="gl-leading-20"
-          >
-            <span
-              class="gl-block gl-font-bold gl-mb-1"
-              data-testid="findings-drawer-item-description"
-            >
-              Engine
-            </span>
-            <span
-              data-testid="findings-drawer-item-value-prop"
-            >
-              testengine name
-            </span>
-          </p>
-        </li>
-      </ul>
-    </div>
-  </aside>
-</transition-stub>
-`;
diff --git a/spec/frontend/diffs/components/shared/findings_drawer_details_spec.js b/spec/frontend/diffs/components/shared/findings_drawer_details_spec.js
deleted file mode 100644
index 3f3ed3a2594..00000000000
--- a/spec/frontend/diffs/components/shared/findings_drawer_details_spec.js
+++ /dev/null
@@ -1,54 +0,0 @@
-import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
-import FindingsDrawerDetails from '~/diffs/components/shared/findings_drawer_details.vue';
-import {
-  mockFindingDetected,
-  mockFindingsMultiple,
-  mockProject,
-} from '../../mock_data/findings_drawer';
-
-describe('Findings Drawer Details', () => {
-  let wrapper;
-
-  const findingDetailsProps = {
-    drawer: mockFindingDetected,
-    project: mockProject,
-  };
-
-  const createWrapper = (findingDetailsOverrides = {}) => {
-    const propsData = {
-      drawer: findingDetailsProps.drawer,
-      project: findingDetailsProps.project,
-      ...findingDetailsOverrides,
-    };
-
-    wrapper = shallowMountExtended(FindingsDrawerDetails, {
-      propsData,
-    });
-  };
-
-  const findTitle = () => wrapper.findByTestId('findings-drawer-title');
-
-  describe('General Rendering', () => {
-    it('renders without errors', () => {
-      createWrapper();
-      expect(wrapper.exists()).toBe(true);
-    });
-
-    it('matches the snapshot with dismissed badge', () => {
-      createWrapper();
-      expect(wrapper.element).toMatchSnapshot();
-    });
-
-    it('matches the snapshot with detected badge', () => {
-      createWrapper();
-      expect(wrapper.element).toMatchSnapshot();
-    });
-  });
-
-  describe('Active Index Handling', () => {
-    it('watcher sets active index on drawer prop change', () => {
-      createWrapper({ drawer: mockFindingsMultiple[2] });
-      expect(findTitle().props().value).toBe(mockFindingsMultiple[2].title);
-    });
-  });
-});
diff --git a/spec/frontend/diffs/components/shared/findings_drawer_item_spec.js b/spec/frontend/diffs/components/shared/findings_drawer_item_spec.js
deleted file mode 100644
index 80087ea66a2..00000000000
--- a/spec/frontend/diffs/components/shared/findings_drawer_item_spec.js
+++ /dev/null
@@ -1,54 +0,0 @@
-import FindingsDrawerItem from '~/diffs/components/shared/findings_drawer_item.vue';
-import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
-
-let wrapper;
-
-const mockDescription = 'testDescription';
-const slotTestId = 'findings-drawer-item-value-slot';
-const mockValue = 'testValue';
-const mockSlot = `<span data-testid="${slotTestId}">mockSlot</span>`;
-const mockSlotText = 'mockSlot';
-
-describe('FindingsDrawerItem', () => {
-  const description = () => wrapper.findByTestId('findings-drawer-item-description');
-
-  const valueSlot = () => wrapper.findByTestId(slotTestId);
-  const valueProp = () => wrapper.findByTestId('findings-drawer-item-value-prop');
-
-  const createWrapper = (props = {}, slots = {}) => {
-    return shallowMountExtended(FindingsDrawerItem, {
-      propsData: {
-        ...props,
-      },
-      slots: {
-        ...slots,
-      },
-    });
-  };
-
-  it('renders with default values', () => {
-    wrapper = createWrapper();
-    expect(description().text()).toContain('');
-    expect(valueProp().text()).toContain('');
-  });
-
-  it('renders description and value props correctly', () => {
-    wrapper = createWrapper({ description: mockDescription, value: mockValue });
-    expect(description().text()).toContain(mockDescription);
-    expect(valueProp().text()).toContain(mockValue);
-  });
-
-  describe('when slot content is passed', () => {
-    it('renders slot content', () => {
-      wrapper = createWrapper({}, { value: mockSlot });
-      expect(valueSlot().text()).toContain(mockSlotText);
-    });
-
-    describe('when value prop is passed', () => {
-      it('does not render value prop', () => {
