Add latest changes from gitlab-org/gitlab@master

.haml-lint.yml

@@ -118,6 +118,7 @@ linters:
       - Cop/ProjectPathHelper
       - Gitlab/FeatureAvailableUsage
       - Gitlab/Json
+      - Gitlab/Rails/SafeFormat
       - GitlabSecurity/PublicSend
       - Layout/FirstHashElementIndentation
       - Layout/EmptyLineAfterGuardClause

.rubocop_todo/gitlab/rails/safe_format.yml

@@ -0,0 +1,59 @@
+---
+# Cop supports --autocorrect.
+Gitlab/Rails/SafeFormat:
+  Details: grace period
+  Exclude:
+    - 'app/controllers/profiles/two_factor_auths_controller.rb'
+    - 'app/graphql/types/project_type.rb'
+    - 'app/helpers/auth_helper.rb'
+    - 'app/helpers/emails_helper.rb'
+    - 'app/helpers/groups/group_members_helper.rb'
+    - 'app/helpers/groups_helper.rb'
+    - 'app/helpers/import_helper.rb'
+    - 'app/helpers/members_helper.rb'
+    - 'app/helpers/merge_requests_helper.rb'
+    - 'app/helpers/profiles_helper.rb'
+    - 'app/helpers/projects_helper.rb'
+    - 'app/helpers/reminder_emails_helper.rb'
+    - 'app/helpers/search_helper.rb'
+    - 'app/helpers/sourcegraph_helper.rb'
+    - 'app/helpers/whats_new_helper.rb'
+    - 'app/models/integrations/apple_app_store.rb'
+    - 'app/models/integrations/asana.rb'
+    - 'app/models/integrations/bamboo.rb'
+    - 'app/models/integrations/beyond_identity.rb'
+    - 'app/models/integrations/bugzilla.rb'
+    - 'app/models/integrations/clickup.rb'
+    - 'app/models/integrations/confluence.rb'
+    - 'app/models/integrations/custom_issue_tracker.rb'
+    - 'app/models/integrations/datadog.rb'
+    - 'app/models/integrations/discord.rb'
+    - 'app/models/integrations/ewm.rb'
+    - 'app/models/integrations/external_wiki.rb'
+    - 'app/models/integrations/google_play.rb'
+    - 'app/models/integrations/hangouts_chat.rb'
+    - 'app/models/integrations/irker.rb'
+    - 'app/models/integrations/jenkins.rb'
+    - 'app/models/integrations/mattermost.rb'
+    - 'app/models/integrations/pivotaltracker.rb'
+    - 'app/models/integrations/redmine.rb'
+    - 'app/models/integrations/unify_circuit.rb'
+    - 'app/models/integrations/youtrack.rb'
+    - 'app/presenters/ci/pipeline_presenter.rb'
+    - 'app/presenters/key_presenter.rb'
+    - 'app/presenters/project_presenter.rb'
+    - 'app/services/jira/requests/base.rb'
+    - 'app/services/security/ci_configuration/base_create_service.rb'
+    - 'ee/app/components/namespaces/free_user_cap/enforcement_alert_component.rb'
+    - 'ee/app/components/namespaces/free_user_cap/usage_quota_alert_component.rb'
+    - 'ee/app/components/namespaces/free_user_cap/usage_quota_trial_alert_component.rb'
+    - 'ee/app/helpers/ee/application_helper.rb'
+    - 'ee/app/helpers/ee/import_helper.rb'
+    - 'ee/app/helpers/ee/members_helper.rb'
+    - 'ee/app/helpers/ee/search_helper.rb'
+    - 'ee/app/helpers/push_rules_helper.rb'
+    - 'ee/app/models/integrations/git_guardian.rb'
+    - 'ee/app/models/integrations/github.rb'
+    - 'ee/lib/gitlab/licenses/submit_license_usage_data_banner.rb'
+    - 'ee/lib/gitlab/manual_quarterly_co_term_banner.rb'
+    - 'spec/helpers/profiles_helper_spec.rb'

