-
- {{ heading }}
-
+
-
+
-
+
+
+
+
{{ $options.I18N_NO_PROJECTS_FOUND }}
+
+
+
-
{{ $options.I18N_NO_PROJECTS_FOUND }}
-
-
-
diff --git a/app/assets/javascripts/pages/projects/compare/rapid_diffs/index.js b/app/assets/javascripts/pages/projects/compare/rapid_diffs/index.js
index b86c9ec442f..83cd9b695d8 100644
--- a/app/assets/javascripts/pages/projects/compare/rapid_diffs/index.js
+++ b/app/assets/javascripts/pages/projects/compare/rapid_diffs/index.js
@@ -1,3 +1,8 @@
import initCompareSelector from '~/projects/compare';
+import { createRapidDiffsApp } from '~/rapid_diffs/app';
initCompareSelector();
+
+const app = createRapidDiffsApp();
+app.init();
+app.reloadDiffs();
diff --git a/app/assets/stylesheets/page_bundles/compare_rapid_diffs.scss b/app/assets/stylesheets/page_bundles/compare_rapid_diffs.scss
new file mode 100644
index 00000000000..d6065590145
--- /dev/null
+++ b/app/assets/stylesheets/page_bundles/compare_rapid_diffs.scss
@@ -0,0 +1,6 @@
+@import 'mixins_and_variables_and_functions';
+@import 'components/rapid_diffs';
+
+.rd-app {
+ --rd-app-sticky-top: calc(#{$calc-application-header-height});
+}
diff --git a/app/controllers/concerns/uploads_actions.rb b/app/controllers/concerns/uploads_actions.rb
index cabc2e77cea..9a2450da8a1 100644
--- a/app/controllers/concerns/uploads_actions.rb
+++ b/app/controllers/concerns/uploads_actions.rb
@@ -80,8 +80,8 @@ module UploadsActions
# behavior when serving uploads.
def set_request_format_from_path_extension
path = request.headers['action_dispatch.original_path'] || request.headers['PATH_INFO']
-
- return unless match = path&.match(/\.(\w+)\z/)
+ match = path&.match(/\.(\w+)\z/)
+ return unless match
format = Mime[match.captures.first]
@@ -120,7 +120,8 @@ module UploadsActions
# rubocop: disable CodeReuse/ActiveRecord
def build_uploader_from_upload
- return unless uploader = build_uploader
+ uploader = build_uploader
+ return unless uploader
upload_paths = uploader.upload_paths(params[:filename])
upload = Upload.find_by(model: model, uploader: uploader_class.to_s, path: upload_paths)
diff --git a/app/controllers/projects/compare_controller.rb b/app/controllers/projects/compare_controller.rb
index 3157d7ab6f8..328573c5a3a 100644
--- a/app/controllers/projects/compare_controller.rb
+++ b/app/controllers/projects/compare_controller.rb
@@ -80,6 +80,11 @@ class Projects::CompareController < Projects::ApplicationController
def rapid_diffs
return render_404 unless ::Feature.enabled?(:rapid_diffs, current_user, type: :wip)
+ @show_whitespace_default = current_user.nil? || current_user.show_whitespace_in_diffs
+ @reload_stream_url = diffs_stream_namespace_project_compare_index_path(**compare_params)
+ @diff_files_endpoint = diff_files_metadata_namespace_project_compare_index_path(**compare_params)
+ @update_current_user_path = expose_path(api_v4_user_preferences_path)
+
show
end
diff --git a/app/finders/todos_finder.rb b/app/finders/todos_finder.rb
index 22ccb3bebdc..2b914b1709f 100644
--- a/app/finders/todos_finder.rb
+++ b/app/finders/todos_finder.rb
@@ -21,6 +21,7 @@ class TodosFinder
include FinderMethods
include Gitlab::Utils::StrongMemoize
include SafeFormatHelper
+ include Gitlab::InternalEventsTracking
requires_cross_project_access unless: -> { project? }
@@ -48,6 +49,8 @@ class TodosFinder
return Todo.none if current_user.nil?
raise ArgumentError, invalid_type_message unless valid_types?
+ track_bot_user if current_user.bot?
+
items = current_user.todos
items = without_hidden(items)
items = by_action_id(items)
@@ -261,6 +264,17 @@ class TodosFinder
def filter_done_only?
Array.wrap(params[:state]).map(&:to_sym) == [:done]
end
+
+ def track_bot_user
+ track_internal_event(
+ "request_todos_by_bot_user",
+ user: current_user,
+ additional_properties: {
+ label: 'user_type',
+ property: current_user.user_type
+ }
+ )
+ end
end
TodosFinder.prepend_mod_with('TodosFinder')
diff --git a/app/finders/work_items/glql/work_items_finder.rb b/app/finders/work_items/glql/work_items_finder.rb
new file mode 100644
index 00000000000..4b44ddaebc7
--- /dev/null
+++ b/app/finders/work_items/glql/work_items_finder.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module WorkItems
+ module Glql
+ class WorkItemsFinder
+ def initialize(current_user, context, resource_parent, params = {})
+ @current_user = current_user
+ @context = context
+ @resource_parent = resource_parent
+ @params = params
+ end
+
+ # Overwritten in ee/app/finders/ee/work_items/glql/work_items_finder.rb
+ def use_elasticsearch_finder?