-        wrapper = createWrapper({ value: mockValue }, { value: mockSlot });
-        expect(valueProp().exists()).toBe(false);
-      });
-    });
-  });
-});
diff --git a/spec/frontend/diffs/components/shared/findings_drawer_spec.js b/spec/frontend/diffs/components/shared/findings_drawer_spec.js
deleted file mode 100644
index d1b7d85e70b..00000000000
--- a/spec/frontend/diffs/components/shared/findings_drawer_spec.js
+++ /dev/null
@@ -1,95 +0,0 @@
-import { nextTick } from 'vue';
-import { GlDrawer } from '@gitlab/ui';
-import FindingsDrawer from '~/diffs/components/shared/findings_drawer.vue';
-import { mountExtended } from 'helpers/vue_test_utils_helper';
-import {
-  mockFindingDismissed,
-  mockFindingDetected,
-  mockProject,
-  mockFindingsMultiple,
-} from '../../mock_data/findings_drawer';
-
-describe('FindingsDrawer', () => {
-  let wrapper;
-
-  const findPreviousButton = () => wrapper.findByTestId('findings-drawer-prev-button');
-  const findNextButton = () => wrapper.findByTestId('findings-drawer-next-button');
-  const findTitle = () => wrapper.findByTestId('findings-drawer-title');
-  const createWrapper = (
-    drawer = { findings: [mockFindingDetected], index: 0 },
-    project = mockProject,
-  ) => {
-    return mountExtended(FindingsDrawer, {
-      propsData: {
-        drawer,
-        project,
-      },
-    });
-  };
-
-  describe('General Rendering', () => {
-    beforeEach(() => {
-      wrapper = createWrapper();
-    });
-    it('renders without errors', () => {
-      expect(wrapper.exists()).toBe(true);
-    });
-
-    it('emits close event when gl-drawer emits close event', () => {
-      wrapper.findComponent(GlDrawer).vm.$emit('close');
-      expect(wrapper.emitted('close')).toHaveLength(1);
-    });
-
-    it('matches the snapshot with dismissed badge', () => {
-      expect(wrapper.element).toMatchSnapshot();
-    });
-
-    it('matches the snapshot with detected badge', () => {
-      expect(wrapper.element).toMatchSnapshot();
-    });
-  });
-
-  describe('Prev/Next Buttons with Multiple Items', () => {
-    it('renders prev/next buttons when there are multiple items', () => {
-      wrapper = createWrapper({ findings: mockFindingsMultiple, index: 0 });
-      expect(findPreviousButton().exists()).toBe(true);
-      expect(findNextButton().exists()).toBe(true);
-    });
-
-    it('does not render prev/next buttons when there is only one item', () => {
-      wrapper = createWrapper({ findings: [mockFindingDismissed], index: 0 });
-      expect(findPreviousButton().exists()).toBe(false);
-      expect(findNextButton().exists()).toBe(false);
-    });
-
-    it('calls prev method on prev button click and loops correct activeIndex', async () => {
-      wrapper = createWrapper({ findings: mockFindingsMultiple, index: 0 });
-      expect(findTitle().text()).toBe(`Name ${mockFindingsMultiple[0].title}`);
-
-      await findPreviousButton().trigger('click');
-      await nextTick();
-      expect(findTitle().text()).toBe(`Name ${mockFindingsMultiple[2].title}`);
-
-      await findPreviousButton().trigger('click');
-      await nextTick();
-      expect(findTitle().text()).toBe(`Name ${mockFindingsMultiple[1].title}`);
-    });
-
-    it('calls next method on next button click', async () => {
-      wrapper = createWrapper({ findings: mockFindingsMultiple, index: 0 });
-      expect(findTitle().text()).toBe(`Name ${mockFindingsMultiple[0].title}`);
-
-      await findNextButton().trigger('click');
-      await nextTick();
-      expect(findTitle().text()).toBe(`Name ${mockFindingsMultiple[1].title}`);
-
-      await findNextButton().trigger('click');
-      await nextTick();
-      expect(findTitle().text()).toBe(`Name ${mockFindingsMultiple[2].title}`);
-
-      await findNextButton().trigger('click');
-      await nextTick();
-      expect(findTitle().text()).toBe(`Name ${mockFindingsMultiple[0].title}`);
-    });
-  });
-});
diff --git a/spec/frontend/lib/utils/confirm_via_gl_modal/confirm_action_spec.js b/spec/frontend/lib/utils/confirm_via_gl_modal/confirm_action_spec.js
index 88423c8a30a..961ee7cdf3c 100644
--- a/spec/frontend/lib/utils/confirm_via_gl_modal/confirm_action_spec.js
+++ b/spec/frontend/lib/utils/confirm_via_gl_modal/confirm_action_spec.js
@@ -106,16 +106,16 @@ describe('confirmAction', () => {
 