Dangerfile

@@ -13,7 +13,9 @@ Gitlab::Dangerfiles.for_project(self, project_name) do |gitlab_dangerfiles|
   gitlab_dangerfiles.import_plugins
   gitlab_dangerfiles.config.ci_only_rules = ProjectHelper::CI_ONLY_RULES
   gitlab_dangerfiles.config.files_to_category = ProjectHelper::CATEGORIES
+
   gitlab_dangerfiles.config.excluded_required_codeowners_sections_for_roulette.push('Database')
+  gitlab_dangerfiles.config.included_optional_codeowners_sections_for_roulette.push('Backend Static Code Analysis')
 
   gitlab_dangerfiles.import_dangerfiles(except: %w[simple_roulette])
 end

app/assets/javascripts/diffs/components/no_changes.vue

@@ -1,12 +1,18 @@
 <script>
-import { GlButton, GlSprintf } from '@gitlab/ui';
+import { GlSprintf, GlEmptyState } from '@gitlab/ui';
 // eslint-disable-next-line no-restricted-imports
 import { mapGetters } from 'vuex';
+import { s__, __ } from '~/locale';
 
 export default {
+  i18n: {
+    title: s__('MergeRequest|There are no changes yet'),
+    message: __('No changes between %{source} and %{target}'),
+    buttonText: __('Create commit'),
+  },
   components: {
-    GlButton,
     GlSprintf,
+    GlEmptyState,
   },
   props: {
     changesEmptyStateIllustration: {
@@ -45,28 +51,23 @@ export default {
 </script>
 
 <template>
-  <div class="row empty-state">
-    <div class="col-12">
-      <div class="svg-content svg-250"><img :src="changesEmptyStateIllustration" /></div>
-    </div>
-    <div class="col-12">
-      <div class="text-content text-center">
-        <div data-testid="no-changes-message">
-          <gl-sprintf :message="__('No changes between %{source} and %{target}')">
-            <template #source>
-              <span class="ref-name">{{ sourceName }}</span>
-            </template>
-            <template #target>
-              <span class="ref-name">{{ targetName }}</span>
-            </template>
-          </gl-sprintf>
-        </div>
-        <div class="text-center">
-          <gl-button :href="getNoteableData.new_blob_path" variant="confirm" category="primary">{{
-            __('Create commit')
-          }}</gl-button>
-        </div>
-      </div>
-    </div>
-  </div>
+  <gl-empty-state
+    :title="$options.i18n.title"
+    :svg-path="changesEmptyStateIllustration"
+    :primary-button-text="$options.i18n.buttonText"
+    :primary-button-link="getNoteableData.new_blob_path"
+  >
+    <template #description>
+      <span data-testid="no-changes-message">
+        <gl-sprintf :message="$options.i18n.message">
+          <template #source>
+            <span class="ref-name">{{ sourceName }}</span>
+          </template>
+          <template #target>
+            <span class="ref-name">{{ targetName }}</span>
+          </template>
+        </gl-sprintf>
+      </span>
+    </template>
+  </gl-empty-state>
 </template>

app/components/pajamas/checkbox_component.html.haml

@@ -1,4 +1,4 @@
-.gl-form-checkbox.custom-control.custom-checkbox
+.gl-form-checkbox.custom-control.custom-checkbox{ content_wrapper_options }
   = form.check_box(method,
       formatted_input_options,
       checked_value,

app/components/pajamas/checkbox_component.rb

@@ -20,6 +20,7 @@ def initialize(
       help_text: nil,
       label_options: {},
       checkbox_options: {},
+      content_wrapper_options: {},
       checked_value: '1',
       unchecked_value: '0'
     )
@@ -29,6 +30,7 @@ def initialize(
       @help_text_argument = help_text
       @label_options = label_options
       @input_options = checkbox_options
+      @content_wrapper_options = content_wrapper_options
       @checked_value = checked_value
       @unchecked_value = unchecked_value
       @value = checked_value if checkbox_options[:multiple]
@@ -43,6 +45,7 @@ def initialize(
       :help_text_argument,
       :label_options,
       :input_options,
+      :content_wrapper_options,
       :checked_value,
       :unchecked_value,
       :value

app/helpers/merge_requests_helper.rb

@@ -188,7 +188,7 @@ def diffs_tab_pane_data(project, merge_request, params)
       current_user_data: @current_user_data,
       update_current_user_path: @update_current_user_path,
       project_path: project_path(merge_request.project),
-      changes_empty_state_illustration: image_path('illustrations/merge_request_changes_empty.svg'),
+      changes_empty_state_illustration: image_path('illustrations/empty-state/empty-commit-md.svg'),
       is_fluid_layout: fluid_layout.to_s,
       dismiss_endpoint: callouts_path,
       show_suggest_popover: show_suggest_popover?.to_s,

app/models/integrations/mattermost_slash_commands.rb

@@ -30,6 +30,10 @@ def self.to_param
       'mattermost_slash_commands'
     end
 
+    def avatar_url
+      ActionController::Base.helpers.image_path('illustrations/third-party-logos/integrations-logos/mattermost.svg')
+    end
+
     def configure(user, params)
       token = ::Mattermost::Command.new(user)
         .create(command(params))