+ false
+ end
+ end
+ end
+end
+
+WorkItems::Glql::WorkItemsFinder.prepend_mod
diff --git a/app/graphql/resolvers/work_items_resolver.rb b/app/graphql/resolvers/work_items_resolver.rb
index d352ef90adf..7cc7c49e836 100644
--- a/app/graphql/resolvers/work_items_resolver.rb
+++ b/app/graphql/resolvers/work_items_resolver.rb
@@ -21,14 +21,31 @@ module Resolvers
def resolve_with_lookahead(**args)
return WorkItem.none if resource_parent.nil?
- Gitlab::Graphql::Loaders::IssuableLoader.new(
- resource_parent,
- finder(prepare_finder_params(args))
- ).batching_find_all { |q| apply_lookahead(q) }
+ finder = choose_finder(args)
+
+ Gitlab::Graphql::Loaders::IssuableLoader
+ .new(resource_parent, finder)
+ .batching_find_all { |q| apply_lookahead(q) }
end
private
+ def choose_finder(args)
+ if ::Feature.enabled?(:glql_es_integration, current_user)
+ glql_finder = glql_finder(args)
+
+ return glql_finder if glql_finder.use_elasticsearch_finder?
+ end
+
+ finder(prepare_finder_params(args))
+ end
+
+ def glql_finder(args)
+ ::WorkItems::Glql::WorkItemsFinder.new(current_user, context, resource_parent, args)
+ end
+
+ # When we search on a group level, this finder is being overwritten in
+ # app/graphql/resolvers/namespaces/work_items_resolver.rb:32
def finder(args)
::WorkItems::WorkItemsFinder.new(current_user, args)
end
diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index c940f8dae0b..3b062b14709 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -179,7 +179,6 @@ module Ci
scope :with_pipeline_locked_artifacts, -> { joins(:pipeline).where('pipeline.locked': Ci::Pipeline.lockeds[:artifacts_locked]) }
scope :last_month, -> { where('created_at > ?', Date.today - 1.month) }
scope :scheduled_actions, -> { where(when: :delayed, status: COMPLETED_STATUSES + %i[scheduled]) }
- scope :ref_protected, -> { where(protected: true) }
scope :with_live_trace, -> { where_exists(Ci::BuildTraceChunk.scoped_build) }
scope :with_stale_live_trace, -> { with_live_trace.finished_before(12.hours.ago) }
scope :finished_before, ->(date) { finished.where('finished_at < ?', date) }
diff --git a/app/models/commit_status.rb b/app/models/commit_status.rb
index b1cdf044637..74589a3cbf0 100644
--- a/app/models/commit_status.rb
+++ b/app/models/commit_status.rb
@@ -70,6 +70,7 @@ class CommitStatus < Ci::ApplicationRecord
scope :after_stage, ->(index) { where('stage_idx > ?', index) }
scope :for_project, ->(project_id) { where(project_id: project_id) }
scope :for_ref, ->(ref) { where(ref: ref) }
+ scope :for_user, ->(user) { where(user: user) }
scope :by_name, ->(name) { where(name: name) }
scope :in_pipelines, ->(pipelines) { where(pipeline: pipelines) }
scope :with_pipeline, -> { joins(:pipeline) }
@@ -80,6 +81,7 @@ class CommitStatus < Ci::ApplicationRecord
}
scope :with_when_executed, ->(when_executed) { where(when: when_executed) }
scope :with_type, ->(type) { where(type: type) }
+ scope :ref_protected, -> { where(protected: true) }
# The scope applies `pluck` to split the queries. Use with care.
scope :for_project_paths, ->(paths) do
diff --git a/app/services/ci/create_commit_status_service.rb b/app/services/ci/create_commit_status_service.rb
index 3c8c0fa1a71..4329a6f050d 100644
--- a/app/services/ci/create_commit_status_service.rb
+++ b/app/services/ci/create_commit_status_service.rb
@@ -26,7 +26,7 @@ module Ci
result = validate
return result if result&.error?
- @pipeline = first_matching_pipeline || create_pipeline
+ @pipeline = find_or_create_pipeline
return forbidden unless ::Ability.allowed?(current_user, :update_pipeline, pipeline)
@stage = find_or_create_external_stage
@@ -46,9 +46,13 @@ module Ci
return bad_request('State is required') if params[:state].blank?
return not_found('References for commit') if ref.blank?
- return unless params[:pipeline_id] && !first_matching_pipeline
+ return unless params[:pipeline_id]
- not_found("Pipeline for pipeline_id, sha and ref")
+ return not_found("Pipeline for pipeline_id, sha and ref") unless first_matching_pipeline
+
+ return if can_append_jobs_to_existing_pipeline?
+
+ error("The number of jobs has exceeded the limit", :unprocessable_entity)
end
def ref
@@ -62,6 +66,23 @@ module Ci
end
strong_memoize_attr :commit
+ def find_or_create_pipeline
+ return create_pipeline unless first_matching_pipeline
+ return first_matching_pipeline if can_append_jobs_to_existing_pipeline?
+
+ create_log_entry
+
+ enforce_jobs_limit? ? create_pipeline : first_matching_pipeline
+ end
+
+ def can_append_jobs_to_existing_pipeline?
+ return true unless first_matching_pipeline_size_exceeded?
+ return true if external_commit_status_exists?
+
+ false
+ end
+ strong_memoize_attr :can_append_jobs_to_existing_pipeline?
+
def first_matching_pipeline
limit = params[:pipeline_id] ? nil : DEFAULT_LIMIT_PIPELINES
pipelines = project.ci_pipelines.newest_first(sha: sha, limit: limit)
@@ -71,6 +92,13 @@ module Ci
end
strong_memoize_attr :first_matching_pipeline
+ def first_matching_pipeline_size_exceeded?