   it('emits a tracking event when modal emit `confirmed` and event name is provided', async () => {
     const trackingEvent = {
-      name: 'test_event',
-      label: 'test_label',
+      name: 'unprotect_branch',
+      label: 'repository_settings',
     };
     await renderRootComponent('', { trackingEvent });
     const { trackEventSpy } = bindInternalEventDocument(modalWrapper.element);
 
     modal.vm.$emit('confirmed');
 
-    expect(trackEventSpy).toHaveBeenCalledWith('test_event', {
-      label: 'test_label',
+    expect(trackEventSpy).toHaveBeenCalledWith('unprotect_branch', {
+      label: 'repository_settings',
     });
   });
 });
diff --git a/spec/frontend/repository/components/blob_button_group_spec.js b/spec/frontend/repository/components/blob_button_group_spec.js
index 42aed016f40..89f764372cb 100644
--- a/spec/frontend/repository/components/blob_button_group_spec.js
+++ b/spec/frontend/repository/components/blob_button_group_spec.js
@@ -147,7 +147,7 @@ describe('BlobButtonGroup component', () => {
     createComponent();
 
     const { targetBranch, originalBranch } = DEFAULT_INJECT;
-    const { name, canPushCode, deletePath, emptyRepo, isUsingLfs } = DEFAULT_PROPS;
+    const { name, canPushCode, emptyRepo, isUsingLfs } = DEFAULT_PROPS;
     const title = `Delete ${name}`;
 
     expect(findDeleteBlobModal().props()).toMatchObject({
@@ -155,9 +155,9 @@ describe('BlobButtonGroup component', () => {
       targetBranch,
       originalBranch,
       canPushCode,
-      deletePath,
       emptyRepo,
       isUsingLfs,
+      handleFormSubmit: expect.any(Function),
     });
   });
 });
diff --git a/spec/frontend/repository/components/commit_changes_modal_spec.js b/spec/frontend/repository/components/commit_changes_modal_spec.js
index d95c4df434c..5b98fd51acb 100644
--- a/spec/frontend/repository/components/commit_changes_modal_spec.js
+++ b/spec/frontend/repository/components/commit_changes_modal_spec.js
@@ -19,13 +19,13 @@ jest.mock('~/lib/utils/csrf', () => ({ token: 'mock-csrf-token' }));
 
 const initialProps = {
   modalId: 'Delete-blob',
-  deletePath: 'some/path',
   commitMessage: 'Delete File',
   targetBranch: 'some-target-branch',
   originalBranch: 'main',
   canPushCode: true,
   canPushToBranch: true,
   emptyRepo: false,
+  handleFormSubmit: jest.fn(),
 };
 
 const { i18n } = CommitChangesModal;
@@ -35,7 +35,7 @@ describe('CommitChangesModal', () => {
 
   const createComponentFactory =
     (mountFn) =>
-    (props = {}) => {
+    ({ props, slots } = {}) => {
       wrapper = mountFn(CommitChangesModal, {
         propsData: {
           ...initialProps,
@@ -49,6 +49,7 @@ describe('CommitChangesModal', () => {
           GlSprintf,
           GlModal: stubComponent(GlModal, { template: RENDER_ALL_SLOTS_TEMPLATE }),
         },
+        slots,
       });
     };
 
@@ -56,6 +57,7 @@ describe('CommitChangesModal', () => {
   const createFullComponent = createComponentFactory(mount);
 
   const findModal = () => wrapper.findComponent(GlModal);
+  const findSlot = () => wrapper.findByTestId('test-slot');
   const findForm = () => findModal().findComponent(GlForm);
   const findCommitTextarea = () => findForm().findComponent(GlFormTextarea);
   const findFormRadioGroup = () => findForm().findComponent(GlFormRadioGroup);
@@ -65,6 +67,8 @@ describe('CommitChangesModal', () => {
   const findCreateMrCheckbox = () => findForm().findComponent(GlFormCheckbox);
   const findTargetInput = () => findForm().findComponent(GlFormInput);
   const findCommitHint = () => wrapper.find('[data-testid="hint"]');
+  const findBranchInForkMessage = () =>
+    wrapper.findByText('GitLab will create a branch in your fork and start a merge request.');
 
   const fillForm = async (inputValue = {}) => {
     const { targetText, commitText } = inputValue;
@@ -84,7 +88,7 @@ describe('CommitChangesModal', () => {
       linkEnd: '',
     });
 
-    beforeEach(() => createComponent({ isUsingLfs: true }));
+    beforeEach(() => createComponent({ props: { isUsingLfs: true } }));
 
     it('renders a modal containing LFS text', () => {
       expect(findModal().props('title')).toBe(lfsTitleText);
@@ -102,24 +106,45 @@ describe('CommitChangesModal', () => {
     });
   });
 
-  it('renders Modal component', () => {
-    createComponent();
+  describe('renders modal component', () => {
+    it('renders with correct props', () => {
+      createComponent();
 
-    expect(findModal().props()).toMatchObject({
-      size: 'md',
-      actionPrimary: {
-        text: 'Commit changes',
-      },
-      actionCancel: {
-        text: 'Cancel',
-      },
+      expect(findModal().props()).toMatchObject({
+        size: 'md',
+        actionPrimary: {
+          text: 'Commit changes',
+        },
+        actionCancel: {
+          text: 'Cancel',
+        },
+      });
+      expect(findSlot().exists()).toBe(false);
+    });
+
+    it('renders the body slot when one is provided', () => {
+      createComponent({
+        slots: {
+          body: '<div data-testid="test-slot">test body slot</div>',
+        },
+      });
+      expect(findSlot().text()).toBe('test body slot');
+    });
+
+    it('renders the form field slot when one is provided', () => {
+      createComponent({
+        slots: {
+          body: '<div data-testid="test-slot">test form fields slot</div>',
+        },
+      });
+      expect(findSlot().text()).toBe('test form fields slot');
     });
   });
 