app/views/shared/namespaces/cascading_settings/_enforcement_checkbox.html.haml

@@ -13,4 +13,5 @@
 = form.gitlab_ui_checkbox_component lock_attribute,
   label,
   help_text: help_text,
-  checkbox_options: { checked: group.namespace_settings.public_send(lock_attribute), data: { testid: 'enforce-for-all-subgroups-checkbox' } }
+  checkbox_options: { checked: group.namespace_settings.public_send(lock_attribute), data: { testid: 'enforce-for-all-subgroups-checkbox' } },
+  content_wrapper_options: { class: 'gl-pl-7!' }

app/views/shared/namespaces/cascading_settings/_setting_checkbox.html.haml

@@ -0,0 +1,20 @@
+- attribute = local_assigns.fetch(:attribute, nil)
+- group = local_assigns.fetch(:group, nil)
+- settings_path_helper = local_assigns.fetch(:settings_path_helper, nil)
+- form = local_assigns.fetch(:form, nil)
+- setting_locked = local_assigns.fetch(:setting_locked, false)
+- help_text = local_assigns.fetch(:help_text, nil)
+- checked = local_assigns.fetch(:checked, false)
+- klass = local_assigns.fetch(:class, nil)
+
+- return unless attribute && group && form && settings_path_helper
+
+= form.gitlab_ui_checkbox_component attribute, checkbox_options: { checked: checked, disabled: setting_locked, class: klass } do |c|
+  = c.with_label attribute, class: 'custom-control-label', aria: { disabled: setting_locked } do
+    = render 'shared/namespaces/cascading_settings/setting_label_container' do
+      = yield
+      - if setting_locked
+        = render 'shared/namespaces/cascading_settings/lock_icon', local_assigns
+  - if help_text
+    = c.with_help_text do
+      = help_text

app/workers/integrations/execute_worker.rb

@@ -15,7 +15,7 @@ class ExecuteWorker # rubocop:disable Scalability/IdempotentWorker
     def perform(hook_id, data)
       return if ::Gitlab::SilentMode.enabled?
 
-      data = data.with_indifferent_access
+      data = Gitlab::WebHooks.prepare_data(data)
       integration = Integration.find_by_id(hook_id)
       return unless integration
 

app/workers/web_hook_worker.rb

@@ -17,7 +17,7 @@ def perform(hook_id, data, hook_name, params = {})
     hook = WebHook.find_by_id(hook_id)
     return unless hook
 
-    data = data.with_indifferent_access
+    data = Gitlab::WebHooks.prepare_data(data)
     params.symbolize_keys!
 
     # Before executing the hook, reapply any recursion detection UUID that was initially

config/feature_flags/gitlab_com_derisk/wiki_content_background_job.yml

@@ -0,0 +1,9 @@
+---
+name: wiki_content_background_job
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/367628
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/146973
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/452495
+milestone: '16.11'
+group: group::knowledge
+type: gitlab_com_derisk
+default_enabled: false

doc/api/group_access_tokens.md

@@ -150,9 +150,6 @@ POST /groups/:id/access_tokens/:token_id/rotate
 | `token_id` | integer | yes | ID of the access token |
 | `expires_at` | date    | no       | Expiration date of the access token in ISO format (`YYYY-MM-DD`). [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/416795) in GitLab 16.6. |
 
-NOTE:
-Non-administrators can rotate their own tokens. Administrators can rotate tokens of any user in the group.
-
 ```shell
 curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/groups/<group_id>/access_tokens/<token_id>/rotate"
 ```

doc/api/project_access_tokens.md

@@ -159,9 +159,6 @@ POST /projects/:id/access_tokens/:token_id/rotate
 | `token_id` | integer | yes | ID of the project access token |
 | `expires_at` | date    | no       | Expiration date of the access token in ISO format (`YYYY-MM-DD`). [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/416795) in GitLab 16.6. |
 
-NOTE:
-Non-administrators can rotate their own tokens. Administrators can rotate tokens of any user in the project.
-
 ```shell
 curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/<project_id>/access_tokens/<token_id>/rotate"
 ```

doc/development/ai_architecture.md

@@ -6,16 +6,65 @@ info: Any user with at least the Maintainer role can merge updates to this conte
 