+ project
+ .actual_limits
+ .exceeded?(:ci_pipeline_size, first_matching_pipeline.all_jobs)
+ end
+ strong_memoize_attr :first_matching_pipeline_size_exceeded?
+
def name
params[:name] || params[:context] || 'default'
end
@@ -99,22 +127,32 @@ module Ci
end
end
+ def external_commit_status_exists?
+ external_commit_status_scope(first_matching_pipeline).any?
+ end
+
def find_or_build_external_commit_status
- ::GenericCommitStatus.running_or_pending.find_or_initialize_by( # rubocop:disable CodeReuse/ActiveRecord
- project: project,
- pipeline: pipeline,
- name: name,
- ref: ref,
- user: current_user,
- protected: project.protected_for?(ref),
+ external_commit_status_scope(pipeline).find_or_initialize_by( # rubocop:disable CodeReuse/ActiveRecord
ci_stage: stage,
- stage_idx: stage.position,
- partition_id: pipeline.partition_id
+ stage_idx: stage.position
).tap do |new_commit_status|
new_commit_status.assign_attributes(optional_commit_status_params)
end
end
+ def external_commit_status_scope(pipeline)
+ scope = ::GenericCommitStatus
+ .running_or_pending
+ .for_project(project.id)
+ .in_pipelines(pipeline)
+ .in_partition(pipeline.partition_id)
+ .for_ref(ref)
+ .by_name(name)
+ .for_user(current_user)
+ scope = scope.ref_protected if project.protected_for?(ref)
+ scope
+ end
+
def add_or_update_external_job
::Ci::Pipelines::AddJobService.new(pipeline).execute!(commit_status) do |job|
apply_job_state!(job)
@@ -153,6 +191,22 @@ module Ci
}
end
+ def create_log_entry
+ Gitlab::AppJsonLogger.info(
+ class: self.class.name,
+ namespace_id: project.namespace_id,
+ project_id: project.id,
+ current_user_id: current_user.id,
+ subscription_plan: project.actual_plan_name,
+ message: 'Project tried to create more jobs than the quota allowed',
+ limit_enforced: enforce_jobs_limit?
+ )
+ end
+
+ def enforce_jobs_limit?
+ Feature.enabled?(:ci_limit_commit_statuses, project)
+ end
+
def not_found(message)
error("404 #{message} Not Found", :not_found)
end
diff --git a/app/views/admin/runners/edit.html.haml b/app/views/admin/runners/edit.html.haml
index 6eead81ab64..652385ee090 100644
--- a/app/views/admin/runners/edit.html.haml
+++ b/app/views/admin/runners/edit.html.haml
@@ -10,7 +10,7 @@
= render ::Layouts::SettingsSectionComponent.new(_('Restrict projects for this runner'), options: { class: 'gl-mt-7 gl-pt-6 gl-border-t' }) do |c|
- c.with_body do
.gl-flex.gl-flex-col.gl-gap-5
- = render ::Layouts::CrudComponent.new(_('Assigned projects')) do |c|
+ = render ::Layouts::CrudComponent.new(_('Assigned projects'), icon: 'project', count: @runner.runner_projects.count) do |c|
- c.with_body do
- if @runner.runner_projects.any?
%ul.content-list{ data: { testid: 'assigned-projects' } }
diff --git a/app/views/layouts/_page.html.haml b/app/views/layouts/_page.html.haml
index ced191d5bcf..671dba282e1 100644
--- a/app/views/layouts/_page.html.haml
+++ b/app/views/layouts/_page.html.haml
@@ -14,7 +14,7 @@
-# Broadcast messages
.broadcast-wrapper
= dispensable_render_if_exists "shared/token_expiration_banner"
- = dispensable_render "layouts/broadcast"
+ = dispensable_render "layouts/broadcast" unless content_for(:hide_broadcast_messages).present?
= yield :group_invite_members_banner
-# Alerts
diff --git a/app/views/layouts/project.html.haml b/app/views/layouts/project.html.haml
index 41d33f6a563..ff818aea5b9 100644
--- a/app/views/layouts/project.html.haml
+++ b/app/views/layouts/project.html.haml
@@ -26,6 +26,6 @@
= dispensable_render_if_exists "projects/importing_alert", project: @project
= dispensable_render_if_exists "shared/web_hooks/web_hook_disabled_alert"
= dispensable_render_if_exists "projects/free_user_cap_alert", project: @project
-= dispensable_render_if_exists 'shared/unlimited_members_during_trial_alert', resource: @project
+= dispensable_render_if_exists 'shared/unlimited_members_during_trial_alert', resource: @project unless content_for(:hide_unlimited_members_during_trial_alert).present?
= render template: "layouts/application"
diff --git a/app/views/projects/compare/rapid_diffs.html.haml b/app/views/projects/compare/rapid_diffs.html.haml
index cf726ab446d..abeabfe53ec 100644
--- a/app/views/projects/compare/rapid_diffs.html.haml
+++ b/app/views/projects/compare/rapid_diffs.html.haml
@@ -5,6 +5,8 @@
- has_diff = @commits.present? || @diffs.present? && @diffs.diff_files.present?