   describe('form', () => {
     it('gets passed the path for action attribute', () => {
       createComponent();
-      expect(findForm().attributes('action')).toBe(initialProps.deletePath);
+      expect(findForm().attributes('action')).toBe(initialProps.actionPath);
     });
 
     it('shows the correct form fields when commit to current branch', () => {
@@ -142,7 +167,7 @@ describe('CommitChangesModal', () => {
     });
 
     it('shows the correct form fields when `canPushToBranch` is `false`', () => {
-      createComponent({ canPushToBranch: false, canPushCode: true });
+      createComponent({ props: { canPushToBranch: false, canPushCode: true } });
       expect(wrapper.vm.$data.form.fields.branch_name.value).toBe('some-target-branch');
       expect(findCommitTextarea().exists()).toBe(true);
       expect(findRadioGroup().exists()).toBe(false);
@@ -150,6 +175,36 @@ describe('CommitChangesModal', () => {
       expect(findCreateMrCheckbox().text()).toBe('Create a merge request for this change');
     });
 
+    describe('when `canPushToCode` is `false`', () => {
+      const commitInBranchMessage = sprintf(
+        'Your changes can be committed to %{branchName} because a merge request is open.',
+        {
+          branchName: 'main',
+        },
+      );
+
+      it('shows the correct form fields when `branchAllowsCollaboration` is `true`', () => {
+        createComponent({ props: { canPushCode: false, branchAllowsCollaboration: true } });
+        expect(findCommitTextarea().exists()).toBe(true);
+        expect(findRadioGroup().exists()).toBe(false);
+        expect(findModal().text()).toContain(commitInBranchMessage);
+        expect(findBranchInForkMessage().exists()).toBe(false);
+      });
+
+      it('shows the correct form fields when `branchAllowsCollaboration` is `false`', () => {
+        createComponent({
+          props: {
+            canPushCode: false,
+            branchAllowsCollaboration: false,
+          },
+        });
+        expect(findCommitTextarea().exists()).toBe(true);
+        expect(findRadioGroup().exists()).toBe(false);
+        expect(findModal().text()).not.toContain(commitInBranchMessage);
+        expect(findBranchInForkMessage().exists()).toBe(true);
+      });
+    });
+
     it('clear branch name when new branch option is selected', async () => {
       createComponent();
       expect(wrapper.vm.$data.form.fields.branch_name).toEqual({
@@ -174,8 +229,6 @@ describe('CommitChangesModal', () => {
       input                     | value                          | emptyRepo | canPushCode | canPushToBranch | exist
       ${'authenticity_token'}   | ${'mock-csrf-token'}           | ${false}  | ${true}     | ${true}         | ${true}
       ${'authenticity_token'}   | ${'mock-csrf-token'}           | ${true}   | ${false}    | ${true}         | ${true}
-      ${'_method'}              | ${'delete'}                    | ${false}  | ${true}     | ${true}         | ${true}
-      ${'_method'}              | ${'delete'}                    | ${true}   | ${false}    | ${true}         | ${true}
       ${'original_branch'}      | ${initialProps.originalBranch} | ${false}  | ${true}     | ${true}         | ${true}
       ${'original_branch'}      | ${undefined}                   | ${true}   | ${true}     | ${true}         | ${false}
       ${'create_merge_request'} | ${'1'}                         | ${false}  | ${false}    | ${true}         | ${true}
@@ -187,9 +240,11 @@ describe('CommitChangesModal', () => {
       'passes $input as a hidden input with the correct value',
       ({ input, value, emptyRepo, canPushCode, canPushToBranch, exist }) => {
         createComponent({
-          emptyRepo,
-          canPushCode,
-          canPushToBranch,
+          props: {
+            emptyRepo,
+            canPushCode,
+            canPushToBranch,
+          },
         });
 
         const inputMethod = findForm().find(`input[name="${input}"]`);
@@ -237,16 +292,15 @@ describe('CommitChangesModal', () => {
   });
 
   describe('form submission', () => {
-    let submitSpy;
+    const handleFormSubmitSpy = jest.fn();
 
     beforeEach(async () => {
-      createFullComponent();
+      createFullComponent({ props: { handleFormSubmit: handleFormSubmitSpy } });
       await nextTick();
-      submitSpy = jest.spyOn(findForm().element, 'submit');
     });
 
     afterEach(() => {
-      submitSpy.mockRestore();
+      handleFormSubmitSpy.mockRestore();
     });
 
     describe('invalid form', () => {
@@ -265,7 +319,7 @@ describe('CommitChangesModal', () => {
 
       it('does not submit form', () => {
         findModal().vm.$emit('primary', { preventDefault: () => {} });
-        expect(submitSpy).not.toHaveBeenCalled();
+        expect(handleFormSubmitSpy).not.toHaveBeenCalled();
       });
     });
 
