Add latest changes from gitlab-org/gitlab@master

config/feature_flags/development/replace_order_by_created_at_with_id.yml

@@ -1,8 +0,0 @@
----
-name: replace_order_by_created_at_with_id
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/86104
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/360757
-milestone: '15.0'
-type: development
-group: group::workspace
-default_enabled: false

config/feature_flags/development/use_status_for_repository_update_mirror.yml

@@ -0,0 +1,8 @@
+---
+name: use_status_for_repository_update_mirror
+introduced_by_url: 
+rollout_issue_url: 
+milestone: '15.1'
+type: development
+group: group::source code
+default_enabled: false

config/gitlab_loose_foreign_keys.yml

@@ -179,6 +179,10 @@ dast_site_profiles_pipelines:
   - table: ci_pipelines
     column: ci_pipeline_id
     on_delete: async_delete
+deployments:
+  - table: clusters
+    column: cluster_id
+    on_delete: async_nullify
 external_pull_requests:
   - table: projects
     column: project_id

db/post_migrate/20220531024142_track_clusters_deletions.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class TrackClustersDeletions < Gitlab::Database::Migration[2.0]
+  include Gitlab::Database::MigrationHelpers::LooseForeignKeyHelpers
+
+  enable_lock_retries!
+
+  def up
+    track_record_deletions(:clusters)
+  end
+
+  def down
+    untrack_record_deletions(:clusters)
+  end
+end

db/post_migrate/20220531024143_remove_clusters_deployments_cluster_id_fk.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+class RemoveClustersDeploymentsClusterIdFk < Gitlab::Database::Migration[2.0]
+  FK_NAME = 'fk_289bba3222'
+
+  disable_ddl_transaction!
+
+  def up
+    with_lock_retries do
+      remove_foreign_key_if_exists(
+        :deployments,
+        :clusters,
+        name: FK_NAME,
+        reverse_lock_order: true
+      )
+    end
+  end
+
+  def down
+    add_concurrent_foreign_key(
+      :deployments,
+      :clusters,
+      name: FK_NAME,
+      column: :cluster_id,
+      target_column: :id,
+      on_delete: :nullify
+    )
+  end
+end

db/schema_migrations/20220531024142

@@ -0,0 +1 @@
+d2f51bc463e31d4097c86232b85fff0c4cffe091aac23ba30b4b2851e12a253c

db/schema_migrations/20220531024143

@@ -0,0 +1 @@
+50839e8a00962e423093c9f80534efb1d11b750c11d0602537a83033d1c3638f

db/structure.sql

@@ -31291,6 +31291,8 @@ CREATE TRIGGER ci_pipelines_loose_fk_trigger AFTER DELETE ON ci_pipelines REFERE
 
 CREATE TRIGGER ci_runners_loose_fk_trigger AFTER DELETE ON ci_runners REFERENCING OLD TABLE AS old_table FOR EACH STATEMENT EXECUTE FUNCTION insert_into_loose_foreign_keys_deleted_records();
 
+CREATE TRIGGER clusters_loose_fk_trigger AFTER DELETE ON clusters REFERENCING OLD TABLE AS old_table FOR EACH STATEMENT EXECUTE FUNCTION insert_into_loose_foreign_keys_deleted_records();
+
 CREATE TRIGGER merge_requests_loose_fk_trigger AFTER DELETE ON merge_requests REFERENCING OLD TABLE AS old_table FOR EACH STATEMENT EXECUTE FUNCTION insert_into_loose_foreign_keys_deleted_records();
 
 CREATE TRIGGER namespaces_loose_fk_trigger AFTER DELETE ON namespaces REFERENCING OLD TABLE AS old_table FOR EACH STATEMENT EXECUTE FUNCTION insert_into_loose_foreign_keys_deleted_records();
@@ -31473,9 +31475,6 @@ ALTER TABLE ONLY ci_pipelines
 ALTER TABLE ONLY geo_event_log
     ADD CONSTRAINT fk_27548c6db3 FOREIGN KEY (hashed_storage_migrated_event_id) REFERENCES geo_hashed_storage_migrated_events(id) ON DELETE CASCADE;
 
-ALTER TABLE ONLY deployments
-    ADD CONSTRAINT fk_289bba3222 FOREIGN KEY (cluster_id) REFERENCES clusters(id) ON DELETE SET NULL;
-
 ALTER TABLE ONLY merge_requests_compliance_violations
     ADD CONSTRAINT fk_290ec1ab02 FOREIGN KEY (merge_request_id) REFERENCES merge_requests(id) ON DELETE CASCADE;
 

doc/api/broadcast_messages.md

@@ -205,7 +205,7 @@ Example response:
 
 Delete a broadcast message.
 
-```shell
+```plaintext
 DELETE /broadcast_messages/:id
 ```
 

doc/api/cluster_agents.md

@@ -95,7 +95,7 @@ Gets a single agent details.
 
 You must have at least the Developer role to use this endpoint.
 
-```shell
+```plaintext
 GET /projects/:id/cluster_agents/:agent_id
 ```
 
@@ -157,7 +157,7 @@ Registers an agent to the project.
 