-# Only show commit list in the first page
- hide_commit_list = params[:page].present? && params[:page] != '1'
+- add_page_specific_style 'page_bundles/merge_requests'
+- add_page_specific_style 'page_bundles/compare_rapid_diffs'
.container-fluid{ class: [container_class] }
.gl-border-b-0.gl-mb-0.gl-pt-4
@@ -15,7 +17,8 @@
.container-fluid{ class: [container_class] }
= render "projects/commits/commit_list" unless hide_commit_list
.container-fluid
- = render RapidDiffs::DiffFileComponent.with_collection(@diffs.diff_files, parallel_view: diff_view == :parallel)
+ - args = { diffs_slice: nil, reload_stream_url: @reload_stream_url, stream_url: nil, show_whitespace: @show_whitespace_default, diff_view: diff_view, metadata_endpoint: nil, update_user_endpoint: @update_current_user_path, diff_files_endpoint: @diff_files_endpoint, lazy: true }
+ = render ::RapidDiffs::AppComponent.new(**args)
- else
.container-fluid
= render Pajamas::CardComponent.new(card_options: { class: "gl-bg-subtle" }) do |c|
diff --git a/config/events/create_pipeline_with_inputs.yml b/config/events/create_pipeline_with_inputs.yml
new file mode 100644
index 00000000000..50979f11ba2
--- /dev/null
+++ b/config/events/create_pipeline_with_inputs.yml
@@ -0,0 +1,24 @@
+---
+description: Using inputs when creating a pipeline
+internal_events: true
+action: create_pipeline_with_inputs
+identifiers:
+- project
+- namespace
+- user
+additional_properties:
+ label:
+ description: The source of the pipeline, e.g. push, merge_request, schedule, etc.
+ property:
+ description: The source of the config, e.g. repository_source, auto_devops_source, etc.
+ value:
+ description: Number of inputs passed from the user
+product_group: pipeline_authoring
+product_categories:
+- pipeline_composition
+milestone: '17.11'
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186735
+tiers:
+- free
+- premium
+- ultimate
diff --git a/config/events/request_todos_by_bot_user.yml b/config/events/request_todos_by_bot_user.yml
new file mode 100644
index 00000000000..e9e45d4fcfd
--- /dev/null
+++ b/config/events/request_todos_by_bot_user.yml
@@ -0,0 +1,20 @@
+---
+description: todos accessed by user who is a bot
+internal_events: true
+action: request_todos_by_bot_user
+identifiers:
+- user
+additional_properties:
+ label:
+ description: type of user
+ property:
+ description: type of user who requested todos
+product_group: personal_productivity
+product_categories:
+- notifications
+milestone: '17.11'
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/185261
+tiers:
+- free
+- premium
+- ultimate
diff --git a/config/feature_flags/gitlab_com_derisk/ci_limit_commit_statuses.yml b/config/feature_flags/gitlab_com_derisk/ci_limit_commit_statuses.yml
new file mode 100644
index 00000000000..217e6201f50
--- /dev/null
+++ b/config/feature_flags/gitlab_com_derisk/ci_limit_commit_statuses.yml
@@ -0,0 +1,9 @@
+---
+name: ci_limit_commit_statuses
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/436361
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/185807
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/526901
+milestone: '17.11'
+group: group::ci platform
+type: gitlab_com_derisk
+default_enabled: false
diff --git a/config/feature_flags/gitlab_com_derisk/glql_es_integration.yml b/config/feature_flags/gitlab_com_derisk/glql_es_integration.yml
new file mode 100644
index 00000000000..2f8214e60ec
--- /dev/null
+++ b/config/feature_flags/gitlab_com_derisk/glql_es_integration.yml
@@ -0,0 +1,9 @@
+---
+name: glql_es_integration
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/524326
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/185103
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/527280
+milestone: '17.11'
+group: group::knowledge
+type: gitlab_com_derisk
+default_enabled: false
diff --git a/config/metrics/counts_all/count_distinct_project_id_from_create_pipeline_with_inputs.yml b/config/metrics/counts_all/count_distinct_project_id_from_create_pipeline_with_inputs.yml
new file mode 100644
index 00000000000..0c2b3bda109
--- /dev/null
+++ b/config/metrics/counts_all/count_distinct_project_id_from_create_pipeline_with_inputs.yml
@@ -0,0 +1,23 @@
+---
+key_path: redis_hll_counters.count_distinct_project_id_from_create_pipeline_with_inputs
+description: Count of unique projects that created a CI pipeline with inputs via any source.
+product_group: pipeline_authoring
+product_categories:
+- pipeline_composition
+performance_indicator_type: []
+value_type: number
+status: active
+milestone: '17.11'
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186735
+time_frame:
+- 28d
+- 7d
+data_source: internal_events
+data_category: optional
+tiers:
+- free
+- premium
+- ultimate
+events:
+- name: create_pipeline_with_inputs
+ unique: project.id
diff --git a/config/metrics/counts_all/count_distinct_user_id_from_request_todos_by_bot_user.yml b/config/metrics/counts_all/count_distinct_user_id_from_request_todos_by_bot_user.yml
new file mode 100644
index 00000000000..a878a8df8fa
--- /dev/null
+++ b/config/metrics/counts_all/count_distinct_user_id_from_request_todos_by_bot_user.yml
@@ -0,0 +1,23 @@
+---
+key_path: redis_hll_counters.count_distinct_user_id_from_request_todos_by_bot_user
+description: Count of unique users who are bots and who are accessing todos through webui/api endpoint.