@@ -287,7 +341,7 @@ describe('CommitChangesModal', () => {
 
       it('submits form', () => {
         findModal().vm.$emit('primary', { preventDefault: () => {} });
-        expect(submitSpy).toHaveBeenCalled();
+        expect(handleFormSubmitSpy).toHaveBeenCalled();
       });
     });
   });
diff --git a/spec/graphql/types/issue_type_enum_spec.rb b/spec/graphql/types/issue_type_enum_spec.rb
index f0370e275cd..3d9d3f58dd1 100644
--- a/spec/graphql/types/issue_type_enum_spec.rb
+++ b/spec/graphql/types/issue_type_enum_spec.rb
@@ -5,9 +5,9 @@ require 'spec_helper'
 RSpec.describe Types::IssueTypeEnum, feature_category: :team_planning do
   specify { expect(described_class.graphql_name).to eq('IssueType') }
 
-  it 'exposes all the existing issue type values except epic' do
+  it 'exposes all the existing issue type values' do
     expect(described_class.values.keys).to match_array(
-      %w[ISSUE INCIDENT TEST_CASE REQUIREMENT TASK OBJECTIVE KEY_RESULT EPIC]
+      %w[ISSUE INCIDENT TEST_CASE REQUIREMENT TASK OBJECTIVE KEY_RESULT EPIC TICKET]
     )
   end
 end
diff --git a/spec/lib/api/helpers_spec.rb b/spec/lib/api/helpers_spec.rb
index 27872bd3bdf..9adaf10cb3a 100644
--- a/spec/lib/api/helpers_spec.rb
+++ b/spec/lib/api/helpers_spec.rb
@@ -269,6 +269,69 @@ RSpec.describe API::Helpers, feature_category: :shared do
           end
         end
       end
+
+      context 'user is authenticated with a job token from another project and fine grained policies are enabled' do
+        let_it_be(:runner_project) { create(:project) }
+        let_it_be(:job) { create(:ci_build, project: runner_project) }
+        let_it_be(:allowed_job_token_policy) { ::Ci::JobToken::Policies.all_policies.pick(:value) }
+        let_it_be(:job_token_policy) { allowed_job_token_policy }
+
+        before do
+          create(:ci_job_token_project_scope_link,
+            source_project: project,
+            target_project: runner_project,
+            direction: :inbound,
+            job_token_policies: [allowed_job_token_policy],
+            default_permissions: false
+          )
+
+          allow(helper).to receive(:route_authentication_setting).and_return({})
+          allow(helper).to receive(:route_setting).with(:authorization).and_return(job_token_policy: job_token_policy)
+          allow(user).to receive(:ci_job_token_scope).and_return(user.set_ci_job_token_scope!(job))
+        end
+
+        subject(:find_project!) { helper.find_project!(project.id) }
+
+        it { is_expected.to eq project }
+
+        context 'when the given policy is not allowed' do
+          let_it_be(:job_token_policy) { :not_allowed_policy }
+
+          it 'returns forbidden' do
+            expect(helper)
+              .to receive(:forbidden!)
+              .with("The #{job_token_policy} permission on #{project.path} is not authorized for this CI/CD job token.")
+
+            find_project!
+          end
+
+          context 'when the `enforce_job_token_policies` feature flag is disabled' do
+            before do
+              stub_feature_flags(enforce_job_token_policies: false)
+            end
+
+            it { is_expected.to eq project }
+          end
+        end
+
+        context 'when no policy is given' do
+          let_it_be(:job_token_policy) { nil }
+
+          it 'returns forbidden' do
+            expect(helper).to receive(:forbidden!).with('This action is not authorized for CI/CD job tokens.')
+
+            find_project!
+          end
+
+          context 'when the `enforce_job_token_policies` feature flag is disabled' do
+            before do
+              stub_feature_flags(enforce_job_token_policies: false)
+            end
+
+            it { is_expected.to eq project }
+          end
+        end
+      end
     end
 