 # AI Architecture
 
-GitLab has created a common set of tools to support our product groups and their utilization of AI. Our goals with this common architecture are:
+This document describes architecture shared by the GitLab Duo AI features. For historical motivation and goals of this architecture, see the [AI Gateway Architecture blueprint](../architecture/blueprints/ai_gateway/index.md).
+
+## Introduction
+
+The following diagram shows a simplified view of how the different components in GitLab interact.
+
+```plantuml
+@startuml
+!theme cloudscape-design
+skinparam componentStyle rectangle
+
+package Clients {
+  [IDEs, Code Editors, Language Server] as IDE
+  [GitLab Web Frontend] as GLWEB
+}
+
+[GitLab.com] as GLCOM
+[Self-Managed/Dedicated] as SMI
+[CustomersDot API] as CD
+[AI Gateway] as AIGW
+
+package Models {
+  [3rd party models (Anthropic,VertexAI)] as THIRD
+  [GitLab Native Models] as GLNM
+}
+
+Clients -down-> GLCOM : REST/Websockets
+Clients -down-> SMI : REST/Websockets
+SMI -right-> CD : License + JWT Sync
+GLCOM -down-> AIGW : Prompts + Telemetry + JWT (REST)
+
+SMI -down-> AIGW : Prompts + Telemetry + JWT (REST)
+AIGW -up-> GLCOM : JWKS public key sync
+AIGW -up-> CD : JWKS public key sync
+AIGW -down-> Models : prompts
+@enduml
+```
+
+- **AI Abstraction layer** - Every GitLab instance (Self-Managed, GitLab.com, ..) contains an [AI Abstraction layer](ai_features/index.md) which provides a framework for implementing new AI features in the monolith. This layer adds contextual information to the request and does request pre/post processing.
 
-1. Increase the velocity of feature teams by providing a set of high quality, ready to use tools
-1. Ability to switch underlying technologies quickly and easily
+### Systems
 
-AI is moving very quickly, and we need to be able to keep pace with changes in the area. We have built an [abstraction layer](ai_features/index.md) to do this, allowing us to take a more "pluggable" approach to the underlying models, data stores, and other technologies.
+- [GitLab instances](https://gitlab.com/gitlab-org/gitlab) - GitLab monolith that powers all types of GitLab instances
+- [CustomersDot](https://gitlab.com/gitlab-org/customers-gitlab-com) - Allows customers to buy and upgrade subscriptions by adding more seats and add/edit payment records. It also manages self-managed licenses.
+- [AI Gateway](https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist) - System that provides unified interface for invoking models. Deployed in Google Cloud Run (using [Runway](https://gitlab.com/gitlab-com/gl-infra/platform/runway)).
+- Extensions
+  - [Language Server](https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp) (powers code suggestions in VS Code, VisualStudio and Neovim)
+  - [VS Code](https://gitlab.com/gitlab-org/gitlab-vscode-extension)
+  - [JetBrains](https://gitlab.com/gitlab-org/editor-extensions/gitlab-jetbrains-plugin)
+  - [Visual Studio](https://gitlab.com/gitlab-org/editor-extensions/gitlab-visual-studio-extension)
+  - [Neovim](https://gitlab.com/gitlab-org/editor-extensions/gitlab.vim)
 
-The following diagram from the [architecture blueprint](../architecture/blueprints/ai_gateway/index.md) shows a simplified view of how the different components in GitLab interact. The abstraction layer helps avoid code duplication within the REST APIs.
+### Difference between how GitLab.com and Self-Managed/Dedicated access AI Gateway
 
-![architecture diagram](../architecture/blueprints/ai_gateway/img/architecture.png)
+- GitLab.com
+  - GitLab.com instances self-issue JWT Auth token signed with a private key.
+- Other types of instances
+  - Self-Managed and Dedicated regularly synchronise their licenses and AI Access tokens with CustomersDot.
+  - Self-Managed and Dedicated instances route traffic to appropriate AI Gateway.
 
 ## SaaS-based AI abstraction layer
 
@@ -128,3 +177,8 @@ Code Suggestions acceptance rates are _highly_ sensitive to latency. While writi
 In a worst case with sufficient latency, the IDE could be issuing a string of requests, each of which is then ignored as the user proceeds without waiting for the response. This adds no value for the user, while still putting load on our services.
 
 See our discussions [here](https://gitlab.com/gitlab-org/gitlab/-/issues/418955) around how we plan to iterate on latency for this feature.
+
+## Future changes to the architecture
+
+- We plan on deploying [AI Gateway](https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist) in different regions to improve latency (see the ed epic [Multi-region support for AI Gateway](https://gitlab.com/groups/gitlab-com/gl-infra/-/epics/1206)).
+- We would like to centralize telemetry. However, centralizing AI (or, Cloud Connector) telemetry is a difficult and unsolved problem as of now.