+product_group: personal_productivity
+product_categories:
+- notifications
+performance_indicator_type: []
+value_type: number
+status: active
+milestone: '17.11'
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/185261
+time_frame:
+- 28d
+- 7d
+data_source: internal_events
+data_category: optional
+tiers:
+- free
+- premium
+- ultimate
+events:
+- name: request_todos_by_bot_user
+ unique: user.id
diff --git a/data/deprecations/15-9-insecure-ci-job-token.yml b/data/deprecations/15-9-insecure-ci-job-token.yml
index 25612e827b9..924dfce7414 100644
--- a/data/deprecations/15-9-insecure-ci-job-token.yml
+++ b/data/deprecations/15-9-insecure-ci-job-token.yml
@@ -8,9 +8,9 @@
window: 1
impact: high # Can be one of: [critical, high, medium, low]
scope: project # Can be one or a combination of: [instance, group, project]
- reporter: jheimbuck_gl # (required) GitLab username of the person reporting the deprecation
- stage: Verify # (required) String value of the stage that the feature was created in. e.g., Growth
- issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/395708 # (required) Link to the deprecation issue in GitLab
+ reporter: jocelynjane # (required) GitLab username of the person reporting the deprecation
+ stage: Software Supply Chain Security # (required) String value of the stage that the feature was created in. e.g., Growth
+ issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/383084 # (required) Link to the deprecation issue in GitLab
body: | # (required) Do not modify this line, instead modify the lines below.
In GitLab 14.4, we introduced a setting to [limit access _from_ your project's CI/CD job tokens (`CI_JOB_TOKEN`)](https://docs.gitlab.com/ci/jobs/ci_job_token/#limit-your-projects-job-token-access) to make it more secure.
This setting was called **Limit CI_JOB_TOKEN access**. In GitLab 16.3, we renamed this setting to **Limit access _from_ this project** for clarity.
@@ -18,7 +18,7 @@
In GitLab 15.9, we introduced an alternative setting called
[**Authorized groups and projects**](https://docs.gitlab.com/ci/jobs/ci_job_token/#add-a-group-or-project-to-the-job-token-allowlist).
This setting controls job token access _to_ your project by using an allowlist.
- This new setting is a large improvement over the original. The first iteration is deprecated
+ This new setting is a large improvement over the original. The first iteration was deprecated
in GitLab 16.0 and scheduled for removal in GitLab 18.0.
The **Limit access _from_ this project** setting is disabled by default for all new projects.
diff --git a/data/deprecations/16-5-ci-job-token-limit-setting.yml b/data/deprecations/16-5-ci-job-token-limit-setting.yml
index 9b26ec84ebe..03f016f5106 100644
--- a/data/deprecations/16-5-ci-job-token-limit-setting.yml
+++ b/data/deprecations/16-5-ci-job-token-limit-setting.yml
@@ -7,7 +7,7 @@
breaking_change: true # (required) If this deprecation is a breaking change, set this value to true
window: 1
reporter: jocelynjane # (required) GitLab username of the person reporting the deprecation
- stage: govern # (required) String value of the stage that the feature was created in. e.g., Growth
+ stage: Software Supply Chain Security # (required) String value of the stage that the feature was created in. e.g., Growth
issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/383084 # (required) Link to the deprecation issue in GitLab
check_impact: Use the [Authentication Log](../ci/jobs/ci_job_token.md#job-token-authentication-log) to verify which projects are authenticating with your project.
impact: high # Can be one of: [critical, high, medium, low]
diff --git a/db/migrate/20250404212646_increase_description_limit_on_compliance_requirements.rb b/db/migrate/20250404212646_increase_description_limit_on_compliance_requirements.rb
new file mode 100644
index 00000000000..4b255abfc1e
--- /dev/null
+++ b/db/migrate/20250404212646_increase_description_limit_on_compliance_requirements.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class IncreaseDescriptionLimitOnComplianceRequirements < Gitlab::Database::Migration[2.2]
+ disable_ddl_transaction!
+ milestone '17.11'
+
+ def up
+ remove_text_limit :compliance_requirements, :description
+ add_text_limit :compliance_requirements, :description, 500
+ end
+
+ def down
+ remove_text_limit :compliance_requirements, :description
+ add_text_limit :compliance_requirements, :description, 255
+ end
+end
diff --git a/db/post_migrate/20250328135136_remove_subscription_seat_assignment_organization_id_default.rb b/db/post_migrate/20250328135136_remove_subscription_seat_assignment_organization_id_default.rb
new file mode 100644
index 00000000000..ec8adacc237
--- /dev/null
+++ b/db/post_migrate/20250328135136_remove_subscription_seat_assignment_organization_id_default.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class RemoveSubscriptionSeatAssignmentOrganizationIdDefault < Gitlab::Database::Migration[2.2]
+ milestone '17.11'
+
+ def change
+ change_column_default(:subscription_seat_assignments, :organization_id, from: 1, to: nil)
+ end
+end
diff --git a/db/post_migrate/20250407043340_remove_broken_fk_for_p_ci_stages_and_p_ci_pipelines_attempt3.rb b/db/post_migrate/20250407043340_remove_broken_fk_for_p_ci_stages_and_p_ci_pipelines_attempt3.rb
new file mode 100644
index 00000000000..6f091e81b1f
--- /dev/null
+++ b/db/post_migrate/20250407043340_remove_broken_fk_for_p_ci_stages_and_p_ci_pipelines_attempt3.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+class RemoveBrokenFkForPCiStagesAndPCiPipelinesAttempt3 < Gitlab::Database::Migration[2.2]
+ include Gitlab::Database::PartitioningMigrationHelpers::ForeignKeyHelpers
+ include Gitlab::Database::MigrationHelpers::WraparoundAutovacuum
+
+ milestone '17.11'
+ disable_ddl_transaction!