     context 'when user is not authenticated' do
diff --git a/spec/lib/ci/job_token/policies_spec.rb b/spec/lib/ci/job_token/policies_spec.rb
new file mode 100644
index 00000000000..9fe8bebd357
--- /dev/null
+++ b/spec/lib/ci/job_token/policies_spec.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe ::Ci::JobToken::Policies, feature_category: :secrets_management do
+  describe '.all_policies' do
+    it 'contains exactly the valid policies' do
+      schema = 'app/validators/json_schemas/ci_job_token_policies.json'
+      valid_policies = Gitlab::Json.parse(File.read(schema)).dig('items', 'enum').map(&:to_sym)
+
+      expect(valid_policies).to match_array(described_class.all_policies.pluck(:value))
+    end
+  end
+end
diff --git a/spec/lib/gitlab/search/found_blob_spec.rb b/spec/lib/gitlab/search/found_blob_spec.rb
index 8efbe053155..3983c37dd4f 100644
--- a/spec/lib/gitlab/search/found_blob_spec.rb
+++ b/spec/lib/gitlab/search/found_blob_spec.rb
@@ -17,7 +17,6 @@ RSpec.describe Gitlab::Search::FoundBlob, feature_category: :global_search do
       expect(subject.path).to eq('CHANGELOG')
       expect(subject.basename).to eq('CHANGELOG')
       expect(subject.ref).to eq('master')
-      expect(subject.matched_lines_count).to be_nil
       expect(subject.startline).to eq(188)
       expect(subject.data.lines[2]).to eq("  - Feature: Replace teams with group membership\n")
     end
diff --git a/spec/models/ci/job_token/allowlist_spec.rb b/spec/models/ci/job_token/allowlist_spec.rb
index dfab57ff806..c08020a5380 100644
--- a/spec/models/ci/job_token/allowlist_spec.rb
+++ b/spec/models/ci/job_token/allowlist_spec.rb
@@ -214,4 +214,61 @@ RSpec.describe Ci::JobToken::Allowlist, feature_category: :continuous_integratio
       end
     end
   end
+
+  describe '#nearest_scope_for_target_project' do
+    subject { allowlist.nearest_scope_for_target_project(target_project) }
+
+    let_it_be(:direction) { :inbound }
+    let_it_be(:root_group) { create(:group) }
+    let_it_be(:subgroup) { create(:group, parent: root_group) }
+    let_it_be(:target_project) { create(:project, group: subgroup) }
+
+    let!(:scope_by_project) do
+      create(:ci_job_token_project_scope_link,
+        source_project: source_project,
+        target_project: target_project,
+        direction: :inbound
+      )
+    end
+
+    let!(:scope_by_subgroup) do
+      create(:ci_job_token_group_scope_link, source_project: source_project, target_group: subgroup)
+    end
+
+    let!(:scope_by_root_group) do
+      create(:ci_job_token_group_scope_link, source_project: source_project, target_group: root_group)
+    end
+
+    context 'when the target project is the nearest association' do
+      it { is_expected.to eq scope_by_project }
+    end
+
+    context "when the target project's group is the nearest association" do
+      let(:scope_by_project) { nil }
+
+      it { is_expected.to eq scope_by_subgroup }
+    end
+
+    context "when the target project's root group is the nearest association" do
+      let(:scope_by_project) { nil }
+      let(:scope_by_subgroup) { nil }
+
+      it { is_expected.to eq scope_by_root_group }
+    end
+
+    context 'when the subgroup is transferred to a another newer subgroup and no project scope exists' do
+      let_it_be(:another_subgroup) { create(:group, parent: root_group) }
+
+      let(:scope_by_project) { nil }
+      let!(:scope_by_another_subgroup) do
+        create(:ci_job_token_group_scope_link, source_project: source_project, target_group: another_subgroup)
+      end
+
+      before do
+        subgroup.update!(parent: another_subgroup)
+      end
+
+      it { is_expected.to eq scope_by_subgroup }
+    end
+  end
 end
diff --git a/spec/models/ci/job_token/scope_spec.rb b/spec/models/ci/job_token/scope_spec.rb
index 69abe77319e..18e28b3f4f6 100644
--- a/spec/models/ci/job_token/scope_spec.rb
+++ b/spec/models/ci/job_token/scope_spec.rb
@@ -229,6 +229,52 @@ RSpec.describe Ci::JobToken::Scope, feature_category: :continuous_integration, f
     end
   end
 
+  describe '#policy_allowed?' do
+    subject { scope.policy_allowed?(accessed_project, policy) }
+
+    let(:scope) { described_class.new(target_project) }
+    let_it_be(:target_project) { create(:project) }
+    let_it_be(:allowed_policy) { ::Ci::JobToken::Policies.all_policies.pick(:value) }
+    let_it_be(:policy) { allowed_policy }
+    let_it_be(:accessed_project) { create_inbound_accessible_project_for_policies(target_project, [allowed_policy]) }
+
+    context 'when the policy is defined in the scope' do
+      it { is_expected.to be(true) }
+
+      context 'when the accessed project is not inbound accessible' do
+        let_it_be(:accessed_project) { create(:project) }
+
+        it { is_expected.to be(false) }
+      end
+    end
+
+    context 'when the policy is not defined in the scope' do
+      let_it_be(:policy) { :not_allowed_policy }
+
+      it { is_expected.to be(false) }
+
+      context 'when the accessed project is the target project' do
+        let_it_be(:accessed_project) { target_project }
+
+        it { is_expected.to be(true) }
+      end
+
+      context 'when the accessed project does not have ci_inbound_job_token_scope_enabled set to true' do
+        before do
+          accessed_project.ci_inbound_job_token_scope_enabled = false
+        end
+
+        it { is_expected.to be(true) }
+      end
+
+      context 'when the accessed project has not enabled fine grained permissions' do
+        let_it_be(:accessed_project) { create_inbound_accessible_project(target_project) }
+
+        it { is_expected.to be(true) }
+      end
+    end
+  end
+
   describe '#self_referential?' do
     subject { scope.self_referential?(access_project) }
 