 You must have at least the Maintainer role to use this endpoint.
 
-```shell
+```plaintext
 POST /projects/:id/cluster_agents
 ```
 
@@ -313,7 +313,7 @@ Gets a single agent token.
 
 You must have at least the Developer role to use this endpoint.
 
-```shell
+```plaintext
 GET /projects/:id/cluster_agents/:agent_id/tokens/:token_id
 ```
 
@@ -369,7 +369,7 @@ Creates a new token for an agent.
 
 You must have at least the Maintainer role to use this endpoint.
 
-```shell
+```plaintext
 POST /projects/:id/cluster_agents/:agent_id/tokens
 ```
 

doc/api/deploy_keys.md

@@ -225,8 +225,8 @@ curl --request DELETE --header "PRIVATE-TOKEN: <your_access_token>" "https://git
 
 Enables a deploy key for a project so this can be used. Returns the enabled key, with a status code 201 when successful.
 
-```shell
-curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/5/deploy_keys/13/enable"
+```plaintext
+POST /projects/:id/deploy_keys/:key_id/enable
 ```
 
 | Attribute | Type | Required | Description |
@@ -234,6 +234,10 @@ curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitla
 | `id`      | integer/string | yes | The ID or [URL-encoded path of the project](index.md#namespaced-path-encoding) owned by the authenticated user |
 | `key_id`  | integer | yes | The ID of the deploy key |
 
+```shell
+curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/5/deploy_keys/12/enable"
+```
+
 Example response:
 
 ```json

doc/api/group_protected_environments.md

@@ -28,7 +28,7 @@ Currently, these levels are recognized:
 
 Gets a list of protected environments from a group.
 
-```shell
+```plaintext
 GET /groups/:id/protected_environments
 ```
 
@@ -63,7 +63,7 @@ Example response:
 
 Gets a single protected environment.
 
-```shell
+```plaintext
 GET /groups/:id/protected_environments/:name
 ```
 
@@ -97,7 +97,7 @@ Example response:
 
 Protects a single environment.
 
-```shell
+```plaintext
 POST /groups/:id/protected_environments
 ```
 
@@ -137,7 +137,7 @@ Example response:
 
 Unprotects the given protected environment.
 
-```shell
+```plaintext
 DELETE /groups/:id/protected_environments/:name
 ```
 

doc/api/instance_clusters.md

@@ -221,7 +221,7 @@ Example response:
 
 Updates an existing instance cluster.
 
-```shell
+```plaintext
 PUT /admin/clusters/:cluster_id
 ```
 

doc/api/merge_trains.md

@@ -26,7 +26,7 @@ Read more on [pagination](index.md#pagination).
 
 Get all Merge Trains of the requested project:
 
-```shell
+```plaintext
 GET /projects/:id/merge_trains
 GET /projects/:id/merge_trains?scope=complete
 ```

doc/api/packages/conan.md

@@ -456,7 +456,7 @@ Download a recipe file to the package registry. You must use a download URL that
 [recipe download URLs endpoint](#recipe-download-urls)
 returned.
 
-```shell
+```plaintext
 GET packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/export/:file_name
 ```
 
@@ -489,7 +489,7 @@ Upload a recipe file to the package registry. You must use an upload URL that th
 [recipe upload URLs endpoint](#recipe-upload-urls)
 returned.
 
-```shell
+```plaintext
 GET packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/export/:file_name
 ```
 
@@ -518,7 +518,7 @@ Download a package file to the package registry. You must use a download URL tha
 [package download URLs endpoint](#package-download-urls)
 returned.
 
-```shell
+```plaintext
 GET packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/package/:conan_package_reference/:package_revision/:file_name
 ```
 
@@ -553,7 +553,7 @@ Upload a package file to the package registry. You must use an upload URL that t
 [package upload URLs endpoint](#package-upload-urls)
 returned.
 
-```shell
+```plaintext
 GET packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/package/:conan_package_reference/:package_revision/:file_name
 ```
 

doc/api/project_clusters.md

@@ -88,7 +88,7 @@ Example response:
 
 Gets a single project cluster.
 
-```shell
+```plaintext
 GET /projects/:id/clusters/:cluster_id
 ```
 
@@ -182,7 +182,7 @@ Example response:
 
 Adds an existing Kubernetes cluster to the project.
 