+
+ SOURCE_TABLE_NAME = :p_ci_stages
+ TARGET_TABLE_NAME = :p_ci_pipelines
+ FK_NAME = :fk_fb57e6cc56_p
+
+ def up
+ return unless can_execute_on?(:ci_pipelines, :ci_stages)
+
+ with_lock_retries do
+ remove_foreign_key_if_exists(
+ SOURCE_TABLE_NAME,
+ TARGET_TABLE_NAME,
+ name: FK_NAME,
+ reverse_lock_order: true
+ )
+ end
+ end
+
+ def down
+ # no-op
+ # Since we recreate the fk in db/post_migrate/20250326204934_remove_broken_fk_for_p_ci_stages_and_p_ci_pipelines.rb
+ end
+end
diff --git a/db/schema_migrations/20250320005730 b/db/schema_migrations/20250320005730
index e69de29bb2d..7797c1c0521 100644
--- a/db/schema_migrations/20250320005730
+++ b/db/schema_migrations/20250320005730
@@ -0,0 +1 @@
+85210d36999484fafe57284bc5c68985d68f48061530ff79429c84875a6420f2
\ No newline at end of file
diff --git a/db/schema_migrations/20250328135136 b/db/schema_migrations/20250328135136
new file mode 100644
index 00000000000..24c8baa003b
--- /dev/null
+++ b/db/schema_migrations/20250328135136
@@ -0,0 +1 @@
+b062d670e1b5da5de8bca3c4082a3a6cd76f873e33098cf3873fcee6ba1b128c
\ No newline at end of file
diff --git a/db/schema_migrations/20250404212646 b/db/schema_migrations/20250404212646
new file mode 100644
index 00000000000..c74450cab49
--- /dev/null
+++ b/db/schema_migrations/20250404212646
@@ -0,0 +1 @@
+6dc9a76b5e4b712f670b18cc23721aa673b6db01c2a1806de0a0defb2019e39e
\ No newline at end of file
diff --git a/db/schema_migrations/20250407043340 b/db/schema_migrations/20250407043340
new file mode 100644
index 00000000000..e9d0ddf220e
--- /dev/null
+++ b/db/schema_migrations/20250407043340
@@ -0,0 +1 @@
+e4400de67e39e1bd6934ff41c05de276c7bf26294f15fb9ac6ac62e293e47ffa
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 9b1a56e12d3..59c0673e570 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -12651,7 +12651,7 @@ CREATE TABLE compliance_requirements (
description text NOT NULL,
control_expression text,
requirement_type smallint DEFAULT 0 NOT NULL,
- CONSTRAINT check_71d7c59197 CHECK ((char_length(description) <= 255)),
+ CONSTRAINT check_71d7c59197 CHECK ((char_length(description) <= 500)),
CONSTRAINT check_be5c3cfc16 CHECK ((char_length(control_expression) <= 2048)),
CONSTRAINT check_f1fb6fdd81 CHECK ((char_length(name) <= 255))
);
@@ -23215,7 +23215,7 @@ CREATE TABLE subscription_seat_assignments (
last_activity_on timestamp with time zone,
created_at timestamp with time zone NOT NULL,
updated_at timestamp with time zone NOT NULL,
- organization_id bigint DEFAULT 1 NOT NULL,
+ organization_id bigint NOT NULL,
seat_type smallint
);
diff --git a/doc/api/broadcast_messages.md b/doc/api/broadcast_messages.md
index 05b592bedda..fd2b8b454a7 100644
--- a/doc/api/broadcast_messages.md
+++ b/doc/api/broadcast_messages.md
@@ -20,7 +20,7 @@ title: Broadcast Messages API
{{< /history >}}
-Broadcast messages API operates on [broadcast messages](../administration/broadcast_messages.md).
+Use this API to interact with banners and notifications displayed in the UI. For more information, see [broadcast messages](../administration/broadcast_messages.md).
GET requests do not require authentication. All other broadcast message API endpoints are accessible only to administrators. Non-GET requests by:
diff --git a/doc/api/database_migrations.md b/doc/api/database_migrations.md
index df98a894cae..0d753bb7e01 100644
--- a/doc/api/database_migrations.md
+++ b/doc/api/database_migrations.md
@@ -18,9 +18,11 @@ title: Database migrations API
{{< /history >}}
-This API is for managing database migrations used in the development of GitLab.
+Use this API to manage GitLab database migrations.
-All methods require administrator authorization.
+Prerequisites:
+
+- You must have administrator access to the instance.
## Mark a migration as successful
diff --git a/doc/api/events.md b/doc/api/events.md
index 60ecfa35043..7b1d4db13f7 100644
--- a/doc/api/events.md
+++ b/doc/api/events.md
@@ -12,6 +12,8 @@ title: Events API
{{< /details >}}
+Use this API to view user and project events.
+
## Filter parameters
### Actions
@@ -137,7 +139,7 @@ Example response:
]
```
-### Get user contribution events
+## Get user contribution events
Get the contribution events for the specified user, sorted from newest to oldest. Scope `read_user` or `api` is required.
Events associated with epics are not available using API.
diff --git a/doc/api/experiments.md b/doc/api/experiments.md
index a244ae9d06b..c0992eca5b0 100644
--- a/doc/api/experiments.md
+++ b/doc/api/experiments.md
@@ -2,7 +2,7 @@
stage: Growth
group: Acquisition
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
-title: Experiments API (GitLab team only)
+title: Experiments API
---
{{< details >}}
@@ -12,9 +12,11 @@ title: Experiments API (GitLab team only)
{{< /details >}}
-This API is for listing A/B experiments [defined in GitLab](../development/experiment_guide/_index.md).