diff --git a/spec/models/issue_spec.rb b/spec/models/issue_spec.rb
index a869b60fb95..734e28e6716 100644
--- a/spec/models/issue_spec.rb
+++ b/spec/models/issue_spec.rb
@@ -1888,11 +1888,12 @@ RSpec.describe Issue, feature_category: :team_planning do
   end
 
   describe '.service_desk' do
-    it 'returns the service desk issue' do
-      service_desk_issue = create(:issue, project: reusable_project, author: ::Users::Internal.support_bot)
-      regular_issue = create(:issue, project: reusable_project)
+    let_it_be(:service_desk_issue) { create(:issue, project: reusable_project, author: ::Users::Internal.support_bot) }
+    let_it_be(:regular_issue) { create(:issue, project: reusable_project) }
+    let_it_be(:ticket) { create(:work_item, :ticket, project: reusable_project, author: user) }
 
-      expect(described_class.service_desk).to include(service_desk_issue)
+    it 'returns the service desk issue and ticket work item' do
+      expect(described_class.service_desk).to contain_exactly(service_desk_issue, described_class.find(ticket.id))
       expect(described_class.service_desk).not_to include(regular_issue)
     end
   end
diff --git a/spec/requests/api/environments_spec.rb b/spec/requests/api/environments_spec.rb
index df592eb153b..e1eb6807091 100644
--- a/spec/requests/api/environments_spec.rb
+++ b/spec/requests/api/environments_spec.rb
@@ -122,6 +122,12 @@ RSpec.describe API::Environments, feature_category: :continuous_delivery do
         expect(response).to have_gitlab_http_status(:not_found)
       end
     end
+
+    it_behaves_like 'enforcing job token policies', :read_environments do
+      let(:request) do
+        get api("/projects/#{accessed_project.id}/environments"), params: { job_token: job.token }
+      end
+    end
   end
 
   describe 'POST /projects/:id/environments' do
diff --git a/spec/requests/api/graphql/issue/issue_spec.rb b/spec/requests/api/graphql/issue/issue_spec.rb
index 3665fbc2df8..903a966b42a 100644
--- a/spec/requests/api/graphql/issue/issue_spec.rb
+++ b/spec/requests/api/graphql/issue/issue_spec.rb
@@ -48,7 +48,7 @@ RSpec.describe 'Query.issue(id)', feature_category: :team_planning do
   end
 
   context 'when the user does have access' do
-    before do
+    before_all do
       project.add_guest(current_user)
     end
 
diff --git a/spec/requests/api/graphql/issues_spec.rb b/spec/requests/api/graphql/issues_spec.rb
index 42d901607db..b476527f792 100644
--- a/spec/requests/api/graphql/issues_spec.rb
+++ b/spec/requests/api/graphql/issues_spec.rb
@@ -162,6 +162,7 @@ RSpec.describe 'getting an issue list at root level', feature_category: :team_pl
   it_behaves_like 'graphql issue list request spec' do
     let_it_be(:external_user) { create(:user) }
     let_it_be(:another_user) { reporter }
+    let_it_be(:project) { project_a } # Used for Service Desk issues creation in shared example
 
     let(:public_projects) { [project_a, project_c] }
 
diff --git a/spec/support/helpers/ci/job_token_scope_helpers.rb b/spec/support/helpers/ci/job_token_scope_helpers.rb
index 90e415583d0..4a2d5f83412 100644
--- a/spec/support/helpers/ci/job_token_scope_helpers.rb
+++ b/spec/support/helpers/ci/job_token_scope_helpers.rb
@@ -48,6 +48,12 @@ module Ci
       end
     end
 
+    def create_inbound_accessible_project_for_policies(project, policies)
+      create(:project).tap do |accessible_project|
+        add_inbound_accessible_linkage(project, accessible_project, policies)
+      end
+    end
+
     def create_inbound_and_outbound_accessible_project(project)
       create(:project).tap do |accessible_project|
         make_project_fully_accessible(project, accessible_project)
@@ -68,12 +74,14 @@ module Ci
       )
     end
 