-```shell
+```plaintext
 POST /projects/:id/clusters/user
 ```
 
@@ -279,7 +279,7 @@ Example response:
 
 Updates an existing project cluster.
 
-```shell
+```plaintext
 PUT /projects/:id/clusters/:cluster_id
 ```
 

doc/api/protected_environments.md

@@ -34,7 +34,7 @@ The following types are recognized:
 
 Gets a list of protected environments from a project:
 
-```shell
+```plaintext
 GET /projects/:id/protected_environments
 ```
 
@@ -70,7 +70,7 @@ Example response:
 
 Gets a single protected environment:
 
-```shell
+```plaintext
 GET /projects/:id/protected_environments/:name
 ```
 
@@ -105,7 +105,7 @@ Example response:
 
 Protects a single environment:
 
-```shell
+```plaintext
 POST /projects/:id/protected_environments
 ```
 
@@ -170,7 +170,7 @@ Example response:
 
 Unprotects the given protected environment:
 
-```shell
+```plaintext
 DELETE /projects/:id/protected_environments/:name
 ```
 

doc/user/group/saml_sso/index.md

@@ -601,6 +601,10 @@ This can then be compared to the [NameID](#nameid) being sent by the identity pr
 
 ### Users receive a 404
 
+Because SAML SSO for groups is a paid feature, your subscription expiring can result in a `404` error when you're signing in using SAML SSO on GitLab.com.
+If all users are receiving a `404` when attempting to log in using SAML, confirm
+[there is an active subscription](../../../subscriptions/gitlab_com/index.md#view-your-gitlab-saas-subscription) being used in this SAML SSO namespace.
+
 If you receive a `404` during setup when using "verify configuration", make sure you have used the correct
 [SHA-1 generated fingerprint](../../../integration/saml.md#notes-on-configuring-your-identity-provider).
 

lib/api/helpers.rb

@@ -394,8 +394,7 @@ module API
     end
 
     def order_options_with_tie_breaker
-      order_by = if Feature.enabled?(:replace_order_by_created_at_with_id) &&
-                    params[:order_by] == 'created_at'
+      order_by = if params[:order_by] == 'created_at'
                    'id'
                  else
                    params[:order_by]

spec/lib/api/helpers_spec.rb

@@ -639,18 +639,6 @@ RSpec.describe API::Helpers do
       it 'converts to id' do
         is_expected.to eq({ 'id' => 'asc' })
       end
-
-      context 'when replace_order_by_created_at_with_id feature flag is disabled' do
-        before do
-          stub_feature_flags(replace_order_by_created_at_with_id: false)
-        end
-
-        include_examples '#order_options_with_tie_breaker'
-
-        it 'maintains created_at order' do
-          is_expected.to eq({ 'created_at' => 'asc', 'id' => 'asc' })
-        end
-      end
     end
   end
 

spec/models/clusters/cluster_spec.rb

@@ -50,6 +50,10 @@ RSpec.describe Clusters::Cluster, :use_clean_rails_memory_store_caching do
   it { is_expected.to respond_to :project }
   it { is_expected.to be_namespace_per_environment }
 
+  it_behaves_like 'it has loose foreign keys' do
+    let(:factory_name) { :cluster }
+  end
+
   describe 'applications have inverse_of: :cluster option' do
     let(:cluster) { create(:cluster) }
     let!(:helm) { create(:clusters_applications_helm, cluster: cluster) }

spec/models/deployment_spec.rb

@@ -1419,4 +1419,11 @@ RSpec.describe Deployment do
       end
     end
   end
+
+  context 'loose foreign key on deployments.cluster_id' do
+    it_behaves_like 'cleanup by a loose foreign key' do
+      let!(:parent) { create(:cluster) }
+      let!(:model) { create(:deployment, cluster: parent) }
+    end
+  end
 end

spec/models/project_spec.rb

@@ -4739,8 +4739,7 @@ RSpec.describe Project, factory_default: :keep do
     shared_examples 'filter respects visibility' do
       it 'respects visibility' do
         enable_admin_mode!(user) if admin_mode
-        project.update!(visibility_level: Gitlab::VisibilityLevel.level_value(project_level.to_s))
-        update_feature_access_level(project, feature_access_level)
+        update_feature_access_level(project, feature_access_level, visibility_level: Gitlab::VisibilityLevel.level_value(project_level.to_s))
 
         expected_objects = expected_count == 1 ? [project] : []
 

spec/policies/blob_policy_spec.rb

@@ -20,8 +20,11 @@ RSpec.describe BlobPolicy do
   with_them do
     it 'grants permission' do
       enable_admin_mode!(user) if admin_mode
-      project.update!(visibility_level: Gitlab::VisibilityLevel.level_value(project_level.to_s))
-      update_feature_access_level(project, feature_access_level)
+      update_feature_access_level(
+        project,
+        feature_access_level,
+        visibility_level: Gitlab::VisibilityLevel.level_value(project_level.to_s)
+      )
 
       if expected_count == 1
         expect(policy).to be_allowed(:read_blob)

spec/support/helpers/project_helpers.rb

@@ -17,12 +17,12 @@ module ProjectHelpers
     end
   end
 
-  def update_feature_access_level(project, access_level)
+  def update_feature_access_level(project, access_level, additional_params = {})
     features = ProjectFeature::FEATURES.dup
     features.delete(:pages)
     params = features.each_with_object({}) { |feature, h| h["#{feature}_access_level"] = access_level }
 
-    project.update!(params)
+    project.update!(params.merge(additional_params))
   end
 
   def create_project_with_statistics(namespace = nil, with_data: false, size_multiplier: 1)