+Use this API to interact with A/B experiments. For more information, see the [experiment guide](../development/experiment_guide/_index.md).
-The user must be a [GitLab team member](https://gitlab.com/groups/gitlab-com/-/group_members) to access the API.
+Prerequisites:
+
+- You must be a [GitLab team member](https://gitlab.com/groups/gitlab-com/-/group_members).
## List all experiments
diff --git a/doc/api/model_registry.md b/doc/api/model_registry.md
index 0ccd7dfbcfd..7ca11edb836 100644
--- a/doc/api/model_registry.md
+++ b/doc/api/model_registry.md
@@ -12,6 +12,8 @@ title: Model registry API
{{< /details >}}
+Use this API to interact with the machine learning model registry. For more information, see [model registry](../user/project/ml/model_registry/_index.md).
+
## Download a machine learning model package
Returns the file.
diff --git a/doc/api/openapi/openapi_v2.yaml b/doc/api/openapi/openapi_v2.yaml
index edcb673d7ff..994bedfd7ad 100644
--- a/doc/api/openapi/openapi_v2.yaml
+++ b/doc/api/openapi/openapi_v2.yaml
@@ -15033,6 +15033,58 @@ paths:
tags:
- conan_packages
operationId: getApiV4ProjectsIdPackagesConanV2ConansPackageNamePackageVersionPackageUsernamePackageChannelLatest
+ "/api/v4/projects/{id}/packages/conan/v2/conans/{package_name}/{package_version}/{package_username}/{package_channel}/revisions":
+ get:
+ summary: Get the list of revisions
+ description: This feature was introduced in GitLab 17.11
+ produces:
+ - application/json
+ parameters:
+ - in: path
+ name: id
+ description: The ID or URL-encoded path of the project
+ type: string
+ required: true
+ - in: path
+ name: package_name
+ description: Package name
+ type: string
+ required: true
+ example: my-package
+ - in: path
+ name: package_version
+ description: Package version
+ type: string
+ required: true
+ example: '1.0'
+ - in: path
+ name: package_username
+ description: Package username
+ type: string
+ required: true
+ example: my-group+my-project
+ - in: path
+ name: package_channel
+ description: Package channel
+ type: string
+ required: true
+ example: stable
+ responses:
+ '200':
+ description: Get the list of revisions
+ schema:
+ "$ref": "#/definitions/API_Entities_Packages_Conan_RecipeRevision"
+ '400':
+ description: Bad Request
+ '401':
+ description: Unauthorized
+ '403':
+ description: Forbidden
+ '404':
+ description: Not Found
+ tags:
+ - conan_packages
+ operationId: getApiV4ProjectsIdPackagesConanV2ConansPackageNamePackageVersionPackageUsernamePackageChannelRevisions
? "/api/v4/projects/{id}/packages/conan/v2/conans/{package_name}/{package_version}/{package_username}/{package_channel}/revisions/{recipe_revision}/files"
: get:
summary: List recipe files
diff --git a/doc/api/packages/conan_v2.md b/doc/api/packages/conan_v2.md
index a125f7d66d4..a79cd2c15b2 100644
--- a/doc/api/packages/conan_v2.md
+++ b/doc/api/packages/conan_v2.md
@@ -12,6 +12,12 @@ title: Conan v2 API
{{< /details >}}
+{{< history >}}
+
+- [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/519741) in GitLab 17.11 [with a flag](../../administration/feature_flags.md) named `conan_package_revisions_support`. Disabled by default.
+
+{{< /history >}}
+
{{< alert type="note" >}}
For Conan v1 operations, see [Conan v1 API](conan_v1.md).
@@ -20,6 +26,12 @@ For Conan v1 operations, see [Conan v1 API](conan_v1.md).
Use this API to interact with the Conan v2 package manager. For more information, see [Conan packages in the package registry](../../user/packages/conan_repository/_index.md).
+{{< alert type="flag" >}}
+
+The availability of this feature is controlled by a feature flag. For more information, see the history.
+
+{{< /alert >}}
+
Generally, these endpoints are used by the [Conan 2 package manager client](https://docs.conan.io/2/index.html)
and are not meant for manual consumption.
@@ -53,18 +65,6 @@ The project-level prefix is used to make requests in a single project's scope. T
## Get latest recipe revision
-{{< history >}}
-
-- [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/519741) in GitLab 17.11 [with a flag](../../administration/feature_flags.md) named `conan_package_revisions_support`. Disabled by default.
-
-{{< /history >}}
-
-{{< alert type="flag" >}}
-
-The availability of this feature is controlled by a feature flag. For more information, see the history.
-
-{{< /alert >}}
-
Get the revision hash and creation date of the latest package recipe.
```plaintext
@@ -118,3 +118,40 @@ curl --request PUT \
--upload-file path/to/conaninfo.txt \
"https://gitlab.example.com/api/v4/projects/9/packages/conan/v2/conans/my-package/1.0/my-group+my-project/stable/revisions/75151329520e7685dcf5da49ded2fec0/packages/103f6067a947f366ef91fc1b7da351c588d1827f/revisions/3bdd2d8c8e76c876ebd1ac0469a4e72c/files/conaninfo.txt"
```
+
+## List all recipe revisions
+
+List all revisions for a package recipe.