-    def add_inbound_accessible_linkage(project, accessible_project)
+    def add_inbound_accessible_linkage(project, accessible_project, policies = [])
       create(
         :ci_job_token_project_scope_link,
         source_project: accessible_project,
         target_project: project,
-        direction: :inbound
+        direction: :inbound,
+        default_permissions: policies.empty?,
+        job_token_policies: policies
       )
     end
   end
diff --git a/spec/support/shared_examples/ci/job_token_policies_shared_examples.rb b/spec/support/shared_examples/ci/job_token_policies_shared_examples.rb
new file mode 100644
index 00000000000..9eb1cad51be
--- /dev/null
+++ b/spec/support/shared_examples/ci/job_token_policies_shared_examples.rb
@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'enforcing job token policies' do |policy|
+  context 'when authenticating with a CI Job Token from another project' do
+    let_it_be(:user) { create(:user) }
+    let_it_be(:job) { create(:ci_build, :running, user: user) }
+    let_it_be(:accessed_project) { create(:project, developers: user) }
+    let_it_be(:allowed_policies) { [policy] }
+    let_it_be(:default_permissions) { false }
+
+    before do
+      create(:ci_job_token_project_scope_link,
+        source_project: accessed_project,
+        target_project: job.project,
+        direction: :inbound,
+        job_token_policies: allowed_policies,
+        default_permissions: default_permissions
+      )
+    end
+
+    subject(:do_request) do
+      request
+      response
+    end
+
+    it { is_expected.to have_gitlab_http_status(:ok) }
+
+    context 'when the policy is not allowed' do
+      let(:allowed_policies) { [] }
+
+      it { is_expected.to have_gitlab_http_status(:forbidden) }
+
+      it 'returns an error message containing the disallowed policy' do
+        do_request
+        expect(json_response['message']).to eq("403 Forbidden - The #{policy} permission on #{accessed_project.path} " \
+          "is not authorized for this CI/CD job token.")
+      end
+
+      context 'when fine grained permissions are disabled' do
+        let_it_be(:default_permissions) { true }
+
+        it { is_expected.to have_gitlab_http_status(:ok) }
+      end
+
+      context 'when the `enforce_job_token_policies` feature flag is disabled' do
+        before do
+          stub_feature_flags(enforce_job_token_policies: false)
+        end
+
+        it { is_expected.to have_gitlab_http_status(:ok) }
+      end
+    end
+  end
+end
diff --git a/spec/support/shared_examples/finders/issues_finder_shared_examples.rb b/spec/support/shared_examples/finders/issues_finder_shared_examples.rb
index 5af30e32587..db0fc45511a 100644
--- a/spec/support/shared_examples/finders/issues_finder_shared_examples.rb
+++ b/spec/support/shared_examples/finders/issues_finder_shared_examples.rb
@@ -244,6 +244,40 @@ RSpec.shared_examples 'issues or work items finder' do |factory, execute_context
         end
       end
 
+      # Querying Service Desk issues uses `support-bot` `author_username`.
+      # This is a workaround that selects both legacy Service Desk issues and ticket work items
+      # until we migrated Service Desk issues to work items of type ticket.
+      # Will be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/505024
+      context 'when filtering by Service Desk issues/tickets' do
+        # Use items only for this context because it's temporary. This way we don't need to modify other examples.
+        let_it_be_with_reload(:service_desk_issue) do
+          create(
+            :issue, # legacy Service Desk issues are always of type issue
+            author: Users::Internal.support_bot,
+            external_author: 'user@example.com',
+            project: project2,
+            description: 'Service Desk issue'
+          )
+        end
+
+        let_it_be_with_reload(:ticket) do
+          create(
+            :work_item,
+            :ticket,
+            author: user2, # don't use support bot because this isn't a req for ticket WIT
+            project: project2,
+            description: 'Ticket'
+          )
+        end
+
+        let(:params) { { author_username: 'support-bot' } }
+
+        it 'returns Service Desk issues and work items of type ticket' do
+          # Use the ids here because work item finder and issue finder return different types of objects.
+          expect(items.map(&:id)).to contain_exactly(service_desk_issue.id, ticket.id)
+        end
+      end
+
       context 'filtering by milestone' do
         let(:params) { { milestone_title: milestone.title } }
 
diff --git a/spec/support/shared_examples/requests/api/graphql/issue_list_shared_examples.rb b/spec/support/shared_examples/requests/api/graphql/issue_list_shared_examples.rb
index d2433d767c7..71177add9e2 100644
--- a/spec/support/shared_examples/requests/api/graphql/issue_list_shared_examples.rb
+++ b/spec/support/shared_examples/requests/api/graphql/issue_list_shared_examples.rb
@@ -277,6 +277,29 @@ RSpec.shared_examples 'graphql issue list request spec' do
         end
       end
     end
+
+    # Querying Service Desk issues uses `support-bot` `author_username`.
+    # This is a workaround that selects both legacy Service Desk issues and ticket work items
+    # until we migrated Service Desk issues to work items of type ticket.
+    # Will be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/505024
+    context 'when filtering by Service Desk issues/tickets' do
+      # Use items only for this context because it's temporary. This way we don't need to modify other examples.
+      let_it_be(:service_desk_issue) { create(:issue, project: project, author: ::Users::Internal.support_bot) }
+      # don't use support bot because this isn't a req for ticket WIT
+      let_it_be(:ticket) { create(:work_item, :ticket, project: project, author: current_user) }
+      # Get work item as issue because this query only returns issues.
+      let_it_be(:service_desk_items) { [service_desk_issue, Issue.find(ticket.id)] }
+
+      let_it_be(:base_params) { { iids: service_desk_items.map { |issue| issue.iid.to_s } } }
+
+      let(:issue_filter_params) { { author_username: 'support-bot' } }
+
+      it 'returns Service Desk issue and ticket work item' do
+        post_query
+
+        expect(issue_ids).to match_array(to_gid_list(service_desk_items))
+      end
+    end
   end
 
   describe 'sorting and pagination' do