+
+```plaintext
+GET
/v2/conans/:package_name/:package_version/:package_username/:package_channel/revisions
+```
+
+| Attribute | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `package_name` | string | yes | Name of a package. |
+| `package_version` | string | yes | Version of a package. |
+| `package_username` | string | yes | Conan username of a package. This attribute is the `+`-separated full path of your project. |
+| `package_channel` | string | yes | Channel of a package. |
+
+```shell
+curl --header "Authorization: Bearer " "https://gitlab.example.com/api/v4/projects/9/packages/conan/v2/conans/my-package/1.0/my-group+my-project/stable/revisions"
+```
+
+Example response:
+
+```json
+{
+ "reference": "my-package/1.0@my-group+my-project/stable",
+ "revisions": [
+ {
+ "revision": "75151329520e7685dcf5da49ded2fec0",
+ "time": "2024-12-17T09:16:40.334+0000"
+ },
+ {
+ "revision": "df28fd816be3a119de5ce4d374436b25",
+ "time": "2024-12-17T09:15:30.123+0000"
+ }
+ ]
+}
+```
diff --git a/doc/api/usage_data.md b/doc/api/usage_data.md
index 9faa240f63b..2dc2023e429 100644
--- a/doc/api/usage_data.md
+++ b/doc/api/usage_data.md
@@ -12,7 +12,7 @@ title: Service Ping API
{{< /details >}}
-The Service Ping API is associated with [Service Ping](../development/internal_analytics/service_ping/_index.md).
+Use this API to interact with the GitLab Service Ping process. For more information, see the [Service Ping development guidelines](../development/internal_analytics/service_ping/_index.md).
## Export Service Ping data
diff --git a/doc/ci/jobs/fine_grained_permissions.md b/doc/ci/jobs/fine_grained_permissions.md
index 186057a3f4e..5c2a2612ad6 100644
--- a/doc/ci/jobs/fine_grained_permissions.md
+++ b/doc/ci/jobs/fine_grained_permissions.md
@@ -190,6 +190,7 @@ The following endpoints are available for CI/CD job tokens.
| Packages: Read | `READ_PACKAGES` | `GET /projects/:id/packages/conan/v2/conans/:package_name/:package_version/:package_username/:package_channel/latest` | Get the latest revision |
| Packages: Read | `READ_PACKAGES` | `GET /projects/:id/packages/conan/v2/conans/:package_name/:package_version/:package_username/:package_channel/revisions/:recipe_revision/files/:file_name` | Download recipe files |
| Packages: Read | `READ_PACKAGES` | `GET /projects/:id/packages/conan/v2/conans/:package_name/:package_version/:package_username/:package_channel/revisions/:recipe_revision/files` | List recipe files |
+| Packages: Read | `READ_PACKAGES` | `GET /projects/:id/packages/conan/v2/conans/:package_name/:package_version/:package_username/:package_channel/revisions` | Get the list of revisions |
| Packages: Read | `READ_PACKAGES` | `GET /projects/:id/packages/generic/:package_name/*package_version/(*path/):file_name` | Download package file |
| Packages: Read | `READ_PACKAGES` | `GET /projects/:id/packages/go/*module_name/@v/:module_version.info` | Version metadata |
| Packages: Read | `READ_PACKAGES` | `GET /projects/:id/packages/go/*module_name/@v/:module_version.mod` | Download module file |
diff --git a/doc/update/breaking_windows.md b/doc/update/breaking_windows.md
index 8886b25a05d..934614a285f 100644
--- a/doc/update/breaking_windows.md
+++ b/doc/update/breaking_windows.md
@@ -24,8 +24,8 @@ This window takes place on April 21 - 23, 2025 from 09:00 UTC to 22:00 UTC.
| Deprecation | Impact | Stage | Scope | Check potential impact |
|-------------|--------|-------|-------|------------------------|
-| [CI/CD job token - **Limit access from your project** setting removal](https://gitlab.com/gitlab-org/gitlab/-/issues/395708) | High | Verify | Project | |
-| [CI/CD job token - **Authorized groups and projects** allowlist enforcement](https://gitlab.com/gitlab-org/gitlab/-/issues/383084) | High | Govern | Project | Use the [Authentication Log](../ci/jobs/ci_job_token.md#job-token-authentication-log) to verify which projects are authenticating with your project. |
+| [CI/CD job token - **Limit access from your project** setting removal](https://gitlab.com/gitlab-org/gitlab/-/issues/383084) | High | Software supply chain security | Project | |
+| [CI/CD job token - **Authorized groups and projects** allowlist enforcement](https://gitlab.com/gitlab-org/gitlab/-/issues/383084) | High | Software supply chain security | Project | Use the [Authentication Log](../ci/jobs/ci_job_token.md#job-token-authentication-log) to verify which projects are authenticating with your project. |
| [Deprecate License Scanning CI/CD artifact report type](https://gitlab.com/gitlab-org/gitlab/-/issues/439301) | Low | Secure | Project | |
| [OpenTofu CI/CD template](https://gitlab.com/components/opentofu/-/issues/43#note_1913822299) | Low | Deploy | Project | |
| [CodeClimate-based Code Quality scanning will be removed](https://gitlab.com/gitlab-org/gitlab/-/issues/471677) | High | Secure | | |
diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md
index 4f2462aa08d..7fdee182acb 100644
--- a/doc/update/deprecations.md
+++ b/doc/update/deprecations.md
@@ -956,7 +956,7 @@ This migration tool will be removed in GitLab 18.3.
- Announced in GitLab 15.9
- Removal in GitLab 18.0 ([breaking change](https://docs.gitlab.com/update/terminology/#breaking-change))
-- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/issues/395708).
+- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/issues/383084).